Function at 0x404fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1520
call fcn.00409cf0
push ebx
mov ebx, 1
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x70], ebx
push ebp
mov ebx, 2
push esi
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xac], ebx
mov edx, 7
mov ebp, 0xffffff
mov edi, 8
mov ecx, 9
mov esi, 0xa
mov eax, 0xb
xor ebx, ebx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ebp
mov dword [esp + 0x80], 0xc
mov dword [esp + 0x84], ebp
mov dword [esp + 0x8c], 5
mov dword [esp + 0x90], ebp
mov dword [esp + 0x98], 6
mov dword [esp + 0x9c], ebp
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa8], ebp
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], 2
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], 2
mov dword [esp + 0xc8], esi
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], 2
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], 2
mov dword [esp + 0xe0], 0xc
mov dword [esp + 0xe4], ebp
mov dword [esp + 0xe8], 2
mov dword [esp + 0xec], 0xd
mov dword [esp + 0xf0], ebp
mov dword [esp + 0xf4], 2
mov dword [esp + 0xf8], 0xe
mov dword [esp + 0xfc], ebp
mov dword [esp + 0x100], 3
mov dword [esp + 0x104], 5
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], 3
mov dword [esp + 0x110], 6
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], 3
mov dword [esp + 0x11c], edx
mov dword [esp + 0x120], ebp
mov dword [esp + 0x124], 3
mov dword [esp + 0x128], edi
mov dword [esp + 0x12c], ebp
mov dword [esp + 0x130], 3
mov dword [esp + 0x134], ecx
mov dword [esp + 0x138], ebp
mov dword [esp + 0x13c], 3
mov dword [esp + 0x140], esi
mov dword [esp + 0x144], ebp
mov dword [esp + 0x148], 3
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], ebp
mov dword [esp + 0x154], 3
mov dword [esp + 0x158], 0xc
mov dword [esp + 0x15c], ebp
mov dword [esp + 0x160], 3
mov dword [esp + 0x164], 0xd
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], 3
mov dword [esp + 0x170], 0xe
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], 4
mov dword [esp + 0x17c], 4
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], 4
mov dword [esp + 0x188], 5
mov dword [esp + 0x18c], ebp
mov dword [esp + 0x190], 4
mov dword [esp + 0x194], 6
mov dword [esp + 0x198], ebx
mov dword [esp + 0x19c], 4
mov dword [esp + 0x1a0], edx
mov dword [esp + 0x1a4], ebp
mov dword [esp + 0x1a8], 4
mov dword [esp + 0x1ac], edi
mov dword [esp + 0x1b0], ebx
mov dword [esp + 0x1b4], 4
mov dword [esp + 0x1b8], ecx
mov dword [esp + 0x1bc], ebp
mov dword [esp + 0x1c0], 4
mov dword [esp + 0x1c4], esi
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x1cc], 4
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], ebp
mov dword [esp + 0x1d8], 4
mov dword [esp + 0x1dc], 0xc
mov dword [esp + 0x1e0], ebx
mov dword [esp + 0x1e4], 4
mov dword [esp + 0x1e8], 0xd
mov dword [esp + 0x1ec], ebp
mov dword [esp + 0x1f0], 4
mov dword [esp + 0x1f4], 0xe
mov dword [esp + 0x1f8], ebx
mov dword [esp + 0x1fc], 4
mov dword [esp + 0x200], 0xf
mov dword [esp + 0x204], ebp
mov dword [esp + 0x208], 5
mov dword [esp + 0x20c], 4
mov dword [esp + 0x210], ebx
mov dword [esp + 0x214], 5
mov dword [esp + 0x218], 5
mov dword [esp + 0x21c], ebp
mov dword [esp + 0x220], 5
mov dword [esp + 0x224], 6
mov dword [esp + 0x228], ebx
mov dword [esp + 0x22c], 5
mov dword [esp + 0x230], edx
mov dword [esp + 0x234], ebp
mov dword [esp + 0x238], 5
mov dword [esp + 0x23c], edi
mov dword [esp + 0x240], ebx
mov dword [esp + 0x244], 5
mov dword [esp + 0x248], ecx
mov dword [esp + 0x24c], ebp
mov dword [esp + 0x250], 5
mov dword [esp + 0x254], esi
mov dword [esp + 0x258], ebx
mov dword [esp + 0x25c], 5
mov dword [esp + 0x260], eax
mov dword [esp + 0x264], ebp
mov dword [esp + 0x268], 5
mov dword [esp + 0x26c], 0xc
mov dword [esp + 0x270], ebx
mov dword [esp + 0x274], 5
mov dword [esp + 0x278], 0xd
mov dword [esp + 0x27c], ebp
mov dword [esp + 0x280], 5
mov dword [esp + 0x284], 0xe
mov dword [esp + 0x288], ebx
mov dword [esp + 0x28c], 5
mov dword [esp + 0x290], 0xf
mov dword [esp + 0x294], ebp
mov dword [esp + 0x298], 6
mov dword [esp + 0x29c], 4
mov dword [esp + 0x2a0], 0xffff
mov dword [esp + 0x2a4], 6
mov dword [esp + 0x2a8], 5
mov dword [esp + 0x2ac], 0xffff
mov dword [esp + 0x2b0], 6
mov dword [esp + 0x2b4], 6
mov dword [esp + 0x2b8], 0xffff00
mov dword [esp + 0x2bc], 6
mov dword [esp + 0x2c0], edx
mov dword [esp + 0x2c4], 0xffff00
mov dword [esp + 0x2c8], 6
mov dword [esp + 0x2cc], edi
mov dword [esp + 0x2d0], 0xff00
mov dword [esp + 0x2d4], 6
mov dword [esp + 0x2d8], ecx
mov dword [esp + 0x2dc], 0xff00
mov dword [esp + 0x2e0], 6
mov dword [esp + 0x2e4], esi
mov dword [esp + 0x2e8], 0xff00ff
mov dword [esp + 0x2ec], 6
mov dword [esp + 0x2f0], eax
mov dword [esp + 0x2f4], 0xff00ff
mov dword [esp + 0x2f8], 6
mov dword [esp + 0x2fc], 0xc
mov dword [esp + 0x300], 0xff
mov dword [esp + 0x304], 6
mov dword [esp + 0x308], 0xd
mov dword [esp + 0x30c], 0xff
mov dword [esp + 0x310], 6
mov dword [esp + 0x314], 0xe
mov dword [esp + 0x318], 0xff0000
mov dword [esp + 0x31c], 6
mov dword [esp + 0x320], 0xf
mov dword [esp + 0x324], 0xff0000
mov dword [esp + 0x328], edx
mov dword [esp + 0x32c], 4
mov dword [esp + 0x330], 0xffff
mov dword [esp + 0x334], edx
mov dword [esp + 0x338], 5
mov dword [esp + 0x33c], 0xffff
mov dword [esp + 0x340], edx
mov dword [esp + 0x344], 6
mov dword [esp + 0x348], 0xffff00
mov dword [esp + 0x34c], edx
mov dword [esp + 0x350], edx
mov dword [esp + 0x354], 0xffff00
mov dword [esp + 0x358], edx
mov dword [esp + 0x35c], edi
mov dword [esp + 0x360], 0xff00
mov dword [esp + 0x364], edx
mov dword [esp + 0x368], ecx
mov dword [esp + 0x36c], 0xff00
mov dword [esp + 0x370], edx
mov dword [esp + 0x374], esi
mov dword [esp + 0x378], 0xff00ff
mov dword [esp + 0x37c], edx
mov dword [esp + 0x380], eax
mov dword [esp + 0x384], 0xff00ff
mov dword [esp + 0x388], edx
mov dword [esp + 0x38c], 0xc
mov dword [esp + 0x390], 0xff
mov dword [esp + 0x394], edx
mov dword [esp + 0x398], 0xd
mov dword [esp + 0x39c], 0xff
mov dword [esp + 0x3a0], edx
mov dword [esp + 0x3a4], 0xe
mov dword [esp + 0x3a8], 0xff0000
mov dword [esp + 0x3ac], edx
mov dword [esp + 0x3b0], 0xf
mov dword [esp + 0x3b4], 0xff0000
mov dword [esp + 0x3b8], edi
mov dword [esp + 0x3bc], 4
mov dword [esp + 0x3c0], ebx
mov dword [esp + 0x3c4], edi
mov dword [esp + 0x3c8], 5
mov dword [esp + 0x3cc], ebx
mov dword [esp + 0x3d0], edi
mov dword [esp + 0x3d4], 6
mov dword [esp + 0x3d8], ebx
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3e0], edx
mov dword [esp + 0x3e4], ebx
mov dword [esp + 0x3e8], edi
mov dword [esp + 0x3ec], edi
mov dword [esp + 0x3f0], ebx
mov dword [esp + 0x3f4], edi
mov dword [esp + 0x3f8], ecx
mov dword [esp + 0x3fc], ebx
mov dword [esp + 0x400], edi
mov dword [esp + 0x404], esi
mov dword [esp + 0x408], ebx
mov dword [esp + 0x40c], edi
mov dword [esp + 0x410], eax
mov dword [esp + 0x414], ebx
mov dword [esp + 0x418], edi
mov dword [esp + 0x41c], 0xc
mov dword [esp + 0x420], ebx
mov dword [esp + 0x424], edi
mov dword [esp + 0x428], 0xd
mov dword [esp + 0x42c], ebx
mov dword [esp + 0x430], edi
mov dword [esp + 0x434], 0xe
mov dword [esp + 0x438], ebx
mov dword [esp + 0x43c], edi
mov dword [esp + 0x440], 0xf
mov dword [esp + 0x444], ebx
mov dword [esp + 0x448], ecx
mov dword [esp + 0x44c], 4
mov dword [esp + 0x450], ebx
mov dword [esp + 0x454], ecx
mov dword [esp + 0x458], 5
mov dword [esp + 0x45c], ebx
mov dword [esp + 0x460], ecx
mov dword [esp + 0x464], 6
mov dword [esp + 0x468], ebx
mov dword [esp + 0x46c], ecx
mov dword [esp + 0x470], edx
mov dword [esp + 0x474], 0x4b4b4b
mov dword [esp + 0x478], ecx
mov dword [esp + 0x47c], edi
mov dword [esp + 0x480], 0x646464
mov dword [esp + 0x484], ecx
mov dword [esp + 0x488], ecx
mov dword [esp + 0x48c], 0x808080
mov dword [esp + 0x490], ecx
mov dword [esp + 0x494], esi
mov dword [esp + 0x498], 0x969696
mov dword [esp + 0x49c], ecx
mov dword [esp + 0x4a0], eax
mov dword [esp + 0x4a4], 0xc0c0c0
mov dword [esp + 0x4a8], ecx
mov dword [esp + 0x4ac], 0xc
mov dword [esp + 0x4b0], 0xdcdcdc
mov dword [esp + 0x4b4], ecx
mov dword [esp + 0x4b8], 0xd
mov dword [esp + 0x4bc], ebp
mov dword [esp + 0x4c0], ecx
mov dword [esp + 0x4c4], 0xe
mov dword [esp + 0x4c8], ebp
mov dword [esp + 0x4cc], ecx
mov dword [esp + 0x4d0], 0xf
mov dword [esp + 0x4d4], ebp
mov dword [esp + 0x4d8], esi
mov dword [esp + 0x4dc], 4
mov dword [esp + 0x4e0], ebx
mov dword [esp + 0x4e4], esi
mov dword [esp + 0x4e8], 5
mov dword [esp + 0x4ec], ebx
mov dword [esp + 0x4f0], esi
mov dword [esp + 0x4f4], 6
mov dword [esp + 0x4f8], ebx
mov dword [esp + 0x4fc], esi
mov dword [esp + 0x500], edx
mov dword [esp + 0x504], 0x4b4b4b
mov dword [esp + 0x508], esi
mov dword [esp + 0x50c], edi
mov dword [esp + 0x510], 0x646464
mov dword [esp + 0x514], esi
mov dword [esp + 0x518], ecx
mov dword [esp + 0x51c], 0x808080
mov dword [esp + 0x520], esi
mov dword [esp + 0x524], esi
mov dword [esp + 0x528], 0x969696
mov dword [esp + 0x52c], esi
mov dword [esp + 0x530], eax
mov dword [esp + 0x534], 0xc0c0c0
mov dword [esp + 0x538], esi
mov dword [esp + 0x53c], 0xc
mov dword [esp + 0x540], 0xdcdcdc
mov dword [esp + 0x544], esi
mov dword [esp + 0x548], 0xd
mov dword [esp + 0x54c], ebp
mov dword [esp + 0x550], esi
mov dword [esp + 0x554], 0xe
mov dword [esp + 0x558], ebp
mov dword [esp + 0x55c], esi
mov dword [esp + 0x560], 0xf
mov dword [esp + 0x564], ebp
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 4
mov dword [esp + 0x570], ebp
mov dword [esp + 0x574], eax
mov dword [esp + 0x578], 5
mov dword [esp + 0x57c], ebp
mov dword [esp + 0x580], eax
mov dword [esp + 0x584], 6
mov dword [esp + 0x588], ebp
mov dword [esp + 0x58c], eax
mov dword [esp + 0x590], edx
mov dword [esp + 0x594], ebp
mov dword [esp + 0x598], eax
mov dword [esp + 0x59c], edi
mov dword [esp + 0x5a0], ebx
mov dword [esp + 0x5a4], eax
mov dword [esp + 0x5a8], ecx
mov dword [esp + 0x5ac], ebx
mov dword [esp + 0x5b0], eax
mov dword [esp + 0x5b4], esi
mov dword [esp + 0x5b8], ebx
mov dword [esp + 0x5bc], eax
mov dword [esp + 0x5c0], eax
mov dword [esp + 0x5c4], ebx
mov dword [esp + 0x5c8], eax
mov dword [esp + 0x5cc], 0xc
mov dword [esp + 0x5d0], ebp
mov dword [esp + 0x5d4], eax
mov dword [esp + 0x5d8], 0xd
mov dword [esp + 0x5dc], ebp
mov dword [esp + 0x5e0], eax
mov dword [esp + 0x5e4], 0xe
mov dword [esp + 0x5e8], ebp
mov dword [esp + 0x5ec], eax
mov dword [esp + 0x5f0], 0xf
mov dword [esp + 0x5f4], ebp
mov dword [esp + 0x5f8], 0xc
mov dword [esp + 0x5fc], 6
mov dword [esp + 0x600], 0xffff
mov dword [esp + 0x604], 0xc
mov dword [esp + 0x608], edx
mov dword [esp + 0x60c], 0xffff
mov dword [esp + 0x610], 0xc
mov dword [esp + 0x614], edi
mov dword [esp + 0x618], 0xffff
mov dword [esp + 0x61c], 0xc
mov dword [esp + 0x620], ecx
mov dword [esp + 0x624], 0xff
mov dword [esp + 0x628], 0xc
mov dword [esp + 0x62c], esi
mov dword [esp + 0x630], 0xff
mov dword [esp + 0x634], 0xc
mov dword [esp + 0x638], eax
mov dword [esp + 0x63c], 0xffff
mov dword [esp + 0x640], 0xc
mov dword [esp + 0x644], 0xc
mov dword [esp + 0x648], 0xffff
mov dword [esp + 0x64c], 0xc
mov dword [esp + 0x650], 0xd
mov dword [esp + 0x674], edi
mov edi, 0xffff
mov dword [esp + 0x678], edi
mov dword [esp + 0x68c], esi
mov dword [esp + 0x69c], edi
mov dword [esp + 0x6a8], edi
mov dword [esp + 0x6b4], edi
mov esi, 0x415f28
lea edi, [esp + 0x6bc]
mov dword [esp + 0x680], ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x668], edx
movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1534]
mov edx, 0xd
push esi
push 0x808080
mov dword [esp + 0x65c], 0xffff
mov dword [esp + 0x660], 0xd
mov dword [esp + 0x664], 6
mov dword [esp + 0x668], 0xffff
mov dword [esp + 0x66c], 0xd
mov dword [esp + 0x674], 0xffff
mov dword [esp + 0x678], edx
mov dword [esp + 0x684], edx
mov dword [esp + 0x68c], 0xff
mov dword [esp + 0x690], edx
mov dword [esp + 0x698], 0xff
mov dword [esp + 0x69c], edx
mov dword [esp + 0x6a0], eax
mov dword [esp + 0x6a8], edx
mov dword [esp + 0x6ac], 0xc
mov dword [esp + 0x6b4], edx
mov dword [esp + 0x6b8], edx
mov dword [esp + 0x6c0], 0x63
call fcn.00406ec0
mov edi, dword [esp + 0x1c]
mov eax, 0x66666667
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov ecx, dword [edi + 0xc]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x88888889
mov dword [0x4197a8], edx
mov ecx, dword [edi + 8]
imul ecx
add edx, ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [0x4197a4], edx
mov ecx, dword [edi + 0xc]
mov eax, ecx
mov edi, 0x14
cdq
idiv edi
mov eax, ecx
mov ecx, 0xf
mov dword [esp + 0x34], edx
cdq
idiv ecx
mov dword [esp + 0x20], edx
xor edx, edx
xor ecx, ecx
mov edi, ecx
lea eax, [ecx + edx]
imul edi, dword [0x4197a8]
lea eax, [eax + eax*2]
shl eax, 2
cmp edx, ebx
mov dword [esp + eax + 0x720], edi
mov edi, dword [esp + 0x14]
mov dword [esp + eax + 0x724], edi
lea eax, [esp + eax + 0x728]
mov dword [eax], 0x808080
je 0x405ec2
cmp edx, 0x118
jne 0x405edf
mov edi, ecx
and edi, 0x80000001
jns 0x405ed1
dec edi
or edi, 0xfffffffe
inc edi
neg edi
sbb edi, edi
and edi, 0xff000001
add edi, ebp
mov dword [eax], edi
cmp ecx, ebx
je 0x405ee8
cmp ecx, 0x13
jne 0x405f2b
mov edi, dword [esp + 0x10]
and edi, 0x80000001
jns 0x405ef9
dec edi
or edi, 0xfffffffe
inc edi
mov dword [esp + 0x18], edi
neg edi
sbb edi, edi
and edi, 0xff000001
add edi, ebp
cmp ecx, 0x13
mov dword [eax], edi
jne 0x405f2b
mov edi, dword [esp + 0x18]
cmp edi, ebx
lea edi, [edx + edx*2]
jne 0x405f24
mov dword [esp + edi*4 + 0x80c], ebx
jmp 0x405f2b
mov dword [esp + edi*4 + 0x80c], ebp
cmp edx, 0x64
je 0x405f45
cmp edx, 0x78
je 0x405f45
cmp edx, 0xa0
je 0x405f45
cmp edx, 0xb4
jne 0x405f65
cmp ecx, 1
je 0x405f63
cmp ecx, 2
je 0x405f63
cmp ecx, 3
je 0x405f63
cmp ecx, 0x10
je 0x405f63
cmp ecx, 0x11
je 0x405f63
cmp ecx, 0x12
jne 0x405f65
mov dword [eax], ebp
inc ecx
cmp ecx, 0x14
jl 0x405e85
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
inc eax
add edx, 0x14
mov dword [esp + 0x10], eax
mov eax, dword [0x4197a4]
add edi, eax
cmp edx, 0x12c
mov dword [esp + 0x14], edi
jl 0x405e83
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
push 5
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 6
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [0x4197a4]
mov edi, dword [sym.imp.GDI32.dll_Ellipse]
mov dword [esp + 0x920], 0xc0
lea ecx, [eax*4]
push ecx
mov ecx, dword [0x4197a8]
lea edx, [ecx*4]
push edx
push eax
push ecx
push esi
call edi
mov ecx, dword [0x4197a4]
mov dword [esp + 0x9d4], 0xc0c0
lea eax, [ecx*4]
push eax
mov eax, dword [0x4197a8]
lea edx, [eax + eax*8]
lea edx, [eax + edx*2]
push edx
push ecx
shl eax, 4
push eax
push esi
call edi
mov eax, dword [0x4197a4]
mov dword [esp + 0x1280], 0xc0c000
lea ecx, [eax*8]
sub ecx, eax
add ecx, ecx
push ecx
mov ecx, dword [0x4197a8]
lea edx, [ecx*4]
push edx
lea edx, [eax + eax*4]
lea eax, [eax + edx*2]
push eax
push ecx
push esi
call edi
mov ecx, dword [0x4197a4]
mov eax, dword [0x4197a8]
mov dword [esp + 0x1334], 0xc000
lea edx, [ecx*8]
sub edx, ecx
add edx, edx
push edx
lea edx, [eax + eax*8]
lea edx, [eax + edx*2]
push edx
lea edx, [ecx + ecx*4]
shl eax, 4
lea ecx, [ecx + edx*2]
push ecx
push eax
push esi
call edi
lea ecx, [esp + 0x728]
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0x14
mov eax, dword [ecx]
cmp eax, 0x808080
je 0x4060ec
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [esp + 0x14]
mov edx, dword [0x4197a8]
mov edi, eax
mov eax, dword [ecx - 8]
mov ecx, dword [ecx - 4]
mov dword [esp + 0x24], eax
add eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [0x4197a4]
mov dword [esp + 0x28], ecx
add ecx, eax
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x24]
push edi
push ecx
push esi
call dword [sym.imp.USER32.dll_FillRect]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add ecx, 0xc
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jne 0x406099
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x40608d
mov edi, dword [sym.imp.GDI32.dll_MoveToEx]
mov dword [esp + 0x10], 1
mov edx, dword [esp + 0x10]
push ebx
imul edx, dword [0x4197a4]
push edx
push ebx
push esi
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
imul eax, dword [0x4197a4]
mov edx, dword [ecx + 0xc]
push eax
push edx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xf
mov dword [esp + 0x10], eax
jl 0x406117
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
push ebx
imul eax, dword [0x4197a8]
push ebx
push eax
push esi
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
imul eax, dword [0x4197a8]
mov edx, dword [ecx + 8]
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x14
mov dword [esp + 0x10], eax
jl 0x406159
push ebx
push 1
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [0x4197a8]
lea ecx, [eax + 1]
lea edx, [eax*4]
cmp ecx, edx
mov dword [esp + 0x10], ecx
jge 0x406214
mov edx, ecx
and edx, 0x80000001
jns 0x4061cf
dec edx
or edx, 0xfffffffe
inc edx
jne 0x406204
mov eax, dword [0x4197a4]
push ebx
lea eax, [eax + eax*4 + 1]
push eax
push ecx
push esi
call edi
mov eax, dword [0x4197a4]
mov edx, dword [esp + 0x10]
lea ecx, [eax*8]
sub ecx, eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [0x4197a8]
mov ecx, dword [esp + 0x10]
inc ecx
lea edx, [eax*4]
cmp ecx, edx
mov dword [esp + 0x10], ecx
jl 0x4061c0
push 6
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push 2
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [0x4197a8]
lea ecx, [eax + 1]
lea edx, [eax*4 + 2]
cmp ecx, edx
mov dword [esp + 0x10], ecx
jge 0x4062c5
lea edx, [ecx - 1]
mov dword [esp + 0x14], edx
mov edx, ecx
and edx, 0x80000003
jns 0x406272
dec edx
or edx, 0xfffffffc
inc edx
jne 0x4062ac
mov eax, dword [0x4197a4]
mov edx, dword [esp + 0x14]
push ebx
lea ecx, [eax*8 + 1]
push ecx
push edx
push esi
call edi
mov eax, dword [0x4197a4]
mov edx, dword [esp + 0x14]
lea eax, [eax + eax*4]
lea ecx, [eax + eax - 1]
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [0x4197a8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
inc ecx
inc edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
lea edx, [eax*4 + 2]
cmp ecx, edx
jl 0x406263
push 6
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push 3
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x4197a8]
mov eax, ecx
lea edx, [ecx + ecx*8]
shl eax, 4
lea ecx, [ecx + edx*2 + 2]
mov dword [esp + 0x10], eax
cmp eax, ecx
jge 0x40636a
jmp 0x406316
mov eax, dword [esp + 0x10]
cdq
mov ecx, 6
idiv ecx
test edx, edx
jne 0x406351
mov eax, dword [0x4197a4]
push ebx
lea edx, [eax + eax*4 + 1]
mov eax, dword [esp + 0x14]
push edx
push eax
push esi
call edi
mov eax, dword [0x4197a4]
mov edx, dword [esp + 0x10]
lea ecx, [eax*8]
sub ecx, eax
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [0x4197a8]
mov ecx, dword [esp + 0x10]
inc ecx
lea edx, [eax + eax*8]
mov dword [esp + 0x10], ecx
lea eax, [eax + edx*2 + 2]
cmp ecx, eax
jl 0x406312
push 6
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push 4
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [0x4197a8]
mov ecx, eax
lea edx, [eax + eax*8]
shl ecx, 4
inc ecx
lea edx, [eax + edx*2 + 2]
cmp ecx, edx
mov dword [esp + 0x10], ecx
jge 0x40641e
lea edx, [ecx - 5]
mov dword [esp + 0x14], edx
mov edx, ecx
and edx, 0x80000007
jns 0x4063cb
dec edx
or edx, 0xfffffff8
inc edx
jne 0x406405
mov eax, dword [0x4197a4]
mov edx, dword [esp + 0x14]
push ebx
lea ecx, [eax*8 + 1]
push ecx
push edx
push esi
call edi
mov eax, dword [0x4197a4]
mov edx, dword [esp + 0x14]
lea eax, [eax + eax*4]
lea ecx, [eax + eax - 1]
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [0x4197a8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
inc ecx
inc edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
lea edx, [eax + eax*8]
lea edx, [eax + edx*2 + 2]
cmp ecx, edx
jl 0x4063bc
push 6
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 6
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [0x4197a4]
push ebx
lea ecx, [eax + eax*4]
push ecx
push ebx
push esi
call edi
mov eax, dword [0x4197a4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1c]
push edx
mov ecx, dword [eax + 0xc]
push ecx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [0x4197a4]
push ebx
lea edx, [eax*8]
sub edx, eax
push edx
push ebx
push esi
call edi
mov eax, dword [0x4197a4]
mov edx, dword [esp + 0x1c]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [edx + 0xc]
push ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov ecx, dword [0x4197a4]
push ebx
lea edx, [ecx*8]
push edx
push ebx
push esi
call edi
mov eax, dword [0x4197a4]
mov edx, dword [esp + 0x1c]
lea ecx, [eax*8]
mov eax, dword [edx + 0xc]
push ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [0x4197a4]
push ebx
lea ecx, [eax + eax*4]
add ecx, ecx
push ecx
push ebx
push esi
call edi
mov eax, dword [0x4197a4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1c]
add edx, edx
mov ecx, dword [eax + 0xc]
push edx
push ecx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [0x4197a4]
mov dword [esp + 0x24], ebx
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
mov ecx, dword [0x4197a8]
mov dword [esp + 0x28], eax
push ebx
lea edx, [ecx + ecx*4]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + edx*4]
mov ecx, dword [esp + 0x24]
add eax, ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, eax
lea edx, [esp + 0x24]
push edi
push edx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [0x4197a8]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
push edi
lea eax, [eax + eax*4]
mov dword [esp + 0x2c], ebx
shl eax, 2
mov dword [esp + 0x28], eax
add eax, ecx
mov dword [esp + 0x30], eax
mov eax, dword [0x4197a4]
lea eax, [eax + eax*2]
lea ecx, [edx + eax*4]
lea edx, [esp + 0x28]
add eax, ecx
push edx
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [0x4197a8]
mov edi, dword [0x4197a4]
lea eax, [ecx*4]
mov dword [esp + 0x24], eax
mov eax, edi
cdq
sub eax, edx
shl ecx, 4
sar eax, 1
inc ecx
lea edx, [eax + edi]
mov dword [esp + 0x2c], ecx
lea ecx, [edi + edi*2]
add eax, edi
mov dword [esp + 0x28], edx
lea edx, [eax + ecx*4 + 1]
mov eax, dword [esp + 0x14]
push eax
mov dword [esp + 0x34], edx
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x808080
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea ecx, [esp + 0x24]
mov edi, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateEllipticRgnIndirect]
push eax
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov edx, dword [esp + 0x34]
push edi
push edx
push esi
call dword [sym.imp.GDI32.dll_FillRgn]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esp + 0x20], 1
lea edi, [esp + 0x44]
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [edi]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [0x4197a8]
imul edx, dword [0x4197a4]
imul ecx, eax
mov dword [esp + 0x24], ecx
add ecx, eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [0x4197a4]
mov dword [esp + 0x28], edx
add edx, ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push edx
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 8]
add edi, 0xc
cmp eax, 0x63
mov dword [esp + 0x20], eax
jne 0x40660d
mov edi, dword [0x4197a8]
mov ecx, dword [0x4197a4]
mov eax, ecx
lea edx, [edi*4]
mov dword [esp + 0x24], edx
cdq
sub eax, edx
sar eax, 1
shl edi, 4
lea edx, [eax + ecx]
mov dword [esp + 0x2c], edi
lea edi, [ecx + ecx*2]
add eax, ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
lea eax, [eax + edi*4]
mov dword [esp + 0x30], eax
push eax
mov eax, dword [esp + 0x30]
push eax
push edx
push ecx
push esi
call dword [sym.imp.GDI32.dll_Ellipse]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x6e4]
rep stosd dword es:[edi], eax
mov eax, dword [0x4197a4]
mov dword [esp + 0x6f4], 0x2bc
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x6e4], eax
xor eax, eax
mov cl, byte [eax + 0x4153a8]
mov byte [esp + eax + 0x700], cl
inc eax
cmp cl, bl
jne 0x4066ee
lea edx, [esp + 0x6e4]
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push ebp
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
lea eax, [esp + 0x38]
lea edi, [esp + 0x6bc]
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x6c4]
push ecx
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
lea edi, [esp + 0x6bc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6bc]
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x3c]
not ecx
dec ecx
push ecx
push edx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [0x4197a4]
sar ecx, 1
lea edx, [eax + eax*8]
mov edi, edx
cdq
sub eax, edx
sub edi, ecx
sar eax, 1
sub edi, eax
mov eax, dword [esp + 0x40]
cdq
push edi
mov edi, dword [esp + 0x28]
sub eax, edx
mov ecx, eax
mov eax, dword [edi + 0xc]
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub eax, ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_TextOutA]
mov edx, dword [edi + 0x28]
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov ecx, dword [esp + 0x34]
push ecx
call edi
pop edi
pop esi
xor eax, eax
pop ebp
pop ebx
add esp, 0x1520
ret 4