Function at 0x404411
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x394
push ebx
push esi
mov eax, dword [ecx + 0x1af4]
push edi
push ebp
mov ebx, ecx
push eax
mov ebp, dword [sym.imp.USER32.dll_IsIconic]
call ebp
mov ebp, ebx
mov dword [esp + 0x58], eax
mov word [esp + 0x48], 0
mov eax, dword [esp + 0x3a8]
and eax, 0xffff
add eax, ebx
mov dword [esp + 0xc8], eax
cmp eax, ebx
jbe 0x407f40
mov dword [esp + 0x5c], 0
cmp word [esp + 0x48], 0
jne 0x4043fd
xor eax, eax
inc ebp
mov word [esp + 0x48], 1
mov al, byte [ebp - 1]
mov dword [esp + 0x68], eax
test al, 0x80
je 0x4043fd
and dword [esp + 0x68], 0xffffff7f
movzx ax, byte [ebp]
mov word [esp + 0x48], ax
inc ebp
mov eax, dword [esp + 0x68]
cmp eax, 0x4a
ja case.0x40440a.60
jmp dword [eax*4 + 0x408028]
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x88]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
lea ecx, [esp + 0x2a4]
push ecx
push eax
mov ecx, ebx
call fcn.00408fd0
mov ebp, eax
mov ecx, ebx
call fcn.004084c0
test eax, eax
je 0x407f6d
mov eax, dword [ebx + 0x1a94]
mov ecx, ebx
push eax
call fcn.004094d0
mov ecx, dword [ebx + 0x1a24]
mov eax, dword [esp + 0x2a4]
push eax
mov edx, dword [ebx + 0x1a50]
push 0
mov esi, dword [ecx + 8]
push 0
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x98]
push esi
push eax
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x1a94]
push ecx
mov ecx, ebx
call fcn.00409580
mov eax, dword [ebx + 0x1a24]
push 2
mov ecx, dword [eax + 4]
add ecx, dword [esp + 0x8c]
mov edx, dword [ebx + 0x1a94]
mov dword [esp + 0x94], ecx
lea ecx, [esp + 0x8c]
mov eax, dword [eax + 8]
push ecx
add eax, dword [esp + 0x94]
push edx
mov dword [esp + 0xa0], eax
call dword [sym.imp.GDI32.dll_DPtoLP]
cmp dword [esp + 0x58], 0
jne 0x404564
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0x8c]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0x8c]
push 0xcc0020
mov edx, dword [esp + 0x8c]
push ecx
mov dword [esp + 0x64], eax
push edx
mov eax, dword [ebx + 0x1a94]
push eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x9c]
push eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x9c]
push eax
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1a50]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1a50], 0
mov dword [ebx + 0x1a54], 0
jmp 0x407ef4
lea eax, [esp + 0x9c]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
mov ebp, eax
mov ecx, ebx
mov eax, dword [ebx + 0x1a90]
push eax
call fcn.004094d0
mov eax, dword [ebx + 0x1a94]
mov ecx, ebx
push eax
call fcn.004094d0
mov eax, dword [ebx + 0x1a24]
push 0xcc0020
mov ecx, dword [ebx + 0x1a20]
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
mov edx, dword [ebx + 0x1a58]
xor eax, eax
mov ax, word [ebx + 0x1b16]
push eax
push ecx
push edx
push edi
mov eax, dword [esp + 0xb4]
push esi
mov ecx, dword [esp + 0xb4]
push 0
push 0
mov edx, dword [ebx + 0x1a94]
push edi
push esi
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_StretchDIBits]
cmp dword [esp + 0x58], 0
jne 0x404685
mov eax, dword [esp + 0xa0]
push edi
mov ecx, dword [esp + 0xa0]
push esi
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.00408160
mov ecx, dword [esp + 0xa0]
push 0xcc0020
mov edx, dword [esp + 0xa0]
push ecx
mov dword [esp + 0x64], eax
push edx
mov eax, dword [ebx + 0x1a94]
push eax
push edi
push esi
mov eax, dword [ebx + 0x1ae0]
add eax, dword [esp + 0xb8]
mov ecx, dword [ebx + 0x1a90]
push eax
mov eax, dword [ebx + 0x1adc]
add eax, dword [esp + 0xb8]
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1a94]
mov ecx, ebx
push eax
call fcn.00409580
mov eax, dword [ebx + 0x1a90]
mov ecx, ebx
push eax
call fcn.00409580
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407ef4
push eax
mov ecx, ebx
call fcn.00408b60
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407ef4
lea eax, [esp + 0xac]
mov ecx, ebx
push eax
push ebp
call fcn.004094b0
lea ecx, [esp + 0x80]
push ecx
push eax
mov ecx, ebx
call fcn.00409450
lea ecx, [esp + 0x1b4]
push ecx
push eax
mov ecx, ebx
call fcn.00408fd0
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x40483c
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x84]
push eax
mov eax, dword [esp + 0x84]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408160
mov dword [esp + 0x5c], eax
test eax, eax
je 0x40474e
mov ecx, ebx
call fcn.004088e0
jmp 0x404780
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0xb0]
push eax
mov eax, dword [esp + 0xb0]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408160
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x308]
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetClipBox]
cmp eax, 2
jne 0x4047f0
mov eax, dword [esp + 0x308]
cmp dword [esp + 0x80], eax
jl 0x4047f0
mov eax, dword [esp + 0x30c]
cmp dword [esp + 0x84], eax
jl 0x4047f0
mov eax, dword [esp + 0xb4]
add eax, dword [esp + 0x80]
cmp eax, dword [esp + 0x310]
jg 0x4047f0
mov eax, dword [esp + 0x84]
add eax, dword [esp + 0xb8]
cmp eax, dword [esp + 0x314]
jg 0x4047f0
mov ecx, dword [ebx + 0x1a90]
jmp 0x4047f6
mov ecx, dword [ebx + 0x1a94]
mov eax, dword [esp + 0x1b4]
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0xbc]
push edx
mov edx, dword [esp + 0xb8]
push esi
push ecx
push eax
mov ecx, dword [esp + 0xc8]
mov eax, dword [esp + 0xc0]
push ecx
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x1a94]
mov eax, dword [esp + 0x1b4]
mov edx, dword [esp + 0x84]
push eax
mov esi, dword [esp + 0x84]
push edx
mov eax, dword [esp + 0xc0]
push esi
mov edx, dword [esp + 0xc0]
push ecx
mov esi, dword [esp + 0xc0]
push eax
mov eax, dword [esp + 0xc0]
push edx
push esi
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x114]
mov ecx, ebx
push eax
push ebp
call fcn.004094b0
mov dword [esp + 0xbc], 0xf00021
cmp dword [esp + 0x68], 3
mov ebp, eax
jne 0x4048c4
lea eax, [esp + 0xbc]
mov ecx, ebx
push eax
push ebp
call fcn.00408fd0
mov ebp, eax
cmp dword [esp + 0x58], 0
jne 0x404932
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push eax
mov eax, dword [esp + 0x118]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408160
mov ecx, dword [esp + 0xbc]
mov edx, dword [esp + 0x120]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x120]
push edx
mov ecx, dword [esp + 0x120]
push eax
mov edx, dword [esp + 0x120]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x11c]
push eax
mov eax, dword [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x11c]
push edx
push eax
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x124]
mov ecx, ebx
push eax
push ebp
call fcn.004094b0
lea ecx, [esp + 0x22c]
push ecx
push eax
mov ecx, ebx
call fcn.004094b0
lea ecx, [esp + 0x1b8]
push ecx
push eax
mov ecx, ebx
call fcn.00408fd0
mov ebp, eax
mov ecx, ebx
call fcn.004084c0
test eax, eax
je 0x407f74
cmp dword [esp + 0x58], 0
jne 0x404a4d
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x128]
push eax
mov eax, dword [esp + 0x128]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408160
mov ecx, dword [esp + 0x1b8]
mov edx, dword [esp + 0x238]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x238]
push edx
mov ecx, dword [esp + 0x238]
push eax
mov edx, dword [esp + 0x238]
push ecx
push edx
mov eax, dword [ebx + 0x1a50]
mov ecx, dword [esp + 0x144]
push eax
mov edx, dword [esp + 0x144]
push ecx
mov eax, dword [esp + 0x144]
push edx
mov ecx, dword [esp + 0x144]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x238]
mov edx, dword [esp + 0x234]
push eax
mov eax, dword [esp + 0x234]
push ecx
mov ecx, dword [esp + 0x234]
push edx
push eax
mov edx, dword [ebx + 0x1a50]
mov eax, dword [esp + 0x140]
push ecx
mov ecx, dword [esp + 0x140]
push edx
mov edx, dword [esp + 0x140]
push eax
mov eax, dword [esp + 0x140]
push ecx
push edx
mov ecx, dword [ebx + 0x1a94]
push eax
push ecx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, dword [ebx + 0x1a50]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebx + 0x1a54]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1a50], 0
mov dword [ebx + 0x1a54], 0
jmp 0x407ef4
lea eax, [esp + 0x134]
mov ecx, ebx
push eax
push ebp
call fcn.004094b0
lea ecx, [esp + 0x23c]
push ecx
push eax
mov ecx, ebx
call fcn.004094b0
lea ecx, [esp + 0x1bc]
push ecx
push eax
mov ecx, ebx
call fcn.00408fd0
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x404ba7
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x138]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.00408160
mov ecx, dword [esp + 0x1bc]
mov edx, dword [esp + 0x248]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x248]
push edx
mov ecx, dword [esp + 0x248]
push eax
mov edx, dword [esp + 0x248]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
mov ecx, dword [esp + 0x154]
push eax
mov edx, dword [esp + 0x154]
push ecx
mov eax, dword [esp + 0x154]
push edx
mov ecx, dword [esp + 0x154]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, dword [ebx + 0x1a94]
mov eax, dword [esp + 0x1bc]
mov edx, dword [esp + 0x248]
push eax
mov esi, dword [esp + 0x248]
push edx
mov eax, dword [esp + 0x248]
push esi
mov edx, dword [esp + 0x248]
push eax
mov esi, dword [esp + 0x150]
push edx
mov eax, dword [esp + 0x150]
push ecx
mov edx, dword [esp + 0x150]
push esi
mov esi, dword [esp + 0x150]
push eax
push edx
push esi
push ecx
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0xcc]
mov ecx, ebx
push eax
push ebp
call fcn.004094b0
lea ecx, [esp + 0x318]
push ecx
push eax
mov ecx, ebx
call fcn.004094b0
lea ecx, [esp + 0x2a8]
push ecx
push eax
mov ecx, ebx
call fcn.00408fd0
mov ebp, eax
mov ecx, dword [esp + 0xd4]
mov eax, dword [esp + 0xd8]
mov edx, dword [esp + 0xd0]
push eax
push ecx
mov eax, dword [esp + 0xd4]
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
mov ecx, ebx
call fcn.00408160
mov ecx, dword [esp + 0x2a8]
mov dword [esp + 0x5c], eax
push ecx
xor eax, eax
mov ax, word [ebx + 0x1b16]
mov ecx, dword [ebx + 0x1a20]
push eax
mov edx, dword [ebx + 0x1a58]
mov eax, dword [esp + 0x32c]
push ecx
mov ecx, dword [esp + 0x32c]
push edx
mov edx, dword [esp + 0x32c]
push eax
mov eax, dword [esp + 0x32c]
push ecx
mov ecx, dword [esp + 0xf0]
push edx
mov edx, dword [esp + 0xf0]
push eax
mov eax, dword [esp + 0xf0]
push ecx
mov ecx, dword [esp + 0xf0]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0xcc0020
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0xd0]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
mov ecx, dword [esp + 0xe4]
push eax
mov edx, dword [esp + 0xe4]
push ecx
mov eax, dword [esp + 0xe4]
push edx
mov ecx, dword [esp + 0xe4]
push eax
push ecx
mov edx, dword [ebx + 0x1a94]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407ef4
push eax
mov ecx, ebx
call fcn.00408b60
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407ef4
lea eax, [esp + 0xdc]
mov ecx, ebx
push eax
push ebp
call fcn.004094b0
lea ecx, [esp + 0x2c4]
push ecx
push eax
mov ecx, ebx
call fcn.00409450
mov ebp, eax
mov ecx, dword [esp + 0xe8]
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x2d0], ecx
mov dword [esp + 0x2cc], eax
mov dword [esp + 0x14c], eax
lea edx, [esp + 0x144]
push 2
push edx
mov eax, dword [ebx + 0x1a94]
mov dword [esp + 0x158], ecx
push eax
mov dword [esp + 0x154], 0
mov dword [esp + 0x150], 0
call dword [sym.imp.GDI32.dll_DPtoLP]
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x148]
mov eax, dword [esp + 0xe8]
sub dword [esp + 0x14c], ecx
mov ecx, dword [esp + 0xe4]
push eax
mov eax, dword [esp + 0xe0]
push ecx
mov ecx, dword [ebx + 0x1a90]
sub dword [esp + 0x158], edx
mov edx, dword [esp + 0xe8]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.00408160
push 0xcc0020
mov ecx, dword [ebx + 0x1a20]
mov edx, dword [ebx + 0x1a58]
mov dword [esp + 0x60], eax
xor eax, eax
mov ax, word [ebx + 0x1b16]
push eax
push ecx
mov eax, dword [esp + 0x2dc]
push edx
mov ecx, dword [esp + 0x2dc]
push eax
mov edx, dword [esp + 0x2dc]
push ecx
mov eax, dword [esp + 0x2dc]
push edx
mov ecx, dword [esp + 0x16c]
push eax
push ecx
mov edx, dword [esp + 0x170]
mov eax, dword [esp + 0x104]
push edx
mov ecx, dword [esp + 0x104]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov ecx, dword [esp + 0xe0]
push 0xcc0020
mov edx, dword [esp + 0xe0]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
mov ecx, dword [esp + 0x15c]
push eax
mov edx, dword [esp + 0x15c]
push ecx
mov eax, dword [esp + 0xf4]
push edx
mov ecx, dword [esp + 0xf4]
push eax
push ecx
mov edx, dword [ebx + 0x1a94]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407ef4
push eax
mov ecx, ebx
call fcn.00408b60
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407ef4
mov ecx, ebx
call fcn.00408630
lea eax, [esp + 0x42]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
lea ecx, [esp + 0xec]
push ecx
push eax
mov ecx, ebx
call fcn.00409450
cmp dword [esp + 0x58], 0
mov ebp, eax
je 0x404f41
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetTextAlign]
test al, 1
je 0x404fd0
lea eax, [esp + 0x328]
push 0
mov ecx, dword [esp + 0x46]
push eax
push ecx
mov edx, dword [ebx + 0x1b86]
mov eax, dword [esp + 0xfc]
push ebp
mov ecx, dword [esp + 0xfc]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.00409640
mov ecx, dword [esp + 0x334]
mov edx, dword [esp + 0x330]
mov eax, dword [esp + 0x32c]
push ecx
mov ecx, dword [esp + 0x32c]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x42]
mov edx, dword [esp + 0xec]
and eax, 0xffff
push eax
push ebp
push ecx
mov eax, dword [ebx + 0x1a90]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [esp + 0x42]
mov ecx, dword [esp + 0xf0]
and eax, 0xffff
mov edx, dword [esp + 0xec]
push eax
push ebp
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [esp + 0x42]
and eax, 0xffff
add ebp, eax
jmp 0x407ef4
mov ecx, ebx
call fcn.00408630
lea eax, [esp + 0xf4]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
mov cl, byte [eax]
inc eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], 0
test cl, 0x80
mov byte [esp + 0x64], cl
je 0x40504f
lea ecx, [esp + 0x394]
mov dword [esp + 0x54], ecx
push ecx
push eax
mov ecx, ebx
call fcn.00408ea0
lea ecx, [esp + 0x4c]
push ecx
push eax
mov ecx, ebx
call fcn.00409000
test byte [esp + 0x64], 0x40
mov ebp, eax
je 0x4050a2
mov eax, dword [ebx + 0x1a58]
xor esi, esi
cmp word [esp + 0x4c], si
mov dword [esp + 0x60], eax
jbe 0x4050a2
mov edi, eax
lea eax, [esp + 0x12]
mov ecx, ebx
push eax
add edi, 4
push ebp
inc esi
call fcn.00409040
mov ebp, eax
movsx eax, word [esp + 0x12]
mov dword [edi - 4], eax
mov eax, dword [esp + 0x4c]
and eax, 0xffff
cmp eax, esi
jg 0x40507a
and byte [esp + 0x64], 6
cmp dword [esp + 0x58], 0
je 0x4050c3
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetTextAlign]
test al, 1
je 0x405174
lea eax, [esp + 0x338]
mov ecx, dword [esp + 0x60]
movzx si, byte [esp + 0x64]
push eax
push ecx
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x5c]
and eax, 0xffff
mov edx, dword [ebx + 0x1b86]
push eax
push ebp
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x108]
push esi
push edx
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
mov ecx, ebx
call fcn.00409820
mov ecx, dword [esp + 0x344]
mov edx, dword [esp + 0x340]
mov eax, dword [esp + 0x33c]
push ecx
mov ecx, dword [esp + 0x33c]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x4c]
push ecx
and eax, 0xffff
mov ecx, dword [esp + 0x58]
movzx edx, si
push eax
push ebp
mov eax, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0x104]
push edx
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x50]
and eax, 0xffff
push eax
push ebp
push ecx
xor eax, eax
mov al, byte [esp + 0x74]
mov ecx, dword [esp + 0x108]
mov edx, dword [esp + 0x104]
push eax
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov eax, dword [esp + 0x4c]
and eax, 0xffff
add ebp, eax
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x154]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
lea ecx, [esp + 0x24c]
push ecx
push eax
mov ecx, ebx
call fcn.00408ea0
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x40526c
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x15c]
mov edx, dword [esp + 0x158]
push eax
mov eax, dword [esp + 0x158]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0x258]
mov edx, dword [esp + 0x254]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x254]
push edx
mov ecx, dword [esp + 0x254]
push eax
mov edx, dword [esp + 0x16c]
push ecx
mov eax, dword [esp + 0x16c]
push edx
mov ecx, dword [esp + 0x16c]
push eax
mov edx, dword [esp + 0x16c]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_Arc]
mov eax, dword [esp + 0x258]
mov ecx, dword [esp + 0x254]
mov edx, dword [esp + 0x250]
push eax
mov eax, dword [esp + 0x250]
push ecx
mov ecx, dword [esp + 0x168]
push edx
mov edx, dword [esp + 0x168]
push eax
mov eax, dword [esp + 0x168]
push ecx
mov ecx, dword [esp + 0x168]
push edx
push eax
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x164]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
lea ecx, [esp + 0x25c]
push ecx
push eax
mov ecx, ebx
call fcn.00408ea0
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x40536d
mov eax, dword [esp + 0x170]
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x168]
push eax
mov eax, dword [esp + 0x168]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0x268]
mov edx, dword [esp + 0x264]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x264]
push edx
mov ecx, dword [esp + 0x264]
push eax
mov edx, dword [esp + 0x17c]
push ecx
mov eax, dword [esp + 0x17c]
push edx
mov ecx, dword [esp + 0x17c]
push eax
mov edx, dword [esp + 0x17c]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_Chord]
mov eax, dword [esp + 0x268]
mov ecx, dword [esp + 0x264]
mov edx, dword [esp + 0x260]
push eax
mov eax, dword [esp + 0x260]
push ecx
mov ecx, dword [esp + 0x178]
push edx
mov edx, dword [esp + 0x178]
push eax
mov eax, dword [esp + 0x178]
push ecx
mov ecx, dword [esp + 0x178]
push edx
push eax
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_Chord]
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x174]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x40543e
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x17c]
mov edx, dword [esp + 0x178]
push eax
mov eax, dword [esp + 0x178]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0x180]
mov edx, dword [esp + 0x17c]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x17c]
push edx
mov ecx, dword [esp + 0x17c]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_Ellipse]
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x17c]
mov edx, dword [esp + 0x178]
push eax
mov eax, dword [esp + 0x178]
push ecx
push edx
mov ecx, dword [ebx + 0x1a94]
push eax
push ecx
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x184]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
lea ecx, [esp + 0x26c]
push ecx
push eax
mov ecx, ebx
call fcn.00408ea0
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x40551f
mov eax, dword [esp + 0x190]
mov ecx, dword [esp + 0x18c]
mov edx, dword [esp + 0x188]
push eax
mov eax, dword [esp + 0x188]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0x278]
mov edx, dword [esp + 0x274]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x274]
push edx
mov ecx, dword [esp + 0x274]
push eax
mov edx, dword [esp + 0x19c]
push ecx
mov eax, dword [esp + 0x19c]
push edx
mov ecx, dword [esp + 0x19c]
push eax
mov edx, dword [esp + 0x19c]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_Pie]
mov eax, dword [esp + 0x278]
mov ecx, dword [esp + 0x274]
mov edx, dword [esp + 0x270]
push eax
mov eax, dword [esp + 0x270]
push ecx
mov ecx, dword [esp + 0x198]
push edx
mov edx, dword [esp + 0x198]
push eax
mov eax, dword [esp + 0x198]
push ecx
mov ecx, dword [esp + 0x198]
push edx
push eax
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_Pie]
jmp 0x407ef4
lea eax, [esp + 0xa4]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x4055ba
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push eax
mov edx, dword [ebx + 0x1a6c]
push ecx
mov eax, dword [ebx + 0x1a68]
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_LineTo]
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0xa4]
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_LineTo]
lea eax, [ebx + 0x1a68]
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0xa8]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x407ef4
lea eax, [esp + 0xfc]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
lea ecx, [esp + 0x2e4]
lea esi, [ebx + 0x1a68]
push ecx
push eax
mov ecx, ebx
call fcn.00409450
mov ebp, eax
mov ecx, dword [esp + 0x2e8]
mov eax, dword [esp + 0x2e4]
push 0
mov edx, dword [ebx + 0x1a90]
mov dword [esi], eax
mov eax, dword [esp + 0x104]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x100]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [esp + 0x100]
push 0
mov edx, dword [esp + 0x100]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
cmp dword [esp + 0x58], 0
jne 0x4056be
mov eax, dword [ebx + 0x1a6c]
mov ecx, dword [esi]
mov edx, dword [esp + 0x100]
push eax
mov eax, dword [esp + 0x100]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov dword [esp + 0x5c], eax
mov eax, dword [ebx + 0x1a6c]
mov ecx, dword [esi]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_LineTo]
mov ecx, dword [ebx + 0x1a6c]
mov edx, dword [esi]
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x407ef4
lea eax, [esp + 0x104]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
lea ecx, [esp + 0x1c0]
push ecx
push eax
mov ecx, ebx
call fcn.00408f80
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x405765
mov eax, dword [esp + 0x108]
push 1
mov ecx, dword [esp + 0x108]
push 1
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
mov ecx, ebx
call fcn.00408160
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x108]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x108]
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x108]
mov edx, dword [esp + 0x104]
push eax
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x407ef4
cmp word [ebx + 0x1b0a], 0
jne 0x4057e3
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ax, word [esp + 0x28]
mov word [ebx + 0x1b08], ax
mov eax, dword [esp + 0x28]
and eax, 0xffff
shl eax, 3
cmp eax, 0x15f4
jbe 0x4057e3
push eax
mov ecx, ebx
call fcn.00408b80
mov dword [ebx + 0x1a5c], eax
mov dword [ebx + 0x1a58], eax
test eax, eax
je 0x407f7b
lea eax, [esp + 0x70]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
mov cx, word [ebx + 0x1b0a]
mov ebp, eax
test cx, cx
mov eax, dword [esp + 0x70]
jne 0x405820
mov edx, dword [esp + 0x74]
mov dword [ebx + 0x1b00], eax
mov dword [ebx + 0x1af8], eax
mov dword [ebx + 0x1b04], edx
mov dword [ebx + 0x1afc], edx
jmp 0x405868
cmp dword [ebx + 0x1af8], eax
jle 0x405830
mov dword [ebx + 0x1af8], eax
jmp 0x405842
mov eax, dword [esp + 0x70]
cmp dword [ebx + 0x1b00], eax
jge 0x405842
mov dword [ebx + 0x1b00], eax
mov eax, dword [esp + 0x74]
cmp dword [ebx + 0x1afc], eax
jle 0x405856
mov dword [ebx + 0x1afc], eax
jmp 0x405868
mov eax, dword [esp + 0x74]
cmp dword [ebx + 0x1b04], eax
jge 0x405868
mov dword [ebx + 0x1b04], eax
movzx eax, cx
shl eax, 3
add eax, dword [ebx + 0x1a58]
mov edx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [eax], edx
mov dword [eax + 4], esi
mov ax, word [ebx + 0x1b0a]
inc ax
mov word [ebx + 0x1b0a], ax
cmp word [ebx + 0x1b08], ax
je 0x4058a2
test al, al
jne 0x4057e3
mov ax, word [ebx + 0x1b0a]
cmp word [ebx + 0x1b08], ax
jne 0x407ef4
mov eax, dword [ebx + 0x1b04]
mov ecx, dword [ebx + 0x1b00]
push eax
mov edx, dword [ebx + 0x1afc]
push ecx
mov eax, dword [ebx + 0x1af8]
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
cmp dword [esp + 0x68], 0x12
mov dword [esp + 0x5c], eax
jne 0x405937
mov ecx, ebx
call fcn.004085b0
xor eax, eax
mov ecx, dword [ebx + 0x1a58]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a94]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Polygon]
cmp dword [esp + 0x58], 0
jne 0x40597a
xor eax, eax
mov ecx, dword [ebx + 0x1a58]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a90]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x40597a
cmp dword [esp + 0x58], 0
jne 0x40595c
xor eax, eax
mov ecx, dword [ebx + 0x1a58]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a90]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Polyline]
xor eax, eax
mov ecx, dword [ebx + 0x1a58]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a94]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Polyline]
mov word [ebx + 0x1b0a], 0
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407ef4
push eax
mov ecx, ebx
call fcn.00408b60
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x194]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x405a33
mov eax, dword [esp + 0x1a0]
mov ecx, dword [esp + 0x19c]
mov edx, dword [esp + 0x198]
push eax
mov eax, dword [esp + 0x198]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0x1a0]
mov edx, dword [esp + 0x19c]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x19c]
push edx
mov ecx, dword [esp + 0x19c]
push eax
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_Rectangle]
mov eax, dword [esp + 0x1a0]
mov ecx, dword [esp + 0x19c]
mov edx, dword [esp + 0x198]
push eax
mov eax, dword [esp + 0x198]
push ecx
push edx
mov ecx, dword [ebx + 0x1a94]
push eax
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x1a4]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
lea ecx, [esp + 0x1ec]
push ecx
push eax
mov ecx, ebx
call fcn.00409480
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x405b04
mov eax, dword [esp + 0x1b0]
mov ecx, dword [esp + 0x1ac]
mov edx, dword [esp + 0x1a8]
push eax
mov eax, dword [esp + 0x1a8]
push ecx
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov ecx, dword [esp + 0x1f0]
mov edx, dword [esp + 0x1ec]
mov dword [esp + 0x5c], eax
push ecx
mov eax, dword [esp + 0x1b4]
push edx
mov ecx, dword [esp + 0x1b4]
push eax
mov edx, dword [esp + 0x1b4]
push ecx
mov eax, dword [esp + 0x1b4]
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_RoundRect]
mov eax, dword [esp + 0x1f0]
mov ecx, dword [esp + 0x1ec]
mov edx, dword [esp + 0x1b0]
push eax
mov eax, dword [esp + 0x1b0]
push ecx
mov ecx, dword [esp + 0x1b0]
push edx
mov edx, dword [esp + 0x1b0]
push eax
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x407ef4
lea eax, [esp + 0x1f4]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
lea ecx, [esp + 0x1c4]
push ecx
push eax
mov ecx, ebx
call fcn.00408f80
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x405bac
cmp dword [ebx + 0x1ad8], 0
je 0x405b87
mov ecx, ebx
call fcn.004088e0
mov dword [esp + 0x5c], 1
mov eax, dword [esp + 0x1c4]
mov ecx, dword [esp + 0x1f8]
mov edx, dword [esp + 0x1f4]
push eax
push ecx
mov eax, dword [ebx + 0x1a90]
push edx
push eax
call dword [sym.imp.GDI32.dll_FloodFill]
mov eax, dword [esp + 0x1c4]
mov ecx, dword [esp + 0x1f8]
mov edx, dword [esp + 0x1f4]
push eax
push ecx
mov eax, dword [ebx + 0x1a94]
push edx
push eax
call dword [sym.imp.GDI32.dll_FloodFill]
jmp 0x407ef4
lea eax, [esp + 0x1fc]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
lea ecx, [esp + 0x1c8]
push ecx
push eax
mov ecx, ebx
call fcn.00408f80
lea ecx, [esp + 0x2a]
push ecx
push eax
mov ecx, ebx
call fcn.00409000
cmp dword [esp + 0x58], 0
mov ebp, eax
jne 0x405c53
cmp dword [ebx + 0x1ad8], 0
je 0x405c24
mov ecx, ebx
call fcn.004088e0
mov dword [esp + 0x5c], 1
mov eax, dword [esp + 0x2a]
mov ecx, dword [esp + 0x1c8]
and eax, 0xffff
mov edx, dword [esp + 0x200]
push eax
push ecx
mov eax, dword [esp + 0x204]
push edx
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov eax, dword [esp + 0x2a]
mov ecx, dword [esp + 0x1c8]
and eax, 0xffff
mov edx, dword [esp + 0x200]
push eax
push ecx
mov eax, dword [esp + 0x204]
push edx
push eax
mov ecx, dword [ebx + 0x1a94]
push ecx
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x407ef4
lea eax, [esp + 0xc0]
mov ecx, ebx
push eax
push ebp
call fcn.00408f80
cmp dword [ebx + 0x1b70], 0
mov ebp, eax
mov eax, dword [esp + 0xc0]
mov dword [ebx + 0x1b74], eax
jne 0x407ef4
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esp + 0xc0]
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x407ef4
lea eax, [esp + 0xc4]
mov ecx, ebx
push eax
push ebp
call fcn.00408f80
cmp dword [ebx + 0x1b70], 0
mov ebp, eax
mov eax, dword [esp + 0xc4]
mov dword [ebx + 0x1b78], eax
jne 0x407ef4
push eax
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0xc4]
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x407ef4
lea eax, [esp + 0x2c]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x2c]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
jmp 0x407ef4
lea eax, [esp + 0x2e]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x2e]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetROP2]
mov eax, dword [esp + 0x2e]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x407ef4
lea eax, [esp + 0x30]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x30]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov eax, dword [esp + 0x30]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x407ef4
lea eax, [esp + 0x32]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x32]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov eax, dword [esp + 0x32]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
jmp 0x407ef4
lea eax, [esp + 0x44]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov eax, dword [esp + 0x44]
and eax, 0xffff
cmp eax, 2
jl 0x405e60
cmp eax, 6
jg 0x405e60
mov word [esp + 0x44], 8
mov eax, dword [esp + 0x44]
mov ecx, dword [ebx + 0x1a90]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetMapMode]
mov eax, dword [esp + 0x44]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x407ef4
mov cl, byte [ebp]
xor eax, eax
shr cl, 4
mov al, cl
xor ecx, ecx
inc ebp
push 0
mov dword [esp + 0x110], eax
mov al, byte [ebp - 1]
and al, 7
mov edx, dword [ebx + 0x1a94]
mov cl, al
mov eax, dword [esp + 0x110]
mov dword [esp + 0x114], ecx
push ecx
push eax
push edx
call dword [sym.imp.GDI32.dll_SetBrushOrgEx]
lea ecx, [esp + 0x10c]
mov edx, dword [ebx + 0x1af4]
push ecx
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0x110]
push 0
mov edx, dword [esp + 0x110]
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SetBrushOrgEx]
jmp 0x407ef4
lea eax, [esp + 0x204]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
mov ebp, eax
push 0
mov eax, dword [ebx + 0x1ae0]
mov ecx, dword [ebx + 0x1a90]
add eax, dword [esp + 0x20c]
push eax
mov eax, dword [ebx + 0x1adc]
add eax, dword [esp + 0x20c]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov ecx, dword [esp + 0x208]
push 0
mov edx, dword [esp + 0x208]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x407ef4
lea eax, [esp + 0x20c]
mov ecx, ebx
push eax
push ebp
call fcn.00409480
mov ebp, eax
push 0
mov eax, dword [esp + 0x214]
mov ecx, dword [esp + 0x210]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov ecx, dword [esp + 0x210]
push 0
mov edx, dword [esp + 0x210]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x407ef4
lea eax, [esp + 0x214]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
mov ebp, eax
push 0
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0x218]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov ecx, dword [esp + 0x218]
push 0
mov edx, dword [esp + 0x218]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x407ef4
lea eax, [esp + 0x21c]
mov ecx, ebx
push eax
push ebp
call fcn.00409480
mov ebp, eax
push 0
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x220]
push eax
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov ecx, dword [esp + 0x220]
push 0
mov edx, dword [esp + 0x220]
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x407ef4
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
lea esi, [ebx + 0x1a34]
push ebp
call fcn.00409000
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x2ec]
and ecx, 0xffff
push edx
push eax
lea edi, [ebx + 0x1a38]
mov dword [esi], ecx
mov ecx, ebx
call fcn.00409480
mov ecx, dword [esp + 0x2ec]
mov edx, dword [esp + 0x2f0]
mov dword [edi], ecx
lea ecx, [esp + 0x2ac]
push ecx
mov dword [edi + 4], edx
push eax
mov ecx, ebx
call fcn.00408f80
mov ebp, eax
push esi
mov eax, dword [esp + 0x2b0]
mov dword [ebx + 0x1a40], eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov esi, eax
test esi, esi
je 0x407f82
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b60], 0
jne 0x40610a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b60], 0
jmp 0x407ef4
lea esi, [ebx + 0x1a34]
lea eax, [esp + 0x2f4]
push eax
mov ecx, ebx
push ebp
lea edi, [ebx + 0x1a38]
mov dword [esi], 0
call fcn.00409480
mov ecx, dword [esp + 0x2f4]
mov edx, dword [esp + 0x2f8]
mov dword [edi], ecx
lea ecx, [esp + 0x2b0]
push ecx
mov dword [edi + 4], edx
push eax
mov ecx, ebx
call fcn.00408f80
mov ebp, eax
push esi
mov eax, dword [esp + 0x2b4]
mov dword [ebx + 0x1a40], eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov esi, eax
test esi, esi
je 0x407f89
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b60], 0
jne 0x4061aa
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b60], 0
jmp 0x407ef4
lea eax, [ebx + 0x1a34]
push eax
mov dword [eax], 5
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov esi, eax
test esi, esi
je 0x407f90
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b60], 0
jne 0x406202
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b60], 0
jmp 0x407ef4
mov al, byte [ebp]
xor ecx, ecx
and al, 1
inc ebp
mov cl, al
mov eax, dword [ebx + 0x1a90]
mov esi, dword [ebx + ecx*4 + 0x1b54]
push esi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b60], 0
jne 0x407ef4
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b60], 1
jmp 0x407ef4
lea eax, [esp + 0x16]
mov ecx, ebx
push eax
lea esi, [ebx + 0x1a28]
push ebp
call fcn.00409000
mov ecx, dword [esp + 0x16]
lea edx, [esp + 0x2b4]
and ecx, 0xffff
push edx
push eax
mov dword [esi], ecx
mov ecx, ebx
call fcn.00408f80
mov ecx, dword [esp + 0x2b4]
lea edx, [esp + 0x18]
push edx
mov dword [ebx + 0x1a2c], ecx
push eax
mov ecx, ebx
call fcn.00409040
mov ebp, eax
push esi
movsx ecx, word [esp + 0x1c]
mov dword [ebx + 0x1a30], ecx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov esi, eax
test esi, esi
je 0x407f97
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x4062f4
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
mov dword [ebx + 0x1b6c], 0
jmp 0x407ef4
mov ecx, ebx
call fcn.004084c0
test eax, eax
je 0x407f9e
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov esi, eax
test esi, esi
je 0x407fa5
mov eax, dword [ebx + 0x1a50]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov eax, dword [ebx + 0x1a94]
mov dword [ebx + 0x1a50], 0
mov dword [ebx + 0x1a54], 0
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x40638d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
cmp dword [ebx + 0x1b64], 0
je 0x4063c3
cmp word [ebx + 0x1b18], 0
jne 0x4063b4
cmp word [ebx + 0x1b1a], 1
je 0x4063c3
mov dword [ebx + 0x1b6c], 1
jmp 0x407ef4
mov dword [ebx + 0x1b6c], 0
jmp 0x407ef4
mov al, byte [ebp]
inc ebp
mov ecx, ebx
mov byte [esp + 0x54], al
call fcn.004084c0
test eax, eax
je 0x407fac
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov esi, eax
test esi, esi
je 0x407fb3
mov eax, dword [ebx + 0x1a50]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebx + 0x1a54]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
mov al, byte [esp + 0x54]
mov dword [ebx + 0x1a54], 0
lea edi, [ebx + eax*4 + 0x1b1c]
mov dword [ebx + 0x1a50], 0
mov eax, dword [edi]
test eax, eax
je 0x406448
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov dword [edi], esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x406480
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 1
mov eax, dword [ebx + 0x1b64]
mov dword [ebx + 0x1b6c], eax
jmp 0x407ef4
lea esi, [ebx + 0x1a28]
lea eax, [esp + 0x2b8]
push eax
mov ecx, ebx
push ebp
mov dword [esi], 2
call fcn.00408f80
mov ecx, dword [esp + 0x2b8]
lea edx, [esp + 0x1a]
push edx
mov dword [ebx + 0x1a2c], ecx
push eax
mov ecx, ebx
call fcn.00409000
mov ebp, eax
push esi
mov eax, dword [esp + 0x1e]
and eax, 0xffff
mov dword [ebx + 0x1a30], eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov esi, eax
test esi, esi
je 0x407fba
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x406515
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
mov dword [ebx + 0x1b6c], 0
jmp 0x407ef4
mov ax, word [ebx + 0x1b16]
mov esi, dword [ebx + 0x1a24]
push eax
mov ecx, ebx
push esi
call fcn.004098e0
add ax, word [esi]
mov esi, dword [ebx + 0x1a24]
movzx edx, ax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x54], edx
add eax, edx
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x60], eax
test eax, eax
je 0x407fc1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esp + 0x54]
mov edi, eax
mov esi, dword [ebx + 0x1a24]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1a24]
mov edi, dword [esp + 0x54]
mov dx, word [ecx + 0x14]
add edi, eax
mov esi, dword [ebx + 0x1a58]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
mov ecx, dword [esp + 0x60]
mov ax, word [ebx + 0x1b16]
lea edx, [esp + 0x2fc]
mov dword [esp + 0x300], eax
push edx
mov dword [esp + 0x300], 5
mov dword [esp + 0x308], ecx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov esi, eax
test esi, esi
je 0x407fc8
mov eax, dword [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x406631
push eax
mov ecx, ebx
call fcn.00408b60
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x40665d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
cmp dword [ebx + 0x1b68], 0
jne 0x40669c
cmp dword [ebx + 0x1b64], 0
je 0x40669c
cmp word [ebx + 0x1b18], 0
jne 0x40668d
cmp word [ebx + 0x1b1a], 1
je 0x40669c
mov dword [ebx + 0x1b6c], 1
jmp 0x407ef4
mov dword [ebx + 0x1b6c], 0
jmp 0x407ef4
lea eax, [ebx + 0x1a28]
push eax
mov dword [eax], 1
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov esi, eax
test esi, esi
je 0x407fcf
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x4066f4
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 0
mov dword [ebx + 0x1b6c], 0
jmp 0x407ef4
mov cl, byte [ebp]
inc ebp
mov al, cl
and al, 0x80
je 0x406727
and cl, 1
xor edx, edx
mov dl, cl
mov esi, dword [ebx + edx*4 + 0x1b4c]
jmp 0x406732
xor edx, edx
mov dl, cl
mov esi, dword [ebx + edx*4 + 0x1b1c]
test al, al
jne 0x40673d
push esi
call dword [sym.imp.GDI32.dll_UnrealizeObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebx + 0x1b5c], 0
jne 0x406773
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1b5c], 1
mov eax, dword [ebx + 0x1b64]
mov dword [ebx + 0x1b6c], eax
jmp 0x407ef4
lea eax, [esp + 0x358]
mov ecx, ebx
push eax
push ebp
call fcn.00409040
lea ecx, [esp + 0x35c]
push ecx
push eax
mov ecx, ebx
call fcn.00409040
lea ecx, [esp + 0x360]
push ecx
push eax
mov ecx, ebx
call fcn.00409040
lea ecx, [esp + 0x364]
push ecx
push eax
mov ecx, ebx
call fcn.00409040
mov ecx, dword [esp + 0x360]
lea edx, [esp + 0x368]
push edx
mov dword [ebx + 0x1b86], ecx
push eax
mov ecx, ebx
call fcn.00409040
lea ecx, [esp + 0x34]
push ecx
push eax
mov ecx, ebx
call fcn.00409000
mov esi, eax
mov ebp, eax
mov eax, dword [esp + 0x34]
lea edi, [esp + 0x36c]
and eax, 0xffff
add eax, 8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x358]
and eax, 0xffff
push ecx
mov byte [esp + eax + 0x378], 0
lea ebp, [eax + ebp + 8]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov esi, eax
test esi, esi
je 0x407fd6
push esi
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebx + 0x1a70]
test eax, eax
je 0x40686d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1a70], esi
jmp 0x407ef4
lea eax, [esp + 0x36]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x36]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextCharacterExtra]
mov eax, dword [esp + 0x36]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextCharacterExtra]
jmp 0x407ef4
lea eax, [esp + 0x38]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
lea ecx, [esp + 0x3a]
push ecx
push eax
mov ecx, ebx
call fcn.00409000
mov ebp, eax
mov eax, dword [esp + 0x38]
and eax, 0xffff
mov ecx, dword [ebx + 0x1a90]
push eax
mov eax, dword [esp + 0x3e]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextJustification]
mov eax, dword [esp + 0x38]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x3e]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextJustification]
jmp 0x407ef4
lea eax, [esp + 0x3c]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ecx, dword [ebx + 0x1a90]
mov eax, dword [esp + 0x3c]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov eax, dword [esp + 0x3c]
mov ecx, dword [ebx + 0x1a94]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x407ef4
lea eax, [esp + 0x4a]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
lea ecx, [esp + 0x4e]
push ecx
push eax
mov ecx, ebx
call fcn.00409000
cmp dword [ebx + 0x1a44], 0
mov ebp, eax
jne 0x4069c0
mov eax, dword [esp + 0x4e]
and eax, 0xffff
lea ecx, [eax*4 + 8]
push ecx
mov ecx, ebx
call fcn.00408b80
mov dword [ebx + 0x1a44], eax
test eax, eax
je 0x407fe0
mov word [eax], 0x300
mov ax, word [esp + 0x4e]
mov ecx, dword [ebx + 0x1a44]
inc ax
mov word [ecx + 2], ax
mov ax, word [ebx + 0x1b84]
test ax, ax
je 0x4069ee
cmp ax, 0x100
jne 0x4069e7
mov eax, dword [ebx + 0x1a44]
cmp word [eax + 2], 0x100
jne 0x4069e7
mov byte [esp + 0x54], 1
jmp 0x4069f3
mov byte [esp + 0x54], 4
jmp 0x4069f3
mov byte [esp + 0x54], 0
mov si, word [esp + 0x4a]
mov al, byte [esp + 0x54]
dec al
cmp al, 1
sbb edi, edi
neg edi
cmp word [esp + 0x4e], si
jb 0x406cac
lea eax, [esp + 0x50]
mov ecx, ebx
push eax
push ebp
call fcn.00408ec0
mov ebp, eax
mov edx, dword [ebx + 0x1b80]
test edx, edx
je 0x406a84
cmp si, 0xa
jb 0x406a44
mov ecx, dword [ebx + 0x1a44]
xor eax, eax
mov ax, word [ecx + 2]
movzx ecx, si
sub eax, ecx
cmp eax, 0xa
jg 0x406a84
xor eax, eax
xor ecx, ecx
mov al, byte [esp + 0x51]
mov cl, byte [esp + 0x50]
shl eax, 8
shl ecx, 0x10
or eax, ecx
xor ecx, ecx
mov cl, byte [esp + 0x52]
or eax, ecx
push eax
push edx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov ecx, dword [ebx + 0x1a48]
movzx edx, si
mov ecx, dword [ecx + eax*4 + 4]
mov eax, dword [ebx + 0x1a44]
mov dword [eax + edx*4 + 4], ecx
jmp 0x406c9f
movzx eax, si
mov edx, dword [ebx + 0x1a44]
lea ecx, [eax*4]
mov al, byte [esp + 0x52]
mov byte [edx + ecx + 4], al
mov al, byte [esp + 0x51]
mov edx, dword [ebx + 0x1a44]
mov byte [edx + ecx + 5], al
mov al, byte [esp + 0x50]
mov edx, dword [ebx + 0x1a44]
mov byte [edx + ecx + 6], al
mov edx, dword [ebx + 0x1a44]
mov al, byte [esp + 0x54]
mov byte [edx + ecx + 7], al
cmp word [ebx + 0x1b84], 0x100
jne 0x406c9f
cmp si, 0x8d
jne 0x406b17
cmp byte [esp + 0x52], 0x62
jne 0x406b17
cmp byte [esp + 0x51], 0x41
jne 0x406b17
cmp byte [esp + 0x50], 0x81
jne 0x406b17
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 4], 0xd0
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 5], 0xd0
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 6], 0xd0
jmp 0x406c9f
cmp si, 0x9c
jne 0x406b5c
mov eax, 0x82
cmp byte [esp + 0x52], al
jne 0x406b5c
cmp byte [esp + 0x51], al
jne 0x406b5c
cmp byte [esp + 0x50], 0x3f
jne 0x406b5c
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 4], 0xe4
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 5], 0xe4
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 6], 0xe4
jmp 0x406c9f
cmp si, 0xa2
jne 0x406b9e
cmp byte [esp + 0x52], 0x81
jne 0x406b9e
cmp byte [esp + 0x51], 0xc0
jne 0x406b9e
cmp byte [esp + 0x50], 0x97
jne 0x406b9e
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 4], 0x90
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 5], 0x90
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 6], 0x90
jmp 0x406c9f
cmp si, 0xa5
jne 0x406be0
cmp byte [esp + 0x52], 0xa1
jne 0x406be0
cmp byte [esp + 0x51], 0x62
jne 0x406be0
cmp byte [esp + 0x50], 0x52
jne 0x406be0
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 4], 0xd8
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 5], 0xd8
mov eax, dword [ebx + 0x1a44]
mov byte [eax + ecx + 6], 0xd8
jmp 0x406c9f
cmp si, 0xa9
jne 0x406c0b
mov eax, 0xa2
cmp byte [esp + 0x52], al
jne 0x406c0b
cmp byte [esp + 0x51], al
jne 0x406c0b
cmp byte [esp + 0x50], al
jne 0x406c0b
mov edx, dword [ebx + 0x1a44]
mov eax, 0xb0
jmp 0x406c87
cmp si, 0xaa
jne 0x406c37
mov eax, pe_nt_image_headers32
cmp byte [esp + 0x52], al
jne 0x406c37
cmp byte [esp + 0x51], al
jne 0x406c37
cmp byte [esp + 0x50], 0x3f
jne 0x406c37
mov edx, dword [ebx + 0x1a44]
mov eax, 0xa0
jmp 0x406c87
cmp si, 0xb3
jne 0x406c60
cmp byte [esp + 0x52], 0xff
jne 0x406c60
cmp byte [esp + 0x51], 0xbf
jne 0x406c60
cmp byte [esp + 0x50], 0x18
jne 0x406c60
mov edx, dword [ebx + 0x1a44]
mov eax, 0xe8
jmp 0x406c87
cmp si, 0xbf
jne 0x406c9f
cmp byte [esp + 0x52], 0
jne 0x406c9f
cmp byte [esp + 0x51], 0xe1
jne 0x406c9f
cmp byte [esp + 0x50], 0
jne 0x406c9f
mov edx, dword [ebx + 0x1a44]
mov eax, 0x60
mov byte [edx + ecx + 4], al
mov edx, dword [ebx + 0x1a44]
mov byte [edx + ecx + 5], al
mov edx, dword [ebx + 0x1a44]
mov byte [edx + ecx + 6], al
inc si
cmp word [esp + 0x4e], si
jae 0x406a0f
cmp dword [ebx + 0x1a4c], 0
jne 0x406cd0
mov eax, dword [ebx + 0x1a44]
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebx + 0x1a4c], eax
test eax, eax
je 0x407fea
push 0
mov eax, dword [ebx + 0x1a4c]
push eax
mov ecx, dword [ebx + 0x1a94]
push ecx
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
mov ecx, dword [ebx + 0x1a4c]
push ecx
mov edx, dword [ebx + 0x1a90]
push edx
call dword [sym.imp.GDI32.dll_SelectPalette]
test edi, edi
je 0x406d4d
cmp word [esp + 0x4a], 0xa
jb 0x406d4d
mov eax, dword [ebx + 0x1a44]
mov edx, dword [esp + 0x4e]
and edx, 0xffff
xor ecx, ecx
mov cx, word [eax + 2]
sub ecx, edx
cmp ecx, 0xa
jle 0x406d4d
mov ecx, dword [esp + 0x4a]
and ecx, 0xffff
sub edx, ecx
lea eax, [eax + ecx*4]
add eax, 4
inc edx
push eax
push edx
push ecx
mov eax, dword [ebx + 0x1a4c]
push eax
call dword [sym.imp.GDI32.dll_AnimatePalette]
jmp 0x407ef4
mov ecx, dword [esp + 0x4a]
and ecx, 0xffff
lea eax, [ecx*4]
add eax, dword [ebx + 0x1a44]
add eax, 4
push eax
mov eax, dword [esp + 0x52]
and eax, 0xffff
sub eax, ecx
inc eax
push eax
push ecx
mov ecx, dword [ebx + 0x1a4c]
push ecx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x407ef4
lea eax, [esp + 0x348]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
mov ebp, eax
mov ecx, dword [esp + 0x350]
mov eax, dword [esp + 0x354]
mov edx, dword [esp + 0x34c]
push eax
push ecx
mov eax, dword [esp + 0x350]
push edx
push eax
mov ecx, dword [ebx + 0x1aec]
push ecx
call dword [sym.imp.GDI32.dll_SetRectRgn]
mov ecx, ebx
call fcn.00408350
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
lea eax, [esp + 0x224]
mov ecx, ebx
push eax
push ebp
call fcn.00409480
mov ebp, eax
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
mov ecx, dword [esp + 0x224]
mov eax, dword [esp + 0x228]
mov edx, dword [ebx + 0x1ae8]
push eax
push ecx
push esi
mov eax, dword [ebx + 0x1a90]
push edx
push eax
call dword [sym.imp.GDI32.dll_FrameRgn]
mov ecx, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
push ecx
mov eax, dword [ebx + 0x1ae8]
push edx
mov ecx, dword [ebx + 0x1a94]
push esi
push eax
push ecx
call dword [sym.imp.GDI32.dll_FrameRgn]
push esi
mov ecx, dword [ebx + 0x1a90]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x407ef4
mov eax, dword [ebx + 0x1ae8]
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
call dword [sym.imp.GDI32.dll_InvertRgn]
mov ecx, dword [ebx + 0x1ae8]
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_InvertRgn]
jmp 0x407ef4
mov ecx, ebx
call fcn.004085b0
mov eax, dword [ebx + 0x1ae8]
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
call dword [sym.imp.GDI32.dll_PaintRgn]
mov ecx, dword [ebx + 0x1ae8]
mov edx, dword [ebx + 0x1a94]
push ecx
push edx
call dword [sym.imp.GDI32.dll_PaintRgn]
jmp 0x407ef4
cmp dword [ebx + 0x1ad8], 0
je 0x406ee6
cmp dword [esp + 0x58], 0
jne 0x406ee6
mov ecx, ebx
call fcn.004088e0
lea eax, [esp + 0x1cc]
mov ecx, ebx
push eax
push ebp
call fcn.004094b0
lea ecx, [esp + 0x1c]
push ecx
push eax
mov ecx, ebx
call fcn.00409000
mov ebp, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1d8]
and ecx, 0xffff
mov dword [ebx + 0x1ac8], 0
lea edi, [ecx*8]
mov dword [ebx + 0x1acc], eax
mov eax, ecx
mov dword [ebx + 0x1ac4], edi
mov dword [ebx + 0x1ac0], 0
imul eax, dword [esp + 0x1d8]
mov dword [esp + 0x98], eax
mov eax, dword [ebx + 0x1a58]
mov edx, dword [esp + 0x98]
mov dword [esp + 0x60], eax
add edx, eax
cmp dword [esp + 0x1d8], 0
mov dword [esp + 0x54], edx
jle 0x406f9b
mov eax, edx
mov esi, dword [esp + 0x60]
cmp dword [esi], 0xffffffff
jne 0x406f9b
cmp dword [eax], 0
jne 0x406f9b
add eax, 4
add esi, 4
mov edx, dword [ebx + 0x1ac8]
inc edx
mov dword [ebx + 0x1ac8], edx
cmp edx, dword [esp + 0x1d8]
jl 0x406f75
mov eax, dword [ebx + 0x1ac8]
cmp eax, dword [esp + 0x1d8]
jge 0x406fe9
mov eax, dword [esp + 0x1d8]
mov edx, dword [esp + 0x54]
shl eax, 2
mov edi, dword [esp + 0x60]
lea esi, [eax + edx - 4]
lea eax, [eax + edi - 4]
cmp dword [eax], 0xffffffff
jne 0x406fe9
cmp dword [esi], 0
jne 0x406fe9
sub esi, 4
sub eax, 4
mov edx, dword [ebx + 0x1acc]
dec edx
mov dword [ebx + 0x1acc], edx
cmp edx, dword [ebx + 0x1ac8]
jg 0x406fc4
mov esi, 0xffffffff
mov eax, dword [ebx + 0x1ac8]
mov dword [esp + 0x64], eax
cmp dword [ebx + 0x1acc], eax
mov dword [esp + 0x6c], 0
jle 0x40703c
mov edx, dword [esp + 0x54]
lea edi, [edx + eax*4]
mov edx, dword [esp + 0x60]
lea edx, [edx + eax*4]
mov eax, dword [ebx + 0x1acc]
sub eax, dword [esp + 0x64]
mov dword [esp + 0x54], eax
and esi, dword [edx]
mov eax, dword [esp + 0x6c]
or eax, dword [edi]
add edi, 4
add edx, 4
mov dword [esp + 0x6c], eax
dec dword [esp + 0x54]
jne 0x407024
mov edx, esi
mov eax, esi
shl edx, 0x10
shr eax, 0x10
or edx, esi
and edx, 0xff00
and esi, 0xff0000
shl edx, 8
or eax, esi
shr eax, 8
mov esi, dword [esp + 0x6c]
shr esi, 0x10
or edx, eax
mov eax, dword [esp + 0x6c]
and eax, 0xff0000
or esi, eax
mov eax, dword [esp + 0x6c]
shr esi, 8
shl eax, 0x10
lea edi, [ecx*8]
or eax, dword [esp + 0x6c]
and eax, 0xff00
shl eax, 8
or esi, eax
mov eax, 0x80000000
mov dword [esp + 0x6c], esi
test edi, edi
jle 0x4070c1
test eax, edx
je 0x4070c1
test dword [esp + 0x6c], eax
jne 0x4070c1
shr eax, 1
mov esi, dword [ebx + 0x1ac0]
inc esi
lea edi, [ecx*8]
mov dword [ebx + 0x1ac0], esi
cmp esi, edi
jl 0x40709c
shl ecx, 3
mov esi, 1
cmp dword [ebx + 0x1ac0], ecx
jge 0x4070f2
test esi, edx
je 0x4070f2
test dword [esp + 0x6c], esi
jne 0x4070f2
add esi, esi
mov eax, dword [ebx + 0x1ac4]
dec eax
mov dword [ebx + 0x1ac4], eax
cmp eax, dword [ebx + 0x1ac0]
jg 0x4070d1
push 0xff0062
mov eax, dword [ebx + 0x1aa0]
push 0x20
push 0x20
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebx + 0x1a58]
mov edx, dword [esp + 0x98]
push eax
mov ecx, dword [ebx + 0x1a7c]
push edx
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa0]
push 0
push 0
push ecx
mov edx, dword [ebx + 0x1a98]
push 0x20
push 0x20
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x42
mov ecx, dword [ebx + 0x1aa0]
push 0x20
push 0x20
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebx + 0x1a58]
mov edx, dword [esp + 0x98]
add eax, dword [esp + 0x98]
mov ecx, dword [ebx + 0x1a7c]
push eax
push edx
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa0]
push 0
push 0
push ecx
mov edx, dword [ebx + 0x1a9c]
push 0x20
push 0x20
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1ac4]
sub eax, dword [ebx + 0x1ac0]
mov dword [ebx + 0x1ad0], eax
mov eax, dword [ebx + 0x1acc]
sub eax, dword [ebx + 0x1ac8]
mov dword [ebx + 0x1ad4], eax
mov edx, dword [ebx + 0x1ab8]
mov ecx, dword [ebx + 0x1abc]
add edx, dword [ebx + 0x1ab0]
add ecx, dword [ebx + 0x1ab4]
mov eax, dword [esp + 0x1cc]
mov esi, dword [esp + 0x1d0]
mov dword [ebx + 0x1ab0], edx
mov dword [ebx + 0x1ab4], ecx
sub edx, eax
sub ecx, esi
mov dword [ebx + 0x1ab8], eax
mov dword [ebx + 0x1abc], esi
mov dword [ebx + 0x1ab0], edx
mov dword [ebx + 0x1ab4], ecx
cmp dword [esp + 0x58], 0
jne 0x40722c
mov ecx, ebx
call fcn.00408910
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407ef4
push eax
mov ecx, ebx
call fcn.00408b60
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407ef4
cmp dword [esp + 0x58], 0
jne 0x407ef4
mov ecx, ebx
call fcn.004088e0
jmp 0x407ef4
xor eax, eax
add ebp, 2
mov ax, word [ebp - 2]
add ebp, 2
mov ecx, ebx
mov dword [esp + 0x29c], eax
xor eax, eax
mov edx, dword [esp + 0x29c]
mov ax, word [ebp - 2]
push eax
push edx
call fcn.00408440
jmp 0x407ef4
lea esi, [ebx + 0x1b92]
mov ecx, ebx
push esi
call fcn.00409280
push esi
mov ecx, ebx
call fcn.004092b0
test eax, eax
je 0x407ff4
mov dword [ebx + 0x1b78], 0
mov dword [ebx + 0x1b74], 0xffffff
mov dword [ebx + 0x1b0e], 0
mov word [ebx + 0x1b0a], 0
mov word [ebx + 0x1b14], 0
mov word [ebx + 0x1b0c], 0
jmp 0x407ef4
lea eax, [esp + 0x1e]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov eax, dword [esp + 0x1e]
and eax, 0xffff
je 0x40732f
cmp eax, 1
je 0x4073de
cmp eax, 2
je 0x4074ee
jmp 0x407ef4
lea eax, [esp + 0x2d4]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
mov ebp, eax
mov edi, dword [esp + 0x2dc]
sub edi, dword [esp + 0x2d4]
mov esi, dword [esp + 0x2e0]
sub esi, dword [esp + 0x2d8]
mov eax, dword [ebx + 0x1a94]
push esi
push edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebx + 0x1a88], eax
test eax, eax
je 0x407ffe
push eax
mov eax, dword [ebx + 0x1aa8]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, ebx
mov dword [ebx + 0x1a8c], eax
mov eax, dword [ebx + 0x1a94]
push eax
call fcn.004094d0
mov eax, dword [esp + 0x2d8]
push 0xcc0020
mov ecx, dword [esp + 0x2d8]
push eax
push ecx
mov edx, dword [ebx + 0x1a94]
push edx
mov eax, dword [ebx + 0x1aa8]
push esi
push edi
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x1a94]
push ecx
mov ecx, ebx
call fcn.00409580
jmp 0x407ef4
lea eax, [esp + 0x27c]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
mov ebp, eax
mov edi, dword [esp + 0x284]
sub edi, dword [esp + 0x27c]
mov esi, dword [esp + 0x288]
sub esi, dword [esp + 0x280]
mov eax, dword [ebx + 0x1a94]
push eax
mov ecx, ebx
call fcn.004094d0
mov eax, dword [ebx + 0x1af0]
mov ecx, dword [ebx + 0x1a94]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0x1a90]
push ecx
mov ecx, ebx
call fcn.004094d0
push 0
mov ecx, dword [ebx + 0x1ae0]
push ecx
mov edx, dword [ebx + 0x1adc]
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov ecx, dword [ebx + 0x1af0]
mov edx, dword [ebx + 0x1a90]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa8]
mov edx, dword [esp + 0x284]
push 0
mov eax, dword [esp + 0x284]
push 0
push ecx
push esi
push edi
mov ecx, dword [ebx + 0x1a90]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa8]
mov edx, dword [esp + 0x284]
push 0
mov eax, dword [esp + 0x284]
push 0
push ecx
push esi
push edi
push edx
push eax
mov ecx, dword [ebx + 0x1a94]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x1a90]
push ecx
mov ecx, ebx
call fcn.00409580
mov ecx, dword [ebx + 0x1a94]
push ecx
mov ecx, ebx
call fcn.00409580
mov ecx, ebx
call fcn.00408350
cmp dword [ebx + 0x1a88], 0
je 0x407ef4
mov eax, dword [ebx + 0x1a8c]
mov ecx, dword [ebx + 0x1aa8]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0x1a88]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x1a88], 0
jmp 0x407ef4
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov eax, dword [esp + 0x20]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x407ef4
lea eax, [esp + 0x2bc]
mov ecx, ebx
push eax
push ebp
call fcn.00409080
mov ebp, eax
mov ecx, ebx
mov eax, dword [esp + 0x2bc]
push eax
call fcn.00408b80
mov dword [ebx + 0x1a5c], eax
mov dword [ebx + 0x1a58], eax
test eax, eax
jne case.0x40440a.66
mov eax, 0xc9
jmp 0x407f59
cmp dword [esp + 0x68], 0x46
mov word [esp + 0x54], 0
jne 0x4075ab
lea eax, [esp + 0x54]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
lea eax, [esp + 0x46]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov cx, word [esp + 0x46]
and cx, 0x7f
mov word [ebx + 0x1b1a], cx
lea edx, [esp + 0x46]
mov cx, word [esp + 0x46]
push edx
and cx, 0x80
push eax
cmp cx, 1
sbb ecx, ecx
neg ecx
mov word [ebx + 0x1b16], cx
mov ecx, ebx
call fcn.00409000
mov cx, word [esp + 0x46]
lea edx, [esp + 0x40]
mov word [ebx + 0x1b18], cx
push edx
push eax
mov ecx, ebx
call fcn.00409000
mov ebp, eax
mov esi, dword [esp + 0x40]
and esi, 0xffff
cmp word [esp + 0x54], 0
jne 0x40763b
mov ax, word [ebx + 0x1b1a]
mov edi, dword [ebx + 0x1a64]
push eax
mov ecx, ebx
push esi
call fcn.00409350
movzx ecx, ax
mov eax, edi
cdq
idiv ecx
jmp 0x407653
lea eax, [esp + 0x40]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov eax, dword [esp + 0x40]
and eax, 0xffff
mov ecx, dword [ebx + 0x1a24]
mov dword [ecx], 0x28
mov ecx, dword [ebx + 0x1a24]
mov dword [ecx + 4], esi
mov ecx, dword [ebx + 0x1a24]
mov dword [ecx + 8], eax
mov ecx, dword [ebx + 0x1a24]
mov word [ecx + 0xc], 1
mov ax, word [ebx + 0x1b1a]
mov ecx, dword [ebx + 0x1a24]
mov word [ecx + 0xe], ax
mov eax, dword [esp + 0x54]
and eax, 0xffff
mov ecx, dword [ebx + 0x1a24]
mov dword [ecx + 0x10], eax
cmp word [ebx + 0x1b1a], 1
jne 0x4076b9
mov eax, dword [ebx + 0x1a24]
mov dword [eax + 0x20], 0
jmp 0x4076cb
xor eax, eax
mov ecx, dword [ebx + 0x1a24]
mov ax, word [ebx + 0x1b18]
mov dword [ecx + 0x20], eax
mov eax, dword [ebx + 0x1a24]
mov dword [eax + 0x24], 0
mov edx, dword [ebx + 0x1a64]
mov eax, dword [ebx + 0x1a24]
mov dword [eax + 0x14], edx
cmp word [ebx + 0x1b16], 1
jne 0x4077e4
mov ax, word [ebx + 0x1b18]
test ax, ax
jne 0x4077b0
cmp dword [esp + 0x68], 0x45
je 0x407789
mov eax, dword [ebx + 0x1a44]
cmp word [eax + 2], 2
je 0x407789
mov eax, dword [ebx + 0x1a90]
lea esi, [ebx + 0x1a20]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
test eax, 0x1000000
je 0x407739
movzx ax, al
jmp 0x407747
push eax
mov eax, dword [ebx + 0x1a4c]
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov ecx, dword [esi]
mov word [ecx + 0x28], ax
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
test eax, 0x1000000
je 0x407770
movzx cx, al
mov eax, dword [esi]
mov word [eax + 0x2a], cx
jmp 0x407927
push eax
mov eax, dword [ebx + 0x1a4c]
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov ecx, dword [esi]
mov word [ecx + 0x2a], ax
jmp 0x407927
mov eax, dword [ebx + 0x1a20]
mov word [eax + 0x28], 0
mov ecx, dword [ebx + 0x1a44]
mov ax, word [ecx + 2]
mov ecx, dword [ebx + 0x1a20]
dec ax
mov word [ecx + 0x2a], ax
jmp 0x407927
xor edx, edx
test ax, ax
je 0x407927
xor esi, esi
mov ecx, dword [ebx + 0x1a20]
inc ebp
add esi, 2
inc edx
movzx ax, byte [ebp - 1]
mov word [ecx + esi + 0x26], ax
xor eax, eax
mov ax, word [ebx + 0x1b18]
cmp eax, edx
jg 0x4077bd
jmp 0x407927
cmp word [esp + 0x54], 3
jne 0x407812
mov edx, dword [ebx + 0x1a20]
mov eax, dword [ebp]
add edx, 0x28
mov dword [edx], eax
add edx, 4
lea eax, [ebp + 4]
add ebp, 0xc
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
jmp 0x407927
mov ax, word [ebx + 0x1b18]
test ax, ax
jne 0x4078ea
cmp dword [esp + 0x68], 0x45
jne 0x40787e
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2a], 0
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x29], 0
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x28], 0
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2b], 0
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2e], 0xff
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2d], 0xff
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2c], 0xff
mov eax, dword [ebx + 0x1a20]
mov byte [eax + 0x2f], 0
jmp 0x407927
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2a], al
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x29], ah
mov ecx, dword [ebx + 0x1a20]
shr eax, 0x10
mov byte [ecx + 0x28], al
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2b], 0
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2e], al
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2d], ah
mov ecx, dword [ebx + 0x1a20]
shr eax, 0x10
mov byte [ecx + 0x2c], al
mov ecx, dword [ebx + 0x1a20]
mov byte [ecx + 0x2f], 0
jmp 0x407927
xor esi, esi
test ax, ax
je 0x407927
xor edi, edi
lea eax, [esp + 0x2c0]
mov ecx, ebx
push eax
add edi, 4
push ebp
inc esi
call fcn.00408ec0
mov ebp, eax
mov ecx, dword [ebx + 0x1a20]
mov eax, dword [esp + 0x2c0]
mov dword [ecx + edi + 0x24], eax
xor eax, eax
mov ax, word [ebx + 0x1b18]
cmp eax, esi
jg 0x4078f3
cmp word [esp + 0x54], 0
jne 0x407ef4
mov eax, dword [ebx + 0x1a58]
mov ecx, dword [ebx + 0x1a24]
push eax
push ecx
mov ecx, ebx
call fcn.004093a0
jmp 0x407ef4
cmp dword [esp + 0x68], 0x47
jne 0x40795c
mov esi, dword [ebx + 0x1ae8]
jmp 0x407962
mov esi, dword [ebx + 0x1aec]
cmp word [ebx + 0x1b14], 0
jne 0x407987
lea eax, [esp + 0x22]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ax, word [esp + 0x22]
mov word [ebx + 0x1b12], ax
cmp word [ebx + 0x1b12], 0
jne 0x407a20
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_SetRectRgn]
jmp 0x407a75
mov ecx, dword [ebx + 0x1ae4]
push ecx
call dword [sym.imp.GDI32.dll_SetRectRgn]
push 2
mov ecx, dword [ebx + 0x1ae4]
push ecx
push esi
push esi
call dword [sym.imp.GDI32.dll_CombineRgn]
test eax, eax
je 0x408008
mov ax, word [ebx + 0x1b14]
inc ax
mov word [ebx + 0x1b14], ax
cmp word [ebx + 0x1b12], ax
je 0x407a6c
test al, 0x7f
je 0x407a75
cmp dword [esp + 0x3ac], 0
je 0x407a20
cmp dword [ebx + 0x33e8], 0
je 0x407a20
mov eax, dword [esp + 0x3b0]
push eax
call dword [esp + 0x3b0]
mov dword [ebx + 0x33e8], 0
lea eax, [esp + 0x28c]
mov ecx, ebx
push eax
push ebp
call fcn.00408ea0
mov ebp, eax
mov ecx, dword [esp + 0x294]
mov eax, dword [esp + 0x298]
mov edx, dword [esp + 0x290]
cmp word [ebx + 0x1b14], 0
push eax
push ecx
mov eax, dword [esp + 0x294]
push edx
push eax
jne 0x4079a9
push esi
call dword [sym.imp.GDI32.dll_SetRectRgn]
jmp 0x4079cf
mov word [ebx + 0x1b14], 0
cmp word [ebx + 0x1b14], 0
jne 0x407ef4
cmp dword [esp + 0x68], 0x48
jne 0x407ef4
mov ecx, ebx
call fcn.00408350
jmp 0x407ef4
cmp word [ebx + 0x1b0a], 0
jne 0x407b51
lea eax, [esp + 0x24]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov ebp, eax
mov ecx, ebx
mov ax, word [esp + 0x24]
xor si, si
mov word [ebx + 0x1b08], ax
movzx eax, ax
shl eax, 2
push eax
call fcn.00408b80
mov word [ebx + 0x1b0c], si
mov dword [ebx + 0x1b0e], eax
cmp word [ebx + 0x1b08], si
jbe 0x407b22
lea eax, [esp + 0x3e]
mov ecx, ebx
push eax
push ebp
call fcn.00409000
mov cx, word [esp + 0x3e]
mov ebp, eax
movzx edx, si
inc si
mov eax, dword [ebx + 0x1b0e]
mov word [eax + edx*2], cx
mov cx, word [esp + 0x3e]
add word [ebx + 0x1b0c], cx
cmp word [ebx + 0x1b08], si
ja 0x407aea
xor eax, eax
mov ax, word [ebx + 0x1b0c]
shl eax, 3
cmp eax, 0x15f4
jbe 0x407b51
push eax
mov ecx, ebx
call fcn.00408b80
mov dword [ebx + 0x1a5c], eax
mov dword [ebx + 0x1a58], eax
test eax, eax
je 0x408012
lea eax, [esp + 0x78]
mov ecx, ebx
push eax
push ebp
call fcn.00409450
mov cx, word [ebx + 0x1b0a]
mov ebp, eax
test cx, cx
mov eax, dword [esp + 0x78]
jne 0x407b8e
mov edx, dword [esp + 0x7c]
mov dword [ebx + 0x1b00], eax
mov dword [ebx + 0x1af8], eax
mov dword [ebx + 0x1b04], edx
mov dword [ebx + 0x1afc], edx
jmp 0x407bd6
cmp dword [ebx + 0x1af8], eax
jle 0x407b9e
mov dword [ebx + 0x1af8], eax
jmp 0x407bb0
mov eax, dword [esp + 0x78]
cmp dword [ebx + 0x1b00], eax
jge 0x407bb0
mov dword [ebx + 0x1b00], eax
mov eax, dword [esp + 0x7c]
cmp dword [ebx + 0x1afc], eax
jle 0x407bc4
mov dword [ebx + 0x1afc], eax
jmp 0x407bd6
mov eax, dword [esp + 0x7c]
cmp dword [ebx + 0x1b04], eax
jge 0x407bd6
mov dword [ebx + 0x1b04], eax
movzx eax, cx
shl eax, 3
add eax, dword [ebx + 0x1a58]
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x7c]
mov dword [eax], edx
mov dword [eax + 4], esi
mov ax, word [ebx + 0x1b0a]
inc ax
mov word [ebx + 0x1b0a], ax
cmp word [ebx + 0x1b0c], ax
je 0x407c10
test al, al
jne 0x407b51
mov ax, word [ebx + 0x1b0a]
cmp word [ebx + 0x1b0c], ax
jne 0x407ef4
mov eax, dword [ebx + 0x1b04]
mov ecx, dword [ebx + 0x1b00]
push eax
mov edx, dword [ebx + 0x1afc]
push ecx
mov eax, dword [ebx + 0x1af8]
push edx
mov ecx, dword [ebx + 0x1a90]
push eax
push ecx
mov ecx, ebx
call fcn.004086a0
mov ecx, ebx
mov dword [esp + 0x5c], eax
call fcn.004085b0
xor eax, eax
mov ecx, dword [ebx + 0x1b0e]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a58]
push eax
push ecx
push edx
mov eax, dword [ebx + 0x1a94]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
cmp dword [esp + 0x58], 0
jne 0x407caa
xor eax, eax
mov ecx, dword [ebx + 0x1b0e]
mov ax, word [ebx + 0x1b08]
mov edx, dword [ebx + 0x1a58]
push eax
push ecx
push edx
mov eax, dword [ebx + 0x1a90]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov word [ebx + 0x1b0a], 0
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407cdb
push eax
mov ecx, ebx
call fcn.00408b60
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
mov eax, dword [ebx + 0x1b0e]
test eax, eax
je 0x407ef4
push eax
mov ecx, ebx
call fcn.00408b60
jmp 0x407ef4
cmp dword [ebx + 0x1ad8], 0
je 0x407d0d
cmp dword [esp + 0x58], 0
jne 0x407d0d
mov ecx, ebx
call fcn.004088e0
lea eax, [esp + 0x1dc]
mov ecx, ebx
push eax
push ebp
call fcn.004094b0
lea ecx, [esp + 0x26]
push ecx
push eax
mov ecx, ebx
call fcn.00409000
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.00409000
mov ebp, eax
mov ecx, dword [esp + 0x1e4]
mov eax, dword [esp + 0x1e8]
mov esi, dword [esp + 0x26]
and esi, 0xffff
mov dword [ebx + 0x1acc], eax
mov edi, ecx
mov dword [ebx + 0x1ac4], ecx
mov dword [ebx + 0x1ac8], 0
mov dword [ebx + 0x1ac0], 0
imul esi, eax
imul edi, eax
push 0xff0062
mov eax, dword [ebx + 0x1aa0]
push 0x20
push 0x20
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebx + 0x1a58]
mov ecx, dword [ebx + 0x1a7c]
push eax
push esi
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa0]
push 0
push 0
push ecx
mov edx, dword [ebx + 0x1a98]
push 0x20
push 0x20
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x42
mov ecx, dword [ebx + 0x1aa4]
push 0x20
push 0x20
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebx + 0x1a58]
mov ecx, dword [ebx + 0x1a80]
add eax, esi
push eax
push edi
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
push 0xcc0020
mov ecx, dword [ebx + 0x1aa4]
push 0
push 0
push ecx
mov edx, dword [ebx + 0x1a9c]
push 0x20
push 0x20
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x1ac4]
mov ecx, dword [ebx + 0x1ab8]
sub eax, dword [ebx + 0x1ac0]
add ecx, dword [ebx + 0x1ab0]
mov edx, dword [ebx + 0x1abc]
mov dword [ebx + 0x1ad0], eax
mov eax, dword [ebx + 0x1acc]
add edx, dword [ebx + 0x1ab4]
sub eax, dword [ebx + 0x1ac8]
mov esi, dword [esp + 0x1e0]
mov dword [ebx + 0x1ad4], eax
mov dword [ebx + 0x1ab0], ecx
mov eax, dword [esp + 0x1dc]
mov dword [ebx + 0x1ab4], edx
sub ecx, eax
sub edx, esi
mov dword [ebx + 0x1ab8], eax
mov dword [ebx + 0x1abc], esi
mov dword [ebx + 0x1ab0], ecx
mov dword [ebx + 0x1ab4], edx
cmp dword [esp + 0x58], 0
jne 0x407ea0
mov ecx, ebx
call fcn.00408910
mov eax, dword [ebx + 0x1a5c]
test eax, eax
je 0x407ef4
push eax
mov ecx, ebx
call fcn.00408b60
mov dword [ebx + 0x1a5c], 0
mov eax, dword [ebx + 0x1a60]
mov dword [ebx + 0x1a58], eax
jmp 0x407ef4
mov dword [ebx + 0x1a64], 0
lea eax, [ebx + 0x1a64]
mov ecx, dword [ebx + 0x1a58]
push eax
push ecx
push ebp
mov ecx, ebx
call fcn.00409140
mov ebp, eax
test ebp, ebp
je 0x40801c
cmp dword [esp + 0x5c], 0
je 0x407f02
mov ecx, ebx
call fcn.00408910
cmp dword [esp + 0x3ac], 0
je 0x407f2e
cmp dword [ebx + 0x33e8], 0
je 0x407f2e
mov eax, dword [esp + 0x3b0]
push eax
call dword [esp + 0x3b0]
mov dword [ebx + 0x33e8], 0
dec word [esp + 0x48]
cmp dword [esp + 0xc8], ebp
ja 0x4043c5
mov eax, dword [esp + 0xc8]
sub eax, ebp
cmp eax, 1
mov eax, 0
adc eax, 0xffffffff
and eax, 0xcb
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x394
ret 0xc
mov eax, 0xcb
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xc9
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xc9
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xc9
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xc9
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xca
jmp 0x407f59
mov eax, 0xc9
jmp 0x407f59
mov eax, 0xc9
jmp 0x407f59