Function at 0x448080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x48c932
push eax
mov dword fs:[0], esp
sub esp, 0x640
push ebx
mov ebx, dword [esp + 0x65c]
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x66c]
mov ecx, edi
mov edx, dword [ecx]
lea eax, [esi + 0x154]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
xor ebp, ebp
mov dword [eax + 0xc], ecx
mov dword [esi + 0x140], ebp
mov dword [esi + 0x144], ebp
cmp dword [ebx + 0x14], ebp
jne 0x4480f9
mov eax, dword [esp + 0x660]
mov edx, ebp
mov dword [eax], edx
mov ecx, dword [esi + 0x144]
mov dword [eax + 4], ecx
jmp 0x44ab2a
push ebx
lea edx, [esp + 0x218]
push 0x495338
push edx
call fcn.0043ec40
add esp, 0xc
push 0xffffffffffffffff
push ebp
push eax
mov ecx, ebx
mov dword [esp + 0x664], ebp
call fcn.0041a210
cmp dword [esp + 0x22c], 8
mov dword [esp + 0x658], 0xffffffff
jb 0x448146
mov eax, dword [esp + 0x218]
push eax
call fcn.0047c604
add esp, 4
push 0x495328
call fcn.00469d6f
add esp, 4
push eax
push 0x495328
mov ecx, ebx
call fcn.0043e580
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov ecx, dword [esi + 0x148]
mov edi, 7
push 0x48ee44
mov dword [esp + 0xac], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], ebp
mov word [esp + 0x50], bp
call fcn.00469d6f
add esp, 4
push eax
push 0x48ee44
lea ecx, [esp + 0x50]
call fcn.00419f00
push 0x48ee44
mov dword [esp + 0x65c], 1
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], ebp
mov word [esp + 0x74], bp
call fcn.00469d6f
add esp, 4
push eax
push 0x48ee44
lea ecx, [esp + 0x74]
call fcn.00419f00
push 0x48ee44
mov byte [esp + 0x65c], 2
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], bp
call fcn.00469d6f
add esp, 4
push eax
push 0x48ee44
lea ecx, [esp + 0x28]
call fcn.00419f00
push 0x48ee44
mov byte [esp + 0x65c], 3
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa0], ebp
mov word [esp + 0x90], bp
call fcn.00469d6f
add esp, 4
push eax
push 0x48ee44
lea ecx, [esp + 0x90]
call fcn.00419f00
mov dword [esp + 0x34c], edi
mov dword [esp + 0x348], ebp
mov word [esp + 0x338], bp
mov dword [esp + 0x380], edi
mov dword [esp + 0x37c], ebp
mov word [esp + 0x36c], bp
mov dword [esp + 0x3bc], edi
mov dword [esp + 0x3b8], ebp
mov word [esp + 0x3a8], bp
mov dword [esp + 0x410], edi
mov dword [esp + 0x40c], ebp
mov word [esp + 0x3fc], bp
mov ecx, dword [esp + 0x670]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, esi
mov byte [esp + 0x660], 5
call fcn.00445880
mov eax, dword [ebx + 0x14]
cmp eax, ebp
mov dword [esp + 0xac], ebp
jbe 0x44a9b5
jmp 0x4482e0
mov edx, dword [esp + 0x668]
lea eax, [esp + 0xac]
push eax
lea ecx, [esp + 0x70]
push ecx
push edx
lea eax, [esp + 0x2ac]
push eax
mov ecx, esi
call fcn.00440560
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x664], 6
call fcn.0041a210
cmp dword [esp + 0x2b8], 8
mov byte [esp + 0x658], 5
jb 0x44833b
mov ecx, dword [esp + 0x2a4]
push ecx
call fcn.0047c604
add esp, 4
mov ecx, dword [esp + 0x5c]
cmp ecx, ebp
mov dword [esp + 0x2b8], 7
mov dword [esp + 0x2b4], ebp
mov word [esp + 0x2a4], bp
je 0x4485fd
mov eax, dword [esi + 0xc0]
dec eax
je 0x448492
dec eax
je 0x448486
dec eax
jne 0x4484a3
lea edx, [esp + 0x48]
push edx
call fcn.0043ee60
mov ecx, dword [esp + 0x60]
add esp, 4
cmp ecx, ebp
mov dword [esp + 0x10], ebp
jbe 0x4484a3
mov edi, ebp
xor ebx, ebx
cmp ecx, edi
ja 0x4483ae
lea ecx, [esp + 0x48]
call fcn.0047ac7e
mov ecx, dword [esp + 0x5c]
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x4483bd
lea eax, [esp + 0x4c]
cmp word [eax + ebx], 0x61
jb 0x448474
cmp ecx, edi
ja 0x4483d9
lea ecx, [esp + 0x48]
call fcn.0047ac7e
mov ecx, dword [esp + 0x5c]
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x4483e8
lea eax, [esp + 0x4c]
cmp word [eax + ebx], 0x7a
ja 0x448474
cmp ebx, ebp
je 0x448422
lea eax, [edi - 1]
cmp ecx, eax
ja 0x44840b
lea ecx, [esp + 0x48]
call fcn.0047ac7e
mov ecx, dword [esp + 0x5c]
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x44841a
lea eax, [esp + 0x4c]
cmp word [eax + ebx - 2], 0x20
jne 0x448474
cmp ecx, edi
ja 0x448433
lea ecx, [esp + 0x48]
call fcn.0047ac7e
mov ecx, dword [esp + 0x5c]
cmp dword [esp + 0x60], 8
mov edi, dword [esp + 0x4c]
jae 0x448442
lea edi, [esp + 0x4c]
cmp ecx, dword [esp + 0x10]
ja 0x448451
lea ecx, [esp + 0x48]
call fcn.0047ac7e
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x448460
lea eax, [esp + 0x4c]
mov cx, word [edi + ebx]
mov edi, dword [esp + 0x10]
sub cx, 0x20
mov word [eax + ebx], cx
mov ecx, dword [esp + 0x5c]
inc edi
add ebx, 2
cmp ecx, edi
mov dword [esp + 0x10], edi
ja 0x4483ae
jmp 0x4484a3
lea edx, [esp + 0x48]
push edx
call fcn.0043ee60
jmp 0x44849c
lea eax, [esp + 0x48]
push eax
call fcn.0043eec0
mov ecx, dword [esp + 0x60]
add esp, 4
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x4484b2
lea eax, [esp + 0x4c]
lea edx, [esp + 0x180]
push edx
push ecx
push eax
mov eax, dword [esp + 0x670]
push eax
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32W]
mov ecx, dword [esp + 0x670]
mov ebx, dword [esp + 0x184]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x180]
push ecx
push ebx
push edx
push eax
lea ecx, [esp + 0x188]
push ecx
mov ecx, esi
call fcn.0043cc20
cmp dword [esp + 0x670], ebp
jne 0x4485d8
mov ebp, dword [esp + 0x17c]
lea edx, [ebx + ebp]
mov ebx, dword [esp + 0x178]
push edx
lea eax, [edi + ebx]
push eax
push ebp
lea ecx, [esp + 0x60c]
push ebx
push ecx
call fcn.00410730
mov ecx, dword [eax]
add esp, 4
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 8], ecx
mov ecx, esi
mov dword [edx + 0xc], eax
call fcn.00447e10
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x44855d
lea eax, [esp + 0x4c]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x664]
push ecx
push eax
push ebp
push ebx
push edx
call dword [sym.imp.gdi32.dll_TextOutW]
mov eax, dword [esi + 0x54]
test eax, eax
je 0x4485e4
mov ebx, dword [esi + 0x44]
mov eax, dword [esi + 0x74]
xor ecx, ecx
cmp ebx, 0x2bc
setge cl
push eax
inc ecx
push ecx
push 0
call dword [sym.imp.gdi32.dll_CreatePen]
mov ebp, dword [esp + 0x664]
push eax
push ebp
call dword [sym.imp.gdi32.dll_SelectObject]
mov edx, dword [esp + 0x18]
push 0
mov ebx, eax
mov eax, dword [esp + 0x18]
push edx
push eax
push ebp
call dword [sym.imp.gdi32.dll_MoveToEx]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
lea eax, [edi + edx]
push eax
push ebp
call dword [sym.imp.gdi32.dll_LineTo]
push ebx
push ebp
call dword [sym.imp.gdi32.dll_SelectObject]
jmp 0x4485e4
mov ecx, dword [esi + 0xb0]
mov dword [esi + 0x114], ecx
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
add edx, edi
push 0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1c], edx
call fcn.0041a320
xor ebp, ebp
mov eax, dword [esp + 0x80]
cmp eax, ebp
je 0x44a99e
lea edx, [eax + eax + 2]
push edx
call fcn.0046b634
mov edi, eax
mov eax, dword [esp + 0x88]
add esp, 4
cmp eax, 8
mov eax, dword [esp + 0x70]
jae 0x44862f
lea eax, [esp + 0x70]
push eax
push edi
call dword [sym.imp.kernel32.dll_lstrcpyW]
push edi
call dword [sym.imp.user32.dll_CharLowerW]
push edi
call fcn.00469d6f
add esp, 4
push eax
push edi
lea ecx, [esp + 0x74]
call fcn.00419f00
push edi
call fcn.0046a9e0
add esp, 4
push 0xffffffffffffffff
lea ebx, [esi + 0x24]
push ebp
mov ecx, ebx
call fcn.0041a320
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x2e0]
push edx
mov ecx, esi
xor edi, edi
mov dword [esp + 0x1c], ebp
call fcn.00440ca0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x664], 7
call fcn.0041a210
cmp dword [esp + 0x2f0], 8
mov byte [esp + 0x658], 5
jb 0x4486be
mov eax, dword [esp + 0x2dc]
push eax
call fcn.0047c604
add esp, 4
mov eax, dword [esp + 0x34]
cmp eax, ebp
mov dword [esp + 0x2f0], 7
mov dword [esp + 0x2ec], ebp
mov word [esp + 0x2dc], bp
je 0x44a99e
ja 0x4486f3
lea ecx, [esp + 0x20]
call fcn.0047ac7e
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x38], 8
mov ecx, dword [esp + 0x24]
jae 0x448702
lea ecx, [esp + 0x24]
cmp word [ecx], 0x2f
jne 0x448772
dec eax
push eax
mov edi, 1
push edi
lea ecx, [esp + 0x2c4]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004200d0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x664], 8
call fcn.0041a210
cmp dword [esp + 0x2d4], 8
mov byte [esp + 0x658], 5
jb 0x448758
mov edx, dword [esp + 0x2c0]
push edx
call fcn.0047c604
add esp, 4
mov dword [esp + 0x2d4], 7
mov dword [esp + 0x2d0], ebp
mov word [esp + 0x2c0], bp
push 0x495324
call fcn.00469d6f
add esp, 4
push eax
mov eax, dword [esp + 0x38]
push 0x495324
push eax
push ebp
lea ecx, [esp + 0x30]
call fcn.0041d4e0
test eax, eax
jne 0x4487e9
push 0x493430
call fcn.00469d6f
add esp, 4
push eax
push 0x493430
mov ecx, ebx
call fcn.00419f00
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x4487dc
mov edx, dword [esi + 0x44]
shl edx, 1
mov eax, 0x384
mov ecx, edx
cmp ecx, eax
mov dword [esi + 0x44], edx
jle 0x4487dc
mov dword [esi + 0x44], eax
mov ecx, dword [esp + 0x664]
push ecx
jmp 0x44a997
push 0x495320
call fcn.00469d6f
mov edx, dword [esp + 0x38]
add esp, 4
push eax
push 0x495320
push edx
push ebp
lea ecx, [esp + 0x30]
call fcn.0041d4e0
test eax, eax
je 0x44a958
push 0x493d80
call fcn.00469d6f
add esp, 4
push eax
mov eax, dword [esp + 0x38]
push 0x493d80
push eax
push ebp
lea ecx, [esp + 0x30]
call fcn.0041d4e0
test eax, eax
je 0x44a958
push 0x49531c
call fcn.00469d6f
mov ecx, dword [esp + 0x38]
add esp, 4
push eax
push 0x49531c
push ecx
push ebp
lea ecx, [esp + 0x30]
call fcn.0041d4e0
test eax, eax
jne 0x448899
push 0x493dcc
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a98f
mov eax, dword [esi + 0x4c]
xor edx, edx
cmp eax, ebp
sete dl
mov dword [esi + 0x4c], edx
jmp 0x44a98f
lea ecx, [esp + 0x20]
push 0x495318
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a925
lea edx, [esp + 0x20]
push 0x495308
push edx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a925
lea eax, [esp + 0x20]
push 0x4952fc
push eax
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448b9a
push 0x4952fc
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x448b8d
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esp + 0x80]
jae 0x448b8d
mov ebx, dword [esp + 0x664]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x470]
push ecx
mov ecx, esi
call fcn.004408d0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x664], 9
call fcn.0041a210
lea ecx, [esp + 0x468]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
cmp dword [esp + 0x34], ebp
je 0x448b76
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48f934
call fcn.00437430
push 0x3d
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5e0]
push ecx
mov ecx, esi
call fcn.00440b10
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x664], 0xa
call fcn.0041a210
lea ecx, [esp + 0x5b8]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
lea edx, [esp + 0x20]
push 0x4952f0
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448a55
sub esp, 0x1c
lea edi, [esi + 0x58]
mov ecx, esp
mov dword [esp + 0x38], esp
push edi
call fcn.00424a80
sub esp, 0x1c
lea eax, [esp + 0xc0]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
mov byte [esp + 0x694], 0xb
call fcn.00424a80
lea ecx, [esp + 0x4d8]
push ecx
mov ecx, esi
mov byte [esp + 0x694], 5
call fcn.00440e20
push 0xffffffffffffffff
push ebp
push eax
mov ecx, edi
mov byte [esp + 0x664], 0xc
call fcn.0041a210
lea ecx, [esp + 0x4a0]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
jmp 0x448b76
lea edx, [esp + 0x20]
push 0x494010
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448a89
mov eax, dword [esi + 0x40]
push 1
push eax
lea ecx, [esp + 0x90]
push ecx
push ebx
mov ecx, esi
call fcn.0043fd90
mov dword [esi + 0x40], eax
jmp 0x448b76
lea edx, [esp + 0x20]
push 0x4940b8
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448aba
mov eax, dword [esi + 0x74]
push eax
lea ecx, [esp + 0x8c]
push ecx
mov ecx, esi
call fcn.0043fb70
mov dword [esi + 0x74], eax
jmp 0x448b76
lea edx, [esp + 0x20]
push 0x4942e8
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448ae4
lea eax, [esp + 0x88]
push eax
mov ecx, esi
call fcn.0043d550
jmp 0x448b76
lea ecx, [esp + 0x20]
push 0x4952e0
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448b12
mov edx, dword [esi + 0x44]
push edx
lea eax, [esp + 0x8c]
push eax
mov ecx, esi
call fcn.0043db80
mov dword [esi + 0x44], eax
jmp 0x448b76
lea ecx, [esp + 0x20]
push 0x4952d4
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448b76
lea edx, [esp + 0x88]
push 0x493eb8
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448b56
cmp dword [esp + 0x9c], ebp
jne 0x448b56
mov dword [esi + 0x8c], 1
jmp 0x448b76
mov eax, dword [esi + 0x78]
push eax
lea ecx, [esp + 0x8c]
push ecx
mov ecx, esi
mov dword [esi + 0x8c], 2
call fcn.0043fb70
mov dword [esi + 0x78], eax
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x80]
jb 0x448923
push ebx
jmp 0x44a997
mov ebx, dword [esp + 0x664]
push ebx
jmp 0x44a997
lea eax, [esp + 0x20]
push 0x4952cc
push eax
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448e2e
push ebx
lea ecx, [esp + 0x338]
call fcn.0043f590
mov edx, dword [esp + 0x664]
lea ecx, [esp + 0x334]
push ecx
push 0x4952cc
push edx
mov ecx, esi
mov dword [esp + 0x3d8], 1
call fcn.00444b40
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x80]
mov edi, 0x64
mov ebx, 1
jae 0x448d79
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x518]
push eax
mov ecx, esi
call fcn.004408d0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x664], 0xd
call fcn.0041a210
lea ecx, [esp + 0x510]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
cmp dword [esp + 0x34], ebp
je 0x448d64
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48f934
call fcn.00437430
push 0x3d
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x500]
push eax
mov ecx, esi
call fcn.00440b10
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x664], 0xe
call fcn.0041a210
lea ecx, [esp + 0x4d8]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
lea ecx, [esp + 0x20]
push 0x493ed0
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448cf1
lea edx, [esp + 0x88]
push edx
mov ecx, esi
call fcn.0043d720
mov ecx, dword [esp + 0x664]
push ebp
mov ebx, eax
push 0x64
lea eax, [esp + 0x90]
push eax
push ecx
mov ecx, esi
call fcn.0043fd90
mov edi, eax
jmp 0x448d64
lea edx, [esp + 0x20]
push 0x494010
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448d30
mov eax, dword [esp + 0x3cc]
mov edx, dword [esp + 0x664]
push ebp
push eax
lea ecx, [esp + 0x90]
push ecx
push edx
mov ecx, esi
call fcn.0043fd90
mov dword [esp + 0x3cc], eax
jmp 0x448d64
lea eax, [esp + 0x20]
push 0x4940b8
push eax
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448d64
mov ecx, dword [esp + 0x384]
push ecx
lea edx, [esp + 0x8c]
push edx
mov ecx, esi
call fcn.0043fb70
mov dword [esp + 0x384], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x80]
jb 0x448c03
cmp ebx, ebp
je 0x448d8a
cmp dword [esp + 0x670], ebp
je 0x448dca
add dword [esi + 0x110], edi
xor edi, edi
cmp dword [esp + 0x670], ebp
je 0x448de4
mov eax, dword [esp + 0x3cc]
mov ecx, dword [esi + 0x108]
add eax, 8
cmp ecx, eax
jle 0x448da9
mov eax, ecx
mov edx, dword [esi + 0xb0]
mov dword [esi + 0x108], eax
mov eax, dword [esp + 0x14]
add eax, edi
mov dword [esi + 0x114], edx
mov dword [esp + 0x14], eax
jmp 0x44a99e
mov ecx, dword [esi + 0x15c]
mov edx, dword [esi + 0x154]
push 0x64
push edi
sub ecx, edx
push ecx
call dword [sym.imp.kernel32.dll_MulDiv]
mov edi, eax
mov eax, dword [esi + 0x108]
mov ecx, dword [esp + 0x18]
cdq
sub eax, edx
mov edx, dword [esp + 0x3cc]
push edx
push 1
sar eax, 1
add eax, ecx
mov ecx, dword [esp + 0x38c]
push ecx
mov ecx, dword [esp + 0x20]
push eax
lea edx, [edi + ecx]
push edx
push eax
mov eax, dword [esp + 0x67c]
push ecx
push eax
lea ecx, [esi + 0x118]
call fcn.00457220
add dword [esp + 0x14], edi
jmp 0x44a99e
lea ecx, [esp + 0x20]
push 0x4952c4
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a86f
lea edx, [esp + 0x20]
push 0x48ee48
push edx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a86f
lea eax, [esp + 0x20]
push 0x491e34
push eax
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a7be
lea ecx, [esp + 0x20]
push 0x4952c0
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a7be
lea edx, [esp + 0x20]
push 0x493458
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448edb
push 0x493458
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a98f
mov dword [esi + 0xb0], ebp
jmp 0x44a98f
lea ecx, [esp + 0x20]
push 0x493448
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448f28
push 0x493448
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x448f1b
mov dword [esi + 0xb0], 1
mov edx, dword [esp + 0x664]
push edx
jmp 0x44a997
lea eax, [esp + 0x20]
push 0x49343c
push eax
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448f75
push 0x49343c
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x448f68
mov dword [esi + 0xb0], 2
mov ecx, dword [esp + 0x664]
push ecx
jmp 0x44a997
lea edx, [esp + 0x20]
push 0x49349c
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x448fbe
push 0x49349c
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a98f
mov dword [esi + 0xb4], 3
jmp 0x44a98f
lea ecx, [esp + 0x20]
push 0x493474
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x449007
push 0x493474
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x448ffa
mov dword [esi + 0xb4], ebp
mov edx, dword [esp + 0x664]
push edx
jmp 0x44a997
lea eax, [esp + 0x20]
push 0x49348c
push eax
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a787
lea ecx, [esp + 0x20]
push 0x49347c
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a787
lea edx, [esp + 0x20]
push 0x493464
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x449084
push 0x493464
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a98f
mov dword [esi + 0xb4], 2
jmp 0x44a98f
lea ecx, [esp + 0x20]
push 0x4952b8
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x4493ec
lea ecx, [esp + 0x1a4]
call fcn.0043da30
mov ecx, 1
mov eax, 0x64
push 0xffffffffffffffff
mov dword [esp + 0x1d4], ecx
mov dword [esp + 0x1d8], ecx
push ebp
lea ecx, [esp + 0x1e4]
mov byte [esp + 0x660], 0x11
mov dword [esp + 0x1b0], ebp
mov dword [esp + 0x1b4], ebp
mov dword [esp + 0x1b8], ebp
mov dword [esp + 0x1c4], eax
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x1e0], 0xff00ff
mov dword [esp + 0x1d4], ebp
mov dword [esp + 0x1cc], ebp
mov dword [esp + 0x1d0], ebp
call fcn.0041a320
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x200]
call fcn.0041a320
mov ecx, dword [esp + 0x664]
lea edx, [esp + 0x1a4]
push edx
lea eax, [esp + 0x70]
push eax
push ecx
mov ecx, esi
call fcn.00443950
mov eax, dword [esp + 0x1a8]
cmp eax, ebp
mov edx, dword [esp + 0x1f0]
mov ecx, dword [esp + 0x1b0]
jne 0x449177
cmp dword [esp + 0x1ac], ebp
jne 0x449177
cmp ecx, ebp
jne 0x449177
cmp edx, ebp
je 0x4493d1
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x3c], 1
je 0x44918d
push eax
mov ecx, esi
call fcn.0043cbd0
jmp 0x4491c3
cmp edx, ebp
je 0x4491b3
cmp dword [esp + 0x1f4], 8
mov eax, dword [esp + 0x1e0]
jae 0x4491a9
lea eax, [esp + 0x1e0]
push eax
mov ecx, esi
call fcn.0043cc00
jmp 0x4491c3
cmp ecx, ebp
je 0x4493d1
xor ebp, ebp
mov eax, ecx
mov dword [esp + 0x3c], ebp
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x4493d1
lea edx, [esp + 0x1a4]
push edx
mov ecx, esi
call fcn.0043ce40
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x10]
push eax
lea edx, [esp + 0x68]
lea ecx, [esi + 0x118]
push edx
call fcn.004564e0
mov eax, dword [esp + 0x1d0]
test eax, eax
je 0x44921b
mov eax, dword [esp + 0x1bc]
mov ecx, dword [esp + 0x64]
push 0x64
push eax
push ecx
call dword [sym.imp.kernel32.dll_MulDiv]
mov edi, eax
jmp 0x449222
mov edi, dword [esp + 0x1bc]
mov eax, dword [esp + 0x1d4]
test eax, eax
mov dword [esp + 0x64], edi
je 0x449250
mov edx, dword [esp + 0x1c0]
mov eax, dword [esp + 0x68]
push 0x64
push edx
push eax
call dword [sym.imp.kernel32.dll_MulDiv]
mov edi, dword [esp + 0x64]
mov dword [esp + 0x68], eax
jmp 0x44925b
mov ecx, dword [esp + 0x1c0]
mov dword [esp + 0x68], ecx
test edi, edi
mov ebx, dword [esp + 0x68]
mov ebp, edi
je 0x449281
test ebx, ebx
je 0x449281
mov eax, dword [esp + 0x40]
test eax, eax
je 0x449281
mov ecx, dword [esi + 0x178]
mov eax, dword [esi + 0x17c]
add ebp, ecx
add ebx, eax
mov eax, dword [esp + 0x670]
test eax, eax
je 0x449298
mov edx, dword [esi + 0xb0]
mov dword [esi + 0x114], edx
mov eax, dword [esp + 0x670]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
push ebx
push ecx
push edx
lea eax, [esp + 0x170]
push eax
mov ecx, esi
call fcn.0043ccf0
test edi, edi
je 0x4493b4
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4493b4
mov eax, dword [esp + 0x670]
test eax, eax
jne 0x4493b4
mov edi, dword [esp + 0x164]
lea ecx, [edi + ebx]
mov ebx, dword [esp + 0x160]
push ecx
lea edx, [ebx + ebp]
push edx
push edi
lea eax, [esp + 0x62c]
push ebx
push eax
call fcn.00410730
mov edx, dword [eax]
add esp, 4
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, esi
call fcn.00447e10
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x44934a
mov ecx, dword [esi + 0x168]
cmp ecx, dword [esi + 0x164]
jne 0x44934a
mov edx, dword [esp + 0x1c8]
mov dword [esp + 0x1c4], edx
mov eax, dword [esi + 0x18c]
mov ecx, dword [esi + 0x184]
mov edx, dword [esi + 0x180]
push eax
mov eax, dword [esi + 0x17c]
push ecx
mov ecx, dword [esi + 0x178]
push edx
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x1d4]
push ecx
mov ecx, dword [esp + 0x1ec]
push edx
mov edx, dword [esp + 0x1e4]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x68c]
push ecx
push edx
push edi
push ebx
push eax
lea ecx, [esi + 0x118]
call fcn.00457c50
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x3c]
add ecx, ebp
test eax, eax
mov dword [esp + 0x14], ecx
je 0x4493d1
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.gdi32.dll_DeleteObject]
lea ecx, [esp + 0x1a4]
mov byte [esp + 0x658], 5
call fcn.0043da50
xor ebp, ebp
jmp 0x44a99e
lea edx, [esp + 0x20]
push 0x4952ac
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44970f
lea ecx, [esp + 0x230]
call fcn.0043da30
mov edi, dword [sym.imp.user32.dll_GetSystemMetrics]
push 0xb
mov byte [esp + 0x65c], 0x12
mov dword [esp + 0x238], ebp
mov dword [esp + 0x23c], ebp
mov dword [esp + 0x240], ebp
call edi
push 0xc
mov dword [esp + 0x24c], eax
mov dword [esp + 0x260], ebp
call edi
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x270]
mov dword [esp + 0x254], eax
mov dword [esp + 0x268], ebp
mov dword [esp + 0x258], ebp
mov dword [esp + 0x25c], ebp
call fcn.0041a320
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x28c]
call fcn.0041a320
mov edx, dword [esp + 0x664]
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x70]
push ecx
push edx
mov ecx, esi
call fcn.00443950
mov eax, dword [esp + 0x234]
cmp eax, ebp
mov ebx, dword [esp + 0x27c]
mov edi, dword [esp + 0x23c]
jne 0x4494d1
cmp dword [esp + 0x238], ebp
jne 0x4494d1
cmp edi, ebp
jne 0x4494d1
cmp ebx, ebp
je 0x4496f4
xor ebp, ebp
cmp eax, ebp
mov ecx, dword [esp + 0x248]
mov edx, dword [esp + 0x24c]
mov dword [esp + 0x40], 1
je 0x4494f9
push edx
push ecx
push eax
mov ecx, esi
call fcn.0043cb80
mov ebp, eax
jmp 0x449535
cmp ebx, ebp
je 0x449523
cmp dword [esp + 0x280], 8
mov eax, dword [esp + 0x26c]
jae 0x449515
lea eax, [esp + 0x26c]
push edx
push ecx
push eax
mov ecx, esi
call fcn.0043cbb0
mov ebp, eax
jmp 0x449535
cmp edi, ebp
je 0x4496f4
mov dword [esp + 0x40], 0
mov ebp, edi
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x4496f4
lea eax, [esp + 0x230]
push eax
mov ecx, esi
call fcn.0043ce40
push ebp
lea edx, [esp + 0x314]
lea ecx, [esi + 0x118]
push edx
mov dword [esp + 0x44], eax
call fcn.00456460
mov edi, dword [eax]
test edi, edi
mov ecx, dword [eax + 4]
mov edx, edi
mov dword [esp + 0x13c], ecx
mov dword [esp + 0xb0], edx
mov ebx, ecx
je 0x4495aa
mov eax, ecx
test eax, eax
je 0x4495aa
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4495aa
mov eax, dword [esi + 0x178]
mov ecx, edi
add ecx, eax
mov eax, dword [esi + 0x17c]
mov dword [esp + 0xb0], ecx
add ebx, eax
mov eax, dword [esp + 0x670]
test eax, eax
je 0x4495c1
mov ecx, dword [esi + 0xb0]
mov dword [esi + 0x114], ecx
mov edx, dword [esp + 0x670]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ebx
push eax
push ecx
lea edx, [esp + 0x160]
push edx
mov ecx, esi
call fcn.0043ccf0
test edi, edi
je 0x4496d4
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x4496d4
mov eax, dword [esp + 0x670]
test eax, eax
jne 0x4496d4
mov ebp, dword [esp + 0x154]
mov ecx, dword [esp + 0xb0]
lea eax, [ebx + ebp]
mov ebx, dword [esp + 0x150]
push eax
lea edx, [ebx + ecx]
push edx
push ebp
lea eax, [esp + 0x5fc]
push ebx
push eax
call fcn.00410730
mov edx, dword [eax]
add esp, 4
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, esi
call fcn.00447e10
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x44967d
mov ecx, dword [esi + 0x168]
cmp ecx, dword [esi + 0x164]
jne 0x44967d
mov edx, dword [esp + 0x254]
mov dword [esp + 0x250], edx
mov eax, dword [esi + 0x18c]
mov ecx, dword [esi + 0x184]
mov edx, dword [esi + 0x180]
push eax
mov eax, dword [esi + 0x17c]
push ecx
mov ecx, dword [esi + 0x178]
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x260]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x154]
push eax
mov eax, dword [esp + 0x680]
push ecx
push edx
push edi
push ebp
push ebx
push eax
lea ecx, [esi + 0x118]
call fcn.00457f00
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4496e3
push ebp
call dword [sym.imp.user32.dll_DestroyCursor]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xb0]
add eax, ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x230]
mov byte [esp + 0x658], 5
call fcn.0043da50
xor ebp, ebp
jmp 0x44a99e
lea edx, [esp + 0x20]
push 0x4952a0
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x449e0d
lea ecx, [esp + 0xc0]
call fcn.0043da30
mov edi, dword [sym.imp.user32.dll_GetSystemMetrics]
mov eax, 0x64
mov ebx, 1
push 0xb
mov byte [esp + 0x65c], 0x13
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc8], ebp
mov dword [esp + 0xcc], ebp
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xdc], eax
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xec], ebp
mov dword [esp + 0xf8], 0xff00ff
call edi
push 0xc
mov dword [esp + 0xd4], eax
call edi
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x100]
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe8], ebp
mov dword [esp + 0xec], ebp
call fcn.0041a320
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x11c]
call fcn.0041a320
mov edx, dword [esp + 0x664]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x70]
push ecx
push edx
mov ecx, esi
call fcn.00443950
lea eax, [esp + 0xc0]
push eax
mov ecx, esi
call fcn.0043ce40
mov edx, dword [esp + 0x10c]
mov ecx, dword [esp + 0xcc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc4]
cmp eax, ebp
jne 0x449a5a
cmp dword [esp + 0xc8], ebp
jne 0x449a5a
cmp ecx, ebp
jne 0x449a5a
cmp edx, ebp
jne 0x449a5a
mov eax, dword [esi + 0x11c]
cmp eax, ebp
je 0x449df2
push eax
call dword [sym.imp.comctl32.dll_ImageList_GetImageCount]
mov ecx, dword [esp + 0xc0]
cmp ecx, eax
jge 0x449df2
push 0
push ecx
mov ecx, dword [esi + 0x11c]
push ecx
call dword [sym.imp.comctl32.dll_ImageList_GetIcon]
test eax, eax
mov dword [esp + 0x3c], eax
je 0x449df2
mov eax, dword [esp + 0xec]
test eax, eax
mov ebp, dword [esp + 0xdc]
mov edi, dword [esp + 0xd8]
mov dword [esp + 0x144], ebp
je 0x4498b4
mov edx, dword [esi + 0x120]
push 0x64
push edi
push edx
call dword [sym.imp.kernel32.dll_MulDiv]
mov edi, eax
mov eax, dword [esp + 0xf0]
test eax, eax
je 0x4498df
mov eax, dword [esp + 0xdc]
mov ecx, dword [esi + 0x124]
push 0x64
push eax
push ecx
call dword [sym.imp.kernel32.dll_MulDiv]
mov ebp, eax
mov dword [esp + 0x144], ebp
test edi, edi
mov eax, edi
mov dword [esp + 0x130], eax
je 0x44990b
test ebp, ebp
je 0x44990b
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x44990b
add eax, dword [esi + 0x178]
mov dword [esp + 0x130], eax
add ebp, dword [esi + 0x17c]
mov ebx, dword [esp + 0x670]
test ebx, ebx
je 0x449922
mov edx, dword [esi + 0xb0]
mov dword [esi + 0x114], edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push eax
push ecx
lea edx, [esp + 0x178]
push edx
mov ecx, esi
call fcn.0043ccf0
test edi, edi
je 0x449a2e
mov eax, dword [esp + 0x144]
test eax, eax
je 0x449a2e
test ebx, ebx
jne 0x449a2e
mov ebx, dword [esp + 0x16c]
mov ecx, dword [esp + 0x130]
lea eax, [ebx + ebp]
mov ebp, dword [esp + 0x168]
push eax
lea edx, [ecx + ebp]
push edx
push ebx
lea eax, [esp + 0x63c]
push ebp
push eax
call fcn.00410730
mov edx, dword [eax]
add esp, 4
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, esi
call fcn.00447e10
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x4499d0
mov ecx, dword [esi + 0x168]
cmp ecx, dword [esi + 0x164]
jne 0x4499d0
mov edx, dword [esp + 0xe4]
mov dword [esp + 0xe0], edx
mov eax, dword [esi + 0x18c]
mov ecx, dword [esi + 0x184]
mov edx, dword [esi + 0x180]
push eax
mov eax, dword [esi + 0x17c]
push ecx
mov ecx, dword [esi + 0x178]
push edx
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0xf0]
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x15c]
push eax
mov eax, dword [esp + 0x680]
push ecx
push edx
push edi
push ebx
push ebp
push eax
lea ecx, [esi + 0x118]
call fcn.00457f00
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.user32.dll_DestroyCursor]
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x14]
add eax, edx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x14], eax
mov byte [esp + 0x658], 5
call fcn.0043da50
xor ebp, ebp
jmp 0x44a99e
cmp eax, ebp
mov dword [esp + 0x44], ebx
je 0x449a6c
push eax
mov ecx, esi
call fcn.0043cbd0
jmp 0x449aa2
cmp edx, ebp
je 0x449a92
cmp dword [esp + 0x110], 8
mov eax, dword [esp + 0xfc]
jae 0x449a88
lea eax, [esp + 0xfc]
push eax
mov ecx, esi
call fcn.0043cc00
jmp 0x449aa2
cmp ecx, ebp
je 0x449df2
xor ebp, ebp
mov dword [esp + 0x44], ebp
mov eax, ecx
cmp eax, ebp
mov dword [esp + 0x40], eax
je 0x449df2
mov ecx, dword [esp + 0xd0]
test ecx, ecx
je 0x449df2
mov ecx, dword [esp + 0xd4]
test ecx, ecx
je 0x449df2
push eax
lea eax, [esp + 0x14c]
lea ecx, [esi + 0x118]
push eax
call fcn.004564e0
mov eax, dword [esp + 0xec]
test eax, eax
je 0x449b0e
mov ecx, dword [esp + 0xd8]
mov edx, dword [esp + 0xd0]
push 0x64
push ecx
push edx
call dword [sym.imp.kernel32.dll_MulDiv]
mov ebx, eax
mov dword [esp + 0xd8], ebx
jmp 0x449b15
mov ebx, dword [esp + 0xd8]
mov eax, dword [esp + 0xf0]
test eax, eax
je 0x449b46
mov eax, dword [esp + 0xdc]
mov ecx, dword [esp + 0xd4]
push 0x64
push eax
push ecx
call dword [sym.imp.kernel32.dll_MulDiv]
mov ebx, dword [esp + 0xd8]
mov dword [esp + 0xdc], eax
test ebx, ebx
mov eax, dword [esp + 0xdc]
mov ebp, ebx
mov dword [esp + 0x158], ebp
mov edi, eax
je 0x449b7f
test eax, eax
je 0x449b7f
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x449b7f
mov ebp, dword [esi + 0x178]
mov edi, dword [esi + 0x17c]
add ebp, ebx
mov dword [esp + 0x158], ebp
add edi, eax
mov eax, dword [esp + 0x148]
cdq
idiv dword [esp + 0xd0]
mov ecx, eax
mov eax, dword [esp + 0x14c]
cdq
idiv dword [esp + 0xd4]
mov dword [esp + 0x1c], ecx
mov edx, eax
imul edx, ecx
cmp dword [esp + 0xc0], edx
jge 0x449ddf
test ecx, ecx
je 0x449ddf
test eax, eax
je 0x449ddf
mov eax, dword [esp + 0x670]
test eax, eax
je 0x449bdc
mov eax, dword [esi + 0xb0]
mov dword [esi + 0x114], eax
mov ecx, dword [esp + 0x670]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edi
push edx
push eax
lea ecx, [esp + 0xc8]
push ecx
mov ecx, esi
call fcn.0043ccf0
test ebx, ebx
je 0x449ddb
mov eax, dword [esp + 0xdc]
test eax, eax
je 0x449ddb
mov eax, dword [esp + 0x670]
test eax, eax
jne 0x449ddb
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0xb8]
lea edx, [eax + edi]
push edx
lea edx, [ecx + ebp]
push edx
push eax
push ecx
lea eax, [esp + 0x620]
push eax
call fcn.00410730
mov edx, dword [eax]
add esp, 4
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, esi
call fcn.00447e10
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x449c91
mov ecx, dword [esi + 0x168]
cmp ecx, dword [esi + 0x164]
jne 0x449c91
mov edx, dword [esp + 0xe4]
mov dword [esp + 0xe0], edx
mov ebx, dword [esp + 0x664]
mov ebp, dword [sym.imp.gdi32.dll_CreateCompatibleDC]
push ebx
call ebp
push ebx
mov edi, eax
call ebp
mov ecx, dword [esp + 0xd0]
mov ebp, eax
mov eax, dword [esp + 0xd4]
push eax
push ecx
push ebx
call dword [sym.imp.gdi32.dll_CreateCompatibleBitmap]
mov edx, dword [esp + 0x40]
push edx
push edi
mov ebx, eax
call dword [sym.imp.gdi32.dll_SelectObject]
push ebx
push ebp
mov dword [esp + 0x44], eax
call dword [sym.imp.gdi32.dll_SelectObject]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xc0]
xor edx, edx
div dword [esp + 0x1c]
mov ecx, dword [esp + 0xd4]
push 0xcc0020
imul ecx, eax
mov eax, dword [esp + 0xd4]
push ecx
mov ecx, eax
imul ecx, edx
mov edx, dword [esp + 0xdc]
push ecx
push edi
push edx
push eax
push 0
push 0
push ebp
call dword [sym.imp.gdi32.dll_BitBlt]
mov eax, dword [esp + 0x3c]
push eax
push edi
call dword [sym.imp.gdi32.dll_SelectObject]
mov ecx, dword [esp + 0xa4]
push ecx
push ebp
call dword [sym.imp.gdi32.dll_SelectObject]
push edi
mov edi, dword [sym.imp.gdi32.dll_DeleteDC]
call edi
push ebp
call edi
mov edx, dword [esp + 0x3c]
mov edi, dword [sym.imp.gdi32.dll_DeleteObject]
push edx
call edi
mov eax, dword [esp + 0xa4]
push eax
call edi
mov ecx, dword [esi + 0x18c]
mov edx, dword [esi + 0x184]
mov eax, dword [esi + 0x180]
push ecx
mov ecx, dword [esi + 0x17c]
push edx
mov edx, dword [esi + 0x178]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xf0]
push edx
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x100]
push ecx
push edx
push eax
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0xfc]
mov eax, dword [esp + 0xe0]
push ebx
push ecx
mov ecx, dword [esp + 0xe4]
push edx
mov edx, dword [esp + 0x694]
push eax
push ecx
push edx
lea ecx, [esi + 0x118]
call fcn.00457c50
push ebx
call edi
mov ebp, dword [esp + 0x158]
add dword [esp + 0x14], ebp
mov eax, dword [esp + 0x44]
test eax, eax
je 0x449df2
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.gdi32.dll_DeleteObject]
lea ecx, [esp + 0xc0]
mov byte [esp + 0x658], 5
call fcn.0043da50
xor ebp, ebp
jmp 0x44a99e
lea ecx, [esp + 0x20]
push 0x495290
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44a164
push 0x48ee44
lea ecx, [esp + 0x218]
xor edi, edi
call fcn.00437430
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x80]
mov byte [esp + 0x658], 0x14
jae 0x44a14b
mov ebx, dword [esp + 0x664]
lea ebx, [ebx]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x534]
push edx
mov ecx, esi
call fcn.004408d0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x664], 0x15
call fcn.0041a210
lea ecx, [esp + 0x52c]
mov byte [esp + 0x658], 0x14
call fcn.0043d9d0
cmp dword [esp + 0x34], ebp
je 0x449ff4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48f934
call fcn.00437430
push 0x3d
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x43c]
push edx
mov ecx, esi
call fcn.00440b10
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x664], 0x16
call fcn.0041a210
lea ecx, [esp + 0x414]
mov byte [esp + 0x658], 0x14
call fcn.0043d9d0
lea eax, [esp + 0x20]
push 0x493ee8
push eax
call fcn.0041d7d0
add esp, 8
test al, al
je 0x449f38
push ebp
push edi
lea ecx, [esp + 0x90]
push ecx
push ebx
mov ecx, esi
call fcn.0043fd90
mov edi, eax
jmp 0x449ff4
lea edx, [esp + 0x20]
push 0x494320
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x449f67
push ebp
push ebp
lea eax, [esp + 0x90]
push eax
push ebx
mov ecx, esi
call fcn.0043fd90
mov edi, eax
jmp 0x449ff4
lea ecx, [esp + 0x20]
push 0x494300
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x449ff4
sub esp, 0x1c
lea edx, [esp + 0x230]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.00424a80
sub esp, 0x1c
lea eax, [esp + 0xc0]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
mov byte [esp + 0x694], 0x17
call fcn.00424a80
lea ecx, [esp + 0x59c]
push ecx
mov ecx, esi
mov byte [esp + 0x694], 0x14
call fcn.00440e20
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x220]
mov byte [esp + 0x664], 0x18
call fcn.0041a210
lea ecx, [esp + 0x564]
mov byte [esp + 0x658], 0x14
call fcn.0043d9d0
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x80]
jb 0x449e60
cmp edi, ebp
je 0x44a14b
push 0x48ee44
lea ecx, [esp + 0x18c]
call fcn.00437430
push edi
lea eax, [esp + 0x54c]
push eax
mov ecx, esi
mov byte [esp + 0x660], 0x19
call fcn.0043f1c0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x194]
mov byte [esp + 0x664], 0x1a
call fcn.0041a210
lea ecx, [esp + 0x548]
mov byte [esp + 0x658], 0x19
call fcn.0043d9d0
cmp dword [esp + 0x19c], ebp
je 0x44a13f
mov edx, dword [esp + 0x664]
lea ecx, [esp + 0x188]
push ecx
push edx
call fcn.0043d300
mov ebx, dword [esp + 0x678]
add esp, 8
test ebx, ebx
mov ebp, eax
mov edi, edx
je 0x44a0a2
mov eax, dword [esi + 0xb0]
mov dword [esi + 0x114], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push edi
push ecx
push edx
lea eax, [esp + 0x180]
push eax
mov ecx, esi
call fcn.0043cc20
test ebx, ebx
jne 0x44a139
mov ebx, dword [esp + 0x174]
lea ecx, [ebx + edi]
mov edi, dword [esp + 0x170]
push ecx
lea edx, [edi + ebp]
push edx
push ebx
lea eax, [esp + 0x64c]
push edi
push eax
call fcn.00410730
mov edx, dword [eax]
add esp, 4
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, esi
call fcn.00447e10
cmp dword [esp + 0x1a0], 8
mov eax, dword [esp + 0x18c]
jae 0x44a120
lea eax, [esp + 0x18c]
mov ecx, dword [esp + 0x19c]
mov edx, dword [esp + 0x664]
push ecx
push eax
push ebx
push edi
push edx
call dword [sym.imp.gdi32.dll_TextOutW]
add dword [esp + 0x14], ebp
xor ebp, ebp
lea ecx, [esp + 0x188]
call fcn.0043d9d0
lea ecx, [esp + 0x214]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
jmp 0x44a99e
lea eax, [esp + 0x20]
push 0x495284
push eax
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea ecx, [esp + 0x20]
push 0x49527c
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea edx, [esp + 0x20]
push 0x495274
push edx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea eax, [esp + 0x20]
push 0x49526c
push eax
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea ecx, [esp + 0x20]
push 0x495264
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea edx, [esp + 0x20]
push 0x49525c
push edx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea eax, [esp + 0x20]
push 0x495254
push eax
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea ecx, [esp + 0x20]
push 0x495248
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea edx, [esp + 0x20]
push 0x495240
push edx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea eax, [esp + 0x20]
push 0x495238
push eax
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea ecx, [esp + 0x20]
push 0x49522c
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea edx, [esp + 0x20]
push 0x495224
push edx
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea eax, [esp + 0x20]
push 0x49521c
push eax
call fcn.0041d7d0
add esp, 8
test al, al
jne 0x44a737
lea ecx, [esp + 0x20]
push 0x495210
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44a49c
push 0x495210
mov ecx, ebx
call fcn.0041d970
cmp edi, ebp
jne 0x44a47e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x438]
push ecx
mov ecx, esi
call fcn.004408d0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x664], 0x1b
call fcn.0041a210
lea ecx, [esp + 0x430]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
cmp dword [esp + 0x34], ebp
je 0x44a99e
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48f934
call fcn.00437430
push 0x3d
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x474]
push ecx
mov ecx, esi
call fcn.00440b10
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x664], 0x1c
call fcn.0041a210
lea ecx, [esp + 0x44c]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
lea edx, [esp + 0x20]
push 0x495204
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44a99e
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48ee44
call fcn.00437430
sub esp, 0x1c
lea eax, [esp + 0xc0]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
mov byte [esp + 0x694], 0x1d
call fcn.00424a80
lea ecx, [esp + 0x350]
push ecx
mov ecx, esi
mov byte [esp + 0x694], 5
call fcn.00440e20
push ebx
lea ecx, [esi + 0x290]
mov byte [esp + 0x65c], 0x1e
call fcn.00447840
lea edx, [esp + 0x318]
push edx
lea eax, [esp + 0x2f8]
push 0x48efc8
push eax
call fcn.0043ec40
add esp, 0xc
cmp dword [esp + 0x30c], 8
mov eax, dword [esp + 0x2f8]
mov byte [esp + 0x658], 0x20
jae 0x44a440
lea eax, [esp + 0x2f8]
mov edi, dword [esp + 0x664]
push ebx
push eax
push edi
mov ecx, esi
call fcn.00444b40
push edi
mov ecx, esi
call fcn.0043d340
lea ecx, [esp + 0x2f4]
call fcn.0043d9d0
lea ecx, [esp + 0x318]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
jmp 0x44a99e
push 1
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
mov ecx, dword [esp + 0x664]
push ecx
jmp 0x44a997
lea edx, [esp + 0x20]
push 0x495200
push edx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44a99e
push 0x4951f4
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a72a
push 0xffffffffffffffff
lea edi, [esi + 0xe8]
push ebp
mov ecx, edi
mov dword [esi + 0xe4], 2
call fcn.0041a320
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x80]
jae 0x44a6dd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x48c]
push eax
mov ecx, esi
call fcn.004408d0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x664], 0x21
call fcn.0041a210
lea ecx, [esp + 0x484]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
cmp dword [esp + 0x34], ebp
je 0x44a6cc
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48f934
call fcn.00437430
push 0x3d
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x4e4]
push eax
mov ecx, esi
call fcn.00440b10
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x664], 0x22
call fcn.0041a210
lea ecx, [esp + 0x4bc]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
lea ecx, [esp + 0x20]
push 0x4951e8
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44a63d
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48ee44
mov dword [esi + 0xe4], 1
call fcn.00437430
sub esp, 0x1c
lea edx, [esp + 0xc0]
mov ecx, esp
mov dword [esp + 0x7c], esp
push edx
mov byte [esp + 0x694], 0x23
call fcn.00424a80
lea eax, [esp + 0x52c]
push eax
mov ecx, esi
mov byte [esp + 0x694], 5
call fcn.00440e20
push 0xffffffffffffffff
push ebp
push eax
mov ecx, edi
mov byte [esp + 0x664], 0x24
call fcn.0041a210
lea ecx, [esp + 0x4f4]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
lea ecx, [esp + 0x20]
push 0x4951e0
push ecx
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44a6cc
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48ee44
mov dword [esi + 0xe4], 2
call fcn.00437430
sub esp, 0x1c
lea edx, [esp + 0xc0]
mov ecx, esp
mov dword [esp + 0x7c], esp
push edx
mov byte [esp + 0x694], 0x25
call fcn.00424a80
lea eax, [esp + 0x5d4]
push eax
mov ecx, esi
mov byte [esp + 0x694], 5
call fcn.00440e20
push 0xffffffffffffffff
push ebp
push eax
mov ecx, edi
mov byte [esp + 0x664], 0x26
call fcn.0041a210
lea ecx, [esp + 0x59c]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esp + 0x80]
jb 0x44a505
mov edx, dword [esi + 0x168]
mov ecx, dword [esi + 0x164]
inc edx
mov eax, edx
cmp eax, ecx
mov dword [esi + 0x168], edx
push ebx
mov ecx, esi
jne 0x44a718
mov edx, dword [esp + 0x668]
push 0x4951d0
push edx
call fcn.00444b40
mov ecx, dword [esp + 0x664]
push ecx
jmp 0x44a997
mov eax, dword [esp + 0x668]
push 0x4951c0
push eax
call fcn.00444b40
mov ecx, dword [esp + 0x664]
push ecx
jmp 0x44a997
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x28]
push edx
mov ecx, ebx
call fcn.0041a210
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a77a
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x44a769
lea eax, [esp + 0x24]
push ebx
push eax
mov eax, dword [esp + 0x66c]
push eax
mov ecx, esi
call fcn.00444b40
mov ecx, dword [esp + 0x664]
push ecx
jmp 0x44a997
push 0x49347c
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a7b1
mov dword [esi + 0xb4], 1
mov edx, dword [esp + 0x664]
push edx
jmp 0x44a997
push 0x4951b8
mov ecx, ebx
call fcn.0041d970
lea eax, [esp + 0x20]
push 0x4952c0
push eax
mov edi, 1
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44a85d
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48f934
call fcn.00437430
push 0x3d
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x5fc]
push eax
mov ecx, esi
call fcn.00440b10
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x664], 0x10
call fcn.0041a210
lea ecx, [esp + 0x5d4]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
mov edx, dword [esp + 0x664]
push ebp
push edi
lea ecx, [esp + 0x90]
push ecx
push edx
mov ecx, esi
call fcn.0043fd90
mov edi, eax
push edi
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0043cdf0
jmp 0x44a99e
push 0x4951a4
mov ecx, ebx
call fcn.0041d970
lea ecx, [esp + 0x20]
push 0x4952c4
push ecx
mov edi, 1
call fcn.0041d7d0
add esp, 8
test al, al
je 0x44a90e
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x48f934
call fcn.00437430
push 0x3d
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5a8]
push ecx
mov ecx, esi
call fcn.00440b10
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x664], 0xf
call fcn.0041a210
lea ecx, [esp + 0x580]
mov byte [esp + 0x658], 5
call fcn.0043d9d0
mov eax, dword [esp + 0x664]
push ebp
push edi
lea edx, [esp + 0x90]
push edx
push eax
mov ecx, esi
call fcn.0043fd90
mov edi, eax
mov ecx, dword [esp + 0x670]
push ecx
push edi
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00446d60
jmp 0x44a99e
push 0x495190
mov ecx, ebx
call fcn.0041d970
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a94e
mov ecx, dword [esi + 0x50]
xor eax, eax
cmp ecx, ebp
sete al
mov dword [esi + 0x50], eax
mov ecx, dword [esp + 0x664]
push ecx
jmp 0x44a997
push 0x4933f0
call fcn.00469d6f
add esp, 4
push eax
push 0x4933f0
mov ecx, ebx
call fcn.00419f00
push edi
mov ecx, esi
call fcn.00447ed0
test eax, eax
je 0x44a99e
cmp edi, ebp
jne 0x44a98f
mov eax, dword [esi + 0x48]
xor edx, edx
cmp eax, ebp
sete dl
mov dword [esi + 0x48], edx
mov eax, dword [esp + 0x664]
push eax
mov ecx, esi
call fcn.0043d340
mov edx, dword [esp + 0x668]
mov ecx, dword [esp + 0xac]
cmp ecx, dword [edx + 0x14]
jb 0x4482e0
mov eax, dword [esp + 0x670]
push eax
push 1
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00446d60
mov edx, dword [esp + 0x18]
mov ecx, dword [esi + 0x158]
mov ebp, dword [esp + 0xa8]
mov eax, dword [esi + 0x148]
sub edx, ecx
cmp ebp, eax
mov dword [esi + 0x144], edx
jge 0x44aa69
mov ebx, ebp
lea ebx, [ebx + ebx*4]
lea edi, [esi + 0x104]
shl ebx, 2
lea esp, [esp]
mov eax, dword [esi + 0x284]
mov edx, dword [eax + ebx]
add eax, ebx
mov ecx, edi
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x110]
test eax, eax
je 0x44aa5b
mov ecx, dword [esi + 0x140]
push 0x64
push ecx
push eax
call dword [sym.imp.kernel32.dll_MulDiv]
mov ecx, dword [edi]
add ecx, eax
mov eax, ecx
mov dword [edi], ecx
mov ecx, dword [esi + 0x140]
cmp ecx, eax
jle 0x44aa55
mov eax, ecx
mov dword [esi + 0x140], eax
mov eax, dword [esi + 0x148]
inc ebp
add ebx, 0x14
cmp ebp, eax
jl 0x44aa00
mov edx, dword [esi + 0x140]
mov edi, dword [esp + 0x660]
mov dword [edi], edx
mov eax, dword [esi + 0x144]
lea ecx, [esp + 0x334]
mov dword [edi + 4], eax
call fcn.0043d930
mov eax, dword [esp + 0xa0]
mov ebx, 8
cmp eax, ebx
jb 0x44aaad
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.0047c604
add esp, 4
mov eax, dword [esp + 0x38]
xor esi, esi
cmp eax, ebx
mov ebp, 7
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x9c], esi
mov word [esp + 0x8c], si
jb 0x44aadf
mov edx, dword [esp + 0x24]
push edx
call fcn.0047c604
add esp, 4
cmp dword [esp + 0x84], ebx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], esi
mov word [esp + 0x24], si
jb 0x44ab02
mov eax, dword [esp + 0x70]
push eax
call fcn.0047c604
add esp, 4
cmp dword [esp + 0x60], ebx
mov dword [esp + 0x84], ebp
mov dword [esp + 0x80], esi
mov word [esp + 0x70], si
jb 0x44ab28
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0047c604
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x650]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x64c
ret 0x14