Function at 0x40aaa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2fc
push ebx
push esi
push edi
xor edi, edi
push 0x190
mov dword [esp + 0x24], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], 0x40dfffc0
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], 0xc0dfffc0
call fcn.004970a0
mov ebx, dword [ebp + 8]
mov dword [esp + 0x70], eax
add esp, 4
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x18]
sub eax, edx
push 1
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebx + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x1c]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [ebx + 0xee]
cdq
sub eax, edx
mov ecx, eax
mov al, byte [ebx + 0xc9]
sar ecx, 1
cmp al, 5
mov dword [esp + 0x3c], ecx
jne 0x40ac19
mov esi, dword [ebx + 0xf2]
xor eax, eax
cmp esi, edi
mov dword [esp + 0xc], eax
jle 0x40aba4
test ecx, ecx
jle 0x40ab9b
mov edx, dword [ebx + 0xfe]
mov dword [esp + 0x14], ecx
lea edx, [edx + eax*8]
fld qword [esp + 0x60]
fcomp qword [edx]
fnstsw ax
test ah, 0x41
jne 0x40ab69
mov eax, dword [edx]
mov edi, dword [edx + 4]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edi
fld qword [esp + 0x28]
fcomp qword [edx]
fnstsw ax
test ah, 1
je 0x40ab83
mov eax, dword [edx]
mov edi, dword [edx + 4]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
lea eax, [esi*8]
add edx, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x40ab4f
mov eax, dword [esp + 0xc]
inc eax
cmp eax, esi
mov dword [esp + 0xc], eax
jl 0x40ab3e
xor edx, edx
test esi, esi
mov dword [esp + 0xc], edx
jle 0x40ac77
mov eax, dword [ebx + 0xee]
fld qword [0x4bcfe8]
cmp ecx, eax
jge 0x40abec
mov eax, esi
lea edi, [esi*8]
imul eax, ecx
add eax, edx
mov edx, dword [ebx + 0xfe]
lea edx, [edx + eax*8]
mov eax, dword [ebx + 0xee]
sub eax, ecx
fadd qword [edx]
add edx, edi
dec eax
jne 0x40abe1
mov edx, dword [esp + 0xc]
fcom qword [esp + 0x60]
fnstsw ax
test ah, 1
je 0x40abfb
fst qword [esp + 0x60]
fcom qword [esp + 0x28]
fnstsw ax
test ah, 0x41
jne 0x40ac0c
fstp qword [esp + 0x28]
jmp 0x40ac0e
fstp st(0)
inc edx
cmp edx, esi
mov dword [esp + 0xc], edx
jl 0x40abb2
jmp 0x40ac77
mov ecx, dword [ebx + 0xf2]
test ecx, ecx
jle 0x40ac77
mov eax, dword [ebx + 0xee]
fld qword [0x4bcfe8]
test eax, eax
jle 0x40ac6a
lea esi, [ecx*8]
mov ecx, dword [ebx + 0xfe]
mov edx, eax
lea ecx, [ecx + edi*8]
fadd qword [ecx]
fcom qword [esp + 0x60]
fnstsw ax
test ah, 1
je 0x40ac56
fst qword [esp + 0x60]
fcom qword [esp + 0x28]
fnstsw ax
test ah, 0x41
jne 0x40ac65
fst qword [esp + 0x28]
add ecx, esi
dec edx
jne 0x40ac45
mov ecx, dword [ebx + 0xf2]
inc edi
cmp edi, ecx
fstp st(0)
jl 0x40ac23
fld qword [esp + 0x28]
fsub qword [esp + 0x60]
fmul qword [0x4bd350]
fld qword [esp + 0x60]
fcomp qword [0x4bcfe8]
fnstsw ax
test ah, 1
jne 0x40acbb
fld qword [esp + 0x60]
fsub st(1)
fcomp qword [0x4bcfe8]
fnstsw ax
test ah, 1
je 0x40acbb
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
jmp 0x40acc5
fld qword [esp + 0x60]
fsub st(1)
fstp qword [esp + 0x60]
fadd qword [esp + 0x28]
xor esi, esi
lea edi, [esp + 0x178]
mov dword [esp + 0xc], esi
fsub qword [esp + 0x60]
fst qword [esp + 0xb0]
fmul qword [0x4bd348]
fstp qword [esp + 0x28]
fild dword [esp + 0xc]
sub esp, 8
fmul qword [esp + 0x30]
fadd qword [esp + 0x68]
fstp qword [esp]
push str._6.0f
push edi
call fcn.0049712c
add esp, 0x10
inc esi
add edi, 0x14
cmp esi, 0xb
mov dword [esp + 0xc], esi
jl 0x40aceb
mov edx, dword [ebx + 0xca]
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push esi
call edi
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x20]
push eax
mov eax, dword [ebx + 0x14]
push ecx
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
mov ecx, dword [esp + 0x10]
push ecx
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esp + 0xc0], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0x38], eax
mov dword [esp + 0xc4], eax
mov eax, 0x66666667
mov dword [esp + 0xbc], ecx
imul dword [esp + 0x18]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [ebx + 0x18]
add eax, edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc8], eax
mov eax, 0x88888889
imul dword [esp + 0x1c]
add edx, dword [esp + 0x1c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x66666667
add edx, ecx
mov dword [esp + 0xa0], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0xa4], edx
imul dword [esp + 0x1c]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0xc], edx
lea eax, [edx + ecx]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x18]
lea edx, [eax + eax*2]
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x68], edx
sub eax, edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0xac], eax
lea eax, [edx + ecx]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x94], eax
mov eax, 0x66666667
imul dword [esp + 0x1c]
sar edx, 1
mov eax, edx
push 0xf
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x3c]
add ecx, edx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x9c], ecx
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x10]
sub eax, ecx
mov dword [esp + 0xa0], edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], edx
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push esi
call edi
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
mov eax, dword [esp + 0x10]
push eax
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebx + 0x14]
mov edx, dword [esp + 0x1c]
lea eax, [edx + ecx]
mov ecx, dword [ebx + 0x20]
mov edx, dword [esp + 0x68]
mov dword [esp + 0x14], eax
mov dword [esp + 0x80], eax
mov eax, ecx
sub eax, edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x84], eax
mov eax, dword [ebx + 0x1c]
sub eax, edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x88], eax
mov eax, 0x66666667
imul dword [esp + 0x18]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
sub eax, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x118], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x120], eax
mov eax, ecx
sub eax, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x124], eax
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x70], edx
mov dword [esp + 0x78], eax
mov eax, 0x51eb851f
imul dword [esp + 0x18]
sar edx, 4
mov eax, edx
push 0xf
shr eax, 0x1f
add edx, eax
sub ecx, edx
mov dword [esp + 0x80], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push esi
call edi
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x74]
push edx
push eax
push ecx
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
mov edx, dword [esp + 0x10]
push edx
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebx + 0x20]
mov edi, dword [esp + 0x24]
mov eax, dword [ebx + 0x14]
mov edx, ecx
sub edx, edi
mov dword [esp + 0xcc], eax
sub edx, 4
add ecx, 0xfffffffe
mov dword [esp + 0xd0], edx
mov edx, dword [esp + 0x1c]
add edx, eax
lea eax, [esp + 0xbc]
push 1
push eax
mov dword [esp + 0xdc], edx
mov dword [esp + 0xe0], ecx
call fcn.00409c60
lea ecx, [esp + 0xa8]
push 1
push ecx
call fcn.00409c60
lea edx, [esp + 0xa0]
push 1
push edx
call fcn.00409c60
lea eax, [esp + 0x68]
push 1
push eax
call fcn.00409c60
lea ecx, [esp + 0xa0]
push 1
push ecx
call fcn.00409c60
lea edx, [esp + 0x140]
push 1
push edx
call fcn.00409c60
lea eax, [esp + 0xa0]
push 1
push eax
call fcn.00409c60
lea ecx, [esp + 0x104]
push 1
push ecx
call fcn.00409c60
add esp, 0x40
lea eax, [ebx + 0x24]
push 0
push eax
mov eax, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc8]
sub esp, 0x10
mov edx, esp
push esi
mov dword [edx], eax
mov eax, dword [esp + 0xe0]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0xe4]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
call fcn.00409a70
add esp, 0x1c
mov edi, eax
lea eax, [ebx + 0x4d]
mov ecx, dword [esp + 0xd0]
push 0
push eax
mov eax, dword [esp + 0xd4]
sub esp, 0x10
mov edx, esp
mov dword [esp + 0x2c], edi
push esi
mov dword [edx], eax
mov eax, dword [esp + 0xf0]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0xf4]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
call fcn.00409a70
mov dword [esp + 0x44], eax
mov eax, dword [ebx + 0xf2]
add esp, 0x1c
mov dword [esp + 0xc], 0
test eax, eax
jle 0x40b162
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov ecx, dword [ebx + 0xfa]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add edx, ecx
push edx
call edi
mov ecx, dword [ebx + 0xfa]
mov edx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x68], edx
add eax, ecx
push eax
call edi
mov ecx, dword [esp + 0x68]
cmp ecx, eax
jle 0x40b140
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [ebx + 0xf2]
inc eax
add edx, 0x14
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], edx
jl 0x40b0fe
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x88]
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x80]
sub eax, edx
push 0
cdq
idiv dword [ebx + 0xf2]
mov ecx, 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x24]
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0xfa]
lea edx, [eax + edx*4]
push edx
mov edx, dword [esp + 0x50]
sub esp, 0x10
mov eax, esp
push esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x68]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.00409a70
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x50], eax
mov eax, 1
mov dword [esp + 0x64], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
sub ecx, edx
mov eax, 0x66666667
imul ecx
add esp, 0x1c
lea ecx, [esp + 0x178]
sar edx, 2
mov eax, edx
push 0
push ecx
mov ecx, dword [esp + 0x48]
shr eax, 0x1f
sub esp, 0x10
add edx, eax
mov eax, esp
mov dword [esp + 0x64], edx
push esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.00409a70
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x38]
add esp, 0x1c
cmp eax, edi
mov dword [esp + 0x38], eax
jle 0x40b24f
mov dword [esp + 0x38], edi
mov eax, dword [ebx + 0xee]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0xc], esi
jle 0x40b2b7
mov dword [esp + 0x24], esi
mov edx, dword [ebx + 0xf6]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add edx, esi
push edx
call edi
mov ecx, dword [esp + 0x24]
mov edx, eax
mov eax, dword [ebx + 0xf6]
mov dword [esp + 0x68], edx
add eax, ecx
push eax
call edi
mov ecx, dword [esp + 0x68]
cmp ecx, eax
jle 0x40b2a1
mov edx, dword [esp + 0xc]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [ebx + 0xee]
inc eax
add esi, 0x14
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x40b267
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x70]
mov ecx, dword [ebx + 0xee]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x78]
lea edi, [esp + 0xdc]
sub eax, esi
lea ecx, [ecx + ecx*2]
shl eax, 1
cdq
idiv ecx
mov ecx, 0xf
mov esi, 0x4d5968
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0xf6]
lea ecx, [esp + 0xdc]
push ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x44], 1
mov edx, dword [esp + 0x80]
lea ecx, [ecx + ecx*4]
mov dword [esp + 0x50], edx
lea ecx, [esi + ecx*4]
mov esi, dword [esp + 0x44]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], esi
mov esi, dword [esp + 0x5c]
sub eax, 2
mov dword [ecx + 4], esi
mov dword [esp + 0x60], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00409a70
mov ecx, 0xf
mov esi, 0x4d5968
lea edi, [esp + 0xf8]
add esp, 0x1c
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xdc]
mov dword [esp + 0xdc], eax
push ecx
mov dword [esp + 0xe4], 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edx, dword [ebp + 0xc]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
mov al, byte [ebx + 0xc9]
cmp al, 4
mov dword [esp + 0xc], 0
je 0x40b4f9
lea eax, [esp + 0x178]
lea ecx, [esp + 0x128]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov esi, dword [esp + 0x9c]
mov edx, dword [esp + 0x94]
mov ecx, esi
mov eax, 0x66666667
sub ecx, edx
push 0x26
mov edx, ecx
imul edx, dword [esp + 0x10]
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x94]
sub esi, edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x44], eax
mov eax, 0x66666667
mov dword [edx], esi
imul ecx
sar edx, 2
mov ecx, edx
mov eax, dword [esp + 0x94]
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [esp + 0x9c]
mov edi, edx
mov edx, esi
sub edx, edi
add edi, esi
mov dword [esp + 0x48], edx
mov edx, ecx
sub edx, eax
mov eax, 0x66666667
imul edx
sar edx, 3
mov eax, edx
mov dword [esp + 0x50], edi
shr eax, 0x1f
add edx, eax
mov eax, dword [ebp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x44]
push ecx
push 0xffffffffffffffff
push edx
push eax
call dword [sym.imp.USER32.dll_DrawTextA]
mov al, byte [ebx + 0xc9]
cmp al, 1
je 0x40b464
cmp al, 3
jne 0x40b4cc
mov ecx, dword [esp + 0x5c]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0xc]
sub ecx, edi
imul ecx, esi
mov eax, 0x66666667
push 0
imul ecx
sar edx, 2
mov ecx, edx
mov eax, dword [ebp + 0xc]
shr ecx, 0x1f
add edx, ecx
add edx, edi
push edx
mov edx, dword [esp + 0x58]
push edx
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [esp + 0x5c]
mov edi, dword [esp + 0x54]
sub ecx, edi
mov eax, 0x66666667
imul ecx, esi
imul ecx
sar edx, 2
mov ecx, edx
mov eax, dword [ebp + 0xc]
shr ecx, 0x1f
add edx, ecx
add edx, edi
push edx
mov edx, dword [esp + 0x5c]
push edx
push eax
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x40b4d0
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc esi
add edx, 4
add ecx, 0x14
cmp esi, 0xb
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
jl 0x40b3b7
jmp 0x40b5d9
lea ecx, [esp + 0x178]
mov esi, 6
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x9c]
mov edi, dword [esp + 0x94]
mov dword [esp + 0x40], edx
sub ecx, edi
lea edx, [esi - 2]
imul edx, ecx
imul ecx, esi
fild dword [esp + 0xc]
fmul qword [0x4bd0c8]
mov eax, 0x66666667
sub esp, 8
imul edx
fstp qword [esp]
sar edx, 1
mov eax, edx
push str._3.2f
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x9c]
add edx, edi
mov edi, dword [esp + 0xa4]
mov dword [esp + 0x50], edx
mov edx, edi
sub edx, eax
mov eax, 0x66666667
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x66666667
sub edi, edx
imul ecx
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x30]
sar edx, 1
mov ecx, edx
push edi
shr ecx, 0x1f
add edx, ecx
add edx, eax
mov dword [esp + 0x5c], edx
call fcn.0049712c
mov eax, dword [ebp + 0xc]
add esp, 0x10
lea edx, [esp + 0x40]
push 0x26
push edx
push 0xffffffffffffffff
push edi
push eax
call dword [sym.imp.USER32.dll_DrawTextA]
mov eax, dword [esp + 0xc]
add edi, 0x14
inc eax
dec esi
cmp esi, 1
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], edi
jge 0x40b509
mov ecx, dword [esp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ecx
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x34]
lea eax, [esp + 0xdc]
push eax
mov dword [esp + 0xe0], edx
mov dword [esp + 0xe4], 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push esi
call edi
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xf2]
cmp eax, 1
jne 0x40b642
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x80]
sub ecx, edx
mov dword [esp + 0x34], ecx
fild dword [esp + 0x34]
jmp 0x40b665
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x80]
sub edx, ecx
lea ecx, [eax - 1]
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
mov dword [esp + 0x34], ecx
fidiv dword [esp + 0x34]
fstp dword [esp + 0x20]
xor esi, esi
cmp eax, esi
mov dword [esp + 0xc], esi
jle 0x40b761
mov dword [esp + 0x1c], esi
fild dword [esp + 0xc]
fmul dword [esp + 0x20]
fstp dword [esp + 0x18]
fild dword [esp + 0x80]
fadd dword [esp + 0x18]
call fcn.00496fa4
mov edx, dword [0x4d5900]
mov dword [edx + esi*4], eax
mov edi, dword [0x4d5900]
fild dword [edi + esi*4]
fsub dword [esp + 0x20]
call fcn.00496fa4
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x44], eax
fild dword [edi + esi*4]
fadd dword [esp + 0x20]
call fcn.00496fa4
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [ebx + 0xfa]
lea edx, [esp + 0x40]
push 0x25
push edx
add eax, ecx
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push eax
push ecx
call dword [sym.imp.USER32.dll_DrawTextA]
mov al, byte [ebx + 0xc9]
cmp al, 2
je 0x40b70a
cmp al, 3
jne 0x40b743
fild dword [esp + 0x50]
mov edx, dword [esp + 0x54]
push 0
push edx
fadd dword [esp + 0x20]
call fcn.00496fa4
mov edi, dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
fild dword [esp + 0x50]
mov eax, dword [esp + 0x5c]
push eax
fadd dword [esp + 0x1c]
call fcn.00496fa4
push eax
push edi
call dword [sym.imp.GDI32.dll_LineTo]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebx + 0xf2]
inc esi
add ecx, 0x14
cmp esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], ecx
jl 0x40b67b
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0xf
mov esi, 0x4d5968
lea edi, [esp + 0xdc]
lea eax, [ebx + 0x76]
rep movsd dword es:[edi], dword [esi]
cmp byte [eax], 0
je 0x40b91a
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp byte [eax], 0x80
jae 0x40b872
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0xdc]
push edx
mov dword [esp + 0xe8], 0xa8c
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe0], ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push esi
call edi
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0xa8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
push 1
push eax
push ecx
mov ecx, dword [esp + 0xac]
sub edx, ecx
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0xe8]
add edx, eax
add edx, ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [esp + 0x10]
push ecx
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0xdc]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
fmul qword [0x4bd340]
call fcn.00496fa4
mov ecx, dword [esp + 0xa4]
add ecx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0xa4], ecx
inc eax
jmp 0x40b90a
mov edx, dword [esp + 0x38]
xor eax, eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe0], eax
lea eax, [esp + 0xdc]
mov dword [esp + 0xdc], edx
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push esi
call edi
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xa4]
push 2
push ecx
mov ecx, dword [esp + 0xa8]
push edx
mov edx, dword [esp + 0xb4]
mov dword [esp + 0x1c], eax
sub edx, ecx
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
add edx, ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [esp + 0x10]
push ecx
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0xdc]
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0xc]
add ecx, edx
mov dword [esp + 0xa4], ecx
add eax, 2
mov cl, byte [eax]
mov dword [esp + 0xc], eax
test cl, cl
jne 0x40b7a3
jmp 0x40b923
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov al, byte [ebx + 0x24]
test al, al
je 0x40b981
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xdc]
xor eax, eax
push edx
mov dword [esp + 0xe8], eax
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push esi
call edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0xbc]
push 0x25
push eax
lea eax, [ebx + 0x24]
push 0xffffffffffffffff
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [esp + 0x10]
push ecx
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov al, byte [ebx + 0x9f]
test al, al
je 0x40b9e0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xdc]
push eax
mov dword [esp + 0xe0], edx
mov dword [esp + 0xe4], 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push esi
call edi
lea ecx, [esp + 0x118]
mov dword [esp + 0x10], eax
push 0x25
push ecx
lea eax, [ebx + 0x9f]
push 0xffffffffffffffff
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
mov edx, dword [esp + 0x10]
push edx
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov al, byte [ebx + 0x4d]
test al, al
je 0x40ba39
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xdc]
push ecx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push esi
call edi
lea edx, [esp + 0xcc]
mov dword [esp + 0x10], eax
push 0x25
push edx
lea eax, [ebx + 0x4d]
push 0xffffffffffffffff
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
mov eax, dword [esp + 0x10]
push eax
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0xf
mov esi, 0x4d5968
lea edi, [esp + 0xdc]
lea edx, [esp + 0xdc]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x68]
push edx
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov esi, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [ebx + 0xee]
xor esi, esi
test ecx, ecx
jle 0x40bbf8
mov dword [esp + 0x14], esi
mov dword [esp + 0x38], 0x4d5924
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x70]
sub eax, edx
push 0x25
mov dword [esp + 0x2c], eax
cdq
idiv ecx
lea ecx, [ecx + ecx*2]
mov edi, eax
mov eax, dword [esp + 0x2c]
cdq
idiv ecx
mov ecx, dword [esp + 0x74]
mov edx, edi
imul edx, esi
add ecx, eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x48], eax
lea eax, [esi + 1]
imul edi, eax
lea edx, [edx + ecx + 1]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], edx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x80]
lea edx, [edi + ecx - 2]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x50], eax
mov eax, dword [ebx + 0xf6]
lea ecx, [esp + 0x44]
add edx, eax
mov eax, dword [ebp + 0xc]
push ecx
push 0xffffffffffffffff
push edx
push eax
call dword [sym.imp.USER32.dll_DrawTextA]
mov edi, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov ecx, dword [ebx + 0xee]
sub edi, eax
mov eax, edi
cdq
idiv ecx
mov edx, dword [esp + 0x70]
mov ecx, eax
imul ecx, esi
mov esi, dword [esp + 0x7c]
lea eax, [ecx + edx + 1]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x40], eax
mov eax, esi
sub eax, edx
cdq
and edx, 3
add eax, edx
mov edx, dword [esp + 0x74]
sar eax, 2
mov dword [esp + 0x34], eax
add eax, edx
mov dword [esp + 0x44], eax
mov eax, dword [ebx + 0xee]
lea edx, [eax + eax*2]
mov eax, edi
mov edi, edx
cdq
idiv edi
sub esi, dword [esp + 0x34]
mov dword [esp + 0x4c], esi
add eax, ecx
mov ecx, dword [esp + 0x70]
lea edx, [eax + ecx - 1]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x48], edx
mov ecx, dword [eax]
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
mov edi, eax
mov eax, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x68]
add ecx, 4
mov dword [esp + 0x38], ecx
mov ecx, dword [ebx + 0xee]
add edx, 0x14
cmp esi, ecx
mov dword [esp + 0x14], edx
jl 0x40baa4
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebx + 0xf2]
xor esi, esi
test eax, eax
mov dword [esp + 0xc], esi
jle 0x40bc91
mov edi, dword [esp + 0x6c]
mov edx, dword [0x4d5904]
xor eax, eax
mov dword [edx + esi*8], eax
mov ecx, dword [0x4d5904]
mov dword [ecx + esi*8 + 4], eax
mov cl, byte [ebx + 0xc9]
cmp cl, 4
jne 0x40bc57
mov edx, dword [0x4d5908]
mov dword [edx + esi*8], eax
mov ecx, dword [0x4d5908]
mov dword [ecx + esi*8 + 4], eax
jmp 0x40bc66
fld qword [esp + 0x60]
mov edx, dword [0x4d5908]
fchs
fstp qword [edx + esi*8]
fild dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
mov dword [edi + esi*8 + 4], eax
fmul dword [esp + 0x20]
fiadd dword [esp + 0x50]
call fcn.00496fa4
mov dword [edi + esi*8], eax
mov eax, dword [ebx + 0xf2]
inc esi
cmp esi, eax
mov dword [esp + 0xc], esi
jl 0x40bc22
mov al, byte [ebx + 0xc9]
test al, al
je 0x40c13d
cmp al, 1
je 0x40c13d
cmp al, 2
je 0x40c13d
cmp al, 3
je 0x40c13d
cmp al, 5
jne 0x40bf9a
mov eax, dword [esp + 0x3c]
mov ecx, dword [ebx + 0xee]
cmp eax, ecx
mov dword [esp + 0xc], eax
jge 0x40bdfb
lea ecx, [eax*4 + 0x4d5924]
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0xf2]
mov edi, dword [esp + 0x6c]
dec eax
js 0x40bd19
lea ecx, [edi + eax*8]
mov edx, dword [ebx + 0xf2]
mov esi, dword [ecx]
shl edx, 1
sub edx, eax
sub ecx, 8
mov dword [edi + edx*8 - 8], esi
mov edx, dword [ebx + 0xf2]
mov esi, dword [ecx + 0xc]
shl edx, 1
sub edx, eax
dec eax
test eax, eax
mov dword [edi + edx*8 - 4], esi
jge 0x40bcf0
mov eax, dword [ebx + 0xf2]
xor esi, esi
test eax, eax
mov dword [esp + 0x10], esi
jle 0x40bd99
imul eax, dword [esp + 0xc]
mov edx, dword [ebx + 0xfe]
mov ecx, dword [0x4d5908]
add eax, esi
fld qword [edx + eax*8]
fadd qword [ecx + esi*8]
fstp qword [ecx + esi*8]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x54]
sub eax, ecx
mov ecx, dword [0x4d5908]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul qword [ecx + esi*8]
fdiv qword [esp + 0xb0]
call fcn.00496fa4
fild dword [esp + 0x10]
mov ecx, dword [esp + 0x5c]
sub ecx, eax
fmul dword [esp + 0x20]
mov dword [edi + esi*8 + 4], ecx
fiadd dword [esp + 0x50]
call fcn.00496fa4
mov dword [edi + esi*8], eax
mov eax, dword [ebx + 0xf2]
inc esi
cmp esi, eax
mov dword [esp + 0x10], esi
jl 0x40bd29
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0xf2]
mov dword [esp + 0x10], eax
shl ecx, 1
push ecx
push edi
push esi
call dword [sym.imp.GDI32.dll_Polygon]
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [ebx + 0xee]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
jl 0x40bce0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], 0
test eax, eax
jle 0x40c276
mov eax, dword [sym.imp.GDI32.dll_CreatePen]
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, 0x4d5924
mov dword [esp + 0x14], ecx
jmp 0x40be34
mov eax, dword [sym.imp.GDI32.dll_CreatePen]
mov esi, dword [ebp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x5c]
sub edx, dword [esp + 0x54]
cmp edx, 0x32
jge 0x40be55
mov edx, dword [esp + 0x58]
sub edx, dword [esp + 0x50]
cmp edx, 0x32
jge 0x40be55
mov ecx, dword [ecx]
push ecx
push 1
jmp 0x40be5a
mov edx, dword [ecx]
push edx
push 2
push 0
call eax
push eax
push esi
call edi
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0xf2]
xor esi, esi
lea ecx, [eax - 1]
mov dword [esp + 0x10], esi
test ecx, ecx
jle 0x40bf54
imul eax, dword [esp + 0xc]
mov edx, dword [ebx + 0xfe]
mov edi, dword [esp + 0x5c]
add eax, esi
push 0
fld qword [edx + eax*8]
mov edx, dword [esp + 0x58]
mov eax, edi
fsub qword [esp + 0x64]
sub eax, edx
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fmulp st(1)
fdiv qword [esp + 0xb4]
call fcn.00496fa4
fild dword [esp + 0x14]
sub edi, eax
push edi
fmul dword [esp + 0x28]
fiadd dword [esp + 0x58]
call fcn.00496fa4
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov edx, dword [esp + 0xc]
mov eax, dword [ebx + 0xfe]
imul edx, dword [ebx + 0xf2]
add edx, esi
lea edi, [esi + 1]
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x34], edi
fld qword [eax + edx*8 + 8]
mov edx, dword [esp + 0x54]
mov ecx, esi
fsub qword [esp + 0x60]
sub ecx, edx
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
fmulp st(1)
fdiv qword [esp + 0xb0]
call fcn.00496fa4
fild dword [esp + 0x34]
sub esi, eax
push esi
fmul dword [esp + 0x24]
fiadd dword [esp + 0x54]
call fcn.00496fa4
mov edx, dword [ebp + 0xc]
push eax
push edx
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [ebx + 0xf2]
mov esi, edi
mov dword [esp + 0x10], esi
lea ecx, [eax - 1]
cmp esi, ecx
jl 0x40be7d
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x24]
mov eax, dword [ebp + 0xc]
push edx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x3c]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
jl 0x40be28
mov eax, dword [esp + 0x6c]
push eax
call fcn.00496fcb
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 4
jne 0x40c276
mov ecx, dword [ebx + 0xf2]
xor eax, eax
test ecx, ecx
jle 0x40bfee
mov edx, dword [ebx + 0xee]
xor ecx, ecx
test edx, edx
jle 0x40bfe3
mov esi, ecx
mov edi, dword [ebx + 0xfe]
imul esi, dword [ebx + 0xf2]
mov edx, dword [0x4d5904]
add esi, eax
inc ecx
fld qword [edi + esi*8]
fadd qword [edx + eax*8]
fstp qword [edx + eax*8]
cmp ecx, dword [ebx + 0xee]
jl 0x40bfba
mov ecx, dword [ebx + 0xf2]
inc eax
cmp eax, ecx
jl 0x40bfae
mov eax, dword [ebx + 0xee]
mov dword [esp + 0xc], 0
test eax, eax
jle 0x40c276
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x3c], 0x4d5924
mov eax, dword [ebx + 0xf2]
dec eax
js 0x40c045
lea ecx, [edi + eax*8]
mov edx, dword [ebx + 0xf2]
mov esi, dword [ecx]
shl edx, 1
sub edx, eax
sub ecx, 8
mov dword [edi + edx*8 - 8], esi
mov edx, dword [ebx + 0xf2]
mov esi, dword [ecx + 0xc]
shl edx, 1
sub edx, eax
dec eax
test eax, eax
mov dword [edi + edx*8 - 4], esi
jge 0x40c01c
mov eax, dword [ebx + 0xf2]
xor esi, esi
test eax, eax
mov dword [esp + 0x10], esi
jle 0x40c0c7
imul eax, dword [esp + 0xc]
mov edx, dword [ebx + 0xfe]
mov ecx, dword [0x4d5908]
add eax, esi
fld qword [edx + eax*8]
fadd qword [ecx + esi*8]
fstp qword [ecx + esi*8]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x54]
sub eax, ecx
mov ecx, dword [0x4d5908]
mov edx, dword [0x4d5904]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul qword [ecx + esi*8]
fdiv qword [edx + esi*8]
call fcn.00496fa4
fild dword [esp + 0x10]
mov ecx, dword [esp + 0x5c]
sub ecx, eax
fmul dword [esp + 0x20]
mov dword [edi + esi*8 + 4], ecx
fiadd dword [esp + 0x50]
call fcn.00496fa4
mov dword [edi + esi*8], eax
mov eax, dword [ebx + 0xf2]
inc esi
cmp esi, eax
mov dword [esp + 0x10], esi
jl 0x40c055
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edx, dword [ebp + 0xc]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov eax, dword [ebx + 0xf2]
shl eax, 1
push eax
push edi
push ecx
call dword [sym.imp.GDI32.dll_Polygon]
mov edx, dword [ebp + 0xc]
push esi
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x3c]
mov ecx, dword [ebx + 0xee]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x3c], edx
jl 0x40c010
mov eax, dword [esp + 0x6c]
push eax
call fcn.00496fcb
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xee]
mov dword [esp + 0xc], 0
test eax, eax
jle 0x40c276
mov dword [esp + 0x3c], 0x4d5924
mov eax, dword [ebx + 0xf2]
mov edi, dword [esp + 0x6c]
dec eax
js 0x40c194
lea ecx, [edi + eax*8]
mov edx, dword [ebx + 0xf2]
mov esi, dword [ecx]
shl edx, 1
sub edx, eax
sub ecx, 8
mov dword [edi + edx*8 - 8], esi
mov edx, dword [ebx + 0xf2]
mov esi, dword [ecx + 0xc]
shl edx, 1
sub edx, eax
dec eax
test eax, eax
mov dword [edi + edx*8 - 4], esi
jge 0x40c16b
mov eax, dword [ebx + 0xf2]
xor esi, esi
test eax, eax
mov dword [esp + 0x10], esi
jle 0x40c214
imul eax, dword [esp + 0xc]
mov edx, dword [ebx + 0xfe]
mov ecx, dword [0x4d5908]
add eax, esi
fld qword [edx + eax*8]
fadd qword [ecx + esi*8]
fstp qword [ecx + esi*8]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x54]
sub eax, ecx
mov ecx, dword [0x4d5908]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul qword [ecx + esi*8]
fdiv qword [esp + 0xb0]
call fcn.00496fa4
fild dword [esp + 0x10]
mov ecx, dword [esp + 0x5c]
sub ecx, eax
fmul dword [esp + 0x20]
mov dword [edi + esi*8 + 4], ecx
fiadd dword [esp + 0x50]
call fcn.00496fa4
mov dword [edi + esi*8], eax
mov eax, dword [ebx + 0xf2]
inc esi
cmp esi, eax
mov dword [esp + 0x10], esi
jl 0x40c1a4
mov edx, dword [esp + 0x3c]
mov eax, dword [edx]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0xf2]
mov dword [esp + 0x10], eax
shl ecx, 1
push ecx
push edi
push esi
call dword [sym.imp.GDI32.dll_Polygon]
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x3c]
mov ecx, dword [ebx + 0xee]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x3c], edx
jl 0x40c15b
mov eax, dword [esp + 0x6c]
push eax
call fcn.00496fcb
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret