Function at 0x409590
Capabilities:
Check for peb beingdebugged flag
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x42194c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
mov eax, dword [0x42a49c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x36c]
mov ecx, dword [edi + 0x368]
push eax
xor edx, edx
mov dl, byte [edi + 0x41]
push eax
push ecx
push eax
push edx
lea eax, [esp + 0x24]
push str._rtf1_ansi_fonttbl_f0_fcharset_d_fprq0__s__f1_fcharset255_fprq0__s__f2_fcharset0_fprq0__s__f3_fcharset238_fprq0__s_
push eax
mov dword [esp + 0x188], 0
call fcn.004175d6
mov eax, dword [esp + 0x2c]
mov edx, dword [edi + 0x620]
add esp, 0x1c
lea esi, [edi + 0x620]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
push str.colortbl__red0green0_blue255__red0green255_blue255__red255green0_blue255__red255green255_blue0__red255green0_blue0__red0green255_blue0_
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ebp, dword [esp + 0x174]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x6e
mov eax, dword [ebp + 8]
push eax
call ebx
mov ecx, dword [ebp + 8]
push 0x58
push ecx
mov dword [esp + 0x34], eax
call ebx
mov ecx, eax
mov eax, dword [esp + 0x2c]
push 0x6f
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
cdq
idiv ecx
mov edx, dword [ebp + 8]
push edx
mov dword [esp + 0x34], eax
call ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
push 0x5a
push eax
call ebx
mov ecx, eax
mov eax, dword [esp + 0x24]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
cdq
idiv ecx
mov ecx, dword [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x20], eax
push str.paperw_dpaperh_d
lea edx, [esp + 0x1c]
push edx
call fcn.004175d6
mov eax, dword [esp + 0x20]
mov edx, dword [esi]
add esp, 0x10
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [ebp + 8]
push 0xa
push eax
call ebx
mov ecx, dword [ebp + 8]
push 0x5a
push ecx
mov dword [esp + 0x2c], eax
call ebx
mov ecx, eax
mov eax, dword [esp + 0x24]
push 8
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
cdq
idiv ecx
mov dword [edi + 0x61c], eax
mov edx, dword [ebp + 8]
push edx
call ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
push 0x58
push eax
call ebx
mov ecx, eax
mov eax, dword [esp + 0x24]
push 0x70
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
cdq
idiv ecx
mov ecx, dword [ebp + 8]
push ecx
mov dword [esp + 0x2c], eax
call ebx
mov edx, dword [ebp + 8]
push 0x58
push edx
mov dword [esp + 0x24], eax
call ebx
mov ecx, eax
mov eax, dword [esp + 0x1c]
push 0x71
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
cdq
idiv ecx
add eax, 2
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
push eax
call ebx
mov ecx, dword [ebp + 8]
push 0x5a
push ecx
mov dword [esp + 0x38], eax
call ebx
mov ecx, eax
mov eax, dword [esp + 0x30]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
cdq
idiv ecx
mov ebx, eax
add ebx, 2
fild dword [edi + 0x4c]
fmul qword [0x4236b0]
call fcn.0040d650
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jle 0x409782
mov ebp, dword [esp + 0x24]
mov edx, ecx
sub edx, eax
mov dword [esp + 0x1c], eax
add ebp, edx
jmp 0x409786
mov ebp, dword [esp + 0x24]
fild dword [edi + 0x50]
fmul qword [0x4236b0]
call fcn.0040d650
cmp eax, ebx
jle 0x4097aa
mov ecx, dword [edi + 0x61c]
sub ebx, eax
add ecx, ebx
mov ebx, eax
mov dword [edi + 0x61c], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
sub eax, ecx
sub eax, ebp
add eax, 4
mov ecx, eax
jns 0x4097bf
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov edx, dword [edi + 0x61c]
sub eax, ebx
sub eax, edx
add eax, 4
mov dword [esp + 0x2c], eax
jns 0x4097dc
xor eax, eax
mov dword [esp + 0x2c], eax
push eax
mov eax, dword [esp + 0x20]
push ecx
push ebx
push eax
lea ecx, [esp + 0x20]
push str.margl_dmargt_dmargr_dmargb_d
push ecx
call fcn.004175d6
mov eax, dword [esp + 0x28]
mov edx, dword [esi]
add esp, 0x18
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi + 0x34]
test eax, eax
je 0x40982b
push str.landscape
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [edi + 0x30]
test ecx, ecx
je 0x409845
mov eax, dword [edi + 0x61c]
cdq
idiv ecx
neg eax
mov dword [edi + 0x614], eax
jmp 0x40984f
mov dword [edi + 0x614], 0xffffff10
mov eax, dword [edi + 0x614]
lea ecx, [esp + 0x10]
push eax
push str._sl_d
push ecx
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi + 0x394]
test eax, eax
jne 0x409977
cmp ebp, 0x21c0
jle 0x40990a
cmp ebp, 0x2d00
jge 0x40997d
mov eax, dword [edi + 0x370]
test eax, eax
je 0x4098b0
mov eax, ebp
shl eax, 5
add eax, ebp
lea ecx, [eax + eax*2]
jmp 0x4098ef
mov eax, dword [edi + 0x374]
test eax, eax
je 0x4098e4
lea eax, [ebp + ebp*2]
shl eax, 3
sub eax, ebp
lea ecx, [eax + eax*4]
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [edi + 0x610], edx
jmp 0x40997d
lea edx, [ebp + ebp*2]
lea ecx, [ebp + edx*8]
shl ecx, 2
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [edi + 0x610], edx
jmp 0x40997d
mov eax, dword [edi + 0x370]
test eax, eax
je 0x409939
mov eax, ebp
shl eax, 5
add eax, ebp
lea ecx, [eax + eax*2]
mov eax, 0xf2b9d649
imul ecx
add edx, ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [edi + 0x610], edx
jmp 0x40997d
mov eax, dword [edi + 0x374]
test eax, eax
je 0x40996a
lea eax, [ebp + ebp*2]
shl eax, 3
sub eax, ebp
lea ecx, [eax + eax*4]
mov eax, 0xf2b9d649
imul ecx
add edx, ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [edi + 0x610], edx
jmp 0x40997d
lea ecx, [ebp + ebp*2]
lea ecx, [ebp + ecx*8]
shl ecx, 2
jmp 0x40994f
mov dword [edi + 0x610], eax
mov eax, dword [edi + 0x610]
mov ecx, eax
and ecx, 0x80000001
jns 0x409992
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x40999b
dec eax
mov dword [edi + 0x610], eax
mov edx, dword [edi + 0x610]
lea eax, [esp + 0x10]
push edx
push str.charscalex_d
push eax
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
fild dword [edi + 0x610]
fmul qword [str._np_n_]
call fcn.0040d650
push eax
lea eax, [esp + 0x14]
push str.deftab_d_f0
push eax
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, edi
call fcn.0040add0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x409a2d
push ebp
mov ecx, edi
call fcn.0040b220
test eax, eax
jne 0x409a2d
lea ecx, [esp + 0x10]
mov dword [esp + 0x16c], 0xffffffff
call fcn.00418a41
xor eax, eax
jmp 0x40ac08
xor eax, eax
lea ebx, [edi + 0x530]
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov eax, dword [ebx]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x40abd3
mov edx, dword [esp + 0x14]
and edx, 0xff
lea eax, [edx - 8]
cmp eax, 0x13
ja case.0x409a71.19
xor ecx, ecx
mov cl, byte [eax + 0x40ac54]
jmp dword [ecx*4 + 0x40ac24]
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea eax, [ecx - 0xe]
cmp eax, 0x6a
ja case.0x409a71.13
xor edx, edx
mov dl, byte [eax + 0x40ad0c]
jmp dword [edx*4 + 0x40ac68]
mov dword [edi + 0x364], 0xa
mov dword [edi + 0x428], 0
mov ecx, edi
call fcn.0040add0
jmp case.0x409a71.13
mov dword [edi + 0x364], 0xc
jmp 0x409ab5
push 0x42a000
lea ecx, [esp + 0x14]
mov dword [edi + 0x420], 1
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
push str._b0
lea ecx, [esp + 0x14]
mov dword [edi + 0x420], 0
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
push 0x429ff4
lea ecx, [esp + 0x14]
mov dword [edi + 0x41c], 1
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
push str.i0
lea ecx, [esp + 0x14]
mov dword [edi + 0x41c], 0
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov al, byte [esp + 0x14]
cmp al, 0x31
je 0x409ba5
cmp al, 1
jne 0x409bd1
push str.ul
lea ecx, [esp + 0x14]
mov dword [edi + 0x418], 1
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov al, byte [esp + 0x14]
cmp al, 0x30
je 0x409bdd
test al, al
jne case.0x409a71.13
push str.ul0
lea ecx, [esp + 0x14]
mov dword [edi + 0x418], 0
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
mov ecx, edi
mov dword [edi + 0x364], 0xf
call fcn.0040add0
jmp case.0x409a71.13
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov al, byte [esp + 0x14]
cmp al, 0x31
je 0x409c3a
cmp al, 1
jne 0x409c44
mov dword [edi + 0x428], 1
cmp al, 0x30
je 0x409ab5
test al, al
jne 0x409abf
jmp 0x409ab5
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov al, byte [esp + 0x14]
cmp al, 0x31
je 0x409c73
cmp al, 1
jne 0x409c7d
mov dword [edi + 0x424], 1
cmp al, 0x30
je 0x409c89
test al, al
jne 0x409abf
mov ecx, edi
mov dword [edi + 0x424], 0
call fcn.0040add0
jmp case.0x409a71.13
mov edx, dword [ebx]
lea eax, [esp + 0x14]
xor ebp, ebp
push 1
push eax
mov ecx, ebx
mov dword [edi + 0x424], ebp
call dword [edx + 0x34]
mov al, byte [esp + 0x14]
test al, 1
je 0x409cc9
mov dword [edi + 0x364], 0xc
jmp 0x409cd3
mov dword [edi + 0x364], 0xa
test al, 4
je 0x409ce4
mov ebx, 1
mov dword [edi + 0x360], ebx
jmp 0x409cef
mov dword [edi + 0x360], ebp
mov ebx, 1
test al, 0x18
jne 0x409d00
mov dword [edi + 0x420], ebp
push str._b0
jmp 0x409d0b
mov dword [edi + 0x420], ebx
push 0x42a000
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov al, byte [esp + 0x14]
test al, 0x20
je 0x409d34
mov dword [edi + 0x428], ebx
jmp 0x409d3a
mov dword [edi + 0x428], ebp
test al, 0x40
je 0x409d4b
mov dword [edi + 0x41c], ebx
push 0x429ff4
jmp 0x409d56
mov dword [edi + 0x41c], ebp
push str.i0
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
test byte [esp + 0x14], 0x80
je 0x409d8f
push str.ul
lea ecx, [esp + 0x14]
mov dword [edi + 0x418], ebx
call fcn.00418b7e
jmp 0x40ab28
push str.ul0
lea ecx, [esp + 0x14]
mov dword [edi + 0x418], ebp
call fcn.00418b7e
jmp 0x40ab28
mov ecx, dword [edi + 0x30]
xor eax, eax
cmp ecx, eax
jne 0x409dbb
mov dword [edi + 0x614], 0xffffff10
mov dword [edi + 0x60c], eax
mov dword [edi + 0x608], eax
mov dword [edi + 0x360], eax
mov dword [edi + 0x418], eax
mov dword [edi + 0x41c], eax
mov dword [edi + 0x420], eax
mov dword [edi + 0x428], eax
mov dword [edi + 0x424], eax
mov dword [edi + 0x604], eax
mov al, byte [edi + 0x28]
cmp al, 0x63
mov dword [edi + 0x364], 0xa
je 0x409e06
mov byte [edi + 0x28], 0
push str.ul0i0_b0_nosupersubcf0_f0_fs24
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi + 0x614]
mov ecx, dword [edi + 0x610]
push eax
push ecx
lea edx, [esp + 0x18]
push str.charscalex_d_sl_d
push edx
call fcn.004175d6
mov eax, dword [esp + 0x20]
mov edx, dword [esi]
add esp, 0x10
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, edi
call fcn.00408860
jmp case.0x409a71.13
push 0xffffff10
mov dword [edi + 0x614], 0xffffff10
push str._sl_d
lea eax, [esp + 0x18]
push eax
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
push 0xffffff4c
lea eax, [esp + 0x14]
push str._sl_d
push eax
mov dword [edi + 0x614], 0xffffff4c
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov eax, dword [esp + 0x14]
test al, al
je case.0x409a71.13
mov ebx, dword [edi + 0x380]
neg ebx
sbb ebx, ebx
and ebx, 0x24
add ebx, 0xb4
and eax, 0xff
mov ecx, eax
neg eax
shl eax, 2
sub eax, ecx
lea eax, [eax + eax*8]
shl eax, 5
cdq
idiv ebx
push eax
mov dword [edi + 0x614], eax
push str._sl_d
lea edx, [esp + 0x18]
push edx
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov eax, dword [esp + 0x14]
test al, al
je case.0x409a71.13
and eax, 0xff
mov ecx, eax
neg eax
shl eax, 2
sub eax, ecx
lea ecx, [eax + eax*8]
mov eax, 0xb60b60b7
shl ecx, 5
imul ecx
add edx, ecx
lea ecx, [esp + 0x10]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push str._sl_d
push ecx
mov dword [edi + 0x614], edx
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov eax, dword [esp + 0x14]
test al, al
je case.0x409a71.13
mov ebx, dword [edi + 0x380]
neg ebx
sbb ebx, ebx
and ebx, 0xc
add ebx, 0x3c
jmp 0x409ef9
push 0xffffff74
lea eax, [esp + 0x14]
push str._sl_d
mov dword [edi + 0x614], 0xffffff74
push eax
jmp 0x409f21
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov ecx, edi
call fcn.0040af80
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x4236a0]
call fcn.0040d650
push eax
push str.li_d
jmp 0x409f1c
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x14]
and edx, 0xff
imul edx, dword [edi + 0x614]
push edx
push str.margb_d
jmp 0x409e74
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push str.margb_d
push ecx
jmp 0x409e79
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov ecx, dword [esp + 0x14]
test cl, cl
je case.0x409aa4.17
mov eax, dword [edi + 0x61c]
and ecx, 0xff
cdq
idiv ecx
lea edx, [esp + 0x10]
neg eax
push eax
push str._sl_d
mov dword [edi + 0x614], eax
push edx
jmp 0x409e79
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
jmp case.0x409a71.13
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov al, byte [esp + 0x14]
cmp al, 9
mov byte [edi + 0x28], al
jne case.0x409a71.13
mov byte [edi + 0x28], 0xa
jmp case.0x409a71.13
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov al, byte [esp + 0x14]
cmp al, 0x31
je 0x40a0fb
cmp al, 1
jne 0x40a127
push str._subcharscalex130
lea ecx, [esp + 0x14]
mov dword [edi + 0x604], 1
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov al, byte [esp + 0x14]
cmp al, 0x30
je 0x40a133
test al, al
jne case.0x409a71.13
push str._supercharscalex132
lea ecx, [esp + 0x14]
mov dword [edi + 0x604], 2
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
mov eax, dword [edi + 0x610]
lea ecx, [esp + 0x10]
push eax
push str._nosupersubcharscalex_d
mov dword [edi + 0x604], 0
push ecx
jmp 0x409e79
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0x380]
and edx, 0xff
neg eax
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
sbb eax, eax
and eax, 0x24
fmul qword [0x423698]
add eax, 0xb4
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fdivp st(1)
call fcn.0040d650
mov ebx, eax
cdq
xor eax, edx
mov dword [edi + 0x618], ebx
sub eax, edx
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x423690]
fsub qword [0x423688]
fmul qword [str._np]
call fcn.0040d650
push eax
push ebx
lea ecx, [esp + 0x18]
push str.par_sl_ddn_d
push ecx
call fcn.004175d6
mov eax, dword [esp + 0x20]
mov edx, dword [esi]
add esp, 0x10
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
mov ebp, 0xc8
mov dword [esp + 0x1c], 0
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov cl, byte [esp + 0x14]
test cl, cl
je 0x40a25a
cmp cl, 0x22
je 0x40a25a
mov eax, dword [esp + 0x1c]
mov byte [esp + eax + 0x60], cl
inc eax
cmp eax, 0x104
mov dword [esp + 0x1c], eax
jl 0x40a229
jmp 0x40a263
mov ecx, dword [esp + 0x1c]
mov byte [esp + ecx + 0x60], 0
xor ebx, ebx
mov al, byte [esp + ebx + 0x60]
test al, al
je 0x40a290
cmp al, 0x2c
je 0x40a27c
inc ebx
cmp ebx, 0x104
jl 0x40a265
jmp 0x40a290
lea edx, [esp + ebx + 0x61]
push edx
call fcn.0040d55a
add esp, 4
mov ebp, eax
mov byte [esp + ebx + 0x60], 0
push 0x2050
push 0
push 0
lea eax, [esp + 0x6c]
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov ebx, eax
test ebx, ebx
je case.0x409a71.13
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0x4235f8
push ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x170], 1
call fcn.0041e55a
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x48]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esp + 0x50]
xor edx, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
div ebp
xor edx, edx
push eax
mov eax, dword [esp + 0x50]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
div ebp
push eax
lea eax, [esp + 0x18]
push str._shp_shpinst_shpright_d_shpbottom_d_shpfhdr0_shpbxcolumn_shpbxignore_shpbypara_shpwr3_sp_sn_shapeType_sv_75_sp_sn_posrelh_sv_3_sp_sn_pib_sv
push eax
call fcn.004175d6
mov eax, dword [esp + 0x20]
mov edx, dword [esi]
add esp, 0x10
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x5a]
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x50]
push ecx
push edx
push eax
lea ecx, [esp + 0x20]
push str.pictdibitmap0picw_dpich_dwbmbitspixel_dwbmplanes1wbmwidthbytes_d
push ecx
call fcn.004175d6
mov eax, dword [esp + 0x28]
mov edx, dword [esi]
add esp, 0x18
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea ecx, [esp + 0x30]
call fcn.0041e587
test eax, eax
je 0x40a37c
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [esp + 0x38]
call fcn.004194bb
push 0
lea eax, [esp + 0x64]
push 0
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x178], 2
call fcn.004195cd
test eax, eax
je 0x40a40e
push 0
push 0xe
lea ecx, [esp + 0x40]
call fcn.0041976f
lea ecx, [esp + 0x14]
push 1
push ecx
lea ecx, [esp + 0x40]
call fcn.004196ea
test eax, eax
je 0x40a405
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
and edx, 0xff
push edx
push str._02x
push eax
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea eax, [esp + 0x14]
push 1
push eax
lea ecx, [esp + 0x40]
call fcn.004196ea
test eax, eax
jne 0x40a3c4
lea ecx, [esp + 0x38]
call fcn.004197e8
push str._sp_sn_fLine_sv_0_sp_sn_fBehindDocument_sv_1_shprsltpict
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea ecx, [esp + 0x38]
mov byte [esp + 0x16c], 1
call fcn.00419510
mov dword [esp + 0x30], vtable.CGdiObject.0
lea ecx, [esp + 0x30]
mov byte [esp + 0x16c], 3
call fcn.0041e5b1
mov byte [esp + 0x16c], 0
jmp case.0x409a71.13
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x14]
push 1
push 0
push 0
push 0
push edx
mov ecx, edi
call fcn.00407f70
jmp case.0x409a71.13
push 1
push 0
push 0
push 0
push 0
mov ecx, edi
call fcn.00407f70
jmp case.0x409a71.13
push 1
push 0
push 0
push 0
push 1
mov ecx, edi
call fcn.00407f70
jmp case.0x409a71.13
push 1
push 0
push 0
push 0
push 3
mov ecx, edi
call fcn.00407f70
jmp case.0x409a71.13
mov ecx, edi
call fcn.00408860
xor ebx, ebx
lea ebp, [edi + 0x540]
mov eax, dword [edi + 0x530]
lea ecx, [edi + 0x530]
lea edx, [esp + 0x14]
push 1
push edx
call dword [eax + 0x34]
mov eax, dword [esp + 0x14]
test al, al
je case.0x409a71.13
and eax, 0xff
inc ebx
mov dword [esp + 0x18], eax
add ebp, 4
fild dword [esp + 0x18]
cmp ebx, 0x10
fsub dword [0x423678]
fstp dword [ebp - 4]
mov dword [edi + 0x580], 1
jl 0x40a4db
jmp case.0x409a71.13
xor ebp, ebp
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov al, byte [esp + 0x14]
test al, al
je case.0x409a71.13
mov ecx, edi
call fcn.0040af80
mov edx, dword [esp + 0x14]
and edx, 0xff
imul eax, edx
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fimul dword [edi + 0x610]
fmul qword [0x423670]
call fcn.0040d650
push eax
lea eax, [esp + 0x14]
push str._tx_d
push eax
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
inc ebp
cmp ebp, 0x20
jl 0x40a52d
jmp case.0x409a71.13
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov al, byte [esp + 0x14]
test al, al
jne 0x40a626
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
xor ebx, ebx
mov ecx, edi
call fcn.0040af80
mov ecx, dword [esp + 0x14]
and ecx, 0xff
imul eax, ecx
imul eax, ebx
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fimul dword [edi + 0x610]
fmul qword [0x423670]
call fcn.0040d650
push eax
lea edx, [esp + 0x14]
push str._tx_d
push edx
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
inc ebx
cmp ebx, 0x20
jl 0x40a5c8
jmp case.0x409a71.13
cmp al, 1
jne case.0x409a71.13
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
mov dword [edi + 0x580], 1
call dword [eax + 0x34]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 0
and eax, 0xff
lea ecx, [edi + 0x540]
mov edx, 0x10
fild dword [esp + 0x1c]
mov ebp, dword [esp + 0x1c]
add ecx, 4
add ebp, eax
dec edx
fsub dword [0x423678]
mov dword [esp + 0x1c], ebp
fstp dword [ecx - 4]
jne 0x40a662
jmp case.0x409a71.13
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov al, byte [esp + 0x14]
test al, al
jne 0x40a6d7
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov al, byte [esp + 0x14]
xor ebx, ebx
test al, al
jbe case.0x409a71.13
mov edx, dword [esi]
push 1
push 0x429dec
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [esp + 0x14]
inc ebx
and eax, 0xff
cmp ebx, eax
jl 0x40a6b6
jmp case.0x409a71.13
cmp al, 1
jne case.0x409a71.13
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov al, byte [esp + 0x14]
xor ebx, ebx
test al, al
jbe case.0x409a71.13
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
mov ecx, edi
call fcn.0040b3a0
mov eax, dword [esp + 0x14]
inc ebx
and eax, 0xff
cmp ebx, eax
jl 0x40a6fb
jmp case.0x409a71.13
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea eax, [ecx - 1]
cmp eax, 0x35
ja case.0x40a747.7
xor edx, edx
mov dl, byte [eax + 0x40ad94]
jmp dword [edx*4 + 0x40ad78]
mov eax, 1
push eax
push str.cf_d
jmp 0x409e74
mov eax, 2
push eax
push str.cf_d
jmp 0x409e74
mov eax, 3
push eax
push str.cf_d
jmp 0x409e74
mov eax, 4
push eax
push str.cf_d
jmp 0x409e74
mov eax, 5
push eax
push str.cf_d
jmp 0x409e74
mov eax, 6
push eax
push str.cf_d
jmp 0x409e74
xor eax, eax
push eax
push str.cf_d
jmp 0x409e74
mov ecx, edi
call fcn.0040af80
lea ecx, [eax*4]
sub ecx, eax
lea eax, [esp + 0x10]
neg ecx
shl ecx, 2
push ecx
push str._shp_shpinst_shpleft_d_shpright180_shpbottom300_shpfhdr0_shpbxcolumn_shpbxignore_shpbypara_shpwr3
push eax
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
push str._sp_sn_shapeType_sv_202_sp_sn_posrelh_sv_3_sp_sn_dxTextLeft_sv_0_sp_sn_dyTextTop_sv_0_sp_sn_dxTextRight_sv_0_sp_sn_dyTextBottom_sv_0_sp_sn_fFilled_sv_0_sp_sn_fLine_sv_0_sp_sn_fBehindDocument_sv_1_shptxt
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi + 0x420]
test eax, eax
je 0x40a839
push 0x429c74
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi + 0x41c]
test eax, eax
je 0x40a861
push 0x429c70
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi + 0x614]
lea ecx, [esp + 0x10]
push eax
push 0x429c68
push ecx
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi + 0x428]
test eax, eax
je 0x40a8a9
mov eax, dword [edi + 0x610]
lea ecx, [esp + 0x10]
shl eax, 1
push eax
push 0x429c58
push ecx
jmp 0x40a8ba
mov edx, dword [edi + 0x610]
lea eax, [esp + 0x10]
push edx
push 0x429c58
push eax
call fcn.004175d6
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, edi
call fcn.0040add0
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov edx, dword [esi]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, esi
call dword [edx + 0x38]
push str._shprslt_shptxt
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
push str._tab
lea ecx, [esp + 0x14]
call fcn.00418b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
jmp case.0x409a71.13
mov ecx, edi
mov dword [edi + 0x428], 2
call fcn.0040add0
jmp case.0x409a71.13
mov ecx, edi
mov dword [edi + 0x360], 1
call fcn.0040add0
jmp case.0x409a71.13
mov ecx, edi
mov dword [edi + 0x360], 0
call fcn.0040add0
jmp case.0x409a71.13
mov eax, dword [edi + 0x580]
test eax, eax
je case.0x409a71.10
xor ebx, ebx
lea ebp, [edi + 0x540]
fld dword [ebp]
call fcn.0040d650
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jg 0x40a9ae
inc ebx
add ebp, 4
cmp ebx, 0x10
jl 0x40a993
jmp 0x40a9e4
fld dword [edi + ebx*4 + 0x540]
mov ebp, ecx
call fcn.0040d650
cmp dword [esp + 0x20], eax
jge 0x40a9e4
lea edx, [esp + 0x20]
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, edi
call fcn.0040b3a0
fld dword [edi + ebx*4 + 0x540]
inc ebp
call fcn.0040d650
cmp ebp, eax
jl 0x40a9c2
cmp ebx, 0x10
jne case.0x409a71.13
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x28], 0xffffffff
call fcn.0040b3a0
jmp case.0x409a71.13
lea eax, [esp + 0x20]
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, edi
call fcn.0040b3a0
jmp case.0x409a71.13
lea edx, [esp + 0x20]
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x28], 0xffffffff
call fcn.0040b3a0
jmp case.0x409a71.13
cmp dword [edi + 0x428], 2
jne case.0x409a71.13
mov ecx, edi
mov dword [edi + 0x428], 0
call fcn.0040add0
jmp case.0x409a71.13
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004047f0
mov ebx, eax
mov eax, dword [esp + 0x14]
cmp al, 0x5c
je 0x40aa90
cmp al, 0x7b
je 0x40aa90
cmp al, 0x7d
jne 0x40aaa2
mov edx, dword [esi]
push 1
push 0x429b0c
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [esp + 0x14]
test ebx, ebx
je 0x40ab8b
cmp ebx, 3
je 0x40ab8b
cmp ebx, 1
jne 0x40ab5a
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40aba5
mov ecx, edi
call fcn.0040af80
mov ebx, dword [edi + 0x428]
mov ecx, eax
test ebx, ebx
je 0x40aae1
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cmp ecx, 0xc
je 0x40ab41
mov eax, dword [edi + 0x424]
test eax, eax
jne 0x40ab41
mov eax, dword [edi + 0x610]
test ebx, ebx
je 0x40aafc
add eax, eax
mov edx, dword [esp + 0x14]
push eax
and edx, 0xff
push edx
cdq
sub eax, edx
sar eax, 1
push eax
lea eax, [ecx*4]
push eax
lea ecx, [esp + 0x20]
push str._f1_fs_dcharscalex_d__c_f0charscalex_d
push ecx
call fcn.004175d6
add esp, 0x18
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, edi
call fcn.0040add0
jmp case.0x409a71.13
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
and eax, 0xff
push eax
push str._f1__c_f0
push ecx
jmp 0x409e79
cmp ebx, 4
je case.0x409a71.13
mov cl, byte [edi + 0x40]
test cl, cl
jne 0x40ab76
and eax, 0xff
push eax
push str._f2__c_f0
jmp 0x409e74
cmp cl, 0xee
jne 0x40aba5
and eax, 0xff
push eax
push str._f3__c_f0
jmp 0x409e74
mov eax, dword [edi + 0x378]
test eax, eax
je 0x40aba5
lea edx, [esp + 0x14]
mov ecx, edi
push edx
call fcn.0040afd0
test eax, eax
jne case.0x409a71.13
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, esi
call dword [eax + 0x38]
mov edx, dword [edi + 0x530]
lea ebx, [edi + 0x530]
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, ebx
call dword [edx + 0x34]
test eax, eax
jne 0x409a53
mov edx, dword [esi]
push 1
push 0x429b2c
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x4c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x4c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x16c], 0xffffffff
call fcn.00418a41
mov eax, 1
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x160
ret 4