Function at 0xa6c7d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xafd33d
mov eax, dword fs:[0]
push eax
sub esp, 0x640
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x524], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x498], esi
mov dword [ebp - 0x4a0], edi
mov ecx, dword [edi + 0x108]
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b0], 0
test ecx, ecx
js 0xa6cae5
mov eax, dword [ebx + 0x24]
test eax, eax
je 0xa6c847
mov edx, dword [eax]
jmp 0xa6c849
xor edx, edx
cmp ecx, edx
jge 0xa6cae5
mov eax, dword [eax + 4]
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0x4b0], ecx
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
cmp esi, 0xa452e0
jne 0xa6c88c
or dword [eax + 0x18], 1
jmp 0xa6c899
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [edi], 1
jne 0xa6cadf
mov eax, dword [ebx + 0x14]
xor ecx, ecx
mov dword [ebp - 0x494], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xa6c8de
mov eax, dword [edx]
mov esi, dword [eax + 0x18]
cmp esi, fcn.00a72140
jne 0xa6c8c6
mov ecx, dword [edx + 0x2c]
jmp 0xa6c8de
lea eax, [ebp - 0x494]
mov ecx, esi
push eax
push edx
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x494]
test cl, 2
je 0xa6cadf
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x3dc]
test ecx, ecx
je 0xa6c9e5
mov eax, dword [ecx]
mov esi, dword [eax + 0x24]
cmp esi, fcn.00a72060
jne 0xa6c9c6
mov eax, dword [ecx + 0x694]
mov edi, 1
cmp dword [eax], 0
je 0xa6c9dd
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0x694]
mov ecx, dword [ebp - 0x4e0]
mov edi, dword [eax]
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x484], esi
test ecx, ecx
je 0xa6c96b
mov dword [ebp - 0x4e0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x484]
lea eax, [ebp - 0x4e0]
mov ecx, esi
push eax
push 0x10
push dword [ebp - 0x4b0]
push edi
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
js 0xa6c994
cmp dword [ebp - 0x4e0], 0
jne 0xa6c999
mov edi, 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4e0]
test ecx, ecx
je 0xa6c9dd
mov dword [ebp - 0x4e0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xa6c9dd
push 0
push 0x10
push dword [ebp - 0x4b0]
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
je 0xa6e8b0
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x3dc]
test ecx, ecx
je 0xa6cadf
mov eax, dword [ecx]
mov esi, dword [eax + 0x24]
cmp esi, fcn.00a72060
jne 0xa6cac0
mov eax, dword [ecx + 0x694]
mov edi, 1
cmp dword [eax], 0
je 0xa6cad7
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 4], edi
mov eax, dword [ecx + 0x694]
mov ecx, dword [ebp - 0x4a4]
mov edi, dword [eax]
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x484], esi
test ecx, ecx
je 0xa6ca65
mov dword [ebp - 0x4a4], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x484]
lea eax, [ebp - 0x4a4]
mov ecx, esi
push eax
push 0x13
push dword [ebp - 0x4b0]
push edi
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
js 0xa6ca8e
cmp dword [ebp - 0x4a4], 0
jne 0xa6ca93
mov edi, 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4a4]
test ecx, ecx
je 0xa6cad7
mov dword [ebp - 0x4a4], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xa6cad7
push 0
push 0x13
push dword [ebp - 0x4b0]
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
je 0xa6e8b0
mov esi, dword [ebp - 0x498]
mov edi, dword [ebp - 0x4a0]
lea eax, [ebp - 0x540]
push eax
push dword [ebp - 0x4b8]
mov ecx, ebx
push 1
push edi
call fcn.00a6c380
lea eax, [ebp - 0x540]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00a69624
lea eax, [ebp - 0x540]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00a69689
push ecx
lea eax, [ebp - 0x540]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00ae9b39
cmp byte [ebp - 0x53f], 0
je 0xa6cb7b
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x120]
cmp eax, 5
je 0xa6cb5b
cmp eax, 4
je 0xa6cb5b
dec eax
neg eax
sbb eax, eax
and eax, 0xffffff
jmp 0xa6cb63
push 8
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push dword [edi + 0x124]
lea edx, [edi + 4]
mov ecx, esi
push eax
push 0xff
call fcn.00a7982a
lea eax, [ebp - 0x540]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00a69880
cmp dword [edi + 0xf8], 0
je 0xa6cbfa
mov eax, dword [ebx + 0x14]
lea edx, [edi + 0xd4]
mov ecx, esi
push dword [eax + 0x128]
push 0xff0072ff
push 0xff
call fcn.00a369e2
mov ecx, dword [ebx + 0x14]
lea edx, [ebp - 0x488]
mov al, byte [edi + 0x138]
push edx
mov edx, dword [edi + 0x128]
push eax
lea eax, [ecx + 0x1c]
neg ecx
sbb ecx, ecx
and ecx, eax
call fcn.00a409df
mov eax, dword [ebx + 0x14]
lea edx, [edi + 0xc4]
mov ecx, esi
push dword [eax + 0x128]
push 0xff0072ff
push dword [ebp - 0x488]
call fcn.00a369e2
mov edi, dword [ebx + 0x14]
xor eax, eax
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x48c], eax
mov ecx, dword [edi + 0x34]
test ecx, ecx
je 0xa6cc4b
mov eax, dword [ecx]
mov esi, dword [eax + 0x18]
cmp esi, fcn.00a72140
jne 0xa6cc2a
mov eax, dword [ecx + 0x2c]
mov dword [ebp - 0x48c], eax
jmp 0xa6cc45
lea eax, [ebp - 0x48c]
push eax
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, dword [ebx + 0x14]
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x4cc], edi
mov esi, dword [ebp - 0x4a0]
mov ecx, dword [esi]
mov dword [ebp - 0x484], ecx
test al, 2
jne 0xa6cc7c
cmp ecx, 1
jne 0xa6cc6b
cmp dword [ebp - 0x4b8], 0
jne 0xa6cc70
cmp ecx, 3
jne 0xa6cc7c
mov dword [ebp - 0x4c8], 1
jmp 0xa6cc86
mov dword [ebp - 0x4c8], 0
mov ecx, dword [edi + 0x30]
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x508], 0
test ecx, ecx
je 0xa6ccd4
mov eax, dword [ecx]
mov esi, dword [eax + 0x68]
lea eax, [ebp - 0x50c]
push eax
cmp esi, fcn.00a72160
jne 0xa6ccc7
mov ecx, dword [ecx + 0x30]
xor edx, edx
shr ecx, 4
and cl, 1
call fcn.00a72190
jmp 0xa6ccd4
push 0
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [edi + 0x158]
mov esi, dword [0xc940d0]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x488], eax
mov eax, 1
cmp esi, 0xffffffff
jne 0xa6cd2c
push 0x9ee990
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xa6cd21
push 0x9ee97c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xc940d0], esi
jmp 0xa6cd27
mov esi, dword [0xc940d0]
mov eax, 1
test esi, esi
je 0xa6cd3a
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [0xc940d4]
cmp ecx, 0xffffffff
je 0xa6cd4d
cmp dword [0xc958c4], eax
je 0xa6cd93
push 0
mov dword [0xc958c4], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xa6cd88
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xc940d4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xc940d4]
jmp 0xa6cd93
mov ecx, 0x60
mov dword [0xc940d4], ecx
push ecx
push 0x60
push dword [ebp - 0x488]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x494]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov esi, dword [0xc940d0]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x488], eax
mov eax, 1
cmp esi, 0xffffffff
jne 0xa6ce03
push 0x9ee990
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xa6cdf8
push 0x9ee97c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xc940d0], esi
jmp 0xa6cdfe
mov esi, dword [0xc940d0]
mov eax, 1
test esi, esi
je 0xa6ce11
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [0xc940d4]
cmp ecx, 0xffffffff
je 0xa6ce24
cmp dword [0xc958c4], eax
je 0xa6ce6a
push 0
mov dword [0xc958c4], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xa6ce5f
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xc940d4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xc940d4]
jmp 0xa6ce6a
mov ecx, 0x60
mov dword [0xc940d4], ecx
push ecx
push 0x60
push dword [ebp - 0x488]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x494]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov ecx, dword [edi + 0x34]
xor esi, esi
mov dword [ebp - 0x508], eax
mov eax, dword [edi + 0x118]
add eax, dword [edi + 0x108]
add eax, dword [ebp - 0x50c]
add eax, dword [edi + 0x74]
add eax, dword [edi + 0x78]
mov dword [ebp - 0x4bc], eax
xor eax, eax
mov dword [ebp - 0x49c], esi
mov dword [ebp - 0x520], eax
test ecx, ecx
je 0xa6cefc
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x488], eax
cmp eax, fcn.00a72140
jne 0xa6cee0
mov eax, dword [ecx + 0x2c]
mov dword [ebp - 0x520], eax
jmp 0xa6cefc
lea edx, [ebp - 0x520]
push edx
push ecx
mov ecx, eax
call dword [0xc99200]
call dword [ebp - 0x488]
mov eax, dword [ebp - 0x520]
test al, 2
jne 0xa6cf6a
mov eax, dword [ebp - 0x484]
cmp eax, 2
je 0xa6cf6a
cmp eax, 1
je 0xa6cf15
cmp eax, 3
jne 0xa6cf7c
lea eax, [ebp - 0x58c]
mov edx, 4
push eax
xor cl, cl
call fcn.00a72190
mov edi, dword [edi + 0x158]
mov edx, edi
mov ecx, dword [ebp - 0x58c]
push 2
call fcn.00a5bad0
mov ecx, dword [ebp - 0x588]
mov edx, edi
push 2
mov esi, eax
call fcn.00a5bad0
mov eax, dword [0xc95978]
lea esi, [esi + esi*4]
cmp esi, eax
jg 0xa6cf5c
mov esi, eax
sub esi, dword [ebp - 0x4bc]
mov edi, dword [ebp - 0x4cc]
jmp 0xa6cf76
mov esi, dword [edi + 0x68]
add esi, dword [edi + 0x64]
sub esi, dword [edi + 0x74]
sub esi, dword [edi + 0x78]
mov dword [ebp - 0x49c], esi
mov ecx, dword [edi + 0x34]
xor eax, eax
mov dword [ebp - 0x4a4], esi
mov dword [ebp - 0x51c], eax
test ecx, ecx
je 0xa6cfca
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x488], eax
cmp eax, fcn.00a72140
jne 0xa6cfae
mov eax, dword [ecx + 0x2c]
mov dword [ebp - 0x51c], eax
jmp 0xa6cfca
lea edx, [ebp - 0x51c]
push edx
push ecx
mov ecx, eax
call dword [0xc99200]
call dword [ebp - 0x488]
mov eax, dword [ebp - 0x51c]
test al, 2
je 0xa6d2d8
mov ecx, dword [edi + 0x34]
test ecx, ecx
je 0xa6d00c
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x488], eax
cmp eax, fcn.00a72570
jne 0xa6cff5
mov eax, dword [ecx + 0x44]
not eax
and eax, 1
jmp 0xa6d004
push ecx
mov ecx, eax
call dword [0xc99200]
call dword [ebp - 0x488]
test eax, eax
je 0xa6d2d8
lea eax, [ebp - 0x470]
push eax
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetParent]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowRect]
test eax, eax
je 0xa6d2d8
mov eax, dword [ebp - 0x464]
sub eax, dword [ebp - 0x46c]
mov ecx, dword [edi + 0x30]
mov dword [ebp - 0x4fc], eax
mov eax, dword [edi + 0x60]
add eax, dword [edi + 0x5c]
mov dword [ebp - 0x4b4], eax
mov eax, dword [edi + 0x104]
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x514], 0
mov dword [ebp - 0x510], 0
test ecx, ecx
je 0xa6d0b6
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x488], eax
cmp eax, fcn.00a72160
jne 0xa6d09e
mov ecx, dword [ecx + 0x30]
lea eax, [ebp - 0x514]
shr ecx, 4
mov edx, 4
push eax
and cl, 1
call fcn.00a72190
jmp 0xa6d0b6
lea edx, [ebp - 0x514]
push edx
push 4
push ecx
mov ecx, eax
call dword [0xc99200]
call dword [ebp - 0x488]
mov eax, dword [edi + 0x158]
mov edx, 1
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x488], eax
mov eax, dword [0xc940d0]
mov dword [ebp - 0x48c], eax
cmp eax, 0xffffffff
jne 0xa6d115
push 0x9ee990
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xa6d105
push 0x9ee97c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [0xc940d0], eax
jmp 0xa6d10a
mov eax, dword [0xc940d0]
mov edx, 1
mov dword [ebp - 0x48c], eax
test eax, eax
je 0xa6d129
mov ecx, eax
call dword [0xc99200]
call dword [ebp - 0x48c]
mov edx, eax
mov ecx, dword [0xc940d4]
cmp ecx, 0xffffffff
je 0xa6d13c
cmp dword [0xc958c4], edx
je 0xa6d191
push 0
mov dword [0xc958c4], edx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x494], eax
test eax, eax
je 0xa6d186
push 0x58
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push dword [ebp - 0x494]
mov dword [0xc940d4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push dword [ebp - 0x494]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xc940d4]
jmp 0xa6d191
mov ecx, 0x60
mov dword [0xc940d4], ecx
push ecx
push 0x60
push dword [ebp - 0x488]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x4c4]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov dword [ebp - 0x514], eax
mov edx, 1
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x488], eax
mov eax, dword [0xc940d0]
mov dword [ebp - 0x48c], eax
cmp eax, 0xffffffff
jne 0xa6d208
push 0x9ee990
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xa6d1f8
push 0x9ee97c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [0xc940d0], eax
jmp 0xa6d1fd
mov eax, dword [0xc940d0]
mov edx, 1
mov dword [ebp - 0x48c], eax
test eax, eax
je 0xa6d21c
mov ecx, eax
call dword [0xc99200]
call dword [ebp - 0x48c]
mov edx, eax
mov ecx, dword [0xc940d4]
cmp ecx, 0xffffffff
je 0xa6d22f
cmp dword [0xc958c4], edx
je 0xa6d284
push 0
mov dword [0xc958c4], edx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x494], eax
test eax, eax
je 0xa6d279
push 0x58
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push dword [ebp - 0x494]
mov dword [0xc940d4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push dword [ebp - 0x494]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xc940d4]
jmp 0xa6d284
mov ecx, 0x60
mov dword [0xc940d4], ecx
push ecx
push 0x60
push dword [ebp - 0x488]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x4c4]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov edx, dword [edi + 0x70]
add edx, dword [edi + 0x6c]
mov ecx, dword [ebp - 0x484]
add edx, eax
mov eax, ecx
mov dword [ebp - 0x510], edx
sub eax, dword [ebp - 0x4b4]
add ecx, edx
add eax, dword [ebp - 0x4fc]
cdq
idiv ecx
xor ecx, ecx
cmp eax, 1
setg cl
dec ecx
and dword [ebp - 0x4a4], ecx
push 0x2003
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
jne 0xa6d3ba
push 0x2004
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
jne 0xa6d3ba
lea edx, [ebp - 0x4d5]
lea ecx, [ebp - 0x4e4]
call fcn.00ac7c47
test eax, eax
js 0xa6d3ba
cmp dword [ebp - 0x4e4], 1
jne 0xa6d3ba
cmp byte [ebp - 0x4d5], 0
je 0xa6d3ba
lea eax, [ebp - 0x4a8]
mov edx, 0x9f0110
push eax
push ecx
push 0x9f0184
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00a41860
test eax, eax
js 0xa6d3ba
cmp dword [ebp - 0x4a8], 0
je 0xa6d3ba
mov ecx, 0xc97200
call fcn.00b63cff
test al, al
je 0xa6d3ba
push 1
mov edx, 0x9fa9f8
mov ecx, 0x9f02f0
call fcn.00a57919
cmp eax, 1
jne 0xa6d3ba
mov eax, dword [edi + 0x30]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x8c]
mov ecx, esi
call dword [0xc99200]
call esi
test al, al
jne 0xa6d3b4
mov edx, dword [edi + 0x158]
mov ecx, 0x10
push 0
call fcn.00a5bad0
mov esi, dword [ebp - 0x49c]
add esi, eax
jmp 0xa6d3ba
mov esi, dword [ebp - 0x49c]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x4e4], edx
sub eax, dword [edx + 0x118]
sub eax, dword [edx + 0x108]
add eax, esi
mov esi, dword [ebp - 0x4a0]
mov dword [ebp - 0x484], eax
sub eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x4c8], 0
mov ecx, dword [esi + 4]
mov edi, dword [esi + 8]
mov dword [ebp - 0x494], eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 0x10]
mov dword [ebp - 0x480], ecx
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x49c], esi
mov dword [ebp - 0x474], esi
jne 0xa6d522
cmp byte [ebp - 0x53a], 0
je 0xa6d522
mov esi, dword [ebp - 0x4a4]
test esi, esi
jle 0xa6d522
sub eax, dword [edx + 0x118]
sub eax, dword [edx + 0x108]
sub eax, ecx
sub eax, dword [ebp - 0x494]
cmp eax, esi
jge 0xa6d51c
mov ecx, dword [ebp - 0x4a0]
mov edi, esi
sub edi, eax
imul ebx, esi, 0x3e8
imul edi, dword [ecx + 0x134]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ecx + 8]
mov esi, ebx
imul eax, edi
sub esi, edi
imul ecx, esi
add eax, ecx
mov ecx, dword [ebp - 0x4a0]
cdq
idiv ebx
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x47c], eax
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 4]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, dword [ebp - 0x4a0]
cdq
idiv ebx
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x480], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0xc]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, dword [ebp - 0x4a0]
cdq
idiv ebx
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x478], eax
mov eax, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x10]
imul eax, edi
imul ecx, esi
mov edi, dword [ebp - 0x488]
add eax, ecx
mov ecx, dword [ebp - 0x4a8]
cdq
idiv ebx
mov ebx, dword [ebp - 0x524]
mov edx, dword [ebp - 0x4e4]
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x48c]
mov esi, dword [edx + 0x70]
mov dword [ebp - 0x4bc], esi
mov esi, dword [edx + 0x6c]
mov edx, dword [edx + 0x34]
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x528], 0
test edx, edx
je 0xa6d57a
mov eax, dword [edx]
mov esi, dword [eax + 0x18]
lea eax, [ebp - 0x528]
push eax
push edx
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x474]
mov edi, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x480]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x478]
test byte [ebp - 0x528], 2
jne 0xa6d62f
cmp dword [ebp - 0x4c8], 0
je 0xa6d62f
mov esi, dword [ebp - 0x4a0]
cmp dword [esi + 0xf4], 0
je 0xa6d61e
mov edx, eax
sub edx, ecx
cmp dword [ebp - 0x484], edx
jle 0xa6d61e
mov eax, dword [ebx + 0x14]
mov edi, eax
push dword [ebp - 0x4a4]
sub edx, dword [ebp - 0x494]
push edx
mov ecx, dword [eax + 0x64]
sub ecx, dword [eax + 0x74]
mov esi, dword [edi + 0x74]
push ecx
mov dword [ebp - 0x4a8], edx
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push dword [ebp - 0x4a4]
mov ecx, dword [edi + 0x68]
add eax, esi
push dword [ebp - 0x4a8]
sub ecx, dword [edi + 0x78]
mov esi, dword [ebx + 0x14]
push ecx
mov dword [ebp - 0x490], eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
add eax, dword [esi + 0x78]
mov edx, dword [ebp - 0x474]
mov edi, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x480]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x478]
jmp 0xa6d64a
mov esi, dword [ebx + 0x14]
mov edx, dword [esi + 0x68]
mov dword [ebp - 0x48c], edx
mov edx, dword [esi + 0x64]
jmp 0xa6d63e
mov esi, dword [ebx + 0x14]
mov edx, dword [esi + 0x78]
mov dword [ebp - 0x48c], edx
mov edx, dword [esi + 0x74]
mov dword [ebp - 0x490], edx
mov edx, dword [ebp - 0x49c]
sub eax, dword [ebp - 0x48c]
mov ebx, eax
sub ebx, dword [ebp - 0x490]
sub ebx, ecx
mov dword [ebp - 0x500], ebx
mov ebx, edx
sub ebx, dword [ebp - 0x4c4]
sub ebx, dword [ebp - 0x4bc]
sub ebx, edi
cmp dword [ebp - 0x500], 0
mov dword [ebp - 0x4d4], ebx
mov ebx, dword [ebp - 0x524]
jle 0xa6e8b0
cmp dword [ebp - 0x4d4], 0
jle 0xa6e8b0
add ecx, dword [ebp - 0x490]
add edi, dword [ebp - 0x4c4]
sub edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x478], eax
xor eax, eax
mov dword [ebp - 0x480], ecx
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], eax
mov ecx, dword [esi + 0x30]
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x4cc], eax
mov dword [ebp - 0x494], eax
test ecx, ecx
je 0xa6d713
mov eax, dword [ecx]
mov esi, dword [eax + 0x68]
lea eax, [ebp - 0x4f0]
push eax
push 0
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x4f0]
mov esi, dword [ebx + 0x14]
mov dword [ebp - 0x494], eax
mov eax, dword [esi + 0x158]
mov edi, 1
mov esi, dword [0xc940d0]
mov dword [ebp - 0x4c0], eax
cmp esi, 0xffffffff
jne 0xa6d75a
push 0x9ee990
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xa6d754
push 0x9ee97c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xc940d0], esi
jmp 0xa6d75a
mov esi, dword [0xc940d0]
test esi, esi
je 0xa6d76a
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, eax
mov ecx, dword [0xc940d4]
cmp ecx, 0xffffffff
je 0xa6d77d
cmp dword [0xc958c4], edi
je 0xa6d7c4
push 0
mov dword [0xc958c4], edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xa6d7b9
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xc940d4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xc940d4]
jmp 0xa6d7c4
mov ecx, 0x60
mov dword [0xc940d4], ecx
push ecx
push 0x60
push dword [ebp - 0x494]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x4c0]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov esi, dword [0xc940d0]
mov edi, 1
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x4a8], eax
cmp esi, 0xffffffff
jne 0xa6d82f
push 0x9ee990
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xa6d829
push 0x9ee97c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xc940d0], esi
jmp 0xa6d82f
mov esi, dword [0xc940d0]
test esi, esi
je 0xa6d83f
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, eax
mov ecx, dword [0xc940d4]
cmp ecx, 0xffffffff
je 0xa6d852
cmp dword [0xc958c4], edi
je 0xa6d899
push 0
mov dword [0xc958c4], edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xa6d88e
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xc940d4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xc940d4]
jmp 0xa6d899
mov ecx, 0x60
mov dword [0xc940d4], ecx
push ecx
push 0x60
push dword [ebp - 0x4a8]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x4c0]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov esi, dword [ebp - 0x4f0]
mov edi, dword [ebp - 0x500]
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x49c], esi
cmp edi, esi
jl 0xa6d8e1
cmp dword [ebp - 0x4d4], eax
jge 0xa6d955
push dword [ebp - 0x474]
push dword [ebp - 0x478]
push dword [ebp - 0x47c]
push dword [ebp - 0x480]
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov dword [ebp - 0x4c4], eax
test eax, eax
je 0xa6d955
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
push dword [ebp - 0x498]
mov dword [ebp - 0x4cc], eax
call dword [sym.imp.GDI32.dll_GetClipRgn]
test eax, eax
jne 0xa6d943
mov eax, dword [ebp - 0x4cc]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
mov dword [ebp - 0x4cc], eax
push dword [ebp - 0x4c4]
push dword [ebp - 0x498]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
cmp dword [ebp - 0x4c8], 0
je 0xa6da3e
mov ecx, dword [ebx + 0x18]
push 0x104
mov eax, dword [ecx]
mov esi, dword [eax + 0x2c]
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x4b8]
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jns 0xa6d996
cmp eax, 0x8007007a
jne 0xa6da38
xor eax, eax
mov dword [ebp - 0x64c], 0x40
push 0x3c
push eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x648]
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x648], 0x2200
lea ecx, [ebp - 0x540]
call fcn.00bdcd86
lea ecx, [ebp - 0x64c]
push ecx
lea ecx, [ebp - 0x450]
push ecx
push 0x8c24
push 0xffffffffffffffff
lea ecx, [ebp - 0x420]
push ecx
push eax
mov eax, dword [ebx + 0x14]
push 5
push dword [ebp - 0x498]
push dword [eax + 0x38]
call dword [sym.imp.UxTheme.dll_DrawThemeTextEx]
mov eax, dword [ebp - 0x448]
xor ecx, ecx
sub eax, dword [ebp - 0x450]
mov esi, dword [ebp - 0x49c]
add eax, 4
add eax, esi
cmp eax, edi
setle cl
mov dword [ebp - 0x4c8], ecx
jmp 0xa6da3e
mov esi, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x518]
sub eax, dword [ebp - 0x474]
add eax, dword [ebp - 0x47c]
cdq
sub eax, edx
sar eax, 1
push eax
push 0
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_InflateRect]
cmp dword [ebp - 0x4c8], 0
jne 0xa6da9d
mov ecx, dword [ebp - 0x478]
mov eax, ecx
mov edx, dword [ebp - 0x480]
sub eax, edx
cmp eax, esi
jle 0xa6da9d
mov eax, esi
sub eax, ecx
add eax, edx
cdq
sub eax, edx
push 0
sar eax, 1
push eax
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_InflateRect]
mov eax, dword [ebp - 0x4a0]
mov ecx, dword [eax + 0x108]
mov eax, dword [ebx + 0x24]
test eax, eax
je 0xa6dab4
mov eax, dword [eax]
jmp 0xa6dab6
xor eax, eax
xor edi, edi
test ecx, ecx
js 0xa6dade
cmp ecx, eax
jge 0xa6dade
lfence
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, eax
cmp dword [ebx + 0x28], 0
mov dword [ebp - 0x490], 0
jne 0xa6db59
mov eax, dword [ebx + 0x24]
test eax, eax
je 0xa6db21
mov eax, dword [eax]
cmp eax, 1
jle 0xa6db05
test byte [ebx + 0x30], 0x10
je 0xa6db07
cmp eax, 1
jne 0xa6db10
mov dword [ebx + 0x28], 1
jmp 0xa6db59
jle 0xa6db21
test byte [ebx + 0x30], 0x10
je 0xa6db21
mov dword [ebx + 0x28], 3
jmp 0xa6db59
mov eax, dword [ebx + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x60]
mov ecx, esi
call dword [0xc99200]
call esi
test al, 2
jne 0xa6db52
test byte [ebx + 0x30], 0x20
jne 0xa6db52
mov ecx, ebx
call fcn.00a489a8
test eax, eax
je 0xa6db59
mov dword [ebx + 0x28], 2
jmp 0xa6db59
mov dword [ebx + 0x28], 4
cmp dword [ebx + 0x28], 1
jne 0xa6dba0
mov eax, dword [ebx + 0x14]
xor ecx, ecx
mov dword [ebp - 0x4fc], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xa6db8e
mov eax, dword [edx]
mov esi, dword [eax + 0x18]
lea eax, [ebp - 0x4fc]
push eax
push edx
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x4fc]
test cl, 2
jne 0xa6dba0
mov edx, edi
mov dword [ebp - 0x490], edx
jmp 0xa6dc75
cmp dword [ebx + 0x28], 0
jne 0xa6dc11
mov eax, dword [ebx + 0x24]
test eax, eax
je 0xa6dbd9
mov eax, dword [eax]
cmp eax, 1
jle 0xa6dbbd
test byte [ebx + 0x30], 0x10
je 0xa6dbbf
cmp eax, 1
jne 0xa6dbc8
mov dword [ebx + 0x28], 1
jmp 0xa6dc11
jle 0xa6dbd9
test byte [ebx + 0x30], 0x10
je 0xa6dbd9
mov dword [ebx + 0x28], 3
jmp 0xa6dc11
mov eax, dword [ebx + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x60]
mov ecx, esi
call dword [0xc99200]
call esi
test al, 2
jne 0xa6dc0a
test byte [ebx + 0x30], 0x20
jne 0xa6dc0a
mov ecx, ebx
call fcn.00a489a8
test eax, eax
je 0xa6dc11
mov dword [ebx + 0x28], 2
jmp 0xa6dc11
mov dword [ebx + 0x28], 4
cmp dword [ebx + 0x28], 2
je 0xa6dc73
mov eax, dword [ebx + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x74]
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xa6dc73
mov eax, dword [ebx + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x48]
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xa6dc73
mov edx, edi
mov dword [ebp - 0x490], edx
test edi, edi
jne 0xa6dc75
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xc99200]
call esi
mov edx, eax
mov dword [ebp - 0x490], edx
jmp 0xa6dc75
xor edx, edx
mov ecx, dword [ebx + 0x14]
mov edi, dword [ebx + 0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x4a8], eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
cmp esi, fcn.00a5b040
jne 0xa6dd28
mov dword [ebp - 0x4d0], 0xfffffffe
mov eax, dword [edi]
mov esi, dword [eax + 0x38]
lea eax, [ebp - 0x4d0]
push eax
push edx
push edi
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
jns 0xa6dcd2
mov ecx, dword [ebp + 4]
mov edx, 0x245
push esi
push 0x9fd1e8
call fcn.00aa4c55
jmp 0xa6dd40
cmp dword [ebp - 0x4d0], 0xfffffffe
jne 0xa6dcf0
push dword [ebp - 0x490]
mov ecx, dword [ebp - 0x4a8]
add ecx, 0xffffffdc
push edi
call fcn.00a5bcb3
mov eax, dword [edi]
mov esi, dword [eax + 0x38]
lea eax, [ebp - 0x4d0]
push eax
push dword [ebp - 0x490]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
jns 0xa6dd48
mov ecx, dword [ebp + 4]
mov edx, 0x252
push esi
push 0x9fd1e8
call fcn.00aa4c55
jmp 0xa6dd40
lea ecx, [ebp - 0x4d0]
push ecx
push 0
push edx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
js 0xa6e6ca
cmp dword [ebp - 0x4d0], 0xfffffffe
je 0xa6e6ca
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov esi, dword [eax + 0x14]
cmp esi, 0xa76a50
jne 0xa6dd82
mov dword [ebp - 0x4f8], 0
mov ecx, dword [ecx + 0x58]
test ecx, ecx
je 0xa6e6ca
mov eax, dword [ecx]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 0x4f8]
push eax
push dword [ebp - 0x4c0]
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
js 0xa6e6ca
mov dword [ebp - 0x490], 0
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x490]
test ecx, ecx
je 0xa6ddd7
mov dword [ebp - 0x490], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc94f7c]
mov edi, dword [ebp - 0x4f8]
cmp esi, 0xffffffff
jne 0xa6ddfd
mov edx, 0x9fdf34
mov ecx, 0xc94f7c
call fcn.00a4ba6c
mov esi, dword [0xc94f7c]
test esi, esi
je 0xa6e69f
lea eax, [ebp - 0x490]
mov ecx, esi
push eax
push 0x9f08b8
push edi
call dword [0xc99200]
call esi
test eax, eax
js 0xa6e69f
push 0x40
lea eax, [ebp - 0x580]
mov dword [ebp - 0x584], 0x44
push 0
push eax
call fcn.00ab4bf6
mov eax, dword [ebp - 0x4f8]
add esp, 0xc
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x55c], 0xff000000
mov dword [ebp - 0x558], 0xff000000
mov dword [ebp - 0x554], 0xa001
cmp eax, ecx
jge 0xa6dedc
or dword [ebp - 0x54c], 8
push ecx
push eax
push 0xff
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
jmp 0xa6df6f
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [ebp - 0x518]
cmp eax, ecx
jl 0xa6dec3
mov edi, ebx
lea eax, [ebx + 8]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x3dc]
test ecx, ecx
je 0xa6df22
mov eax, dword [ecx]
mov esi, dword [eax + 0x24]
lea eax, [ebp - 0x4dc]
push eax
push 0
push edi
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xa6df4d
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x3dc]
test ecx, ecx
je 0xa6df55
mov eax, dword [ecx]
mov esi, dword [eax + 0x24]
lea eax, [ebp - 0x4dc]
push eax
push 1
push edi
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xa6df55
mov eax, dword [ebp - 0x4dc]
jmp 0xa6df68
mov eax, dword [ebp - 0x4a0]
mov al, byte [eax + 0x100]
cmp al, 0xff
je 0xa6df75
movzx eax, al
or dword [ebp - 0x54c], 8
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x490]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x20]
lea ecx, [ebp - 0x584]
push ecx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
cmp eax, 0x8000000a
jne 0xa6dfbd
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 0x4d0]
push eax
push 1
push 0
push dword [ebx + 0x18]
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
test byte [ebp - 0x54c], 8
jne 0xa6e69f
mov eax, dword [ebx + 0x14]
xor ecx, ecx
mov dword [ebp - 0x4b4], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xa6dff9
mov eax, dword [edx]
mov esi, dword [eax + 0x18]
lea eax, [ebp - 0x4b4]
push eax
push edx
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x4b4]
test cl, 0x10
jne 0xa6e69f
mov eax, dword [ebx + 0x14]
xor ecx, ecx
mov dword [ebp - 0x484], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xa6e031
mov eax, dword [edx]
mov esi, dword [eax + 0x18]
lea eax, [ebp - 0x484]
push eax
push edx
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x484]
test ecx, 0x1000
jne 0xa6e69f
mov edi, dword [ebp - 0x4b0]
test edi, edi
je 0xa6e061
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x30]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
jne 0xa6e18f
mov ecx, dword [ebp - 0x4b8]
test ecx, ecx
je 0xa6e089
mov eax, dword [ecx]
mov esi, dword [eax + 0xb8]
cmp esi, fcn.00a437f0
jne 0xa6e083
mov esi, dword [ecx + 0x68]
jmp 0xa6e187
push ecx
jmp 0xa6e17b
mov edx, dword [ebx + 0x18]
mov dword [ebp - 0x4a8], edx
mov eax, dword [edx]
mov esi, dword [eax + 0x84]
cmp esi, 0xa43710
jne 0xa6e17a
mov eax, dword [edx + 0x10]
xor esi, esi
mov dword [ebp - 0x4e4], esi
test eax, eax
je 0xa6e0b9
mov eax, dword [eax]
jmp 0xa6e0bb
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4d4], ecx
test eax, eax
jle 0xa6e187
xor ebx, ebx
mov eax, dword [edx + 0x10]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x484], eax
test ebx, ebx
je 0xa6e124
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 0xc0]
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, eax
mov eax, dword [ebp - 0x484]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc0]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x4d4]
cmp edi, eax
jae 0xa6e126
mov eax, dword [ebp - 0x484]
mov ebx, eax
mov edx, dword [ebp - 0x4a8]
inc ecx
mov dword [ebp - 0x4d4], ecx
cmp ecx, dword [ebp - 0x4b4]
jl 0xa6e0d3
mov dword [ebp - 0x484], ebx
test ebx, ebx
mov ebx, dword [ebp - 0x524]
je 0xa6e16c
mov ecx, dword [ebp - 0x484]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0xb8]
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, dword [ebp - 0x4b0]
jmp 0xa6e185
mov esi, dword [ebp - 0x4e4]
mov edi, dword [ebp - 0x4b0]
jmp 0xa6e187
push edx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
je 0xa6e244
mov dword [ebp - 0x4dc], 0xff
test edi, edi
je 0xa6e1cd
mov eax, dword [ebx + 0x14]
lea ecx, [ebp - 0x4dc]
push ecx
push 0x1e
add eax, 0x1c
push edi
push eax
call fcn.00a40300
test eax, eax
je 0xa6e1cd
mov eax, dword [ebx + 0x14]
lea ecx, [ebp - 0x4dc]
push ecx
push 0x1f
add eax, 0x1c
push edi
push eax
call fcn.00a40300
lea eax, [ebp - 0x5cc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0xa6e244
mov eax, dword [ebx + 0x14]
push dword [eax + 0x158]
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetricsForDpi]
push dword [ebp - 0x4dc]
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebp - 0x49c]
push esi
push eax
mov ecx, dword [ecx + 0x11c]
sub ecx, eax
push eax
mov eax, dword [ebp - 0x518]
add edx, ecx
add edx, dword [ebp - 0x480]
add eax, ecx
add eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x498]
push eax
call fcn.00bc6a8f
push dword [ebp - 0x5bc]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x5c0]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x4ac], 0
mov edx, dword [ebp - 0x4b8]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x4ac]
test edx, edx
jne 0xa6e2e3
mov edi, dword [ebx + 0x18]
mov eax, dword [edi]
mov esi, dword [eax + 0xac]
mov dword [ebp - 0x4a8], esi
test ecx, ecx
je 0xa6e297
mov dword [ebp - 0x4ac], edx
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x4a8]
cmp esi, 0xa44960
jne 0xa6e2c3
mov ecx, dword [edi + 0x48]
test ecx, ecx
je 0xa6e2b9
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [edi + 0x48]
mov dword [ebp - 0x4ac], ecx
xor eax, eax
jmp 0xa6e2d5
lea eax, [ebp - 0x4ac]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xa6e347
mov edx, 0xd90
jmp 0xa6e33c
mov eax, dword [edx]
mov edi, dword [eax + 0xfc]
test ecx, ecx
je 0xa6e30f
mov dword [ebp - 0x4ac], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov edx, dword [ebp - 0x4b8]
lea eax, [ebp - 0x4ac]
push eax
push edx
cmp edi, fcn.00a3acd0
jne 0xa6e326
call fcn.00a3acd0
jmp 0xa6e330
mov ecx, edi
call dword [0xc99200]
call edi
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xa6e347
mov edx, 0xd95
push eax
push 0x9fd480
call fcn.00ab606d
cmp dword [ebp - 0x4ac], 0
je 0xa6e677
mov dword [ebp - 0x504], 0
lea eax, [ebp - 0x5b8]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.00a3a69c
mov ecx, dword [ebx + 0x14]
lea eax, [ebp - 0x52c]
push eax
lea edx, [ebp - 0x4e8]
mov ecx, dword [ecx + 0x120]
call fcn.00a792cf
lea ecx, [ebp - 0x504]
call fcn.00a3786d
fld dword [ebp - 0x52c]
lea eax, [ebp - 0x504]
mov ecx, dword [ebp - 0x4ac]
lea edx, [ebp - 0x5b8]
push eax
sub esp, 0xc
fstp dword [esp + 4]
fld dword [ebp - 0x4e8]
fstp dword [esp]
call fcn.00a3755a
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xa6e3e0
push eax
push 0x9fd480
mov edx, 0xda0
call fcn.00ab606d
jmp 0xa6e668
mov ecx, dword [ebx + 0x14]
mov edi, dword [ecx + 0x30]
mov eax, dword [edi]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ecx + 0x158]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebx + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x4c]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x4e8]
lea ecx, [ebp - 0x4bc]
push ecx
push dword [ebp - 0x484]
push dword [ebp - 0x4b4]
push eax
push edi
cmp esi, fcn.00a345d0
jne 0xa6e446
call fcn.00a345d0
jmp 0xa6e450
mov ecx, esi
call dword [0xc99200]
call esi
cmp eax, 0x8000000a
je 0xa6e668
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xa6e477
push eax
push 0x9fd480
mov edx, 0xda5
call fcn.00ab606d
jmp 0xa6e668
lea eax, [ebp - 0x5ac]
push eax
push 0x18
push dword [ebp - 0x4bc]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0xa6e668
mov eax, dword [ebx + 0x14]
mov ecx, 4
push 0
mov edx, dword [eax + 0x158]
call fcn.00a5bad0
cmp dword [ebp - 0x4c8], 0
mov ecx, eax
mov edi, dword [ebp - 0x5a8]
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x424], eax
je 0xa6e54d
mov eax, dword [ebx + 0x14]
mov ecx, 4
push 0
mov edx, dword [eax + 0x158]
call fcn.00a5bad0
mov esi, dword [ebp - 0x4a0]
cdq
sub eax, edx
mov edx, dword [ebp - 0x428]
sar eax, 1
sub eax, dword [ebp - 0x5a8]
add eax, dword [ebp - 0x4f0]
add eax, dword [ebp - 0x480]
mov esi, dword [esi + 0x10]
mov ecx, eax
sub esi, dword [ebp - 0x5a4]
sub ecx, dword [ebp - 0x430]
sub esi, dword [ebp - 0x4e8]
add edx, ecx
mov dword [ebp - 0x430], eax
mov eax, esi
sub eax, dword [ebp - 0x42c]
add dword [ebp - 0x424], eax
jmp 0xa6e588
mov esi, dword [ebp - 0x4a0]
mov esi, dword [esi + 0x10]
sub esi, eax
mov eax, edi
cdq
sub esi, ecx
mov ecx, dword [ebp - 0x4f0]
sub eax, edx
sar eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x480]
add eax, ecx
mov dword [ebp - 0x430], eax
lea edx, [eax + edi]
mov eax, dword [ebp - 0x5a4]
add eax, esi
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x428], edx
mov eax, dword [eax + 0xc]
cmp edx, eax
jle 0xa6e5b3
sub eax, edx
push 0
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_OffsetRect]
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x4f4], eax
mov byte [ebp - 4], 5
test eax, eax
je 0xa6e64b
push dword [ebp - 0x4bc]
mov dword [ebp - 0x594], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
mov dword [ebp - 0x590], edi
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x424]
mov esi, dword [ebp - 0x42c]
sub edx, esi
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x430]
sub eax, ecx
mov dword [ebp - 0x4c0], 0x1ff0000
push dword [ebp - 0x4c0]
push edx
push eax
push 0
push 0
push dword [ebp - 0x4f4]
push edx
push eax
push esi
push ecx
push dword [ebp - 0x498]
call dword [sym.imp.ext_ms_win_gdi_draw_l1_1_1.dll_GdiAlphaBlend]
push edi
mov byte [ebp - 4], 5
push dword [ebp - 0x4f4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x4f4]
mov byte [ebp - 4], 7
mov dword [ebp - 0x4f4], 0
test eax, eax
je 0xa6e664
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x504]
mov byte [ebp - 4], 3
call fcn.00a3786d
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4ac]
test ecx, ecx
je 0xa6e69f
mov dword [ebp - 0x4ac], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x490]
test ecx, ecx
je 0xa6e6ca
mov dword [ebp - 0x490], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x500]
add edi, 4
sub eax, edi
test eax, eax
jle 0xa6e880
cmp dword [ebp - 0x4c8], 0
je 0xa6e880
mov eax, dword [ebx + 0x14]
mov esi, dword [ebp - 0x4b8]
add eax, 0x1c
push 0
push 0x13
push esi
push eax
call fcn.00a40300
test eax, eax
je 0xa6e880
mov eax, dword [ebx + 0x14]
push 0
push 0x15
add eax, 0x1c
push esi
push eax
call fcn.00a40300
test eax, eax
je 0xa6e880
mov ecx, dword [ebx + 0x18]
push 0x104
mov eax, dword [ecx]
mov esi, dword [eax + 0x2c]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x4b8]
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jns 0xa6e75c
cmp eax, 0x8007007a
jne 0xa6e880
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_CopyRect]
mov eax, dword [ebp - 0x440]
add eax, edi
mov dword [ebp - 0x60c], 0x40
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x434]
push 0x3c
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x608]
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x608], 0x2200
lea ecx, [ebp - 0x540]
call fcn.00bdcd86
mov edi, dword [ebp - 0x498]
mov esi, eax
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x460]
push eax
push 0xc24
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebx + 0x14]
push esi
push 5
push edi
push dword [eax + 0x38]
call dword [sym.imp.UxTheme.dll_DrawThemeTextEx]
and dword [ebp - 0x608], 0xfffffdff
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x440]
push eax
push 0x8824
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebx + 0x14]
push esi
push 5
push edi
push dword [eax + 0x38]
call dword [sym.imp.UxTheme.dll_DrawThemeTextEx]
mov ebx, dword [ebp - 0x4b0]
test ebx, ebx
je 0xa6e886
mov edx, dword [ebp - 0x458]
xor ecx, ecx
mov eax, dword [ebp - 0x438]
sub edx, dword [ebp - 0x460]
sub eax, dword [ebp - 0x440]
mov esi, dword [ebx]
cmp edx, eax
setg cl
push ecx
mov esi, dword [esi + 0x14]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
jmp 0xa6e886
mov edi, dword [ebp - 0x498]
mov esi, dword [ebp - 0x4c4]
test esi, esi
je 0xa6e8b0
mov ebx, dword [ebp - 0x4cc]
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
test ebx, ebx
je 0xa6e8a9
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00ab3c50
mov esp, ebp
pop ebp
ret 8