Function at 0x401100
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x481533
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfc
push ebx
push ebp
push esi
xor esi, esi
push edi
mov ebp, ecx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], vtable.CFont.0
mov ebx, dword [esp + 0x11c]
push 0x48
push 0x5a
push ebx
mov dword [esp + 0x120], esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [esp + 0x6c], eax
mov edi, 0x4a121c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
lea edx, [esp + 0x88]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x80], 0
shr ecx, 2
mov byte [esp + 0x81], 0
mov byte [esp + 0x82], 0
mov byte [esp + 0x83], 0
mov byte [esp + 0x84], 4
mov byte [esp + 0x85], 0
mov byte [esp + 0x86], 0
mov byte [esp + 0x87], 0x20
push 1
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.GDI32.dll_SetBkMode]
lea ecx, [esp + 0x6c]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [esp + 0x3c]
call fcn.004725bb
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x38]
neg eax
sbb eax, eax
and eax, edx
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x5c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x54]
push ecx
push 6
push str.99.99
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x5c]
mov edi, dword [esp + 0x58]
mov dword [esp + 0x24], edi
lea esi, [ecx + edx]
mov eax, dword [esp + 0x60]
mov dword [ebp + 0x64], esi
add eax, edi
mov dword [esp + 0x1c], eax
mov dword [ebp + 0x68], eax
mov eax, 0x55555556
imul ecx
mov eax, dword [esp + 0x64]
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [esp + 0x68]
sub eax, edx
mov edx, dword [esp + 0x1c]
sub ecx, edi
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x70], ecx
sub ecx, edx
xor edi, edi
sub eax, esi
cmp ecx, edi
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x78], ecx
jle 0x401372
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x18]
cdq
idiv dword [ebp + 0x78]
mov esi, eax
test esi, esi
jge 0x40129b
xor esi, esi
jmp 0x4012a8
cmp esi, 0xff
jle 0x4012a8
mov esi, 0xff
mov ecx, eax
test ecx, ecx
jge 0x4012b2
xor ecx, ecx
jmp 0x4012bf
cmp ecx, 0xff
jle 0x4012bf
mov ecx, 0xff
test eax, eax
jge 0x4012c7
xor eax, eax
jmp 0x4012d3
cmp eax, 0xff
jle 0x4012d3
mov eax, 0xff
xor edx, edx
and esi, 0xff
mov dh, al
mov dl, cl
lea ecx, [esp + 0x1c]
shl edx, 8
or edx, esi
push edx
push 1
push 0
call fcn.00472628
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x1c]
neg eax
sbb eax, eax
and eax, esi
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x64]
mov esi, eax
mov eax, edi
add eax, edx
push 0
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x6c]
mov edx, edi
add edx, ecx
push edx
push eax
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x1c], vtable.CGdiObject.0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x114], 1
call fcn.00472612
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x78]
inc edi
add ecx, 0x40
cmp edi, eax
mov byte [esp + 0x114], 0
mov dword [esp + 0x18], ecx
jl 0x401289
push 0
push 2
push 0
lea ecx, [esp + 0x4c]
call fcn.00472628
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x40]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov byte [esp + 0x114], 2
neg eax
sbb eax, eax
and eax, esi
push eax
push ebx
call edi
mov ecx, dword [ebp + 0x68]
mov edx, dword [ebp + 0x64]
dec ecx
push 0
dec edx
push ecx
push edx
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x6c]
mov esi, dword [sym.imp.GDI32.dll_LineTo]
dec eax
inc ecx
push eax
push ecx
push ebx
call esi
mov edx, dword [ebp + 0x70]
mov eax, dword [ebp + 0x6c]
inc edx
inc eax
push edx
push eax
push ebx
call esi
mov ecx, dword [ebp + 0x70]
mov edx, dword [ebp + 0x64]
inc ecx
dec edx
push ecx
push edx
push ebx
call esi
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x64]
dec eax
dec ecx
push eax
push ecx
push ebx
call esi
mov edx, dword [esp + 0x14]
push edx
push ebx
call edi
push 6
push ebx
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0x707070
push 1
push 0
lea ecx, [esp + 0x34]
call fcn.00472628
push 0x404040
push 1
push 0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x120], 3
call fcn.00472628
mov byte [esp + 0x114], 4
xor esi, esi
mov dword [esp + 0x14], esi
mov ecx, esi
mov eax, 0x66666667
imul ecx, dword [ebp + 0x74]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [ebp + 0x64]
add edx, eax
mov eax, esi
and eax, 1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
jne 0x4015d0
mov al, byte [ebp + 0x48]
test al, al
je 0x4015c2
mov edi, dword [ebp + 0x40]
mov byte [esp + 0x13], 1
mov ecx, dword [edi + 0x496]
mov edx, dword [edi + 0x492]
mov eax, dword [edi + 0x4be]
push ecx
mov ecx, dword [edi + 0x4ba]
push edx
push eax
push ecx
call fcn.00447a00
push 0
push 0xf4240
push edx
push eax
call fcn.00447950
mov dword [esp + 0x48], eax
mov esi, eax
mov eax, dword [edi + 0x39d6]
mov ecx, edx
test eax, eax
mov dword [esp + 0x4c], ecx
jne 0x4014f1
mov edi, dword [edi + 0x39da]
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
mov esi, eax
mov eax, dword [esp + 0x4c]
mov ecx, edx
cmp ecx, eax
jl 0x4014f1
jg 0x4014eb
cmp esi, dword [esp + 0x48]
jbe 0x4014f1
mov esi, dword [esp + 0x48]
mov ecx, eax
test ecx, ecx
jl 0x401516
jg 0x4014ff
cmp esi, 0x2710
jbe 0x401516
push 0
push 0x3e8
push ecx
push esi
mov byte [esp + 0x23], 0
call fcn.00447950
mov esi, eax
mov ecx, edx
mov edi, dword [esp + 0x14]
push ecx
mov eax, edi
push esi
cdq
push edx
push eax
call fcn.00447a00
push 0
push 0x14
push edx
push eax
call fcn.00447950
push edx
push eax
lea edx, [esp + 0xb0]
push 0x4a120c
push edx
call fcn.004478fa
add esp, 0x10
cmp edi, 0x14
jne 0x40158b
mov al, byte [esp + 0x13]
mov edi, 0x4a1208
test al, al
jne 0x40155f
mov edi, 0x4a1204
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xa8]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xa8]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xa8]
push ecx
mov ecx, dword [ebp + 0x70]
add ecx, 4
push eax
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_TextOutA]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x28]
neg eax
sbb eax, eax
jmp 0x4015dc
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x30]
neg eax
sbb eax, eax
and eax, edx
push eax
push ebx
call edi
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x68]
push 0
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x18]
mov edx, 2
sub edx, eax
mov eax, dword [ebp + 0x70]
lea ecx, [eax + edx*2]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [esp + 0x14]
push eax
push ebx
call edi
inc esi
cmp esi, 0x15
mov dword [esp + 0x14], esi
jl 0x40143d
push 0
push ebx
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov ecx, dword [ebp + 0x68]
mov edi, dword [esp + 0x24]
mov edx, dword [ebp + 0x64]
mov esi, dword [sym.imp.GDI32.dll_TextOutA]
push 2
sub ecx, edi
push 0x4a1200
push ecx
push edx
push ebx
call esi
push 2
push ebx
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov ecx, dword [ebp + 0x60]
lea eax, [esp + 0xa8]
push eax
push ecx
call fcn.00418ac0
mov eax, edi
lea edi, [esp + 0xb0]
cdq
sub eax, edx
or ecx, 0xffffffff
mov edx, eax
xor eax, eax
add esp, 8
sar edx, 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], edx
push ecx
mov ecx, dword [ebp + 0x68]
sub ecx, edx
mov edx, dword [ebp + 0x64]
lea eax, [esp + 0xac]
sub edx, 3
push eax
push ecx
push edx
push ebx
call esi
xor esi, esi
mov ecx, dword [ebp + 0x78]
mov eax, 0x66666667
imul ecx, esi
imul ecx
mov edi, dword [ebp + 0x70]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, esi
sub edi, edx
and eax, 1
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
je 0x4016e2
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x30]
neg eax
sbb eax, eax
jmp 0x4016ee
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x28]
neg eax
sbb eax, eax
and eax, edx
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x401767
test esi, esi
je 0x401767
lea ecx, [esp + 0xa8]
mov eax, 0x66666667
push ecx
mov ecx, esi
imul ecx, dword [ebp + 0x60]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
call fcn.00418ac0
lea edi, [esp + 0xb0]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
not ecx
dec ecx
sub edx, eax
mov eax, dword [ebp + 0x64]
push ecx
lea ecx, [esp + 0xac]
sub eax, 3
push ecx
push edx
push eax
push ebx
call dword [sym.imp.GDI32.dll_TextOutA]
mov edi, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x64]
mov edx, dword [esp + 0x18]
sub ecx, edx
push 0
sub ecx, 3
push edi
push ecx
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov edx, dword [ebp + 0x6c]
push edi
push edx
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [esp + 0x14]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
inc esi
cmp esi, 0x14
jl 0x4016a9
mov al, byte [ebp + 0x48]
test al, al
je 0x4017d7
xor esi, esi
mov eax, dword [ebp + 0x44]
mov cl, byte [eax + esi + 0x10]
test cl, cl
je 0x4017d1
mov ecx, dword [eax + esi*4 + 0x15]
xor edi, edi
test ecx, ecx
jle 0x4017d1
push edi
push esi
mov ecx, ebp
call fcn.00401860
mov ecx, dword [ebp + 0x44]
inc edi
cmp edi, dword [ecx + esi*4 + 0x15]
jl 0x4017be
inc esi
cmp esi, 5
jl 0x4017a9
mov edx, dword [esp + 0x50]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x30], esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x114], 5
call fcn.00472612
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x114], 6
call fcn.00472612
mov dword [esp + 0x40], esi
lea ecx, [esp + 0x40]
mov byte [esp + 0x114], 7
call fcn.00472612
mov dword [esp + 0x38], esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x114], 8
call fcn.00472612
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x108
ret 4