Function at 0x469270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4bc
mov eax, dword [0x4ef52c]
xor eax, esp
mov dword [esp + 0x4b8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x38], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, ecx
mov dword [esp + 0xc], ebx
push edi
mov dword [esi], vtable.CXDialogTemplate.0
mov eax, dword [ebx + 0x858]
mov dword [esi + 0x54], eax
mov eax, dword [ebx + 0x854]
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov eax, dword [ebx + 4]
mov dword [esi + 0x68], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x6c], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x70], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x74], eax
mov dword [esi + 0x88], 0xffffffff
mov eax, dword [ebx + 0x850]
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], 0x3e9
mov dword [esi + 0x94], 1
mov eax, dword [ebx]
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x9c], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x14]
and eax, 1
mov dword [esi + 0xa4], eax
mov ecx, dword [ebx + 0x14]
and ecx, 2
mov dword [esi + 0xa8], ecx
mov eax, dword [ebx + 0x14]
and eax, 4
mov dword [esi + 0xb0], 0
mov dword [esi + 0xac], eax
mov eax, dword [ebx + 0x84c]
mov dword [esi + 0xb4], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xb8], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0xbc], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0xc0], eax
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd8], 0
mov dword [esi + 0x4ec], 0
mov dword [esi + 0x4f0], 0
mov eax, dword [ebx + 0x85c]
mov dword [esi + 0x4f4], eax
mov edx, dword [ebx + 0x860]
mov dword [esi + 0x4f8], edx
mov dword [esi + 0x4fc], 0
mov al, byte [ebx + 0x86c]
mov byte [esi + 0x5da], al
test ecx, ecx
je 0x4693ed
mov dword [esi + 0xa4], 1
cmp edx, 0xffffffff
jne 0x4693ed
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [esi + 0x4f8], eax
mov eax, dword [esi + 0x4f8]
cmp eax, 0xffffffff
je 0x469405
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x4fc], eax
mov ebx, dword [sym.imp.USER32.dll_GetDialogBaseUnits]
mov dword [esp + 0x34], ebx
call ebx
movzx eax, ax
mov dword [esp + 0x40], eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
mov edi, eax
push 4
push dword [esp + 0x44]
shr edi, 0x10
push 0x26
mov dword [esp + 0x58], edi
mov dword [esp + 0x28], ebx
call ebx
push 8
push edi
push 0xc
mov dword [esi + 0x78], eax
call ebx
push 4
push dword [esp + 0x44]
mov dword [esi + 0x80], eax
push 0xd
call ebx
mov dword [esi + 0x7c], eax
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 0x58
push ebx
call edi
push 0x5a
push ebx
mov dword [esp + 0x30], eax
call edi
push ebx
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [esp + 0x28]
push 0x60
push ebx
push dword [esi + 0x78]
call dword [esp + 0x28]
push 0x60
push edi
push dword [esi + 0x80]
mov dword [esi + 0x78], eax
call dword [esp + 0x28]
push 0x60
push ebx
push dword [esi + 0x7c]
mov dword [esi + 0x80], eax
call dword [esp + 0x28]
cmp dword [esi + 0xa8], 0
mov dword [esi + 0x7c], eax
je 0x4694ec
push 0x60
push ebx
mov ebx, dword [esp + 0x24]
push 4
push dword [esp + 0x4c]
push 6
call ebx
push eax
call ebx
add dword [esi + 0x78], eax
push 0x60
push edi
push 8
push dword [esp + 0x58]
push 1
call ebx
push eax
call ebx
add dword [esi + 0x80], eax
jmp 0x4694f0
mov ebx, dword [esp + 0x1c]
push 8
push dword [esp + 0x50]
push 0xa
call ebx
mov dword [esi + 0x84], eax
mov eax, dword [esi + 0x78]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x20]
and eax, 0xf00
cmp eax, 0x300
ja 0x469546
je 0x46953d
test eax, eax
je 0x469554
cmp eax, 0x100
je 0x469534
cmp eax, 0x200
jne 0x469554
mov dword [esi + 0x64], 3
jmp 0x46956d
mov dword [esi + 0x64], 2
jmp 0x46956d
mov dword [esi + 0x64], 4
jmp 0x46956d
cmp eax, 0x400
je 0x469566
cmp eax, 0x500
je 0x46955d
mov dword [esi + 0x64], 1
jmp 0x46956d
mov dword [esi + 0x64], 6
jmp 0x46956d
mov dword [esi + 0x64], 5
push 0x208
lea edi, [esi + 0x2e4]
push 0
push edi
call fcn.0048ba70
mov eax, dword [esp + 0x1c]
add esp, 0xc
add eax, 0x644
push eax
push 0x104
push edi
call fcn.00499101
add esp, 0xc
lea eax, [esi + 0x512]
push 0xc8
push 0
push eax
call fcn.0048ba70
add esp, 0xc
push 0x20000
call fcn.0046d49a
add esp, 4
mov dword [esi + 0xd4], eax
push 0x20000
push 0
push eax
call fcn.0048ba70
add esp, 0xc
push 0x20000
call fcn.0046d49a
add esp, 4
mov dword [esi + 0xd8], eax
push 0x20000
push 0
push eax
call fcn.0048ba70
mov ebx, dword [esi + 0xbc]
add esp, 0xc
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x469612
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
test ecx, ecx
je 0x46966a
mov eax, dword [esi + 0xd4]
push 0xffff
test ecx, 0xffff0000
jne 0x46964c
push eax
movzx eax, cx
push eax
push ebx
call edi
test eax, eax
jne 0x46965b
mov eax, dword [esi + 0xd4]
xor ecx, ecx
mov word [eax], cx
jmp 0x46965b
push ecx
push 0x10000
push eax
call fcn.0049d9df
add esp, 0x10
mov eax, dword [esi + 0xd4]
xor ecx, ecx
mov word [eax + 0x1fffe], cx
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x4696bc
mov eax, dword [esi + 0xd8]
push 0xffff
test ecx, 0xffff0000
jne 0x46969e
push eax
movzx eax, cx
push eax
push ebx
call edi
test eax, eax
jne 0x4696ad
mov eax, dword [esi + 0xd8]
xor ecx, ecx
mov word [eax], cx
jmp 0x4696ad
push ecx
push 0x10000
push eax
call fcn.0049d9df
add esp, 0x10
mov eax, dword [esi + 0xd8]
xor ecx, ecx
mov word [eax + 0x1fffe], cx
push 0x208
lea eax, [esi + 0xdc]
push 0
push eax
call fcn.0048ba70
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [ecx + 0x22c]
test eax, eax
je 0x4696ff
push 0x103
lea ecx, [esi + 0xdc]
push ecx
push eax
push ebx
call edi
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x4696ff
mov word [esi + 0xdc], ax
cmp word [esi + 0xdc], 0
jne 0x469733
cmp word [ecx + 0x230], 0
lea eax, [ecx + 0x230]
je 0x469733
push 0x103
push eax
lea eax, [esi + 0xdc]
push 0x104
push eax
call fcn.0049d9df
add esp, 0x10
xor eax, eax
push 0xc8
mov word [esi + 0x2e2], ax
lea eax, [esi + 0xf88]
push 0
push eax
call fcn.0048ba70
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [ecx + 0x438]
test eax, eax
je 0x46977c
push 0x63
lea ecx, [esi + 0xf88]
push ecx
push eax
push ebx
call edi
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x46977c
mov word [esi + 0xf88], ax
cmp word [esi + 0xf88], 0
jne 0x4697aa
cmp word [ecx + 0x43c], 0
lea eax, [ecx + 0x43c]
je 0x4697aa
push 0x63
push eax
lea eax, [esi + 0xf88]
push 0x64
push eax
call fcn.0049d9df
add esp, 0x10
xor eax, eax
xor ebx, ebx
mov word [esi + 0x104e], ax
cmp ebx, 0xc
jne 0x4697fc
cmp word [esi + 0xf88], 0
lea ecx, [esi + 0xf88]
jne 0x4697e9
cmp byte [esi + 0x5da], 0
mov eax, dword [str.Report]
cmovne eax, dword [0x4f0154]
push eax
push 0x64
push ecx
call fcn.00499101
add esp, 0xc
imul eax, ebx, 0xc8
xor ecx, ecx
inc ebx
mov word [esi + eax + 0x6ee], cx
jmp 0x4697b5
cmp byte [esi + 0x5da], 0
je 0x46980e
mov eax, dword [ebx*8 + 0x4f00f4]
jmp 0x469815
mov eax, dword [ebx*8 + 0x4f005c]
push eax
imul edi, ebx, 0xc8
lea eax, [esi + 0x628]
push 0x64
add eax, edi
push eax
call fcn.00499101
xor eax, eax
inc ebx
add esp, 0xc
mov word [esi + edi + 0x6ee], ax
cmp ebx, 0x13
jl 0x4697b5
mov ebx, dword [esp + 0x10]
cmp dword [ebx + 0x870], eax
je 0x469862
lea eax, [ebx + 0x874]
mov ecx, esi
push eax
call fcn.0046b3c0
jmp 0x46994c
test dword [esp + 0x20], 0x20000000
jne 0x46994c
xor edi, edi
cmp edi, 0xc
jne 0x4698c5
cmp word [esi + 0xf88], 0
lea ebx, [esi + 0xf88]
jne 0x4698b4
cmp byte [esi + 0x5da], 0
mov eax, dword [0x4f00b8]
cmovne eax, dword [0x4f0150]
push 0x64
push ebx
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_LoadStringW]
imul edx, edi, 0xc8
mov dword [esp + 0x24], edx
jmp 0x469903
imul edx, edi, 0xc8
mov eax, 1
mov dword [esp + 0x24], edx
jmp 0x469903
cmp byte [esi + 0x5da], 0
lea eax, [edi*8]
je 0x4698dd
mov ecx, dword [eax + 0x4f00f0]
jmp 0x4698e3
mov ecx, dword [eax + 0x4f0058]
imul eax, edi, 0xc8
lea ebx, [esi + 0x628]
push 0x64
add ebx, eax
mov dword [esp + 0x28], eax
push ebx
push ecx
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [edi*8]
test eax, eax
jne 0x469930
cmp byte [esi + 0x5da], 0
mov edx, 0x4f00f4
mov eax, 0x4f005c
cmovne eax, edx
push dword [eax + ecx]
push 0x64
push ebx
call fcn.00499101
add esp, 0xc
mov eax, dword [esp + 0x24]
xor ecx, ecx
inc edi
mov word [esi + eax + 0x6ee], cx
cmp edi, 0x13
jl 0x469872
mov ebx, dword [esp + 0x10]
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
lea eax, [esp + 0xc4]
push 0x1f4
push 0
push eax
mov dword [esp + 0x44], edi
call fcn.0048ba70
add esp, 0xc
mov dword [esp + 0xc0], 0x1f4
lea eax, [esp + 0xc0]
push 0
push eax
push 0x1f4
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [ebx + 0x864]
test ecx, ecx
je 0x4699c6
imul ecx, dword [esp + 0x258]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x258], eax
mov eax, dword [ebx + 0x868]
test eax, eax
je 0x4699e9
cmp word [eax], 0
je 0x4699e9
push eax
lea eax, [esp + 0x278]
push 0x20
push eax
call fcn.00499101
add esp, 0xc
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
mov dword [esi + 0x4f0], eax
mov eax, dword [sym.imp.GDI32.dll_SelectObject]
push edi
mov dword [esp + 0x6c], eax
call eax
mov dword [esp + 0x60], eax
lea edi, [esi + 0x628]
lea eax, [esi + 0x5dc]
mov dword [esp + 0x24], 0x13
mov dword [esp + 0x14], eax
mov ebx, eax
mov eax, dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [esp + 0x3c], eax
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469a36
sub ecx, edx
lea eax, [esp + 0x50]
push eax
sar ecx, 1
push ecx
push edi
push dword [esp + 0x44]
call dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x48]
add eax, 0x14
cmp eax, ecx
cmovg ecx, eax
cmp dword [esi + 0x68], 0
je 0x469a6d
add ecx, dword [esi + 0x7c]
mov dword [ebx], ecx
add edi, 0xc8
add ebx, 4
sub dword [esp + 0x24], 1
jne 0x469a31
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
add edi, 0x50
cmp dword [esi + 0xa8], 0
je 0x469aaa
push 0
call ebx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
sub edi, 0xa
cmp dword [esi + 0xac], 0
je 0x469ac7
push 0
call ebx
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov edi, edx
shr edi, 0x1f
add edi, edx
mov ebx, dword [esp + 0x20]
and ebx, 0xf0
je 0x469ae4
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0xfffffff0
sub ecx, eax
add edi, ecx
push edi
push edi
push 0
lea eax, [esi + 0xc4]
push 0
push eax
mov eax, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x20], eax
call eax
push 0xc50
lea edi, [esi + 0xc4]
push edi
push 0xffffffffffffffff
push dword [esi + 0xd4]
push dword [esp + 0x48]
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [esi + 0xd0]
sub eax, dword [esi + 0xc8]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x68]
push eax
push 2
push 0x4e025c
push dword [esp + 0x44]
call dword [esp + 0x4c]
mov ecx, dword [esi + 0xa8]
mov eax, 0x20
mov edx, dword [esi + 0xcc]
test ecx, ecx
mov dword [edi], 0x10
mov edi, 0x10
cmovne edi, eax
mov dword [esp + 0x28], 0x38
add edx, 0x1c
mov dword [esi + 0xc8], edi
test ecx, ecx
mov dword [esi + 0xcc], edx
mov eax, 0x18
cmovne eax, dword [esp + 0x28]
add eax, 5
add dword [esi + 0xd0], eax
mov eax, dword [esi + 0xd0]
sub eax, edi
mov edi, dword [esp + 0xc]
add eax, 0x10
push eax
push edx
push 0
push 0
lea eax, [esp + 0x90]
push eax
call edi
cmp dword [esi + 0xa8], 0
je 0x469bbb
add dword [esp + 0x88], 0x10
mov ecx, dword [esp + 0x8c]
mov edx, 0x46
mov eax, ecx
mov dword [esi + 0x500], 0x90c80880
sub eax, dword [esp + 0x84]
xorps xmm0, xmm0
cmp eax, edx
push 0
cmovl ecx, edx
xor eax, eax
test dword [esp + 0x24], 0x1000
mov dword [esi + 0x50a], eax
mov word [esi + 0x508], ax
mov dword [esi + 0x504], eax
mov eax, dword [esi + 0x500]
mov dword [esp + 0x90], ecx
mov ecx, 0x90c80882
push 0
cmovne eax, ecx
mov dword [esi + 0x500], eax
lea eax, [esp + 0x98]
movups xmmword [esi + 4], xmm0
push 0
movups xmmword [esi + 0x14], xmm0
push 0
movups xmmword [esi + 0x24], xmm0
push eax
movups xmmword [esi + 0x34], xmm0
movups xmmword [esi + 0x44], xmm0
call edi
mov ecx, dword [esi + 0xc0]
test ecx, ecx
jne 0x469c53
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x20]
test eax, eax
je 0x469c65
movzx eax, ax
push eax
push ecx
jmp 0x469ca8
cmp word [edx + 0x24], 0
lea eax, [edx + 0x24]
je 0x469c73
push eax
push ecx
jmp 0x469ca8
test ebx, ebx
je 0x469cb4
add ebx, 0xfffffff0
mov ecx, 0x7f03
cmp ebx, 0x30
ja case.0x469c8b.17
movzx eax, byte [ebx + 0x46b070]
jmp dword [eax*4 + 0x46b05c]
mov ecx, 0x7f01
jmp case.0x469c8b.17
mov ecx, 0x7f02
jmp case.0x469c8b.17
mov ecx, 0x7f04
push ecx
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esi + 0x4ec], eax
cmp dword [esi + 0x4ec], 0
je 0x469e81
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb
call ebx
push 0xc
mov dword [esp + 0x2c], eax
call ebx
mov edx, dword [esi + 0xa8]
mov edi, 8
mov ebx, dword [esp + 0x28]
test edx, edx
mov dword [esp + 0x2c], eax
mov eax, 0x18
cmovne edi, eax
lea ecx, [edi + ebx]
add ecx, dword [esi + 0xcc]
lea eax, [edi + ebx]
add dword [esi + 0xc4], eax
mov dword [esi + 0xcc], ecx
lea eax, [ecx + 8]
mov dword [esp + 0x88], eax
test edx, edx
je 0x469d20
lea eax, [ecx + 0x18]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x2c]
add eax, 2
add eax, edi
push eax
lea eax, [ebx + 2]
add eax, edi
push eax
push edi
push edi
lea eax, [esp + 0xa0]
push eax
call dword [esp + 0x20]
push 0x20
call fcn.0046d45d
mov ecx, eax
add esp, 4
mov dword [esp + 0x50], ecx
test ecx, ecx
je 0x469d75
mov dword [ecx], vtable.CXDialogItem.0
xorps xmm0, xmm0
movups xmmword [ecx + 4], xmm0
mov word [ecx + 0x14], 0
mov dword [ecx + 0x18], 0x82
mov dword [ecx + 0x1c], 0
jmp 0x469d77
xor ecx, ecx
movzx eax, word [esi + 0x508]
mov dword [esi + eax*4 + 4], ecx
movzx eax, word [esi + 0x508]
mov ebx, dword [esi + eax*4 + 4]
mov dword [esp + 0x18], ebx
call dword [esp + 0x34]
mov edi, eax
shr edi, 0x10
call dword [esp + 0x34]
movzx eax, ax
mov dword [ebx + 0x18], 0x82
movsx ebx, ax
push ebx
push 4
push dword [esp + 0x98]
call dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
movsx edi, di
push edi
push 8
mov word [ecx + 0xc], ax
push dword [esp + 0x9c]
call dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push ebx
push 4
mov word [ecx + 0xe], ax
mov eax, dword [esp + 0xa0]
sub eax, dword [esp + 0x98]
push eax
call dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
push edi
push 8
mov word [ebx + 0x10], ax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x9c]
push eax
call dword [esp + 0x28]
mov word [ebx + 0x12], ax
mov eax, 0x3e8
push 2
mov dword [ebx + 8], 0
mov word [ebx + 0x14], ax
mov dword [ebx + 4], 0x50000000
call fcn.0046d49a
add esp, 4
mov dword [ebx + 0x1c], eax
push 0x4dadc8
push 1
push eax
call fcn.00499101
inc word [esi + 0x508]
add esp, 0xc
cmp dword [esi + 0xa8], 0
je 0x469e81
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x6c]
jle 0x469e81
mov ecx, dword [esi + 0xd0]
sub ecx, dword [esi + 0xc8]
mov eax, dword [esp + 0x94]
mov dword [esi + 0xc8], eax
add eax, ecx
mov dword [esi + 0xd0], eax
mov eax, dword [esi + 0x90]
mov edi, dword [esi + 0xd4]
mov dword [esp + 0x2c], eax
mov dword [esi + 0xa0], eax
inc eax
push 0x20
mov dword [esp + 0x28], edi
mov dword [esi + 0x90], eax
call fcn.0046d45d
mov ecx, eax
add esp, 4
mov dword [esp + 0x50], ecx
test ecx, ecx
je 0x469ed9
mov dword [ecx], vtable.CXDialogItem.0
xorps xmm0, xmm0
movups xmmword [ecx + 4], xmm0
mov word [ecx + 0x14], 0
mov dword [ecx + 0x18], 0x82
mov dword [ecx + 0x1c], 0
jmp 0x469edb
xor ecx, ecx
movzx eax, word [esi + 0x508]
mov dword [esi + eax*4 + 4], ecx
movzx eax, word [esi + 0x508]
mov ebx, dword [esi + eax*4 + 4]
mov dword [esp + 0x18], ebx
call dword [esp + 0x34]
shr eax, 0x10
mov dword [esp + 0x28], eax
call dword [esp + 0x34]
lea ecx, [esi + 0xc4]
movzx eax, ax
mov dword [ebx + 0x18], 0x82
test ecx, ecx
je 0x469f81
movsx edi, ax
push edi
push 4
push dword [ecx]
call dword [esp + 0x28]
mov word [ebx + 0xc], ax
mov eax, dword [esp + 0x28]
movsx ebx, ax
push ebx
push 8
push dword [esi + 0xc8]
call dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
push 4
mov word [ecx + 0xe], ax
mov eax, dword [esi + 0xcc]
sub eax, dword [esi + 0xc4]
push eax
call edi
mov ecx, dword [esp + 0x18]
push ebx
push 8
mov word [ecx + 0x10], ax
mov eax, dword [esi + 0xd0]
sub eax, dword [esi + 0xc8]
push eax
call edi
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
movzx eax, ax
jmp 0x469f8f
xor eax, eax
mov dword [ebx + 0xc], eax
mov eax, 0xa
mov word [ebx + 0x10], ax
mov word [ebx + 0x12], ax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 8], 0
mov word [ebx + 0x14], ax
mov dword [ebx + 4], 0x50000000
test edi, edi
je 0x469fc1
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x469fb0
sub edi, ecx
sar edi, 1
jmp 0x469fc3
xor edi, edi
inc edi
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046d49a
mov edx, dword [esp + 0x28]
add esp, 4
mov ecx, eax
test edx, edx
mov eax, 0x4dadc8
mov dword [ebx + 0x1c], ecx
cmovne eax, edx
push eax
push edi
push ecx
call fcn.00499101
inc word [esi + 0x508]
lea eax, [esi + 0xdc]
xor ebx, ebx
add esp, 0xc
xor edi, edi
mov dword [esp + 0x18], ebx
cmp word [eax], bx
jne 0x46a11d
mov edx, dword [esp + 0x20]
mov eax, edx
and eax, 0xf
cmp eax, 9
ja case.default.0x46a02d
jmp dword [eax*4 + 0x46b0a4]
mov ecx, dword [esp + 0x14]
mov edi, dword [esi + 0x610]
add edi, dword [esi + 0x5f8]
add edi, dword [ecx]
jmp 0x46a0e3
mov edi, dword [esi + 0x61c]
add edi, dword [esi + 0x5e4]
jmp 0x46a0dd
mov ecx, dword [esp + 0x14]
mov ebx, 2
mov edi, dword [esi + 0x5e4]
add edi, dword [ecx]
jmp case.default.0x46a02d
mov edi, dword [esi + 0x5fc]
add edi, dword [esi + 0x5f8]
jmp 0x46a0dd
mov edi, dword [esi + 0x608]
mov ebx, 1
jmp case.default.0x46a02d
mov edi, dword [esi + 0x608]
mov ebx, 2
add edi, dword [esi + 0x5e0]
jmp case.default.0x46a02d
mov edi, dword [esi + 0x610]
mov ebx, 2
add edi, dword [esi + 0x5e0]
jmp case.default.0x46a02d
mov edi, dword [esi + 0x618]
add edi, dword [esi + 0x614]
jmp 0x46a0dd
mov edi, dword [esi + 0x620]
mov ebx, 2
add edi, dword [esi + 0x600]
jmp case.default.0x46a02d
mov edi, dword [esi + 0x620]
add edi, dword [esi + 0x600]
add edi, dword [esi + 0x5e0]
mov ebx, 3
test edx, 0x8000000
je 0x46a0fc
test dl, 7
je 0x46a0fc
add edi, dword [esi + 0x624]
inc ebx
test edx, 0x10000000
je 0x46a1d0
test dl, 7
je 0x46a1d0
add edi, dword [esi + 0x604]
inc ebx
jmp 0x46a1d0
push eax
lea eax, [esp + 0x2bc]
push 0x104
push eax
call fcn.00499101
add esp, 0xc
lea eax, [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x24], ebx
push eax
lea eax, [esp + 0x2bc]
push 0x4da0e4
push eax
call fcn.0049dab0
mov edx, eax
add esp, 0xc
test edx, edx
je 0x46a1cc
xor edi, edi
nop dword [eax + eax]
cmp ebx, 4
jge 0x46a1c6
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x28], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46a170
sub ecx, dword [esp + 0x28]
lea eax, [esp + 0x50]
push eax
sar ecx, 1
push ecx
push edx
push dword [esp + 0x44]
call dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x48]
add eax, 0x14
cmp eax, ecx
cmovg ecx, eax
cmp dword [esi + 0x68], 0
je 0x46a1a9
add ecx, dword [esi + 0x7c]
lea eax, [esp + 0x24]
add edi, ecx
push eax
push 0x4da0e4
push 0
call fcn.0049dab0
mov edx, eax
add esp, 0xc
inc ebx
test edx, edx
jne 0x46a160
mov dword [esp + 0x18], edi
xor edi, edi
mov edx, dword [esp + 0x20]
mov eax, edx
and eax, 0x4000
mov dword [esp + 0x5c], eax
je 0x46a1e4
inc ebx
add edi, dword [esi + 0x5f4]
cmp dword [esi + 0x54], 0
je 0x46a1f1
inc ebx
add edi, dword [esi + 0x60c]
mov eax, edx
and eax, 0x1000000
mov dword [esp + 0x28], eax
je 0x46a204
or dword [esi + 0x5c], 1
jmp 0x46a21e
test edx, 0x2000000
je 0x46a212
or dword [esi + 0x5c], 2
jmp 0x46a21e
test edx, 0x4000000
je 0x46a21e
or dword [esi + 0x5c], 4
mov eax, dword [esi + 0xd0]
mov ecx, dword [esp + 0x9c]
cmp eax, ecx
cmovg ecx, eax
add ecx, 5
cmp dword [esi + 0x4ec], 0
jne 0x46a247
cmp dword [esi + 0x4fc], 0
mov edx, ecx
je 0x46a24c
lea edx, [ecx + 9]
mov ecx, edx
lea eax, [ebx + ebx*2]
lea eax, [edi + eax*2]
mov edi, dword [esp + 0x18]
add edi, 0xfffffffa
add edi, eax
mov eax, dword [esi + 0x80]
add eax, edx
mov dword [esp + 0x2c], edi
push eax
push edi
push ecx
push 0
lea eax, [esp + 0xc0]
push eax
call dword [esp + 0x20]
cmp dword [esi + 0x64], ebx
jle 0x46a284
mov dword [esi + 0x64], 1
cmp dword [esp + 0x28], 0
je 0x46a292
mov ebx, 3
jmp 0x46a2b0
mov eax, dword [esp + 0x20]
test eax, 0x2000000
je 0x46a2a4
mov ebx, 4
jmp 0x46a2b0
test eax, 0x4000000
je 0x46a2c3
mov ebx, 5
mov dword [esp + 0x18], ebx
mov ebx, dword [esi + ebx*4 + 0x5dc]
add ebx, dword [esi + 0x84]
jmp 0x46a2cd
xor ebx, ebx
mov dword [esp + 0x18], 0xffffffff
mov edx, dword [esp + 0xb8]
sub edx, dword [esp + 0xb0]
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0x88]
add eax, 0xc
mov edi, dword [esp + 0x80]
mov dword [esp + 0x8c], eax
lea eax, [edx + 0x20]
cmp ecx, eax
mov dword [esp + 0x28], ebx
cmovle ecx, eax
mov eax, ecx
mov dword [esp + 0x30], ecx
sub eax, edi
mov dword [esp + 0x88], ecx
cmp eax, ebx
jge 0x46a327
lea ecx, [ebx + 0x10]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x88], ecx
mov ebx, dword [esp + 0xb4]
mov eax, ecx
sub eax, edi
mov dword [esp + 0x58], ebx
sub eax, edx
mov dword [esp + 0x50], ebx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp dword [esi + 0xa4], 0
mov ecx, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
je 0x46a373
mov edi, dword [esp + 0x30]
sub edi, dword [esp + 0x2c]
add edi, 0xfffffff0
mov dword [esp + 0x24], edi
mov ecx, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
cmp word [esi + 0xdc], 0
jne 0x46ac32
mov eax, dword [esp + 0x20]
and eax, 0xf
cmp eax, 9
ja case.default.0x46a391
jmp dword [eax*4 + 0x46b0cc]
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x608]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xec0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 1
push 0x80
call fcn.0046c340
mov edi, dword [esp + 0x10]
add edi, 6
add edi, dword [esi + 0x608]
or dword [esi + 0x5c], 0x10
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x608]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xec0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 1
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x80]
mov edi, dword [esp + 0x10]
add eax, ebx
push eax
mov eax, dword [esi + 0x5e0]
add edi, 6
add edi, dword [esi + 0x608]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x6f0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 2
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5e0]
add eax, 6
add edi, eax
or dword [esi + 0x5c], 8
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x620]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x1370]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 6
push 0x80
call fcn.0046c340
mov ecx, dword [esp + 0x10]
mov edi, dword [esi + 0x620]
add ecx, 6
add edi, ecx
test dword [esp + 0x20], 0x8000000
je 0x46a51d
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x624]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x1438]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0x13
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x624]
add eax, 6
add edi, eax
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x600]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xd30]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 7
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x600]
add eax, 6
add edi, eax
test dword [esp + 0x20], 0x10000000
mov dword [esp + 0x14], edi
je 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x604]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xdf8]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0x14
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x604]
add eax, 6
add edi, eax
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x620]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x1370]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 6
push 0x80
call fcn.0046c340
mov ecx, dword [esp + 0x10]
mov edi, dword [esi + 0x620]
add ecx, 6
add edi, ecx
test dword [esp + 0x20], 0x8000000
je 0x46a65a
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x624]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x1438]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0x13
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x624]
add eax, 6
add edi, eax
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x600]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xd30]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 7
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x600]
add eax, 6
add edi, eax
test dword [esp + 0x20], 0x10000000
je 0x46a6ee
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x604]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xdf8]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0x14
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x604]
add eax, 6
add edi, eax
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5e0]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x6f0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 2
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5e0]
add eax, 6
add edi, eax
or dword [esi + 0x5c], 8
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5dc]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x628]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 3
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x80]
mov edi, dword [esp + 0x10]
add eax, ebx
push eax
mov eax, dword [esi + 0x610]
add edi, 6
add edi, dword [esi + 0x5dc]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x1050]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 4
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x610]
add eax, 6
add edi, eax
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5f8]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xba0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 5
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5f8]
add eax, 6
add edi, eax
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x610]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x1050]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 4
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x80]
mov edi, dword [esp + 0x10]
add eax, ebx
push eax
mov eax, dword [esi + 0x5e0]
add edi, 6
add edi, dword [esi + 0x610]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x6f0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 2
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5e0]
add eax, 6
add edi, eax
or dword [esi + 0x5c], 8
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5e4]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x7b8]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0xb
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x80]
mov edi, dword [esp + 0x10]
add eax, ebx
push eax
mov eax, dword [esi + 0x5dc]
add edi, 6
add edi, dword [esi + 0x5e4]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x628]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 3
push 0x80
call fcn.0046c340
add edi, 6
add edi, dword [esi + 0x5dc]
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5e0]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x6f0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 2
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x80]
mov edi, dword [esp + 0x10]
add eax, ebx
push eax
mov eax, dword [esi + 0x61c]
add edi, 6
add edi, dword [esi + 0x5e0]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x12a8]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0xa
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x61c]
add eax, 6
add edi, eax
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5e4]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x7b8]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0xb
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5e4]
add eax, 6
add edi, eax
or dword [esi + 0x5c], 8
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x614]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x1118]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0xe
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x80]
mov edi, dword [esp + 0x10]
add eax, ebx
push eax
mov eax, dword [esi + 0x618]
add edi, 6
add edi, dword [esi + 0x614]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x11e0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0xf
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x618]
add eax, 6
add edi, eax
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5e0]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x6f0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 2
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5e0]
add eax, 6
add edi, eax
or dword [esi + 0x5c], 8
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5f8]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xba0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 5
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x80]
mov ecx, dword [esp + 0x10]
add eax, ebx
mov edi, dword [esi + 0x5f8]
add ecx, 6
push eax
mov eax, dword [esi + 0x5fc]
add edi, ecx
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xc68]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0x10
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5fc]
add eax, 6
add edi, eax
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5e0]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0x6f0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 2
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5e0]
add eax, 6
add edi, eax
or dword [esi + 0x5c], 8
mov dword [esp + 0x14], edi
jmp 0x46aeb8
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x608]
add eax, ecx
push eax
push ebx
push ecx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xec0]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 1
push 0x80
call fcn.0046c340
mov edi, dword [esp + 0x10]
add edi, 6
add edi, dword [esi + 0x608]
mov dword [esp + 0x14], edi
jmp 0x46aeb8
push 0x208
lea eax, [esp + 0x2bc]
push 0
push eax
call fcn.0048ba70
add esp, 0xc
lea eax, [esi + 0xdc]
push 0x103
push eax
lea eax, [esp + 0x2c0]
push 0x104
push eax
call fcn.0049d9df
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0
push eax
lea eax, [esp + 0x2cc]
push 0x4da0e4
push eax
call fcn.0049dab0
mov edx, eax
add esp, 0x1c
mov dword [esp + 0x2c], edx
test edx, edx
je 0x46aeb8
mov eax, 0x17
mov dword [esp + 0x20], eax
add eax, 0xffffffe9
cmp eax, 4
jge 0x46aeb8
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x30], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46acb5
sub ecx, dword [esp + 0x30]
lea eax, [esp + 0x70]
push eax
sar ecx, 1
push ecx
push edx
push dword [esp + 0x44]
call dword [esp + 0x4c]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x48]
add eax, 0x14
cmp eax, ecx
cmovg ecx, eax
cmp dword [esi + 0x68], 0
mov dword [esp + 0x30], ecx
je 0x46acf6
add ecx, dword [esi + 0x7c]
mov dword [esp + 0x30], ecx
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
lea eax, [ecx + edi]
push eax
push ebx
push edi
lea eax, [esp + 0xb0]
push eax
call dword [esp + 0x20]
push 0x20
call fcn.0046d45d
mov ecx, eax
add esp, 4
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x46ad48
mov dword [ecx], vtable.CXDialogItem.0
xorps xmm0, xmm0
movups xmmword [ecx + 4], xmm0
mov word [ecx + 0x14], 0
mov dword [ecx + 0x18], 0x80
mov dword [ecx + 0x1c], 0
jmp 0x46ad4a
xor ecx, ecx
movzx eax, word [esi + 0x508]
mov dword [esi + eax*4 + 4], ecx
movzx eax, word [esi + 0x508]
mov ebx, dword [esi + eax*4 + 4]
mov dword [esp + 0x10], ebx
call dword [esp + 0x34]
mov edi, eax
shr edi, 0x10
call dword [esp + 0x34]
movzx eax, ax
mov dword [ebx + 0x18], 0x80
movsx ebx, ax
push ebx
push 4
push dword [esp + 0xa8]
call dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
movsx edi, di
push edi
push 8
mov word [ecx + 0xc], ax
push dword [esp + 0xac]
call dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
push ebx
push 4
mov word [ecx + 0xe], ax
mov eax, dword [esp + 0xb0]
sub eax, dword [esp + 0xa8]
push eax
call dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
push edi
push 8
mov word [ebx + 0x10], ax
mov eax, dword [esp + 0xb4]
sub eax, dword [esp + 0xac]
push eax
call dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov word [ebx + 0x12], ax
mov dword [ebx + 8], 0
mov word [ebx + 0x14], cx
inc dword [esi + 0x60]
mov dword [ebx + 4], 0x50010000
mov eax, dword [esi + 0x60]
cmp eax, dword [esi + 0x64]
jne 0x46ae13
mov dword [ebx + 4], 0x50010001
mov dword [esi + 0x94], ecx
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x46ae31
mov edi, ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x46ae20
sub edi, ecx
sar edi, 1
jmp 0x46ae33
xor edi, edi
inc edi
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046d49a
mov ecx, eax
add esp, 4
mov eax, dword [esp + 0x10]
test ebx, ebx
mov dword [eax + 0x1c], ecx
mov eax, 0x4dadc8
cmovne eax, ebx
push eax
push edi
push ecx
call fcn.00499101
mov eax, dword [esp + 0x3c]
add esp, 0xc
mov edi, dword [esp + 0x24]
add eax, 6
inc word [esi + 0x508]
add edi, eax
lea eax, [esp + 0x44]
mov dword [esp + 0x24], edi
push eax
push 0x4da0e4
push 0
mov dword [esp + 0x20], edi
call fcn.0049dab0
mov ebx, dword [esp + 0x64]
mov edx, eax
mov eax, dword [esp + 0x2c]
add esp, 0xc
inc eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x20], eax
test edx, edx
jne 0x46aca0
cmp dword [esp + 0x5c], 0
je 0x46af0b
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x5f4]
add eax, edi
push eax
push ebx
push edi
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x20]
lea eax, [esi + 0xad8]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0x12c
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x5f4]
add eax, 6
add edi, eax
mov dword [esp + 0x14], edi
cmp dword [esi + 0x54], 0
je 0x46af5e
mov eax, dword [esi + 0x80]
add eax, ebx
push eax
mov eax, dword [esi + 0x60c]
add eax, edi
push eax
push ebx
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x7c]
push edi
push eax
call ebx
lea eax, [esi + 0xf88]
mov ecx, esi
push eax
lea eax, [esp + 0x74]
push eax
push 0x12d
push 0x80
call fcn.0046c340
mov eax, dword [esi + 0x60c]
add eax, 6
add eax, edi
mov dword [esp + 0x14], eax
jmp 0x46af62
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x18]
cmp edi, 0xffffffff
je 0x46afbc
push dword [esi + 0x84]
lea eax, [esp + 0x74]
push dword [esp + 0x2c]
push 0
push 0
push eax
call ebx
imul eax, edi, 0xc8
mov ecx, esi
add eax, 0x628
add eax, esi
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0046b1e0
mov eax, dword [esp + 0xbc]
mov edi, dword [esp + 0x8c]
cmp eax, edi
jl 0x46afd8
lea edi, [eax + 0x10]
mov dword [esp + 0x8c], edi
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x88]
add eax, 0x10
cmp ecx, eax
mov ebx, dword [esp + 0x38]
push dword [esp + 0x60]
cmovl ecx, eax
xor eax, eax
mov dword [esp + 0x8c], ecx
sub ecx, dword [esp + 0x84]
mov dword [esi + 0x50a], eax
shl ecx, 2
mov eax, ecx
sub edi, dword [esp + 0x88]
cdq
idiv dword [esp + 0x44]
shl edi, 3
mov word [esi + 0x50e], ax
mov eax, edi
cdq
idiv dword [esp + 0x50]
push ebx
mov word [esi + 0x510], ax
call dword [esp + 0x6c]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x4c4]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00488461
mov esp, ebp
pop ebp
ret 0x14