Function at 0x436870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44aca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [ecx + 0x40]
mov dword [esp], ecx
mov ecx, dword [esp + 0x44]
push ebx
push ebp
push esi
lea eax, [eax + ecx*4]
xor esi, esi
push edi
mov ecx, dword [eax]
add ecx, 8
mov edx, dword [ecx]
mov dword [esp + 0x30], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x34], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x38], edx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x3c], ecx
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x58]
cmp eax, esi
mov dword [esp + 0x1c], edx
je 0x4368e3
push 2
lea ecx, [esp + 0x34]
push 2
push ecx
call dword [sym.imp.USER32.dll_InflateRect]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 0x450f70
mov ebp, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
mov dword [esp + 0x4c], esi
call ebp
mov ebx, dword [sym.imp.GDI32.dll_CreatePen]
push eax
push 1
push esi
call ebx
push eax
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CGdiObject::Attach
cmp eax, esi
jne 0x43692c
mov dword [esp + 0x20], 0x44cb54
mov dword [esp + 0x48], 1
jmp 0x436bf0
mov esi, dword [esp + 0x50]
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_1
mov ecx, dword [esp + 0x30]
mov edi, eax
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x28]
dec eax
push eax
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
add eax, 2
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
add eax, 2
push edx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
dec edx
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
push edi
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_1
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x54]
inc edx
mov eax, dword [ecx + 0x24]
cmp eax, edx
jne 0x4369c0
push 1
push eax
call fcn.004371c0
test eax, eax
jne 0x436b29
push 0x10
call ebp
push eax
push 1
push 0
call ebx
push eax
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
jne 0x4369ee
mov dword [esp + 0x20], 0x44cb54
mov dword [esp + 0x48], 2
jmp 0x436bf0
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call sub.MFC42.DLL_CDC::SelectObject_1
mov edi, eax
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x50], edi
jne 0x436a99
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
dec edx
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
push edi
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_1
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::DeleteObject
push 0x12
call ebp
push eax
push 1
push 0
call ebx
push eax
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
jne 0x436a5d
mov dword [esp + 0x20], 0x44cb54
mov dword [esp + 0x48], 3
jmp 0x436bf0
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call sub.MFC42.DLL_CDC::SelectObject_1
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
add ecx, 2
mov dword [esp + 0x50], eax
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
jmp 0x436b14
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
cmp ecx, eax
mov ebp, ecx
jge 0x436b14
jmp 0x436aad
mov ecx, dword [esp + 0x34]
mov eax, ebp
sub eax, ecx
mov ecx, 0xc
cdq
idiv ecx
mov ecx, 6
mov eax, 0x55555556
sub ecx, edx
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov edi, edx
and edi, 0x80000001
jns 0x436add
dec edi
or edi, 0xfffffffe
inc edi
mov ecx, dword [esp + 0x38]
push ebp
lea eax, [esp + 0x2c]
lea edx, [edi + ecx]
mov ecx, esi
push edx
push eax
call sub.MFC42.DLL_CDC::MoveTo
mov eax, dword [esp + 0x3c]
add ebp, 3
cmp ebp, eax
jge 0x436aff
mov eax, ebp
mov ecx, dword [esp + 0x38]
push eax
add edi, ecx
mov ecx, esi
push edi
call sub.MFC42.DLL_CDC::LineTo
cmp ebp, dword [esp + 0x3c]
jl 0x436aa9
mov edx, dword [esp + 0x50]
mov ecx, esi
push edx
call sub.MFC42.DLL_CDC::SelectObject_1
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov edi, dword [esi]
push 0
call fcn.004347d0
add esp, 4
mov ecx, esi
push eax
call dword [edi + 0x30]
mov edx, dword [esp + 0x54]
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x40]
mov eax, dword [ecx + edx*4]
lea ecx, [esp + 0x58]
mov eax, dword [eax + 4]
push eax
call fcn.00448150
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x4c], 4
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [esp + 0x58]
push 0
mov ebx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
lea ecx, [esp + 0x38]
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x44]
sub eax, ecx
push 4
cdq
sub eax, edx
mov ebp, eax
mov eax, dword [esp + 0x2c]
cdq
sub eax, edx
sar ebp, 1
sar eax, 1
sub ebp, eax
mov eax, dword [esp + 0x28]
cdq
sub eax, edx
add ebp, ecx
mov ecx, eax
mov eax, dword [esp + 0x30]
cdq
sub eax, edx
mov edx, dword [esp + 0x44]
sar ecx, 1
sar eax, 1
sub eax, ecx
push ebp
add eax, edx
mov ecx, esi
push eax
call dword [ebx + 0x68]
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 0x30]
lea ecx, [esp + 0x58]
mov byte [esp + 0x48], 0
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x20], 0x44cb54
mov dword [esp + 0x48], 5
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0xc