Function at 0x40b2f0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x45b75c
mov eax, dword fs:[0]
push eax
sub esp, 0x608
mov eax, dword [0x4713c0]
xor eax, esp
mov dword [esp + 0x600], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4713c0]
xor eax, esp
push eax
lea eax, [esp + 0x61c]
mov dword fs:[0], eax
xor ebp, ebp
cmp dword [esp + 0x62c], ebp
mov edi, ecx
je 0x40b484
call fcn.00406b70
mov esi, dword [eax + 0x8c]
call fcn.00406b70
push 0x12
push 6
push edi
mov ecx, esi
call fcn.0043aa90
cmp eax, ebp
jne 0x40b4ae
push 0x462c4c
lea eax, [esp + 0x218]
push 0x200
push eax
call fcn.004414db
add esp, 0xc
lea ecx, [esp + 0x1f8]
mov word [esp + 0x612], bp
call fcn.0042bd40
mov dword [esp + 0x624], ebp
mov edi, 7
lea eax, [esp + 0x214]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], bp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40b3b1
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x218]
push ecx
lea esi, [esp + 0x2c]
call fcn.00406f80
mov edx, esi
push ebp
push edx
or eax, 0xffffffff
lea esi, [esp + 0x200]
mov byte [esp + 0x62c], 1
call fcn.00406df0
mov ebx, 8
cmp dword [esp + 0x3c], ebx
jb 0x40b405
mov eax, dword [esp + 0x28]
push eax
call fcn.004415cb
add esp, 4
cmp dword [esp + 0x210], ebx
mov edx, dword [esp + 0x1fc]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], bp
jae 0x40b429
lea edx, [esp + 0x1fc]
mov edi, dword [0x474bb0]
cmp edi, ebp
je 0x40b46b
mov eax, edx
lea esi, [eax + 2]
jmp 0x40b440
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40b440
sub eax, esi
sar eax, 1
push edi
lea ecx, [eax + eax]
push ecx
push 1
push edx
call fcn.004422ed
mov edx, dword [0x474bb0]
push edx
call fcn.004428a9
add esp, 0x14
cmp dword [esp + 0x210], ebx
jb 0x40b484
mov eax, dword [esp + 0x1fc]
push eax
call fcn.004415cb
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x61c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x600]
xor ecx, esp
call fcn.004414cc
add esp, 0x614
ret
fld dword [0x474044]
fmul qword [0x468760]
call fcn.004595f0
cmp eax, 2
mov dword [esp + 0x18], eax
jge 0x40b4d4
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00428530
add esp, 4
push eax
mov ebx, 0x462c64
lea esi, [esp + 0x1e0]
mov dword [esp + 0x628], 2
call fcn.00408960
add esp, 4
mov esi, 8
mov byte [esp + 0x624], 4
cmp dword [esp + 0x3c], esi
jb 0x40b521
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004415cb
add esp, 4
push edi
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], bp
call dword [sym.imp.GDI32.dll_GetTextColor]
push 0xeea946
push edi
mov ebx, eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov dword [esp + 0x44], eax
call fcn.00406b70
mov eax, dword [eax + 0x54]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esp + 0x1f4], esi
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x40], ebp
jae 0x40b58b
lea eax, [esp + 0x1e0]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x1f8]
lea edx, [esp + 0x48]
push edx
push 0x74
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentExPointW]
mov eax, dword [esp + 0x1f0]
cmp eax, 2
jb 0x40b5bc
cmp eax, ebp
jne 0x40b5db
push 2
push 0x462c68
lea esi, [esp + 0x1e4]
call fcn.00406f80
mov eax, dword [esp + 0x1f0]
mov esi, 8
mov edx, dword [esp + 0x1c]
cmp edx, ebp
je 0x40b5e9
cmp dword [esp + 0x20], ebp
jne 0x40b5fc
xor edx, edx
cmp dword [esp + 0x18], 9
setle dl
sub edx, 1
and edx, 0xd
add edx, 0x23
cmp dword [esp + 0x1f4], esi
mov ecx, dword [esp + 0x1e0]
jae 0x40b613
lea ecx, [esp + 0x1e0]
push eax
mov eax, 0x74
sub eax, edx
cdq
sub eax, edx
push ecx
sar eax, 1
push 0x32
add eax, 6
push eax
push edi
call dword [sym.imp.GDI32.dll_TextOutW]
mov edx, dword [esp + 0x44]
push edx
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
push ebx
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x48]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esp + 0x1f4], esi
jb 0x40b667
mov ecx, dword [esp + 0x1e0]
push ecx
call fcn.004415cb
add esp, 4
mov eax, 1
jmp 0x40b486