Function at 0x404411
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x390
push ebx
push esi
mov eax, dword [ecx + 0x1af4]
push edi
push ebp
mov ebx, ecx
push eax
mov ebp, dword [sym.imp.USER32.dll_IsIconic]
call ebp
mov ebp, ebx
mov dword [esp + 0x54], eax
mov word [esp + 0x48], 0
mov eax, dword [esp + 0x3a4]
and eax, 0xffff
add eax, ebx
mov dword [esp + 0xc4], eax
cmp eax, ebx
jbe 0x407d36
mov dword [esp + 0x58], 0
cmp word [esp + 0x48], 0
jne 0x4043fd
xor eax, eax
inc ebp
mov word [esp + 0x48], 1
mov al, byte [ebp - 1]
mov dword [esp + 0x64], eax
test al, 0x80
je 0x4043fd
and dword [esp + 0x64], 0xffffff7f
movzx ax, byte [ebp]
mov word [esp + 0x48], ax
inc ebp
mov eax, dword [esp + 0x64]
cmp eax, 0x4a
ja case.0x40440a.60
jmp dword [eax*4 + 0x407e1c]
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x88]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
lea ecx, [esp + 0x2a0]
push ecx
push eax
mov ecx, ebx
call fcn.00408dc0
mov ebp, eax
mov ecx, ebx
call fcn.004082b0
test eax, eax
je 0x407d63
mov eax, dword [ebx + 0x1a94]
mov ecx, ebx
push eax
call fcn.004092c0
mov ecx, dword [ebx + 0x1a24]
mov eax, dword [esp + 0x2a0]
push eax
mov edx, dword [ebx + 0x1a50]
push 0
mov esi, dword [ecx + 8]
push 0
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x98]
push esi
push eax
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x1a94]
push ecx
mov ecx, ebx
call fcn.00409370
mov eax, dword [ebx + 0x1a24]
push 2
mov ecx, dword [eax + 4]
add ecx, dword [esp + 0x8c]
mov edx, dword [ebx + 0x1a94]
mov dword [esp + 0x94], ecx
lea ecx, [esp + 0x8c]
mov eax, dword [eax + 8]
push ecx
add eax, dword [esp + 0x94]
push edx
mov dword [esp + 0xa0], eax
call dword [sym.imp.GDI32.dll_DPtoLP]
cmp dword [esp + 0x54], 0
jne 0x404564
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0x8c]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0x8c]
push 0xcc0020
mov edx, dword [esp + 0x8c]
push ecx
mov dword [esp + 0x60], eax
push edx
mov eax, dword [ebx + 0x1a94]
push eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x9c]
push eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x9c]
push eax
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1a50]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1a50], 0
mov dword [ebx + 0x1a54], 0
jmp 0x407cea
lea eax, [esp + 0x98]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
mov ebp, eax
mov ecx, ebx
mov eax, dword [ebx + 0x1a90]
push eax
call fcn.004092c0
mov eax, dword [ebx + 0x1a94]
mov ecx, ebx
push eax
call fcn.004092c0
mov eax, dword [ebx + 0x1a24]
push 0xcc0020
mov ecx, dword [ebx + 0x1a20]
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
mov edx, dword [ebx + 0x1a58]
xor eax, eax
mov ax, word [ebx + 0x1b16]
push eax
push ecx
push edx
push edi
mov eax, dword [esp + 0xb0]
push esi
mov ecx, dword [esp + 0xb0]
push 0
push 0
mov edx, dword [ebx + 0x1a94]
push edi
push esi
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_StretchDIBits]
cmp dword [esp + 0x54], 0
jne 0x404685
mov eax, dword [esp + 0x9c]
push edi
mov ecx, dword [esp + 0x9c]
push esi
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.00407f50
mov ecx, dword [esp + 0x9c]
push 0xcc0020
mov edx, dword [esp + 0x9c]
push ecx
mov dword [esp + 0x60], eax
push edx
mov eax, dword [ebx + 0x1a94]
push eax
push edi
push esi
mov eax, dword [ebx + 0x1ae0]
add eax, dword [esp + 0xb4]
mov ecx, dword [ebx + 0x1a90]
push eax
mov eax, dword [ebx + 0x1adc]
add eax, dword [esp + 0xb4]
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1a94]
mov ecx, ebx
push eax
call fcn.00409370
mov eax, dword [ebx + 0x1a90]
mov ecx, ebx
push eax
call fcn.00409370
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407cea
push eax
mov ecx, ebx
call fcn.00408950
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407cea
lea eax, [esp + 0xa8]
mov ecx, ebx
push eax
push ebp
call fcn.004092a0
lea ecx, [esp + 0x80]
push ecx
push eax
mov ecx, ebx
call fcn.00409240
lea ecx, [esp + 0x1b0]
push ecx
push eax
mov ecx, ebx
call fcn.00408dc0
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x40483c
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb0]
mov edx, dword [esp + 0x84]
push eax
mov eax, dword [esp + 0x84]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00407f50
mov dword [esp + 0x58], eax
test eax, eax
je 0x40474e
mov ecx, ebx
call fcn.004086d0
jmp 0x404780
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb0]
mov edx, dword [esp + 0xac]
push eax
mov eax, dword [esp + 0xac]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00407f50
mov dword [esp + 0x58], eax
lea eax, [esp + 0x304]
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetClipBox]
cmp eax, 2
jne 0x4047f0
mov eax, dword [esp + 0x304]
cmp dword [esp + 0x80], eax
jl 0x4047f0
mov eax, dword [esp + 0x308]
cmp dword [esp + 0x84], eax
jl 0x4047f0
mov eax, dword [esp + 0xb0]
add eax, dword [esp + 0x80]
cmp eax, dword [esp + 0x30c]
jg 0x4047f0
mov eax, dword [esp + 0x84]
add eax, dword [esp + 0xb4]
cmp eax, dword [esp + 0x310]
jg 0x4047f0
mov ecx, dword [ebx + 0x1a90]
jmp 0x4047f6
mov ecx, dword [ebx + 0x1a94]
mov eax, dword [esp + 0x1b0]
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0xb8]
push edx
mov edx, dword [esp + 0xb4]
push esi
push ecx
push eax
mov ecx, dword [esp + 0xc4]
mov eax, dword [esp + 0xbc]
push ecx
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x1a94]
mov eax, dword [esp + 0x1b0]
mov edx, dword [esp + 0x84]
push eax
mov esi, dword [esp + 0x84]
push edx
mov eax, dword [esp + 0xbc]
push esi
mov edx, dword [esp + 0xbc]
push ecx
mov esi, dword [esp + 0xbc]
push eax
mov eax, dword [esp + 0xbc]
push edx
push esi
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x110]
mov ecx, ebx
push eax
push ebp
call fcn.004092a0
mov dword [esp + 0xb8], 0xf00021
cmp dword [esp + 0x64], 3
mov ebp, eax
jne 0x4048c4
lea eax, [esp + 0xb8]
mov ecx, ebx
push eax
push ebp
call fcn.00408dc0
mov ebp, eax
cmp dword [esp + 0x54], 0
jne 0x404932
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
push eax
mov eax, dword [esp + 0x114]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00407f50
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0x11c]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x11c]
push edx
mov ecx, dword [esp + 0x11c]
push eax
mov edx, dword [esp + 0x11c]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push eax
mov eax, dword [esp + 0x118]
push ecx
mov ecx, dword [esp + 0x118]
push edx
push eax
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x120]
mov ecx, ebx
push eax
push ebp
call fcn.004092a0
lea ecx, [esp + 0x228]
push ecx
push eax
mov ecx, ebx
call fcn.004092a0
lea ecx, [esp + 0x1b4]
push ecx
push eax
mov ecx, ebx
call fcn.00408dc0
mov ebp, eax
mov ecx, ebx
call fcn.004082b0
test eax, eax
je 0x407d6a
cmp dword [esp + 0x54], 0
jne 0x404a4d
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
push eax
mov eax, dword [esp + 0x124]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00407f50
mov ecx, dword [esp + 0x1b4]
mov edx, dword [esp + 0x234]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x234]
push edx
mov ecx, dword [esp + 0x234]
push eax
mov edx, dword [esp + 0x234]
push ecx
push edx
mov eax, dword [ebx + 0x1a50]
mov ecx, dword [esp + 0x140]
push eax
mov edx, dword [esp + 0x140]
push ecx
mov eax, dword [esp + 0x140]
push edx
mov ecx, dword [esp + 0x140]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x1b4]
mov ecx, dword [esp + 0x234]
mov edx, dword [esp + 0x230]
push eax
mov eax, dword [esp + 0x230]
push ecx
mov ecx, dword [esp + 0x230]
push edx
push eax
mov edx, dword [ebx + 0x1a50]
mov eax, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push eax
mov eax, dword [esp + 0x13c]
push ecx
push edx
mov ecx, dword [ebx + 0x1a94]
push eax
push ecx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, dword [ebx + 0x1a50]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebx + 0x1a54]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1a50], 0
mov dword [ebx + 0x1a54], 0
jmp 0x407cea
lea eax, [esp + 0x130]
mov ecx, ebx
push eax
push ebp
call fcn.004092a0
lea ecx, [esp + 0x238]
push ecx
push eax
mov ecx, ebx
call fcn.004092a0
lea ecx, [esp + 0x1b8]
push ecx
push eax
mov ecx, ebx
call fcn.00408dc0
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x404ba7
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
push eax
mov eax, dword [esp + 0x134]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00407f50
mov ecx, dword [esp + 0x1b8]
mov edx, dword [esp + 0x244]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x244]
push edx
mov ecx, dword [esp + 0x244]
push eax
mov edx, dword [esp + 0x244]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
mov ecx, dword [esp + 0x150]
push eax
mov edx, dword [esp + 0x150]
push ecx
mov eax, dword [esp + 0x150]
push edx
mov ecx, dword [esp + 0x150]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, dword [ebx + 0x1a94]
mov eax, dword [esp + 0x1b8]
mov edx, dword [esp + 0x244]
push eax
mov esi, dword [esp + 0x244]
push edx
mov eax, dword [esp + 0x244]
push esi
mov edx, dword [esp + 0x244]
push eax
mov esi, dword [esp + 0x14c]
push edx
mov eax, dword [esp + 0x14c]
push ecx
mov edx, dword [esp + 0x14c]
push esi
mov esi, dword [esp + 0x14c]
push eax
push edx
push esi
push ecx
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0xc8]
mov ecx, ebx
push eax
push ebp
call fcn.004092a0
lea ecx, [esp + 0x314]
push ecx
push eax
mov ecx, ebx
call fcn.004092a0
lea ecx, [esp + 0x2a4]
push ecx
push eax
mov ecx, ebx
call fcn.00408dc0
mov ebp, eax
mov ecx, dword [esp + 0xd0]
mov eax, dword [esp + 0xd4]
mov edx, dword [esp + 0xcc]
push eax
push ecx
mov eax, dword [esp + 0xd0]
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
mov ecx, ebx
call fcn.00407f50
mov ecx, dword [esp + 0x2a4]
mov dword [esp + 0x58], eax
push ecx
xor eax, eax
mov ax, word [ebx + 0x1b16]
mov ecx, dword [ebx + 0x1a20]
push eax
mov edx, dword [ebx + 0x1a58]
mov eax, dword [esp + 0x328]
push ecx
mov ecx, dword [esp + 0x328]
push edx
mov edx, dword [esp + 0x328]
push eax
mov eax, dword [esp + 0x328]
push ecx
mov ecx, dword [esp + 0xec]
push edx
mov edx, dword [esp + 0xec]
push eax
mov eax, dword [esp + 0xec]
push ecx
mov ecx, dword [esp + 0xec]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0xcc0020
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xcc]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
mov ecx, dword [esp + 0xe0]
push eax
mov edx, dword [esp + 0xe0]
push ecx
mov eax, dword [esp + 0xe0]
push edx
mov ecx, dword [esp + 0xe0]
push eax
push ecx
mov edx, dword [ebx + 0x1a94]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407cea
push eax
mov ecx, ebx
call fcn.00408950
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407cea
lea eax, [esp + 0xd8]
mov ecx, ebx
push eax
push ebp
call fcn.004092a0
lea ecx, [esp + 0x2c0]
push ecx
push eax
mov ecx, ebx
call fcn.00409240
mov ebp, eax
mov ecx, dword [esp + 0xe4]
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x2cc], ecx
mov dword [esp + 0x2c8], eax
mov dword [esp + 0x148], eax
lea edx, [esp + 0x140]
push 2
push edx
mov eax, dword [ebx + 0x1a94]
mov dword [esp + 0x154], ecx
push eax
mov dword [esp + 0x150], 0
mov dword [esp + 0x14c], 0
call dword [sym.imp.GDI32.dll_DPtoLP]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
mov eax, dword [esp + 0xe4]
sub dword [esp + 0x148], ecx
mov ecx, dword [esp + 0xe0]
push eax
mov eax, dword [esp + 0xdc]
push ecx
mov ecx, dword [ebx + 0x1a90]
sub dword [esp + 0x154], edx
mov edx, dword [esp + 0xe4]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.00407f50
push 0xcc0020
mov ecx, dword [ebx + 0x1a20]
mov edx, dword [ebx + 0x1a58]
mov dword [esp + 0x5c], eax
xor eax, eax
mov ax, word [ebx + 0x1b16]
push eax
push ecx
mov eax, dword [esp + 0x2d8]
push edx
mov ecx, dword [esp + 0x2d8]
push eax
mov edx, dword [esp + 0x2d8]
push ecx
mov eax, dword [esp + 0x2d8]
push edx
mov ecx, dword [esp + 0x168]
push eax
push ecx
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x100]
push edx
mov ecx, dword [esp + 0x100]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov ecx, dword [esp + 0xdc]
push 0xcc0020
mov edx, dword [esp + 0xdc]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
mov ecx, dword [esp + 0x158]
push eax
mov edx, dword [esp + 0x158]
push ecx
mov eax, dword [esp + 0xf0]
push edx
mov ecx, dword [esp + 0xf0]
push eax
push ecx
mov edx, dword [ebx + 0x1a94]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407cea
push eax
mov ecx, ebx
call fcn.00408950
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407cea
mov ecx, ebx
call fcn.00408420
lea eax, [esp + 0x42]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
lea ecx, [esp + 0xe8]
push ecx
push eax
mov ecx, ebx
call fcn.00409240
cmp dword [esp + 0x54], 0
mov ebp, eax
je 0x404f41
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetTextAlign]
test al, 1
je 0x404fd0
lea eax, [esp + 0x324]
push 0
mov ecx, dword [esp + 0x46]
push eax
push ecx
mov edx, dword [ebx + 0x1b86]
mov eax, dword [esp + 0xf8]
push ebp
mov ecx, dword [esp + 0xf8]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.00409430
mov ecx, dword [esp + 0x330]
mov edx, dword [esp + 0x32c]
mov eax, dword [esp + 0x328]
push ecx
mov ecx, dword [esp + 0x328]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0xec]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x42]
mov edx, dword [esp + 0xe8]
and eax, 0xffff
push eax
push ebp
push ecx
mov eax, dword [ebx + 0x1a90]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [esp + 0x42]
mov ecx, dword [esp + 0xec]
and eax, 0xffff
mov edx, dword [esp + 0xe8]
push eax
push ebp
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [esp + 0x42]
and eax, 0xffff
add ebp, eax
jmp 0x407cea
mov ecx, ebx
call fcn.00408420
lea eax, [esp + 0xf0]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
mov cl, byte [eax]
inc eax
mov dword [esp + 0x50], 0
mov dword [esp + 0x5c], 0
test cl, 0x80
mov byte [esp + 0x60], cl
je 0x40504f
lea ecx, [esp + 0x390]
mov dword [esp + 0x50], ecx
push ecx
push eax
mov ecx, ebx
call fcn.00408c90
lea ecx, [esp + 0x4c]
push ecx
push eax
mov ecx, ebx
call fcn.00408df0
test byte [esp + 0x60], 0x40
mov ebp, eax
je 0x4050a2
mov eax, dword [ebx + 0x1a58]
xor edi, edi
cmp word [esp + 0x4c], di
mov dword [esp + 0x5c], eax
jbe 0x4050a2
mov esi, eax
lea eax, [esp + 0x12]
mov ecx, ebx
push eax
add esi, 4
push ebp
inc edi
call fcn.00408e30
mov ebp, eax
movsx eax, word [esp + 0x12]
mov dword [esi - 4], eax
mov eax, dword [esp + 0x4c]
and eax, 0xffff
cmp eax, edi
jg 0x40507a
and byte [esp + 0x60], 6
cmp dword [esp + 0x54], 0
je 0x4050c3
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetTextAlign]
test al, 1
je 0x405174
lea eax, [esp + 0x334]
mov ecx, dword [esp + 0x5c]
movzx si, byte [esp + 0x60]
push eax
push ecx
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
and eax, 0xffff
mov edx, dword [ebx + 0x1b86]
push eax
push ebp
mov eax, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0x104]
push esi
push edx
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
mov ecx, ebx
call fcn.00409610
mov ecx, dword [esp + 0x340]
mov edx, dword [esp + 0x33c]
mov eax, dword [esp + 0x338]
push ecx
mov ecx, dword [esp + 0x338]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x4c]
push ecx
and eax, 0xffff
mov ecx, dword [esp + 0x54]
movzx edx, si
push eax
push ebp
mov eax, dword [esp + 0x100]
push ecx
mov ecx, dword [esp + 0x100]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
and eax, 0xffff
push eax
push ebp
push ecx
xor eax, eax
mov al, byte [esp + 0x70]
mov ecx, dword [esp + 0x104]
mov edx, dword [esp + 0x100]
push eax
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov eax, dword [esp + 0x4c]
and eax, 0xffff
add ebp, eax
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x150]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
lea ecx, [esp + 0x248]
push ecx
push eax
mov ecx, ebx
call fcn.00408c90
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x40526c
mov eax, dword [esp + 0x15c]
mov ecx, dword [esp + 0x158]
mov edx, dword [esp + 0x154]
push eax
mov eax, dword [esp + 0x154]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0x254]
mov edx, dword [esp + 0x250]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x250]
push edx
mov ecx, dword [esp + 0x250]
push eax
mov edx, dword [esp + 0x168]
push ecx
mov eax, dword [esp + 0x168]
push edx
mov ecx, dword [esp + 0x168]
push eax
mov edx, dword [esp + 0x168]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_Arc]
mov eax, dword [esp + 0x254]
mov ecx, dword [esp + 0x250]
mov edx, dword [esp + 0x24c]
push eax
mov eax, dword [esp + 0x24c]
push ecx
mov ecx, dword [esp + 0x164]
push edx
mov edx, dword [esp + 0x164]
push eax
mov eax, dword [esp + 0x164]
push ecx
mov ecx, dword [esp + 0x164]
push edx
push eax
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x160]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
lea ecx, [esp + 0x258]
push ecx
push eax
mov ecx, ebx
call fcn.00408c90
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x40536d
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x168]
mov edx, dword [esp + 0x164]
push eax
mov eax, dword [esp + 0x164]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0x264]
mov edx, dword [esp + 0x260]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x260]
push edx
mov ecx, dword [esp + 0x260]
push eax
mov edx, dword [esp + 0x178]
push ecx
mov eax, dword [esp + 0x178]
push edx
mov ecx, dword [esp + 0x178]
push eax
mov edx, dword [esp + 0x178]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_Chord]
mov eax, dword [esp + 0x264]
mov ecx, dword [esp + 0x260]
mov edx, dword [esp + 0x25c]
push eax
mov eax, dword [esp + 0x25c]
push ecx
mov ecx, dword [esp + 0x174]
push edx
mov edx, dword [esp + 0x174]
push eax
mov eax, dword [esp + 0x174]
push ecx
mov ecx, dword [esp + 0x174]
push edx
push eax
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_Chord]
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x170]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x40543e
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x178]
mov edx, dword [esp + 0x174]
push eax
mov eax, dword [esp + 0x174]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0x17c]
mov edx, dword [esp + 0x178]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x178]
push edx
mov ecx, dword [esp + 0x178]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_Ellipse]
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x178]
mov edx, dword [esp + 0x174]
push eax
mov eax, dword [esp + 0x174]
push ecx
push edx
mov ecx, dword [ebx + 0x1a94]
push eax
push ecx
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x180]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
lea ecx, [esp + 0x268]
push ecx
push eax
mov ecx, ebx
call fcn.00408c90
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x40551f
mov eax, dword [esp + 0x18c]
mov ecx, dword [esp + 0x188]
mov edx, dword [esp + 0x184]
push eax
mov eax, dword [esp + 0x184]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0x274]
mov edx, dword [esp + 0x270]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x270]
push edx
mov ecx, dword [esp + 0x270]
push eax
mov edx, dword [esp + 0x198]
push ecx
mov eax, dword [esp + 0x198]
push edx
mov ecx, dword [esp + 0x198]
push eax
mov edx, dword [esp + 0x198]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_Pie]
mov eax, dword [esp + 0x274]
mov ecx, dword [esp + 0x270]
mov edx, dword [esp + 0x26c]
push eax
mov eax, dword [esp + 0x26c]
push ecx
mov ecx, dword [esp + 0x194]
push edx
mov edx, dword [esp + 0x194]
push eax
mov eax, dword [esp + 0x194]
push ecx
mov ecx, dword [esp + 0x194]
push edx
push eax
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_Pie]
jmp 0x407cea
lea eax, [esp + 0xa0]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x4055ba
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa0]
push eax
mov edx, dword [ebx + 0x1a6c]
push ecx
mov eax, dword [ebx + 0x1a68]
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa0]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_LineTo]
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0xa0]
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_LineTo]
lea eax, [ebx + 0x1a68]
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x407cea
lea eax, [esp + 0xf8]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
lea ecx, [esp + 0x2e0]
lea esi, [ebx + 0x1a68]
push ecx
push eax
mov ecx, ebx
call fcn.00409240
mov ebp, eax
mov ecx, dword [esp + 0x2e4]
mov eax, dword [esp + 0x2e0]
push 0
mov edx, dword [ebx + 0x1a90]
mov dword [esi], eax
mov eax, dword [esp + 0x100]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0xfc]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [esp + 0xfc]
push 0
mov edx, dword [esp + 0xfc]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
cmp dword [esp + 0x54], 0
jne 0x4056be
mov eax, dword [ebx + 0x1a6c]
mov ecx, dword [esi]
mov edx, dword [esp + 0xfc]
push eax
mov eax, dword [esp + 0xfc]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov dword [esp + 0x58], eax
mov eax, dword [ebx + 0x1a6c]
mov ecx, dword [esi]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_LineTo]
mov ecx, dword [ebx + 0x1a6c]
mov edx, dword [esi]
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x407cea
lea eax, [esp + 0x100]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
lea ecx, [esp + 0x1bc]
push ecx
push eax
mov ecx, ebx
call fcn.00408d70
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x405765
mov eax, dword [esp + 0x104]
push 1
mov ecx, dword [esp + 0x104]
push 1
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.00407f50
mov ecx, dword [esp + 0x1bc]
mov edx, dword [esp + 0x104]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x104]
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [esp + 0x1bc]
mov ecx, dword [esp + 0x104]
mov edx, dword [esp + 0x100]
push eax
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x407cea
cmp word [ebx + 0x1b0a], 0
jne 0x4057e3
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ax, word [esp + 0x28]
mov word [ebx + 0x1b08], ax
mov eax, dword [esp + 0x28]
and eax, 0xffff
shl eax, 3
cmp eax, 0x15f4
jbe 0x4057e3
push eax
mov ecx, ebx
call fcn.00408970
mov dword [ebx + 0x1a5c], eax
mov dword [ebx + 0x1a58], eax
test eax, eax
je 0x407d71
lea eax, [esp + 0x68]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
mov cx, word [ebx + 0x1b0a]
mov ebp, eax
test cx, cx
mov eax, dword [esp + 0x68]
jne 0x405820
mov edx, dword [esp + 0x6c]
mov dword [ebx + 0x1b00], eax
mov dword [ebx + 0x1af8], eax
mov dword [ebx + 0x1b04], edx
mov dword [ebx + 0x1afc], edx
jmp 0x405868
cmp dword [ebx + 0x1af8], eax
jle 0x405830
mov dword [ebx + 0x1af8], eax
jmp 0x405842
mov eax, dword [esp + 0x68]
cmp dword [ebx + 0x1b00], eax
jge 0x405842
mov dword [ebx + 0x1b00], eax
mov eax, dword [esp + 0x6c]
cmp dword [ebx + 0x1afc], eax
jle 0x405856
mov dword [ebx + 0x1afc], eax
jmp 0x405868
mov eax, dword [esp + 0x6c]
cmp dword [ebx + 0x1b04], eax
jge 0x405868
mov dword [ebx + 0x1b04], eax
movzx eax, cx
shl eax, 3
add eax, dword [ebx + 0x1a58]
mov edx, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
mov dword [eax], edx
mov dword [eax + 4], esi
mov ax, word [ebx + 0x1b0a]
inc ax
mov word [ebx + 0x1b0a], ax
cmp word [ebx + 0x1b08], ax
je 0x4058a2
test al, al
jne 0x4057e3
mov ax, word [ebx + 0x1b0a]
cmp word [ebx + 0x1b08], ax
jne 0x407cea
mov eax, dword [ebx + 0x1b04]
mov ecx, dword [ebx + 0x1b00]
push eax
mov edx, dword [ebx + 0x1afc]
push ecx
mov eax, dword [ebx + 0x1af8]
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
cmp dword [esp + 0x64], 0x12
mov dword [esp + 0x58], eax
jne 0x405937
mov ecx, ebx
call fcn.004083a0
xor eax, eax
mov ecx, dword [ebx + 0x1a58]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a94]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Polygon]
cmp dword [esp + 0x54], 0
jne 0x40597a
xor eax, eax
mov ecx, dword [ebx + 0x1a58]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a90]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x40597a
cmp dword [esp + 0x54], 0
jne 0x40595c
xor eax, eax
mov ecx, dword [ebx + 0x1a58]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a90]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Polyline]
xor eax, eax
mov ecx, dword [ebx + 0x1a58]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a94]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Polyline]
mov word [ebx + 0x1b0a], 0
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407cea
push eax
mov ecx, ebx
call fcn.00408950
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x190]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x405a33
mov eax, dword [esp + 0x19c]
mov ecx, dword [esp + 0x198]
mov edx, dword [esp + 0x194]
push eax
mov eax, dword [esp + 0x194]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0x19c]
mov edx, dword [esp + 0x198]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x198]
push edx
mov ecx, dword [esp + 0x198]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_Rectangle]
mov eax, dword [esp + 0x19c]
mov ecx, dword [esp + 0x198]
mov edx, dword [esp + 0x194]
push eax
mov eax, dword [esp + 0x194]
push ecx
push edx
mov ecx, dword [ebx + 0x1a94]
push eax
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x1a0]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
lea ecx, [esp + 0x1e8]
push ecx
push eax
mov ecx, ebx
call fcn.00409270
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x405b04
mov eax, dword [esp + 0x1ac]
mov ecx, dword [esp + 0x1a8]
mov edx, dword [esp + 0x1a4]
push eax
mov eax, dword [esp + 0x1a4]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov ecx, dword [esp + 0x1ec]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x58], eax
push ecx
mov eax, dword [esp + 0x1b0]
push edx
mov ecx, dword [esp + 0x1b0]
push eax
mov edx, dword [esp + 0x1b0]
push ecx
mov eax, dword [esp + 0x1b0]
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_RoundRect]
mov eax, dword [esp + 0x1ec]
mov ecx, dword [esp + 0x1e8]
mov edx, dword [esp + 0x1ac]
push eax
mov eax, dword [esp + 0x1ac]
push ecx
mov ecx, dword [esp + 0x1ac]
push edx
mov edx, dword [esp + 0x1ac]
push eax
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x407cea
lea eax, [esp + 0x1f0]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
lea ecx, [esp + 0x1c0]
push ecx
push eax
mov ecx, ebx
call fcn.00408d70
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x405bac
cmp dword [ebx + 0x1ad8], 0
je 0x405b87
mov ecx, ebx
call fcn.004086d0
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x1f4]
mov edx, dword [esp + 0x1f0]
push eax
push ecx
mov eax, dword [ebx + 0x1a90]
push edx
push eax
call dword [sym.imp.GDI32.dll_FloodFill]
mov eax, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x1f4]
mov edx, dword [esp + 0x1f0]
push eax
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_FloodFill]
jmp 0x407cea
lea eax, [esp + 0x1f8]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
lea ecx, [esp + 0x1c4]
push ecx
push eax
mov ecx, ebx
call fcn.00408d70
lea ecx, [esp + 0x2a]
push ecx
push eax
mov ecx, ebx
call fcn.00408df0
cmp dword [esp + 0x54], 0
mov ebp, eax
jne 0x405c53
cmp dword [ebx + 0x1ad8], 0
je 0x405c24
mov ecx, ebx
call fcn.004086d0
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x2a]
mov ecx, dword [esp + 0x1c4]
and eax, 0xffff
mov edx, dword [esp + 0x1fc]
push eax
push ecx
mov eax, dword [esp + 0x200]
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov eax, dword [esp + 0x2a]
mov ecx, dword [esp + 0x1c4]
and eax, 0xffff
mov edx, dword [esp + 0x1fc]
push eax
push ecx
mov eax, dword [esp + 0x200]
push edx
push eax
mov ecx, dword [ebx + 0x1a94]
push ecx
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x407cea
lea eax, [esp + 0xbc]
mov ecx, ebx
push eax
push ebp
call fcn.00408d70
cmp dword [ebx + 0x1b70], 0
mov ebp, eax
mov eax, dword [esp + 0xbc]
mov dword [ebx + 0x1b74], eax
jne 0x407cea
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esp + 0xbc]
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x407cea
lea eax, [esp + 0xc0]
mov ecx, ebx
push eax
push ebp
call fcn.00408d70
cmp dword [ebx + 0x1b70], 0
mov ebp, eax
mov eax, dword [esp + 0xc0]
mov dword [ebx + 0x1b78], eax
jne 0x407cea
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0xc0]
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x407cea
lea eax, [esp + 0x2c]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x2c]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
jmp 0x407cea
lea eax, [esp + 0x2e]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x2e]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetROP2]
mov eax, dword [esp + 0x2e]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x407cea
lea eax, [esp + 0x30]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x30]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov eax, dword [esp + 0x30]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x407cea
lea eax, [esp + 0x32]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x32]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov eax, dword [esp + 0x32]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
jmp 0x407cea
lea eax, [esp + 0x44]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov eax, dword [esp + 0x44]
and eax, 0xffff
cmp eax, 2
jl 0x405e60
cmp eax, 6
jg 0x405e60
mov word [esp + 0x44], 8
mov eax, dword [esp + 0x44]
mov ecx, dword [ebx + 0x1a90]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetMapMode]
mov eax, dword [esp + 0x44]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x407cea
mov cl, byte [ebp]
xor eax, eax
shr cl, 4
mov al, cl
xor ecx, ecx
inc ebp
push 0
mov dword [esp + 0x10c], eax
mov al, byte [ebp - 1]
and al, 7
mov edx, dword [ebx + 0x1a94]
mov cl, al
mov eax, dword [esp + 0x10c]
mov dword [esp + 0x110], ecx
push ecx
push eax
push edx
call dword [sym.imp.GDI32.dll_SetBrushOrgEx]
lea ecx, [esp + 0x108]
mov edx, dword [ebx + 0x1af4]
push ecx
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0x10c]
push 0
mov edx, dword [esp + 0x10c]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SetBrushOrgEx]
jmp 0x407cea
lea eax, [esp + 0x200]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
mov ebp, eax
push 0
mov eax, dword [ebx + 0x1ae0]
mov ecx, dword [ebx + 0x1a90]
add eax, dword [esp + 0x208]
push eax
mov eax, dword [ebx + 0x1adc]
add eax, dword [esp + 0x208]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov ecx, dword [esp + 0x204]
push 0
mov edx, dword [esp + 0x204]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x407cea
lea eax, [esp + 0x208]
mov ecx, ebx
push eax
push ebp
call fcn.00409270
mov ebp, eax
push 0
mov eax, dword [esp + 0x210]
mov ecx, dword [esp + 0x20c]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov ecx, dword [esp + 0x20c]
push 0
mov edx, dword [esp + 0x20c]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x407cea
lea eax, [esp + 0x210]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
mov ebp, eax
push 0
mov eax, dword [esp + 0x218]
mov ecx, dword [esp + 0x214]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov ecx, dword [esp + 0x214]
push 0
mov edx, dword [esp + 0x214]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x407cea
lea eax, [esp + 0x218]
mov ecx, ebx
push eax
push ebp
call fcn.00409270
mov ebp, eax
push 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov ecx, dword [esp + 0x21c]
push 0
mov edx, dword [esp + 0x21c]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x407cea
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
lea esi, [ebx + 0x1a34]
push ebp
call fcn.00408df0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x2e8]
and ecx, 0xffff
push edx
push eax
lea edi, [ebx + 0x1a38]
mov dword [esi], ecx
mov ecx, ebx
call fcn.00409270
mov ecx, dword [esp + 0x2e8]
mov edx, dword [esp + 0x2ec]
mov dword [edi], ecx
lea ecx, [esp + 0x2a8]
push ecx
mov dword [edi + 4], edx
push eax
mov ecx, ebx
call fcn.00408d70
mov ebp, eax
push esi
mov eax, dword [esp + 0x2ac]
mov dword [ebx + 0x1a40], eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov esi, eax
test esi, esi
je 0x407d78
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b60], 0
jne 0x40610a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b60], 0
jmp 0x407cea
lea esi, [ebx + 0x1a34]
lea eax, [esp + 0x2f0]
push eax
mov ecx, ebx
push ebp
lea edi, [ebx + 0x1a38]
mov dword [esi], 0
call fcn.00409270
mov ecx, dword [esp + 0x2f0]
mov edx, dword [esp + 0x2f4]
mov dword [edi], ecx
lea ecx, [esp + 0x2ac]
push ecx
mov dword [edi + 4], edx
push eax
mov ecx, ebx
call fcn.00408d70
mov ebp, eax
push esi
mov eax, dword [esp + 0x2b0]
mov dword [ebx + 0x1a40], eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov esi, eax
test esi, esi
je 0x407d7f
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b60], 0
jne 0x4061aa
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b60], 0
jmp 0x407cea
lea eax, [ebx + 0x1a34]
push eax
mov dword [eax], 5
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov esi, eax
test esi, esi
je 0x407d86
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b60], 0
jne 0x406202
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b60], 0
jmp 0x407cea
mov al, byte [ebp]
xor ecx, ecx
and al, 1
inc ebp
mov cl, al
mov eax, dword [ebx + 0x1a90]
mov esi, dword [ebx + ecx*4 + 0x1b54]
push esi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b60], 0
jne 0x407cea
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b60], 1
jmp 0x407cea
lea eax, [esp + 0x16]
mov ecx, ebx
push eax
lea esi, [ebx + 0x1a28]
push ebp
call fcn.00408df0
mov ecx, dword [esp + 0x16]
lea edx, [esp + 0x2b0]
and ecx, 0xffff
push edx
push eax
mov dword [esi], ecx
mov ecx, ebx
call fcn.00408d70
mov ecx, dword [esp + 0x2b0]
lea edx, [esp + 0x18]
push edx
mov dword [ebx + 0x1a2c], ecx
push eax
mov ecx, ebx
call fcn.00408e30
mov ebp, eax
push esi
movsx ecx, word [esp + 0x1c]
mov dword [ebx + 0x1a30], ecx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov esi, eax
test esi, esi
je 0x407d8d
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x4062f4
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
mov dword [ebx + 0x1b6c], 0
jmp 0x407cea
mov ecx, ebx
call fcn.004082b0
test eax, eax
je 0x407d94
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov esi, eax
test esi, esi
je 0x407d9b
mov eax, dword [ebx + 0x1a50]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov eax, dword [ebx + 0x1a94]
mov dword [ebx + 0x1a50], 0
mov dword [ebx + 0x1a54], 0
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x40638d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
cmp dword [ebx + 0x1b64], 0
je 0x4063c3
cmp word [ebx + 0x1b18], 0
jne 0x4063b4
cmp word [ebx + 0x1b1a], 1
je 0x4063c3
mov dword [ebx + 0x1b6c], 1
jmp 0x407cea
mov dword [ebx + 0x1b6c], 0
jmp 0x407cea
mov al, byte [ebp]
inc ebp
mov ecx, ebx
mov byte [esp + 0x50], al
call fcn.004082b0
test eax, eax
je 0x407da2
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov esi, eax
test esi, esi
je 0x407da9
mov eax, dword [ebx + 0x1a50]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
mov al, byte [esp + 0x50]
mov dword [ebx + 0x1a54], 0
lea edi, [ebx + eax*4 + 0x1b1c]
mov dword [ebx + 0x1a50], 0
mov eax, dword [edi]
test eax, eax
je 0x406448
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov dword [edi], esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x406480
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 1
mov eax, dword [ebx + 0x1b64]
mov dword [ebx + 0x1b6c], eax
jmp 0x407cea
lea esi, [ebx + 0x1a28]
lea eax, [esp + 0x2b4]
push eax
mov ecx, ebx
push ebp
mov dword [esi], 2
call fcn.00408d70
mov ecx, dword [esp + 0x2b4]
lea edx, [esp + 0x1a]
push edx
mov dword [ebx + 0x1a2c], ecx
push eax
mov ecx, ebx
call fcn.00408df0
mov ebp, eax
push esi
mov eax, dword [esp + 0x1e]
and eax, 0xffff
mov dword [ebx + 0x1a30], eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov esi, eax
test esi, esi
je 0x407db0
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x406515
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
mov dword [ebx + 0x1b6c], 0
jmp 0x407cea
mov ax, word [ebx + 0x1b16]
mov esi, dword [ebx + 0x1a24]
push eax
mov ecx, ebx
push esi
call fcn.004096d0
add ax, word [esi]
mov esi, dword [ebx + 0x1a24]
movzx edx, ax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x50], edx
add eax, edx
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x5c], eax
test eax, eax
je 0x407db7
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esp + 0x50]
mov edi, eax
mov esi, dword [ebx + 0x1a24]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1a24]
mov edi, dword [esp + 0x50]
mov dx, word [ecx + 0x14]
add edi, eax
mov esi, dword [ebx + 0x1a58]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
mov ecx, dword [esp + 0x5c]
mov ax, word [ebx + 0x1b16]
lea edx, [esp + 0x2f8]
mov dword [esp + 0x2fc], eax
push edx
mov dword [esp + 0x2fc], 5
mov dword [esp + 0x304], ecx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov esi, eax
test esi, esi
je 0x407dbe
mov eax, dword [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x406631
push eax
mov ecx, ebx
call fcn.00408950
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x40665d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
cmp dword [ebx + 0x1b68], 0
jne 0x40669c
cmp dword [ebx + 0x1b64], 0
je 0x40669c
cmp word [ebx + 0x1b18], 0
jne 0x40668d
cmp word [ebx + 0x1b1a], 1
je 0x40669c
mov dword [ebx + 0x1b6c], 1
jmp 0x407cea
mov dword [ebx + 0x1b6c], 0
jmp 0x407cea
lea eax, [ebx + 0x1a28]
push eax
mov dword [eax], 1
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov esi, eax
test esi, esi
je 0x407dc5
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x4066f4
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
mov dword [ebx + 0x1b6c], 0
jmp 0x407cea
mov cl, byte [ebp]
inc ebp
mov al, cl
and al, 0x80
je 0x406727
and cl, 1
xor edx, edx
mov dl, cl
mov esi, dword [ebx + edx*4 + 0x1b4c]
jmp 0x406732
xor edx, edx
mov dl, cl
mov esi, dword [ebx + edx*4 + 0x1b1c]
test al, al
jne 0x40673d
push esi
call dword [sym.imp.GDI32.dll_UnrealizeObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x406773
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 1
mov eax, dword [ebx + 0x1b64]
mov dword [ebx + 0x1b6c], eax
jmp 0x407cea
lea eax, [esp + 0x354]
mov ecx, ebx
push eax
push ebp
call fcn.00408e30
lea ecx, [esp + 0x358]
push ecx
push eax
mov ecx, ebx
call fcn.00408e30
lea ecx, [esp + 0x35c]
push ecx
push eax
mov ecx, ebx
call fcn.00408e30
lea ecx, [esp + 0x360]
push ecx
push eax
mov ecx, ebx
call fcn.00408e30
mov ecx, dword [esp + 0x35c]
lea edx, [esp + 0x364]
push edx
mov dword [ebx + 0x1b86], ecx
push eax
mov ecx, ebx
call fcn.00408e30
lea ecx, [esp + 0x34]
push ecx
push eax
mov ecx, ebx
call fcn.00408df0
mov esi, eax
mov ebp, eax
mov eax, dword [esp + 0x34]
lea edi, [esp + 0x368]
and eax, 0xffff
add eax, 8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x354]
and eax, 0xffff
push ecx
mov byte [esp + eax + 0x374], 0
lea ebp, [eax + ebp + 8]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov esi, eax
test esi, esi
je 0x407dcc
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebx + 0x1a70]
test eax, eax
je 0x40686d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1a70], esi
jmp 0x407cea
lea eax, [esp + 0x36]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x36]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextCharacterExtra]
mov eax, dword [esp + 0x36]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextCharacterExtra]
jmp 0x407cea
lea eax, [esp + 0x38]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
lea ecx, [esp + 0x3a]
push ecx
push eax
mov ecx, ebx
call fcn.00408df0
mov ebp, eax
mov eax, dword [esp + 0x38]
and eax, 0xffff
mov ecx, dword [ebx + 0x1a90]
push eax
mov eax, dword [esp + 0x3e]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextJustification]
mov eax, dword [esp + 0x38]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x3e]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextJustification]
jmp 0x407cea
lea eax, [esp + 0x3c]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x3c]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov eax, dword [esp + 0x3c]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x407cea
lea eax, [esp + 0x4a]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
lea ecx, [esp + 0x4e]
push ecx
push eax
mov ecx, ebx
call fcn.00408df0
cmp dword [ebx + 0x1a44], 0
mov ebp, eax
jne 0x4069c0
mov eax, dword [esp + 0x4e]
and eax, 0xffff
lea ecx, [eax*4 + 8]
push ecx
mov ecx, ebx
call fcn.00408970
mov dword [ebx + 0x1a44], eax
test eax, eax
je 0x407dd6
mov word [eax], 0x300
mov ax, word [esp + 0x4e]
mov ecx, dword [ebx + 0x1a44]
inc ax
mov word [ecx + 2], ax
mov ax, word [ebx + 0x1b84]
test ax, ax
je 0x4069ee
cmp ax, 0x100
jne 0x4069e7
mov eax, dword [ebx + 0x1a44]
cmp word [eax + 2], 0x100
jne 0x4069e7
mov byte [esp + 0x50], 1
jmp 0x4069f3
mov byte [esp + 0x50], 4
jmp 0x4069f3
mov byte [esp + 0x50], 0
mov si, word [esp + 0x4a]
mov al, byte [esp + 0x50]
dec al
cmp al, 1
sbb edi, edi
neg edi
cmp word [esp + 0x4e], si
jb 0x406acc
lea eax, [esp + 0x78]
mov ecx, ebx
push eax
push ebp
call fcn.00408cb0
mov ebp, eax
mov edx, dword [ebx + 0x1b80]
test edx, edx
je 0x406a81
cmp si, 0xa
jb 0x406a44
mov ecx, dword [ebx + 0x1a44]
xor eax, eax
mov ax, word [ecx + 2]
movzx ecx, si
sub eax, ecx
cmp eax, 0xa
jg 0x406a81
xor eax, eax
xor ecx, ecx
mov al, byte [esp + 0x79]
mov cl, byte [esp + 0x78]
shl eax, 8
shl ecx, 0x10
or eax, ecx
xor ecx, ecx
mov cl, byte [esp + 0x7a]
or eax, ecx
push eax
push edx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov ecx, dword [ebx + 0x1a48]
movzx edx, si
mov ecx, dword [ecx + eax*4 + 4]
mov eax, dword [ebx + 0x1a44]
mov dword [eax + edx*4 + 4], ecx
jmp 0x406abf
movzx eax, si
shl eax, 2
mov cl, byte [esp + 0x7a]
mov edx, dword [ebx + 0x1a44]
mov byte [edx + eax + 4], cl
mov cl, byte [esp + 0x79]
mov edx, dword [ebx + 0x1a44]
mov byte [edx + eax + 5], cl
mov cl, byte [esp + 0x78]
mov edx, dword [ebx + 0x1a44]
mov byte [edx + eax + 6], cl
mov edx, dword [ebx + 0x1a44]
mov cl, byte [esp + 0x50]
mov byte [edx + eax + 7], cl
inc si
cmp word [esp + 0x4e], si
jae 0x406a0f
cmp dword [ebx + 0x1a4c], 0
jne 0x406af0
mov eax, dword [ebx + 0x1a44]
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebx + 0x1a4c], eax
test eax, eax
je 0x407de0
push 0
mov eax, dword [ebx + 0x1a4c]
push eax
mov ecx, dword [ebx + 0x1a94]
push ecx
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
mov ecx, dword [ebx + 0x1a4c]
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_SelectPalette]
test edi, edi
je 0x406b6c
cmp word [esp + 0x4a], 0xa
jb 0x406b6c
mov ecx, dword [ebx + 0x1a44]
mov edx, dword [esp + 0x4e]
and edx, 0xffff
xor eax, eax
mov ax, word [ecx + 2]
sub eax, edx
cmp eax, 0xa
jle 0x406b6c
mov eax, dword [esp + 0x4a]
and eax, 0xffff
sub edx, eax
lea ecx, [ecx + eax*4]
add ecx, 4
inc edx
push ecx
push edx
push eax
mov eax, dword [ebx + 0x1a4c]
push eax
call dword [sym.imp.GDI32.dll_AnimatePalette]
jmp 0x407cea
mov ecx, dword [esp + 0x4a]
and ecx, 0xffff
lea eax, [ecx*4]
add eax, dword [ebx + 0x1a44]
add eax, 4
push eax
mov eax, dword [esp + 0x52]
and eax, 0xffff
sub eax, ecx
inc eax
push eax
push ecx
mov ecx, dword [ebx + 0x1a4c]
push ecx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x407cea
lea eax, [esp + 0x344]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
mov ebp, eax
mov ecx, dword [esp + 0x34c]
mov eax, dword [esp + 0x350]
mov edx, dword [esp + 0x348]
push eax
push ecx
mov eax, dword [esp + 0x34c]
push edx
push eax
mov ecx, dword [ebx + 0x1aec]
push ecx
call dword [sym.imp.GDI32.dll_SetRectRgn]
mov ecx, ebx
call fcn.00408140
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
lea eax, [esp + 0x220]
mov ecx, ebx
push eax
push ebp
call fcn.00409270
mov ebp, eax
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
mov ecx, dword [esp + 0x220]
mov eax, dword [esp + 0x224]
mov edx, dword [ebx + 0x1ae8]
push eax
push ecx
push esi
mov eax, dword [ebx + 0x1a90]
push edx
push eax
call dword [sym.imp.GDI32.dll_FrameRgn]
mov ecx, dword [esp + 0x224]
mov edx, dword [esp + 0x220]
push ecx
mov eax, dword [ebx + 0x1ae8]
push edx
mov ecx, dword [ebx + 0x1a94]
push esi
push eax
push ecx
call dword [sym.imp.GDI32.dll_FrameRgn]
push esi
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x407cea
mov eax, dword [ebx + 0x1ae8]
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
call dword [sym.imp.GDI32.dll_InvertRgn]
mov ecx, dword [ebx + 0x1ae8]
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_InvertRgn]
jmp 0x407cea
mov ecx, ebx
call fcn.004083a0
mov eax, dword [ebx + 0x1ae8]
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
call dword [sym.imp.GDI32.dll_PaintRgn]
mov ecx, dword [ebx + 0x1ae8]
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_PaintRgn]
jmp 0x407cea
cmp dword [ebx + 0x1ad8], 0
je 0x406d05
cmp dword [esp + 0x54], 0
jne 0x406d05
mov ecx, ebx
call fcn.004086d0
lea eax, [esp + 0x1c8]
mov ecx, ebx
push eax
push ebp
call fcn.004092a0
lea ecx, [esp + 0x1c]
push ecx
push eax
mov ecx, ebx
call fcn.00408df0
mov ebp, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1d4]
and ecx, 0xffff
mov dword [ebx + 0x1ac8], 0
mov dword [ebx + 0x1ac0], 0
mov edx, dword [ebx + 0x1a58]
mov dword [ebx + 0x1acc], eax
lea eax, [ecx*8]
mov dword [ebx + 0x1ac4], eax
mov eax, dword [esp + 0x1d4]
imul eax, ecx
mov dword [esp + 0x60], eax
add eax, edx
cmp dword [esp + 0x1d4], 0
mov dword [esp + 0x50], eax
jle 0x406da8
mov edi, edx
cmp dword [edi], 0xffffffff
jne 0x406da8
cmp dword [eax], 0
jne 0x406da8
add eax, 4
add edi, 4
mov esi, dword [ebx + 0x1ac8]
inc esi
mov dword [ebx + 0x1ac8], esi
cmp dword [esp + 0x1d4], esi
jg 0x406d82
mov eax, dword [ebx + 0x1ac8]
cmp dword [esp + 0x1d4], eax
jle 0x406df2
mov eax, dword [esp + 0x1d4]
mov esi, dword [esp + 0x50]
shl eax, 2
lea esi, [eax + esi - 4]
lea edi, [eax + edx - 4]
cmp dword [edi], 0xffffffff
jne 0x406df2
cmp dword [esi], 0
jne 0x406df2
sub esi, 4
sub edi, 4
mov eax, dword [ebx + 0x1acc]
dec eax
mov dword [ebx + 0x1acc], eax
cmp eax, dword [ebx + 0x1ac8]
jg 0x406dcd
xor edi, edi
mov eax, dword [ebx + 0x1ac8]
mov dword [esp + 0x5c], eax
cmp dword [ebx + 0x1acc], eax
mov dword [esp + 0x7c], 0xffffffff
jle 0x406e3e
mov esi, dword [esp + 0x50]
lea edx, [edx + eax*4]
lea esi, [esi + eax*4]
mov eax, dword [ebx + 0x1acc]
sub eax, dword [esp + 0x5c]
mov dword [esp + 0x50], eax
or edi, dword [esi]
mov eax, dword [esp + 0x7c]
and eax, dword [edx]
add esi, 4
add edx, 4
mov dword [esp + 0x7c], eax
dec dword [esp + 0x50]
jne 0x406e26
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
shr esi, 0x10
and eax, 0xff0000
or esi, eax
mov eax, dword [esp + 0x7c]
shr esi, 8
shl eax, 0x10
or eax, dword [esp + 0x7c]
and eax, 0xff00
shl eax, 8
mov edx, edi
or esi, eax
and edx, 0xff0000
mov eax, edi
shl eax, 0x10
or eax, edi
shr edi, 0x10
and eax, 0xff00
shl eax, 8
or edx, edi
shr edx, 8
mov edi, 0x80000000
or eax, edx
lea edx, [ecx*8]
mov dword [esp + 0x50], eax
test edx, edx
jle 0x406ec2
test esi, edi
je 0x406ec2
test dword [esp + 0x50], edi
jne 0x406ec2
shr edi, 1
mov edx, dword [ebx + 0x1ac0]
inc edx
lea eax, [ecx*8]
mov dword [ebx + 0x1ac0], edx
cmp edx, eax
jl 0x406e9d
shl ecx, 3
mov edi, 1
mov edx, dword [ebx + 0x1ac0]
cmp edx, ecx
jge 0x406ef1
test esi, edi
je 0x406ef1
test dword [esp + 0x50], edi
jne 0x406ef1
add edi, edi
mov eax, dword [ebx + 0x1ac4]
dec eax
mov dword [ebx + 0x1ac4], eax
cmp eax, edx
jg 0x406ed4
push 0xff0062
mov eax, dword [ebx + 0x1aa0]
push 0x20
push 0x20
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebx + 0x1a58]
mov ecx, dword [esp + 0x60]
push eax
mov edx, dword [ebx + 0x1a7c]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa0]
push 0
push 0
push ecx
mov edx, dword [ebx + 0x1a98]
push 0x20
push 0x20
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x42
mov ecx, dword [ebx + 0x1aa0]
push 0x20
push 0x20
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebx + 0x1a58]
mov ecx, dword [esp + 0x60]
add eax, dword [esp + 0x60]
mov edx, dword [ebx + 0x1a7c]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa0]
push 0
push 0
push ecx
mov edx, dword [ebx + 0x1a9c]
push 0x20
push 0x20
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1ac4]
sub eax, dword [ebx + 0x1ac0]
mov dword [ebx + 0x1ad0], eax
mov eax, dword [ebx + 0x1acc]
sub eax, dword [ebx + 0x1ac8]
mov dword [ebx + 0x1ad4], eax
mov edx, dword [ebx + 0x1ab8]
mov ecx, dword [ebx + 0x1abc]
add edx, dword [ebx + 0x1ab0]
add ecx, dword [ebx + 0x1ab4]
mov eax, dword [esp + 0x1c8]
mov esi, dword [esp + 0x1cc]
mov dword [ebx + 0x1ab0], edx
mov dword [ebx + 0x1ab4], ecx
sub edx, eax
sub ecx, esi
mov dword [ebx + 0x1ab8], eax
mov dword [ebx + 0x1abc], esi
mov dword [ebx + 0x1ab0], edx
mov dword [ebx + 0x1ab4], ecx
cmp dword [esp + 0x54], 0
jne 0x407022
mov ecx, ebx
call fcn.00408700
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407cea
push eax
mov ecx, ebx
call fcn.00408950
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407cea
cmp dword [esp + 0x54], 0
jne 0x407cea
mov ecx, ebx
call fcn.004086d0
jmp 0x407cea
xor eax, eax
add ebp, 2
mov ax, word [ebp - 2]
add ebp, 2
mov ecx, ebx
mov dword [esp + 0x298], eax
xor eax, eax
mov edx, dword [esp + 0x298]
mov ax, word [ebp - 2]
push eax
push edx
call fcn.00408230
jmp 0x407cea
lea esi, [ebx + 0x1b92]
mov ecx, ebx
push esi
call fcn.00409070
push esi
mov ecx, ebx
call fcn.004090a0
test eax, eax
je 0x407dea
mov dword [ebx + 0x1b78], 0
mov dword [ebx + 0x1b74], 0xffffff
mov dword [ebx + 0x1b0e], 0
mov word [ebx + 0x1b0a], 0
mov word [ebx + 0x1b14], 0
mov word [ebx + 0x1b0c], 0
jmp 0x407cea
lea eax, [esp + 0x1e]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov eax, dword [esp + 0x1e]
and eax, 0xffff
je 0x407125
cmp eax, 1
je 0x4071d4
cmp eax, 2
je 0x4072e4
jmp 0x407cea
lea eax, [esp + 0x2d0]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
mov ebp, eax
mov esi, dword [esp + 0x2d8]
sub esi, dword [esp + 0x2d0]
mov edi, dword [esp + 0x2dc]
sub edi, dword [esp + 0x2d4]
mov eax, dword [ebx + 0x1a94]
push edi
push esi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebx + 0x1a88], eax
test eax, eax
je 0x407df4
push eax
mov eax, dword [ebx + 0x1aa8]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, ebx
mov dword [ebx + 0x1a8c], eax
mov eax, dword [ebx + 0x1a94]
push eax
call fcn.004092c0
mov eax, dword [esp + 0x2d4]
push 0xcc0020
mov ecx, dword [esp + 0x2d4]
push eax
push ecx
mov edx, dword [ebx + 0x1a94]
push edx
mov eax, dword [ebx + 0x1aa8]
push edi
push esi
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x1a94]
push ecx
mov ecx, ebx
call fcn.00409370
jmp 0x407cea
lea eax, [esp + 0x278]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
mov ebp, eax
mov esi, dword [esp + 0x280]
sub esi, dword [esp + 0x278]
mov edi, dword [esp + 0x284]
sub edi, dword [esp + 0x27c]
mov eax, dword [ebx + 0x1a94]
push eax
mov ecx, ebx
call fcn.004092c0
mov eax, dword [ebx + 0x1af0]
mov ecx, dword [ebx + 0x1a94]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0x1a90]
push ecx
mov ecx, ebx
call fcn.004092c0
push 0
mov ecx, dword [ebx + 0x1ae0]
push ecx
mov edx, dword [ebx + 0x1adc]
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov ecx, dword [ebx + 0x1af0]
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa8]
mov edx, dword [esp + 0x280]
push 0
mov eax, dword [esp + 0x280]
push 0
push ecx
push edi
push esi
mov ecx, dword [ebx + 0x1a90]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa8]
mov edx, dword [esp + 0x280]
push 0
mov eax, dword [esp + 0x280]
push 0
push ecx
push edi
push esi
push edx
push eax
mov ecx, dword [ebx + 0x1a94]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x1a90]
push ecx
mov ecx, ebx
call fcn.00409370
mov ecx, dword [ebx + 0x1a94]
push ecx
mov ecx, ebx
call fcn.00409370
mov ecx, ebx
call fcn.00408140
cmp dword [ebx + 0x1a88], 0
je 0x407cea
mov eax, dword [ebx + 0x1a8c]
mov ecx, dword [ebx + 0x1aa8]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0x1a88]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1a88], 0
jmp 0x407cea
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov eax, dword [esp + 0x20]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x407cea
lea eax, [esp + 0x2b8]
mov ecx, ebx
push eax
push ebp
call fcn.00408e70
mov ebp, eax
mov ecx, ebx
mov eax, dword [esp + 0x2b8]
push eax
call fcn.00408970
mov dword [ebx + 0x1a5c], eax
mov dword [ebx + 0x1a58], eax
test eax, eax
jne case.0x40440a.66
mov eax, 0xc9
jmp 0x407d4f
cmp dword [esp + 0x64], 0x46
mov word [esp + 0x50], 0
jne 0x4073a1
lea eax, [esp + 0x50]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
lea eax, [esp + 0x46]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov cx, word [esp + 0x46]
and cx, 0x7f
mov word [ebx + 0x1b1a], cx
lea edx, [esp + 0x46]
mov cx, word [esp + 0x46]
push edx
and cx, 0x80
push eax
cmp cx, 1
sbb ecx, ecx
neg ecx
mov word [ebx + 0x1b16], cx
mov ecx, ebx
call fcn.00408df0
mov cx, word [esp + 0x46]
lea edx, [esp + 0x40]
mov word [ebx + 0x1b18], cx
push edx
push eax
mov ecx, ebx
call fcn.00408df0
mov ebp, eax
mov esi, dword [esp + 0x40]
and esi, 0xffff
cmp word [esp + 0x50], 0
jne 0x407431
mov ax, word [ebx + 0x1b1a]
mov edi, dword [ebx + 0x1a64]
push eax
mov ecx, ebx
push esi
call fcn.00409140
movzx ecx, ax
mov eax, edi
cdq
idiv ecx
jmp 0x407449
lea eax, [esp + 0x40]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov eax, dword [esp + 0x40]
and eax, 0xffff
mov ecx, dword [ebx + 0x1a24]
mov dword [ecx], 0x28
mov ecx, dword [ebx + 0x1a24]
mov dword [ecx + 4], esi
mov ecx, dword [ebx + 0x1a24]
mov dword [ecx + 8], eax
mov ecx, dword [ebx + 0x1a24]
mov word [ecx + 0xc], 1
mov ax, word [ebx + 0x1b1a]
mov ecx, dword [ebx + 0x1a24]
mov word [ecx + 0xe], ax
mov eax, dword [esp + 0x50]
and eax, 0xffff
mov ecx, dword [ebx + 0x1a24]
mov dword [ecx + 0x10], eax
cmp word [ebx + 0x1b1a], 1
jne 0x4074af
mov eax, dword [ebx + 0x1a24]
mov dword [eax + 0x20], 0
jmp 0x4074c1
xor eax, eax
mov ecx, dword [ebx + 0x1a24]
mov ax, word [ebx + 0x1b18]
mov dword [ecx + 0x20], eax
mov eax, dword [ebx + 0x1a24]
mov dword [eax + 0x24], 0
mov edx, dword [ebx + 0x1a64]
mov eax, dword [ebx + 0x1a24]
mov dword [eax + 0x14], edx
cmp word [ebx + 0x1b16], 1
jne 0x4075da
mov ax, word [ebx + 0x1b18]
test ax, ax
jne 0x4075a6
cmp dword [esp + 0x64], 0x45
je 0x40757f
mov eax, dword [ebx + 0x1a44]
cmp word [eax + 2], 2
je 0x40757f
mov eax, dword [ebx + 0x1a90]
lea esi, [ebx + 0x1a20]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
test eax, 0x1000000
je 0x40752f
movzx ax, al
jmp 0x40753d
push eax
mov eax, dword [ebx + 0x1a4c]
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov ecx, dword [esi]
mov word [ecx + 0x28], ax
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
test eax, 0x1000000
je 0x407566
movzx cx, al
mov eax, dword [esi]
mov word [eax + 0x2a], cx
jmp 0x40771d
push eax
mov eax, dword [ebx + 0x1a4c]
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov ecx, dword [esi]
mov word [ecx + 0x2a], ax
jmp 0x40771d
mov eax, dword [ebx + 0x1a20]
mov word [eax + 0x28], 0
mov ecx, dword [ebx + 0x1a44]
mov ax, word [ecx + 2]
mov ecx, dword [ebx + 0x1a20]
dec ax
mov word [ecx + 0x2a], ax
jmp 0x40771d
xor edx, edx
test ax, ax
je 0x40771d
xor esi, esi
mov ecx, dword [ebx + 0x1a20]
inc ebp
add esi, 2
inc edx
movzx ax, byte [ebp - 1]
mov word [ecx + esi + 0x26], ax
xor eax, eax
mov ax, word [ebx + 0x1b18]
cmp eax, edx
jg 0x4075b3
jmp 0x40771d
cmp word [esp + 0x50], 3
jne 0x407608
mov edx, dword [ebx + 0x1a20]
mov eax, dword [ebp]
add edx, 0x28
mov dword [edx], eax
add edx, 4
lea eax, [ebp + 4]
add ebp, 0xc
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
jmp 0x40771d
mov ax, word [ebx + 0x1b18]
test ax, ax
jne 0x4076e0
cmp dword [esp + 0x64], 0x45
jne 0x407674
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2a], 0
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x29], 0
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x28], 0
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2b], 0
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2e], 0xff
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2d], 0xff
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2c], 0xff
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2f], 0
jmp 0x40771d
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2a], al
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x29], ah
mov ecx, dword [ebx + 0x1a20]
shr eax, 0x10
mov byte [ecx + 0x28], al
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2b], 0
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2e], al
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2d], ah
mov ecx, dword [ebx + 0x1a20]
shr eax, 0x10
mov byte [ecx + 0x2c], al
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2f], 0
jmp 0x40771d
xor esi, esi
test ax, ax
je 0x40771d
xor edi, edi
lea eax, [esp + 0x2bc]
mov ecx, ebx
push eax
add edi, 4
push ebp
inc esi
call fcn.00408cb0
mov ebp, eax
mov ecx, dword [ebx + 0x1a20]
mov eax, dword [esp + 0x2bc]
mov dword [ecx + edi + 0x24], eax
xor eax, eax
mov ax, word [ebx + 0x1b18]
cmp eax, esi
jg 0x4076e9
cmp word [esp + 0x50], 0
jne 0x407cea
mov eax, dword [ebx + 0x1a58]
mov ecx, dword [ebx + 0x1a24]
push eax
push ecx
mov ecx, ebx
call fcn.00409190
jmp 0x407cea
cmp dword [esp + 0x64], 0x47
jne 0x407752
mov esi, dword [ebx + 0x1ae8]
jmp 0x407758
mov esi, dword [ebx + 0x1aec]
cmp word [ebx + 0x1b14], 0
jne 0x40777d
lea eax, [esp + 0x22]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ax, word [esp + 0x22]
mov word [ebx + 0x1b12], ax
cmp word [ebx + 0x1b12], 0
jne 0x407816
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_SetRectRgn]
jmp 0x40786b
mov ecx, dword [ebx + 0x1ae4]
push ecx
call dword [sym.imp.GDI32.dll_SetRectRgn]
push 2
mov ecx, dword [ebx + 0x1ae4]
push ecx
push esi
push esi
call dword [sym.imp.GDI32.dll_CombineRgn]
test eax, eax
je 0x407dfe
mov ax, word [ebx + 0x1b14]
inc ax
mov word [ebx + 0x1b14], ax
cmp word [ebx + 0x1b12], ax
je 0x407862
test al, 0x7f
je 0x40786b
cmp dword [esp + 0x3a8], 0
je 0x407816
cmp dword [ebx + 0x33e8], 0
je 0x407816
mov eax, dword [esp + 0x3ac]
push eax
call dword [esp + 0x3ac]
mov dword [ebx + 0x33e8], 0
lea eax, [esp + 0x288]
mov ecx, ebx
push eax
push ebp
call fcn.00408c90
mov ebp, eax
mov ecx, dword [esp + 0x290]
mov eax, dword [esp + 0x294]
mov edx, dword [esp + 0x28c]
cmp word [ebx + 0x1b14], 0
push eax
push ecx
mov eax, dword [esp + 0x290]
push edx
push eax
jne 0x40779f
push esi
call dword [sym.imp.GDI32.dll_SetRectRgn]
jmp 0x4077c5
mov word [ebx + 0x1b14], 0
cmp word [ebx + 0x1b14], 0
jne 0x407cea
cmp dword [esp + 0x64], 0x48
jne 0x407cea
mov ecx, ebx
call fcn.00408140
jmp 0x407cea
cmp word [ebx + 0x1b0a], 0
jne 0x407947
lea eax, [esp + 0x24]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov ebp, eax
mov ecx, ebx
mov ax, word [esp + 0x24]
xor si, si
mov word [ebx + 0x1b08], ax
movzx eax, ax
shl eax, 2
push eax
call fcn.00408970
mov word [ebx + 0x1b0c], si
mov dword [ebx + 0x1b0e], eax
cmp word [ebx + 0x1b08], si
jbe 0x407918
lea eax, [esp + 0x3e]
mov ecx, ebx
push eax
push ebp
call fcn.00408df0
mov dx, word [esp + 0x3e]
mov ebp, eax
movzx eax, si
inc si
mov ecx, dword [ebx + 0x1b0e]
mov word [ecx + eax*2], dx
mov dx, word [esp + 0x3e]
add word [ebx + 0x1b0c], dx
cmp word [ebx + 0x1b08], si
ja 0x4078e0
xor eax, eax
mov ax, word [ebx + 0x1b0c]
shl eax, 3
cmp eax, 0x15f4
jbe 0x407947
push eax
mov ecx, ebx
call fcn.00408970
mov dword [ebx + 0x1a5c], eax
mov dword [ebx + 0x1a58], eax
test eax, eax
je 0x407e08
lea eax, [esp + 0x70]
mov ecx, ebx
push eax
push ebp
call fcn.00409240
mov cx, word [ebx + 0x1b0a]
mov ebp, eax
test cx, cx
mov eax, dword [esp + 0x70]
jne 0x407984
mov edx, dword [esp + 0x74]
mov dword [ebx + 0x1b00], eax
mov dword [ebx + 0x1af8], eax
mov dword [ebx + 0x1b04], edx
mov dword [ebx + 0x1afc], edx
jmp 0x4079cc
cmp dword [ebx + 0x1af8], eax
jle 0x407994
mov dword [ebx + 0x1af8], eax
jmp 0x4079a6
mov eax, dword [esp + 0x70]
cmp dword [ebx + 0x1b00], eax
jge 0x4079a6
mov dword [ebx + 0x1b00], eax
mov eax, dword [esp + 0x74]
cmp dword [ebx + 0x1afc], eax
jle 0x4079ba
mov dword [ebx + 0x1afc], eax
jmp 0x4079cc
mov eax, dword [esp + 0x74]
cmp dword [ebx + 0x1b04], eax
jge 0x4079cc
mov dword [ebx + 0x1b04], eax
movzx eax, cx
shl eax, 3
add eax, dword [ebx + 0x1a58]
mov edx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [eax], edx
mov dword [eax + 4], esi
mov ax, word [ebx + 0x1b0a]
inc ax
mov word [ebx + 0x1b0a], ax
cmp word [ebx + 0x1b0c], ax
je 0x407a06
test al, al
jne 0x407947
mov ax, word [ebx + 0x1b0a]
cmp word [ebx + 0x1b0c], ax
jne 0x407cea
mov eax, dword [ebx + 0x1b04]
mov ecx, dword [ebx + 0x1b00]
push eax
mov edx, dword [ebx + 0x1afc]
push ecx
mov eax, dword [ebx + 0x1af8]
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408490
mov ecx, ebx
mov dword [esp + 0x58], eax
call fcn.004083a0
xor eax, eax
mov ecx, dword [ebx + 0x1b0e]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a58]
push eax
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
cmp dword [esp + 0x54], 0
jne 0x407aa0
xor eax, eax
mov ecx, dword [ebx + 0x1b0e]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a58]
push eax
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov word [ebx + 0x1b0a], 0
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407ad1
push eax
mov ecx, ebx
call fcn.00408950
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
mov eax, dword [ebx + 0x1b0e]
test eax, eax
je 0x407cea
push eax
mov ecx, ebx
call fcn.00408950
jmp 0x407cea
cmp dword [ebx + 0x1ad8], 0
je 0x407b03
cmp dword [esp + 0x54], 0
jne 0x407b03
mov ecx, ebx
call fcn.004086d0
lea eax, [esp + 0x1d8]
mov ecx, ebx
push eax
push ebp
call fcn.004092a0
lea ecx, [esp + 0x26]
push ecx
push eax
mov ecx, ebx
call fcn.00408df0
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.00408df0
mov ebp, eax
mov ecx, dword [esp + 0x1e0]
mov eax, dword [esp + 0x1e4]
mov esi, dword [esp + 0x26]
and esi, 0xffff
mov dword [ebx + 0x1acc], eax
mov edi, ecx
mov dword [ebx + 0x1ac4], ecx
mov dword [ebx + 0x1ac8], 0
mov dword [ebx + 0x1ac0], 0
imul esi, eax
imul edi, eax
push 0xff0062
mov eax, dword [ebx + 0x1aa0]
push 0x20
push 0x20
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebx + 0x1a58]
mov ecx, dword [ebx + 0x1a7c]
push eax
push esi
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa0]
push 0
push 0
push ecx
mov edx, dword [ebx + 0x1a98]
push 0x20
push 0x20
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x42
mov ecx, dword [ebx + 0x1aa4]
push 0x20
push 0x20
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebx + 0x1a58]
mov ecx, dword [ebx + 0x1a80]
add eax, esi
push eax
push edi
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa4]
push 0
push 0
push ecx
mov edx, dword [ebx + 0x1a9c]
push 0x20
push 0x20
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1ac4]
mov edx, dword [ebx + 0x1ab8]
sub eax, dword [ebx + 0x1ac0]
add edx, dword [ebx + 0x1ab0]
mov ecx, dword [ebx + 0x1abc]
mov dword [ebx + 0x1ad0], eax
mov eax, dword [ebx + 0x1acc]
add ecx, dword [ebx + 0x1ab4]
sub eax, dword [ebx + 0x1ac8]
mov esi, dword [esp + 0x1dc]
mov dword [ebx + 0x1ad4], eax
mov dword [ebx + 0x1ab0], edx
mov eax, dword [esp + 0x1d8]
mov dword [ebx + 0x1ab4], ecx
sub edx, eax
sub ecx, esi
mov dword [ebx + 0x1ab8], eax
mov dword [ebx + 0x1abc], esi
mov dword [ebx + 0x1ab0], edx
mov dword [ebx + 0x1ab4], ecx
cmp dword [esp + 0x54], 0
jne 0x407c96
mov ecx, ebx
call fcn.00408700
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407cea
push eax
mov ecx, ebx
call fcn.00408950
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407cea
mov dword [ebx + 0x1a64], 0
lea eax, [ebx + 0x1a64]
mov ecx, dword [ebx + 0x1a58]
push eax
push ecx
push ebp
mov ecx, ebx
call fcn.00408f30
mov ebp, eax
test ebp, ebp
je 0x407e12
cmp dword [esp + 0x58], 0
je 0x407cf8
mov ecx, ebx
call fcn.00408700
cmp dword [esp + 0x3a8], 0
je 0x407d24
cmp dword [ebx + 0x33e8], 0
je 0x407d24
mov eax, dword [esp + 0x3ac]
push eax
call dword [esp + 0x3ac]
mov dword [ebx + 0x33e8], 0
dec word [esp + 0x48]
cmp dword [esp + 0xc4], ebp
ja 0x4043c5
mov eax, dword [esp + 0xc4]
sub eax, ebp
cmp eax, 1
mov eax, 0
adc eax, 0xffffffff
and eax, 0xcb
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x390
ret 0xc
mov eax, 0xcb
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xc9
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xc9
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xc9
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xc9
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xca
jmp 0x407d4f
mov eax, 0xc9
jmp 0x407d4f
mov eax, 0xc9
jmp 0x407d4f