sol.asm
lawlrenz_crumble/crumble/examples/sol.asm

tagPAINTSTRUCT struc ; (sizeof=0x40, standard type) ; XREF: ...
hdc dd ?		; offset
fErase dd ?
rcPaint	RECT ?
fRestore dd ?
fIncUpdate dd ?
rgbReserved db 32 dup(?)
tagPAINTSTRUCT ends


RECT struc ; (sizeof=0x10, standard type) ; XREF: ...
left dd	?
top dd ?
right dd ?
bottom dd ?
RECT ends


tagRECT	struc ;	(sizeof=0x10, standard type) ; XREF: ...
left dd	?
top dd ?
right dd ?
bottom dd ?
tagRECT	ends


tagTEXTMETRICW struc ; (sizeof=0x3C, standard type) ; XREF: ...
tmHeight dd ?
tmAscent dd ?
tmDescent dd ?
tmInternalLeading dd ?
tmExternalLeading dd ?
tmAveCharWidth dd ?
tmMaxCharWidth dd ?
tmWeight dd ?
tmOverhang dd ?
tmDigitizedAspectX dd ?
tmDigitizedAspectY dd ?
tmFirstChar dw ?
tmLastChar dw ?
tmDefaultChar dw ?
tmBreakChar dw ?
tmItalic db ?
tmUnderlined db	?
tmStruckOut db ?
tmPitchAndFamily db ?
tmCharSet db ?
_padding db 3 dup(?)
tagTEXTMETRICW ends


INITCOMMONCONTROLSEX struc ; (sizeof=0x8, standard type) ; XREF: ...
dwSize dd ?
dwICC dd ?
INITCOMMONCONTROLSEX ends


WNDCLASSEXW struc ; (sizeof=0x30, standard type) ; XREF: ...
cbSize dd ?
style dd ?
lpfnWndProc dd ?	; offset
cbClsExtra dd ?
cbWndExtra dd ?
hInstance dd ?		; offset
hIcon dd ?		; offset
hCursor	dd ?		; offset
hbrBackground dd ?	; offset
lpszMenuName dd	?	; offset
lpszClassName dd ?	; offset
hIconSm	dd ?		; offset
WNDCLASSEXW ends


tagMSG struc ; (sizeof=0x1C, standard type) ; XREF: ...
hwnd dd	?		; offset
message	dd ?
wParam dd ?
lParam dd ?
time dd	?
pt POINT ?
tagMSG ends


POINT struc ; (sizeof=0x8, standard type) ; XREF: ...
x dd ?
y dd ?
POINT ends


tagPOINT struc ; (sizeof=0x8, standard type) ; XREF: ...
x dd ?
y dd ?
tagPOINT ends


tagSIZE	struc ;	(sizeof=0x8, standard type) ; XREF: ...
_cx dd ?
cy dd ?
tagSIZE	ends


WNDCLASSW struc	; (sizeof=0x28,	standard type) ; XREF: ...
style dd ?
lpfnWndProc dd ?	; offset
cbClsExtra dd ?
cbWndExtra dd ?
hInstance dd ?		; offset
hIcon dd ?		; offset
hCursor	dd ?		; offset
hbrBackground dd ?	; offset
lpszMenuName dd	?	; offset
lpszClassName dd ?	; offset
WNDCLASSW ends


_SCOPETABLE_ENTRY struc	; (sizeof=0xC) ; XREF: ...
EnclosingLevel dd ?
FilterFunc dd ?		; offset
HandlerFunc dd ?	; offset
_SCOPETABLE_ENTRY ends


CPPEH_RECORD struc ; (sizeof=0x18) ; XREF: ...
old_esp	dd ?		; XREF:	...
exc_ptr	dd ?		; XREF:	... ; offset
registration _EH3_EXCEPTION_REGISTRATION ? ; XREF: ...
CPPEH_RECORD ends


_EH3_EXCEPTION_REGISTRATION struc ; (sizeof=0x10, standard type) ; XREF: ...
Next dd	?		; offset
ExceptionHandler dd ?	; offset
ScopeTable dd ?		; offset
TryLevel dd ?		; XREF:	...
_EH3_EXCEPTION_REGISTRATION ends


_STARTUPINFOA struc ; (sizeof=0x44, standard type) ; XREF: ...
cb dd ?
lpReserved dd ?		; offset
lpDesktop dd ?		; offset
lpTitle	dd ?		; offset
dwX dd ?
dwY dd ?
dwXSize	dd ?
dwYSize	dd ?
dwXCountChars dd ?
dwYCountChars dd ?
dwFillAttribute	dd ?
dwFlags	dd ?
wShowWindow dw ?
cbReserved2 dw ?
lpReserved2 dd ?	; offset
hStdInput dd ?		; offset
hStdOutput dd ?		; offset
hStdError dd ?		; offset
_STARTUPINFOA ends


;
; +-------------------------------------------------------------------------+
; |   This file	has been generated by The Interactive Disassembler (IDA)    |
; |	      Copyright	(c) 2013 Hex-Rays, <support@hex-rays.com>	    |
; |			 License info: 48-3215-7394-8A			    |
; |  Universitaet Bonn/	Institut fuer Informatik Abteilung fuer	Informati   |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	373E7A863A1A345C60EDB9E20EC32311
; Input	CRC32 :	8ECE50A6

; File Name   :	Y:\binaries\sol.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	1000000
; Section 1. (virtual address 00001000)
; Virtual size			: 00005D2E (  23854.)
; Section size in file		: 00005E00 (  24064.)
; Offset to raw	data for section: 00000400
; Flags	60000020: Text Executable Readable
; Alignment	: default
;
; Imports from ADVAPI32.dll
;

include	uni.inc	; see unicode subdir of	ida for	info on	unicode

.686p
.mmx
.model flat


; Segment type:	Externs
; _idata
; LSTATUS __stdcall RegCreateKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD Reserved, LPWSTR	lpClass, DWORD dwOptions, REGSAM samDesired, const LPSECURITY_ATTRIBUTES lpSecurityAttributes, PHKEY phkResult,	LPDWORD	lpdwDisposition)
extrn RegCreateKeyExW:dword
; LSTATUS __stdcall RegQueryValueExW(HKEY hKey,	LPCWSTR	lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE	lpData,	LPDWORD	lpcbData)
extrn RegQueryValueExW:dword
; LSTATUS __stdcall RegOpenKeyExA(HKEY hKey, LPCSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY	phkResult)
extrn RegOpenKeyExA:dword
; LSTATUS __stdcall RegQueryValueExA(HKEY hKey,	LPCSTR lpValueName, LPDWORD lpReserved,	LPDWORD	lpType,	LPBYTE lpData, LPDWORD lpcbData)
extrn RegQueryValueExA:dword
; LSTATUS __stdcall RegSetValueExW(HKEY	hKey, LPCWSTR lpValueName, DWORD Reserved, DWORD dwType, const BYTE *lpData, DWORD cbData)
extrn RegSetValueExW:dword
; LSTATUS __stdcall RegCloseKey(HKEY hKey)
extrn RegCloseKey:dword

;
; Imports from CARDS.dll
;
extrn __imp_cdtDrawExt:dword
extrn __imp_cdtInit:dword
extrn __imp_cdtTerm:dword
extrn __imp_cdtDraw:dword

;
; Imports from COMCTL32.dll
;
; BOOL __stdcall InitCommonControlsEx(const INITCOMMONCONTROLSEX *picce)
extrn InitCommonControlsEx:dword

;
; Imports from GDI32.dll
;
; COLORREF __stdcall SetTextColor(HDC hdc, COLORREF color)
extrn SetTextColor:dword
; COLORREF __stdcall SetPixel(HDC hdc, int x, int y, COLORREF color)
extrn SetPixel:dword
; BOOL __stdcall LineDDA(int xStart, int yStart, int xEnd, int yEnd, LINEDDAPROC lpProc, LPARAM	data)
extrn LineDDA:dword
; BOOL __stdcall BitBlt(HDC hdc, int x,	int y, int cx, int cy, HDC hdcSrc, int x1, int y1, DWORD rop)
extrn BitBlt:dword
; HDC __stdcall	CreateCompatibleDC(HDC hdc)
extrn CreateCompatibleDC:dword
; HGDIOBJ __stdcall GetStockObject(int i)
extrn GetStockObject:dword
; BOOL __stdcall GetTextExtentPoint32W(HDC hdc,	LPCWSTR	lpString, int c, LPSIZE	psizl)
extrn GetTextExtentPoint32W:dword
; HFONT	__stdcall CreateFontW(int cHeight, int cWidth, int cEscapement,	int cOrientation, int cWeight, DWORD bItalic, DWORD bUnderline,	DWORD bStrikeOut, DWORD	iCharSet, DWORD	iOutPrecision, DWORD iClipPrecision, DWORD iQuality, DWORD iPitchAndFamily, LPCWSTR pszFaceName)
extrn CreateFontW:dword
; BOOL __stdcall DeleteDC(HDC hdc)
extrn DeleteDC:dword
; BOOL __stdcall TextOutW(HDC hdc, int x, int y, LPCWSTR lpString, int c)
extrn TextOutW:dword
; BOOL __stdcall PtVisible(HDC hdc, int	x, int y)
extrn PtVisible:dword
; BOOL __stdcall SetBrushOrgEx(HDC hdc,	int x, int y, LPPOINT lppt)
extrn SetBrushOrgEx:dword
; HGDIOBJ __stdcall SelectObject(HDC hdc, HGDIOBJ h)
extrn SelectObject:dword
; BOOL __stdcall PatBlt(HDC hdc, int x,	int y, int w, int h, DWORD rop)
extrn PatBlt:dword
; int __stdcall	SetROP2(HDC hdc, int rop2)
extrn SetROP2:dword
; BOOL __stdcall MoveToEx(HDC hdc, int x, int y, LPPOINT lppt)
extrn MoveToEx:dword
; BOOL __stdcall LineTo(HDC hdc, int x,	int y)
extrn LineTo:dword
; BOOL __stdcall GetTextMetricsW(HDC hdc, LPTEXTMETRICW	lptm)
extrn GetTextMetricsW:dword
; BOOL __stdcall DeleteObject(HGDIOBJ ho)
extrn DeleteObject:dword
; HBRUSH __stdcall CreateSolidBrush(COLORREF color)
extrn CreateSolidBrush:dword
; int __stdcall	GetDeviceCaps(HDC hdc, int index)
extrn GetDeviceCaps:dword
; HBITMAP __stdcall CreateCompatibleBitmap(HDC hdc, int	cx, int	cy)
extrn CreateCompatibleBitmap:dword

;
; Imports from KERNEL32.dll
;
; void __stdcall GetStartupInfoA(LPSTARTUPINFOA	lpStartupInfo)
extrn GetStartupInfoA:dword
; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName)
extrn GetModuleHandleA:dword
; int __stdcall	MulDiv(int nNumber, int	nNumerator, int	nDenominator)
extrn MulDiv:dword
; int __stdcall	lstrlenW(LPCWSTR lpString)
extrn lstrlenW:dword
; HLOCAL __stdcall LocalFree(HLOCAL hMem)
extrn __imp_LocalFree:dword
; HLOCAL __stdcall LocalAlloc(UINT uFlags, SIZE_T uBytes)
extrn LocalAlloc:dword
; LPWSTR __stdcall GetCommandLineW()
extrn GetCommandLineW:dword
; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)
extrn GetProcAddress:dword
; HMODULE __stdcall LoadLibraryA(LPCSTR	lpLibFileName)
extrn LoadLibraryA:dword

;
; Imports from SHELL32.dll
;
; INT __stdcall	ShellAboutW(HWND hWnd, LPCWSTR szApp, LPCWSTR szOtherStuff, HICON hIcon)
extrn ShellAboutW:dword

;
; Imports from USER32.dll
;
; HWND __stdcall SetFocus(HWND hWnd)
extrn SetFocus:dword
; ATOM __stdcall RegisterClassW(const WNDCLASSW	*lpWndClass)
extrn RegisterClassW:dword
; BOOL __stdcall CopyRect(LPRECT lprcDst, const	RECT *lprcSrc)
extrn CopyRect:dword
; BOOL __stdcall MoveWindow(HWND hWnd, int X, int Y, int nWidth, int nHeight, BOOL bRepaint)
extrn MoveWindow:dword
; BOOL __stdcall DestroyWindow(HWND hWnd)
extrn DestroyWindow:dword
; DWORD	__stdcall GetSysColor(int nIndex)
extrn GetSysColor:dword
; BOOL __stdcall EndPaint(HWND hWnd, const PAINTSTRUCT *lpPaint)
extrn EndPaint:dword
; HDC __stdcall	BeginPaint(HWND	hWnd, LPPAINTSTRUCT lpPaint)
extrn BeginPaint:dword
; HDC __stdcall	GetDC(HWND hWnd)
extrn GetDC:dword
; int __stdcall	ReleaseDC(HWND hWnd, HDC hDC)
extrn ReleaseDC:dword
; BOOL __stdcall InvalidateRect(HWND hWnd, const RECT *lpRect, BOOL bErase)
extrn InvalidateRect:dword
; BOOL __stdcall EndDialog(HWND	hDlg, INT_PTR nResult)
extrn EndDialog:dword
; HWND __stdcall GetDesktopWindow()
extrn GetDesktopWindow:dword
; int __stdcall	LoadStringA(HINSTANCE hInstance, UINT uID, LPSTR lpBuffer, int cchBufferMax)
extrn LoadStringA:dword
; BOOL __stdcall ReleaseCapture()
extrn ReleaseCapture:dword
; HWND __stdcall GetCapture()
extrn GetCapture:dword
; HWND __stdcall SetCapture(HWND hWnd)
extrn SetCapture:dword
; BOOL __stdcall PostMessageW(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
extrn PostMessageW:dword
; BOOL __stdcall EnableMenuItem(HMENU hMenu, UINT uIDEnableItem, UINT uEnable)
extrn EnableMenuItem:dword
; HMENU	__stdcall GetMenu(HWND hWnd)
extrn GetMenu:dword
; LRESULT __stdcall DefWindowProcW(HWND	hWnd, UINT Msg,	WPARAM wParam, LPARAM lParam)
extrn DefWindowProcW:dword
; int __stdcall	ShowCursor(BOOL	bShow)
extrn ShowCursor:dword
; void __stdcall PostQuitMessage(int nExitCode)
extrn PostQuitMessage:dword
; BOOL __stdcall KillTimer(HWND	hWnd, UINT_PTR uIDEvent)
extrn KillTimer:dword
; BOOL __stdcall GetClientRect(HWND hWnd, LPRECT lpRect)
extrn GetClientRect:dword
; BOOL __stdcall IsIconic(HWND hWnd)
extrn IsIconic:dword
; HACCEL __stdcall LoadAcceleratorsW(HINSTANCE hInstance, LPCWSTR lpTableName)
extrn LoadAcceleratorsW:dword
; BOOL __stdcall UpdateWindow(HWND hWnd)
extrn UpdateWindow:dword
; BOOL __stdcall ShowWindow(HWND hWnd, int nCmdShow)
extrn ShowWindow:dword
; UINT_PTR __stdcall SetTimer(HWND hWnd, UINT_PTR nIDEvent, UINT uElapse, TIMERPROC lpTimerFunc)
extrn SetTimer:dword
; HWND __stdcall CreateWindowExW(DWORD dwExStyle, LPCWSTR lpClassName, LPCWSTR lpWindowName, DWORD dwStyle, int	X, int Y, int nWidth, int nHeight, HWND	hWndParent, HMENU hMenu, HINSTANCE hInstance, LPVOID lpParam)
extrn CreateWindowExW:dword
; BOOL __stdcall AdjustWindowRect(LPRECT lpRect, DWORD dwStyle,	BOOL bMenu)
extrn AdjustWindowRect:dword
; ATOM __stdcall RegisterClassExW(const	WNDCLASSEXW *)
extrn RegisterClassExW:dword
; HANDLE __stdcall LoadImageW(HINSTANCE	hInst, LPCWSTR name, UINT type,	int cx,	int cy,	UINT fuLoad)
extrn LoadImageW:dword
; HICON	__stdcall LoadIconW(HINSTANCE hInstance, LPCWSTR lpIconName)
extrn LoadIconW:dword
; UINT __stdcall RegisterWindowMessageW(LPCWSTR	lpString)
extrn RegisterWindowMessageW:dword
; HCURSOR __stdcall LoadCursorW(HINSTANCE hInstance, LPCWSTR lpCursorName)
extrn LoadCursorW:dword
; LRESULT __stdcall DispatchMessageW(const MSG *lpMsg)
extrn DispatchMessageW:dword
; BOOL __stdcall TranslateMessage(const	MSG *lpMsg)
extrn TranslateMessage:dword
; int __stdcall	TranslateAcceleratorW(HWND hWnd, HACCEL	hAccTable, LPMSG lpMsg)
extrn TranslateAcceleratorW:dword
; BOOL __stdcall GetMessageW(LPMSG lpMsg, HWND hWnd, UINT wMsgFilterMin, UINT wMsgFilterMax)
extrn GetMessageW:dword
; BOOL __stdcall InvertRect(HDC	hDC, const RECT	*lprc)
extrn InvertRect:dword
; BOOL __stdcall IntersectRect(LPRECT lprcDst, const RECT *lprcSrc1, const RECT	*lprcSrc2)
extrn IntersectRect:dword
; int __stdcall	MessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType)
extrn MessageBoxW:dword
; int __stdcall	LoadStringW(HINSTANCE hInstance, UINT uID, LPWSTR lpBuffer, int	cchBufferMax)
extrn LoadStringW:dword
; BOOL __stdcall SetCursorPos(int X, int Y)
extrn SetCursorPos:dword
; BOOL __stdcall ClientToScreen(HWND hWnd, LPPOINT lpPoint)
extrn ClientToScreen:dword
; SHORT	__stdcall GetKeyState(int nVirtKey)
extrn GetKeyState:dword
; BOOL __stdcall PtInRect(const	RECT *lprc, POINT pt)
extrn PtInRect:dword
; BOOL __stdcall PeekMessageW(LPMSG lpMsg, HWND	hWnd, UINT wMsgFilterMin, UINT wMsgFilterMax, UINT wRemoveMsg)
extrn PeekMessageW:dword
; DWORD	__stdcall MsgWaitForMultipleObjects(DWORD nCount, const	HANDLE *pHandles, BOOL fWaitAll, DWORD dwMilliseconds, DWORD dwWakeMask)
extrn MsgWaitForMultipleObjects:dword
; int __stdcall	DrawTextW(HDC hdc, LPCWSTR lpchText, int cchText, LPRECT lprc, UINT format)
extrn DrawTextW:dword
; BOOL __stdcall WinHelpW(HWND hWndMain, LPCWSTR lpszHelp, UINT	uCommand, ULONG_PTR dwData)
extrn WinHelpW:dword
; BOOL __stdcall CheckDlgButton(HWND hDlg, int nIDButton, UINT uCheck)
extrn CheckDlgButton:dword
; UINT __stdcall IsDlgButtonChecked(HWND hDlg, int nIDButton)
extrn IsDlgButtonChecked:dword
; BOOL __stdcall EnableWindow(HWND hWnd, BOOL bEnable)
extrn EnableWindow:dword
; HWND __stdcall GetDlgItem(HWND hDlg, int nIDDlgItem)
extrn GetDlgItem:dword
; BOOL __stdcall CheckRadioButton(HWND hDlg, int nIDFirstButton, int nIDLastButton, int	nIDCheckButton)
extrn CheckRadioButton:dword
; INT_PTR __stdcall DialogBoxParamW(HINSTANCE hInstance, LPCWSTR lpTemplateName, HWND hWndParent, DLGPROC lpDialogFunc,	LPARAM dwInitParam)
extrn DialogBoxParamW:dword
; BOOL __stdcall InflateRect(LPRECT lprc, int dx, int dy)
extrn InflateRect:dword
; int __stdcall	FrameRect(HDC hDC, const RECT *lprc, HBRUSH hbr)
extrn FrameRect:dword

;
; Imports from msvcrt.dll
;
extrn __imp__except_handler3:dword
; unsigned int __cdecl _controlfp(unsigned int NewValue, unsigned int Mask)
extrn __imp__controlfp:dword
extrn __set_app_type:dword
extrn __p__fmode:dword
extrn __p__commode:dword
extrn _adjust_fdiv:dword
extrn __setusermatherr:dword
extrn __imp__initterm:dword
extrn __getmainargs:dword
extrn _acmdln:dword
; void __cdecl exit(int	Code)
extrn exit:dword
; void __cdecl cexit()
extrn _cexit:dword
extrn __imp__XcptFilter:dword
; void __cdecl exit(int	Code)
extrn _exit:dword
; void __cdecl c_exit()
extrn _c_exit:dword
; int __cdecl rand()
extrn rand:dword
; time_t __cdecl time(time_t *Time)
extrn time:dword
; void __cdecl srand(unsigned int Seed)
extrn srand:dword



; Segment type:	Pure code
; Segment permissions: Read/Execute
_text segment para public 'CODE' use32
assume cs:_text
;org 1001208h
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
dword_1001208 dd 0
dword_100120C dd 0
dword_1001210 dd 0
dword_1001214 dd 4 dup(0)
dd 3B7D8480h, 0
dd 2, 18h, 1358h, 758h
dword_100123C dd 6548544Eh, 632E706Ch, 6D68h
; const	WCHAR Data
Data dd	24h
; const	WCHAR TableName
TableName:
unicode	0, <HiddenAccel>,0
; const	WCHAR aNotYetImplemen
aNotYetImplemen:
unicode	0, <Not	Yet Implemented>,0
; const	WCHAR SubKey
SubKey:
unicode	0, <Software\Microsoft\Solitair>
unicode	0, <e>,0
align 4
; const	WCHAR pszFaceName
pszFaceName:
unicode	0, <MS Shell Dlg>,0
align 4
; const	WCHAR szHelp
szHelp:
unicode	0, <sol.hlp>,0
; const	WCHAR WindowName
WindowName dw 0
align 4
stru_10012F8 _SCOPETABLE_ENTRY <0FFFFFFFFh, \ ;	SEH scope table	for function 1005F85
		   offset loc_1006112, \
		   offset loc_1006126>
align 8
; char LibFileName[11]
LibFileName db 'hhctrl.ocx',0
align 8
; char aClsidAdb880a6D[]
aClsidAdb880a6D	db 'CLSID\{ADB880A6-D8FF-11CF-9377-00AA'
db '003B7A11}\InprocServer32',0
; char ValueName[4]
ValueName db 4 dup(0)
aNb10 db 'NB10',0
align 10h
dd 3B7D8480h, 1, 2E6C6F73h, 626470h


; Attributes: bp-based frame

; int __stdcall	sub_1001370(HWND hWnd)
sub_1001370 proc near

Paint= tagPAINTSTRUCT ptr -40h
hWnd= dword ptr	 8

push	ebp
mov	ebp, esp
sub	esp, 40h
lea	eax, [ebp+Paint]
push	eax		; lpPaint
push	[ebp+hWnd]	; hWnd
call	ds:BeginPaint
mov	eax, hMem
test	eax, eax
jz	short loc_1001397
push	0
lea	ecx, [ebp+Paint]
push	ecx
push	7
push	eax
call	dword ptr [eax]

loc_1001397:
lea	eax, [ebp+Paint]
push	eax		; lpPaint
push	[ebp+hWnd]	; hWnd
call	ds:EndPaint
leave
retn	4
sub_1001370 endp




sub_10013A8 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	ecx, [esp+arg_0]
mov	eax, hDC
mov	hDC, ecx
mov	ecx, [esp+arg_4]
mov	x, ecx
mov	ecx, [esp+arg_8]
mov	y, ecx
retn	0Ch
sub_10013A8 endp




sub_10013CE proc near
cmp	hDC, 0
jz	short loc_10013E1
inc	dword_1007178
xor	eax, eax
inc	eax
retn

loc_10013E1:		; hWnd
push	hWnd
call	ds:GetDC
test	eax, eax
jnz	short loc_10013F2
retn

loc_10013F2:
push	0
push	0
push	eax
call	sub_10013A8
xor	eax, eax
inc	eax
mov	dword_1007178, eax
retn
sub_10013CE endp




sub_1001405 proc near
mov	eax, hDC
test	eax, eax
jz	short locret_100142A
dec	dword_1007178
jnz	short locret_100142A
push	eax		; hDC
push	hWnd		; hWnd
call	ds:ReleaseDC
and	hDC, 0

locret_100142A:
retn
sub_1001405 endp




; void __stdcall TimerFunc(HWND, UINT, UINT_PTR, DWORD)
TimerFunc proc near
mov	eax, hMem
test	eax, eax
jz	short loc_100143D
push	0
push	0
push	11h
push	eax
call	dword ptr [eax]

loc_100143D:
mov	ax, 1
retn	10h
TimerFunc endp




sub_1001444 proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
cmp	eax, nIDDlgItem
jz	short locret_1001465
push	1		; bErase
push	0		; lpRect
push	hWnd		; hWnd
mov	nIDDlgItem, eax
call	ds:InvalidateRect

locret_1001465:
retn	4
sub_1001444 endp




sub_1001468 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

cmp	[esp+arg_0], 0
jz	short loc_100148A
push	0		; Time
call	ds:time
and	eax, 7FFFh
push	eax		; Seed
mov	dword_1007344, eax
call	ds:srand
pop	ecx
pop	ecx

loc_100148A:
mov	eax, hMem
push	0
push	[esp+4+arg_4]
push	8
push	eax
call	dword ptr [eax]
retn	8
sub_1001468 endp



; Attributes: bp-based frame

sub_100149D proc near

Buffer=	byte ptr -64h
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 64h
push	esi
push	64h		; cchBufferMax
lea	eax, [ebp+Buffer]
push	eax		; lpBuffer
push	69h		; uID
push	hInstance	; hInstance
call	ds:LoadStringA
xor	esi, esi
cmp	[ebp+arg_0], 0FFFFFFE2h
jz	short loc_10014DA
cmp	[ebp+arg_0], 0FFFFFFE3h
jz	short loc_10014D5
cmp	[ebp+arg_0], 0FFFFFFE4h
jnz	short loc_10014EE
push	esi
push	esi
push	offset dword_100123C
jmp	short loc_10014E0

loc_10014D5:
push	esi
push	2
jmp	short loc_10014DC

loc_10014DA:
push	esi
push	esi

loc_10014DC:
lea	eax, [ebp+Buffer]
push	eax

loc_10014E0:
call	ds:GetDesktopWindow
push	eax
call	sub_10061DE
jmp	short loc_10014F1

loc_10014EE:
mov	eax, [ebp+arg_0]

loc_10014F1:
cmp	eax, esi
pop	esi
jnz	short locret_1001500
push	12Dh
call	sub_100261C

locret_1001500:
leave
retn	4
sub_100149D endp




sub_1001504 proc near

arg_0= dword ptr  4

mov	ecx, dword_1007184
xor	eax, eax
cmp	dword_100702C, 3
push	esi
setz	al
xor	esi, esi
inc	esi
and	ecx, esi
shl	ecx, 3
and	eax, esi
or	eax, ecx
mov	ecx, dword_1007188
shl	eax, 1
and	ecx, esi
or	eax, ecx
mov	ecx, dword_1007024
shl	eax, 1
and	ecx, esi
or	eax, ecx
mov	ecx, dword_1007020
shl	eax, 1
and	ecx, esi
or	eax, ecx
push	eax		; hKey
push	0C9h		; __int16
push	64h		; int
call	sub_1002540
mov	edx, [esp+4+arg_0]
mov	ecx, eax
and	ecx, esi
mov	dword_1007020, ecx
mov	ecx, eax
and	ecx, 2
shr	ecx, 1
mov	dword_1007024, ecx
mov	ecx, eax
and	ecx, 4
shr	ecx, 2
mov	[edx], ecx
mov	ecx, eax
and	ecx, 8
or	ecx, 4
shr	ecx, 2
mov	dword_100702C, ecx
mov	ecx, eax
shr	eax, 4
and	ecx, 40h
shr	ecx, 6
and	eax, 3
dec	eax
mov	dword_1007184, ecx
jz	short loc_10015BC
dec	eax
jz	short loc_10015B0
mov	nIDCheckButton,	12Eh
jmp	short loc_10015C6

loc_10015B0:
mov	nIDCheckButton,	130h
jmp	short loc_10015C6

loc_10015BC:
mov	nIDCheckButton,	12Fh

loc_10015C6:
call	ds:rand
push	0Ch
pop	ecx
cdq
idiv	ecx
push	edx		; hKey
push	0C8h		; __int16
push	64h		; int
call	sub_1002540
push	41h
add	eax, 35h
push	36h
push	eax
call	sub_10023C6
push	eax
call	sub_1001444
push	0		; hKey
push	0CBh		; __int16
mov	esi, 0CDh
push	esi		; int
call	sub_1002540
push	0Ah		; cbData
push	offset Data	; lpData
push	offset unk_1007370 ; int
push	0CCh		; __int16
push	esi		; int
mov	dword_1007340, eax
call	sub_100247F
pop	esi
retn	4
sub_1001504 endp




sub_1001624 proc near

arg_0= byte ptr	 4

xor	eax, eax
inc	eax
test	[esp+arg_0], al
jz	short loc_100169E
mov	edx, dword_1007184
xor	ecx, ecx
cmp	dword_100702C, 3
setz	cl
and	edx, eax
shl	edx, 3
and	ecx, eax
or	ecx, edx
mov	edx, dword_1007188
and	edx, eax
shl	ecx, 1
or	ecx, edx
mov	edx, dword_1007024
and	edx, eax
shl	ecx, 1
or	ecx, edx
mov	edx, dword_1007020
and	edx, eax
mov	eax, nIDCheckButton
shl	ecx, 1
or	ecx, edx
sub	eax, 12Eh
jz	short loc_100168E
dec	eax
jz	short loc_1001686
dec	eax
jnz	short loc_1001691
and	ecx, 0FFFFFFEFh
or	ecx, 20h
jmp	short loc_1001691

loc_1001686:
and	ecx, 0FFFFFFDFh
or	ecx, 10h
jmp	short loc_1001691

loc_100168E:
and	ecx, 0FFFFFFCFh

loc_1001691:		; Data
push	ecx
push	0C9h		; __int16
push	64h		; int
call	sub_1002415

loc_100169E:
test	[esp+arg_0], 4
jz	short locret_10016BA
mov	eax, nIDDlgItem
add	eax, 0FFFFFFCBh
push	eax		; Data
push	0C8h		; __int16
push	64h		; int
call	sub_1002415

locret_10016BA:
retn	4
sub_1001624 endp



; Attributes: bp-based frame

; int __stdcall	sub_10016BD(HWND hWnd, UINT Msg, WPARAM	wParam,	LPARAM lParam)
sub_10016BD proc near

Buffer=	word ptr -0D0h
var_8= dword ptr -8
var_4= dword ptr -4
hWnd= dword ptr	 8
Msg= dword ptr	0Ch
wParam=	dword ptr  10h
lParam=	dword ptr  14h

push	ebp
mov	ebp, esp
sub	esp, 0D0h
push	esi
push	edi
mov	edi, [ebp+Msg]
mov	eax, 100h
cmp	edi, eax
ja	loc_100184F
jz	loc_1001843
cmp	edi, 7
ja	loc_10017E8
jz	loc_1001832
mov	eax, edi
dec	eax
dec	eax
jz	loc_10017A5
dec	eax
jz	loc_100179B
dec	eax
dec	eax
jz	short loc_1001730
dec	eax
jnz	loc_1001A7B
cmp	word ptr [ebp+wParam], 0
jz	loc_10018AE
mov	eax, [ebp+wParam]
shr	eax, 10h
test	ax, ax
jnz	loc_10018AE
push	[ebp+hWnd]	; hWnd
call	sub_1001370
jmp	loc_10018AE

loc_1001730:		; hWnd
push	[ebp+hWnd]
call	ds:IsIconic
push	offset Rect	; lpRect
push	[ebp+hWnd]	; hWnd
mov	dword_100716C, eax
call	ds:GetClientRect
mov	ecx, dword_1007308
movsx	eax, word ptr [ebp+lParam]
movsx	edx, cx
imul	edx, 7
sub	eax, edx
cdq
push	8
pop	esi
idiv	esi
push	8
mov	esi, eax
mov	eax, ecx
cdq
pop	ecx
idiv	ecx
add	eax, 3
cmp	esi, eax
jge	short loc_1001783
cmp	dword_1007338, eax
jz	short loc_100177F
mov	esi, eax

loc_100177F:
cmp	esi, eax
jl	short loc_100179B

loc_1001783:
mov	dword_1007338, esi
call	sub_10040FE
push	1		; bErase
push	0		; lpRect
push	[ebp+hWnd]	; hWnd
call	ds:InvalidateRect

loc_100179B:
call	sub_1005D94
jmp	loc_10018AE

loc_10017A5:		; uIDEvent
push	29Ah
push	hWnd		; hWnd
call	ds:KillTimer
mov	eax, hMem
xor	esi, esi
push	esi
push	esi
push	1
push	eax
call	dword ptr [eax]
push	1
call	sub_10026F8
call	cdtTerm
push	ho		; ho
call	ds:DeleteObject
push	esi		; nExitCode
call	ds:PostQuitMessage
jmp	loc_10018AE

loc_10017E8:
cmp	edi, 8
jz	short loc_100181E
cmp	edi, 0Fh
jz	short loc_1001802
cmp	edi, 53h
jnz	loc_1001A7B
push	0FFFFFFE2h
jmp	loc_10019FB

loc_1001802:
cmp	dword_100716C, 0
jnz	loc_10018AE
push	[ebp+hWnd]	; hWnd
call	sub_1001370
xor	eax, eax
jmp	loc_10018BE

loc_100181E:
mov	eax, hMem
xor	esi, esi
cmp	[eax+4Ch], esi
jz	short loc_1001832
push	1
push	esi
push	4
push	eax
call	dword ptr [eax]

loc_1001832:
xor	eax, eax
cmp	edi, 7
setz	al
push	eax		; bShow
call	ds:ShowCursor
jmp	short loc_10018AE

loc_1001843:
push	0
push	[ebp+wParam]
push	2
jmp	loc_1001A3B

loc_100184F:
mov	eax, 201h
xor	esi, esi
cmp	edi, eax
ja	loc_1001A64
jz	loc_1001A45
mov	eax, edi
sub	eax, 111h
jz	loc_1001968
push	5
pop	ecx
sub	eax, ecx
jz	short loc_10018E6
sub	eax, 9
jz	short loc_10018C4
sub	eax, 0E1h
jnz	loc_1001A7B

loc_1001888:
mov	eax, hMem
cmp	[eax+4Ch], esi
jz	short loc_10018AE

loc_1001892:
movsx	edx, word ptr [ebp+lParam]
mov	[ebp+var_8], edx
mov	edx, [ebp+lParam]
shr	edx, 10h
movsx	edx, dx
mov	[ebp+var_4], edx
push	esi
lea	edx, [ebp+var_8]
push	edx
push	ecx

loc_10018AB:
push	eax
call	dword ptr [eax]

loc_10018AE:		; lParam
push	[ebp+lParam]
push	[ebp+wParam]	; wParam
push	edi		; Msg
push	[ebp+hWnd]	; hWnd
call	ds:DefWindowProcW

loc_10018BE:
pop	edi
pop	esi
leave
retn	10h

loc_10018C4:
mov	eax, [ebp+wParam]
shr	eax, 10h
test	al, 10h
jnz	short loc_10018DF
test	ah, 28h
jnz	short loc_10018DF
movzx	eax, word ptr [ebp+wParam]
push	eax

loc_10018D8:
call	sub_1005E8E
jmp	short loc_10018AE

loc_10018DF:
push	1FFFh
jmp	short loc_10018D8

loc_10018E6:		; hWnd
push	[ebp+hWnd]
call	ds:GetMenu
mov	edi, eax
mov	eax, hMem
xor	esi, esi
cmp	[eax+4], esi
jz	short loc_1001903
cmp	dword ptr [eax+58h], 0FFFFFFFFh
jz	short loc_1001906

loc_1001903:
push	3
pop	esi

loc_1001906:		; uEnable
push	esi
mov	esi, ds:EnableMenuItem
push	3E9h		; uIDEnableItem
push	edi		; hMenu
call	esi ; EnableMenuItem
mov	eax, hMem
mov	eax, [eax+58h]
inc	eax
neg	eax
sbb	eax, eax
and	eax, 3
push	eax		; uEnable
push	3E8h		; uIDEnableItem
push	edi		; hMenu
call	esi ; EnableMenuItem
mov	eax, hMem
mov	eax, [eax+58h]
inc	eax
neg	eax
sbb	eax, eax
and	eax, 3
push	eax		; uEnable
push	3EAh		; uIDEnableItem
push	edi		; hMenu
call	esi ; EnableMenuItem
mov	eax, hMem
mov	eax, [eax+58h]
inc	eax
neg	eax
sbb	eax, eax
and	eax, 3
push	eax		; uEnable
push	7D0h		; uIDEnableItem
push	edi		; hMenu
call	esi ; EnableMenuItem
mov	edi, [ebp+Msg]
jmp	loc_10018AE

loc_1001968:
movzx	eax, word ptr [ebp+wParam]
mov	ecx, 3ECh
cmp	eax, ecx
jg	short loc_10019D2
jz	short loc_10019B8
sub	eax, 3E8h
jz	short loc_10019AA
dec	eax
jz	short loc_100199F
dec	eax
jz	short loc_1001995
dec	eax
jnz	loc_10018AE
call	sub_1005A1F
jmp	loc_10018AE

loc_1001995:
call	sub_1005C5D
jmp	loc_10018AE

loc_100199F:
xor	esi, esi
push	esi
push	esi
push	9
jmp	loc_1001A3B

loc_10019AA:
push	0
push	1
call	sub_1001468
jmp	loc_10018AE

loc_10019B8:		; lParam
push	0
push	0F060h		; wParam
push	112h		; Msg
push	[ebp+hWnd]	; hWnd
call	ds:PostMessageW
jmp	loc_10018AE

loc_10019D2:
cmp	eax, 3F2h
jz	short loc_1001A35
cmp	eax, 7D0h
jz	short loc_1001A05
cmp	eax, 0FFE1h
jle	loc_10018AE
cmp	eax, 0FFE4h
jg	loc_10018AE
movsx	eax, word ptr [ebp+wParam]
push	eax

loc_10019FB:
call	sub_100149D
jmp	loc_10018AE

loc_1001A05:		; cchBufferMax
push	64h
push	6Ch		; __int16
lea	eax, [ebp+Buffer]
push	eax		; lpBuffer
call	sub_10023F8
push	hIcon		; hIcon
lea	eax, [ebp+Buffer]
push	eax		; szOtherStuff
push	offset szApp	; szApp
push	[ebp+hWnd]	; hWnd
call	ds:ShellAboutW
jmp	loc_10018AE

loc_1001A35:
xor	esi, esi
push	esi
push	esi
push	12h

loc_1001A3B:
mov	eax, hMem
jmp	loc_10018AB

loc_1001A45:		; hWnd
push	[ebp+hWnd]
call	ds:SetCapture
mov	eax, hMem
cmp	[eax+4Ch], esi
jnz	loc_10018AE
push	3
pop	ecx
jmp	loc_1001892

loc_1001A64:
mov	eax, edi
sub	eax, 202h
jz	loc_1001B1E
dec	eax
jz	loc_1001B08
dec	eax
jz	short loc_1001AED

loc_1001A7B:
cmp	edi, dword_1007160
jnz	loc_10018AE
mov	eax, [ebp+wParam]
dec	eax
jz	short loc_1001AD5
dec	eax
jz	short loc_1001AB7
dec	eax
jnz	loc_10018AE
push	0		; lParam
push	0F060h		; wParam
push	112h		; Msg
push	hWnd		; hWnd
call	ds:PostMessageW
xor	eax, eax
inc	eax
jmp	loc_10018BE

loc_1001AB7:
mov	eax, [ebp+lParam]
push	dword ptr [eax+14h]
push	dword ptr [eax+10h]
push	dword ptr [eax+0Ch]
push	dword ptr [eax+8]
push	dword ptr [eax+4]
push	dword ptr [eax]
call	cdtDraw
jmp	loc_10018BE

loc_1001AD5:
movzx	eax, word ptr nNumber
movzx	ecx, word ptr dword_1007308
shl	eax, 10h
or	eax, ecx
jmp	loc_10018BE

loc_1001AED:
call	ds:GetCapture
test	eax, eax
jnz	loc_10018AE
mov	eax, hMem
push	13h
pop	ecx
jmp	loc_1001892

loc_1001B08:
mov	eax, hMem
cmp	[eax+4Ch], esi
push	6
pop	ecx
jnz	loc_10018AE
jmp	loc_1001892

loc_1001B1E:
call	ds:ReleaseCapture
push	4
pop	ecx
jmp	loc_1001888
sub_10016BD endp



; Attributes: bp-based frame fpd=68h

; int __stdcall	sub_1001B2C(HINSTANCE hInstance, int, int, int nCmdShow)
sub_1001B2C proc near

tm= tagTEXTMETRICW ptr -0B0h
Buffer=	word ptr -74h
var_4C=	WNDCLASSEXW ptr	-4Ch
picce= INITCOMMONCONTROLSEX ptr	-1Ch
var_14=	dword ptr -14h
Rect= tagRECT ptr -10h
hInstance= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
nCmdShow= dword	ptr  14h

push	ebp
lea	ebp, [esp-68h]
sub	esp, 0B0h
mov	eax, [ebp+68h+hInstance]
push	ebx
push	esi
push	edi
push	32h		; cchBufferMax
push	12Ch		; __int16
push	offset Text	; lpBuffer
mov	hInstance, eax
call	sub_10023F8
push	offset nNumber
push	offset dword_1007308
call	cdtInit
test	eax, eax
jz	loc_1001E0F
push	7F00h		; lpCursorName
xor	ebx, ebx
push	ebx		; hInstance
call	ds:LoadCursorW
push	ebx		; hWnd
mov	[ebp+68h+var_14], eax
call	ds:GetDC
mov	edi, eax
cmp	edi, ebx
jz	loc_1001E0F
lea	eax, [ebp+68h+tm]
push	eax		; lptm
push	edi		; hdc
call	ds:GetTextMetricsW
mov	eax, [ebp+68h+tm.tmHeight]
mov	esi, ds:GetDeviceCaps
mov	dword_1007368, eax
mov	eax, [ebp+68h+tm.tmMaxCharWidth]
push	18h		; index
push	edi		; hdc
mov	dword_1007310, eax
call	esi ; GetDeviceCaps
cmp	eax, 2
jnz	short loc_1001BC1
mov	dword_1007168, 1

loc_1001BC1:		; index
push	8
push	edi		; hdc
call	esi ; GetDeviceCaps
push	0Ah		; index
push	edi		; hdc
mov	dword_1007360, eax
call	esi ; GetDeviceCaps
xor	ecx, ecx
cmp	eax, 12Ch
setl	cl
mov	dword_1007364, eax
mov	eax, ecx
cmp	eax, ebx
mov	dword_100718C, eax
jz	short loc_1001BF9
mov	eax, nNumber
cdq
sub	eax, edx
sar	eax, 1
mov	nNumber, eax

loc_1001BF9:		; hDC
push	edi
push	ebx		; hWnd
call	ds:ReleaseDC
mov	eax, dword_1007168
neg	eax
sbb	eax, eax
and	eax, 0FF7FFFh
add	eax, 8000h
push	eax		; color
mov	color, eax
call	ds:CreateSolidBrush
push	ebx		; Time
mov	ho, eax
call	ds:time
movzx	eax, ax
push	eax		; Seed
call	ds:srand
pop	ecx
pop	ecx
push	0Ah		; cchBufferMax
push	64h		; __int16
push	offset szApp	; lpBuffer
call	sub_10023F8
push	32h		; cchBufferMax
push	65h		; __int16
push	offset Buffer	; lpBuffer
call	sub_10023F8
push	14h		; cchBufferMax
push	67h		; __int16
lea	eax, [ebp+68h+Buffer]
push	eax		; lpBuffer
call	sub_10023F8
lea	eax, [ebp+68h+Buffer]
push	eax		; lpString
call	ds:RegisterWindowMessageW
mov	dword_1007160, eax
mov	eax, [ebp+68h+arg_8]
mov	ecx, eax
movzx	eax, word ptr [eax]
xor	esi, esi
jmp	short loc_1001C8E

loc_1001C7C:
cmp	ax, 2Fh
jnz	short loc_1001C89
cmp	word ptr [ecx+2], 49h
jz	short loc_1001C95

loc_1001C89:
inc	ecx
inc	ecx
mov	ax, [ecx]

loc_1001C8E:
cmp	ax, bx
jnz	short loc_1001C7C
jmp	short loc_1001C98

loc_1001C95:
xor	esi, esi
inc	esi

loc_1001C98:
lea	eax, [ebp+68h+picce]
push	eax		; picce
mov	[ebp+68h+picce.dwSize],	8
mov	[ebp+68h+picce.dwICC], 16FDh
call	ds:InitCommonControlsEx
mov	edi, 1F4h
push	edi		; lpIconName
push	hInstance	; hInstance
call	ds:LoadIconW
push	ebx		; fuLoad
push	10h		; cy
push	10h		; cx
push	1		; type
push	edi		; name
push	hInstance	; hInst
mov	hIcon, eax
call	ds:LoadImageW
cmp	[ebp+68h+arg_4], ebx
mov	edx, eax
mov	dword_100720C, edx
jnz	short loc_1001D49
xor	eax, eax
push	0Ch
pop	ecx
lea	edi, [ebp+68h+var_4C]
rep stosd
mov	eax, hInstance
mov	[ebp+68h+var_4C.hInstance], eax
mov	eax, hIcon
mov	[ebp+68h+var_4C.hIcon],	eax
mov	eax, [ebp+68h+var_14]
mov	[ebp+68h+var_4C.hCursor], eax
mov	eax, ho
mov	[ebp+68h+var_4C.hbrBackground],	eax
lea	eax, [ebp+68h+var_4C]
push	eax		; WNDCLASSEXW *
mov	[ebp+68h+var_4C.cbSize], 30h
mov	[ebp+68h+var_4C.style],	2008h
mov	[ebp+68h+var_4C.lpfnWndProc], offset sub_10016BD
mov	[ebp+68h+var_4C.hIconSm], edx
mov	[ebp+68h+var_4C.lpszMenuName], 1
mov	[ebp+68h+var_4C.lpszClassName],	offset ClassName ; "Solitaire"
call	ds:RegisterClassExW
test	ax, ax
jz	loc_1001E0F

loc_1001D49:
mov	ecx, dword_1007308
push	8
mov	eax, ecx
imul	ecx, 7
cdq
pop	edi
idiv	edi
push	1		; bMenu
push	0CF0000h	; dwStyle
mov	[ebp+68h+Rect.top], ebx
mov	[ebp+68h+Rect.left], ebx
add	eax, 3
mov	dword_1007338, eax
lea	eax, [ecx+eax*8]
mov	[ebp+68h+Rect.right], eax
mov	eax, nNumber
shl	eax, 2
mov	[ebp+68h+Rect.bottom], eax
lea	eax, [ebp+68h+Rect]
push	eax		; lpRect
call	ds:AdjustWindowRect
mov	edx, [ebp+68h+Rect.bottom]
mov	eax, [ebp+68h+Rect.right]
sub	edx, [ebp+68h+Rect.top]
sub	eax, [ebp+68h+Rect.left]
mov	ecx, dword_1007364
cmp	edx, ecx
mov	[ebp+68h+Rect.right], eax
mov	[ebp+68h+Rect.bottom], edx
jle	short loc_1001DA9
mov	[ebp+68h+Rect.bottom], ecx

loc_1001DA9:		; lpParam
push	ebx
push	hInstance	; hInstance
neg	esi
push	ebx		; hMenu
push	ebx		; hWndParent
push	[ebp+68h+Rect.bottom] ;	nHeight
sbb	esi, esi
push	eax		; nWidth
push	ebx		; Y
push	80000000h	; X
and	esi, 20000000h
add	esi, 2CF0000h
push	esi		; dwStyle
push	offset szApp	; lpWindowName
push	offset ClassName ; "Solitaire"
push	ebx		; dwExStyle
call	ds:CreateWindowExW
cmp	eax, ebx
mov	hWnd, eax
jz	short loc_1001E0F
lea	eax, [ebp+68h+arg_8]
push	eax
call	sub_1001504
push	offset TimerFunc ; lpTimerFunc
push	0FAh		; uElapse
push	29Ah		; nIDEvent
push	hWnd		; hWnd
call	ds:SetTimer
test	eax, eax
jnz	short loc_1001E18

loc_1001E0F:
call	sub_10023E2
xor	eax, eax
jmp	short loc_1001E94

loc_1001E18:
call	sub_100289B
push	[ebp+68h+arg_8]
call	sub_10026F8
push	[ebp+68h+nCmdShow] ; nCmdShow
push	hWnd		; hWnd
call	ds:ShowWindow
push	hWnd		; hWnd
call	ds:UpdateWindow
push	offset TableName ; "HiddenAccel"
push	[ebp+68h+hInstance] ; hInstance
call	ds:LoadAcceleratorsW
mov	hAccTable, eax
xor	eax, eax
cmp	[ebp+68h+arg_4], ebx
setz	al
push	eax
call	sub_1005F1E
cmp	dword_1007020, ebx
jz	short loc_1001E6E
call	sub_1005C79

loc_1001E6E:
cmp	[ebp+68h+nCmdShow], 7
jz	short loc_1001E91
cmp	[ebp+68h+nCmdShow], 6
jz	short loc_1001E91
push	ebx		; lParam
push	3E8h		; wParam
push	111h		; Msg
push	hWnd		; hWnd
call	ds:PostMessageW

loc_1001E91:
xor	eax, eax
inc	eax

loc_1001E94:
pop	edi
pop	esi
pop	ebx
add	ebp, 68h
leave
retn	10h
sub_1001B2C endp



; Attributes: bp-based frame

; int __stdcall	sub_1001E9E(HINSTANCE hInstance, int, int, int nCmdShow)
sub_1001E9E proc near

Msg= tagMSG ptr	-1Ch
hInstance= dword ptr  8
arg_4= dword ptr  0Ch
nCmdShow= dword	ptr  14h

push	ebp
mov	ebp, esp
sub	esp, 1Ch
call	ds:GetCommandLineW
push	[ebp+nCmdShow]	; nCmdShow
push	eax		; int
push	[ebp+arg_4]	; int
push	[ebp+hInstance]	; hInstance
call	sub_1001B2C
test	eax, eax
jz	short locret_1001F13
push	esi
mov	esi, ds:GetMessageW
push	edi
mov	[ebp+Msg.wParam], 1
xor	edi, edi
jmp	short loc_1001EFE

loc_1001ED0:
lea	eax, [ebp+Msg]
push	eax		; lpMsg
push	hAccTable	; hAccTable
push	hWnd		; hWnd
call	ds:TranslateAcceleratorW
test	eax, eax
jnz	short loc_1001EFE
lea	eax, [ebp+Msg]
push	eax		; lpMsg
call	ds:TranslateMessage
lea	eax, [ebp+Msg]
push	eax		; lpMsg
call	ds:DispatchMessageW

loc_1001EFE:		; wMsgFilterMax
push	edi
push	edi		; wMsgFilterMin
lea	eax, [ebp+Msg]
push	edi		; hWnd
push	eax		; lpMsg
call	esi ; GetMessageW
test	eax, eax
jnz	short loc_1001ED0
cmp	[ebp+Msg.wParam], edi
pop	edi
setnz	al
pop	esi

locret_1001F13:
leave
retn	10h
sub_1001E9E endp




sub_1001F17 proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
add	eax, 0C8h
push	eax		; uBytes
push	40h		; uFlags
call	ds:LocalAlloc
retn	4
sub_1001F17 endp

; [00000006 BYTES: COLLAPSED FUNCTION LocalFree. PRESS KEYPAD CTRL-"+" TO EXPAND]



; int __stdcall	sub_1001F32(RECT *lprc)
sub_1001F32 proc near

lprc= dword ptr	 4

push	[esp+lprc]	; lprc
push	hDC		; hDC
call	ds:InvertRect
retn	4
sub_1001F32 endp




sub_1001F45 proc near

arg_0= dword ptr  4

mov	ecx, [esp+arg_0]
xor	eax, eax
mov	ax, [ecx]
mov	dx, ax
shr	dx, 0Fh
push	esi
jz	short loc_1001F61
and	eax, 7FFFh
mov	esi, eax
jmp	short loc_1001F67

loc_1001F61:
mov	esi, nIDDlgItem

loc_1001F67:
push	color
xor	eax, eax
test	dx, dx
setz	al
push	eax
mov	eax, [ecx+8]
sub	eax, y
push	esi
push	nNumber
push	dword_1007308
push	eax
mov	eax, [ecx+4]
sub	eax, x
push	eax
push	hDC
call	cdtDrawExt
pop	esi
retn	4
sub_1001F45 endp




sub_1001FA6 proc near

rop2= dword ptr	-4
arg_0= dword ptr  4
arg_4= dword ptr  8
arg_C= dword ptr  10h

push	ecx
call	sub_10013CE
test	eax, eax
jz	loc_100207E
mov	eax, [esp+4+arg_0]
push	ebx
push	ebp
mov	ebp, [eax+4]
push	esi
push	edi
mov	edi, [eax]
push	6		; rop2
push	hDC		; hdc
call	ds:SetROP2
push	0		; lppt
push	ebp		; y
push	edi		; x
push	hDC		; hdc
mov	[esp+24h+rop2],	eax
call	ds:MoveToEx
mov	eax, dword_1007308
mov	ebx, ds:LineTo
push	ebp		; y
add	eax, edi
push	eax		; x
push	hDC		; hdc
call	ebx ; LineTo
mov	esi, [esp+14h+arg_4]
mov	eax, dword_1007308
dec	esi
mov	[esp+14h+arg_0], esi
imul	esi, [esp+14h+arg_C]
add	esi, nNumber
add	eax, edi
add	esi, ebp
push	esi		; y
push	eax		; x
push	hDC		; hdc
call	ebx ; LineTo
push	esi		; y
push	edi		; x
push	hDC		; hdc
call	ebx ; LineTo
push	ebp		; y
push	edi		; x
push	hDC		; hdc
call	ebx ; LineTo
mov	esi, [esp+14h+arg_0]
test	esi, esi
jz	short loc_1002065

loc_100203D:
add	ebp, [esp+14h+arg_C]
push	0		; lppt
push	ebp		; y
push	edi		; x
push	hDC		; hdc
call	ds:MoveToEx
mov	eax, dword_1007308
push	ebp		; y
add	eax, edi
push	eax		; x
push	hDC		; hdc
call	ebx ; LineTo
dec	esi
jnz	short loc_100203D

loc_1002065:		; rop2
push	[esp+14h+rop2]
push	hDC		; hdc
call	ds:SetROP2
call	sub_1001405
pop	edi
pop	esi
pop	ebp
pop	ebx

loc_100207E:
pop	ecx
retn	10h
sub_1001FA6 endp




sub_1002082 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
xor	esi, esi
cmp	dword_10071CC, esi
jz	short loc_1002092
mov	esi, 80000000h

loc_1002092:
mov	eax, [esp+4+arg_0]
movzx	eax, word ptr [eax]
mov	cx, ax
shr	cx, 0Fh
jz	short loc_10020A9
and	eax, 7FFFh
jmp	short loc_10020AE

loc_10020A9:
mov	eax, nIDDlgItem

loc_10020AE:
push	color
xor	edx, edx
test	cx, cx
setz	dl
or	edx, esi
push	edx
push	eax
push	nNumber
mov	eax, [esp+14h+arg_4]
mov	ecx, [eax+4]
push	dword_1007308
sub	ecx, y
mov	eax, [eax]
sub	eax, x
push	ecx
push	eax
push	hDC
call	cdtDrawExt
pop	esi
retn	8
sub_1002082 endp




sub_10020F2 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

push	color
mov	eax, [esp+4+arg_0]
push	[esp+4+arg_8]
mov	ecx, [eax+4]
push	[esp+8+arg_4]
sub	ecx, y
push	nNumber
mov	eax, [eax]
push	dword_1007308
sub	eax, x
push	ecx
push	eax
push	hDC
call	cdtDrawExt
retn	0Ch
sub_10020F2 endp




sub_1002131 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch
arg_C= dword ptr  10h

push	esi
push	edi
push	0		; lppt
push	y		; y
push	x		; x
push	hDC		; hdc
call	ds:SetBrushOrgEx
push	ho		; h
mov	esi, ds:SelectObject
push	hDC		; hdc
call	esi ; SelectObject
mov	edi, eax
test	edi, edi
jz	short loc_10021A5
mov	eax, [esp+8+arg_4]
mov	ecx, [esp+8+arg_C]
mov	edx, [esp+8+arg_8]
push	0F00021h	; rop
sub	ecx, eax
sub	eax, y
push	ecx		; h
mov	ecx, [esp+10h+arg_0]
sub	edx, ecx
sub	ecx, x
push	edx		; w
push	eax		; y
push	ecx		; x
push	hDC		; hdc
call	ds:PatBlt
push	edi		; h
push	hDC		; hdc
call	esi ; SelectObject

loc_10021A5:
pop	edi
pop	esi
retn	10h
sub_1002131 endp



; Attributes: bp-based frame

sub_10021AA proc near

Rect= tagRECT ptr -10h

push	ebp
mov	ebp, esp
sub	esp, 10h
call	sub_10013CE
test	eax, eax
jz	short locret_10021DF
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	hWnd		; hWnd
call	ds:GetClientRect
push	[ebp+Rect.bottom]
push	[ebp+Rect.right]
push	[ebp+Rect.top]
push	[ebp+Rect.left]
call	sub_1002131
call	sub_1001405

locret_10021DF:
leave
retn
sub_10021AA endp



; Attributes: bp-based frame

sub_10021E1 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
mov	ecx, [ebp+arg_0]
mov	eax, [ecx+4]
cmp	[ebp+arg_4], eax
jl	short loc_1002216
mov	edx, dword_1007308
add	eax, edx
cmp	[ebp+arg_4], eax
jge	short loc_1002216
mov	eax, [ecx+8]
cmp	[ebp+arg_8], eax
jl	short loc_1002216
mov	ecx, nNumber
add	eax, ecx
cmp	[ebp+arg_8], eax
jge	short loc_1002216
xor	eax, eax
inc	eax
jmp	short loc_1002218

loc_1002216:
xor	eax, eax

loc_1002218:
pop	ebp
retn	0Ch
sub_10021E1 endp



; Attributes: bp-based frame

; int __stdcall	sub_100221C(RECT *lprcSrc1, RECT *lprcSrc2)
sub_100221C proc near

rcDst= tagRECT ptr -10h
lprcSrc1= dword	ptr  8
lprcSrc2= dword	ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 10h
push	[ebp+lprcSrc2]	; lprcSrc2
lea	eax, [ebp+rcDst]
push	[ebp+lprcSrc1]	; lprcSrc1
push	eax		; lprcDst
call	ds:IntersectRect
leave
retn	8
sub_100221C endp




sub_1002236 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	edx, [esp+arg_0]
mov	ecx, [edx]
mov	eax, [esp+arg_4]
mov	[eax], ecx
push	esi
mov	esi, dword_1007308
add	ecx, esi
mov	[eax+8], ecx
mov	ecx, [edx+4]
mov	[eax+4], ecx
mov	edx, nNumber
add	ecx, edx
mov	[eax+0Ch], ecx
pop	esi
retn	8
sub_1002236 endp



; Attributes: bp-based frame

; int __stdcall	sub_1002263(int, RECT *lprcSrc2)
sub_1002263 proc near

rcDst= tagRECT ptr -20h
rcSrc1=	RECT ptr -10h
arg_0= dword ptr  8
lprcSrc2= dword	ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 20h
lea	eax, [ebp+rcSrc1]
push	eax
mov	eax, [ebp+arg_0]
add	eax, 4
push	eax
call	sub_1002236
push	[ebp+lprcSrc2]	; lprcSrc2
lea	eax, [ebp+rcSrc1]
push	eax		; lprcSrc1
lea	eax, [ebp+rcDst]
push	eax		; lprcDst
call	ds:IntersectRect
leave
retn	8
sub_1002263 endp




; int __stdcall	sub_100228E(HDC	hdc, int)
sub_100228E proc near

hdc= dword ptr	4
arg_4= dword ptr  8

push	esi
mov	esi, [esp+4+arg_4]
push	edi
push	dword ptr [esi+4] ; y
mov	edi, ds:PtVisible
push	dword ptr [esi]	; x
push	[esp+10h+hdc]	; hdc
call	edi ; PtVisible
test	eax, eax
jz	short loc_10022BE
push	dword ptr [esi+0Ch] ; y
push	dword ptr [esi+8] ; x
push	[esp+10h+hdc]	; hdc
call	edi ; PtVisible
test	eax, eax
jz	short loc_10022BE
xor	eax, eax
inc	eax
jmp	short loc_10022C0

loc_10022BE:
xor	eax, eax

loc_10022C0:
pop	edi
pop	esi
retn	8
sub_100228E endp




sub_10022C5 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_0]
mov	ecx, [esp+arg_4]
mov	edx, [esp+arg_8]
push	esi
mov	esi, [eax]
add	esi, [ecx]
mov	[edx], esi
mov	eax, [eax+4]
add	eax, [ecx+4]
pop	esi
mov	[edx+4], eax
retn	0Ch
sub_10022C5 endp



; Attributes: bp-based frame

sub_10022E5 proc near

var_C= byte ptr	-0Ch
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 0Ch
push	esi
mov	esi, [ebp+arg_0]
push	edi
lea	edi, [ebp+var_C]
movsd
movsd
movsd
mov	esi, [ebp+arg_4]
mov	edi, [ebp+arg_0]
movsd
movsd
movsd
mov	edi, [ebp+arg_4]
lea	esi, [ebp+var_C]
movsd
movsd
movsd
pop	edi
pop	esi
leave
retn	8
sub_10022E5 endp




sub_100230E proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	ecx, [esp+arg_4]
mov	edx, [esp+arg_0]

loc_1002316:
mov	ax, [edx]
mov	[ecx], ax
inc	ecx
inc	ecx
inc	edx
inc	edx
test	ax, ax
jnz	short loc_1002316
lea	eax, [ecx-2]
retn	8
sub_100230E endp



; Attributes: bp-based frame

sub_100232B proc near

var_28=	byte ptr -28h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 28h
mov	eax, [ebp+arg_4]
xor	ecx, ecx
test	eax, eax
setl	cl
push	esi
mov	esi, ecx
test	esi, esi
jz	short loc_1002344
neg	eax

loc_1002344:
lea	ecx, [ebp+var_28]
push	edi

loc_1002348:
push	0Ah
cdq
pop	edi
idiv	edi
add	edx, 30h
mov	[ecx], dx
inc	ecx
inc	ecx
test	eax, eax
jnz	short loc_1002348
test	esi, esi
mov	edx, [ebp+arg_0]
mov	eax, edx
pop	edi
jz	short loc_100236C
mov	word ptr [edx],	2Dh
lea	eax, [edx+2]

loc_100236C:
dec	ecx
dec	ecx
mov	si, [ecx]
mov	[eax], si
inc	eax
lea	esi, [ebp+var_28]
inc	eax
cmp	ecx, esi
ja	short loc_100236C
and	word ptr [eax],	0
sub	eax, edx
sar	eax, 1
pop	esi
leave
retn	8
sub_100232B endp




; int __stdcall	sub_100238A(LPCWSTR lpText)
sub_100238A proc near

lpText=	dword ptr  4

push	30h		; uType
push	offset szApp	; lpCaption
push	[esp+8+lpText]	; lpText
push	hWnd		; hWnd
call	ds:MessageBoxW
retn	4
sub_100238A endp




sub_10023A4 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	eax, [esp+arg_0]
cmp	eax, [esp+arg_4]
jl	short locret_10023B2
mov	eax, [esp+arg_4]

locret_10023B2:
retn	8
sub_10023A4 endp




sub_10023B5 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	eax, [esp+arg_0]
cmp	eax, [esp+arg_4]
jg	short locret_10023C3
mov	eax, [esp+arg_4]

locret_10023C3:
retn	8
sub_10023B5 endp



; Attributes: bp-based frame

sub_10023C6 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_0]
cmp	eax, [ebp+arg_4]
jge	short loc_10023D6
mov	eax, [ebp+arg_4]
jmp	short loc_10023DE

loc_10023D6:
cmp	eax, [ebp+arg_8]
jle	short loc_10023DE
mov	eax, [ebp+arg_8]

loc_10023DE:
pop	ebp
retn	0Ch
sub_10023C6 endp




sub_10023E2 proc near
push	offset Text	; lpText
call	sub_100238A
retn
sub_10023E2 endp




sub_10023ED proc near
push	offset aNotYetImplemen ; "Not Yet Implemented"
call	sub_100238A
retn
sub_10023ED endp




; int __stdcall	sub_10023F8(LPWSTR lpBuffer, __int16, int cchBufferMax)
sub_10023F8 proc near

lpBuffer= dword	ptr  4
arg_4= word ptr	 8
cchBufferMax= dword ptr	 0Ch

push	[esp+cchBufferMax] ; cchBufferMax
movzx	eax, [esp+4+arg_4]
push	[esp+4+lpBuffer] ; lpBuffer
push	eax		; uID
push	hInstance	; hInstance
call	ds:LoadStringW
retn	0Ch
sub_10023F8 endp



; Attributes: bp-based frame

; int __stdcall	sub_1002415(int, __int16, BYTE Data)
sub_1002415 proc near

Buffer=	word ptr -44h
hKey= dword ptr	-4
arg_4= word ptr	 0Ch
Data= byte ptr	10h

push	ebp
mov	ebp, esp
sub	esp, 44h
push	esi
xor	esi, esi
push	esi		; lpdwDisposition
lea	eax, [ebp+hKey]
push	eax		; phkResult
push	esi		; lpSecurityAttributes
push	0F003Fh		; samDesired
push	esi		; dwOptions
push	esi		; lpClass
push	esi		; Reserved
push	offset SubKey	; "Software\\Microsoft\\Solitaire"
push	80000001h	; hKey
call	ds:RegCreateKeyExW
test	eax, eax
jz	short loc_1002444
xor	eax, eax
jmp	short loc_100247A

loc_1002444:		; cchBufferMax
push	20h
push	dword ptr [ebp+arg_4] ;	__int16
lea	eax, [ebp+Buffer]
push	eax		; lpBuffer
call	sub_10023F8
push	4		; cbData
lea	eax, [ebp+Data]
push	eax		; lpData
push	4		; dwType
push	esi		; Reserved
lea	eax, [ebp+Buffer]
push	eax		; lpValueName
push	[ebp+hKey]	; hKey
call	ds:RegSetValueExW
push	[ebp+hKey]	; hKey
mov	esi, eax
neg	esi
sbb	esi, esi
inc	esi
call	ds:RegCloseKey
mov	eax, esi

loc_100247A:
pop	esi
leave
retn	0Ch
sub_1002415 endp



; Attributes: bp-based frame

; int __stdcall	sub_100247F(int, __int16, int, LPCWSTR lpData, DWORD cbData)
sub_100247F proc near

Buffer=	word ptr -48h
Type= dword ptr	-8
hKey= dword ptr	-4
arg_4= word ptr	 0Ch
arg_8= dword ptr  10h
lpData=	dword ptr  14h
cbData=	dword ptr  18h

push	ebp
mov	ebp, esp
sub	esp, 48h
push	esi
push	edi
xor	edi, edi
push	edi		; lpdwDisposition
lea	eax, [ebp+hKey]
push	eax		; phkResult
push	edi		; lpSecurityAttributes
push	0F003Fh		; samDesired
push	edi		; dwOptions
push	edi		; lpClass
push	edi		; Reserved
push	offset SubKey	; "Software\\Microsoft\\Solitaire"
push	80000001h	; hKey
call	ds:RegCreateKeyExW
test	eax, eax
jz	short loc_10024CB
push	[ebp+lpData]	; lpString
mov	esi, ds:lstrlenW
call	esi ; lstrlenW
mov	ecx, eax
mov	eax, [ebp+cbData]
inc	ecx
cmp	eax, ecx
jl	short loc_10024C6
push	[ebp+lpData]	; lpString
call	esi ; lstrlenW
inc	eax

loc_10024C6:
mov	esi, [ebp+lpData]
jmp	short loc_1002526

loc_10024CB:		; cchBufferMax
push	20h
push	dword ptr [ebp+arg_4] ;	__int16
lea	eax, [ebp+Buffer]
push	eax		; lpBuffer
call	sub_10023F8
cmp	[ebp+hKey], edi
jz	short loc_1002537
mov	esi, [ebp+lpData]
push	ebx
lea	eax, [ebp+cbData]
push	eax		; lpcbData
push	esi		; lpData
lea	eax, [ebp+Type]
push	eax		; lpType
push	edi		; lpReserved
lea	eax, [ebp+Buffer]
push	eax		; lpValueName
push	[ebp+hKey]	; hKey
call	ds:RegQueryValueExW
push	[ebp+hKey]	; hKey
mov	ebx, eax
call	ds:RegCloseKey
cmp	ebx, edi
pop	ebx
jnz	short loc_100250F
cmp	[ebp+Type], 1
jz	short loc_1002537

loc_100250F:
mov	edi, ds:lstrlenW
push	esi		; lpString
call	edi ; lstrlenW
mov	ecx, eax
mov	eax, [ebp+cbData]
inc	ecx
cmp	eax, ecx
jl	short loc_1002526
push	esi		; lpString
call	edi ; lstrlenW
inc	eax

loc_1002526:
mov	edi, [ebp+arg_8]
mov	ecx, eax
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_1002537:
xor	eax, eax
pop	edi
inc	eax
pop	esi
leave
retn	14h
sub_100247F endp



; Attributes: bp-based frame

; int __stdcall	sub_1002540(int, __int16, HKEY hKey)
sub_1002540 proc near

Buffer=	word ptr -4Ch
cbData=	dword ptr -0Ch
Type= dword ptr	-8
Data= byte ptr -4
arg_4= word ptr	 0Ch
hKey= dword ptr	 10h

push	ebp
mov	ebp, esp
sub	esp, 4Ch
push	ebx
mov	ebx, [ebp+hKey]
push	esi
xor	esi, esi
push	esi		; lpdwDisposition
lea	eax, [ebp+hKey]
push	eax		; phkResult
push	esi		; lpSecurityAttributes
push	0F003Fh		; samDesired
push	esi		; dwOptions
push	esi		; lpClass
push	esi		; Reserved
push	offset SubKey	; "Software\\Microsoft\\Solitaire"
push	80000001h	; hKey
mov	dword ptr [ebp+Data], ebx
mov	[ebp+cbData], 4
mov	[ebp+Type], esi
call	ds:RegCreateKeyExW
test	eax, eax
jz	short loc_1002580
mov	eax, ebx
jmp	short loc_10025CA

loc_1002580:		; cchBufferMax
push	20h
push	dword ptr [ebp+arg_4] ;	__int16
lea	eax, [ebp+Buffer]
push	eax		; lpBuffer
call	sub_10023F8
cmp	[ebp+hKey], esi
jz	short loc_10025C7
push	edi
lea	eax, [ebp+cbData]
push	eax		; lpcbData
lea	eax, [ebp+Data]
push	eax		; lpData
lea	eax, [ebp+Type]
push	eax		; lpType
push	esi		; lpReserved
lea	eax, [ebp+Buffer]
push	eax		; lpValueName
push	[ebp+hKey]	; hKey
call	ds:RegQueryValueExW
push	[ebp+hKey]	; hKey
mov	edi, eax
call	ds:RegCloseKey
cmp	edi, esi
pop	edi
jnz	short loc_10025C4
cmp	[ebp+Type], 4
jz	short loc_10025C7

loc_10025C4:
mov	dword ptr [ebp+Data], ebx

loc_10025C7:
mov	eax, dword ptr [ebp+Data]

loc_10025CA:
pop	esi
pop	ebx
leave
retn	0Ch
sub_1002540 endp



; Attributes: bp-based frame

sub_10025D0 proc near

Buffer=	word ptr -100h
arg_0= word ptr	 8

push	ebp
mov	ebp, esp
sub	esp, 100h
push	80h		; cchBufferMax
push	dword ptr [ebp+arg_0] ;	__int16
lea	eax, [ebp+Buffer]
push	eax		; lpBuffer
call	sub_10023F8
push	34h		; uType
push	offset szApp	; lpCaption
lea	eax, [ebp+Buffer]
push	eax		; lpText
push	hWnd		; hWnd
call	ds:MessageBoxW
cmp	eax, 6
jz	short loc_1002615
cmp	eax, 1
jz	short loc_1002615
xor	eax, eax
jmp	short locret_1002618

loc_1002615:
xor	eax, eax
inc	eax

locret_1002618:
leave
retn	4
sub_10025D0 endp



; Attributes: bp-based frame

sub_100261C proc near

Buffer=	word ptr -100h
arg_0= word ptr	 8

push	ebp
mov	ebp, esp
sub	esp, 100h
push	80h		; cchBufferMax
push	dword ptr [ebp+arg_0] ;	__int16
lea	eax, [ebp+Buffer]
push	eax		; lpBuffer
call	sub_10023F8
lea	eax, [ebp+Buffer]
push	eax		; lpText
call	sub_100238A
leave
retn	4
sub_100261C endp




; int __stdcall	sub_1002649(HLOCAL hMem)
sub_1002649 proc near

hMem= dword ptr	 4

push	edi
mov	edi, [esp+4+hMem]
test	edi, edi
jz	short loc_1002697
mov	eax, [edi+64h]
dec	eax
js	short loc_1002679
push	ebx
push	esi
lea	esi, [edi+eax*4+6Ch]
lea	ebx, [eax+1]

loc_1002661:
mov	eax, [esi]
test	eax, eax
jz	short loc_1002671
push	0
push	0
push	2
push	eax
call	dword ptr [eax+4]

loc_1002671:
sub	esi, 4
dec	ebx
jnz	short loc_1002661
pop	esi
pop	ebx

loc_1002679:
cmp	edi, hMem
jnz	short loc_1002688
and	hMem, 0

loc_1002688:
lea	eax, [edi+4]
push	eax
call	sub_1005741
push	edi		; hMem
call	LocalFree

loc_1002697:
pop	edi
retn	4
sub_1002649 endp



; Attributes: bp-based frame

; int __stdcall	sub_100269B(HDC	hdc, int, int, int cy)
sub_100269B proc near

hdc= dword ptr	8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
cy= dword ptr  14h

push	ebp
mov	ebp, esp
push	edi
push	[ebp+hdc]	; hdc
call	ds:CreateCompatibleDC
mov	edi, eax
test	edi, edi
jz	short loc_10026F3
push	esi
push	[ebp+cy]	; cy
push	dword_1007308	; cx
push	[ebp+hdc]	; hdc
call	ds:CreateCompatibleBitmap
mov	esi, eax
test	esi, esi
jz	short loc_10026DF
push	esi		; h
push	edi		; hdc
call	ds:SelectObject
test	eax, eax
mov	ecx, [ebp+arg_8]
mov	[ecx], eax
jnz	short loc_10026EA
push	esi		; ho
call	ds:DeleteObject

loc_10026DF:		; hdc
push	edi
call	ds:DeleteDC
xor	eax, eax
jmp	short loc_10026F2

loc_10026EA:
mov	eax, [ebp+arg_4]
mov	[eax], edi
xor	eax, eax
inc	eax

loc_10026F2:
pop	esi

loc_10026F3:
pop	edi
pop	ebp
retn	10h
sub_100269B endp




sub_10026F8 proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
push	ebx
push	ebp
xor	ebp, ebp
cmp	eax, ebp
push	esi
push	edi
mov	dword_1007188, eax
jz	short loc_100277F
cmp	dword_10071A4, ebp
jz	loc_1002891
push	h		; h
mov	esi, ds:SelectObject
push	hdc		; hdc
call	esi ; SelectObject
mov	edi, ds:DeleteObject
push	eax		; ho
call	edi ; DeleteObject
push	hdc		; hdc
mov	ebx, ds:DeleteDC
call	ebx ; DeleteDC
push	dword_10071BC	; h
push	dword_10071B8	; hdc
call	esi ; SelectObject
push	eax		; ho
call	edi ; DeleteObject
push	dword_10071B8	; hdc
call	ebx ; DeleteDC
push	dword_10071C4	; h
push	dword_10071C0	; hdc
call	esi ; SelectObject
push	eax		; ho
call	edi ; DeleteObject
push	dword_10071C0	; hdc
call	ebx ; DeleteDC
mov	dword_10071A4, ebp
jmp	loc_1002891

loc_100277F:
cmp	dword_10071A4, ebp
jnz	loc_1002891
push	hWnd		; hWnd
call	ds:GetDC
mov	esi, eax
cmp	esi, ebp
jz	loc_1002860
mov	eax, hMem
mov	dword_10071AC, ebp
push	dword ptr [eax+60h] ; cy
push	offset dword_10071BC ; int
push	offset dword_10071B8 ; int
push	esi		; hdc
call	sub_100269B
test	eax, eax
jnz	short loc_10027D5
push	esi		; hDC
push	hWnd		; hWnd
call	ds:ReleaseDC
jmp	loc_1002860

loc_10027D5:
mov	eax, hMem
push	dword ptr [eax+60h] ; cy
push	offset dword_10071C4 ; int
push	offset dword_10071C0 ; int
push	esi		; hdc
call	sub_100269B
test	eax, eax
mov	edi, ds:DeleteObject
mov	ebx, ds:SelectObject
mov	ebp, ds:DeleteDC
jz	short loc_1002838
mov	eax, hMem
push	dword ptr [eax+60h] ; cy
push	offset h	; int
push	offset hdc	; int
push	esi		; hdc
call	sub_100269B
test	eax, eax
jnz	short loc_100287A
push	dword_10071C4	; h
push	dword_10071C0	; hdc
call	ebx ; SelectObject
push	eax		; ho
call	edi ; DeleteObject
push	dword_10071C0	; hdc
call	ebp ; DeleteDC

loc_1002838:		; hDC
push	esi
push	hWnd		; hWnd
call	ds:ReleaseDC
push	dword_10071BC	; h
push	dword_10071B8	; hdc
call	ebx ; SelectObject
push	eax		; ho
call	edi ; DeleteObject
push	dword_10071B8	; hdc
call	ebp ; DeleteDC
xor	ebp, ebp

loc_1002860:
push	12Fh
call	sub_100261C
mov	dword_1007188, ebp
mov	dword_10071A4, ebp
xor	eax, eax
jmp	short loc_1002894

loc_100287A:		; hDC
push	esi
push	hWnd		; hWnd
mov	dword_10071A4, 1
call	ds:ReleaseDC

loc_1002891:
xor	eax, eax
inc	eax

loc_1002894:
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	4
sub_10026F8 endp



; Attributes: thunk

sub_100289B proc near
jmp	sub_1005581
sub_100289B endp




sub_10028A0 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	eax, [esp+arg_0]
xor	ecx, ecx
cmp	[esp+arg_4], ecx
mov	[eax+24h], ecx
jz	short loc_10028B2
mov	[eax+30h], ecx

loc_10028B2:
or	dword ptr [eax+58h], 0FFFFFFFFh
or	dword ptr [eax+5Ch], 0FFFFFFFFh
mov	[eax+34h], ecx
mov	[eax+40h], ecx
mov	[eax+50h], ecx
mov	[eax+54h], ecx
mov	[eax+28h], ecx
mov	[eax+2Ch], ecx
mov	ecx, dword_100702C
mov	[eax+3Ch], ecx
xor	eax, eax
inc	eax
retn	8
sub_10028A0 endp




sub_10028DB proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

push	esi
mov	esi, [esp+4+arg_0]
xor	eax, eax
cmp	dword ptr [esi+58h], 0FFFFFFFFh
jnz	short loc_1002927
cmp	[esi+24h], eax
jz	short loc_1002927
inc	eax
mov	[esi+28h], eax
mov	[esi+4Ch], eax
mov	eax, [esp+4+arg_8]
cmp	eax, [esi+64h]
push	ebx
push	edi
mov	ebx, eax
jge	short loc_1002923
lea	edi, [esi+eax*4+6Ch]

loc_1002905:
mov	eax, [edi]
push	0
push	[esp+10h+arg_4]
push	5
push	eax
call	dword ptr [eax+4]
cmp	eax, 1FFFh
jnz	short loc_100292B
inc	ebx
add	edi, 4
cmp	ebx, [esi+64h]
jl	short loc_1002905

loc_1002923:
xor	eax, eax

loc_1002925:
pop	edi
pop	ebx

loc_1002927:
pop	esi
retn	0Ch

loc_100292B:
mov	[esi+58h], ebx
mov	eax, dword_1007000
mov	[esi+44h], eax
mov	eax, dword_1007004
mov	[esi+48h], eax
cmp	dword_1007188, 0
jnz	short loc_1002956
mov	eax, [esp+0Ch+arg_4]
mov	ecx, [eax]
mov	[esi+44h], ecx
mov	eax, [eax+4]
mov	[esi+48h], eax

loc_1002956:
xor	eax, eax
inc	eax
jmp	short loc_1002925
sub_10028DB endp




sub_100295B proc near

arg_0= dword ptr  4
arg_8= dword ptr  0Ch

push	ebx
push	esi
mov	esi, [esp+8+arg_0]
mov	ecx, [esi+58h]
xor	ebx, ebx
cmp	ecx, 0FFFFFFFFh
mov	[esi+4Ch], ebx
jz	loc_1002A02
mov	eax, [esi+5Ch]
cmp	eax, 0FFFFFFFFh
push	edi
mov	edi, [esi+ecx*4+6Ch]
jz	short loc_10029EB
mov	ebx, [esi+eax*4+6Ch]
push	ecx
push	eax
push	0Ah
push	esi
call	dword ptr [esi]
push	0
push	0
push	16h
push	ebx
call	dword ptr [ebx+4]
cmp	[esp+0Ch+arg_8], 0
lea	eax, [esi+44h]
jz	short loc_10029A4
xor	ebx, ebx
inc	ebx
push	ebx
jmp	short loc_10029F0

loc_10029A4:
push	0
push	eax
push	0Ah
push	edi
call	dword ptr [edi+4]
push	1FFDh
push	edi
push	0Eh
push	ebx
call	dword ptr [ebx+4]
test	eax, eax
jz	short loc_10029CD
push	edi
push	ebx
push	0Eh
push	esi
call	dword ptr [esi]
test	eax, eax
jz	short loc_10029CD
xor	ebx, ebx
inc	ebx
jmp	short loc_10029CF

loc_10029CD:
xor	ebx, ebx

loc_10029CF:
or	dword ptr [esi+5Ch], 0FFFFFFFFh
push	0
push	0
push	0Ch
push	esi
call	dword ptr [esi]
test	eax, eax
jz	short loc_10029F7
push	0
push	0
push	0Dh
push	esi
call	dword ptr [esi]
jmp	short loc_10029F7

loc_10029EB:
push	1
lea	eax, [esi+44h]

loc_10029F0:
push	eax
push	0Ah
push	edi
call	dword ptr [edi+4]

loc_10029F7:
push	0
push	0
push	7
push	edi
call	dword ptr [edi+4]
pop	edi

loc_1002A02:
or	dword ptr [esi+58h], 0FFFFFFFFh
pop	esi
mov	eax, ebx
pop	ebx
retn	0Ch
sub_100295B endp




sub_1002A0D proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	ebx
push	esi
push	edi
mov	edi, [esp+0Ch+arg_0]
xor	ebx, ebx
cmp	[edi+64h], ebx
jle	short loc_1002A38
lea	esi, [edi+6Ch]

loc_1002A1E:
mov	eax, [esi]
push	ebx
push	[esp+10h+arg_4]
push	0Bh
push	eax
call	dword ptr [eax+4]
test	eax, eax
jnz	short loc_1002A40
inc	ebx
add	esi, 4
cmp	ebx, [edi+64h]
jl	short loc_1002A1E

loc_1002A38:
xor	eax, eax

loc_1002A3A:
pop	edi
pop	esi
pop	ebx
retn	8

loc_1002A40:
xor	eax, eax
inc	eax
jmp	short loc_1002A3A
sub_1002A0D endp




sub_1002A45 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  4

sub	esp, 10h
push	ebx
push	ebp
push	esi
push	edi
xor	edi, edi
mov	[esp+20h+var_4], edi

loc_1002A52:
mov	eax, [esp+20h+arg_0]
cmp	[eax+64h], edi
mov	[esp+20h+var_8], edi
mov	[esp+20h+var_10], edi
jle	loc_1002B84
lea	ecx, [eax+6Ch]
mov	[esp+20h+var_C], ecx

loc_1002A6E:
push	2
pop	ebp
cmp	[esp+20h+var_10], ebp
jl	short loc_1002A82
cmp	[esp+20h+var_10], 6
jl	loc_1002B64

loc_1002A82:
mov	eax, [esp+20h+var_C]
mov	esi, [eax]
mov	eax, [esi+1Ch]
cmp	eax, edi
jle	loc_1002B56
lea	eax, [eax+eax*2+6]
test	byte ptr [esi+eax*4+1],	80h
jz	loc_1002B56
cmp	[esi+18h], edi
jnz	short loc_1002AB4
push	0FFFFFFFEh
push	1FFCh
push	6
push	esi
call	dword ptr [esi+4]

loc_1002AB4:
push	74h
pop	ebx

loc_1002AB7:
mov	eax, hMem
mov	edi, [ebx+eax]
push	0
push	esi
push	10h
push	edi
call	dword ptr [edi+4]
test	eax, eax
jnz	short loc_1002ADA
add	ebx, 4
inc	ebp
cmp	ebx, 84h
jl	short loc_1002AB7
jmp	short loc_1002B56

loc_1002ADA:
push	[esp+20h+var_10]
mov	eax, hMem
push	ebp
push	0Ah
push	eax
call	dword ptr [eax]
mov	ebx, 1FFDh
push	ebx
push	esi
push	0Eh
push	edi
call	dword ptr [edi+4]
test	eax, eax
jz	short loc_1002B2D
cmp	dword_1007188, 0
jnz	short loc_1002B13
mov	eax, [esi+1Ch]
push	ebx
dec	eax
push	eax
push	12h
push	esi
call	dword ptr [esi+4]
test	eax, eax
jz	short loc_1002B2D

loc_1002B13:
mov	eax, hMem
push	esi
push	edi
push	0Eh
push	eax
call	dword ptr [eax]
test	eax, eax
jz	short loc_1002B2D
mov	[esp+20h+var_4], 1
jmp	short loc_1002B32

loc_1002B2D:
and	[esp+20h+var_4], 0

loc_1002B32:
mov	eax, hMem
inc	[esp+20h+var_8]
push	0
push	0
push	0Ch
push	eax
call	dword ptr [eax]
test	eax, eax
jz	short loc_1002B56
mov	eax, hMem
push	0
push	0
push	0Dh
push	eax
call	dword ptr [eax]

loc_1002B56:
xor	edi, edi
push	edi
push	edi
push	7
push	esi
call	dword ptr [esi+4]
mov	eax, [esp+20h+arg_0]

loc_1002B64:
inc	[esp+20h+var_10]
mov	ecx, [esp+20h+var_10]
add	[esp+20h+var_C], 4
cmp	ecx, [eax+64h]
jl	loc_1002A6E
cmp	[esp+20h+var_8], edi
jg	loc_1002A52

loc_1002B84:
mov	eax, [esp+20h+var_4]
pop	edi
pop	esi
pop	ebp
pop	ebx
add	esp, 10h
retn	8
sub_1002A45 endp



; Attributes: bp-based frame

sub_1002B92 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ebx
push	esi
mov	esi, [ebp+arg_0]
mov	eax, [esi+58h]
cmp	eax, 0FFFFFFFFh
push	edi
jz	loc_1002C40
mov	ebx, [ebp+arg_4]
mov	eax, [esi+eax*4+6Ch]
lea	edi, [esi+44h]
push	edi
push	ebx
push	14h
push	eax
call	dword ptr [eax+4]
mov	eax, [ebx]
mov	[edi], eax
mov	eax, [ebx+4]
mov	[edi+4], eax
xor	edi, edi
cmp	[esi+64h], edi
jle	short loc_1002BF4
lea	eax, [esi+6Ch]
mov	[ebp+arg_0], eax

loc_1002BD0:
mov	ecx, [esi+58h]
mov	eax, [ebp+arg_0]
mov	eax, [eax]
push	ebx
push	dword ptr [esi+ecx*4+6Ch]
push	11h
push	eax
call	dword ptr [eax+4]
cmp	eax, 1FFFh
jnz	short loc_1002C13
add	[ebp+arg_0], 4
inc	edi
cmp	edi, [esi+64h]
jl	short loc_1002BD0

loc_1002BF4:
mov	eax, [esi+5Ch]
cmp	eax, 0FFFFFFFFh
jz	short loc_1002C40
mov	eax, [esi+eax*4+6Ch]
push	0
push	0
push	16h
push	eax
call	dword ptr [eax+4]
or	dword ptr [esi+5Ch], 0FFFFFFFFh

loc_1002C0E:
xor	eax, eax
inc	eax
jmp	short loc_1002C42

loc_1002C13:
mov	eax, [esi+5Ch]
cmp	edi, eax
jz	short loc_1002C0E
cmp	eax, 0FFFFFFFFh
jz	short loc_1002C2D
mov	eax, [esi+eax*4+6Ch]
push	0
push	0
push	16h
push	eax
call	dword ptr [eax+4]

loc_1002C2D:
push	0
push	0
mov	[esi+5Ch], edi
mov	esi, [esi+edi*4+6Ch]
push	16h
push	esi
call	dword ptr [esi+4]
jmp	short loc_1002C42

loc_1002C40:
xor	eax, eax

loc_1002C42:
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	8
sub_1002B92 endp



; Attributes: bp-based frame

sub_1002C49 proc near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
mov	eax, [ebp+arg_4]
push	ebx
push	esi
xor	ebx, ebx
push	ebx
push	ebx
push	dword ptr [eax]
call	sub_10013A8
mov	esi, [ebp+arg_0]
cmp	[esi+24h], ebx
mov	[ebp+var_4], eax
jz	short loc_1002C8A
cmp	[esi+64h], ebx
jle	short loc_1002C8A
push	edi
lea	edi, [esi+6Ch]

loc_1002C71:
mov	eax, [edi]
push	0
push	[ebp+arg_4]
push	13h
push	eax
call	dword ptr [eax+4]
inc	ebx
add	edi, 4
cmp	ebx, [esi+64h]
jl	short loc_1002C71
xor	ebx, ebx
pop	edi

loc_1002C8A:
push	ebx
push	ebx
push	[ebp+var_4]
call	sub_10013A8
xor	eax, eax
pop	esi
inc	eax
pop	ebx
leave
retn	8
sub_1002C49 endp




sub_1002C9D proc near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
push	edi
xor	edi, edi
cmp	[esi+4], edi
jnz	short loc_1002CAE
xor	eax, eax
jmp	short loc_1002D0D

loc_1002CAE:
mov	eax, [esi+0Ch]
push	edi
push	edi
mov	[esi+30h], eax
mov	eax, [esi+18h]
push	0Fh
push	esi
mov	[esi+40h], eax
call	dword ptr [esi]
mov	eax, [esi+10h]
mov	eax, [esi+eax*4+6Ch]
push	1
push	dword ptr [esi+1Ch]
push	0Fh
push	eax
call	dword ptr [eax+4]
mov	eax, [esi+14h]
mov	eax, [esi+eax*4+6Ch]
push	1
push	dword ptr [esi+20h]
push	0Fh
push	eax
call	dword ptr [eax+4]
mov	eax, [esi+10h]
mov	eax, [esi+eax*4+6Ch]
push	edi
push	edi
push	7
push	eax
call	dword ptr [eax+4]
mov	eax, [esi+14h]
mov	eax, [esi+eax*4+6Ch]
push	edi
push	edi
push	7
push	eax
call	dword ptr [eax+4]
push	edi
push	edi
push	0Bh
push	esi
call	dword ptr [esi]
xor	eax, eax
inc	eax

loc_1002D0D:
pop	edi
pop	esi
retn	4
sub_1002C9D endp




sub_1002D12 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	edx, [esp+arg_0]
push	ebx
mov	ebx, [esp+4+arg_4]
push	esi
mov	esi, [edx+ebx*4+6Ch]
mov	eax, [esi+1Ch]
add	eax, 3
lea	ecx, [eax+eax*2]
shl	ecx, 2
mov	eax, ecx
shr	ecx, 2
push	edi
mov	edi, [edx+1Ch]
rep movsd
mov	ecx, eax
mov	eax, [esp+0Ch+arg_8]
and	ecx, 3
rep movsb
mov	esi, [edx+eax*4+6Ch]
mov	eax, [esi+1Ch]
mov	edi, [edx+20h]
add	eax, 3
lea	ecx, [eax+eax*2]
shl	ecx, 2
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [esp+0Ch+arg_8]
and	ecx, 3
rep movsb
mov	ecx, [edx+30h]
mov	[edx+14h], eax
xor	eax, eax
pop	edi
inc	eax
cmp	dword ptr [edx+8], 0
mov	[edx+0Ch], ecx
mov	ecx, [edx+40h]
pop	esi
mov	[edx+10h], ebx
mov	[edx+4], eax
mov	[edx+18h], ecx
pop	ebx
jz	short locret_1002D90
and	dword ptr [edx+8], 0
dec	ecx
mov	[edx+18h], ecx

locret_1002D90:
retn	0Ch
sub_1002D12 endp




sub_1002D93 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	ebx
mov	ebx, [esp+4+arg_4]
push	esi
mov	esi, [esp+8+arg_0]
xor	ecx, ecx
cmp	dword ptr [esi+58h], 0FFFFFFFFh
push	edi
setnz	cl
push	0
lea	edi, [esi+ebx*4+6Ch]
mov	eax, [edi]
push	ecx
push	18h
push	eax
call	dword ptr [eax+4]
test	eax, eax
jz	short loc_1002DD4
mov	[esi+50h], ebx
mov	edi, [edi]
xor	ebx, ebx
push	ebx
push	ebx
push	4
push	edi
call	dword ptr [edi+4]
dec	eax
cmp	eax, ebx
mov	[esi+54h], eax
jge	short loc_1002DD4
mov	[esi+54h], ebx

loc_1002DD4:
pop	edi
pop	esi
pop	ebx
retn	8
sub_1002D93 endp




sub_1002DDA proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

push	esi
mov	esi, [esp+4+arg_0]
push	edi
mov	edi, [esi+50h]
cmp	edi, 0FFFFFFFFh
jnz	short loc_1002DEA
xor	edi, edi

loc_1002DEA:
cmp	[esp+8+arg_4], 0
jz	short loc_1002E3F

loc_1002DF1:
add	edi, [esp+8+arg_4]
jns	short loc_1002DFD
mov	edi, [esi+64h]
dec	edi
jmp	short loc_1002E04

loc_1002DFD:
cmp	edi, [esi+64h]
jl	short loc_1002E04
xor	edi, edi

loc_1002E04:
cmp	edi, [esi+50h]
jz	short loc_1002E3F
mov	eax, [esi+edi*4+6Ch]
xor	ecx, ecx
cmp	dword ptr [esi+58h], 0FFFFFFFFh
push	0
setnz	cl
push	ecx
push	18h
push	eax
call	dword ptr [eax+4]
test	eax, eax
jz	short loc_1002DF1
cmp	[esp+8+arg_8], 0
jz	short loc_1002E3F
mov	eax, [esi+50h]
mov	ecx, [esi+edi*4+6Ch]
mov	eax, [esi+eax*4+6Ch]
mov	ecx, [ecx]
mov	eax, [eax]
mov	ecx, [ecx]
cmp	ecx, [eax]
jz	short loc_1002DF1

loc_1002E3F:
push	edi
push	esi
call	sub_1002D93
pop	edi
pop	esi
retn	0Ch
sub_1002DDA endp




sub_1002E4B proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
mov	esi, [esp+4+arg_0]
mov	eax, [esi+50h]
mov	eax, [esi+eax*4+6Ch]
push	edi
push	0
push	1
push	4
push	eax
call	dword ptr [eax+4]
push	0
mov	edi, eax
mov	eax, [esi+50h]
mov	eax, [esi+eax*4+6Ch]
push	0
push	4
push	eax
call	dword ptr [eax+4]
test	eax, eax
jnz	short loc_1002E7D
xor	edi, edi
jmp	short loc_1002E9C

loc_1002E7D:
test	edi, edi
jnz	short loc_1002E86
lea	edi, [eax-1]
jmp	short loc_1002E9C

loc_1002E86:
lea	ecx, [eax-1]
sub	eax, edi
push	ecx
push	eax
mov	eax, [esi+54h]
add	eax, [esp+10h+arg_4]
push	eax
call	sub_10023C6
mov	edi, eax

loc_1002E9C:
mov	eax, [esi+50h]
mov	eax, [esi+eax*4+6Ch]
push	0
push	edi
push	19h
push	eax
call	dword ptr [eax+4]
test	eax, eax
jz	short loc_1002EB3
mov	[esi+54h], edi

loc_1002EB3:
pop	edi
pop	esi
retn	8
sub_1002E4B endp



; Attributes: bp-based frame

sub_1002EB8 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
Point= tagPOINT	ptr -8
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 10h
mov	eax, [ebp+arg_4]
push	esi
push	edi
xor	edi, edi
cmp	eax, 24h
jg	loc_1002F84
jz	loc_1002F7B
cmp	eax, 9
jz	loc_1002F62
cmp	eax, 0Dh
jz	short loc_1002F13
cmp	eax, 1Bh
jz	short loc_1002F08
cmp	eax, 20h
jz	short loc_1002F13
cmp	eax, 23h
jnz	loc_1002F97
mov	esi, [ebp+arg_0]
mov	eax, [esi+64h]
dec	eax
push	eax

loc_1002EFD:
push	esi
call	sub_1002D93
jmp	loc_1003002

loc_1002F08:
push	1
push	0
push	4
jmp	loc_1002FB5

loc_1002F13:
mov	esi, [ebp+arg_0]
cmp	dword ptr [esi+58h], 0FFFFFFFFh
jnz	short loc_1002F4C
push	edi
push	esi
call	sub_1002E4B
mov	eax, [esi+50h]
mov	eax, [esi+eax*4+6Ch]
lea	ecx, [ebp+var_10]
push	ecx
push	dword ptr [esi+54h]
push	17h
push	eax
call	dword ptr [eax+4]
push	edi
lea	eax, [ebp+var_10]
push	eax
push	3
push	esi
call	dword ptr [esi]
test	eax, eax
jz	short loc_1002F97
push	edi
push	edi
jmp	loc_1002FFC

loc_1002F4C:
xor	edi, edi
push	edi
push	edi
push	4
push	esi
call	dword ptr [esi]
push	edi
push	edi
push	esi
call	sub_1002DDA
jmp	loc_1003066

loc_1002F62:
push	1
push	10h		; nVirtKey
call	ds:GetKeyState
xor	ecx, ecx
test	ax, ax
setnl	cl
lea	ecx, [ecx+ecx-1]
push	ecx
jmp	short loc_1002FF9

loc_1002F7B:
mov	esi, [ebp+arg_0]
push	edi
jmp	loc_1002EFD

loc_1002F84:
sub	eax, 25h
jz	short loc_1002FE6
dec	eax
jz	short loc_1002FE2
dec	eax
jz	short loc_1002FCD
dec	eax
jz	short loc_1002FC0
sub	eax, 19h
jz	short loc_1002F9E

loc_1002F97:
xor	eax, eax
jmp	loc_1003069

loc_1002F9E:		; nVirtKey
push	11h
call	ds:GetKeyState
test	ax, ax
jge	loc_1003066
push	1
push	0
push	13h

loc_1002FB5:
mov	eax, [ebp+arg_0]
push	eax
call	dword ptr [eax]
jmp	loc_1003066

loc_1002FC0:
push	1

loc_1002FC2:
mov	esi, [ebp+arg_0]
push	esi
call	sub_1002E4B
jmp	short loc_1003002

loc_1002FCD:		; nVirtKey
push	10h
call	ds:GetKeyState
xor	ecx, ecx
test	ax, ax
setl	cl
push	ecx
push	1
jmp	short loc_1002FF9

loc_1002FE2:
push	0FFFFFFFFh
jmp	short loc_1002FC2

loc_1002FE6:		; nVirtKey
push	10h
call	ds:GetKeyState
xor	ecx, ecx
test	ax, ax
setl	cl
push	ecx
push	0FFFFFFFFh

loc_1002FF9:
mov	esi, [ebp+arg_0]

loc_1002FFC:
push	esi
call	sub_1002DDA

loc_1003002:
mov	eax, [esi+50h]
mov	eax, [esi+eax*4+6Ch]
lea	ecx, [ebp+var_10]
push	ecx
push	dword ptr [esi+54h]
push	17h
push	eax
call	dword ptr [eax+4]
mov	eax, [ebp+var_10]
mov	[ebp+Point.x], eax
mov	eax, [ebp+var_C]
mov	[ebp+Point.y], eax
lea	eax, [ebp+Point]
push	eax		; lpPoint
push	hWnd		; hWnd
call	ds:ClientToScreen
cmp	dword ptr [esi+58h], 0FFFFFFFFh
jz	short loc_100305A
mov	eax, [esi+50h]
mov	eax, [esi+eax*4+6Ch]
push	edi
push	edi
push	4
push	eax
call	dword ptr [eax+4]
test	eax, eax
jle	short loc_100305A
mov	eax, [esi+50h]
mov	eax, [esi+eax*4+6Ch]
mov	eax, [eax]
mov	eax, [eax+10h]
add	[ebp+Point.y], eax

loc_100305A:		; Y
push	[ebp+Point.y]
push	[ebp+Point.x]	; X
call	ds:SetCursorPos

loc_1003066:
xor	eax, eax
inc	eax

loc_1003069:
pop	edi
pop	esi
leave
retn	8
sub_1002EB8 endp



; Attributes: bp-based frame

sub_100306F proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
cmp	nIDCheckButton,	130h
jz	short loc_10030C1
cmp	[ebp+arg_4], 0FFFFFFFCh
jz	short loc_10030A6
cmp	[ebp+arg_4], 0FFFFFFFDh
jz	short loc_100309B
cmp	[ebp+arg_4], 0FFFFFFFEh
jnz	short loc_10030C1
mov	eax, [ebp+arg_8]
mov	ecx, [ebp+arg_0]
mov	[ecx+30h], eax
jmp	short loc_10030BC

loc_100309B:
mov	eax, [ebp+arg_0]
mov	ecx, [ebp+arg_8]
add	[eax+30h], ecx
jmp	short loc_10030BC

loc_10030A6:
push	esi
mov	esi, [ebp+arg_0]
mov	eax, [esi+30h]
add	eax, [ebp+arg_8]
push	0
push	eax
call	sub_10023B5
mov	[esi+30h], eax
pop	esi

loc_10030BC:
call	sub_1005D51

loc_10030C1:
xor	eax, eax
inc	eax
pop	ebp
retn	0Ch
sub_100306F endp




sub_10030C8 proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
and	dword ptr [eax+2Ch], 0
push	68h
call	sub_10025D0
test	eax, eax
jz	short loc_10030F3
push	0		; lParam
push	3E8h		; wParam
push	111h		; Msg
push	hWnd		; hWnd
call	ds:PostMessageW

loc_10030F3:
xor	eax, eax
inc	eax
retn	4
sub_10030C8 endp



; Attributes: bp-based frame

; int __stdcall	sub_10030F9(HLOCAL hMem, int, int, int)
sub_10030F9 proc near

hMem= dword ptr	 8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_4]
cmp	eax, 13h	; switch 20 cases
ja	short loc_1003120 ; jumptable 01003104 default case
jmp	ds:off_10031DF[eax*4] ;	switch jump

loc_100310B:		; jumptable 01003104 case 0
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_10028A0
jmp	short loc_1003122

loc_1003118:		; jumptable 01003104 case 1
push	[ebp+hMem]
call	sub_1002649

loc_1003120:		; jumptable 01003104 default case
xor	eax, eax

loc_1003122:
pop	ebp
retn	10h

loc_1003126:		; jumptable 01003104 case 2
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_1002EB8
jmp	short loc_1003122

loc_1003133:		; jumptable 01003104 case 19
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_1002A45
jmp	short loc_1003122

loc_1003140:		; jumptable 01003104 case 3
push	[ebp+arg_C]
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_10028DB
jmp	short loc_1003122

loc_1003150:		; jumptable 01003104 case 4
push	[ebp+arg_C]
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_100295B
jmp	short loc_1003122

loc_1003160:		; jumptable 01003104 case 5
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_1002B92
jmp	short loc_1003122

loc_100316D:		; jumptable 01003104 case 6
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_1002A0D
jmp	short loc_1003122

loc_100317A:		; jumptable 01003104 case 7
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_1002C49
jmp	short loc_1003122

loc_1003187:		; jumptable 01003104 case 9
push	[ebp+hMem]
call	sub_1002C9D
jmp	short loc_1003122

loc_1003191:		; jumptable 01003104 case 10
push	[ebp+arg_C]
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_1002D12
jmp	short loc_1003122

loc_10031A1:		; jumptable 01003104 case 11
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
jmp	loc_1003120	; jumptable 01003104 default case

loc_10031AD:		; jumptable 01003104 case 13
push	[ebp+hMem]
call	sub_10030C8
jmp	loc_1003122

loc_10031BA:		; jumptable 01003104 case 18
call	sub_10023ED
jmp	loc_1003120	; jumptable 01003104 default case

loc_10031C4:		; jumptable 01003104 case 14
xor	eax, eax
inc	eax
jmp	loc_1003122

loc_10031CC:		; jumptable 01003104 case 15
push	[ebp+arg_C]
push	[ebp+arg_8]
push	[ebp+hMem]
call	sub_100306F
jmp	loc_1003122
sub_10030F9 endp

off_10031DF dd offset loc_100310B ; jump table for switch statement
dd offset loc_1003118
dd offset loc_1003126
dd offset loc_1003140
dd offset loc_1003150
dd offset loc_1003160
dd offset loc_100316D
dd offset loc_100317A
dd offset loc_1003120
dd offset loc_1003187
dd offset loc_1003191
dd offset loc_10031A1
dd offset loc_1003120
dd offset loc_10031AD
dd offset loc_10031C4
dd offset loc_10031CC
dd offset loc_1003120
dd offset loc_1003120
dd offset loc_10031BA
dd offset loc_1003133


; Attributes: bp-based frame

sub_100322F proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h
arg_10=	dword ptr  18h
arg_14=	dword ptr  1Ch
arg_18=	dword ptr  20h
arg_1C=	dword ptr  24h

push	ebp
mov	ebp, esp
push	24h
call	sub_1001F17
test	eax, eax
jz	short loc_1003270
mov	ecx, [ebp+arg_0]
and	dword ptr [eax+8], 0
mov	[eax], ecx
mov	ecx, [ebp+arg_4]
mov	[eax+4], ecx
mov	ecx, [ebp+arg_8]
mov	[eax+0Ch], ecx
mov	ecx, [ebp+arg_C]
mov	[eax+10h], ecx
mov	ecx, [ebp+arg_10]
mov	[eax+14h], ecx
mov	ecx, [ebp+arg_14]
mov	[eax+18h], ecx
mov	ecx, [ebp+arg_18]
mov	[eax+1Ch], ecx
mov	ecx, [ebp+arg_1C]
mov	[eax+20h], ecx

loc_1003270:
pop	ebp
retn	20h
sub_100322F endp



; Attributes: bp-based frame

sub_1003274 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h
arg_10=	dword ptr  18h
arg_14=	dword ptr  1Ch

push	ebp
mov	ebp, esp
push	esi
mov	esi, [ebp+arg_14]
lea	eax, [esi+esi*2+9]
shl	eax, 2
push	eax
call	sub_1001F17
test	eax, eax
jz	short loc_10032C5
mov	ecx, [ebp+arg_0]
test	ecx, ecx
mov	[eax], ecx
jz	short loc_100329B
mov	edx, [ecx+4]
mov	[eax+4], edx

loc_100329B:
mov	edx, [ebp+arg_4]
and	dword ptr [eax+1Ch], 0
and	dword ptr [eax+18h], 0
test	ecx, ecx
mov	[eax+8], edx
mov	edx, [ebp+arg_8]
mov	[eax+0Ch], edx
mov	edx, [ebp+arg_C]
mov	[eax+10h], edx
mov	edx, [ebp+arg_10]
mov	[eax+14h], edx
mov	[eax+20h], esi
jz	short loc_10032C5
inc	dword ptr [ecx+8]

loc_10032C5:
pop	esi
pop	ebp
retn	18h
sub_1003274 endp




sub_10032CA proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
mov	esi, [esp+4+arg_0]
push	edi
mov	edi, [esi]
cmp	dword ptr [edi+0Ch], 0
jnz	short loc_10032DE
cmp	dword ptr [edi+14h], 0
jz	short loc_10032F9

loc_10032DE:
push	dword ptr [esi+14h]
mov	eax, [esp+0Ch+arg_4]
push	dword ptr [esi+10h]
mov	eax, [eax]
push	dword ptr [esi+0Ch]
add	eax, dword_1007308
push	eax
call	sub_1002131

loc_10032F9:
cmp	dword ptr [edi+10h], 0
jnz	short loc_1003305
cmp	dword ptr [edi+18h], 0
jz	short loc_1003321

loc_1003305:
push	dword ptr [esi+14h]
mov	eax, [esp+0Ch+arg_4]
mov	eax, [eax+4]
push	dword ptr [esi+10h]
add	eax, nNumber
push	eax
push	dword ptr [esi+8]
call	sub_1002131

loc_1003321:
pop	edi
pop	esi
retn	8
sub_10032CA endp




; int __stdcall	sub_1003326(HLOCAL hMem)
sub_1003326 proc near

hMem= dword ptr	 4

push	esi
mov	esi, [esp+4+hMem]
mov	eax, [esi]
test	eax, eax
jz	short loc_100333D
dec	dword ptr [eax+8]
jnz	short loc_100333D
push	dword ptr [esi]	; hMem
call	LocalFree

loc_100333D:		; hMem
push	esi
call	LocalFree
xor	eax, eax
inc	eax
pop	esi
retn	4
sub_1003326 endp



; Attributes: bp-based frame

; int __stdcall	sub_100334A(int, HDC hdcSrc, int)
sub_100334A proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
hdcSrc=	dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 10h
mov	eax, [ebp+hdcSrc]
push	ebx
push	esi
mov	esi, [ebp+arg_0]
push	edi
push	dword ptr [eax+4]
push	dword ptr [eax]	; pt
lea	eax, [esi+8]
push	eax		; lprc
call	ds:PtInRect
test	eax, eax
jz	short loc_10033A9
mov	eax, [esi+1Ch]
test	eax, eax
jz	short loc_10033A9
lea	edi, [eax-1]
cmp	edi, [ebp+arg_8]
mov	[ebp+arg_0], edi
jl	short loc_10033A9
lea	eax, [edi+edi*2+9]
lea	ebx, [esi+eax*4]

loc_1003385:
test	byte ptr [ebx+1], 80h
jz	short loc_10033A9
mov	eax, [ebp+hdcSrc]
push	dword ptr [eax+4]
push	dword ptr [eax]
push	ebx
call	sub_10021E1
test	eax, eax
jnz	short loc_10033B5
dec	edi
sub	ebx, 0Ch
cmp	edi, [ebp+arg_8]
mov	[ebp+arg_0], edi
jge	short loc_1003385

loc_10033A9:
mov	eax, 1FFFh

loc_10033AE:
pop	edi
pop	esi
pop	ebx
leave
retn	0Ch

loc_10033B5:
mov	eax, [esi+1Ch]
sub	eax, edi
mov	dword_1007198, eax
lea	eax, [edi+edi*2]
mov	edi, [esi+eax*4+28h]
mov	ebx, [esi+eax*4+2Ch]
mov	eax, [ebp+hdcSrc]
mov	ecx, edi
sub	ecx, [eax]
mov	dword_100719C, ecx
mov	ecx, ebx
sub	ecx, [eax+4]
cmp	dword_1007188, 0
mov	dword_10071A0, ecx
jnz	loc_100351B
push	hWnd		; hWnd
call	ds:GetDC
mov	ecx, eax
test	ecx, ecx
mov	[ebp+hdcSrc], ecx
jnz	short loc_100340B
call	sub_10023E2
jmp	short loc_10033A9

loc_100340B:
mov	edx, dword_1007198
mov	dword_10071AC, ecx
mov	eax, [esi]
mov	eax, [eax+10h]
dec	edx
imul	eax, edx
add	eax, nNumber
mov	edx, dword_1007308
mov	cy, eax
add	eax, ebx
mov	[ebp+var_4], eax
lea	eax, [ebp+var_10]
push	eax		; int
add	edx, edi
push	ecx		; hdc
mov	[ebp+var_10], edi
mov	[ebp+var_8], edx
mov	[ebp+var_C], ebx
call	sub_100228E
test	eax, eax
jz	short loc_100347C
push	0CC0020h	; rop
push	ebx		; y1
push	edi		; x1
push	[ebp+hdcSrc]	; hdcSrc
push	cy		; cy
push	dword_1007308	; cx
push	0		; y
push	0		; x
push	hdc		; hdc
call	ds:BitBlt
mov	eax, dword_1007178
jmp	short loc_10034C6

loc_100347C:
mov	eax, dword_1007178
push	ebx
push	edi
push	hdc
mov	[ebp+arg_8], eax
mov	dword_1007178, 1
call	sub_10013A8
push	dword ptr [esi+14h]
mov	[ebp+hdcSrc], eax
push	dword ptr [esi+10h]
push	ebx
push	edi
call	sub_1002131
push	dword ptr [esi+1Ch]
push	[ebp+arg_0]
push	12h
push	esi
call	dword ptr [esi+4]
push	0
push	0
push	[ebp+hdcSrc]
call	sub_10013A8
mov	eax, [ebp+arg_8]

loc_10034C6:
push	ebx
push	edi
push	dword_10071B8
mov	[ebp+arg_8], eax
mov	dword_1007178, 1
call	sub_10013A8
push	dword ptr [esi+14h]
mov	[ebp+hdcSrc], eax
push	dword ptr [esi+10h]
push	ebx
push	edi
call	sub_1002131
mov	edi, [ebp+arg_0]
push	edi
xor	ebx, ebx
push	ebx
call	sub_10023B5
push	eax
lea	eax, [edi-1]
push	eax
push	12h
push	esi
call	dword ptr [esi+4]
push	ebx
push	ebx
push	[ebp+hdcSrc]
call	sub_10013A8
mov	eax, [ebp+arg_8]
mov	dword_1007178, eax
jmp	short loc_100351E

loc_100351B:
mov	edi, [ebp+arg_0]

loc_100351E:
mov	dword ptr [esi+18h], offset dword_1007194
mov	dword_1007194, edi
mov	eax, edi
jmp	loc_10033AE
sub_100334A endp



; Attributes: bp-based frame

sub_1003532 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ebx
xor	ebx, ebx
cmp	[ebp+arg_8], ebx
push	edi
mov	edi, [ebp+arg_0]
jz	short loc_1003549
push	ebx
push	ebx
push	1Ch
push	edi
call	dword ptr [edi+4]

loc_1003549:
cmp	dword_1007188, ebx
jz	short loc_100356C
mov	eax, [ebp+arg_4]
mov	ecx, [eax]
cmp	ecx, dword_1007000
jz	short loc_10035D6
push	offset dword_1007000
push	eax
push	14h
push	edi
call	dword ptr [edi+4]
jmp	short loc_10035D6

loc_100356C:
push	esi
mov	esi, [edi+18h]
cmp	esi, ebx
jz	short loc_10035D5
cmp	[esi+10h], ebx
jz	short loc_10035D5
mov	eax, [ebp+arg_4]
mov	ecx, [eax]
cmp	ecx, dword_1007000
jz	short loc_10035AF
mov	edx, [esi+0Ch]
add	edx, [eax+4]
mov	eax, [esi+8]
push	0CC0020h	; rop
push	ebx		; y1
push	ebx		; x1
push	dword ptr [esi+24h] ; hdcSrc
add	eax, ecx
push	dword ptr [esi+14h] ; cy
push	dword_1007308	; cx
push	edx		; y
push	eax		; x
push	dword ptr [esi+18h] ; hdc
call	ds:BitBlt

loc_10035AF:
cmp	[ebp+arg_8], ebx
jz	short loc_10035C3
mov	eax, [esi]
push	1FFDh
dec	eax
push	eax
push	12h
push	edi
call	dword ptr [edi+4]

loc_10035C3:		; hDC
push	dword ptr [esi+18h]
push	hWnd		; hWnd
call	ds:ReleaseDC
mov	[esi+18h], ebx

loc_10035D5:
pop	esi

loc_10035D6:
xor	eax, eax
pop	edi
inc	eax
pop	ebx
pop	ebp
retn	0Ch
sub_1003532 endp



; Attributes: bp-based frame

sub_10035DF proc near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
mov	ecx, [ebp+arg_0]
mov	eax, [ecx+18h]
test	eax, eax
jz	short loc_1003654
mov	edx, [eax]
mov	eax, [eax+4]
push	ebx
push	esi
lea	esi, [edx+edx*2+9]
lea	esi, [ecx+esi*4]
push	edi
mov	edi, [ebp+arg_4]
lea	ecx, [eax+eax*2]
shl	ecx, 2
mov	ebx, ecx
shr	ecx, 2
add	edi, 24h
mov	[ebp+var_4], esi
rep movsd
mov	ecx, ebx
mov	ebx, [ebp+arg_0]
and	ecx, 3
rep movsb
mov	ecx, [ebp+arg_4]
mov	[ecx+1Ch], eax
mov	ecx, [ebx+1Ch]
sub	ecx, eax
sub	ecx, edx
test	ecx, ecx
jle	short loc_100364E
mov	edi, [ebp+var_4]
lea	ecx, [ecx+ecx*2]
shl	ecx, 2
lea	edx, [eax+edx+3]
lea	edx, [edx+edx*2]
lea	esi, [ebx+edx*4]
mov	edx, ecx
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb

loc_100364E:
sub	[ebx+1Ch], eax
pop	edi
pop	esi
pop	ebx

loc_1003654:
xor	eax, eax
inc	eax
leave
retn	8
sub_10035DF endp



; Attributes: bp-based frame

sub_100365B proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_0]
push	ebx
mov	ebx, [ebp+arg_4]
push	esi
push	edi
mov	edi, [ebp+arg_8]
cmp	edi, 1FFDh
jnz	short loc_1003677
mov	edx, [eax+1Ch]
jmp	short loc_10036A5

loc_1003677:
mov	edx, [ebx+1Ch]
lea	ecx, [edx+edx*2]
lea	edx, [edx+edi+3]
shl	ecx, 2
mov	[ebp+arg_8], edi
lea	esi, [edi+edi*2+9]
lea	edx, [edx+edx*2]
lea	edi, [eax+edx*4]
mov	edx, ecx
shr	ecx, 2
lea	esi, [eax+esi*4]
rep movsd
mov	ecx, edx
mov	edx, [ebp+arg_8]
and	ecx, 3
rep movsb

loc_10036A5:
mov	ecx, [ebx+1Ch]
lea	ecx, [ecx+ecx*2]
shl	ecx, 2
lea	edx, [edx+edx*2+9]
lea	edi, [eax+edx*4]
mov	edx, ecx
shr	ecx, 2
lea	esi, [ebx+24h]
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	ecx, [ebx+1Ch]
add	[eax+1Ch], ecx
and	dword ptr [ebx+1Ch], 0
pop	edi
xor	eax, eax
pop	esi
inc	eax
pop	ebx
pop	ebp
retn	0Ch
sub_100365B endp



; Attributes: bp-based frame

; int __stdcall	sub_10036DA(HLOCAL hMem, int, int)
sub_10036DA proc near

var_8= dword ptr -8
var_4= dword ptr -4
hMem= dword ptr	 8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
push	ecx
mov	eax, [ebp+arg_8]
and	[ebp+arg_8], 1FFFh
and	eax, 2000h
push	esi
mov	esi, [ebp+arg_4]
mov	[ebp+var_4], eax
mov	eax, [esi+18h]
test	eax, eax
jnz	short loc_1003702
inc	eax
jmp	loc_10037CC

loc_1003702:
mov	eax, [eax]
push	ebx
push	edi
push	0
dec	eax
push	eax
call	sub_10023B5
mov	ebx, [ebp+hMem]
mov	edi, 1FFDh
cmp	[ebp+arg_8], edi
mov	[ebp+var_8], eax
jnz	short loc_1003724
mov	eax, [ebx+1Ch]
jmp	short loc_1003727

loc_1003724:
mov	eax, [ebp+arg_8]

loc_1003727:
mov	[ebp+arg_4], eax
mov	eax, [esi+18h]
push	dword ptr [eax+4]
xor	eax, eax
push	eax
push	eax
push	eax
push	eax
push	eax
call	sub_1003274
test	eax, eax
mov	[ebp+hMem], eax
jz	loc_10037CA
push	0
push	eax
push	0Ch
push	esi
call	dword ptr [esi+4]
test	eax, eax
jz	short loc_10037BE
push	[ebp+arg_8]
push	[ebp+hMem]
push	0Dh
push	ebx
call	dword ptr [ebx+4]
test	eax, eax
jz	short loc_10037BE
push	0
push	[ebp+arg_4]
push	15h
push	ebx
call	dword ptr [ebx+4]
test	eax, eax
jz	short loc_10037BE
xor	eax, eax
cmp	[ebp+var_4], eax
jz	short loc_1003786
push	eax
push	eax
push	1Ch
push	esi
call	dword ptr [esi+4]
test	eax, eax
jz	short loc_10037BE

loc_1003786:
cmp	dword_1007188, 0
jz	short loc_100379D
push	edi
push	[ebp+var_8]
push	12h
push	esi
call	dword ptr [esi+4]
test	eax, eax
jz	short loc_10037BE

loc_100379D:
push	edi
push	[ebp+arg_4]
push	12h
push	ebx
call	dword ptr [ebx+4]
test	eax, eax
jz	short loc_10037BE
push	0
push	0
push	7
push	esi
call	dword ptr [esi+4]
test	eax, eax
jz	short loc_10037BE
xor	esi, esi
inc	esi
jmp	short loc_10037C0

loc_10037BE:
xor	esi, esi

loc_10037C0:		; hMem
push	[ebp+hMem]
call	LocalFree
mov	eax, esi

loc_10037CA:
pop	edi
pop	ebx

loc_10037CC:
pop	esi
leave
retn	0Ch
sub_10036DA endp



; Attributes: bp-based frame

sub_10037D1 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
cmp	[ebp+arg_8], 0
push	esi
push	edi
jz	short loc_1003800
mov	esi, [ebp+arg_4]
mov	eax, [esi+1Ch]
add	eax, 3
lea	ecx, [eax+eax*2]
mov	eax, [ebp+arg_0]
shl	ecx, 2
mov	edx, ecx
shr	ecx, 2
mov	edi, eax
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
jmp	short loc_100382B

loc_1003800:
mov	edx, [ebp+arg_4]
mov	eax, [edx+1Ch]
lea	ecx, [eax+eax*2]
mov	eax, [ebp+arg_0]
shl	ecx, 2
push	ebx
mov	ebx, ecx
shr	ecx, 2
lea	esi, [edx+24h]
lea	edi, [eax+24h]
rep movsd
mov	ecx, ebx
and	ecx, 3
rep movsb
mov	ecx, [edx+1Ch]
mov	[eax+1Ch], ecx
pop	ebx

loc_100382B:
push	1FFDh
push	0
push	12h
push	eax
call	dword ptr [eax+4]
pop	edi
pop	esi
pop	ebp
retn	0Ch
sub_10037D1 endp



; Attributes: bp-based frame

sub_100383E proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ebx
push	0
push	[ebp+arg_4]
call	sub_10023B5
mov	ebx, eax
mov	[ebp+arg_4], ebx
call	sub_10013CE
test	eax, eax
jz	loc_100390B
push	esi
mov	esi, [ebp+arg_0]
mov	eax, [esi+1Ch]
test	eax, eax
push	edi
mov	edi, [ebp+arg_8]
jz	short loc_10038C2
test	edi, edi
jz	short loc_10038C2
push	edi
push	eax
call	sub_10023A4
cmp	ebx, eax
mov	ecx, ebx
mov	[ebp+arg_8], eax
mov	[ebp+arg_0], ecx
jge	short loc_10038D7
lea	eax, [ebx+ebx*2+9]
lea	ebx, [esi+eax*4]
mov	eax, [ebp+arg_4]

loc_100388E:
cmp	ecx, [ebp+arg_4]
jz	short loc_10038A9
mov	ecx, [ebx+4]
cmp	ecx, [eax+4]
jnz	short loc_10038A9
mov	ecx, [ebx+8]
cmp	ecx, [eax+8]
jnz	short loc_10038A9
test	byte ptr [ebx+1], 80h
jz	short loc_10038AF

loc_10038A9:
push	ebx
call	sub_1001F45

loc_10038AF:
mov	ecx, [ebp+arg_0]
inc	ecx
mov	eax, ebx
add	ebx, 0Ch
cmp	ecx, [ebp+arg_8]
mov	[ebp+arg_0], ecx
jl	short loc_100388E
jmp	short loc_10038D7

loc_10038C2:
push	dword ptr [esi+14h]
push	dword ptr [esi+10h]
push	dword ptr [esi+0Ch]
push	dword ptr [esi+8]
call	sub_1002131
test	edi, edi
jnz	short loc_1003901

loc_10038D7:
mov	eax, hMem
cmp	dword ptr [eax+24h], 0
jnz	short loc_10038E9
mov	eax, [esi]
cmp	dword ptr [eax], 1
jnz	short loc_1003901

loc_10038E9:
mov	eax, [ebp+arg_8]
dec	eax
neg	edi
sbb	edi, edi
and	edi, eax
lea	eax, [edi+edi*2]
lea	eax, [esi+eax*4+28h]
push	eax
push	esi
call	sub_10032CA

loc_1003901:
call	sub_1001405
xor	eax, eax
pop	edi
inc	eax
pop	esi

loc_100390B:
pop	ebx
pop	ebp
retn	0Ch
sub_100383E endp



; Attributes: bp-based frame

; int __stdcall	sub_1003910(int, RECT *lprcSrc2)
sub_1003910 proc near

arg_0= dword ptr  8
lprcSrc2= dword	ptr  0Ch

push	ebp
mov	ebp, esp
mov	eax, [ebp+lprcSrc2]
test	eax, eax
push	esi
mov	esi, [ebp+arg_0]
push	edi
jnz	short loc_1003933
xor	edi, edi

loc_1003921:
push	1FFDh
push	edi
push	12h
push	esi
call	dword ptr [esi+4]

loc_100392D:
pop	edi
pop	esi
pop	ebp
retn	8

loc_1003933:
add	eax, 8
push	eax		; lprcSrc2
mov	[ebp+lprcSrc2],	eax
lea	eax, [esi+8]
push	eax		; lprcSrc1
call	sub_100221C
test	eax, eax
jz	short loc_1003972
mov	eax, [esi+1Ch]
xor	edi, edi
test	eax, eax
jz	short loc_1003921
jle	short loc_100396D
push	ebx
lea	ebx, [esi+24h]

loc_1003956:		; lprcSrc2
push	[ebp+lprcSrc2]
push	ebx		; int
call	sub_1002263
test	eax, eax
jnz	short loc_100396C
inc	edi
add	ebx, 0Ch
cmp	edi, [esi+1Ch]
jl	short loc_1003956

loc_100396C:
pop	ebx

loc_100396D:
cmp	edi, [esi+1Ch]
jnz	short loc_1003921

loc_1003972:
xor	eax, eax
jmp	short loc_100392D
sub_1003910 endp



; Attributes: bp-based frame

sub_1003976 proc near

var_1C=	dword ptr -1Ch
var_14=	dword ptr -14h
var_10=	dword ptr -10h
x= dword ptr -0Ch
y= dword ptr -8
hdc= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 1Ch
mov	eax, [ebp+arg_0]
push	esi
mov	esi, [eax+18h]
test	esi, esi
jz	loc_1003AE2
push	ebx
push	edi
lea	eax, [ebp+x]
push	eax
lea	ebx, [esi+8]
push	ebx
push	[ebp+arg_4]
call	sub_10022C5
mov	edi, [ebp+arg_8]
mov	eax, [edi]
cmp	eax, dword_1007000
jz	short loc_10039B5
lea	eax, [ebp+var_14]
push	eax
push	ebx
push	edi
call	sub_10022C5

loc_10039B5:
xor	edx, edx
cmp	dword_1007188, edx
jz	short loc_10039F8
mov	eax, [ebp+arg_0]
mov	ebx, [eax]
push	dword ptr [ebx+10h]
lea	eax, [ebp+x]
push	edx
push	dword ptr [esi+4]
push	eax
call	sub_1001FA6
mov	eax, [edi]
cmp	eax, dword_1007000
jz	loc_1003AE0
push	dword ptr [ebx+10h]
lea	eax, [ebp+var_14]
push	0
push	dword ptr [esi+4]
push	eax
call	sub_1001FA6
jmp	loc_1003AE0

loc_10039F8:
mov	ecx, [esi+18h]
mov	eax, [esi+2Ch]
mov	ebx, ds:BitBlt
push	0CC0020h	; rop
push	[ebp+y]		; y1
mov	[ebp+arg_0], ecx
push	[ebp+x]		; x1
mov	[ebp+hdc], eax
push	ecx		; hdcSrc
push	dword ptr [esi+14h] ; cy
push	dword_1007308	; cx
push	edx		; y
push	edx		; x
push	eax		; hdc
call	ebx ; BitBlt
mov	eax, [edi]
cmp	eax, dword_1007000
jz	short loc_1003A7E
mov	ecx, [ebp+arg_4]
mov	edi, [edi+4]
sub	edi, [ecx+4]
sub	eax, [ecx]
push	0CC0020h	; rop
push	0		; y1
push	0		; x1
push	dword ptr [esi+24h] ; hdcSrc
mov	[ebp+var_1C], eax
push	dword ptr [esi+14h] ; cy
push	dword_1007308	; cx
push	edi		; y
push	eax		; x
push	[ebp+hdc]	; hdc
call	ebx ; BitBlt
mov	eax, [ebp+var_1C]
push	0CC0020h	; rop
push	0		; y1
push	0		; x1
push	dword ptr [esi+1Ch] ; hdcSrc
neg	edi
push	dword ptr [esi+14h] ; cy
neg	eax
push	dword_1007308	; cx
push	edi		; y
push	eax		; x
push	dword ptr [esi+24h] ; hdc
call	ebx ; BitBlt
mov	edi, [ebp+arg_8]

loc_1003A7E:		; rop
push	0CC0020h
push	0		; y1
push	0		; x1
push	dword ptr [esi+1Ch] ; hdcSrc
push	dword ptr [esi+14h] ; cy
push	dword_1007308	; cx
push	[ebp+y]		; y
push	[ebp+x]		; x
push	[ebp+arg_0]	; hdc
call	ebx ; BitBlt
mov	eax, [edi]
cmp	eax, dword_1007000
jz	short loc_1003AC8
push	0CC0020h	; rop
push	0		; y1
push	0		; x1
push	dword ptr [esi+24h] ; hdcSrc
push	dword ptr [esi+14h] ; cy
push	dword_1007308	; cx
push	[ebp+var_10]	; y
push	[ebp+var_14]	; x
push	[ebp+arg_0]	; hdc
call	ebx ; BitBlt

loc_1003AC8:
mov	eax, [esi+24h]
mov	ecx, [esi+2Ch]
mov	[esi+24h], ecx
mov	ecx, [esi+30h]
mov	[esi+2Ch], eax
mov	eax, [esi+28h]
mov	[esi+28h], ecx
mov	[esi+30h], eax

loc_1003AE0:
pop	edi
pop	ebx

loc_1003AE2:
xor	eax, eax
inc	eax
pop	esi
leave
retn	0Ch
sub_1003976 endp



; Attributes: bp-based frame

sub_1003AEA proc near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
push	ecx
mov	eax, [ebp+arg_4]
test	eax, eax
mov	ecx, [ebp+arg_0]
push	esi
push	edi
jnz	short loc_1003B06
mov	edx, [ecx+0Ch]
mov	edi, [ecx+8]
mov	[ebp+var_4], edx
jmp	short loc_1003B1F

loc_1003B06:
dec	eax
cmp	dword_1007190, 0
lea	edx, [eax+eax*2]
mov	edi, [ecx+edx*4+28h]
mov	edx, [ecx+edx*4+2Ch]
mov	[ebp+var_4], edx
jz	short loc_1003B1F
inc	eax

loc_1003B1F:
cmp	eax, [ecx+1Ch]
mov	esi, [ecx]
mov	[ebp+arg_0], eax
jge	short loc_1003B8B
lea	eax, [eax+eax*2+9]
lea	eax, [ecx+eax*4]
mov	[ebp+arg_4], eax
push	ebx

loc_1003B34:
test	byte ptr [eax+1], 80h
mov	edx, [ebp+var_4]
mov	[eax+4], edi
mov	[eax+8], edx
jz	short loc_1003B5F
cmp	[ebp+arg_8], 0
jnz	short loc_1003B5F
mov	eax, [ebp+arg_0]
mov	ebx, [esi+1Ch]
cdq
idiv	ebx
dec	ebx
cmp	edx, ebx
jnz	short loc_1003B76
add	edi, [esi+0Ch]
mov	eax, [esi+10h]
jmp	short loc_1003B73

loc_1003B5F:
mov	eax, [ebp+arg_0]
mov	ebx, [esi+20h]
cdq
idiv	ebx
dec	ebx
cmp	edx, ebx
jnz	short loc_1003B76
add	edi, [esi+14h]
mov	eax, [esi+18h]

loc_1003B73:
add	[ebp+var_4], eax

loc_1003B76:
inc	[ebp+arg_0]
mov	eax, [ebp+arg_4]
mov	edx, [ebp+arg_0]
add	eax, 0Ch
cmp	edx, [ecx+1Ch]
mov	[ebp+arg_4], eax
jl	short loc_1003B34
pop	ebx

loc_1003B8B:
xor	eax, eax
pop	edi
inc	eax
pop	esi
leave
retn	0Ch
sub_1003AEA endp



; Attributes: bp-based frame

sub_1003B94 proc near

rc= RECT ptr -10h
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
mov	eax, [ebp+arg_0]
mov	ecx, [eax]
mov	edx, dword_1007308
mov	eax, [eax+4]
add	edx, ecx
mov	[ebp+rc.left], ecx
mov	ecx, nNumber
add	ecx, eax
mov	[ebp+rc.top], eax
lea	eax, [ebp+rc]
push	eax		; lprc
mov	[ebp+rc.right],	edx
mov	[ebp+rc.bottom], ecx
call	sub_1001F32
leave
retn	4
sub_1003B94 endp



; Attributes: bp-based frame

sub_1003BCB proc near

rcSrc1=	RECT ptr -10h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 10h
push	edi
mov	edi, [ebp+arg_4]
mov	eax, [edi+18h]
test	eax, eax
jnz	short loc_1003BDF
inc	eax
jmp	short loc_1003C2D

loc_1003BDF:
push	esi
lea	ecx, [ebp+rcSrc1]
push	ecx
add	eax, 8
push	eax
push	[ebp+arg_8]
call	sub_10022C5
mov	eax, [ebp+rcSrc1.left]
mov	ecx, dword_1007308
mov	esi, [ebp+arg_0]
add	ecx, eax
mov	eax, [ebp+rcSrc1.top]
mov	[ebp+rcSrc1.right], ecx
mov	ecx, nNumber
add	ecx, eax
mov	eax, [esi+1Ch]
test	eax, eax
mov	[ebp+rcSrc1.bottom], ecx
jnz	short loc_1003C32
lea	eax, [esi+8]
push	eax		; lprcSrc2
lea	eax, [ebp+rcSrc1]
push	eax		; lprcSrc1
call	sub_100221C

loc_1003C23:
test	eax, eax
jnz	short loc_1003C45

loc_1003C27:
mov	eax, 1FFFh

loc_1003C2C:
pop	esi

loc_1003C2D:
pop	edi
leave
retn	0Ch

loc_1003C32:
lea	ecx, [ebp+rcSrc1]
lea	eax, [eax+eax*2+6]
push	ecx		; lprcSrc2
lea	eax, [esi+eax*4]
push	eax		; int
call	sub_1002263
jmp	short loc_1003C23

loc_1003C45:
push	0
push	edi
push	10h
push	esi
call	dword ptr [esi+4]
test	eax, eax
jz	short loc_1003C27
mov	eax, [esi+1Ch]
jmp	short loc_1003C2C
sub_1003BCB endp




sub_1003C57 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	edx, [esp+arg_4]
and	dword_10071A0, 0
and	dword_100719C, 0
cmp	edx, 1FFCh
mov	ecx, [esp+arg_0]
jnz	short loc_1003C95
mov	eax, [ecx+1Ch]
test	eax, eax
jle	short loc_1003C8E
dec	eax
mov	dword_1007194, eax
mov	dword_1007198, 1
jmp	short loc_1003CAE

loc_1003C8E:
mov	eax, 1FFFh
jmp	short locret_1003CBA

loc_1003C95:
mov	eax, [esp+arg_8]
cmp	eax, 0FFFFFFFEh
jnz	short loc_1003CA3
mov	eax, [ecx+1Ch]
sub	eax, edx

loc_1003CA3:
mov	dword_1007194, edx
mov	dword_1007198, eax

loc_1003CAE:
mov	dword ptr [ecx+18h], offset dword_1007194
mov	eax, dword_1007194

locret_1003CBA:
retn	0Ch
sub_1003C57 endp




sub_1003CBD proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	edx, [esp+arg_0]
mov	eax, [edx+18h]
test	eax, eax
jz	short loc_1003CFD
mov	ecx, [eax]
mov	eax, [eax+4]
add	eax, ecx
cmp	ecx, eax
jge	short loc_1003CFD
push	esi
mov	esi, [esp+4+arg_4]
push	edi
lea	edi, [ecx+ecx*2+9]
shl	esi, 0Fh
lea	edx, [edx+edi*4]
sub	eax, ecx

loc_1003CE5:
xor	ecx, ecx
mov	cx, [edx]
and	ecx, 0FFFF7FFFh
or	ecx, esi
mov	[edx], cx
add	edx, 0Ch
dec	eax
jnz	short loc_1003CE5
pop	edi
pop	esi

loc_1003CFD:
xor	eax, eax
inc	eax
retn	8
sub_1003CBD endp




sub_1003D03 proc near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
mov	eax, [esi+18h]
test	eax, eax
jz	short loc_1003D4A
mov	ecx, [eax]
push	edi
mov	edi, [eax+4]
mov	eax, edi
cdq
sub	eax, edx
sar	eax, 1
add	eax, ecx
cmp	ecx, eax
jge	short loc_1003D49
lea	edx, [ecx+ecx*2+9]
push	ebx
lea	ebx, [esi+edx*4]
lea	edx, [edi+ecx+2]
lea	edx, [edx+edx*2]
sub	eax, ecx
lea	esi, [esi+edx*4]
mov	edi, eax

loc_1003D38:
push	esi
push	ebx
call	sub_10022E5
add	ebx, 0Ch
sub	esi, 0Ch
dec	edi
jnz	short loc_1003D38
pop	ebx

loc_1003D49:
pop	edi

loc_1003D4A:
xor	eax, eax
inc	eax
pop	esi
retn	4
sub_1003D03 endp




sub_1003D51 proc near

arg_0= dword ptr  4

cmp	dword_1007188, 0
jz	short loc_1003D85
call	sub_10013CE
test	eax, eax
jz	short locret_1003D88
mov	ecx, [esp+arg_0]
mov	eax, [ecx+1Ch]
test	eax, eax
jle	short loc_1003D77
lea	eax, [eax+eax*2]
lea	eax, [ecx+eax*4+1Ch]
jmp	short loc_1003D7A

loc_1003D77:
lea	eax, [ecx+8]

loc_1003D7A:
push	eax
call	sub_1003B94
call	sub_1001405

loc_1003D85:
xor	eax, eax
inc	eax

locret_1003D88:
retn	4
sub_1003D51 endp




sub_1003D8B proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

cmp	[esp+arg_4], 0
jz	short loc_1003DBC
mov	edx, [esp+arg_0]
mov	eax, [edx+1Ch]
lea	ecx, [eax-1]
test	ecx, ecx
jl	short loc_1003DB7
push	esi
lea	esi, [ecx+ecx*2+9]
lea	edx, [edx+esi*4]
pop	esi

loc_1003DA9:
test	byte ptr [edx+1], 80h
jz	short loc_1003DB7
dec	ecx
sub	edx, 0Ch
test	ecx, ecx
jge	short loc_1003DA9

loc_1003DB7:
sub	eax, ecx
dec	eax
jmp	short locret_1003DC3

loc_1003DBC:
mov	eax, [esp+arg_0]
mov	eax, [eax+1Ch]

locret_1003DC3:
retn	8
sub_1003D8B endp




sub_1003DC6 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_4]
test	eax, eax
mov	ecx, [esp+arg_0]
jnz	short loc_1003DD7
add	ecx, 8
jmp	short loc_1003DDE

loc_1003DD7:
lea	eax, [eax+eax*2]
lea	ecx, [ecx+eax*4+28h]

loc_1003DDE:
mov	eax, dword_1007308
cdq
sub	eax, edx
mov	edx, eax
mov	eax, [esp+arg_8]
sar	edx, 1
add	edx, [ecx]
mov	[eax], edx
mov	ecx, [ecx+4]
mov	[eax+4], ecx
xor	eax, eax
inc	eax
retn	0Ch
sub_1003DC6 endp



; Attributes: bp-based frame

sub_1003DFE proc near

var_14=	byte ptr -14h
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 14h
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx+1Ch]
push	esi
push	edi
mov	[ebp+var_8], 5

loc_1003E14:
and	[ebp+var_4], 0
test	eax, eax
jle	short loc_1003E5D
lea	eax, [ebx+24h]
mov	[ebp+arg_0], eax

loc_1003E22:
call	ds:rand
cdq
idiv	dword ptr [ebx+1Ch]
mov	esi, [ebp+arg_0]
lea	edi, [ebp+var_14]
movsd
movsd
movsd
mov	edi, [ebp+arg_0]
add	[ebp+arg_0], 0Ch
add	edx, 3
inc	[ebp+var_4]
lea	eax, [edx+edx*2]
lea	eax, [ebx+eax*4]
mov	esi, eax
movsd
movsd
movsd
mov	edi, eax
lea	esi, [ebp+var_14]
movsd
movsd
movsd
mov	eax, [ebx+1Ch]
cmp	[ebp+var_4], eax
jl	short loc_1003E22

loc_1003E5D:
dec	[ebp+var_8]
jnz	short loc_1003E14
pop	edi
xor	eax, eax
pop	esi
inc	eax
pop	ebx
leave
retn	4
sub_1003DFE endp



; Attributes: bp-based frame

; void __stdcall Proc(int, int,	LPARAM)
Proc proc near

var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
push	ecx
mov	eax, [ebp+arg_8]
mov	ecx, [eax+18h]
test	ecx, ecx
jz	short locret_1003ECA
mov	edx, [ecx+34h]
cmp	edx, 23h
push	esi
lea	esi, [edx+1]
mov	[ecx+34h], esi
pop	esi
jl	short locret_1003ECA
mov	ecx, [eax+18h]
and	dword ptr [ecx+34h], 0
mov	ecx, [ebp+arg_0]
mov	[ebp+var_8], ecx
mov	ecx, [ebp+arg_4]
mov	[ebp+var_4], ecx
mov	ecx, hMem
add	ecx, 44h
push	ecx
lea	ecx, [ebp+var_8]
push	ecx
push	14h
push	eax
call	dword ptr [eax+4]
mov	eax, [ebp+var_8]
mov	ecx, hMem
mov	[ecx+44h], eax
mov	eax, [ebp+var_4]
mov	ecx, hMem
mov	[ecx+48h], eax

locret_1003ECA:
leave
retn	0Ch
Proc endp




; int __stdcall	sub_1003ECE(LPARAM data)
sub_1003ECE proc near

data= dword ptr	 4

mov	eax, hMem
mov	eax, [eax+44h]
cmp	eax, dword_1007000
jz	short loc_1003F1B
push	esi
mov	esi, [esp+4+data]
mov	eax, [esi+18h]
test	eax, eax
jz	short loc_1003F1A
mov	ecx, [eax]
lea	edx, [ecx+ecx*2]
mov	ecx, [esi+edx*4+28h]
mov	edx, [esi+edx*4+2Ch]
sub	edx, [eax+0Ch]
sub	ecx, [eax+8]
and	dword ptr [eax+34h], 0
mov	eax, hMem
push	esi		; data
push	offset Proc	; lpProc
push	edx		; yEnd
push	ecx		; xEnd
push	dword ptr [eax+48h] ; yStart
push	dword ptr [eax+44h] ; xStart
call	ds:LineDDA

loc_1003F1A:
pop	esi

loc_1003F1B:
xor	eax, eax
inc	eax
retn	4
sub_1003ECE endp



; Attributes: bp-based frame

; int __stdcall	sub_1003F21(HLOCAL data, int, HDC lprcSrc2, int)
sub_1003F21 proc near

data= dword ptr	 8
arg_4= dword ptr  0Ch
lprcSrc2= dword	ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_4]
dec	eax
cmp	eax, 1Bh	; switch 28 cases
ja	loc_1004088	; jumptable 01003F31 default case
jmp	ds:off_100408E[eax*4] ;	switch jump

loc_1003F38:		; jumptable 01003F31 case 1
push	[ebp+data]
call	sub_1003326
jmp	loc_100408A

loc_1003F45:		; jumptable 01003F31 case 2
mov	eax, [ebp+data]
and	dword ptr [eax+18h], 0
and	dword ptr [eax+1Ch], 0

loc_1003F50:		; jumptable 01003F31 cases 0,23,24
xor	eax, eax
inc	eax
jmp	loc_100408A

loc_1003F58:		; jumptable 01003F31 case 4
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; hdcSrc
push	[ebp+data]	; int
call	sub_100334A
jmp	loc_100408A

loc_1003F6B:		; jumptable 01003F31 case 9
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1003532
jmp	loc_100408A

loc_1003F7E:		; jumptable 01003F31 case 5
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1003C57
jmp	loc_100408A

loc_1003F91:		; jumptable 01003F31 case 6
mov	eax, [ebp+data]
and	dword ptr [eax+18h], 0
jmp	short loc_1003F50 ; jumptable 01003F31 cases 0,23,24

loc_1003F9A:		; jumptable 01003F31 case 3
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1003D8B
jmp	loc_100408A

loc_1003FAA:		; jumptable 01003F31 case 7
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1003CBD
jmp	loc_100408A

loc_1003FBA:		; jumptable 01003F31 case 8
push	[ebp+data]
call	sub_1003D03
jmp	loc_100408A

loc_1003FC7:		; jumptable 01003F31 case 11
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_10035DF
jmp	loc_100408A

loc_1003FD7:		; jumptable 01003F31 case 12
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_100365B
jmp	loc_100408A

loc_1003FEA:		; jumptable 01003F31 case 13
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; int
push	[ebp+data]	; hMem
call	sub_10036DA
jmp	loc_100408A

loc_1003FFD:		; jumptable 01003F31 case 14
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_10037D1
jmp	short loc_100408A

loc_100400D:		; jumptable 01003F31 case 16
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1003BCB
jmp	short loc_100408A

loc_100401D:		; jumptable 01003F31 case 17
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_100383E
jmp	short loc_100408A

loc_100402D:		; jumptable 01003F31 case 18
push	[ebp+lprcSrc2]
push	[ebp+data]	; int
call	sub_1003910
jmp	short loc_100408A

loc_100403A:		; jumptable 01003F31 case 19
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1003976
jmp	short loc_100408A

loc_100404A:		; jumptable 01003F31 case 20
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1003AEA
jmp	short loc_100408A

loc_100405A:		; jumptable 01003F31 case 21
push	[ebp+data]
call	sub_1003D51
jmp	short loc_100408A

loc_1004064:		; jumptable 01003F31 case 22
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1003DC6
jmp	short loc_100408A

loc_1004074:		; jumptable 01003F31 case 25
push	[ebp+data]
call	sub_1003DFE
jmp	short loc_100408A

loc_100407E:		; jumptable 01003F31 case 27
push	[ebp+data]
call	sub_1003ECE
jmp	short loc_100408A

loc_1004088:		; jumptable 01003F31 default case
xor	eax, eax

loc_100408A:
pop	ebp
retn	10h
sub_1003F21 endp

off_100408E dd offset loc_1003F50 ; jump table for switch statement
dd offset loc_1003F38
dd offset loc_1003F45
dd offset loc_1003F9A
dd offset loc_1003F58
dd offset loc_1003F7E
dd offset loc_1003F91
dd offset loc_1003FAA
dd offset loc_1003FBA
dd offset loc_1003F6B
dd offset loc_1004088
dd offset loc_1003FC7
dd offset loc_1003FD7
dd offset loc_1003FEA
dd offset loc_1003FFD
dd offset loc_1004088
dd offset loc_100400D
dd offset loc_100401D
dd offset loc_100402D
dd offset loc_100403A
dd offset loc_100404A
dd offset loc_100405A
dd offset loc_1004064
dd offset loc_1003F50
dd offset loc_1003F50
dd offset loc_1004074
dd offset loc_1004088
dd offset loc_100407E


; Attributes: bp-based frame

sub_10040FE proc near

var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4

push	ebp
mov	ebp, esp
sub	esp, 20h
mov	eax, hMem
push	ebx
push	esi
push	edi
mov	[ebp+var_1C], eax
add	eax, 6Ch
push	0Dh
mov	[ebp+var_20], eax
mov	edx, eax
pop	edi

loc_100411A:
mov	eax, [edx]
xor	ecx, ecx
xor	esi, esi
cmp	[eax+20h], ecx
jle	short loc_100413A

loc_1004125:
mov	ebx, [eax+8]
lea	ecx, [ecx+ecx*2]
lea	ecx, [eax+ecx*4+28h]
sub	[ecx], ebx
inc	esi
movzx	ecx, si
cmp	ecx, [eax+20h]
jl	short loc_1004125

loc_100413A:
add	edx, 4
dec	edi
jnz	short loc_100411A
mov	edi, dword_1007338
push	64h		; nDenominator
push	5		; nNumerator
push	nNumber		; nNumber
mov	[ebp+var_18], edi
call	ds:MulDiv
and	[ebp+var_4], 0
mov	ecx, [ebp+var_10]
mov	esi, [ebp+var_20]
mov	ebx, [ebp+var_20]
mov	[ebp+var_14], eax
jmp	short loc_100416E

loc_100416B:
mov	eax, [ebp+var_14]

loc_100416E:
mov	edx, [ebp+var_4]
sub	edx, 0
jz	loc_10041FC
dec	edx
jz	short loc_10041E3
dec	edx
jz	short loc_10041CD
sub	edx, 4
jnz	loc_1004219
mov	ecx, nNumber
mov	eax, dword_1007308
lea	esi, [eax+edi]
mov	eax, ecx
shl	eax, 2
cdq
mov	[ebp+var_10], edi
push	19h
pop	edi
idiv	edi
inc	ebx
mov	[ebp+var_8], ebx
push	19h
pop	ebx
mov	edi, eax
mov	eax, ecx
cdq
idiv	ebx
sub	edi, dword_100718C
lea	eax, [eax+edi*2]
mov	edi, [ebp+var_18]
lea	eax, [eax+eax*2]
lea	ebx, [ecx+eax*2]
add	ebx, [ebp+var_8]
mov	ecx, [ebp+var_10]
jmp	short loc_1004219

loc_10041CD:
mov	eax, dword_1007308
lea	ecx, [eax+eax*2]
lea	ecx, [ecx+edi*4]
lea	esi, [eax+ecx+6]
add	eax, edi
mov	[ebp+var_C], eax
jmp	short loc_1004219

loc_10041E3:
mov	eax, dword_1007308
lea	edx, [eax+edi]
imul	eax, 7
add	ecx, edx
push	5
cdq
pop	esi
idiv	esi
lea	esi, [eax+ecx+4]
jmp	short loc_1004219

loc_10041FC:
mov	edx, dword_1007308
and	[ebp+var_C], 0
lea	esi, [edx+edi+0Ah]
mov	edx, nNumber
mov	ecx, edi
mov	[ebp+var_8], eax
lea	ebx, [edx+eax+5]

loc_1004219:
mov	edx, [ebp+var_4]
mov	eax, [ebp+var_1C]
mov	eax, [eax+edx*4+6Ch]
mov	edx, [ebp+var_8]
mov	[eax+8], ecx
add	ecx, [ebp+var_C]
mov	[eax+10h], esi
add	esi, [ebp+var_C]
inc	[ebp+var_4]
cmp	[ebp+var_4], 0Dh
mov	[eax+0Ch], edx
mov	[eax+14h], ebx
jl	loc_100416B
mov	edx, [ebp+var_20]
push	0Dh
pop	edi

loc_100424B:
mov	eax, [edx]
xor	esi, esi
cmp	[eax+20h], esi
jle	short loc_100426B
xor	ecx, ecx

loc_1004256:
mov	ebx, [eax+8]
lea	ecx, [ecx+ecx*2]
lea	ecx, [eax+ecx*4+28h]
add	[ecx], ebx
inc	esi
movzx	ecx, si
cmp	ecx, [eax+20h]
jl	short loc_1004256

loc_100426B:
add	edx, 4
dec	edi
jnz	short loc_100424B
pop	edi
xor	eax, eax
pop	esi
inc	eax
pop	ebx
leave
retn
sub_10040FE endp




sub_1004279 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	ecx, [esp+arg_4]
mov	eax, [ecx+18h]
mov	eax, [eax]
add	eax, 3
lea	eax, [eax+eax*2]
movzx	eax, word ptr [ecx+eax*4]
mov	edx, 7FFFh
and	eax, edx
push	esi
mov	esi, eax
sar	esi, 2
and	eax, 3
cmp	esi, 0Ch
jnz	short loc_10042AF
mov	ecx, [esp+4+arg_0]
xor	eax, eax
cmp	[ecx+1Ch], eax
setz	al
jmp	short loc_10042EB

loc_10042AF:
push	ebx
mov	ebx, [esp+8+arg_0]
mov	ecx, [ebx+1Ch]
test	ecx, ecx
jz	short loc_10042E8
lea	ecx, [ecx+ecx*2+6]
mov	cx, [ebx+ecx*4]
test	ch, ch
jns	short loc_10042E8
and	ecx, edx
mov	edx, ecx
and	edx, 3
mov	ebx, edx
xor	ebx, eax
cmp	ebx, 3
jge	short loc_10042E8
cmp	eax, edx
jz	short loc_10042E8
inc	esi
sar	ecx, 2
cmp	esi, ecx
jnz	short loc_10042E8
xor	eax, eax
inc	eax
jmp	short loc_10042EA

loc_10042E8:
xor	eax, eax

loc_10042EA:
pop	ebx

loc_10042EB:
pop	esi
retn	8
sub_1004279 endp




; int __stdcall	sub_10042EF(HLOCAL data, HDC lprcSrc2, int)
sub_10042EF proc near

data= dword ptr	 4
lprcSrc2= dword	ptr  8
arg_8= dword ptr  0Ch

push	ebx
mov	ebx, [esp+4+lprcSrc2]
push	esi
mov	esi, [esp+8+data]
mov	eax, [esi+1Ch]
push	edi
xor	edi, edi
cmp	eax, edi
jle	short loc_1004379
lea	eax, [eax+eax*2+6]
lea	eax, [esi+eax*4]
test	byte ptr [eax+1], 80h
jnz	short loc_1004379
push	dword ptr [ebx+4]
push	dword ptr [ebx]
push	eax
call	sub_10021E1
test	eax, eax
jz	short loc_1004379
mov	eax, hMem
push	edi
push	edi
push	0Bh
push	eax
call	dword ptr [eax]
push	1
push	1FFCh
push	6
push	esi
call	dword ptr [esi+4]
push	edi
push	1
push	8
push	esi
call	dword ptr [esi+4]
mov	eax, [esi+1Ch]
push	edi
dec	eax
push	eax
push	15h
push	esi
call	dword ptr [esi+4]
mov	eax, [esi+1Ch]
push	1FFDh
dec	eax
push	eax
push	12h
push	esi
call	dword ptr [esi+4]
mov	eax, hMem
push	edi
push	4
push	0Fh
push	eax
call	dword ptr [eax]
push	edi
push	edi
push	7
push	esi
call	dword ptr [esi+4]
mov	eax, 1FFFh
jmp	short loc_1004386

loc_1004379:		; int
push	[esp+0Ch+arg_8]
push	ebx		; lprcSrc2
push	5		; int
push	esi		; data
call	sub_1003F21

loc_1004386:
pop	edi
pop	esi
pop	ebx
retn	0Ch
sub_10042EF endp



; Attributes: bp-based frame

sub_100438C proc near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
and	[ebp+var_4], 0
push	esi
mov	esi, [ebp+arg_0]
mov	eax, [esi+1Ch]
test	eax, eax
jle	short loc_100440A
lea	eax, [eax+eax*2+6]
lea	eax, [esi+eax*4]
test	byte ptr [eax+1], 80h
jz	short loc_100440A
mov	ecx, [ebp+arg_4]
push	dword ptr [ecx+4]
push	dword ptr [ecx]
push	eax
call	sub_10021E1
test	eax, eax
jz	short loc_100440A
cmp	dword ptr [esi+18h], 0
jnz	short loc_10043D1
push	0FFFFFFFEh
push	1FFCh
push	6
push	esi
call	dword ptr [esi+4]

loc_10043D1:
push	ebx
push	edi
push	74h
mov	[ebp+arg_0], 2
pop	ebx

loc_10043DD:
mov	eax, hMem
mov	edi, [ebx+eax]
push	0
push	esi
push	10h
push	edi
call	dword ptr [edi+4]
test	eax, eax
jnz	short loc_1004412
inc	[ebp+arg_0]
add	ebx, 4
cmp	ebx, 84h
jl	short loc_10043DD
push	eax
push	eax
push	7
push	esi
call	dword ptr [esi+4]

loc_1004408:
pop	edi
pop	ebx

loc_100440A:
mov	eax, [ebp+var_4]
pop	esi
leave
retn	0Ch

loc_1004412:
push	[ebp+arg_8]
mov	eax, hMem
push	[ebp+arg_0]
push	0Ah
push	eax
call	dword ptr [eax]
mov	ebx, 1FFDh
push	ebx
push	esi
push	0Eh
push	edi
call	dword ptr [edi+4]
test	eax, eax
jz	short loc_1004467
cmp	dword_1007188, 0
jnz	short loc_100444C
mov	eax, [esi+1Ch]
push	ebx
dec	eax
push	eax
push	12h
push	esi
call	dword ptr [esi+4]
test	eax, eax
jz	short loc_1004467

loc_100444C:
mov	eax, hMem
push	esi
push	edi
push	0Eh
push	eax
call	dword ptr [eax]
test	eax, eax
jz	short loc_1004467
mov	[ebp+var_4], 1
xor	esi, esi
jmp	short loc_100446C

loc_1004467:
xor	esi, esi
mov	[ebp+var_4], esi

loc_100446C:
mov	eax, hMem
push	esi
push	esi
push	0Ch
push	eax
call	dword ptr [eax]
test	eax, eax
jz	short loc_1004408
mov	eax, hMem
push	esi
push	esi
push	0Dh
push	eax
call	dword ptr [eax]
jmp	loc_1004408
sub_100438C endp



; Attributes: bp-based frame

; int __stdcall	sub_100448D(HLOCAL data, int, HDC lprcSrc2, int)
sub_100448D proc near

data= dword ptr	 8
arg_4= dword ptr  0Ch
lprcSrc2= dword	ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_4]
cmp	eax, 5
jz	short loc_10044D0
cmp	eax, 0Bh
jz	short loc_10044C0
cmp	eax, 10h
jz	short loc_10044B3
push	[ebp+arg_C]	; int
push	[ebp+lprcSrc2]	; lprcSrc2
push	eax		; int
push	[ebp+data]	; data
call	sub_1003F21
jmp	short loc_10044DE

loc_10044B3:
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1004279
jmp	short loc_10044DE

loc_10044C0:
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_100438C
jmp	short loc_10044DE

loc_10044D0:		; int
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; lprcSrc2
push	[ebp+data]	; data
call	sub_10042EF

loc_10044DE:
pop	ebp
retn	10h
sub_100448D endp




; int __stdcall	sub_10044E2(HLOCAL data, HDC lprcSrc2, int)
sub_10044E2 proc near

data= dword ptr	 4
lprcSrc2= dword	ptr  8
arg_8= dword ptr  0Ch

push	esi
mov	esi, [esp+4+data]
cmp	dword ptr [esi+1Ch], 0
jz	short loc_1004506
cmp	[esp+4+arg_8], 0
jz	short loc_1004506
push	[esp+4+arg_8]	; int
push	[esp+8+lprcSrc2] ; lprcSrc2
push	12h		; int
push	esi		; data
call	sub_1003F21
jmp	short loc_100452D

loc_1004506:
call	sub_10013CE
test	eax, eax
jz	short loc_100452D
push	edi
push	3
push	0
lea	edi, [esi+8]
push	edi
call	sub_10020F2
push	edi
push	esi
call	sub_10032CA
call	sub_1001405
xor	eax, eax
inc	eax
pop	edi

loc_100452D:
pop	esi
retn	0Ch
sub_10044E2 endp




sub_1004531 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	ecx, [esp+arg_4]
mov	edx, [ecx+18h]
cmp	dword ptr [edx+4], 1
mov	eax, [edx]
jz	short loc_1004544
xor	eax, eax
jmp	short locret_1004594

loc_1004544:
lea	eax, [eax+eax*2+9]
push	ebx
xor	ebx, ebx
mov	bx, [ecx+eax*4]
push	esi
mov	esi, [esp+8+arg_0]
mov	ecx, [esi+1Ch]
mov	edx, 1FFFh
mov	eax, ebx
shr	eax, 2
and	eax, edx
test	ecx, ecx
jnz	short loc_1004570
test	eax, eax
setz	cl
mov	eax, ecx
jmp	short loc_1004592

loc_1004570:
lea	ecx, [ecx+ecx*2+6]
movzx	ecx, word ptr [esi+ecx*4]
mov	esi, ecx
shr	esi, 2
and	esi, edx
inc	esi
cmp	eax, esi
jnz	short loc_1004590
xor	cl, bl
test	cl, 3
jnz	short loc_1004590
xor	eax, eax
inc	eax
jmp	short loc_1004592

loc_1004590:
xor	eax, eax

loc_1004592:
pop	esi
pop	ebx

locret_1004594:
retn	8
sub_1004531 endp



; Attributes: bp-based frame

; int __stdcall	sub_1004597(HLOCAL data, int, HDC lprcSrc2, int)
sub_1004597 proc near

data= dword ptr	 8
arg_4= dword ptr  0Ch
lprcSrc2= dword	ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_4]
sub	eax, 10h
jz	short loc_10045BC
dec	eax
dec	eax
jz	short loc_10045AC
pop	ebp
jmp	sub_1003F21

loc_10045AC:		; int
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; lprcSrc2
push	[ebp+data]	; data
call	sub_10044E2
jmp	short loc_10045C7

loc_10045BC:
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1004531

loc_10045C7:
pop	ebp
retn	10h
sub_1004597 endp




sub_10045CB proc near

arg_0= dword ptr  4

push	ebx
push	esi
mov	esi, [esp+8+arg_0]
push	edi
push	34h
xor	edx, edx
lea	eax, [esi+24h]
pop	edi

loc_10045DA:
mov	cx, [eax]
xor	cx, dx
and	cx, 7FFFh
xor	[eax], cx
mov	ebx, [esi+8]
mov	cx, [eax]
mov	[eax+4], ebx
mov	ebx, [esi+0Ch]
and	cx, 7FFFh
mov	[eax+8], ebx
mov	[eax], cx
inc	edx
add	eax, 0Ch
cmp	edx, edi
jl	short loc_10045DA
mov	[esi+1Ch], edi
xor	edi, edi
push	edi
push	edi
push	1Ah
push	esi
call	dword ptr [esi+4]
push	edi
push	edi
push	15h
push	esi
call	dword ptr [esi+4]
pop	edi
xor	eax, eax
pop	esi
inc	eax
pop	ebx
retn	4
sub_10045CB endp



; Attributes: bp-based frame

sub_1004625 proc near

rc= RECT ptr -10h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 10h
push	esi
mov	esi, [ebp+arg_0]
mov	eax, [esi+1Ch]
test	eax, eax
jnz	short loc_1004660
lea	eax, [ebp+rc]
push	eax
add	esi, 8
push	esi
call	sub_1002236
mov	eax, [ebp+arg_4]
push	dword ptr [eax+4]
push	dword ptr [eax]	; pt
lea	eax, [ebp+rc]
push	eax		; lprc
call	ds:PtInRect
neg	eax
sbb	eax, eax
add	eax, 1FFFh
jmp	short loc_10046DA

loc_1004660:
mov	ecx, [ebp+arg_4]
push	dword ptr [ecx+4]
lea	eax, [eax+eax*2+6]
push	dword ptr [ecx]
lea	eax, [esi+eax*4]
push	eax
call	sub_10021E1
test	eax, eax
jnz	short loc_1004680
mov	eax, 1FFFh
jmp	short loc_10046DA

loc_1004680:
push	ebx
push	edi
mov	edi, ds:GetKeyState
push	12h		; nVirtKey
call	edi ; GetKeyState
xor	ebx, ebx
push	11h		; nVirtKey
mov	bx, ax
call	edi ; GetKeyState
push	10h		; nVirtKey
and	ebx, eax
call	edi ; GetKeyState
pop	edi
and	ebx, eax
test	bx, bx
pop	ebx
jge	short loc_10046A9
xor	eax, eax
inc	eax
jmp	short loc_10046B1

loc_10046A9:
mov	eax, hMem
mov	eax, [eax+3Ch]

loc_10046B1:
mov	ecx, [esi+1Ch]
push	0
sub	ecx, eax
push	ecx
call	sub_10023B5
mov	dword_1007194, eax
mov	ecx, [esi+1Ch]
sub	ecx, eax
mov	dword_1007198, ecx
mov	dword ptr [esi+18h], offset dword_1007194
mov	eax, dword_1007194

loc_10046DA:
pop	esi
leave
retn	0Ch
sub_1004625 endp



; Attributes: bp-based frame

; int __stdcall	sub_10046DF(HLOCAL data, HDC lprcSrc2, int)
sub_10046DF proc near

data= dword ptr	 8
lprcSrc2= dword	ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
mov	eax, hMem
push	ebx
xor	ebx, ebx
cmp	[eax+24h], ebx
push	esi
mov	esi, [ebp+data]
jnz	short loc_1004709
mov	eax, [esi+1Ch]
push	0Ah
cdq
pop	ecx
idiv	ecx
cmp	edx, 9
jz	short loc_1004709
xor	eax, eax
inc	eax
jmp	loc_100481D

loc_1004709:
call	sub_10013CE
test	eax, eax
jz	loc_100481D
cmp	[esi+1Ch], ebx
push	edi
jnz	short loc_100475E
cmp	nIDCheckButton,	12Fh
jnz	short loc_100473D
mov	eax, dword_100702C
mov	ecx, hMem
dec	eax
cmp	[ecx+40h], eax
jnz	short loc_100473D
push	6
jmp	short loc_100473F

loc_100473D:
push	7

loc_100473F:
pop	eax
push	eax
push	ebx
lea	edi, [esi+8]
push	edi
call	sub_10020F2
push	edi
push	esi
call	sub_10032CA
mov	[ebp+data], 1
jmp	loc_1004814

loc_100475E:		; int
push	[ebp+arg_8]
push	[ebp+lprcSrc2]	; lprcSrc2
push	12h		; int
push	esi		; data
call	sub_1003F21
mov	[ebp+data], eax
mov	eax, [esi+1Ch]
cmp	[ebp+arg_8], eax
jz	short loc_1004784
cmp	[ebp+arg_8], 1FFDh
jnz	loc_1004814

loc_1004784:
cmp	dword_100718C, ebx
jnz	loc_1004814
mov	edx, dword_1007308
push	color		; color
mov	ebx, ds:SetPixel
lea	eax, [eax+eax*2]
lea	eax, [esi+eax*4]
mov	ecx, [eax+1Ch]
mov	eax, [eax+20h]
lea	edi, [ecx+edx-1]
mov	ecx, nNumber
lea	esi, [eax+ecx-1]
mov	eax, esi
sub	eax, y
push	eax		; y
mov	eax, edi
sub	eax, x
push	eax		; x
push	hDC		; hdc
call	ebx ; SetPixel
push	color		; color
mov	eax, esi
sub	eax, y
push	eax		; y
mov	eax, edi
sub	eax, x
dec	eax
push	eax		; x
push	hDC		; hdc
call	ebx ; SetPixel
push	color		; color
sub	esi, y
sub	edi, x
dec	esi
push	esi		; y
push	edi		; x
push	hDC		; hdc
call	ebx ; SetPixel

loc_1004814:
call	sub_1001405
mov	eax, [ebp+data]
pop	edi

loc_100481D:
pop	esi
pop	ebx
pop	ebp
retn	0Ch
sub_10046DF endp



; Attributes: bp-based frame

; int __stdcall	sub_1004823(HLOCAL data, int, HDC lprcSrc2, int)
sub_1004823 proc near

data= dword ptr	 8
arg_4= dword ptr  0Ch
lprcSrc2= dword	ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	ecx, [ebp+arg_4]
cmp	ecx, 12h
jg	short loc_1004873
jz	short loc_1004863
mov	eax, ecx
dec	eax
jz	short loc_1004859
sub	eax, 4
jz	short loc_1004849
sub	eax, 0Bh
jz	short loc_10048AC
dec	eax
jnz	short loc_1004886
mov	eax, 1FFFh
jmp	short loc_10048AE

loc_1004849:
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_1004625
jmp	short loc_10048AE

loc_1004859:
push	[ebp+data]
call	sub_10045CB
jmp	short loc_10048AE

loc_1004863:		; int
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; lprcSrc2
push	[ebp+data]	; data
call	sub_10046DF
jmp	short loc_10048AE

loc_1004873:
mov	eax, ecx
sub	eax, 14h
jz	short loc_10048AC
sub	eax, 4
jz	short loc_10048B2
dec	eax
jz	short loc_100489C
dec	eax
dec	eax
jz	short loc_1004897

loc_1004886:		; int
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; lprcSrc2
push	ecx		; int
push	[ebp+data]	; data
call	sub_1003F21
jmp	short loc_10048AE

loc_1004897:
xor	eax, eax
inc	eax
jmp	short loc_10048AE

loc_100489C:
mov	eax, [ebp+data]
mov	eax, [eax+1Ch]
test	eax, eax
jz	short loc_1004897
dec	eax
cmp	[ebp+lprcSrc2],	eax
jz	short loc_1004897

loc_10048AC:
xor	eax, eax

loc_10048AE:
pop	ebp
retn	10h

loc_10048B2:
xor	eax, eax
cmp	[ebp+lprcSrc2],	eax
setz	al
jmp	short loc_10048AE
sub_1004823 endp




; int __stdcall	sub_10048BC(HLOCAL data, HDC lprcSrc2, int)
sub_10048BC proc near

data= dword ptr	 4
lprcSrc2= dword	ptr  8
arg_8= dword ptr  0Ch

push	[esp+arg_8]	; int
push	[esp+4+lprcSrc2] ; lprcSrc2
push	0Ch		; int
push	[esp+0Ch+data]	; data
call	sub_1003F21
retn	0Ch
sub_10048BC endp




; int __stdcall	sub_10048D2(HLOCAL data, HDC lprcSrc2, int)
sub_10048D2 proc near

data= dword ptr	 4
lprcSrc2= dword	ptr  8
arg_8= dword ptr  0Ch

push	esi
mov	esi, [esp+4+data]
mov	eax, [esi+1Ch]
push	1
sub	eax, 3
push	eax
push	0
call	sub_10023B5
push	eax
push	15h
push	esi
call	dword ptr [esi+4]
push	[esp+4+arg_8]	; int
mov	dword_1007190, 1
push	[esp+8+lprcSrc2] ; lprcSrc2
push	0Eh		; int
push	esi		; data
call	sub_1003F21
and	dword_1007190, 0
pop	esi
retn	0Ch
sub_10048D2 endp




; int __stdcall	sub_1004913(HLOCAL data, HDC lprcSrc2, int)
sub_1004913 proc near

data= dword ptr	 4
lprcSrc2= dword	ptr  8

push	esi
mov	esi, [esp+4+data]
mov	eax, [esi+1Ch]
dec	eax
push	eax
push	0
call	sub_10023B5
push	eax		; int
push	[esp+8+lprcSrc2] ; lprcSrc2
push	5		; int
push	esi		; data
call	sub_1003F21
pop	esi
retn	0Ch
sub_1004913 endp



; Attributes: bp-based frame

; int __stdcall	sub_1004935(HLOCAL data, HDC lprcSrc2, int)
sub_1004935 proc near

data= dword ptr	 8
lprcSrc2= dword	ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ebx
push	[ebp+arg_8]	; int
mov	ebx, [ebp+data]
push	[ebp+lprcSrc2]	; lprcSrc2
push	12h		; int
push	ebx		; data
call	sub_1003F21
test	eax, eax
jz	short loc_10049B6
call	sub_10013CE
test	eax, eax
jz	short loc_10049B1
mov	eax, [ebx]
push	esi
mov	esi, [ebx+1Ch]
dec	esi
mov	[ebp+arg_8], eax
js	short loc_10049AB
lea	eax, [esi+esi*2]
push	edi
lea	edi, [ebx+eax*4+28h]
jmp	short loc_1004970

loc_100496D:
mov	ebx, [ebp+data]

loc_1004970:
mov	eax, [ebx+1Ch]
dec	eax
dec	eax
cmp	esi, eax
jl	short loc_10049AA
mov	ebx, [edi]
mov	ecx, [edi+4]
mov	eax, dword_1007308
push	ecx
lea	edx, [eax+ebx]
push	edx
mov	edx, [ebp+arg_8]
mov	edx, [edx+10h]
lea	edx, [edx+edx*2]
sub	ecx, edx
push	ecx
mov	ecx, [ebp+arg_8]
sub	eax, [ecx+0Ch]
add	eax, ebx
push	eax
call	sub_1002131
dec	esi
sub	edi, 0Ch
test	esi, esi
jge	short loc_100496D

loc_10049AA:
pop	edi

loc_10049AB:
call	sub_1001405
pop	esi

loc_10049B1:
xor	eax, eax
inc	eax
jmp	short loc_10049B8

loc_10049B6:
xor	eax, eax

loc_10049B8:
pop	ebx
pop	ebp
retn	0Ch
sub_1004935 endp



; Attributes: bp-based frame

; int __stdcall	sub_10049BD(HLOCAL data, int, HDC lprcSrc2, int)
sub_10049BD proc near

data= dword ptr	 8
arg_4= dword ptr  0Ch
lprcSrc2= dword	ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	ecx, [ebp+arg_4]
cmp	ecx, 11h
jg	short loc_1004A27
jz	short loc_1004A20
mov	eax, ecx
sub	eax, 5
jz	short loc_1004A10
sub	eax, 6
jz	short loc_1004A00
dec	eax
jz	short loc_10049F0
dec	eax
dec	eax
jnz	short loc_1004A36
push	[ebp+arg_C]	; int
push	[ebp+lprcSrc2]	; lprcSrc2
push	[ebp+data]	; data
call	sub_10048D2
jmp	loc_1004A78

loc_10049F0:		; int
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; lprcSrc2
push	[ebp+data]	; data
call	sub_10048BC
jmp	short loc_1004A78

loc_1004A00:
push	[ebp+arg_C]
push	[ebp+lprcSrc2]
push	[ebp+data]
call	sub_100438C
jmp	short loc_1004A78

loc_1004A10:		; int
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; lprcSrc2
push	[ebp+data]	; data
call	sub_1004913
jmp	short loc_1004A78

loc_1004A20:
mov	eax, 1FFFh
jmp	short loc_1004A78

loc_1004A27:
mov	eax, ecx
sub	eax, 12h
jz	short loc_1004A6A
sub	eax, 6
jz	short loc_1004A60
dec	eax
jz	short loc_1004A47

loc_1004A36:		; int
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; lprcSrc2
push	ecx		; int
push	[ebp+data]	; data
call	sub_1003F21
jmp	short loc_1004A78

loc_1004A47:
mov	eax, [ebp+data]
mov	eax, [eax+1Ch]
test	eax, eax
jz	short loc_1004A5B
dec	eax
cmp	[ebp+lprcSrc2],	eax
jz	short loc_1004A5B
xor	eax, eax
jmp	short loc_1004A78

loc_1004A5B:
xor	eax, eax
inc	eax
jmp	short loc_1004A78

loc_1004A60:
xor	eax, eax
cmp	[ebp+lprcSrc2],	eax
setz	al
jmp	short loc_1004A78

loc_1004A6A:		; int
push	[ebp+arg_C]
push	[ebp+lprcSrc2]	; lprcSrc2
push	[ebp+data]	; data
call	sub_1004935

loc_1004A78:
pop	ebp
retn	10h
sub_10049BD endp



; Attributes: bp-based frame

sub_1004A7C proc near

var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 0Ch
call	sub_10013CE
test	eax, eax
jnz	short loc_1004A97
call	sub_10023E2
xor	eax, eax
jmp	locret_1004BD9

loc_1004A97:
push	ebx
push	esi
push	edi
call	sub_10021AA
mov	esi, [ebp+arg_0]
xor	ebx, ebx
cmp	[esi+64h], ebx
mov	[ebp+var_4], ebx
jle	short loc_1004AC7
lea	edi, [esi+6Ch]

loc_1004AAF:
mov	eax, [edi]
push	ebx
push	ebx
push	3
push	eax
call	dword ptr [eax+4]
inc	[ebp+var_4]
mov	eax, [ebp+var_4]
add	edi, 4
cmp	eax, [esi+64h]
jl	short loc_1004AAF

loc_1004AC7:
mov	edi, [esi+6Ch]
push	ebx
push	ebx
push	1
push	edi
call	dword ptr [edi+4]
push	ebx
push	ebx
push	0Bh
push	esi
call	dword ptr [esi]
cmp	nIDCheckButton,	12Fh
jnz	short loc_1004AF6
cmp	dword_1007184, ebx
jz	short loc_1004AF6
cmp	[ebp+arg_4], ebx
jnz	short loc_1004AF6
xor	eax, eax
jmp	short loc_1004AF9

loc_1004AF6:
xor	eax, eax
inc	eax

loc_1004AF9:
push	ebx
push	eax
push	ebx
push	esi
call	dword ptr [esi]
push	1FFFh
call	sub_1005E8E
push	ebx
push	6
push	0Fh
push	esi
mov	dword ptr [esi+24h], 1
call	dword ptr [esi]
mov	ebx, 1FFDh
push	ebx
push	0
push	12h
push	edi
call	dword ptr [edi+4]
and	dword ptr [esi+24h], 0
lea	eax, [esi+74h]
mov	[ebp+arg_0], eax
mov	[ebp+arg_4], 4

loc_1004B37:
mov	eax, [ebp+arg_0]
mov	eax, [eax]
push	ebx
push	0
push	12h
push	eax
call	dword ptr [eax+4]
add	[ebp+arg_0], 4
dec	[ebp+arg_4]
jnz	short loc_1004B37
and	[ebp+arg_0], 0
lea	eax, [esi+84h]
mov	[ebp+var_8], eax

loc_1004B5B:
mov	eax, [ebp+arg_0]
cmp	eax, 7
mov	[ebp+var_4], eax
jge	short loc_1004BB4
mov	eax, [ebp+var_8]
mov	[ebp+arg_4], eax

loc_1004B6C:
push	0
push	1FFCh
push	6
push	edi
call	dword ptr [edi+4]
mov	[ebp+var_C], eax
mov	eax, [ebp+arg_0]
cmp	[ebp+var_4], eax
jnz	short loc_1004B8E
push	0
push	1
push	8
push	edi
call	dword ptr [edi+4]

loc_1004B8E:
mov	eax, [ebp+arg_4]
mov	eax, [eax]
push	ebx
push	edi
push	0Eh
push	eax
call	dword ptr [eax+4]
mov	eax, [ebp+var_C]
push	ebx
dec	eax
push	eax
push	12h
push	edi
call	dword ptr [edi+4]
inc	[ebp+var_4]
add	[ebp+arg_4], 4
cmp	[ebp+var_4], 7
jl	short loc_1004B6C

loc_1004BB4:
inc	[ebp+arg_0]
add	[ebp+var_8], 4
cmp	[ebp+arg_0], 7
jl	short loc_1004B5B
push	0
push	esi
call	sub_1002D93
xor	edi, edi
inc	edi
mov	[esi+24h], edi
call	sub_1001405
mov	eax, edi
pop	edi
pop	esi
pop	ebx

locret_1004BD9:
leave
retn	8
sub_1004A7C endp




; int __stdcall	sub_1004BDD(HLOCAL hMem, int)
sub_1004BDD proc near

hMem= dword ptr	 4
arg_4= dword ptr  8

push	ebx
push	ebp
push	esi
mov	esi, [esp+0Ch+hMem]
cmp	dword ptr [esi+58h], 0FFFFFFFFh
push	edi
jnz	loc_1004CB7
cmp	dword ptr [esi+24h], 0
jz	loc_1004CB7
mov	eax, [esi+6Ch]
push	0
push	[esp+14h+arg_4]
push	5
push	eax
call	dword ptr [eax+4]
mov	ebp, 1FFFh
cmp	eax, ebp
jz	loc_1004D0E
cmp	eax, 1FFEh
mov	edi, [esi+6Ch]
mov	ebx, [esi+70h]
mov	dword ptr [esi+28h], 1
push	0
jnz	loc_1004CC0
push	0
push	4
push	ebx
call	dword ptr [ebx+4]
test	eax, eax
jz	short loc_1004CB7
cmp	nIDCheckButton,	12Fh
jnz	short loc_1004C52
mov	eax, dword_100702C
dec	eax
cmp	[esi+40h], eax
jz	short loc_1004CB7

loc_1004C52:
inc	dword ptr [esi+40h]
xor	eax, eax
push	0
inc	eax
push	eax
push	0Ah
push	esi
mov	[esi+8], eax
call	dword ptr [esi]
test	eax, eax
jz	short loc_1004CB5
push	0FFFFFFFEh
push	0
push	6
push	ebx
call	dword ptr [ebx+4]
cmp	eax, ebp
jz	short loc_1004CB5
xor	ebp, ebp
push	ebp
push	ebp
push	8
push	ebx
call	dword ptr [ebx+4]
test	eax, eax
jz	short loc_1004CB7
push	ebp
push	ebp
push	9
push	ebx
call	dword ptr [ebx+4]
test	eax, eax
jz	short loc_1004CB7
push	ebx
push	edi
push	0Eh
push	esi
call	dword ptr [esi]
test	eax, eax
jz	short loc_1004CB7
mov	esi, 1FFDh
push	esi
push	ebx
push	0Eh
push	edi
call	dword ptr [edi+4]
test	eax, eax
jz	short loc_1004CB7
push	esi
push	ebp
push	12h
push	ebx
call	dword ptr [ebx+4]
jmp	short loc_1004D05

loc_1004CB5:
xor	ebp, ebp

loc_1004CB7:
xor	eax, eax

loc_1004CB9:
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	8

loc_1004CC0:
mov	eax, [edi+18h]
mov	ebp, [eax]
push	1
push	0Ah
push	esi
dec	ebp
call	dword ptr [esi]
test	eax, eax
jz	short loc_1004CB7
xor	esi, esi
push	esi
push	1
push	8
push	edi
call	dword ptr [edi+4]
test	eax, eax
jz	short loc_1004CB7
push	esi
push	esi
push	9
push	edi
call	dword ptr [edi+4]
test	eax, eax
jz	short loc_1004CB7
mov	esi, 1FFDh
push	esi
push	edi
push	0Eh
push	ebx
call	dword ptr [ebx+4]
test	eax, eax
jz	short loc_1004CB7
push	esi
push	ebp
push	12h
push	edi
call	dword ptr [edi+4]

loc_1004D05:
test	eax, eax
jz	short loc_1004CB7
xor	eax, eax
inc	eax
jmp	short loc_1004CB9

loc_1004D0E:		; int
push	1
push	[esp+14h+arg_4]	; int
push	3		; int
push	esi		; hMem
call	sub_10030F9
jmp	short loc_1004CB9
sub_1004BDD endp




sub_1004D1E proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
push	2
pop	ecx
add	eax, 74h

loc_1004D28:
mov	edx, [eax]
cmp	dword ptr [edx+1Ch], 0Dh
jnz	short loc_1004D3F
inc	ecx
add	eax, 4
cmp	ecx, 6
jl	short loc_1004D28
xor	eax, eax
inc	eax

locret_1004D3C:
retn	4

loc_1004D3F:
xor	eax, eax
jmp	short locret_1004D3C
sub_1004D1E endp



; Attributes: bp-based frame

sub_1004D43 proc near

Msg= tagMSG ptr	-1Ch

push	ebp
mov	ebp, esp
sub	esp, 1Ch
push	edi
push	4FFh		; dwWakeMask
push	5		; dwMilliseconds
xor	edi, edi
push	edi		; fWaitAll
push	edi		; pHandles
push	edi		; nCount
call	ds:MsgWaitForMultipleObjects
test	eax, eax
jz	short loc_1004D67
xor	eax, eax
jmp	loc_1004DE8

loc_1004D67:
push	esi
mov	esi, ds:PeekMessageW
push	edi		; wRemoveMsg
push	edi		; wMsgFilterMax
push	edi		; wMsgFilterMin
push	hWnd		; hWnd
lea	eax, [ebp+Msg]
push	eax		; lpMsg
call	esi ; PeekMessageW
test	eax, eax
jz	short loc_1004DE5
mov	ecx, [ebp+Msg.message]
mov	eax, 104h
cmp	ecx, eax
ja	short loc_1004DA7
jz	short loc_1004DEB
mov	eax, ecx
sub	eax, 0A1h
jz	short loc_1004DEB
sub	eax, 3
jz	short loc_1004DEB
sub	eax, 3
jz	short loc_1004DEB
sub	eax, 59h
jmp	short loc_1004DBF

loc_1004DA7:
mov	eax, ecx
sub	eax, 11Fh
jz	short loc_1004DEB
sub	eax, 0E2h
jz	short loc_1004DEB
sub	eax, 3
jz	short loc_1004DEB
sub	eax, 3

loc_1004DBF:
jz	short loc_1004DEB
push	1		; wRemoveMsg
push	edi		; wMsgFilterMax
push	edi		; wMsgFilterMin
push	hWnd		; hWnd
lea	eax, [ebp+Msg]
push	eax		; lpMsg
call	esi ; PeekMessageW
lea	eax, [ebp+Msg]
push	eax		; lpMsg
call	ds:TranslateMessage
lea	eax, [ebp+Msg]
push	eax		; lpMsg
call	ds:DispatchMessageW

loc_1004DE5:
xor	eax, eax

loc_1004DE7:
pop	esi

loc_1004DE8:
pop	edi
leave
retn

loc_1004DEB:
xor	eax, eax
inc	eax
jmp	short loc_1004DE7
sub_1004D43 endp



; Attributes: bp-based frame fpd=74h

; int __stdcall	sub_1004DF0(HLOCAL hMem)
sub_1004DF0 proc near

String=	word ptr -0D8h
Rect= tagRECT ptr -30h
var_20=	dword ptr -20h
var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
hMem= dword ptr	 8

push	ebp
lea	ebp, [esp-74h]
sub	esp, 0D8h
mov	eax, hMem
push	ebx
push	esi
push	edi
xor	edi, edi
push	edi
push	7
xor	esi, esi
push	0Fh
inc	esi
push	eax
mov	dword_10071CC, esi
call	dword ptr [eax]
mov	ebx, [ebp+74h+hMem]
mov	[ebx+4], edi
mov	[ebx+24h], edi
mov	[ebx+2Ch], esi
cmp	nIDCheckButton,	12Eh
mov	[ebp+74h+var_4], eax
jnz	short loc_1004E64
push	54h		; cchBufferMax
push	6Bh		; __int16
lea	eax, [ebp+74h+String]
push	eax		; lpBuffer
call	sub_10023F8
push	[ebp+74h+var_4]
mov	esi, eax
lea	edi, [ebp+esi*2+74h+String]
push	edi
call	sub_100232B
lea	ecx, [edi+eax*2]
mov	word ptr [ecx],	20h
inc	ecx
inc	ecx
mov	word ptr [ecx],	20h
inc	ecx
inc	ecx
lea	eax, [esi+eax+2]
jmp	short loc_1004E69

loc_1004E64:
lea	ecx, [ebp+74h+String]
xor	eax, eax

loc_1004E69:
cmp	eax, 54h
jnb	short loc_1004E7C
push	54h
pop	edx
sub	edx, eax
push	edx		; cchBufferMax
push	6Ah		; __int16
push	ecx		; lpBuffer
call	sub_10023F8

loc_1004E7C:
lea	eax, [ebp+74h+String]
push	eax		; lpString
call	sub_1005DED
call	sub_10013CE
test	eax, eax
jz	loc_1004F8C
lea	eax, [ebp+74h+Rect]
push	eax		; lpRect
push	hWnd		; hWnd
call	ds:GetClientRect
mov	eax, [ebp+74h+Rect.right]
mov	[ebp+74h+var_18], eax
mov	eax, [ebp+74h+Rect.bottom]
sub	eax, nNumber
mov	[ebp+74h+hMem],	0B4h
mov	[ebp+74h+var_14], eax

loc_1004EBB:
lea	eax, [ebx+74h]
mov	[ebp+74h+var_4], 2
mov	[ebp+74h+var_10], eax

loc_1004EC8:
mov	esi, ds:rand
call	esi ; rand
cdq
push	6Eh
pop	ecx
idiv	ecx
mov	eax, edx
sub	eax, 41h
mov	[ebp+74h+var_20], eax
cdq
xor	eax, edx
sub	eax, edx
cmp	eax, 0Fh
jge	short loc_1004EEF
mov	[ebp+74h+var_20], 0FFFFFFECh

loc_1004EEF:
call	esi ; rand
cdq
push	6Eh
pop	ecx
idiv	ecx
mov	eax, [ebp+74h+var_10]
mov	esi, [eax]
mov	edi, edx
sub	edi, 4Bh
add	esi, [ebp+74h+hMem]
mov	eax, [esi+4]
mov	[ebp+74h+var_C], eax
mov	ecx, [esi+8]
mov	[ebp+74h+var_8], ecx
jmp	short loc_1004F5C

loc_1004F12:
cmp	eax, [ebp+74h+var_18]
jge	short loc_1004F68
lea	eax, [ebp+74h+var_C]
push	eax
push	esi
call	sub_1002082
mov	eax, [ebp+74h+var_20]
cdq
push	0Ah
pop	ecx
idiv	ecx
add	[ebp+74h+var_C], eax
mov	eax, edi
cdq
idiv	ecx
add	edi, 3
add	[ebp+74h+var_8], eax
mov	eax, [ebp+74h+var_8]
cmp	eax, [ebp+74h+var_14]
jle	short loc_1004F50
test	edi, edi
jle	short loc_1004F50
mov	eax, edi
neg	eax
shl	eax, 3
cdq
idiv	ecx
mov	edi, eax

loc_1004F50:
call	sub_1004D43
test	eax, eax
jnz	short loc_1004F87
mov	eax, [ebp+74h+var_C]

loc_1004F5C:
mov	ecx, dword_1007308
neg	ecx
cmp	eax, ecx
jg	short loc_1004F12

loc_1004F68:
inc	[ebp+74h+var_4]
add	[ebp+74h+var_10], 4
cmp	[ebp+74h+var_4], 6
jl	loc_1004EC8
sub	[ebp+74h+hMem],	0Ch
cmp	[ebp+74h+hMem],	24h
jge	loc_1004EBB

loc_1004F87:
call	sub_1001405

loc_1004F8C:
push	1FFFh
call	sub_1005E8E
call	sub_10021AA
xor	eax, eax
push	eax		; int
push	eax		; int
push	0Dh		; int
push	ebx		; hMem
mov	dword_10071CC, eax
call	sub_10030F9
pop	edi
pop	esi
pop	ebx
add	ebp, 74h
leave
retn	4
sub_1004DF0 endp



; Attributes: bp-based frame

sub_1004FB6 proc near

var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ecx
push	ebx
push	esi
push	edi
mov	edi, [ebp+arg_0]
xor	ebx, ebx
cmp	[edi+64h], ebx
jle	short loc_1004FE0
lea	esi, [edi+6Ch]

loc_1004FCB:
mov	eax, [esi]
push	0
push	0
push	3
push	eax
call	dword ptr [eax+4]
inc	ebx
add	esi, 4
cmp	ebx, [edi+64h]
jl	short loc_1004FCB

loc_1004FE0:
mov	[ebp+var_4], 2
lea	esi, [edi+74h]

loc_1004FEA:
and	[ebp+var_8], 0
mov	[ebp+arg_0], 24h

loc_1004FF5:
mov	ecx, [esi]
mov	ebx, [ebp+var_8]
mov	edx, [ebp+var_4]
mov	eax, [ebp+arg_0]
add	[ebp+arg_0], 0Ch
add	eax, ecx
add	edx, 0FFFFFFFEh
shl	ebx, 2
or	edx, ebx
xor	dx, [eax]
and	dx, 7FFFh
xor	[eax], dx
mov	ebx, [ecx+8]
mov	dx, [eax]
or	dx, 8000h
inc	[ebp+var_8]
cmp	[ebp+arg_0], 0C0h
mov	[eax+4], ebx
mov	ecx, [ecx+0Ch]
mov	[eax+8], ecx
mov	[eax], dx
jl	short loc_1004FF5
mov	ecx, [esi]
inc	[ebp+var_4]
push	0Dh
pop	eax
add	esi, 4
cmp	[ebp+var_4], 6
mov	[ecx+1Ch], eax
jl	short loc_1004FEA
push	0
push	0
push	eax
push	edi
call	dword ptr [edi]
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_1004FB6 endp




sub_100505F proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

cmp	nIDCheckButton,	130h
jz	short loc_10050B9
mov	eax, [esp+arg_8]
mov	eax, [eax]
mov	ecx, [eax]
mov	eax, [esp+arg_4]
mov	eax, [eax]
mov	eax, [eax]
or	edx, 0FFFFFFFFh
dec	eax
jz	short loc_10050A5
push	2
pop	edx
sub	eax, edx
jz	short loc_100509B
dec	eax
jnz	short loc_10050B9
sub	ecx, edx
jz	short loc_1005097
dec	ecx
jnz	short loc_10050B9
push	5

loc_1005094:
pop	edx
jmp	short loc_10050AD

loc_1005097:
push	3
jmp	short loc_1005094

loc_100509B:
sub	ecx, edx
jz	short loc_10050AD
sub	ecx, edx
jnz	short loc_10050B9
jmp	short loc_10050AD

loc_10050A5:
cmp	ecx, 2
jnz	short loc_10050AD
xor	edx, edx
inc	edx

loc_10050AD:
mov	eax, [esp+arg_0]
push	0
push	edx
push	0Fh
push	eax
call	dword ptr [eax]

loc_10050B9:
xor	eax, eax
inc	eax
retn	0Ch
sub_100505F endp



; Attributes: bp-based frame

; int __stdcall	sub_10050BF(HLOCAL hMem, int, int)
sub_10050BF proc near

hMem= dword ptr	 8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	esi
mov	esi, [ebp+arg_4]
test	esi, esi
jge	short loc_10050DD
push	[ebp+arg_8]	; int
push	esi		; int
push	0Fh		; int
push	[ebp+hMem]	; hMem
call	sub_10030F9
jmp	loc_1005184

loc_10050DD:
push	ebx
mov	ebx, [ebp+hMem]
push	edi
mov	edi, nIDCheckButton
mov	eax, edi
sub	eax, 12Eh
jz	short loc_1005103
dec	eax
jz	short loc_10050FC
xor	eax, eax
inc	eax
jmp	loc_1005182

loc_10050FC:
mov	edx, offset unk_1007054
jmp	short loc_100515F

loc_1005103:
cmp	esi, 7
mov	edx, offset unk_1007034
jnz	short loc_1005137
cmp	dword_1007024, 0
jz	short loc_100515F
mov	ebx, [ebp+hMem]
mov	ecx, [ebx+34h]
cmp	ecx, 78h
jl	short loc_1005133
mov	eax, 4E20h
sar	ecx, 2
cdq
idiv	ecx
mov	esi, eax
imul	esi, 23h
jmp	short loc_1005162

loc_1005133:
xor	esi, esi
jmp	short loc_1005162

loc_1005137:
xor	eax, eax
inc	eax
cmp	esi, eax
jnz	short loc_100515F
mov	ecx, dword_100702C
cmp	ecx, eax
jnz	short loc_1005155
mov	ebx, [ebp+hMem]
cmp	[ebx+40h], eax
jl	short loc_1005182
push	0FFFFFF9Ch
pop	esi
jmp	short loc_1005162

loc_1005155:
cmp	ecx, 3
jnz	short loc_1005182
cmp	[ebx+40h], ecx
jle	short loc_1005182

loc_100515F:
mov	esi, [edx+esi*4]

loc_1005162:
xor	eax, eax
cmp	edi, 12Fh
setz	al
push	esi		; int
add	eax, 0FFFFFFFCh
push	eax		; int
push	0Fh		; int
push	ebx		; hMem
call	sub_10030F9
cmp	[ebp+arg_4], 7
jnz	short loc_1005182
mov	eax, esi

loc_1005182:
pop	edi
pop	ebx

loc_1005184:
pop	esi
pop	ebp
retn	0Ch
sub_10050BF endp




sub_1005189 proc near

arg_0= dword ptr  4

push	esi
push	edi
xor	edi, edi
cmp	dword_1007024, edi
jz	short loc_10051E6
mov	esi, [esp+8+arg_0]
cmp	[esi+24h], edi
jz	short loc_10051E6
cmp	[esi+28h], edi
jz	short loc_10051E6
cmp	dword_100716C, edi
jnz	short loc_10051E6
mov	eax, [esi+34h]
push	7FFEh
inc	eax
push	eax
call	sub_10023A4
cmp	dword ptr [esi+58h], 0FFFFFFFFh
mov	[esi+34h], eax
jnz	short loc_10051CE
mov	ecx, [esi+6Ch]
push	edi
push	eax
push	1Bh
push	ecx
call	dword ptr [ecx+4]

loc_10051CE:
mov	ecx, [esi+38h]
cmp	ecx, edi
jz	short loc_10051ED
mov	eax, [esi+34h]
cdq
idiv	ecx
test	edx, edx
jnz	short loc_10051ED
push	edi
push	edi
push	0Fh
push	esi
call	dword ptr [esi]

loc_10051E6:
xor	eax, eax

loc_10051E8:
pop	edi
pop	esi
retn	0Ch

loc_10051ED:
mov	eax, [esi+34h]
and	eax, 3
not	eax
test	eax, eax
jz	short loc_10051FE
call	sub_1005D51

loc_10051FE:
xor	eax, eax
inc	eax
jmp	short loc_10051E8
sub_1005189 endp



; Attributes: bp-based frame fpd=70h

; int __stdcall	sub_1005203(int	c, LPRECT color)
sub_1005203 proc near

Buffer=	word ptr -0C0h
var_BE=	byte ptr -0BEh
h= dword ptr -20h
ho= dword ptr -1Ch
psizl= tagSIZE ptr -18h
rc= tagRECT ptr	-10h
c= dword ptr  8
color= dword ptr  0Ch

push	ebp
lea	ebp, [esp-70h]
sub	esp, 0C0h
push	ebx
push	esi
push	edi
push	offset pszFaceName ; "MS Shell Dlg"
xor	esi, esi
push	esi		; iPitchAndFamily
push	esi		; iQuality
push	esi		; iClipPrecision
push	esi		; iOutPrecision
push	1		; iCharSet
push	esi		; bStrikeOut
push	esi		; bUnderline
push	esi		; bItalic
push	2BCh		; cWeight
push	esi		; cOrientation
push	esi		; cEscapement
push	esi		; cWidth
push	48h		; nDenominator
push	5Ah		; index
push	hDC		; hdc
call	ds:GetDeviceCaps
push	eax		; nNumerator
push	9		; nNumber
call	ds:MulDiv
neg	eax
push	eax		; cHeight
call	ds:CreateFontW
push	eax		; h
push	hDC		; hdc
mov	[ebp+70h+ho], eax
call	ds:SelectObject
cmp	dword_1007024, esi
mov	[ebp+70h+h], eax
lea	ebx, [ebp+70h+Buffer]
jz	short loc_10052B6
push	50h		; cchBufferMax
push	66h		; __int16
lea	eax, [ebp+70h+Buffer]
push	eax		; lpBuffer
call	sub_10023F8
lea	edi, [ebp+eax*2+70h+Buffer]
mov	eax, [ebp+70h+c]
mov	eax, [eax+34h]
sar	eax, 2
push	eax
push	edi
call	sub_100232B
lea	ebx, [edi+eax*2]
lea	eax, [ebp+70h+Buffer]
cmp	ebx, eax
jz	short loc_10052B6
push	122h		; format
push	[ebp+70h+color]	; lprc
lea	ecx, [ebp+70h+Buffer]
mov	eax, ebx
sub	eax, ecx
sar	eax, 1
push	eax		; cchText
lea	eax, [ebp+70h+Buffer]
push	eax		; lpchText
push	hDC		; hdc
call	ds:DrawTextW

loc_10052B6:
cmp	nIDCheckButton,	130h
jz	loc_1005478
mov	esi, [ebp+70h+color]
lea	edi, [ebp+70h+rc]
movsd
lea	eax, [ebp+70h+psizl]
push	eax		; psizl
lea	eax, [ebp+70h+Buffer]
sub	ebx, eax
movsd
sar	ebx, 1
push	ebx		; c
mov	ebx, ds:GetTextExtentPoint32W
lea	eax, [ebp+70h+Buffer]
movsd
push	eax		; lpString
push	hDC		; hdc
movsd
call	ebx ; GetTextExtentPoint32W
mov	eax, [ebp+70h+psizl._cx]
sub	[ebp+70h+rc.right], eax
mov	edi, [ebp+70h+c]
xor	eax, eax
cmp	[edi+30h], eax
lea	esi, [ebp+70h+Buffer]
setl	al
test	eax, eax
mov	[ebp+70h+color], eax
jz	short loc_1005312
mov	[ebp+70h+Buffer], 2Dh
lea	esi, [ebp+70h+var_BE]

loc_1005312:
cmp	nIDCheckButton,	12Fh
jnz	short loc_1005344
test	byte ptr dword_1007340,	1
jnz	short loc_1005344
push	esi
push	offset unk_1007370
call	sub_100230E
cmp	dword_1007340, 2
mov	esi, eax
jnz	short loc_1005344
mov	word ptr [esi],	20h
inc	esi
inc	esi

loc_1005344:
cmp	[ebp+70h+color], 0
mov	eax, [edi+30h]
jz	short loc_100534F
neg	eax

loc_100534F:
push	eax
push	esi
call	sub_100232B
cmp	nIDCheckButton,	12Fh
lea	esi, [esi+eax*2]
jnz	short loc_1005387
mov	eax, dword_1007340
test	al, 1
jz	short loc_1005387
cmp	eax, 3
jnz	short loc_100537A
mov	word ptr [esi],	20h
inc	esi
inc	esi

loc_100537A:
push	esi
push	offset unk_1007370
call	sub_100230E
mov	esi, eax

loc_1005387:
mov	word ptr [esi],	20h
inc	esi
xor	eax, eax
inc	esi
cmp	dword_1007168, eax
jnz	short loc_10053A2
cmp	[ebp+70h+color], eax
jz	short loc_10053A2
mov	eax, 0FFh

loc_10053A2:
mov	edi, ds:SetTextColor
push	eax		; color
push	hDC		; hdc
call	edi ; SetTextColor
mov	[ebp+70h+color], eax
lea	eax, [ebp+70h+Buffer]
sub	esi, eax
push	122h		; format
lea	eax, [ebp+70h+rc]
push	eax		; lprc
sar	esi, 1
push	esi		; cchText
lea	eax, [ebp+70h+Buffer]
push	eax		; lpchText
push	hDC		; hdc
mov	[ebp+70h+c], esi
mov	esi, ds:DrawTextW
call	esi ; DrawTextW
push	[ebp+70h+color]	; color
push	hDC		; hdc
call	edi ; SetTextColor
lea	eax, [ebp+70h+psizl]
push	eax		; psizl
push	[ebp+70h+c]	; c
lea	eax, [ebp+70h+Buffer]
push	eax		; lpString
push	hDC		; hdc
call	ebx ; GetTextExtentPoint32W
mov	eax, [ebp+70h+psizl._cx]
sub	[ebp+70h+rc.right], eax
lea	eax, [ebp+70h+Buffer]
push	eax
push	offset Buffer
call	sub_100230E
lea	ecx, [ebp+70h+Buffer]
sub	eax, ecx
mov	edi, eax
push	122h		; format
lea	eax, [ebp+70h+rc]
push	eax		; lprc
sar	edi, 1
push	edi		; cchText
lea	eax, [ebp+70h+Buffer]
push	eax		; lpchText
push	hDC		; hdc
call	esi ; DrawTextW
lea	eax, [ebp+70h+psizl]
push	eax		; psizl
push	edi		; c
lea	eax, [ebp+70h+Buffer]
push	eax		; lpString
push	hDC		; hdc
call	ebx ; GetTextExtentPoint32W
mov	eax, [ebp+70h+rc.right]
sub	eax, [ebp+70h+psizl._cx]
mov	ecx, dword_1007310
shl	ecx, 2
mov	edx, ecx
mov	ecx, eax
sub	ecx, edx
mov	edx, [ebp+70h+rc.bottom]
sub	edx, [ebp+70h+rc.top]
push	0F00021h	; rop
push	edx		; h
mov	[ebp+70h+rc.right], eax
sub	eax, ecx
push	eax		; w
push	[ebp+70h+rc.top] ; y
mov	[ebp+70h+rc.left], ecx
push	ecx		; x
push	hDC		; hdc
call	ds:PatBlt
xor	esi, esi

loc_1005478:		; h
push	[ebp+70h+h]
push	hDC		; hdc
call	ds:SelectObject
cmp	[ebp+70h+ho], esi
pop	edi
pop	esi
pop	ebx
jz	short loc_1005498
push	[ebp+70h+ho]	; ho
call	ds:DeleteObject

loc_1005498:
xor	eax, eax
inc	eax
add	ebp, 70h
leave
retn	8
sub_1005203 endp



; Attributes: bp-based frame

; int __stdcall	sub_10054A2(int	hMem, int, LPRECT color, int)
sub_10054A2 proc near

hMem= dword ptr	 8
arg_4= dword ptr  0Ch
color= dword ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	ecx, [ebp+arg_4]
cmp	ecx, 0Eh
jg	short loc_1005527
jz	short loc_1005517
mov	eax, ecx
sub	eax, 3
jz	short loc_100550A
sub	eax, 3
jz	short loc_10054F1
dec	eax
dec	eax
jz	short loc_10054E1
sub	eax, 4
jz	short loc_10054D4
dec	eax
jnz	short loc_1005537
push	[ebp+hMem]	; hMem
call	sub_1004DF0
jmp	loc_100557D

loc_10054D4:
push	[ebp+hMem]
call	sub_1004D1E
jmp	loc_100557D

loc_10054E1:
push	[ebp+color]
push	[ebp+hMem]
call	sub_1004A7C
jmp	loc_100557D

loc_10054F1:		; int
push	[ebp+arg_C]
push	[ebp+color]	; int
push	6		; int
push	[ebp+hMem]	; hMem
call	sub_10030F9
test	eax, eax
jz	short loc_100550A
xor	eax, eax
inc	eax
jmp	short loc_100557D

loc_100550A:		; int
push	[ebp+color]
push	[ebp+hMem]	; hMem
call	sub_1004BDD
jmp	short loc_100557D

loc_1005517:
push	[ebp+arg_C]
push	[ebp+color]
push	[ebp+hMem]
call	sub_100505F
jmp	short loc_100557D

loc_1005527:
mov	eax, ecx
sub	eax, 0Fh
jz	short loc_100556F
dec	eax
jz	short loc_1005562
dec	eax
jz	short loc_1005552
dec	eax
jz	short loc_1005548

loc_1005537:		; int
push	[ebp+arg_C]
push	[ebp+color]	; int
push	ecx		; int
push	[ebp+hMem]	; hMem
call	sub_10030F9
jmp	short loc_100557D

loc_1005548:
push	[ebp+hMem]
call	sub_1004FB6
jmp	short loc_100557D

loc_1005552:
push	[ebp+arg_C]
push	[ebp+color]
push	[ebp+hMem]
call	sub_1005189
jmp	short loc_100557D

loc_1005562:		; color
push	[ebp+color]
push	[ebp+hMem]	; c
call	sub_1005203
jmp	short loc_100557D

loc_100556F:		; int
push	[ebp+arg_C]
push	[ebp+color]	; int
push	[ebp+hMem]	; hMem
call	sub_10050BF

loc_100557D:
pop	ebp
retn	10h
sub_10054A2 endp




sub_1005581 proc near

hMem= dword ptr	-4

push	ecx
push	ebx
push	edi
push	hMem		; hMem
call	sub_1002649
push	0A0h
call	sub_1001F17
mov	edi, eax
xor	ebx, ebx
cmp	edi, ebx
mov	hMem, eax
jnz	short loc_10055AD
xor	eax, eax
jmp	loc_10056DC

loc_10055AD:
push	ebp
push	esi
push	ebx		; int
push	1		; color
push	ebx		; int
push	edi		; hMem
mov	dword ptr [edi], offset	sub_10054A2
call	sub_10054A2
lea	eax, [edi+4]
push	eax
mov	dword ptr [edi+68h], 0Dh
mov	dword ptr [edi+38h], 28h
call	sub_10056FA
test	eax, eax
jz	loc_10056E6
cmp	[edi+68h], ebx
mov	[esp+14h+hMem],	ebx
jle	loc_10056D7
mov	esi, [esp+14h+hMem]
mov	ebp, [esp+14h+hMem]

loc_10055F3:
mov	eax, [esp+14h+hMem]
sub	eax, ebx
jz	loc_1005690
dec	eax
jz	short loc_100566A
dec	eax
jz	short loc_1005650
sub	eax, 4
jnz	loc_10056AB
mov	esi, nNumber
push	19h
pop	ecx
mov	eax, esi
shl	eax, 2
cdq
idiv	ecx
push	19h
pop	ebp
push	1
push	1
mov	ecx, eax
mov	eax, esi
cdq
idiv	ebp
sub	ecx, dword_100718C
lea	edx, [ecx+ecx*2]
lea	edx, [esi+edx*4]
mov	[edi+60h], edx
push	eax
push	ebx
push	ecx
push	ebx
push	offset sub_100448D
push	4
call	sub_100322F
push	13h
jmp	short loc_10056A8

loc_1005650:
push	1
push	4
push	ebx
push	ebx
push	1
push	2
push	offset sub_1004597
push	3
call	sub_100322F
push	0Dh
jmp	short loc_10056A8

loc_100566A:
mov	eax, dword_1007308
push	5
pop	ecx
cdq
idiv	ecx
push	0Ah
push	1
push	1
push	2
push	1
push	eax
push	offset sub_10049BD
push	2
call	sub_100322F
push	18h
jmp	short loc_10056A8

loc_1005690:
push	0Ah
push	1
push	1
push	2
push	ebx
push	ebx
push	offset sub_1004823
push	1
call	sub_100322F
push	34h

loc_10056A8:
mov	esi, eax
pop	ebp

loc_10056AB:
cmp	esi, ebx
jz	short loc_10056E6
push	ebp
push	ebx
push	ebx
push	ebx
push	ebx
push	esi
call	sub_1003274
cmp	eax, ebx
mov	ecx, [esp+14h+hMem]
mov	[edi+ecx*4+6Ch], eax
jz	short loc_10056E0
inc	dword ptr [edi+64h]
inc	ecx
cmp	ecx, [edi+68h]
mov	[esp+14h+hMem],	ecx
jl	loc_10055F3

loc_10056D7:
xor	eax, eax
inc	eax

loc_10056DA:
pop	esi
pop	ebp

loc_10056DC:
pop	edi
pop	ebx
pop	ecx
retn

loc_10056E0:		; hMem
push	esi
call	LocalFree

loc_10056E6:
call	sub_10023E2
push	hMem		; hMem
call	sub_1002649
xor	eax, eax
jmp	short loc_10056DA
sub_1005581 endp




sub_10056FA proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
push	ebx
push	ebp
push	esi
xor	ebp, ebp
lea	esi, [eax+18h]
push	edi
mov	[eax], ebp
xor	ebx, ebx
mov	edi, esi

loc_100570D:
push	34h
push	ebp
push	ebp
push	ebp
push	ebp
push	ebp
call	sub_1003274
cmp	eax, ebp
mov	[edi], eax
jz	short loc_1005732
inc	ebx
add	edi, 4
cmp	ebx, 2
jl	short loc_100570D
xor	eax, eax
inc	eax

loc_100572B:
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	4

loc_1005732:
cmp	ebx, ebp
jz	short loc_100573D
push	dword ptr [esi]	; hMem
call	LocalFree

loc_100573D:
xor	eax, eax
jmp	short loc_100572B
sub_10056FA endp




sub_1005741 proc near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
push	edi
push	2
add	esi, 18h
pop	edi

loc_100574D:		; hMem
push	dword ptr [esi]
call	LocalFree
add	esi, 4
dec	edi
jnz	short loc_100574D
pop	edi
pop	esi
retn	4
sub_1005741 endp



; Attributes: bp-based frame

; INT_PTR __stdcall DialogFunc(HWND, UINT, WPARAM, LPARAM)
DialogFunc proc	near

hDlg= dword ptr	 8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_4]
sub	eax, 53h
push	ebx
push	esi
push	edi
jz	loc_10059FD
sub	eax, 28h
jz	loc_10059EC
sub	eax, 95h
jz	loc_1005922
dec	eax
jnz	loc_1005848
movzx	ecx, word ptr [ebp+arg_8]
cmp	ecx, 1
mov	ebx, [ebp+hDlg]
jz	loc_100584F
cmp	ecx, 2
jz	loc_1005903
cmp	ecx, 12Bh
jle	loc_1005848
mov	esi, 12Dh
cmp	ecx, esi
jle	short loc_100581F
mov	eax, 130h
cmp	ecx, eax
jg	loc_1005848
push	ecx		; nIDCheckButton
push	eax		; nIDLastButton
push	12Eh		; nIDFirstButton
push	ebx		; hDlg
mov	dword_10071D4, ecx
call	ds:CheckRadioButton
mov	edi, ds:GetDlgItem
xor	eax, eax
add	esi, 2
cmp	dword_10071D4, esi
setz	al
push	eax		; bEnable
push	134h		; nIDDlgItem
push	ebx		; hDlg
call	edi ; GetDlgItem
mov	ebx, ds:EnableWindow
push	eax		; hWnd
call	ebx ; EnableWindow
xor	eax, eax
cmp	dword_10071D4, esi
setz	al
push	eax		; bEnable
push	136h		; nIDDlgItem
push	[ebp+hDlg]	; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ebx ; EnableWindow
jmp	loc_1005A15

loc_100581F:
xor	edx, edx
mov	eax, 12Ch
cmp	word ptr [ebp+arg_8], ax
push	ecx		; nIDCheckButton
setnz	dl
push	esi		; nIDLastButton
push	eax		; nIDFirstButton
push	[ebp+hDlg]	; hDlg
lea	edx, [edx+edx+1]
mov	dword_10071D8, edx
call	ds:CheckRadioButton
jmp	loc_1005A15

loc_1005848:
xor	eax, eax
jmp	loc_1005A18

loc_100584F:
mov	esi, ds:IsDlgButtonChecked
push	132h		; nIDButton
push	ebx		; hDlg
xor	edi, edi
call	esi ; IsDlgButtonChecked
movzx	ecx, word ptr dword_1007020
cmp	eax, ecx
jz	short loc_100587F
xor	dword_1007020, 1
jz	short loc_100587A
call	sub_1005C79
jmp	short loc_100587F

loc_100587A:
call	sub_1005CFD

loc_100587F:
mov	eax, dword_10071D8
cmp	eax, dword_100702C
jz	short loc_100589E
mov	dword_100702C, eax
call	sub_100289B
call	sub_10040FE
xor	edi, edi
inc	edi

loc_100589E:		; nIDButton
push	131h
push	ebx		; hDlg
call	esi ; IsDlgButtonChecked
movzx	ecx, word ptr dword_1007024
cmp	eax, ecx
jz	short loc_10058BA
xor	edi, edi
inc	edi
xor	dword_1007024, edi

loc_10058BA:
mov	eax, dword_10071D4
cmp	nIDCheckButton,	eax
jz	short loc_10058CF
xor	edi, edi
mov	nIDCheckButton,	eax
inc	edi

loc_10058CF:		; nIDButton
push	133h
push	ebx		; hDlg
call	esi ; IsDlgButtonChecked
mov	ecx, dword_1007188
movzx	edx, cx
cmp	eax, edx
jz	short loc_10058ED
xor	ecx, 1
push	ecx
call	sub_10026F8

loc_10058ED:		; nIDButton
push	134h
push	ebx		; hDlg
call	esi ; IsDlgButtonChecked
push	3
mov	dword_1007184, eax
call	sub_1001624
jmp	short loc_1005906

loc_1005903:
mov	edi, [ebp+hDlg]

loc_1005906:
xor	eax, eax
inc	eax
cmp	word ptr [ebp+arg_8], ax
jnz	short loc_1005913
test	edi, edi
jnz	short loc_1005915

loc_1005913:
xor	eax, eax

loc_1005915:		; nResult
push	eax
push	ebx		; hDlg
call	ds:EndDialog
jmp	loc_1005A15

loc_1005922:
mov	eax, nIDCheckButton
mov	edi, [ebp+hDlg]
mov	esi, ds:CheckRadioButton
push	eax		; nIDCheckButton
push	130h		; nIDLastButton
push	12Eh		; nIDFirstButton
push	edi		; hDlg
mov	dword_10071D4, eax
call	esi ; CheckRadioButton
mov	eax, dword_100702C
xor	ecx, ecx
cmp	eax, 1
setnz	cl
mov	dword_10071D8, eax
mov	eax, 12Ch
add	ecx, eax
push	ecx		; nIDCheckButton
push	12Dh		; nIDLastButton
push	eax		; nIDFirstButton
push	edi		; hDlg
call	esi ; CheckRadioButton
movzx	eax, word ptr dword_1007020
mov	esi, ds:CheckDlgButton
push	eax		; uCheck
push	132h		; nIDButton
push	edi		; hDlg
call	esi ; CheckDlgButton
movzx	eax, word ptr dword_1007024
push	eax		; uCheck
push	131h		; nIDButton
push	edi		; hDlg
call	esi ; CheckDlgButton
movzx	eax, word ptr dword_1007188
push	eax		; uCheck
push	133h		; nIDButton
push	edi		; hDlg
call	esi ; CheckDlgButton
movzx	eax, word ptr dword_1007184
push	eax		; uCheck
mov	ebx, 134h
push	ebx		; nIDButton
push	edi		; hDlg
call	esi ; CheckDlgButton
xor	eax, eax
mov	esi, 12Fh
cmp	nIDCheckButton,	esi
setz	al
push	eax		; bEnable
push	ebx		; nIDDlgItem
mov	ebx, ds:GetDlgItem
push	edi		; hDlg
call	ebx ; GetDlgItem
push	eax		; hWnd
call	ds:EnableWindow
xor	eax, eax
cmp	nIDCheckButton,	esi
setz	al
push	eax		; bEnable
push	136h		; nIDDlgItem
push	edi		; hDlg
call	ebx ; GetDlgItem
push	eax		; hWnd
call	ds:EnableWindow
jmp	short loc_1005A15

loc_10059EC:
push	offset unk_1007078
push	0Ah
push	offset szHelp	; "sol.hlp"
push	[ebp+arg_8]
jmp	short loc_1005A0F

loc_10059FD:
mov	eax, [ebp+arg_C]
push	offset unk_1007078 ; dwData
push	0Ch		; uCommand
push	offset szHelp	; "sol.hlp"
push	dword ptr [eax+0Ch] ; hWndMain

loc_1005A0F:
call	ds:WinHelpW

loc_1005A15:
xor	eax, eax
inc	eax

loc_1005A18:
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	10h
DialogFunc endp




sub_1005A1F proc near
push	0		; dwInitParam
push	offset DialogFunc ; lpDialogFunc
push	hWnd		; hWndParent
push	67h		; lpTemplateName
push	hInstance	; hInstance
call	ds:DialogBoxParamW
test	eax, eax
jz	short locret_1005A47
push	1
push	1
call	sub_1001468

locret_1005A47:
retn
sub_1005A1F endp



; Attributes: bp-based frame

; int __stdcall	sub_1005A48(HDC	hDC, int, int)
sub_1005A48 proc near

rc= RECT ptr -10h
hDC= dword ptr	8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 10h
xor	eax, eax
cmp	[ebp+arg_8], eax
push	ebx
setz	al
lea	eax, [eax+eax+0Dh]
push	eax		; nIndex
call	ds:GetSysColor
push	eax		; color
call	ds:CreateSolidBrush
mov	ebx, eax
test	ebx, ebx
jz	short loc_1005AAF
push	esi
mov	esi, [ebp+arg_4]
push	edi
lea	edi, [ebp+rc]
movsd
movsd
movsd
push	ebx		; hbr
lea	eax, [ebp+rc]
push	eax		; lprc
push	[ebp+hDC]	; hDC
movsd
mov	esi, ds:FrameRect
call	esi ; FrameRect
push	0FFFFFFFFh	; dy
push	0FFFFFFFFh	; dx
lea	eax, [ebp+rc]
push	eax		; lprc
call	ds:InflateRect
push	ebx		; hbr
lea	eax, [ebp+rc]
push	eax		; lprc
push	[ebp+hDC]	; hDC
call	esi ; FrameRect
push	ebx		; ho
call	ds:DeleteObject
xor	eax, eax
pop	edi
inc	eax
pop	esi

loc_1005AAF:
pop	ebx
leave
retn	0Ch
sub_1005A48 endp



; Attributes: bp-based frame

; INT_PTR __stdcall sub_1005AB4(HWND, UINT, WPARAM, LPARAM)
sub_1005AB4 proc near

rcDst= tagRECT ptr -20h
rc= tagRECT ptr	-10h
hDlg= dword ptr	 8
arg_4= dword ptr  0Ch
hWndMain= dword	ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
sub	esp, 20h
mov	eax, [ebp+arg_4]
sub	eax, 2Bh
jz	loc_1005BC2
dec	eax
jz	loc_1005BA6
sub	eax, 27h
jz	loc_1005B92
sub	eax, 28h
jz	loc_1005B78
sub	eax, 95h
jz	short loc_1005B58
dec	eax
jz	short loc_1005AF0

loc_1005AE9:
xor	eax, eax
jmp	locret_1005C59

loc_1005AF0:
mov	eax, [ebp+hWndMain]
mov	ecx, eax
shr	ecx, 10h
test	cx, cx
jnz	short loc_1005B13
cmp	ax, 36h
jb	short loc_1005B13
cmp	ax, 41h
ja	short loc_1005B13
mov	dword_10071D0, eax
jmp	loc_1005C56

loc_1005B13:
cmp	cx, 5
jnz	short loc_1005B28
cmp	ax, 36h
jb	short loc_1005B28
cmp	ax, 41h
ja	short loc_1005B28
xor	eax, eax
inc	eax

loc_1005B28:
movzx	eax, ax
dec	eax
jz	short loc_1005B36
dec	eax
jz	short loc_1005B48
jmp	loc_1005C56

loc_1005B36:
push	dword_10071D0
call	sub_1001444
push	4
call	sub_1001624

loc_1005B48:		; nResult
push	0
push	[ebp+hDlg]	; hDlg
call	ds:EndDialog
jmp	loc_1005C56

loc_1005B58:
mov	eax, nIDDlgItem
push	eax		; nIDDlgItem
push	[ebp+hDlg]	; hDlg
mov	dword_10071D0, eax
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:SetFocus
jmp	loc_1005AE9

loc_1005B78:		; dwData
push	offset unk_10070D0
push	0Ah		; uCommand
push	offset szHelp	; "sol.hlp"
push	[ebp+hWndMain]	; hWndMain

loc_1005B87:
call	ds:WinHelpW
jmp	loc_1005C56

loc_1005B92:
mov	eax, [ebp+arg_C]
push	offset unk_10070D0
push	0Ch
push	offset szHelp	; "sol.hlp"
push	dword ptr [eax+0Ch]
jmp	short loc_1005B87

loc_1005BA6:
mov	eax, [ebp+arg_C]
mov	dword ptr [eax], 4
mov	dword ptr [eax+0Ch], 20h
mov	dword ptr [eax+10h], 36h
jmp	loc_1005C56

loc_1005BC2:
push	ebx
mov	ebx, [ebp+arg_C]
push	esi
push	edi
lea	eax, [ebx+1Ch]
push	eax		; lprcSrc
lea	eax, [ebp+rcDst]
push	eax		; lprcDst
call	ds:CopyRect
lea	esi, [ebp+rcDst]
lea	edi, [ebp+rc]
movsd
movsd
push	0FFFFFFFDh	; dy
movsd
push	0FFFFFFFDh	; dx
lea	eax, [ebp+rc]
push	eax		; lprc
movsd
call	ds:InflateRect
mov	eax, [ebx+0Ch]
cmp	eax, 1
mov	esi, [ebx+18h]
jnz	short loc_1005C21
push	0
push	eax
push	dword ptr [ebx+4]
mov	eax, [ebp+rc.bottom]
sub	eax, [ebp+rc.top]
push	eax
mov	eax, [ebp+rc.right]
sub	eax, [ebp+rc.left]
push	eax
push	[ebp+rc.top]
push	[ebp+rc.left]
push	esi
call	cdtDrawExt
mov	eax, [ebx+10h]
and	eax, 10h
jmp	short loc_1005C48

loc_1005C21:
cmp	eax, 2
jnz	short loc_1005C31
lea	eax, [ebp+rc]
push	eax		; lprc
push	esi		; hDC
call	ds:InvertRect

loc_1005C31:
cmp	dword ptr [ebx+0Ch], 4
jnz	short loc_1005C53
mov	eax, [ebx+10h]
and	eax, 10h
jz	short loc_1005C48
mov	ecx, [ebx+4]
mov	dword_10071D0, ecx

loc_1005C48:		; int
push	eax
lea	eax, [ebp+rcDst]
push	eax		; int
push	esi		; hDC
call	sub_1005A48

loc_1005C53:
pop	edi
pop	esi
pop	ebx

loc_1005C56:
xor	eax, eax
inc	eax

locret_1005C59:
leave
retn	10h
sub_1005AB4 endp




sub_1005C5D proc near
push	0		; dwInitParam
push	offset sub_1005AB4 ; lpDialogFunc
push	hWnd		; hWndParent
push	65h		; lpTemplateName
push	hInstance	; hInstance
call	ds:DialogBoxParamW
retn
sub_1005C5D endp



; Attributes: bp-based frame

sub_1005C79 proc near

Rect= tagRECT ptr -10h

push	ebp
mov	ebp, esp
sub	esp, 10h
mov	eax, dword_1007368
add	eax, 2
push	esi
mov	nHeight, eax
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	hWnd		; hWnd
call	ds:GetClientRect
mov	ecx, [ebp+Rect.left]
mov	esi, [ebp+Rect.right]
mov	eax, nHeight
xor	edx, edx
push	edx		; lpParam
push	hInstance	; hInstance
sub	esi, ecx
push	edx		; hMenu
push	hWnd		; hWndParent
inc	esi
push	eax		; nHeight
inc	esi
push	esi		; nWidth
mov	esi, [ebp+Rect.bottom]
sub	esi, eax
inc	esi
push	esi		; Y
dec	ecx
push	ecx		; X
push	40800003h	; dwStyle
push	offset WindowName ; lpWindowName
push	offset aStat	; "Stat"
push	edx		; dwExStyle
call	ds:CreateWindowExW
push	4		; nCmdShow
push	eax		; hWnd
mov	dword_10071E0, eax
call	ds:ShowWindow
push	dword_10071E0	; hWnd
call	ds:UpdateWindow
xor	eax, eax
inc	eax
pop	esi
leave
retn
sub_1005C79 endp




sub_1005CFD proc near
mov	eax, dword_10071E0
test	eax, eax
jz	short loc_1005D14
push	eax		; hWnd
call	ds:DestroyWindow
and	dword_10071E0, 0

loc_1005D14:
xor	eax, eax
inc	eax
retn
sub_1005CFD endp



; Attributes: bp-based frame

sub_1005D18 proc near

Rect= tagRECT ptr -10h

push	ebp
mov	ebp, esp
sub	esp, 10h
cmp	hMem, 0
jz	short locret_1005D4F
mov	eax, dword_10071E0
test	eax, eax
jz	short locret_1005D4F
lea	ecx, [ebp+Rect]
push	ecx		; lpRect
push	eax		; hWnd
call	ds:GetClientRect
sub	[ebp+Rect.right], 4
push	0
lea	eax, [ebp+Rect]
push	eax
mov	eax, hMem
push	10h
push	eax
call	dword ptr [eax]

locret_1005D4F:
leave
retn
sub_1005D18 endp




sub_1005D51 proc near
mov	eax, dword_10071E0
test	eax, eax
jz	short locret_1005D93
push	esi
push	eax		; hWnd
call	ds:GetDC
mov	esi, eax
test	esi, esi
jz	short loc_1005D92
push	edi
push	0
push	0
push	esi
call	sub_10013A8
mov	edi, eax
call	sub_1005D18
push	0
push	0
push	edi
call	sub_10013A8
push	esi		; hDC
push	dword_10071E0	; hWnd
call	ds:ReleaseDC
pop	edi

loc_1005D92:
pop	esi

locret_1005D93:
retn
sub_1005D51 endp



; Attributes: bp-based frame

sub_1005D94 proc near

Rect= tagRECT ptr -10h

push	ebp
mov	ebp, esp
sub	esp, 10h
cmp	dword_10071E0, 0
jz	short locret_1005DEB
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	hWnd		; hWnd
call	ds:GetClientRect
mov	ecx, [ebp+Rect.left]
mov	edx, [ebp+Rect.right]
mov	eax, nHeight
sub	edx, ecx
push	1		; bRepaint
inc	edx
inc	edx
push	eax		; nHeight
push	edx		; nWidth
mov	edx, [ebp+Rect.bottom]
sub	edx, eax
inc	edx
push	edx		; Y
dec	ecx
push	ecx		; X
push	dword_10071E0	; hWnd
call	ds:MoveWindow
push	1		; bErase
push	0		; lpRect
push	dword_10071E0	; hWnd
call	ds:InvalidateRect

locret_1005DEB:
leave
retn
sub_1005D94 endp



; Attributes: bp-based frame

; int __stdcall	sub_1005DED(LPCWSTR lpString)
sub_1005DED proc near

Rect= tagRECT ptr -10h
lpString= dword	ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
mov	eax, dword_10071E0
push	esi
xor	esi, esi
cmp	eax, esi
jz	loc_1005E89
push	edi
push	eax		; hWnd
call	ds:GetDC
mov	edi, eax
cmp	edi, esi
jz	short loc_1005E88
push	ebx
push	esi
push	esi
push	edi
call	sub_10013A8
mov	ebx, eax
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	dword_10071E0	; hWnd
call	ds:GetClientRect
mov	eax, [ebp+Rect.bottom]
sub	eax, [ebp+Rect.top]
push	0F00021h	; rop
push	eax		; h
mov	eax, [ebp+Rect.right]
sub	eax, [ebp+Rect.left]
push	eax		; w
push	[ebp+Rect.top]	; y
push	[ebp+Rect.left]	; x
push	hDC		; hdc
call	ds:PatBlt
push	[ebp+lpString]	; lpString
call	ds:lstrlenW
push	eax		; c
push	[ebp+lpString]	; lpString
push	esi		; y
push	4		; x
push	hDC		; hdc
call	ds:TextOutW
call	sub_1005D18
push	esi
push	esi
push	ebx
call	sub_10013A8
push	edi		; hDC
push	dword_10071E0	; hWnd
call	ds:ReleaseDC
pop	ebx

loc_1005E88:
pop	edi

loc_1005E89:
pop	esi
leave
retn	4
sub_1005DED endp



; Attributes: bp-based frame

sub_1005E8E proc near

String=	word ptr -78h
arg_0= word ptr	 8

push	ebp
mov	ebp, esp
sub	esp, 78h
cmp	dword ptr [ebp+arg_0], 1FFFh
jz	short loc_1005EAD
push	3Ch		; cchBufferMax
push	dword ptr [ebp+arg_0] ;	__int16
lea	eax, [ebp+String]
push	eax		; lpBuffer
call	sub_10023F8
jmp	short loc_1005EB2

loc_1005EAD:
and	[ebp+String], 0

loc_1005EB2:
lea	eax, [ebp+String]
push	eax		; lpString
call	sub_1005DED
leave
retn	4
sub_1005E8E endp



; Attributes: bp-based frame

; int __stdcall	sub_1005EBF(HWND hWnd, UINT Msg, WPARAM	wParam,	LPARAM lParam)
sub_1005EBF proc near

Paint= tagPAINTSTRUCT ptr -40h
hWnd= dword ptr	 8
Msg= dword ptr	0Ch
wParam=	dword ptr  10h
lParam=	dword ptr  14h

push	ebp
mov	ebp, esp
sub	esp, 40h
cmp	[ebp+Msg], 0Fh
jz	short loc_1005EDF
push	[ebp+lParam]	; lParam
push	[ebp+wParam]	; wParam
push	[ebp+Msg]	; Msg
push	[ebp+hWnd]	; hWnd
call	ds:DefWindowProcW
jmp	short locret_1005F1A

loc_1005EDF:
push	edi
lea	eax, [ebp+Paint]
push	eax		; lpPaint
push	[ebp+hWnd]	; hWnd
call	ds:BeginPaint
push	0
push	0
push	[ebp+Paint.hdc]
call	sub_10013A8
mov	edi, eax
call	sub_1005D18
push	0
push	0
push	edi
call	sub_10013A8
lea	eax, [ebp+Paint]
push	eax		; lpPaint
push	[ebp+hWnd]	; hWnd
call	ds:EndPaint
xor	eax, eax
pop	edi

locret_1005F1A:
leave
retn	10h
sub_1005EBF endp



; Attributes: bp-based frame

sub_1005F1E proc near

WndClass= WNDCLASSW ptr	-28h
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 28h
push	esi
xor	esi, esi
cmp	[ebp+arg_0], esi
jz	short loc_1005F7D
mov	eax, hInstance
push	7F00h		; lpCursorName
push	esi		; hInstance
mov	[ebp+WndClass.style], esi
mov	[ebp+WndClass.lpfnWndProc], offset sub_1005EBF
mov	[ebp+WndClass.cbWndExtra], esi
mov	[ebp+WndClass.cbClsExtra], esi
mov	[ebp+WndClass.hInstance], eax
mov	[ebp+WndClass.hIcon], esi
call	ds:LoadCursorW
push	esi		; i
mov	[ebp+WndClass.hCursor],	eax
call	ds:GetStockObject
mov	[ebp+WndClass.hbrBackground], eax
lea	eax, [ebp+WndClass]
push	eax		; lpWndClass
mov	[ebp+WndClass.lpszMenuName], esi
mov	[ebp+WndClass.lpszClassName], offset aStat ; "Stat"
call	ds:RegisterClassW
test	ax, ax
jnz	short loc_1005F7D
xor	eax, eax
jmp	short loc_1005F80

loc_1005F7D:
xor	eax, eax
inc	eax

loc_1005F80:
pop	esi
leave
retn	4
sub_1005F1E endp

assume fs:nothing, gs:nothing


; Attributes: bp-based frame

public start
start proc near

Code= dword ptr	-80h
var_7C=	dword ptr -7Ch
StartupInfo= _STARTUPINFOA ptr -78h
var_34=	dword ptr -34h
var_30=	dword ptr -30h
var_2C=	byte ptr -2Ch
var_28=	byte ptr -28h
var_24=	byte ptr -24h
var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
ms_exc=	CPPEH_RECORD ptr -18h

push	70h
push	offset stru_10012F8
call	__SEH_prolog
xor	ebx, ebx
push	ebx		; lpModuleName
mov	edi, ds:GetModuleHandleA
call	edi ; GetModuleHandleA
cmp	word ptr [eax],	5A4Dh
jnz	short loc_1005FC2
mov	ecx, [eax+3Ch]
add	ecx, eax
cmp	dword ptr [ecx], 4550h
jnz	short loc_1005FC2
movzx	eax, word ptr [ecx+18h]
cmp	eax, 10Bh
jz	short loc_1005FDA
cmp	eax, 20Bh
jz	short loc_1005FC7

loc_1005FC2:
mov	[ebp+var_1C], ebx
jmp	short loc_1005FEE

loc_1005FC7:
cmp	dword ptr [ecx+84h], 0Eh
jbe	short loc_1005FC2
xor	eax, eax
cmp	[ecx+0F8h], ebx
jmp	short loc_1005FE8

loc_1005FDA:
cmp	dword ptr [ecx+74h], 0Eh
jbe	short loc_1005FC2
xor	eax, eax
cmp	[ecx+0E8h], ebx

loc_1005FE8:
setnz	al
mov	[ebp+var_1C], eax

loc_1005FEE:
mov	[ebp+ms_exc.registration.TryLevel], ebx
push	2
call	ds:__set_app_type
pop	ecx
or	dword_1007380, 0FFFFFFFFh
or	dword_1007384, 0FFFFFFFFh
call	ds:__p__fmode
mov	ecx, dword_10071F0
mov	[eax], ecx
call	ds:__p__commode
mov	ecx, dword_10071EC
mov	[eax], ecx
mov	eax, ds:_adjust_fdiv
mov	eax, [eax]
mov	dword_1007388, eax
call	sub_100616A
cmp	dword_1007144, ebx
jnz	short loc_1006049
push	offset sub_100616A
call	ds:__setusermatherr
pop	ecx

loc_1006049:
call	sub_1006158
push	offset dword_1001214
push	offset dword_1001210
call	_initterm
mov	eax, dword_10071E8
mov	[ebp+var_20], eax
lea	eax, [ebp+var_20]
push	eax
push	dword_10071E4
lea	eax, [ebp+var_24]
push	eax
lea	eax, [ebp+var_28]
push	eax
lea	eax, [ebp+var_2C]
push	eax
call	ds:__getmainargs
mov	[ebp+var_30], eax
push	offset dword_100120C
push	offset dword_1001208
call	_initterm
add	esp, 24h
mov	eax, ds:_acmdln
mov	esi, [eax]
mov	[ebp+var_34], esi
cmp	byte ptr [esi],	22h
jnz	short loc_10060DF

loc_10060A5:
inc	esi
mov	[ebp+var_34], esi
mov	al, [esi]
cmp	al, bl
jz	short loc_10060B3
cmp	al, 22h
jnz	short loc_10060A5

loc_10060B3:
cmp	byte ptr [esi],	22h
jnz	short loc_10060BC

loc_10060B8:
inc	esi
mov	[ebp+var_34], esi

loc_10060BC:
mov	al, [esi]
cmp	al, bl
jz	short loc_10060C6
cmp	al, 20h
jbe	short loc_10060B8

loc_10060C6:
mov	[ebp+StartupInfo.dwFlags], ebx
lea	eax, [ebp+StartupInfo]
push	eax		; lpStartupInfo
call	ds:GetStartupInfoA
test	byte ptr [ebp+StartupInfo.dwFlags], 1
jz	short loc_10060EA
movzx	eax, [ebp+StartupInfo.wShowWindow]
jmp	short loc_10060ED

loc_10060DF:
cmp	byte ptr [esi],	20h
jbe	short loc_10060BC
inc	esi
mov	[ebp+var_34], esi
jmp	short loc_10060DF

loc_10060EA:
push	0Ah
pop	eax

loc_10060ED:		; nCmdShow
push	eax
push	esi		; int
push	ebx		; int
push	ebx		; lpModuleName
call	edi ; GetModuleHandleA
push	eax		; hInstance
call	sub_1001E9E
mov	esi, eax
mov	[ebp+var_7C], esi
cmp	[ebp+var_1C], ebx
jnz	short loc_100610A
push	esi		; Code
call	ds:exit

loc_100610A:
call	ds:_cexit
jmp	short loc_100613F

loc_1006112:		; Exception filter 0 for function 1005F85
mov	eax, [ebp+ms_exc.exc_ptr]
mov	ecx, [eax]
mov	ecx, [ecx]
mov	[ebp+Code], ecx
push	eax
push	ecx
call	_XcptFilter
pop	ecx
pop	ecx
retn

loc_1006126:		; Exception handler 0 for function 1005F85
mov	esp, [ebp+ms_exc.old_esp]
mov	esi, [ebp+Code]
cmp	[ebp+var_1C], 0
jnz	short loc_1006139
push	esi		; Code
call	ds:_exit

loc_1006139:
call	ds:_c_exit

loc_100613F:
or	[ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh
mov	eax, esi
call	__SEH_epilog
retn
start endp

align 4
; [00000006 BYTES: COLLAPSED FUNCTION _XcptFilter. PRESS KEYPAD	CTRL-"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION _initterm. PRESS KEYPAD CTRL-"+" TO EXPAND]



sub_1006158 proc near
push	30000h		; Mask
push	10000h		; NewValue
call	_controlfp
pop	ecx
pop	ecx
retn
sub_1006158 endp




sub_100616A proc near
xor	eax, eax
retn
sub_100616A endp

align 10h
; [00000039 BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION _controlfp. PRESS	KEYPAD CTRL-"+"	TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION _except_handler3.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION cdtDraw. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION cdtTerm. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION cdtInit. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION cdtDrawExt. PRESS	KEYPAD CTRL-"+"	TO EXPAND]


; Attributes: bp-based frame

sub_10061DE proc near

Data= byte ptr -104h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
sub	esp, 104h
mov	ecx, hModule
push	esi
test	ecx, ecx
jnz	short loc_100623B
cmp	dword_1007200, ecx
jnz	short loc_100623B
lea	eax, [ebp+Data]
push	eax		; lpData
call	sub_1006277
mov	esi, ds:LoadLibraryA
test	eax, eax
jz	short loc_100621E
lea	eax, [ebp+Data]
push	eax		; lpLibFileName
call	esi ; LoadLibraryA
mov	hModule, eax

loc_100621E:
mov	ecx, hModule
test	ecx, ecx
jnz	short loc_100623B
push	offset LibFileName ; "hhctrl.ocx"
call	esi ; LoadLibraryA
mov	ecx, eax
test	ecx, ecx
mov	hModule, ecx
jz	short loc_1006256

loc_100623B:
mov	eax, dword_1007208
test	eax, eax
jnz	short loc_1006264
push	0Eh		; lpProcName
push	ecx		; hModule
call	ds:GetProcAddress
test	eax, eax
mov	dword_1007208, eax
jnz	short loc_1006264

loc_1006256:
mov	dword_1007200, 1
xor	eax, eax
jmp	short loc_1006272

loc_1006264:
push	[ebp+arg_C]
push	[ebp+arg_8]
push	[ebp+arg_4]
push	[ebp+arg_0]
call	eax ; dword_1007208

loc_1006272:
pop	esi
leave
retn	10h
sub_10061DE endp



; Attributes: bp-based frame

; int __stdcall	sub_1006277(LPBYTE lpData)
sub_1006277 proc near

cbData=	dword ptr -8
hKey= dword ptr	-4
lpData=	dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ecx
lea	eax, [ebp+hKey]
push	esi
xor	esi, esi
push	eax		; phkResult
push	20019h		; samDesired
push	esi		; ulOptions
push	offset aClsidAdb880a6D ; "CLSID\\{ADB880A6-D8FF-11CF-9377-00AA003"...
push	80000000h	; hKey
call	ds:RegOpenKeyExA
test	eax, eax
jnz	short loc_10062CF
lea	eax, [ebp+cbData]
mov	[ebp+cbData], 104h
push	eax		; lpcbData
push	[ebp+lpData]	; lpData
push	esi		; lpType
push	esi		; lpReserved
push	offset ValueName ; lpValueName
push	[ebp+hKey]	; hKey
call	ds:RegQueryValueExA
test	eax, eax
jnz	short loc_10062C2
push	1
pop	esi

loc_10062C2:		; hKey
push	[ebp+hKey]
call	ds:RegCloseKey
mov	eax, esi
jmp	short loc_10062D1

loc_10062CF:
xor	eax, eax

loc_10062D1:
pop	esi
leave
retn	4
sub_1006277 endp

align 4
__IMPORT_DESCRIPTOR_msvcrt dd rva off_1006548 ;	Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aMsvcrt_dll	; DLL Name
dd rva __imp__except_handler3 ;	Import Address Table
__IMPORT_DESCRIPTOR_ADVAPI32 dd	rva off_100638C	; Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aAdvapi32_dll	; DLL Name
dd rva RegCreateKeyExW	; Import Address Table
__IMPORT_DESCRIPTOR_KERNEL32 dd	rva off_1006420	; Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aKernel32_dll	; DLL Name
dd rva GetStartupInfoA	; Import Address Table
__IMPORT_DESCRIPTOR_GDI32 dd rva off_10063C4 ; Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aGdi32_dll	; DLL Name
dd rva SetTextColor	; Import Address Table
__IMPORT_DESCRIPTOR_USER32 dd rva off_1006450 ;	Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aUser32_dll	; DLL Name
dd rva SetFocus		; Import Address Table
__IMPORT_DESCRIPTOR_CARDS dd rva off_10063A8 ; Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aCards_dll	; DLL Name
dd rva __imp_cdtDrawExt	; Import Address Table
__IMPORT_DESCRIPTOR_SHELL32 dd rva off_1006448 ; Import	Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aShell32_dll	; DLL Name
dd rva ShellAboutW	; Import Address Table
__IMPORT_DESCRIPTOR_COMCTL32 dd	rva off_10063BC	; Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aComctl32_dll	; DLL Name
dd rva InitCommonControlsEx ; Import Address Table
dd 5 dup(0)
;
; Import names for ADVAPI32.dll
;
off_100638C dd rva word_10066A6
dd rva word_10066B8
dd rva word_1006CFC
dd rva word_1006CE8
dd rva word_1006694
dd rva word_1006686
dd 0
;
; Import names for CARDS.dll
;
off_10063A8 dd rva word_1006C90
dd rva word_1006C86
dd rva word_1006C7C
dd rva word_1006C72
dd 0
;
; Import names for COMCTL32.dll
;
off_10063BC dd rva word_1006CC2
dd 0
;
; Import names for GDI32.dll
;
off_10063C4 dd rva word_1006848
dd rva word_100683C
dd rva word_1006832
dd rva word_1006828
dd rva word_1006812
dd rva word_100688A
dd rva word_1006858
dd rva word_1006870
dd rva word_10067EC
dd rva word_100687E
dd rva word_10067E0
dd rva word_10067D0
dd rva word_10067C0
dd rva word_10067B6
dd rva word_10067AC
dd rva word_10067A0
dd rva word_1006796
dd rva word_1006784
dd rva word_1006750
dd rva word_1006760
dd rva word_1006774
dd rva word_10067F8
dd 0
;
; Import names for KERNEL32.dll
;
off_1006420 dd rva word_1006730
dd rva word_100671C
dd rva word_1006712
dd rva word_1006706
dd rva word_10066FA
dd rva word_10066EC
dd rva word_10066DA
dd rva word_1006D0C
dd rva word_1006D1E
dd 0
;
; Import names for SHELL32.dll
;
off_1006448 dd rva word_1006CA8
dd 0
;
; Import names for USER32.dll
;
off_1006450 dd rva word_1006C2A
dd rva word_1006C54
dd rva word_1006C1E
dd rva word_1006C46
dd rva word_1006C36
dd rva word_1006C10
dd rva word_10068A6
dd rva word_10068B2
dd rva word_10068C0
dd rva word_10068C8
dd rva word_10068D4
dd rva word_10068E6
dd rva word_10068F2
dd rva word_1006906
dd rva word_1006914
dd rva word_1006926
dd rva word_1006934
dd rva word_1006942
dd rva word_1006952
dd rva word_1006964
dd rva word_100696E
dd rva word_1006980
dd rva word_100698E
dd rva word_10069A0
dd rva word_10069AC
dd rva word_10069BC
dd rva word_10069C8
dd rva word_10069DC
dd rva word_10069EC
dd rva word_10069FA
dd rva word_1006A06
dd rva word_1006A18
dd rva word_1006A2C
dd rva word_1006A40
dd rva word_1006A4E
dd rva word_1006A5A
dd rva word_1006A74
dd rva word_1006A82
dd rva word_1006A96
dd rva word_1006AAA
dd rva word_1006AC2
dd rva word_1006AD0
dd rva word_1006ADE
dd rva word_1006AEE
dd rva word_1006AFC
dd rva word_1006B0A
dd rva word_1006B1A
dd rva word_1006B2C
dd rva word_1006B3A
dd rva word_1006B46
dd rva word_1006B56
dd rva word_1006B72
dd rva word_1006B7E
dd rva word_1006B8A
dd rva word_1006B9C
dd rva word_1006BB2
dd rva word_1006BC2
dd rva word_1006BD0
dd rva word_1006BE4
dd rva word_1006BF6
dd rva word_1006C04
dd 0
;
; Import names for msvcrt.dll
;
off_1006548 dd rva word_1006672
dd rva word_1006664
dd rva word_1006646
dd rva word_1006638
dd rva word_1006628
dd rva word_1006618
dd rva word_1006604
dd rva word_10065F8
dd rva word_10065E8
dd rva word_10065DE
dd rva word_10065D6
dd rva word_10065CC
dd rva word_10065BE
dd rva word_10065B6
dd rva word_10065AC
dd rva word_10065A4
dd rva word_100659C
dd rva word_1006594
dd 0
word_1006594 dw	2FAh
db 'srand',0
word_100659C dw	316h
db 'time',0
align 4
word_10065A4 dw	2ECh
db 'rand',0
align 4
word_10065AC dw	0C5h
db '_c_exit',0
word_10065B6 dw	0F6h
db '_exit',0
word_10065BE dw	4Eh
db '_XcptFilter',0
word_10065CC dw	0C8h
db '_cexit',0
align 2
word_10065D6 dw	28Fh
db 'exit',0
align 2
word_10065DE dw	0A8h
db '_acmdln',0
word_10065E8 dw	6Dh
db '__getmainargs',0
word_10065F8 dw	13Ah
db '_initterm',0
word_1006604 dw	9Ah
db '__setusermatherr',0
align 4
word_1006618 dw	0B6h
db '_adjust_fdiv',0
align 4
word_1006628 dw	80h
db '__p__commode',0
align 4
word_1006638 dw	85h
db '__p__fmode',0
align 2
word_1006646 dw	98h
db '__set_app_type',0
align 4
aMsvcrt_dll db 'msvcrt.dll',0
align 4
word_1006664 dw	0D6h
db '_controlfp',0
align 2
word_1006672 dw	0EDh
db '_except_handler3',0
align 2
word_1006686 dw	1C8h
db 'RegCloseKey',0
word_1006694 dw	1F9h
db 'RegSetValueExW',0
align 2
word_10066A6 dw	1CDh
db 'RegCreateKeyExW',0
word_10066B8 dw	1ECh
db 'RegQueryValueExW',0
align 4
aAdvapi32_dll db 'ADVAPI32.dll',0
align 2
word_10066DA dw	0FEh
db 'GetCommandLineW',0
word_10066EC dw	234h
db 'LocalAlloc',0
align 2
word_10066FA dw	238h
db 'LocalFree',0
word_1006706 dw	39Fh
db 'lstrlenW',0
align 2
word_1006712 dw	250h
db 'MulDiv',0
align 4
word_100671C dw	167h
db 'GetModuleHandleA',0
align 10h
word_1006730 dw	19Ch
db 'GetStartupInfoA',0
aKernel32_dll db 'KERNEL32.dll',0
align 10h
word_1006750 dw	8Fh
db 'DeleteObject',0
align 10h
word_1006760 dw	50h
db 'CreateSolidBrush',0
align 4
word_1006774 dw	16Bh
db 'GetDeviceCaps',0
word_1006784 dw	1BDh
db 'GetTextMetricsW',0
word_1006796 dw	1CBh
db 'LineTo',0
align 10h
word_10067A0 dw	1CFh
db 'MoveToEx',0
align 4
word_10067AC dw	233h
db 'SetROP2',0
word_10067B6 dw	1DBh
db 'PatBlt',0
align 10h
word_10067C0 dw	20Ch
db 'SelectObject',0
align 10h
word_10067D0 dw	217h
db 'SetBrushOrgEx',0
word_10067E0 dw	1EFh
db 'PtVisible',0
word_10067EC dw	8Ch
db 'DeleteDC',0
align 4
word_10067F8 dw	2Ch
db 'CreateCompatibleBitmap',0
align 2
word_1006812 dw	2Dh
db 'CreateCompatibleDC',0
align 4
word_1006828 dw	12h
db 'BitBlt',0
align 2
word_1006832 dw	1CAh
db 'LineDDA',0
word_100683C dw	22Fh
db 'SetPixel',0
align 4
word_1006848 dw	23Ah
db 'SetTextColor',0
align 4
word_1006858 dw	1B5h
db 'GetTextExtentPoint32W',0
word_1006870 dw	3Eh
db 'CreateFontW',0
word_100687E dw	24Dh
db 'TextOutW',0
align 2
word_100688A dw	1A5h
db 'GetStockObject',0
align 4
aGdi32_dll db 'GDI32.dll',0
word_10068A6 dw	0C8h
db 'EndPaint',0
align 2
word_10068B2 dw	0Dh
db 'BeginPaint',0
align 10h
word_10068C0 dw	10Ch
db 'GetDC',0
word_10068C8 dw	22Ah
db 'ReleaseDC',0
word_10068D4 dw	193h
db 'InvalidateRect',0
align 2
word_10068E6 dw	0C6h
db 'EndDialog',0
word_10068F2 dw	10Eh
db 'GetDesktopWindow',0
align 2
word_1006906 dw	1C8h
db 'LoadStringA',0
word_1006914 dw	229h
db 'ReleaseCapture',0
align 2
word_1006926 dw	0F3h
db 'GetCapture',0
align 4
word_1006934 dw	244h
db 'SetCapture',0
align 2
word_1006942 dw	200h
db 'PostMessageW',0
align 2
word_1006952 dw	0C2h
db 'EnableMenuItem',0
align 4
word_1006964 dw	12Ch
db 'GetMenu',0
word_100696E dw	8Fh
db 'DefWindowProcW',0
align 10h
word_1006980 dw	28Eh
db 'ShowCursor',0
align 2
word_100698E dw	201h
db 'PostQuitMessage',0
word_10069A0 dw	1B2h
db 'KillTimer',0
word_10069AC dw	0FFh
db 'GetClientRect',0
word_10069BC dw	1A6h
db 'IsIconic',0
align 4
word_10069C8 dw	1B4h
db 'LoadAcceleratorsW',0
word_10069DC dw	2BBh
db 'UpdateWindow',0
align 4
word_10069EC dw	292h
db 'ShowWindow',0
align 2
word_10069FA dw	27Ah
db 'SetTimer',0
align 2
word_1006A06 dw	61h
db 'CreateWindowExW',0
word_1006A18 dw	1
db 'AdjustWindowRect',0
align 4
word_1006A2C dw	218h
db 'RegisterClassExW',0
align 10h
word_1006A40 dw	1BEh
db 'LoadImageW',0
align 2
word_1006A4E dw	1BCh
db 'LoadIconW',0
word_1006A5A dw	228h
db 'RegisterWindowMessageW',0
align 4
word_1006A74 dw	1BAh
db 'LoadCursorW',0
word_1006A82 dw	0A2h
db 'DispatchMessageW',0
align 2
word_1006A96 dw	2AAh
db 'TranslateMessage',0
align 2
word_1006AAA dw	2A8h
db 'TranslateAcceleratorW',0
word_1006AC2 dw	13Eh
db 'GetMessageW',0
word_1006AD0 dw	195h
db 'InvertRect',0
align 2
word_1006ADE dw	192h
db 'IntersectRect',0
word_1006AEE dw	1E3h
db 'MessageBoxW',0
word_1006AFC dw	1C9h
db 'LoadStringW',0
word_1006B0A dw	24Fh
db 'SetCursorPos',0
align 2
word_1006B1A dw	40h
db 'ClientToScreen',0
align 4
word_1006B2C dw	121h
db 'GetKeyState',0
word_1006B3A dw	20Bh
db 'PtInRect',0
align 2
word_1006B46 dw	1FEh
db 'PeekMessageW',0
align 2
word_1006B56 dw	1EAh
db 'MsgWaitForMultipleObjects',0
word_1006B72 dw	0BFh
db 'DrawTextW',0
word_1006B7E dw	2D3h
db 'WinHelpW',0
align 2
word_1006B8A dw	38h
db 'CheckDlgButton',0
align 4
word_1006B9C dw	1A3h
db 'IsDlgButtonChecked',0
align 2
word_1006BB2 dw	0C4h
db 'EnableWindow',0
align 2
word_1006BC2 dw	111h
db 'GetDlgItem',0
align 10h
word_1006BD0 dw	3Bh
db 'CheckRadioButton',0
align 4
word_1006BE4 dw	9Fh
db 'DialogBoxParamW',0
word_1006BF6 dw	18Ah
db 'InflateRect',0
word_1006C04 dw	0E9h
db 'FrameRect',0
word_1006C10 dw	15Ah
db 'GetSysColor',0
word_1006C1E dw	4Ah
db 'CopyRect',0
align 2
word_1006C2A dw	256h
db 'SetFocus',0
align 2
word_1006C36 dw	99h
db 'DestroyWindow',0
word_1006C46 dw	1E9h
db 'MoveWindow',0
align 4
word_1006C54 dw	219h
db 'RegisterClassW',0
align 2
aUser32_dll db 'USER32.dll',0
align 2
word_1006C72 dw	2
db 'cdtDraw',0
word_1006C7C dw	5
db 'cdtTerm',0
word_1006C86 dw	4
db 'cdtInit',0
word_1006C90 dw	3
db 'cdtDrawExt',0
align 2
aCards_dll db 'CARDS.dll',0
word_1006CA8 dw	94h
db 'ShellAboutW',0
aShell32_dll db	'SHELL32.dll',0
word_1006CC2 dw	4Ch
db 'InitCommonControlsEx',0
align 2
aComctl32_dll db 'COMCTL32.dll',0
align 4
word_1006CE8 dw	1EBh
db 'RegQueryValueExA',0
align 4
word_1006CFC dw	1E1h
db 'RegOpenKeyExA',0
word_1006D0C dw	189h
db 'GetProcAddress',0
align 2
word_1006D1E dw	22Eh
db 'LoadLibraryA',0
align 100h
dd 80h dup(?)
_text ends

; Section 2. (virtual address 00007000)
; Virtual size			: 0000038C (	908.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 00006200
; Flags	C0000040: Data Readable	Writable
; Alignment	: default

; Segment type:	Pure data
; Segment permissions: Read/Write
_data segment para public 'DATA' use32
assume cs:_data
;org 1007000h
dword_1007000 dd 7FFFh
dword_1007004 dd 7FFFh
; int nIDDlgItem
nIDDlgItem dd 0FFFFFFFFh
; const	WCHAR ClassName
ClassName:
unicode	0, <Solitaire>,0
dword_1007020 dd 1
dword_1007024 dd 1
; int nIDCheckButton
nIDCheckButton dd 12Eh
dword_100702C dd 3
db 0FFh
db 0FFh
db 0FFh
db 0FFh
unk_1007034 db 0FEh ; þ
db 0FFh
db 0FFh
db 0FFh
db 0ECh	; ì
db 0FFh
db 0FFh
db 0FFh
db  0Ah
db    0
db    0
db    0
db    5
db    0
db    0
db    0
db    5
db    0
db    0
db    0
db 0F1h	; ñ
db 0FFh
db 0FFh
db 0FFh
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_1007054 db	  0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    5
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db 0FBh	; û
db 0FFh
db 0FFh
db 0FFh
db 0CCh	; Ì
db 0FFh
db 0FFh
db 0FFh
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_1007078 db	2Ch ; ,
db    1
db    0
db    0
db  65h	; e
db    0
db    0
db    0
db  2Dh	; -
db    1
db    0
db    0
db  65h	; e
db    0
db    0
db    0
db  2Eh	; .
db    1
db    0
db    0
db  66h	; f
db    0
db    0
db    0
db  2Fh	; /
db    1
db    0
db    0
db  66h	; f
db    0
db    0
db    0
db  30h	; 0
db    1
db    0
db    0
db  66h	; f
db    0
db    0
db    0
db  31h	; 1
db    1
db    0
db    0
db  67h	; g
db    0
db    0
db    0
db  32h	; 2
db    1
db    0
db    0
db  68h	; h
db    0
db    0
db    0
db  33h	; 3
db    1
db    0
db    0
db  69h	; i
db    0
db    0
db    0
db  34h	; 4
db    1
db    0
db    0
db  6Ah	; j
db    0
db    0
db    0
db  36h	; 6
db    1
db    0
db    0
db  6Ah	; j
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_10070D0 db	36h ; 6
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  37h	; 7
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  38h	; 8
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  39h	; 9
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  3Ah	; :
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  3Bh	; ;
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  3Ch	; <
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  3Dh	; =
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  3Eh	; >
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  3Fh	; ?
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  40h	; @
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  41h	; A
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; const	WCHAR aStat
aStat:
unicode	0, <Stat>,0
align 4
dword_1007144 dd 1
align 20h
dword_1007160 dd 0
; HACCEL hAccTable
hAccTable dd 0
dword_1007168 dd 0
dword_100716C dd 0
; HLOCAL hMem
hMem dd	0
; HDC hDC
hDC dd 0
dword_1007178 dd 0
; int x
x dd 0
; int y
y dd 0
dword_1007184 dd 0
dword_1007188 dd 0
dword_100718C dd 0
dword_1007190 dd 0
dword_1007194 dd 0
dword_1007198 dd 0
dword_100719C dd 0
dword_10071A0 dd 0
dword_10071A4 dd 0
; int cy
cy dd 0
dword_10071AC dd 0
; HDC hdc
hdc dd 0
; HGDIOBJ h
h dd 0
; HDC dword_10071B8
dword_10071B8 dd 0
; HGDIOBJ dword_10071BC
dword_10071BC dd 0
; HDC dword_10071C0
dword_10071C0 dd 0
; HGDIOBJ dword_10071C4
dword_10071C4 dd 0
db    0
db    0
db    0
db    0
dword_10071CC dd 0
dword_10071D0 dd 0
dword_10071D4 dd 0
dword_10071D8 dd 0
; int nHeight
nHeight	dd 0
; HWND dword_10071E0
dword_10071E0 dd 0
dword_10071E4 dd 0
dword_10071E8 dd 0
dword_10071EC dd 0
dword_10071F0 dd 0
align 8
; HMODULE hModule
hModule	dd 0
align 10h
dword_1007200 dd ?
align 8
dword_1007208 dd ?
dword_100720C dd ?
align 20h
; const	WCHAR Text
Text dw	?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; WCHAR	Buffer
Buffer dw ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; int dword_1007308
dword_1007308 dd ?
; int nNumber
nNumber	dd ?
dword_1007310 dd ?
align 10h
; const	WCHAR szApp
szApp dw ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; HICON	hIcon
hIcon dd ?
dword_1007338 dd ?
; HWND hWnd
hWnd dd	?
dword_1007340 dd ?
dword_1007344 dd ?
; COLORREF color
color dd ?
align 10h
; struct tagRECT Rect
Rect tagRECT <?>
dword_1007360 dd ?
dword_1007364 dd ?
dword_1007368 dd ?
; HINSTANCE hInstance
hInstance dd ?
unk_1007370 db	  ? ;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; HGDIOBJ ho
ho dd ?
dword_1007380 dd ?
dword_1007384 dd ?
dword_1007388 dd ?
align 1000h
_data ends


end start
