Function at 0x14003e460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x21a0]
mov eax, 0x22a0
call fcn.1401d52a0
sub rsp, rax
movaps xmmword [rsp + 0x2290], xmm6
movaps xmmword [rsp + 0x2280], xmm7
movaps xmmword [rsp + 0x2270], xmm8
movaps xmmword [rsp + 0x2260], xmm9
mov r15, r9
mov rbx, r8
mov rsi, rcx
mov edi, dword [rbp + 0x2200]
mov r12d, edi
btr r12d, 0xa
cmp dword [rcx + 0x40], r12d
jne 0x14003e4f9
mov rdx, qword [r8]
test rdx, rdx
je 0x14003f987
mov rcx, qword [rcx + 0xa8]
call fcn.1401e3efc
test eax, eax
jne 0x14003e4f9
mov rdx, qword [rbx]
mov r13, 0xffffffffffffffff
jmp 0x14003f93f
mov rdx, qword [rbx]
cmp dword [rdx - 0x10], 0
jne 0x14003e512
add rdx, 0xffffffffffffffe8
mov r13, 0xffffffffffffffff
jmp 0x14003f943
mov rcx, rsi
call fcn.14003f9a0
mov r8, qword [rbx]
mov r9d, dword [r8 - 0x10]
inc r9d
mov dword [rsp + 0x28], 0x1000
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r14, rax
mov qword [rbp + 0xa0], rax
mov rdx, qword [rsi + 0x38]
test rdx, rdx
je 0x14003e561
mov rdx, qword [rdx + 8]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x58], rax
mov qword [rbp - 0x80], 0
lea rdx, [rbp - 0x80]
mov rcx, r14
call sub.gdiplus.dll_GdipCreateFontFromDC
mov dword [rbp + 0x130], eax
mov rcx, qword [rbp - 0x80]
mov qword [rbp + 0x128], rcx
mov r13, 0xffffffffffffffff
mov rbx, qword [rbp + 0x2208]
xorps xmm9, xmm9
movss xmm6, dword [0x1402222c4]
bt edi, 0xa
jae 0x14003e696
mov qword [rbp - 0x68], 0
lea rdx, [rbp - 0x68]
mov rcx, r14
call sub.gdiplus.dll_GdipCreateFromHDC
mov rdi, qword [rbp - 0x68]
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x78], 0
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocStringLen]
mov rcx, rdi
call sub.gdiplus.dll_GdipSetTextRenderingHint
movd xmm1, dword [r15 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, dword [r15]
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x38], xmm0
movss dword [rbp - 0x34], xmm1
mov qword [rbp - 0x30], 0
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x80]
mov r8d, r13d
lea rdx, [rbp + 0x160]
mov rcx, rdi
call sub.gdiplus.dll_GdipMeasureString
movd xmm0, dword [r15 + 4]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rbp - 0x6c]
subss xmm0, xmm6
cvttss2si eax, xmm0
sub eax, dword [rbp + 0x220c]
mov dword [r15 + 0xc], eax
movd xmm0, dword [r15]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rbp - 0x70]
addss xmm0, xmm6
cvttss2si eax, xmm0
sub eax, ebx
mov dword [r15 + 8], eax
mov dword [rbp + 0x2200], r12d
mov rcx, rdi
call sub.gdiplus.dll_GdipDeleteGraphics
jmp 0x14003e69d
mov r12d, dword [rbp + 0x2200]
mov ecx, dword [r15 + 0xc]
sub ecx, dword [r15 + 4]
sub ecx, dword [rbp + 0x220c]
mov dword [rsi + 0x48], ecx
mov eax, dword [r15 + 8]
sub eax, dword [r15]
sub eax, ebx
mov dword [rsi + 0x4c], eax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xec], xmm0
xor r15d, r15d
mov dword [rbp + 0xfc], r15d
mov dword [rbp + 0xd8], 0x28
mov dword [rbp + 0xdc], eax
neg ecx
mov dword [rbp + 0xe0], ecx
lea ebx, [r15 + 1]
mov qword [rbp + 0xe4], 0x200001
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x98]
xor r8d, r8d
lea rdx, [rbp + 0xd8]
mov rcx, r14
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rdx, rax
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x50], rax
test r14, r14
je 0x14003e872
mov qword [rsp + 0x68], r15
xor edx, edx
lea r8, [rsp + 0x68]
xor ecx, ecx
call sub.gdiplus.dll_GdipCreateStringFormat
mov dword [rsp + 0x70], eax
mov qword [rbp - 0x60], r15
lea rdx, [rbp - 0x60]
mov rcx, r14
call sub.gdiplus.dll_GdipCreateFromHDC
mov rdi, qword [rbp - 0x60]
mov rcx, qword [rsp + 0x68]
test bl, r12b
je 0x14003e775
mov edx, ebx
jmp 0x14003e780
test r12b, 2
je 0x14003e78f
mov edx, 2
call sub.gdiplus.dll_GdipSetStringFormatAlign
test eax, eax
je 0x14003e7a3
mov dword [rsp + 0x70], eax
jmp 0x14003e7a3
xor edx, edx
call sub.gdiplus.dll_GdipSetStringFormatAlign
mov ecx, dword [rsp + 0x70]
test eax, eax
cmovne ecx, eax
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x68]
test r12b, 4
je 0x14003e7bf
mov edx, ebx
call sub.gdiplus.dll_GdipSetStringFormatLineAlign
test eax, eax
je 0x14003e7d3
mov dword [rsp + 0x70], eax
jmp 0x14003e7d3
xor edx, edx
call sub.gdiplus.dll_GdipSetStringFormatLineAlign
mov ecx, dword [rsp + 0x70]
test eax, eax
cmovne ecx, eax
mov dword [rsp + 0x70], ecx
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocStringLen]
mov rcx, rdi
call sub.gdiplus.dll_GdipSetTextRenderingHint
mov qword [rbp - 0x58], r15
lea rdx, [rbp - 0x58]
mov ecx, 0xffffffff
call sub.gdiplus.dll_GdipCreateSolidFill
movd xmm1, dword [rsi + 0x48]
cvtdq2ps xmm1, xmm1
subss xmm1, xmm6
movd xmm0, dword [rsi + 0x4c]
cvtdq2ps xmm0, xmm0
mov dword [rbp - 0x28], r15d
mov dword [rbp - 0x24], 0x3f800000
movss dword [rbp - 0x20], xmm0
movss dword [rbp - 0x1c], xmm1
mov rbx, qword [rbp - 0x58]
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r12, qword [rbp - 0x80]
mov r9, r12
mov r8d, r13d
lea rdx, [rbp + 0x160]
mov rcx, rdi
call sub.gdiplus.dll_GdipDrawString
mov rcx, rbx
call sub.gdiplus.dll_GdipDeleteBrush
mov rcx, rdi
call sub.gdiplus.dll_GdipDeleteGraphics
mov rcx, qword [rsp + 0x68]
call sub.gdiplus.dll_GdipDeleteStringFormat
mov rdi, qword [rsp + 0x60]
jmp 0x14003e876
mov r12, qword [rbp - 0x80]
movd xmm8, dword [rsi + 0x4c]
cvtdq2ps xmm8, xmm8
movd xmm7, dword [rsi + 0x48]
cvtdq2ps xmm7, xmm7
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003e89b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], r15
mov dword [rbp + 0x10], 0x60
mov dword [rbp + 0x14], 2
mov dword [rbp + 0x18], 1
mov qword [rbp + 0x1c], 0x10000
mov dword [rbp + 0x24], r15d
mov r15, qword [rbp + 0x21e8]
mov rcx, qword [r15 + 0xa20]
mov rax, qword [rcx]
lea r9, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x10]
call qword [rax + 0x18]
test eax, eax
js 0x14003f8f5
cmp qword [rsi + 8], 0
je 0x14003f8f5
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003e905
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov qword [rsi + 0x10], rax
jmp 0x14003e907
xor eax, eax
mov dword [rbp + 0x28], 0x50
mov dword [rbp + 0x2c], 2
mov dword [rbp + 0x30], 1
mov qword [rbp + 0x34], 0x10000
mov dword [rbp + 0x3c], eax
mov rcx, qword [r15 + 0xa20]
mov rax, qword [rcx]
lea r9, [rsi + 0x10]
xor r8d, r8d
lea rdx, [rbp + 0x28]
call qword [rax + 0x18]
test eax, eax
js 0x14003f8f5
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x14003f8f5
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
lea r8, [rbp + 0x138]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0
mov r9d, 4
xor r8d, r8d
call qword [rax + VarBstrFromDisp]
test eax, eax
jns 0x14003ea67
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003e9cb
mov rax, qword [rcx]
call qword [rax + 0x10]
xor ebx, ebx
mov qword [rsi + 0x18], rbx
jmp 0x14003e9cd
xor ebx, ebx
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003e9e0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], rbx
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003e9f3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x28], rbx
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003ea06
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], rbx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003ea19
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], rbx
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003ea2c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], rbx
lea rcx, [rsi + 0xa8]
lea rdx, [0x140282c88]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14003ea40
call fcn.1400118e0
mov qword [rsi + 0x44], 0
mov qword [rsi + 0x4c], 0
mov dword [rsi + 0x54], ebx
jmp 0x14003f92c
mov rdi, qword [rbp + 0x138]
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
lea rdx, [rbp + 0x148]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsi + 8]
call qword [rax + VarBstrFromDisp]
test eax, eax
jns 0x14003eb80
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
call qword [rax + 0x78]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003eaff
mov rax, qword [rcx]
call qword [rax + 0x10]
xor ebx, ebx
mov qword [rsi + 0x18], rbx
jmp 0x14003eb01
xor ebx, ebx
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003eb14
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], rbx
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003eb27
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x28], rbx
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003eb3a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], rbx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003eb4d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], rbx
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003eb60
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], rbx
lea rcx, [rsi + 0xa8]
lea rdx, [0x140282c88]
mov r8, r13
inc r8
cmp byte [rdx + r8], 0
jne 0x14003eb71
jmp 0x14003ea4a
mov rax, qword [rbp + 0x148]
mov dword [rax], 0xbf000000
mov dword [rax + 4], 0xbf000000
mov dword [rax + 8], 0x3f000000
mov qword [rax + 0xc], 0x3f800000
xor ecx, ecx
mov dword [rax + 0x14], ecx
movd xmm1, dword [rsi + 0x4c]
cvtdq2ps xmm1, xmm1
movss xmm5, dword [0x1402222c0]
mulss xmm1, xmm5
xorps xmm0, xmm0
subss xmm0, xmm1
movss dword [rdi], xmm0
movd xmm2, dword [rsi + 0x48]
cvtdq2ps xmm2, xmm2
subss xmm2, dword [0x1402228e0]
subss xmm2, xmm5
movss dword [rdi + 4], xmm2
mov dword [rdi + 8], ecx
movd xmm0, dword [rsi + 0x4c]
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm5
divss xmm1, xmm0
addss xmm1, xmm9
movss dword [rdi + 0xc], xmm1
movd xmm0, dword [rsi + 0x48]
cvtdq2ps xmm0, xmm0
movaps xmm2, xmm5
divss xmm2, xmm0
addss xmm2, xmm9
movss dword [rdi + 0x10], xmm2
mov dword [rsi + 0x58], 0xbf000000
mov dword [rsi + 0x68], 0xbf000000
mov dword [rsi + 0x78], ecx
mov dword [rsi + 0x88], ecx
movss dword [rax + 0x18], xmm8
mov dword [rax + 0x1c], 0xbf000000
mov dword [rax + 0x20], 0x3f000000
mov dword [rax + 0x24], 0x3f800000
mov qword [rax + 0x28], 0x3f800000
movaps xmm4, xmm8
addss xmm4, xmm5
movd xmm1, dword [rsi + 0x4c]
cvtdq2ps xmm1, xmm1
mulss xmm1, xmm5
movaps xmm0, xmm4
subss xmm0, xmm1
movss dword [rdi + 0x14], xmm0
movd xmm2, dword [rsi + 0x48]
cvtdq2ps xmm2, xmm2
subss xmm2, dword [0x1402228e0]
subss xmm2, xmm5
movss dword [rdi + 0x18], xmm2
mov dword [rdi + 0x1c], ecx
movd xmm0, dword [rsi + 0x4c]
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm5
divss xmm1, xmm0
addss xmm1, xmm6
movss dword [rdi + 0x20], xmm1
movd xmm0, dword [rsi + 0x48]
cvtdq2ps xmm0, xmm0
movaps xmm2, xmm5
divss xmm2, xmm0
addss xmm2, xmm9
movss dword [rdi + 0x24], xmm2
movss dword [rsi + 0x5c], xmm8
mov dword [rsi + 0x6c], 0xbf000000
mov dword [rsi + 0x7c], 0x3f800000
mov dword [rsi + 0x8c], ecx
mov dword [rax + 0x30], 0xbf000000
movss dword [rax + 0x34], xmm7
mov dword [rax + 0x38], 0x3f000000
mov qword [rax + 0x3c], 0x3f800000
mov dword [rax + 0x44], 0x3f800000
movd xmm1, dword [rsi + 0x4c]
cvtdq2ps xmm1, xmm1
mulss xmm1, xmm5
xorps xmm0, xmm0
subss xmm0, xmm1
movss dword [rdi + 0x28], xmm0
movd xmm2, dword [rsi + 0x48]
cvtdq2ps xmm2, xmm2
subss xmm2, xmm7
subss xmm2, xmm5
movss dword [rdi + 0x2c], xmm2
mov dword [rdi + 0x30], ecx
movd xmm0, dword [rsi + 0x4c]
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm5
divss xmm1, xmm0
addss xmm1, xmm9
movss dword [rdi + 0x34], xmm1
movd xmm0, dword [rsi + 0x48]
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm5
divss xmm1, xmm0
addss xmm1, xmm6
movss dword [rdi + 0x38], xmm1
mov dword [rsi + 0x60], 0xbf000000
movss dword [rsi + 0x70], xmm7
mov dword [rsi + 0x80], ecx
mov dword [rsi + 0x90], 0x3f800000
movss dword [rax + 0x48], xmm8
movss dword [rax + 0x4c], xmm7
mov dword [rax + 0x50], 0x3f000000
mov dword [rax + 0x54], 0x3f800000
mov dword [rax + 0x58], 0x3f800000
mov dword [rax + 0x5c], 0x3f800000
movd xmm0, dword [rsi + 0x4c]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm5
subss xmm4, xmm0
movss dword [rdi + 0x3c], xmm4
movd xmm1, dword [rsi + 0x48]
cvtdq2ps xmm1, xmm1
subss xmm1, xmm7
subss xmm1, xmm5
movss dword [rdi + 0x40], xmm1
mov dword [rdi + 0x44], ecx
movd xmm0, dword [rsi + 0x4c]
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm5
divss xmm1, xmm0
addss xmm1, xmm6
movss dword [rdi + 0x48], xmm1
movd xmm0, dword [rsi + 0x48]
cvtdq2ps xmm0, xmm0
divss xmm5, xmm0
addss xmm5, xmm6
movss dword [rdi + 0x4c], xmm5
movss dword [rsi + 0x64], xmm8
movss dword [rsi + 0x74], xmm7
mov dword [rsi + 0x84], 0x3f800000
mov dword [rsi + 0x94], 0x3f800000
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi + 8]
call qword [rax + 0x78]
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
call qword [rax + 0x78]
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
call qword [rax + 0x378]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003ee64
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edi, edi
mov qword [rsi + 0x18], rdi
jmp 0x14003ee66
xor edi, edi
mov ecx, dword [rsi + 0x48]
mov eax, dword [rsi + 0x4c]
mov dword [rbp + 0x40], eax
mov dword [rbp + 0x44], ecx
mov dword [rbp + 0x48], 1
mov dword [rbp + 0x4c], 1
mov dword [rbp + 0x50], 0x57
mov qword [rbp + 0x54], 1
mov dword [rbp + 0x5c], 2
mov dword [rbp + 0x60], 8
mov qword [rbp + 0x64], 0x10000
mov rcx, qword [r15 + 0xa20]
mov rax, qword [rcx]
lea r9, [rsi + 0x18]
xor r8d, r8d
lea rdx, [rbp + 0x40]
call qword [rax + 0x28]
test eax, eax
jns 0x14003efa7
int3
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003ef09
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x18], rdi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003ef1c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], rdi
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003ef2f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x28], rdi
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003ef42
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], rdi
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003ef55
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], rdi
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003ef68
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], rdi
lea rcx, [rsi + 0xa8]
lea rdx, [0x140282c88]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14003ef80
call fcn.1400118e0
mov qword [rsi + 0x44], 0
mov qword [rsi + 0x4c], 0
mov dword [rsi + 0x54], edi
jmp 0x14003f92c
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x14003eec6
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003efcf
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x28], 0
mov rdx, qword [rsi + 0x18]
lea rbx, [rsi + 0x28]
mov dword [rbp + 0xa8], 0x57
mov qword [rbp + 0xac], 4
mov dword [rbp + 0xb4], 0xffffffff
mov rcx, qword [r15 + 0xa20]
mov rax, qword [rcx]
lea r9, [rsi + 0x28]
lea r8, [rbp + 0xa8]
call qword [rax + 0x38]
test eax, eax
jns 0x14003f065
int3
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsi + 0x18]
mov r14, rbx
test rcx, rcx
je 0x14003f858
mov rax, qword [rcx]
call qword [rax + 0x10]
xor r15d, r15d
mov qword [rsi + 0x18], r15
lea r14, [rsi + 0x28]
jmp 0x14003f85b
cmp qword [rsi + 0x28], 0
je 0x14003f00f
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
call qword [rax + 0x378]
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f093
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], 0
mov ecx, dword [rsi + 0x48]
mov eax, dword [rsi + 0x4c]
mov dword [rbp + 0x6c], eax
mov dword [rbp + 0x70], ecx
mov dword [rbp + 0x74], 1
mov dword [rbp + 0x78], 1
mov dword [rbp + 0x7c], 0x57
mov qword [rbp + 0x80], 1
mov dword [rbp + 0x88], 2
mov dword [rbp + 0x8c], 8
mov qword [rbp + 0x90], 0x10000
mov rcx, qword [r15 + 0xa20]
mov rax, qword [rcx]
lea r9, [rsi + 0x20]
xor r8d, r8d
lea rdx, [rbp + 0x6c]
call qword [rax + 0x28]
test eax, eax
jns 0x14003f152
int3
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsi + 0x18]
lea rdi, [rsi + 0x20]
test rcx, rcx
je 0x14003f7ba
mov rax, qword [rcx]
call qword [rax + 0x10]
xor r14d, r14d
mov qword [rsi + 0x18], r14
lea rdi, [rsi + 0x20]
jmp 0x14003f7bd
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x14003f0fb
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003f176
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], 0
mov rdx, qword [rsi + 0x20]
mov dword [rbp + 0xc0], 0x57
mov qword [rbp + 0xc4], 4
mov dword [rbp + 0xcc], 0xffffffff
mov rcx, qword [r15 + 0xa20]
mov rax, qword [rcx]
lea r9, [rsi + 0x30]
lea r8, [rbp + 0xc0]
call qword [rax + 0x38]
test eax, eax
jns 0x14003f290
int3
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003f1fd
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x18], 0
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f214
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], 0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003f22b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x28], 0
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003f242
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], 0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003f259
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003f270
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], 0
lea rcx, [rsi + 0xa8]
lea rdx, [0x140282c88]
mov r8, r13
inc r8
cmp byte [rdx + r8], 0
jne 0x14003f281
jmp 0x14003f3aa
cmp qword [rsi + 0x30], 0
je 0x14003f1b6
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
lea rdx, [rbp + 0x108]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsi + 0x18]
call qword [rax + VarBstrFromDisp]
test eax, eax
jns 0x14003f3cb
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003f318
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x18], 0
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f32f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], 0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003f346
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x28], 0
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003f35d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], 0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003f374
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003f38b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], 0
lea rcx, [rsi + 0xa8]
lea rdx, [0x140282c88]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14003f3a0
call fcn.1400118e0
mov qword [rsi + 0x44], 0
mov qword [rsi + 0x4c], 0
mov dword [rsi + 0x54], 0
jmp 0x14003f92c
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
lea rdx, [rbp + 0x118]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsi + 0x20]
call qword [rax + VarBstrFromDisp]
test eax, eax
jns 0x14003f4ef
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi + 0x18]
call qword [rax + 0x78]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003f45c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x18], 0
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f473
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], 0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003f48a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x28], 0
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003f4a1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], 0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003f4b8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003f4cf
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], 0
lea rcx, [rsi + 0xa8]
lea rdx, [0x140282c88]
mov r8, r13
inc r8
cmp byte [rdx + r8], 0
jne 0x14003f4e0
jmp 0x14003f3aa
mov r9, qword [rbp + 0x108]
mov qword [rbp - 0x50], r9
mov qword [rbp], r9
mov r10, qword [rbp + 0x118]
mov qword [rbp - 0x40], r10
mov qword [rbp + 8], r10
xor r8d, r8d
mov dword [rsp + 0x78], r8d
mov ecx, dword [rsi + 0x48]
test ecx, ecx
jle 0x14003f6d9
mov edx, dword [rsi + 0x4c]
lea r11d, [r8 + 0xf]
mov r13d, 0xffffffff
nop dword [rax]
movaps xmm6, xmmword [rbp]
xor r15d, r15d
test edx, edx
jle 0x14003f691
movdqa xmm7, xmmword [reloc.OLEAUT32.dll_SysReAllocStringLen]
nop word [rax + rax]
mov eax, edx
imul eax, r8d
add eax, r15d
cdqe
mov r12, qword [rbp + 0x98]
mov ecx, dword [r12 + rax*4]
shr ecx, 4
and cl, 0xf
jbe 0x14003f5a4
add cl, 3
cmp cl, 8
jae 0x14003f589
mov al, 8
movzx edx, al
shl edx, 0x1c
or edx, 0xffffff
jmp 0x14003f64e
movzx eax, cl
cmp cl, 0xf
cmova eax, r11d
movzx edx, al
shl edx, 0x1c
or edx, 0xffffff
jmp 0x14003f64e
cmp byte [rsi + 0xb8], 0
jne 0x14003f5ba
cmp byte [rsi + 0xb9], 0
je 0x14003f641
mov eax, dword [rsi + 0x48]
mov qword [rbp - 0x18], 0
mov dword [rbp - 0x10], edx
mov dword [rbp - 0xc], eax
lea rdi, [0x1402c33d4]
mov r14d, dword [rdi - 4]
add r14d, r15d
mov ebx, dword [rdi]
add ebx, r8d
mov edx, ebx
shl rdx, 0x20
mov eax, r14d
or rdx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x14003f623
imul ebx, dword [rsi + 0x4c]
lea eax, [r14 + rbx]
cdqe
mov ecx, dword [r12 + rax*4]
shr ecx, 4
test cl, 0xf
jbe 0x14003f623
cmp byte [rsi + 0xb8], 0
jne 0x14003f63a
lea rax, [0x1402c33e4]
cmp rdi, rax
jl 0x14003f63a
add rdi, 8
lea rax, [0x1402c33f4]
cmp rdi, rax
jge 0x14003f641
mov r8d, dword [rsp + 0x78]
jmp 0x14003f5d2
mov edx, 0x3fffffff
jmp 0x14003f643
xor edx, edx
mov r8d, dword [rsp + 0x78]
mov r11d, send
movq rax, xmm6
mov dword [rax], edx
shr edx, 0x1c
dec dl
xor ecx, ecx
cmp dl, 6
cmovbe ecx, r13d
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rax, xmm0
mov dword [rax], ecx
paddq xmm6, xmm7
inc r15d
mov edx, dword [rsi + 0x4c]
cmp r15d, edx
jl 0x14003f550
mov ecx, dword [rsi + 0x48]
mov r9, qword [rbp - 0x50]
mov r10, qword [rbp - 0x40]
mov eax, dword [rbp + 0x110]
add r9, rax
mov qword [rbp - 0x50], r9
mov qword [rbp], r9
mov eax, dword [rbp + 0x120]
add r10, rax
mov qword [rbp - 0x40], r10
mov qword [rbp + 8], r10
inc r8d
mov dword [rsp + 0x78], r8d
cmp r8d, ecx
jl 0x14003f530
mov r13, 0xffffffffffffffff
mov r14, qword [rbp + 0xa0]
mov r15, qword [rbp + 0x21e8]
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi + 0x18]
call qword [rax + 0x78]
mov rcx, qword [r15 + 0xa28]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi + 0x20]
call qword [rax + 0x78]
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [rbp + 0x2200]
mov dword [rsi + 0x40], edi
mov r15, qword [rbp + 0x21f0]
mov rdx, qword [r15]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsi + 0xa8]
sub rbx, 0x18
cmp rcx, rbx
je 0x14003f7a5
cmp dword [rbx + 0x10], 0
jl 0x14003f795
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14003f795
call fcn.1400112b0
mov r14, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14003f788
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsi + 0xa8], rax
jmp 0x14003f7a5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsi + 0xa8]
call fcn.1400118e0
xor eax, eax
mov qword [rsi + 0x50], rax
mov rcx, qword [rbp - 0x80]
call sub.gdiplus.dll_GdipDeleteFont
nop
jmp 0x14003f93c
xor r14d, r14d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f7cf
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi], r14
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003f7e2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x28], r14
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003f7f5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], r14
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003f808
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], r14
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003f81b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], r14
lea rcx, [rsi + 0xa8]
lea rdx, [0x140282c88]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14003f830
call fcn.1400118e0
mov qword [rsi + 0x44], 0
mov qword [rsi + 0x4c], 0
mov dword [rsi + 0x54], r14d
jmp 0x14003f92c
xor r15d, r15d
mov rcx, qword [rsi + 0x20]
mov rdi, rbx
test rcx, rcx
je 0x14003f874
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], r15
mov rdi, r14
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003f885
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi], r15
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003f898
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x30], r15
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003f8ab
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], r15
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003f8be
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 8], r15
lea rcx, [rsi + 0xa8]
lea rdx, [0x140282c88]
mov r8, r13
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x14003f8d0
call fcn.1400118e0
mov qword [rsi + 0x44], 0
mov qword [rsi + 0x4c], 0
mov dword [rsi + 0x54], r15d
jmp 0x14003f92c
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rsi
call fcn.14003f9a0
nop
mov rcx, r12
call sub.gdiplus.dll_GdipDeleteFont
nop
mov r15, qword [rbp + 0x21f0]
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14003f958
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r11, [rsp + 0x22a0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140011290
int3