Function at 0x427480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
test byte [0x46bfd0], 1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x4274bb
or dword [0x46bfd0], 1
push 0x45f8f0
push str.msimg32.dll
call ebx
push eax
call esi
mov dword [0x46bfcc], eax
test byte [0x46bfd0], 2
jne 0x4274df
or dword [0x46bfd0], 2
push str.GradientFill
push str.msimg32.dll
call ebx
push eax
call esi
mov dword [0x46bfc8], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edx, ecx
shr edx, 0x18
mov esi, eax
shr esi, 0x18
add edx, esi
shr edx, 1
test dl, dl
mov byte [esp + 9], dl
je 0x4277d2
mov esi, dword [edi + 0xc]
sub esi, dword [edi + 4]
mov ebx, dword [edi + 8]
sub ebx, dword [edi]
cmp dl, 0xff
mov dword [esp + 0x18], esi
mov esi, dword [edi]
mov dword [esp + 0x48], esi
mov esi, dword [edi + 4]
mov dword [esp + 0x4c], esi
mov esi, dword [edi + 8]
mov dword [esp + 0x50], esi
mov esi, dword [edi + 0xc]
mov dword [esp + 0x54], esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
jae 0x427594
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x18]
mov ecx, esi
push ecx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [esp + 0x38], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x10]
cmp dword [0x46bfc8], 0
je 0x42763b
mov edx, dword [esp + 0x48]
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x5c], edx
xor edx, edx
mov dh, cl
push 1
push 1
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 1
mov word [esp + 0x68], dx
xor edx, edx
mov dh, ch
shr ecx, 0x10
mov word [esp + 0x6a], dx
xor edx, edx
mov dh, cl
mov ecx, 0xff00
mov word [esp + 0x6e], cx
mov word [esp + 0x7e], cx
lea ecx, [esp + 0x60]
mov word [esp + 0x6c], dx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x70], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x74], edx
xor edx, edx
mov dh, al
mov word [esp + 0x78], dx
xor edx, edx
mov dh, ah
shr eax, 0x10
mov word [esp + 0x7a], dx
xor edx, edx
mov dh, al
lea eax, [esp + 0x48]
push eax
push 2
push ecx
push esi
mov word [esp + 0x8c], dx
call dword [0x46bfc8]
jmp 0x427776
mov bx, ax
shr bx, 8
mov word [esp + 0xa], bx
mov bx, cx
shr bx, 8
mov word [esp + 0xc], bx
movzx ebx, al
mov edx, eax
movzx eax, cl
mov dword [esp + 0x10], ecx
shr dword [esp + 0x10], 0x10
xor esi, esi
shr edx, 0x10
mov ecx, ebx
neg ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ecx
mov eax, 2
lea ecx, [ebx + ebx]
mov dword [esp + 0x34], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jmp 0x427694
mov edx, dword [esp + 0x34]
movzx ebx, byte [esp + 0x10]
movzx edx, dl
imul ebx, esi
imul edx, eax
add edx, ebx
sar edx, 1
xor ebx, ebx
mov bh, dl
movzx edx, byte [esp + 0xa]
imul edx, eax
movzx eax, byte [esp + 0xc]
imul eax, esi
add edx, eax
sar edx, 1
mov bl, dl
mov edx, dword [esp + 0x14]
add ecx, edx
sar ecx, 1
movzx eax, cl
shl ebx, 8
or ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x5c], edx
mov edx, eax
sub edx, dword [edi + 4]
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x54]
mov ebx, edx
imul ebx, esi
mov dword [esp + 0x64], ecx
sar ebx, 1
mov ecx, eax
sub ecx, ebx
add esi, 1
mov ebx, esi
imul ebx, edx
sar ebx, 1
sub eax, ebx
mov dword [esp + 0x64], ecx
sub ecx, eax
test ecx, ecx
mov dword [esp + 0x5c], eax
jle 0x42773c
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebp + 8]
push edx
lea eax, [esp + 0x5c]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
add ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add dword [esp + 0x14], edx
sub eax, 1
test eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
jg 0x427690
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x28]
mov al, byte [esp + 9]
cmp al, 0xff
jae 0x4277d2
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov byte [esp + 0xe], al
mov byte [esp + 0xc], 0
mov byte [esp + 0xd], 0
mov byte [esp + 0xf], 1
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x1c]
push eax
push ebx
push 0
push 0
push esi
push eax
mov eax, dword [ebp + 8]
push ebx
push ecx
push edx
push eax
call dword [0x46bfcc]
mov ecx, dword [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret