Function at 0x40b200
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4590dc
mov eax, dword fs:[0]
push eax
sub esp, 0x608
mov eax, dword [0x46e3d0]
xor eax, esp
mov dword [esp + 0x600], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46e3d0]
xor eax, esp
push eax
lea eax, [esp + 0x61c]
mov dword fs:[0], eax
xor ebp, ebp
cmp dword [esp + 0x62c], ebp
mov edi, ecx
je 0x40b38b
call fcn.00406b20
mov esi, dword [eax + 0x88]
call fcn.00406b20
push 0x12
push 6
push edi
mov ecx, esi
call fcn.00439690
cmp eax, ebp
jne 0x40b3b5
push 0x460be8
push 0x400
lea eax, [esp + 0x21c]
push 0x200
push eax
call fcn.0043ef21
add esp, 0x10
lea ecx, [esp + 0x1f8]
call fcn.0042a750
mov dword [esp + 0x624], ebp
mov edi, 7
lea eax, [esp + 0x214]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], bp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40b2c0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x218]
push ecx
lea esi, [esp + 0x2c]
call fcn.00406f20
mov edx, esi
push ebp
push edx
or eax, 0xffffffff
lea esi, [esp + 0x200]
mov byte [esp + 0x62c], 1
call fcn.00406d90
mov ebx, 8
cmp dword [esp + 0x3c], ebx
jb 0x40b314
mov eax, dword [esp + 0x28]
push eax
call fcn.0043ef40
add esp, 4
cmp dword [esp + 0x210], ebx
mov edx, dword [esp + 0x1fc]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], bp
jae 0x40b338
lea edx, [esp + 0x1fc]
mov edi, dword [0x471b30]
cmp edi, ebp
je 0x40b372
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40b347
sub eax, esi
sar eax, 1
push edi
lea ecx, [eax + eax]
push ecx
push 1
push edx
call fcn.0043fe21
mov edx, dword [0x471b30]
push edx
call fcn.004402ef
add esp, 0x14
cmp dword [esp + 0x210], ebx
jb 0x40b38b
mov eax, dword [esp + 0x1fc]
push eax
call fcn.0043ef40
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x61c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x600]
xor ecx, esp
call fcn.0043ef12
add esp, 0x614
ret
fld dword [0x470fc4]
fmul qword [0x466410]
call fcn.00457000
cmp eax, 2
mov dword [esp + 0x18], eax
jge 0x40b3db
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00426d70
add esp, 4
push eax
mov ebx, 0x460c00
lea esi, [esp + 0x1e0]
mov dword [esp + 0x628], 2
call fcn.00408750
add esp, 4
mov esi, 8
mov byte [esp + 0x624], 4
cmp dword [esp + 0x3c], esi
jb 0x40b428
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0043ef40
add esp, 4
push edi
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], bp
call dword [sym.imp.GDI32.dll_GetTextColor]
push 0xeea946
push edi
mov ebx, eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov dword [esp + 0x44], eax
call fcn.00406b20
mov eax, dword [eax + 0x50]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esp + 0x1f4], esi
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x40], ebp
jae 0x40b492
lea eax, [esp + 0x1e0]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x1f8]
lea edx, [esp + 0x48]
push edx
push 0x74
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentExPointW]
mov eax, dword [esp + 0x1f0]
cmp eax, 2
jb 0x40b4c3
cmp eax, ebp
jne 0x40b4e2
push 2
push 0x460c04
lea esi, [esp + 0x1e4]
call fcn.00406f20
mov eax, dword [esp + 0x1f0]
mov esi, 8
mov edx, dword [esp + 0x1c]
cmp edx, ebp
je 0x40b4f0
cmp dword [esp + 0x20], ebp
jne 0x40b503
xor edx, edx
cmp dword [esp + 0x18], 9
setle dl
sub edx, 1
and edx, 0xd
add edx, 0x23
cmp dword [esp + 0x1f4], esi
mov ecx, dword [esp + 0x1e0]
jae 0x40b51a
lea ecx, [esp + 0x1e0]
push eax
mov eax, 0x74
sub eax, edx
cdq
sub eax, edx
push ecx
sar eax, 1
push 0x32
add eax, 6
push eax
push edi
call dword [sym.imp.GDI32.dll_TextOutW]
mov edx, dword [esp + 0x44]
push edx
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
push ebx
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x48]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esp + 0x1f4], esi
jb 0x40b56e
mov ecx, dword [esp + 0x1e0]
push ecx
call fcn.0043ef40
add esp, 4
mov eax, 1
jmp 0x40b38d