Function at 0x406970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x40c5d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], 0x40d730
lea ecx, [esp + 0x5c]
mov dword [esp + 0x98], ebx
call sub.MFC42.DLL_CDC::CDC
lea ecx, [esp + 0x6c]
mov byte [esp + 0x98], 1
call fcn.004071f0
mov dword [esp + 0x6c], 0x40d7c4
mov esi, dword [esp + 0xa0]
xor ecx, ecx
mov byte [esp + 0x98], 2
mov dword [esp + 0x5c], 0x40d748
mov eax, dword [esi + 0xc]
mov dword [esp + 0x78], esi
cmp eax, ebx
mov dword [esp + 0x74], ebx
sete cl
cmp ecx, ebx
mov dword [esp + 0x8c], ecx
je 0x406a92
mov eax, dword [esi]
lea ecx, [esp + 0x7c]
push ecx
mov ecx, esi
call dword [eax + 0x58]
cmp esi, ebx
jne 0x406a18
xor eax, eax
jmp 0x406a1b
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x60]
call sub.MFC42.DLL_CDC::Attach
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x7c]
sub edx, ecx
sub eax, ebp
push edx
push eax
push esi
lea ecx, [esp + 0x78]
call fcn.00407350
lea ecx, [esp + 0x6c]
test ecx, ecx
je 0x406aa4
cmp dword [esp + 0x70], ebx
je 0x406aa4
lea edx, [esp + 0x6c]
lea ecx, [esp + 0x5c]
push edx
call fcn.00407380
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x80]
lea edx, [esp + 0x44]
push eax
push ecx
push edx
lea ecx, [esp + 0x68]
call sub.MFC42.DLL_CDC::SetWindowOrg
jmp 0x406aa4
mov ecx, dword [esi + 8]
mov dword [esp + 0x68], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x60], eax
xor edx, edx
xor eax, eax
mov dl, byte [edi + 0x54]
mov al, byte [edi + 0x50]
mov esi, edx
mov edx, dword [edi + 0x50]
mov dword [esp + 0x10], eax
sub esi, eax
xor eax, eax
xor ebx, ebx
mov al, byte [edi + 0x51]
mov bl, byte [edi + 0x55]
mov ebp, eax
mov eax, dword [edi + 0x54]
mov ecx, edx
and ebp, 0xff
shr ecx, 0x10
shr eax, 0x10
and ebx, 0xff
and ecx, 0xff
and eax, 0xff
sub ebx, ebp
sub eax, ecx
mov byte [esp + 0x98], 3
test esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], eax
jne 0x406b2d
test ebx, ebx
jne 0x406b2d
test eax, eax
jne 0x406b2d
mov esi, dword [esp + 0x10]
mov ebx, ebp
mov eax, ecx
mov dword [esp + 0x24], esi
test edx, edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], eax
jne 0x406b2d
mov dword [esp + 0x14], 0xff
jmp 0x406b6a
cdq
mov edi, eax
mov eax, ebx
xor edi, edx
sub edi, edx
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
cmp ebx, edi
mov dword [esp + 0x28], ebx
jg 0x406b49
mov dword [esp + 0x28], edi
mov eax, esi
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x28]
cmp eax, edx
jle 0x406b5e
mov dword [esp + 0x14], eax
jmp 0x406b6a
cmp ebx, edi
mov dword [esp + 0x14], ebx
jg 0x406b6a
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0xac]
mov esi, dword [esp + 0xa4]
fild dword [esp + 0x14]
cmp dword [edx], 0
je 0x406b86
fild dword [esi + 0xc]
jmp 0x406b89
fild dword [esi + 8]
fdiv st(1)
mov eax, dword [esp + 0x10]
fstp dword [esp + 0x18]
fild dword [esp + 0x24]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x10], eax
fdiv st(1)
fstp dword [esp + 0x34]
fild dword [esp + 0x20]
mov dword [esp + 0x20], ebp
fdiv st(1)
fstp dword [esp + 0x30]
fild dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
fdiv st(1)
fstp dword [esp + 0x2c]
fstp st(0)
jle 0x406d92
mov edi, dword [sym.imp.USER32.dll_SetRect]
mov ebp, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [esp + 0xac]
cmp dword [ecx], 0
je 0x406cb8
fild dword [esp + 0x10]
inc eax
mov dword [esp + 0x28], eax
fstp dword [esp + 0x10]
fild dword [esp + 0x28]
fmul dword [esp + 0x18]
call sub.MSVCRT.dll__ftol
fld dword [esp + 0x10]
mov edx, dword [esi + 8]
push eax
fmul dword [esp + 0x1c]
inc edx
push edx
call sub.MSVCRT.dll__ftol
push eax
lea eax, [esp + 0x58]
push 0
push eax
call edi
fld dword [esp + 0x10]
fmul dword [esp + 0x2c]
fiadd dword [esp + 0x1c]
call sub.MSVCRT.dll__ftol
fld dword [esp + 0x10]
fmul dword [esp + 0x30]
xor ebx, ebx
mov bh, al
fiadd dword [esp + 0x20]
call sub.MSVCRT.dll__ftol
fld dword [esp + 0x10]
fmul dword [esp + 0x34]
mov bl, al
shl ebx, 8
fiadd dword [esp + 0x24]
call sub.MSVCRT.dll__ftol
and eax, 0xff
or ebx, eax
push ebx
call ebp
push eax
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
je 0x406ca0
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x60]
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x4c]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x58]
cmp eax, dword [ecx]
jg 0x406e0e
jmp 0x406d7e
fild dword [esp + 0x10]
mov edx, dword [esi + 0xc]
inc eax
mov dword [esp + 0x28], eax
inc edx
fstp dword [esp + 0x10]
fild dword [esp + 0x28]
push edx
fmul dword [esp + 0x1c]
call sub.MSVCRT.dll__ftol
fld dword [esp + 0x14]
fmul dword [esp + 0x1c]
push eax
push 0
call sub.MSVCRT.dll__ftol
push eax
lea eax, [esp + 0x5c]
push eax
call edi
fld dword [esp + 0x10]
fmul dword [esp + 0x2c]
fiadd dword [esp + 0x1c]
call sub.MSVCRT.dll__ftol
fld dword [esp + 0x10]
fmul dword [esp + 0x30]
xor ebx, ebx
mov bh, al
fiadd dword [esp + 0x20]
call sub.MSVCRT.dll__ftol
fld dword [esp + 0x10]
fmul dword [esp + 0x34]
mov bl, al
shl ebx, 8
fiadd dword [esp + 0x24]
call sub.MSVCRT.dll__ftol
and eax, 0xff
or ebx, eax
push ebx
call ebp
push eax
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
je 0x406d6b
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x60]
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x4c]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x54]
cmp eax, dword [ecx]
jg 0x406f1d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x406bdd
mov dword [esp + 0x5c], 0x40d748
mov ecx, dword [esp + 0x8c]
xor eax, eax
cmp ecx, eax
mov byte [esp + 0x98], 0xb
je 0x407041
mov ecx, dword [esp + 0x88]
mov esi, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x60]
lea eax, [esp + 0x5c]
sub ecx, esi
sub edx, edi
neg eax
sbb eax, eax
push 0xcc0020
and eax, ebp
push esi
push edi
push eax
push ecx
mov ecx, dword [esp + 0x8c]
push edx
push esi
mov edx, dword [ecx + 4]
push edi
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x5c]
push eax
call fcn.00407380
jmp 0x407049
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push edx
push ecx
push eax
lea edx, [esp + 0x58]
push 0
push edx
call edi
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 0x58]
push eax
call ebp
push eax
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
je 0x406e60
mov edi, dword [esp + 0x40]
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x4c]
neg eax
sbb eax, eax
and eax, edi
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x5c], 0x40d748
mov eax, dword [esp + 0x8c]
mov byte [esp + 0x98], 5
test eax, eax
je 0x406ed3
mov ecx, dword [esp + 0x88]
mov esi, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x7c]
mov ebx, dword [esp + 0x60]
lea eax, [esp + 0x5c]
sub ecx, esi
sub edx, edi
neg eax
sbb eax, eax
push 0xcc0020
and eax, ebx
push esi
push edi
push eax
mov eax, dword [esp + 0x88]
push ecx
push edx
push esi
mov ecx, dword [eax + 4]
push edi
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x5c]
push edx
call fcn.00407380
jmp 0x406ee3
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x98], 4
call fcn.00407300
lea ecx, [esp + 0x5c]
mov byte [esp + 0x98], 0
call fcn.0040b4e2
mov dword [esp + 0x3c], 0x40d71c
mov dword [esp + 0x98], 6
jmp 0x40707e
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
xor ebx, ebx
push edx
push ebx
push eax
lea eax, [esp + 0x5c]
push eax
call edi
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx + 0x58]
push eax
call ebp
push eax
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CGdiObject::Attach
cmp eax, ebx
je 0x406f70
mov ebp, dword [esp + 0x40]
lea eax, [esp + 0x3c]
neg eax
sbb eax, eax
lea edx, [esp + 0x4c]
and eax, ebp
push eax
mov eax, dword [esp + 0x64]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x5c], 0x40d748
mov eax, dword [esp + 0x8c]
mov byte [esp + 0x98], 8
cmp eax, ebx
je 0x406ffa
mov ecx, dword [esp + 0x88]
mov esi, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x60]
lea eax, [esp + 0x5c]
sub ecx, esi
sub edx, edi
neg eax
sbb eax, eax
push 0xcc0020
and eax, ebp
push esi
push edi
push eax
push ecx
mov ecx, dword [esp + 0x8c]
push edx
push esi
mov edx, dword [ecx + 4]
push edi
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x74]
cmp eax, ebx
jne 0x406fea
xor eax, eax
push eax
mov eax, dword [esp + 0x64]
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x407002
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x64]
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x407002
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], ebx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x98], 7
mov dword [esp + 0x6c], 0x40d7c4
call fcn.00407220
lea ecx, [esp + 0x5c]
mov byte [esp + 0x98], 0
call fcn.0040b4e2
mov dword [esp + 0x3c], 0x40d71c
mov dword [esp + 0x98], 9
jmp 0x40707e
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x98], 0xa
call fcn.00407300
lea ecx, [esp + 0x5c]
mov byte [esp + 0x98], 0
call fcn.0040b4e2
mov dword [esp + 0x3c], 0x40d71c
mov dword [esp + 0x98], 0xc
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret 0x10