Function at 0x401940
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x42f600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3f8
push ebx
push ebp
push esi
push edi
push 0
mov dword [esp + 0x414], 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, eax
mov ebp, dword [esp + 0x428]
mov dword [esp + 0x40], eax
mov ebx, dword [esp + 0x424]
fild dword [esp + 0x40]
mov edi, dword [esp + 0x420]
and ebp, 0xff
and ebx, 0xff
mov ecx, ebp
fst qword [esp + 0xfc]
fld qword [0x4311d8]
fdiv st(1)
mov esi, ebx
and ecx, 0x7f
and edi, 0xff
and esi, 0x7f
shl ecx, 8
or esi, ecx
mov edx, edi
shl esi, 8
and edx, 0x7f
lea ecx, [esp + 0x20c]
or esi, edx
push esi
fstp qword [esp + 0x60]
fstp st(0)
call fcn.0042023d
push esi
push 1
push 0
lea ecx, [esp + 0x208]
mov byte [esp + 0x41c], 2
call fcn.00420197
mov esi, ebp
lea ecx, [esp + 0x6c]
shl esi, 8
or esi, ebx
mov byte [esp + 0x410], 3
shl esi, 8
mov eax, esi
or eax, edi
push eax
mov dword [esp + 0x40], eax
call fcn.0042023d
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x34]
push eax
push 1
push 0
mov byte [esp + 0x41c], 4
call fcn.00420197
mov ecx, dword [esp + 0x3c]
push 0
lea edx, [esp + 0x218]
push 0
push edx
mov dword [esp + 0x224], ecx
push 8
push 0x10100
lea ecx, [esp + 0x88]
mov byte [esp + 0x424], 5
mov dword [esp + 0x228], 0
call fcn.004201e7
push 0
lea ecx, [esp + 0x68]
mov byte [esp + 0x414], 6
call fcn.0042023d
push 0
push 1
push 0
lea ecx, [esp + 0x58]
mov byte [esp + 0x41c], 7
call fcn.00420197
mov eax, edi
lea ecx, [esp + 0xc4]
and eax, 0xbf
mov byte [esp + 0x410], 8
push eax
mov dword [esp + 0x28], eax
call fcn.0042023d
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x7c]
push eax
push 1
push 6
mov byte [esp + 0x41c], 9
call fcn.00420197
push edi
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x414], 0xa
call fcn.0042023d
push edi
push 1
push 6
lea ecx, [esp + 0x130]
mov byte [esp + 0x41c], 0xb
call fcn.00420197
mov eax, ebx
lea ecx, [esp + 0xb4]
and eax, 0xbf
mov byte [esp + 0x410], 0xc
mov dword [esp + 0x58], eax
shl eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.0042023d
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x410], 0xd
push ecx
push 1
push 0
lea ecx, [esp + 0xb0]
call fcn.00420197
mov eax, ebx
lea ecx, [esp + 0x1c4]
shl eax, 8
push eax
mov byte [esp + 0x414], 0xe
mov dword [esp + 0x14], eax
call fcn.0042023d
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1b4]
push edx
push 1
push 0
mov byte [esp + 0x41c], 0xf
call fcn.00420197
mov eax, ebp
lea ecx, [esp + 0xd4]
and eax, 0xbf
mov byte [esp + 0x410], 0x10
mov dword [esp + 0x54], eax
shl eax, 0x10
push eax
mov dword [esp + 0x48], eax
call fcn.0042023d
mov byte [esp + 0x410], 0x11
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x94]
push eax
push 1
push 0
call fcn.00420197
mov eax, ebp
lea ecx, [esp + 0x1a4]
shl eax, 0x10
push eax
mov byte [esp + 0x414], 0x12
mov dword [esp + 0x24], eax
call fcn.0042023d
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x410], 0x13
push ecx
push 1
push 0
lea ecx, [esp + 0x1a0]
call fcn.00420197
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
or eax, edx
lea ecx, [esp + 0xe4]
push eax
mov byte [esp + 0x414], 0x14
mov dword [esp + 0x18], eax
call fcn.0042023d
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x84]
push edx
push 1
push 0
mov byte [esp + 0x41c], 0x15
call fcn.00420197
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x184]
or eax, edi
mov byte [esp + 0x410], 0x16
push eax
mov dword [esp + 0x18], eax
call fcn.0042023d
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x174]
push eax
push 1
push 0
mov byte [esp + 0x41c], 0x17
call fcn.00420197
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
shl eax, 8
or eax, ecx
lea ecx, [esp + 0xac]
shl eax, 8
push eax
mov byte [esp + 0x414], 0x18
mov dword [esp + 0x18], eax
call fcn.0042023d
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x410], 0x19
push ecx
push 1
push 0
lea ecx, [esp + 0x98]
call fcn.00420197
push esi
lea ecx, [esp + 0x168]
mov byte [esp + 0x414], 0x1a
call fcn.0042023d
mov byte [esp + 0x410], 0x1b
push esi
push 1
push 0
lea ecx, [esp + 0x160]
call fcn.00420197
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
or esi, eax
lea ecx, [esp + 0x9c]
push esi
mov byte [esp + 0x414], 0x1c
call fcn.0042023d
push esi
push 1
push 0
lea ecx, [esp + 0xc8]
mov byte [esp + 0x41c], 0x1d
call fcn.00420197
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x144]
or esi, edi
mov byte [esp + 0x410], 0x1e
push esi
call fcn.0042023d
push esi
push 1
push 0
lea ecx, [esp + 0x140]
mov byte [esp + 0x41c], 0x1f
call fcn.00420197
mov edx, ebp
mov esi, ebx
and edx, 0x33
and esi, 0x33
shl edx, 8
or esi, edx
mov eax, edi
shl esi, 8
and eax, 0x33
lea ecx, [esp + 0x12c]
or esi, eax
mov byte [esp + 0x410], 0x20
push esi
call fcn.0042023d
push esi
push 1
push 0
lea ecx, [esp + 0x1a8]
mov byte [esp + 0x41c], 0x21
call fcn.00420197
mov ecx, ebp
mov esi, ebx
and ecx, 0x66
and esi, 0x66
shl ecx, 8
or esi, ecx
mov edx, edi
shl esi, 8
and edx, 0x66
lea ecx, [esp + 0x1f4]
or esi, edx
mov byte [esp + 0x410], 0x22
push esi
call fcn.0042023d
push esi
push 1
push 0
lea ecx, [esp + 0x198]
mov byte [esp + 0x41c], 0x23
call fcn.00420197
mov byte [esp + 0x410], 0x24
mov esi, ebx
mov eax, ebp
and esi, 0x99
and eax, 0x99
mov ecx, edi
shl eax, 8
or esi, eax
and ecx, 0x99
shl esi, 8
or esi, ecx
lea ecx, [esp + 0x1cc]
push esi
call fcn.0042023d
push esi
push 1
push 0
lea ecx, [esp + 0x188]
mov byte [esp + 0x41c], 0x25
call fcn.00420197
mov edx, ebp
mov esi, ebx
and edx, 0xcc
and esi, 0xcc
shl edx, 8
or esi, edx
mov eax, edi
shl esi, 8
and eax, 0xcc
lea ecx, [esp + 0x204]
or esi, eax
mov byte [esp + 0x410], 0x26
push esi
call fcn.0042023d
push esi
push 1
push 0
lea ecx, [esp + 0x178]
mov byte [esp + 0x41c], 0x27
call fcn.00420197
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
or esi, edx
lea ecx, [esp + 0xdc]
push esi
mov byte [esp + 0x414], 0x28
call fcn.0042023d
push esi
push 1
push 0
lea ecx, [esp + 0xf8]
mov byte [esp + 0x41c], 0x29
call fcn.00420197
mov esi, ebp
mov ecx, ebx
and esi, 0xa6
and ecx, 0x8e
shl esi, 8
mov eax, edi
or ecx, esi
and eax, 0x59
mov byte [esp + 0x410], 0x2a
shl ecx, 8
or ecx, eax
mov dword [esp + 0x24], eax
push ecx
lea ecx, [esp + 0x120]
call fcn.0042023d
mov eax, ebp
mov ecx, edi
and eax, 0xb0
mov byte [esp + 0x410], 0x2b
shl eax, 8
and ecx, 0x60
mov dword [esp + 0x58], eax
mov dword [esp + 0x10], ecx
mov edx, ebx
and edx, 0x98
or edx, eax
shl edx, 8
or edx, ecx
lea ecx, [esp + 0x10c]
push edx
push 1
push 6
call fcn.00420197
mov eax, ebp
mov ecx, ebx
and eax, 0x59
and ecx, 0xa6
shl eax, 8
mov dword [esp + 0x44], ecx
mov dword [esp + 0x54], eax
or ecx, eax
mov eax, edi
shl ecx, 8
and eax, 0x9e
mov byte [esp + 0x410], 0x2c
or ecx, eax
push ecx
lea ecx, [esp + 0x1c0]
call fcn.0042023d
mov eax, ebp
mov ecx, ebx
and eax, 0x60
and ecx, 0xb0
shl eax, 8
mov dword [esp + 0x14], ecx
or ecx, eax
mov edx, edi
mov byte [esp + 0x410], 0x2d
shl ecx, 8
and edx, 0xa8
mov dword [esp + 0x20], eax
or ecx, edx
push ecx
push 1
push 6
lea ecx, [esp + 0x168]
call fcn.00420197
mov eax, ebx
mov ecx, edi
and eax, 0x59
and ecx, 0x68
mov dword [esp + 0x18], eax
or eax, esi
shl eax, 8
or eax, ecx
lea ecx, [esp + 0x1dc]
push eax
mov byte [esp + 0x414], 0x2e
call fcn.0042023d
mov ecx, dword [esp + 0x58]
mov esi, ebx
and esi, 0x60
mov eax, edi
mov edx, esi
and eax, 0x70
or edx, ecx
lea ecx, [esp + 0x14c]
shl edx, 8
or edx, eax
mov byte [esp + 0x410], 0x2f
push edx
push 1
push 6
call fcn.00420197
mov eax, edi
mov byte [esp + 0x410], 0x30
and eax, 0xa6
mov ecx, ebx
mov dword [esp + 0x58], eax
mov edx, dword [esp + 0x54]
and ecx, 0x71
or ecx, edx
shl ecx, 8
or ecx, eax
push ecx
lea ecx, [esp + 0x108]
call fcn.0042023d
mov ecx, dword [esp + 0x20]
mov edx, ebx
and edx, 0x78
mov eax, edi
or edx, ecx
and eax, 0xb0
shl edx, 8
or edx, eax
lea ecx, [esp + 0x114]
push edx
push 1
push 6
mov byte [esp + 0x41c], 0x31
mov dword [esp + 0x60], eax
call fcn.00420197
mov edx, dword [esp + 0x44]
mov eax, ebp
and eax, 0x8e
lea ecx, [esp + 0x1ac]
shl eax, 8
or eax, edx
mov edx, dword [esp + 0x24]
shl eax, 8
or eax, edx
mov byte [esp + 0x410], 0x32
push eax
call fcn.0042023d
mov eax, dword [esp + 0x14]
mov ecx, ebp
and ecx, 0x98
mov byte [esp + 0x410], 0x33
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
push ecx
push 1
push 6
lea ecx, [esp + 0x148]
call fcn.00420197
mov ecx, dword [esp + 0x18]
mov edx, ebp
and edx, 0x78
mov byte [esp + 0x410], 0x34
shl edx, 8
or edx, ecx
mov ecx, dword [esp + 0x58]
shl edx, 8
or edx, ecx
lea ecx, [esp + 0x1e4]
push edx
call fcn.0042023d
mov eax, ebp
mov edx, dword [esp + 0x54]
and eax, 0x80
lea ecx, [esp + 0x1d4]
shl eax, 8
or eax, esi
mov byte [esp + 0x410], 0x35
shl eax, 8
or eax, edx
push eax
push 1
push 6
call fcn.00420197
mov byte [esp + 0x410], 0x36
push 0
push 1
push 0
lea ecx, [esp + 0x38]
call fcn.00420197
push 0
lea ecx, [esp + 0xf8]
mov byte [esp + 0x414], 0x37
call fcn.0042023d
mov dword [esp + 0xd0], 0
mov dword [esp + 0xcc], 0x431430
push str.Arial
push 0x20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0x9b
mov byte [esp + 0x448], 0x39
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
lea ecx, [esp + 0xd0]
call fcn.0042012a
mov esi, dword [esp + 0x418]
lea ecx, [esp + 0x4c]
push ecx
mov ecx, esi
call fcn.0041f90b
lea edx, [esp + 0x64]
mov ecx, esi
push edx
mov dword [esp + 0x58], eax
call fcn.0041f95e
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x41c]
dec eax
cmp eax, 0xa
ja case.0x4021e8.8
jmp dword [eax*4 + 0x404e0c]
mov ecx, dword [esi + 4]
push 0x95f
push 0xc7f
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
lea edx, [esp + 0x20c]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x1fc]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x938
push 0xc3a
push 0x14
push 0x46
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
mov al, byte [esp + 0x430]
test al, al
je 0x40224f
lea edx, [esp + 0x74]
push edx
jmp 0x402254
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.0041f90b
mov dword [esp + 0x10], 0x46
mov ecx, dword [esp + 0x10]
push 0
lea edx, [esp + 0x3ac]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x10]
push 0x95f
push eax
mov ecx, esi
call fcn.0041fe06
mov eax, dword [esp + 0x10]
add eax, 0xb4
cmp eax, 0xc7f
mov dword [esp + 0x10], eax
jl 0x402263
mov dword [esp + 0x10], 0x14
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x400]
push ecx
push 0
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
push 0xc7f
call fcn.0041fe06
mov eax, dword [esp + 0x10]
add eax, 0xb4
cmp eax, 0x95f
mov dword [esp + 0x10], eax
jl 0x4022a6
lea ecx, [esp + 0x6c]
push ecx
mov ecx, esi
call fcn.0041f95e
lea edx, [esp + 0x34]
mov ecx, esi
push edx
call fcn.0041f90b
mov dword [esp + 0x10], 0xfa
mov ecx, dword [esp + 0x10]
push 0x14
lea eax, [ecx + 0xb4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [esi + 4]
push 0
push ecx
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 4]
push 0x95f
push ecx
push 0x938
push edx
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov eax, dword [esp + 0x10]
add eax, 0x168
cmp eax, 0xb86
mov dword [esp + 0x10], eax
jl 0x402301
mov dword [esp + 0x10], 0xc8
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0xb4]
push eax
push 0x46
push ecx
mov ecx, dword [esi + 4]
push 0
push ecx
mov dword [esp + 0x38], eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push edx
push 0xc7f
push eax
push 0xc3a
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
mov eax, dword [esp + 0x10]
add eax, 0x168
cmp eax, 0x884
mov dword [esp + 0x10], eax
jl 0x402359
mov edx, dword [esi + 4]
push 0x14
push 0x46
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_Rectangle]
mov eax, dword [esi + 4]
push 0
push 0xc7f
push 0x14
push 0xc3a
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov ecx, dword [esi + 4]
push 0x95f
push 0xc7f
push 0x938
push 0xc3a
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
mov edx, dword [esi + 4]
push 0x95f
push 0
push 0x938
push 0x46
push edx
call dword [sym.imp.GDI32.dll_Rectangle]
mov dword [esp + 0x10], 0x8e8
mov eax, dword [esp + 0x10]
add eax, 0xfffffb5a
mov ecx, eax
imul ecx, eax
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
fsubr qword [0x4311e0]
fsqrt
fld qword [0x4311e8]
fsub st(1)
call fcn.00407830
fld st(0)
fsub qword [0x4311f0]
mov dword [esp + 0x14], eax
call fcn.00407830
fcomp qword [0x4311f8]
mov dword [esp + 0x24], eax
fnstsw ax
test ah, 0x41
jne 0x402548
lea edx, [esp + 0x84]
mov ecx, esi
push edx
call fcn.0041f90b
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x31c]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
push 0x640
call fcn.0041fe06
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
push ecx
lea eax, [esp + 0x23c]
push edx
push eax
mov ecx, esi
call fcn.0041fdba
mov ecx, dword [esp + 0x10]
push ecx
push 0x640
mov ecx, esi
call fcn.0041fe06
cmp dword [esp + 0x14], 0x5e6
jge 0x4024d7
mov dword [esp + 0x14], 0x5e6
mov ecx, dword [esp + 0x24]
mov eax, 0x69a
cmp ecx, eax
jle 0x4024e8
mov dword [esp + 0x24], eax
lea edx, [esp + 0x7c]
mov ecx, esi
push edx
call fcn.0041f90b
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x3cc]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
push 0x64a
call fcn.0041fe06
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
push ecx
lea eax, [esp + 0x24c]
push edx
push eax
mov ecx, esi
call fcn.0041fdba
mov ecx, dword [esp + 0x10]
push ecx
push 0x636
mov ecx, esi
call fcn.0041fe06
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x7d0
mov dword [esp + 0x10], eax
jg 0x402411
mov dword [esp + 0x10], 0x7d0
lea edx, [esp + 0x34]
mov ecx, esi
push edx
call fcn.0041f90b
mov ecx, dword [esp + 0x10]
push ecx
lea eax, [ecx - 0x4a6]
mov edx, eax
imul edx, eax
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fsubr qword [0x4311e0]
fsqrt
fstp qword [esp + 0x1c]
fld qword [0x4311e8]
fsub qword [esp + 0x1c]
call fcn.00407830
push eax
lea eax, [esp + 0x330]
push eax
mov ecx, esi
call fcn.0041fdba
fld qword [esp + 0x18]
fsub qword [0x4311f0]
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00407830
push eax
mov ecx, esi
call fcn.0041fe06
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
call fcn.0041f90b
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x258]
push eax
push 0x424
push ecx
mov ecx, esi
call fcn.0041fdba
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
push 0x85c
call fcn.0041fe06
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x71c
mov dword [esp + 0x10], eax
jge 0x402564
mov dword [esp + 0x10], 0x71c
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x4c]
add eax, 0xfffffb5a
push edx
mov ecx, eax
imul ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, esi
fild dword [esp + 0x1c]
fsubr qword [0x4311e0]
fsqrt
fstp qword [esp + 0x1c]
call fcn.0041f90b
fld qword [0x4311e8]
fsub qword [esp + 0x18]
mov eax, dword [esp + 0x10]
push eax
call fcn.00407830
lea ecx, [esp + 0x39c]
push eax
push ecx
mov ecx, esi
call fcn.0041fdba
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
push 0x370
call fcn.0041fe06
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call fcn.0041f90b
fld qword [esp + 0x18]
fsub qword [0x4311f0]
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00407830
lea edx, [esp + 0x26c]
push eax
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
push 0x8fc
call fcn.0041fe06
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x668
mov dword [esp + 0x10], eax
jge 0x402621
lea ecx, [esp + 0x12c]
push ecx
mov ecx, esi
call fcn.0041f95e
lea edx, [esp + 0x19c]
mov ecx, esi
push edx
call fcn.0041f90b
mov eax, dword [esi + 4]
push 0x668
push 0x4d8
push 0x71c
push 0x370
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x71c
lea ecx, [esp + 0x33c]
push 0x370
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x71c
push 0x4d8
mov ecx, esi
call fcn.0041fe06
lea edx, [esp + 0x1f4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x18c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x668
push 0x640
push 0x71c
push 0x4d8
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x71c
lea edx, [esp + 0x27c]
push 0x4d8
push edx
mov ecx, esi
call fcn.0041fdba
push 0x71c
push 0x640
mov ecx, esi
call fcn.0041fe06
lea eax, [esp + 0x1cc]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x17c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x668
push 0x7a8
push 0x71c
push 0x640
push edx
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x71c
lea eax, [esp + 0x3ec]
push 0x640
push eax
mov ecx, esi
call fcn.0041fdba
push 0x71c
push 0x7a8
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0x204]
push ecx
mov ecx, esi
call fcn.0041f95e
lea edx, [esp + 0x16c]
push edx
mov ecx, esi
call fcn.0041f90b
mov eax, dword [esi + 4]
push 0x668
push 0x912
push 0x71c
push 0x7a8
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x71c
lea ecx, [esp + 0x28c]
push 0x7a8
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x71c
push 0x912
mov ecx, esi
call fcn.0041fe06
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
call fcn.0041f90b
mov dword [esp + 0x10], 0x668
mov ecx, dword [esp + 0x10]
push ecx
lea eax, [ecx - 0x4a6]
mov edx, eax
imul edx, eax
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fsubr qword [0x4311e0]
fsqrt
fstp qword [esp + 0x1c]
fld qword [0x4311e8]
fsub qword [esp + 0x1c]
call fcn.00407830
push eax
lea eax, [esp + 0x350]
push eax
mov ecx, esi
call fcn.0041fdba
mov ecx, dword [esp + 0x10]
push ecx
push 0x2c6
mov ecx, esi
call fcn.0041fe06
fld qword [esp + 0x18]
fsub qword [0x4311f0]
mov edx, dword [esp + 0x10]
push edx
call fcn.00407830
push eax
lea eax, [esp + 0x2a0]
push eax
mov ecx, esi
call fcn.0041fdba
mov ecx, dword [esp + 0x10]
push ecx
push 0x9ba
mov ecx, esi
call fcn.0041fe06
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x500
mov dword [esp + 0x10], eax
jg 0x402885
mov dword [esp + 0x10], 0x44c
mov edx, dword [esp + 0x10]
lea eax, [edx - 0x4a6]
lea edx, [esp + 0x84]
mov ecx, eax
push edx
imul ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, esi
fild dword [esp + 0x1c]
fsubr qword [0x4311e0]
fsqrt
fstp qword [esp + 0x1c]
call fcn.0041f90b
fld qword [0x4311e8]
fsub qword [esp + 0x18]
mov eax, dword [esp + 0x10]
push eax
call fcn.00407830
lea ecx, [esp + 0x224]
push eax
push ecx
mov ecx, esi
call fcn.0041fdba
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
push 0x370
call fcn.0041fe06
lea eax, [esp + 0x94]
mov ecx, esi
push eax
call fcn.0041f90b
fld qword [esp + 0x18]
fsub qword [0x4311f0]
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00407830
lea edx, [esp + 0x2ac]
push eax
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
push 0x8fc
call fcn.0041fe06
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x2e4
mov dword [esp + 0x10], eax
jge 0x40292a
lea ecx, [esp + 0xac]
push ecx
mov ecx, esi
call fcn.0041f95e
lea edx, [esp + 0x8c]
mov ecx, esi
push edx
call fcn.0041f90b
mov eax, dword [esi + 4]
push 0x2e4
push 0x4dd
push 0x44c
push 0x370
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x44c
lea ecx, [esp + 0x35c]
push 0x370
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x44c
push 0x4dd
mov ecx, esi
call fcn.0041fe06
lea edx, [esp + 0xb4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0xa4]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x2e4
push 0x645
push 0x44c
push 0x4d8
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x44c
lea edx, [esp + 0x2bc]
push 0x4d8
push edx
mov ecx, esi
call fcn.0041fdba
push 0x44c
push 0x645
mov ecx, esi
call fcn.0041fe06
lea eax, [esp + 0x9c]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0xbc]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x2e4
push 0x7ad
push 0x44c
push 0x640
push edx
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x44c
lea eax, [esp + 0x3dc]
push 0x640
push eax
mov ecx, esi
call fcn.0041fdba
push 0x44c
push 0x7ad
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0xc4]
push ecx
mov ecx, esi
call fcn.0041f95e
lea edx, [esp + 0x7c]
push edx
mov ecx, esi
call fcn.0041f90b
mov eax, dword [esi + 4]
push 0x2e4
push 0x915
push 0x44c
push 0x7a8
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x44c
lea ecx, [esp + 0x2cc]
push 0x7a8
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x44c
push 0x915
mov ecx, esi
call fcn.0041fe06
fld qword [esp + 0xfc]
fmul qword [0x431200]
fmul qword [esp + 0x5c]
call fcn.00407830
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, ecx
shl eax, 3
sub eax, ecx
fild dword [esp + 0x18]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, 0x28f909af
shl edx, 2
imul edx
fstp qword [esp + 0x44]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x28f909af
mov dword [esp + 0x10], edx
mov edx, ecx
shl edx, 5
add edx, ecx
lea edx, [ecx + edx*8]
shl edx, 2
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x10]
cmp eax, edx
mov dword [esp + 0x20], edx
jge 0x402cbd
fild dword [esp + 0x10]
fmul qword [esp + 0x5c]
call fcn.00407830
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [esp + 0x44]
fmul qword [0x431208]
fsub qword [0x431210]
fsin
fsub qword [0x431218]
fmul qword [0x431220]
call fcn.00407830
and eax, 0xff
mov ecx, eax
mov edx, eax
and ecx, ebp
and edx, ebx
shl ecx, 8
or ecx, edx
and eax, edi
shl ecx, 8
or ecx, eax
push ecx
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x30]
call fcn.0042012a
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esp + 0x14]
push 0x668
lea edx, [esp + 0x36c]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x14]
push 0x4f6
push eax
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
lea ecx, [esp + 0x2c]
call fcn.00420181
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x402bf7
fld qword [0x431228]
fsub qword [esp + 0x44]
fmul qword [0x431208]
fsub qword [0x431210]
fstp qword [esp + 0x24]
fld qword [esp + 0xfc]
fmul qword [0x431230]
fmul qword [esp + 0x5c]
call fcn.00407830
mov edx, dword [esp + 0x40]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
lea eax, [edx + edx*8]
mov ecx, dword [esp + 0x20]
shl eax, 3
sub eax, edx
mov dword [esp + 0x10], ecx
fstp qword [esp + 0x44]
lea edx, [eax + eax*4]
mov eax, 0x28f909af
shl edx, 2
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, edx
mov dword [esp + 0x20], edx
jge 0x402df4
fild dword [esp + 0x10]
fmul qword [esp + 0x5c]
call fcn.00407830
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [esp + 0x44]
fmul qword [0x431238]
fadd qword [esp + 0x24]
fsin
fsub qword [0x431218]
fmul qword [0x431220]
call fcn.00407830
and eax, 0xff
mov ecx, eax
mov edx, eax
and ecx, ebp
and edx, ebx
shl ecx, 8
or ecx, edx
and eax, edi
shl ecx, 8
or ecx, eax
push ecx
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x30]
call fcn.0042012a
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esp + 0x14]
push 0x668
lea edx, [esp + 0x2dc]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x14]
push 0x4f6
push eax
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
lea ecx, [esp + 0x2c]
call fcn.00420181
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x402d30
fld qword [0x431240]
fsub qword [esp + 0x44]
fmul qword [0x431238]
fadd qword [esp + 0x24]
fstp qword [esp + 0x24]
fld qword [esp + 0xfc]
fmul qword [0x431248]
fmul qword [esp + 0x5c]
call fcn.00407830
mov edx, dword [esp + 0x40]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
lea eax, [edx + edx*4]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
lea eax, [eax + eax*8]
shl eax, 1
sub eax, edx
fstp qword [esp + 0x44]
lea edx, [eax + eax*4]
mov eax, 0x28f909af
shl edx, 2
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, edx
mov dword [esp + 0x20], edx
jge 0x402f2b
fild dword [esp + 0x10]
fmul qword [esp + 0x5c]
call fcn.00407830
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [esp + 0x44]
fmul qword [0x431250]
fadd qword [esp + 0x24]
fsin
fsub qword [0x431218]
fmul qword [0x431220]
call fcn.00407830
and eax, 0xff
mov ecx, eax
mov edx, eax
and ecx, ebp
and edx, ebx
shl ecx, 8
or ecx, edx
and eax, edi
shl ecx, 8
or ecx, eax
push ecx
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x30]
call fcn.0042012a
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esp + 0x14]
push 0x668
lea edx, [esp + 0x3bc]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x14]
push 0x4f6
push eax
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
lea ecx, [esp + 0x2c]
call fcn.00420181
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x402e67
fld qword [0x431258]
fsub qword [esp + 0x44]
fmul qword [0x431250]
fadd qword [esp + 0x24]
fstp qword [esp + 0x24]
fld qword [esp + 0xfc]
fmul qword [0x431260]
fmul qword [esp + 0x5c]
call fcn.00407830
mov edx, dword [esp + 0x40]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
lea eax, [edx + edx*2]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
lea eax, [eax + eax*8]
shl eax, 2
sub eax, edx
fstp qword [esp + 0x44]
lea edx, [eax + eax*4]
mov eax, 0x28f909af
shl edx, 2
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, edx
mov dword [esp + 0x20], edx
jge 0x403063
fild dword [esp + 0x10]
fmul qword [esp + 0x5c]
call fcn.00407830
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [esp + 0x44]
fmul qword [0x431268]
fadd qword [esp + 0x24]
fsin
fsub qword [0x431218]
fmul qword [0x431220]
call fcn.00407830
and eax, 0xff
mov ecx, eax
mov edx, eax
and ecx, ebp
and edx, ebx
shl ecx, 8
or ecx, edx
and eax, edi
shl ecx, 8
or ecx, eax
push ecx
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x30]
call fcn.0042012a
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esp + 0x14]
push 0x668
lea edx, [esp + 0x2ec]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x14]
push 0x4f6
push eax
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
lea ecx, [esp + 0x2c]
call fcn.00420181
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x402f9f
fld qword [0x431270]
fsub qword [esp + 0x44]
fmul qword [0x431268]
fadd qword [esp + 0x24]
fstp qword [esp + 0x24]
fld qword [esp + 0xfc]
fmul qword [0x431278]
fmul qword [esp + 0x5c]
call fcn.00407830
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x40]
fild dword [esp + 0x18]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
lea eax, [eax + eax*4]
fstp qword [esp + 0x44]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, 0x28f909af
shl edx, 2
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, edx
mov dword [esp + 0x18], edx
jge 0x403199
fild dword [esp + 0x10]
fmul qword [esp + 0x5c]
call fcn.00407830
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [esp + 0x44]
fmul qword [0x431280]
fadd qword [esp + 0x24]
fsin
fsub qword [0x431218]
fmul qword [0x431220]
call fcn.00407830
and eax, 0xff
mov ecx, eax
mov edx, eax
and ecx, ebp
and edx, ebx
shl ecx, 8
or ecx, edx
and eax, edi
shl ecx, 8
or ecx, eax
push ecx
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x30]
call fcn.0042012a
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esp + 0x14]
push 0x668
lea edx, [esp + 0x37c]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x14]
push 0x4f6
push eax
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
lea ecx, [esp + 0x2c]
call fcn.00420181
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x4030d5
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
call fcn.0041f90b
mov edi, 0x500
lea eax, [edi - 0x4a6]
push edi
mov ecx, eax
imul ecx, eax
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
fsubr qword [0x4311e0]
fsqrt
fstp qword [esp + 0x1c]
fld qword [0x4311e8]
fsub qword [esp + 0x1c]
call fcn.00407830
lea edx, [esp + 0x2fc]
push eax
push edx
mov ecx, esi
call fcn.0041fdba
push edi
push 0x640
mov ecx, esi
call fcn.0041fe06
fld qword [esp + 0x18]
fsub qword [0x4311f0]
push edi
call fcn.00407830
push eax
lea eax, [esp + 0x400]
push eax
mov ecx, esi
call fcn.0041fdba
push edi
push 0x640
mov ecx, esi
call fcn.0041fe06
dec edi
cmp edi, 0x44c
jge 0x4031aa
lea ecx, [esp + 0x64]
push ecx
mov ecx, esi
call fcn.0041f95e
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
call fcn.0041f90b
mov eax, dword [esi + 4]
mov ebx, dword [sym.imp.GDI32.dll_Rectangle]
push 0x5b4
push 0x69a
push 0x398
push 0x5ea
push eax
call ebx
push 0x5b4
lea ecx, [esp + 0x30c]
push 0x5ea
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x5b4
push 0x69a
mov ecx, esi
call fcn.0041fe06
mov al, byte [esp + 0x430]
test al, al
je 0x4032a4
lea edx, [esp + 0x74]
push edx
jmp 0x4032a9
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.0041f90b
push 0x4a6
lea ecx, [esp + 0x38c]
push 0x208
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x4a6
push 0x640
mov ecx, esi
call fcn.0041fe06
push 0x4a6
lea edx, [esp + 0x22c]
push 0xa78
push edx
mov ecx, esi
call fcn.0041fdba
push 0x4a6
push 0x640
mov ecx, esi
call fcn.0041fe06
mov al, byte [esp + 0x430]
test al, al
je 0x403359
push 0x39c
lea eax, [esp + 0x234]
push 0x640
push eax
mov ecx, esi
call fcn.0041fdba
push 0x4a6
push 0x640
mov ecx, esi
call fcn.0041fe06
push 0x5b0
lea ecx, [esp + 0x244]
push 0x640
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x4a6
jmp 0x4033a1
push 0x398
lea edx, [esp + 0x254]
push 0x640
push edx
mov ecx, esi
call fcn.0041fdba
push 0x4b0
push 0x640
mov ecx, esi
call fcn.0041fe06
push 0x5b4
lea eax, [esp + 0x264]
push 0x640
push eax
mov ecx, esi
call fcn.0041fdba
push 0x49c
push 0x640
mov ecx, esi
call fcn.0041fe06
mov edi, 0x262
mov al, byte [esp + 0x430]
test al, al
je 0x4033ef
push 0x450
lea ecx, [esp + 0x274]
push edi
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x4a6
push edi
mov ecx, esi
call fcn.0041fe06
push 0x4fc
lea edx, [esp + 0x284]
push edi
push edx
jmp 0x40341f
push 0x44c
lea eax, [esp + 0x294]
push edi
push eax
mov ecx, esi
call fcn.0041fdba
push 0x4a6
push edi
mov ecx, esi
call fcn.0041fe06
push 0x500
lea ecx, [esp + 0x2a4]
push edi
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x4a6
push edi
mov ecx, esi
call fcn.0041fe06
add edi, 0xb4
cmp edi, 0xa28
jl 0x4033b2
mov edi, 0x2e4
lea eax, [edi - 0x4a6]
mov edx, eax
imul edx, eax
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
fsubr qword [0x4311e0]
fsqrt
fld qword [0x4311e8]
fsub st(1)
call fcn.00407830
fsub qword [0x4311f0]
mov dword [esp + 0x14], eax
call fcn.00407830
mov ebp, eax
lea eax, [esp + 0xdc]
push eax
mov ecx, esi
call fcn.0041f95e
lea ecx, [esp + 0xec]
push ecx
mov ecx, esi
call fcn.0041f90b
push edi
lea edx, [esp + 0x2b4]
push ebp
push edx
mov ecx, esi
call fcn.0041fdba
push edi
push 0x99c
mov ecx, esi
call fcn.0041fe06
cmp ebp, 0x9b0
jle 0x4034cc
mov ebp, 0x9b0
lea eax, [esp + 0x4c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esp + 0x14]
push edi
lea edx, [esp + 0x2c4]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
push edi
push 0x910
mov ecx, esi
call fcn.0041fe06
push edi
lea eax, [esp + 0x2d4]
push ebp
push eax
mov ecx, esi
call fcn.0041fdba
push edi
push 0x910
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0xdc]
push ecx
mov ecx, esi
call fcn.0041f95e
lea edx, [esp + 0xec]
mov ecx, esi
push edx
call fcn.0041f90b
dec edi
cmp edi, 0x230
jge 0x40344a
mov edi, 0x2e4
mov eax, dword [esi + 4]
lea ebp, [edi + 0x73]
push 0x230
push ebp
push 0x2e4
push edi
push eax
call ebx
push 0x2e4
lea ecx, [esp + 0x2e4]
push edi
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x2e4
push ebp
mov ecx, esi
call fcn.0041fe06
add edi, 0xfa
cmp edi, 0x96a
jl 0x403548
mov edi, 0x230
lea eax, [edi - 0x4a6]
mov ecx, esi
mov edx, eax
imul edx, eax
mov dword [esp + 0x18], edx
lea eax, [esp + 0x4c]
fild dword [esp + 0x18]
push eax
fsubr qword [0x4311e0]
fsqrt
fstp qword [esp + 0x1c]
call fcn.0041f90b
fld qword [0x4311e8]
fsub qword [esp + 0x18]
push edi
call fcn.00407830
lea ecx, [esp + 0x2f4]
push eax
push ecx
mov ecx, esi
call fcn.0041fdba
push edi
push 0x42e
mov ecx, esi
call fcn.0041fe06
fld qword [esp + 0x18]
fsub qword [0x4311f0]
push edi
call fcn.00407830
lea edx, [esp + 0x304]
push eax
push edx
mov ecx, esi
call fcn.0041fdba
push edi
push 0x834
mov ecx, esi
call fcn.0041fe06
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call fcn.0041f90b
push edi
lea ecx, [esp + 0x314]
push 0x424
push ecx
mov ecx, esi
call fcn.0041fdba
push edi
push 0x85c
mov ecx, esi
call fcn.0041fe06
dec edi
cmp edi, 0x17c
jg 0x403592
lea edx, [esp + 0x64]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x4c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x230
push 0x48d
push 0x17c
push 0x47e
push ecx
call ebx
push 0x230
lea edx, [esp + 0x324]
push 0x47e
push edx
mov ecx, esi
call fcn.0041fdba
push 0x230
push 0x48d
mov ecx, esi
call fcn.0041fe06
mov edi, 0x17c
lea eax, [edi - 0x4a6]
lea edx, [esp + 0x34]
mov ecx, eax
push edx
imul ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, esi
fild dword [esp + 0x1c]
fsubr qword [0x4311e0]
fsqrt
fstp qword [esp + 0x1c]
call fcn.0041f90b
fld qword [0x4311e8]
fsub qword [esp + 0x18]
push edi
call fcn.00407830
push eax
lea eax, [esp + 0x338]
push eax
mov ecx, esi
call fcn.0041fdba
push edi
push 0x4ec
mov ecx, esi
call fcn.0041fe06
fld qword [esp + 0x18]
fsub qword [0x4311f0]
push edi
call fcn.00407830
lea ecx, [esp + 0x344]
push eax
push ecx
mov ecx, esi
call fcn.0041fdba
push edi
push 0x794
mov ecx, esi
call fcn.0041fe06
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
call fcn.0041f90b
push edi
lea eax, [esp + 0x354]
push 0x4d8
push eax
mov ecx, esi
call fcn.0041fdba
push edi
push 0x7a8
mov ecx, esi
call fcn.0041fe06
dec edi
cmp edi, 0xc8
jg 0x4036b3
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edi, 0xc8
lea eax, [edi - 0x4a6]
mov edx, eax
imul edx, eax
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
fsubr qword [0x4311e0]
fsqrt
fld qword [0x4311e8]
fsub st(1)
call fcn.00407830
fld st(0)
fsub qword [0x4311f0]
mov ebp, eax
call fcn.00407830
fcomp qword [0x431288]
mov dword [esp + 0x24], eax
fnstsw ax
test ah, 0x41
jne 0x40380c
push edi
lea eax, [esp + 0x364]
push ebp
push eax
mov ecx, esi
call fcn.0041fdba
push edi
push 0x644
mov ecx, esi
call fcn.0041fe06
mov ecx, dword [esp + 0x24]
push edi
lea edx, [esp + 0x374]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
push edi
push 0x63c
mov ecx, esi
call fcn.0041fe06
dec edi
cmp edi, 0x6c
jg 0x403784
lea eax, [esp + 0x11c]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x10c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x230
push 0x262
push 0xc8
push 0x1a4
push edx
call ebx
lea eax, [esp + 0x1ac]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x13c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x4a6
push 0x1ae
push 0xc8
push 0xfa
push edx
call ebx
lea eax, [esp + 0x104]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x114]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x884
push 0x262
push 0x71c
push 0x1a4
push edx
call ebx
lea eax, [esp + 0x1e4]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x1d4]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x884
push 0x1ae
push 0x4a6
push 0xfa
push edx
call ebx
lea eax, [esp + 0x11c]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x10c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x230
push 0xadc
push 0xc8
push 0xa1e
push edx
call ebx
lea eax, [esp + 0x1bc]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x15c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x4a6
push 0xb86
push 0xc8
push 0xad2
push edx
call ebx
lea eax, [esp + 0x104]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x114]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x884
push 0xadc
push 0x71c
push 0xa1e
push edx
call ebx
lea eax, [esp + 0x1dc]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x14c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x884
push 0xb86
push 0x4a6
push 0xad2
push edx
call ebx
mov al, byte [esp + 0x430]
test al, al
je 0x4039e8
lea eax, [esp + 0x74]
push eax
jmp 0x4039ed
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
push 0xc8
lea edx, [esp + 0x384]
push 0xfa
push edx
mov ecx, esi
call fcn.0041fdba
push 0xc8
push 0x262
mov ecx, esi
call fcn.0041fe06
push 0x230
push 0x262
mov ecx, esi
call fcn.0041fe06
push 0x230
push 0x1ae
mov ecx, esi
call fcn.0041fe06
push 0x71c
push 0x1ae
mov ecx, esi
call fcn.0041fe06
push 0x71c
push 0x262
mov ecx, esi
call fcn.0041fe06
push 0x884
push 0x262
mov ecx, esi
call fcn.0041fe06
push 0x884
push 0xfa
mov ecx, esi
call fcn.0041fe06
push 0xc8
push 0xfa
mov ecx, esi
call fcn.0041fe06
push 0xc8
lea eax, [esp + 0x394]
push 0xa1e
push eax
mov ecx, esi
call fcn.0041fdba
push 0xc8
push 0xb86
mov ecx, esi
call fcn.0041fe06
push 0x884
push 0xb86
mov ecx, esi
call fcn.0041fe06
push 0x884
push 0xa1e
mov ecx, esi
call fcn.0041fe06
push 0x71c
push 0xa1e
mov ecx, esi
call fcn.0041fe06
push 0x71c
push 0xad2
mov ecx, esi
call fcn.0041fe06
push 0x230
push 0xad2
mov ecx, esi
call fcn.0041fe06
push 0x230
push 0xa1e
mov ecx, esi
call fcn.0041fe06
push 0xc8
push 0xa1e
mov ecx, esi
call fcn.0041fe06
mov edi, dword [esi]
lea ecx, [esp + 0xcc]
push ecx
mov ecx, esi
call dword [edi + 0x30]
mov edx, dword [esp + 0x3c]
mov ecx, esi
push edx
call dword [edi + 0x38]
push 0
mov ecx, esi
call dword [edi + 0x34]
cmp byte [esp + 0x42c], 1
jne case.0x4021e8.8
mov eax, dword [esp + 0x434]
mov edi, dword [edi + 0x64]
mov ecx, dword [eax - 8]
push ecx
push eax
push 0xd7
push 0x4f6
mov ecx, esi
call edi
mov eax, dword [esp + 0x438]
mov ecx, esi
mov edx, dword [eax - 8]
push edx
push eax
push 0x72b
push 0x442
call edi
jmp case.0x4021e8.8
mov eax, dword [esi + 4]
push 0x95f
push 0xc7f
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov al, byte [esp + 0x430]
test al, al
je 0x403bca
lea ecx, [esp + 0x74]
push ecx
jmp 0x403bcf
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.0041f90b
mov edi, 0x46
push 0
lea eax, [esp + 0x3a4]
push edi
push eax
mov ecx, esi
call fcn.0041fdba
push 0x95f
push edi
mov ecx, esi
call fcn.0041fe06
add edi, 0xb4
cmp edi, 0xc7f
jl 0x403bdb
mov edi, 0x14
push edi
lea ecx, [esp + 0x3b4]
push 0
push ecx
mov ecx, esi
call fcn.0041fdba
push edi
push 0xc7f
mov ecx, esi
call fcn.0041fe06
add edi, 0xb4
cmp edi, 0x95f
jl 0x403c0d
jmp case.0x4021e8.8
lea edx, [esp + 0x6c]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_Rectangle]
push 0x95f
push 0x190
push 0
push 0
push ecx
call edi
lea edx, [esp + 0xe4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x84]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x95f
push 0x320
push 0
push 0x190
push ecx
call edi
lea edx, [esp + 0xac]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x8c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x95f
push 0x4b0
push 0
push 0x320
push ecx
call edi
lea edx, [esp + 0xb4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0xa4]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x95f
push 0x640
push 0
push 0x4b0
push ecx
call edi
lea edx, [esp + 0x9c]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0xbc]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x95f
push 0x7d0
push 0
push 0x640
push ecx
call edi
lea edx, [esp + 0xc4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x7c]
push eax
mov ecx, esi
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x95f
push 0x960
push 0
push 0x7d0
push ecx
call edi
lea edx, [esp + 0xd4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x94]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x95f
push 0xaf0
push 0
push 0x960
push ecx
call edi
lea edx, [esp + 0x64]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x4c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x95f
push 0xc7f
push 0
push 0xaf0
push ecx
jmp 0x404671
lea edx, [esp + 0x6c]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_Rectangle]
push 0x4b0
push 0x190
push 0
push 0
push ecx
call edi
lea edx, [esp + 0xe4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x84]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x4b0
push 0x320
push 0
push 0x190
push ecx
call edi
lea edx, [esp + 0xac]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x8c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x4b0
push 0x4b0
push 0
push 0x320
push ecx
call edi
lea edx, [esp + 0xb4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0xa4]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x4b0
push 0x640
push 0
push 0x4b0
push ecx
call edi
lea edx, [esp + 0x9c]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0xbc]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x4b0
push 0x7d0
push 0
push 0x640
push ecx
call edi
lea edx, [esp + 0xd4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x94]
push eax
mov ecx, esi
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x4b0
push 0xaf0
push 0
push 0x960
push ecx
call edi
lea edx, [esp + 0x64]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x4c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x4b0
push 0xc7f
push 0
push 0xaf0
push ecx
call edi
lea edx, [esp + 0xc4]
mov ecx, esi
push edx
call fcn.0041f95e
lea eax, [esp + 0x7c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esi + 4]
push 0x4b0
push 0x960
push 0
push 0x7d0
push ecx
call edi
push 0x95f
push 0xc7f
push 0x4b0
push 0
jmp 0x40466d
mov eax, dword [esi + 4]
push 0x95f
push 0xc7f
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov al, byte [esp + 0x430]
test al, al
je 0x403fba
lea ecx, [esp + 0x74]
push ecx
jmp 0x403fbf
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.0041f90b
mov eax, dword [esi + 4]
push 0x8f2
push 0xa82
push 0x6e
push 0x1fe
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov edi, 0x46
push 0
lea ecx, [esp + 0x3c4]
push edi
push ecx
mov ecx, esi
call fcn.0041fdba
push 0x95f
push edi
mov ecx, esi
call fcn.0041fe06
add edi, 0xb4
cmp edi, 0xc7f
jl 0x403fe6
mov edi, 0x14
push edi
lea edx, [esp + 0x3d4]
push 0
push edx
mov ecx, esi
call fcn.0041fdba
push edi
push 0xc7f
mov ecx, esi
call fcn.0041fe06
add edi, 0xb4
cmp edi, 0x95f
jl 0x404018
jmp case.0x4021e8.8
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], 0
test eax, eax
jle case.0x4021e8.8
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x3c]
cdq
fild dword [esp + 0x10]
idiv dword [esp + 0x40]
fmul qword [esp + 0x5c]
mov dword [esp + 0x18], eax
call fcn.00407830
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
and eax, 0xff
mov ecx, eax
mov edx, eax
and ecx, ebp
and edx, ebx
shl ecx, 8
or ecx, edx
and eax, edi
shl ecx, 8
or ecx, eax
push ecx
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x30]
call fcn.0042012a
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.0041f90b
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x3e4]
push ecx
push edx
mov ecx, esi
call fcn.0041fdba
mov eax, dword [esp + 0x14]
push 0x95f
push eax
mov ecx, esi
call fcn.0041fe06
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
lea ecx, [esp + 0x2c]
call fcn.00420181
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
inc eax
add edx, 0x100
cmp eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x3c], edx
jl 0x404066
jmp case.0x4021e8.8
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], 0
test eax, eax
jle case.0x4021e8.8
fild dword [esp + 0x10]
fmul qword [esp + 0x5c]
call fcn.00407830
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fld st(0)
fmul qword [0x431290]
fmul qword [0x431298]
fsub qword [0x4312a0]
fmulp st(1)
fmul qword [0x4312a8]
fsin
fsub qword [0x431218]
fmul qword [0x431220]
call fcn.00407830
and eax, 0xff
mov edx, eax
mov ecx, eax
and edx, ebp
and ecx, ebx
shl edx, 8
or edx, ecx
and eax, edi
shl edx, 8
or edx, eax
push edx
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x30]
call fcn.0042012a
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
call fcn.0041f90b
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x3f4]
push eax
push ecx
mov ecx, esi
call fcn.0041fdba
mov edx, dword [esp + 0x14]
push 0x95f
push edx
mov ecx, esi
call fcn.0041fe06
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call fcn.0041f90b
lea ecx, [esp + 0x2c]
call fcn.00420181
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x40]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x40413a
jmp case.0x4021e8.8
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x3c], eax
mov eax, 0x2d0abb8f
imul dword [esp + 0x3c]
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
and edx, 0xff
mov eax, edx
mov ecx, edx
and eax, ebp
and ecx, ebx
shl eax, 8
or eax, ecx
and edx, edi
shl eax, 8
or eax, edx
push eax
push 1
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x30]
call fcn.0042012a
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
call fcn.0041f90b
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0xf8]
call fcn.0042012a
lea ecx, [esp + 0xf4]
push ecx
mov ecx, esi
call fcn.0041f95e
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 4]
push 0x95f
lea eax, [ecx + 0x123]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_Rectangle]
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call fcn.0041f90b
lea ecx, [esp + 0x6c]
push ecx
mov ecx, esi
call fcn.0041f95e
lea ecx, [esp + 0x2c]
call fcn.00420181
lea ecx, [esp + 0xf4]
call fcn.00420181
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x18]
add eax, 0x121dd
mov dword [esp + 0x10], edx
cmp eax, 0xc7380
mov dword [esp + 0x3c], eax
jl 0x404218
jmp case.0x4021e8.8
lea eax, [esp + 0x6c]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_Rectangle]
push 0x95f
push 0x190
push 0
push 0
push edx
call edi
lea eax, [esp + 0xe4]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x84]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x320
push 0
push 0x190
push edx
call edi
lea eax, [esp + 0xac]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x8c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x4b0
push 0
push 0x320
push edx
call edi
lea eax, [esp + 0xb4]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0xa4]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x640
push 0
push 0x4b0
push edx
call edi
lea eax, [esp + 0x9c]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0xbc]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x7d0
push 0
push 0x640
push edx
call edi
lea eax, [esp + 0xc4]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x7c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x960
push 0
push 0x7d0
push edx
call edi
lea eax, [esp + 0xd4]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x94]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0xaf0
push 0
push 0x960
push edx
call edi
lea eax, [esp + 0x64]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x4c]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0xc7f
push 0
push 0xaf0
push edx
call edi
lea eax, [esp + 0xdc]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0xec]
push ecx
mov ecx, esi
call fcn.0041f90b
push 0x190
push 0xc7f
push 0
push 0x190
jmp 0x40466d
lea eax, [esp + 0x6c]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_Rectangle]
push 0x95f
push 0x190
push 0
push 0
push edx
call edi
lea eax, [esp + 0x184]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x174]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x320
push 0
push 0x190
push edx
call edi
lea eax, [esp + 0x164]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x154]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x4b0
push 0
push 0x320
push edx
call edi
lea eax, [esp + 0x1c4]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x1b4]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x640
push 0
push 0x4b0
push edx
call edi
lea eax, [esp + 0x144]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x134]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x7d0
push 0
push 0x640
push edx
call edi
lea eax, [esp + 0x1ec]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x124]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0x960
push 0
push 0x7d0
push edx
call edi
lea eax, [esp + 0x1a4]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x194]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edx, dword [esi + 4]
push 0x95f
push 0xaf0
push 0
push 0x960
push edx
call edi
lea eax, [esp + 0x64]
mov ecx, esi
push eax
call fcn.0041f95e
lea ecx, [esp + 0x4c]
push ecx
mov ecx, esi
call fcn.0041f90b
push 0x95f
push 0xc7f
push 0
push 0xaf0
mov edx, dword [esi + 4]
push edx
call edi
mov eax, dword [esp + 0x58]
mov ecx, esi
push eax
call fcn.0041f95e
mov ecx, dword [esp + 0x54]
push ecx
mov ecx, esi
call fcn.0041f90b
mov edi, vtable.CGdiObject.0
mov dword [esp + 0xcc], edi
lea ecx, [esp + 0xcc]
mov byte [esp + 0x410], 0x3a
call fcn.00420181
mov esi, vtable.CObject.0
mov dword [esp + 0xf4], edi
mov dword [esp + 0xcc], esi
lea ecx, [esp + 0xf4]
mov byte [esp + 0x410], 0x3b
call fcn.00420181
mov dword [esp + 0xf4], esi
mov dword [esp + 0x2c], edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x410], 0x3c
call fcn.00420181
mov dword [esp + 0x2c], esi
mov dword [esp + 0x1d4], edi
lea ecx, [esp + 0x1d4]
mov byte [esp + 0x410], 0x3d
call fcn.00420181
mov dword [esp + 0x1d4], esi
mov dword [esp + 0x1e4], edi
lea ecx, [esp + 0x1e4]
mov byte [esp + 0x410], 0x3e
call fcn.00420181
mov dword [esp + 0x1e4], esi
mov dword [esp + 0x13c], edi
lea ecx, [esp + 0x13c]
mov byte [esp + 0x410], 0x3f
call fcn.00420181
mov dword [esp + 0x13c], esi
mov dword [esp + 0x1ac], edi
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x410], 0x40
call fcn.00420181
mov dword [esp + 0x1ac], esi
mov dword [esp + 0x114], edi
lea ecx, [esp + 0x114]
mov byte [esp + 0x410], 0x41
call fcn.00420181
mov dword [esp + 0x114], esi
mov dword [esp + 0x104], edi
lea ecx, [esp + 0x104]
mov byte [esp + 0x410], 0x42
call fcn.00420181
mov dword [esp + 0x104], esi
mov dword [esp + 0x14c], edi
lea ecx, [esp + 0x14c]
mov byte [esp + 0x410], 0x43
call fcn.00420181
mov dword [esp + 0x14c], esi
mov dword [esp + 0x1dc], edi
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x410], 0x44
call fcn.00420181
mov dword [esp + 0x1dc], esi
mov dword [esp + 0x15c], edi
lea ecx, [esp + 0x15c]
mov byte [esp + 0x410], 0x45
call fcn.00420181
mov dword [esp + 0x15c], esi
mov dword [esp + 0x1bc], edi
lea ecx, [esp + 0x1bc]
mov byte [esp + 0x410], 0x46
call fcn.00420181
mov dword [esp + 0x1bc], esi
mov dword [esp + 0x10c], edi
lea ecx, [esp + 0x10c]
mov byte [esp + 0x410], 0x47
call fcn.00420181
mov dword [esp + 0x10c], esi
mov dword [esp + 0x11c], edi
lea ecx, [esp + 0x11c]
mov byte [esp + 0x410], 0x48
call fcn.00420181
mov dword [esp + 0x11c], esi
mov dword [esp + 0xec], edi
lea ecx, [esp + 0xec]
mov byte [esp + 0x410], 0x49
call fcn.00420181
mov dword [esp + 0xec], esi
mov dword [esp + 0xdc], edi
lea ecx, [esp + 0xdc]
mov byte [esp + 0x410], 0x4a
call fcn.00420181
mov dword [esp + 0xdc], esi
mov dword [esp + 0x16c], edi
lea ecx, [esp + 0x16c]
mov byte [esp + 0x410], 0x4b
call fcn.00420181
mov dword [esp + 0x16c], esi
mov dword [esp + 0x204], edi
lea ecx, [esp + 0x204]
mov byte [esp + 0x410], 0x4c
call fcn.00420181
mov dword [esp + 0x204], esi
mov dword [esp + 0x17c], edi
lea ecx, [esp + 0x17c]
mov byte [esp + 0x410], 0x4d
call fcn.00420181
mov dword [esp + 0x17c], esi
mov dword [esp + 0x1cc], edi
lea ecx, [esp + 0x1cc]
mov byte [esp + 0x410], 0x4e
call fcn.00420181
mov dword [esp + 0x1cc], esi
mov dword [esp + 0x18c], edi
lea ecx, [esp + 0x18c]
mov byte [esp + 0x410], 0x4f
call fcn.00420181
mov dword [esp + 0x18c], esi
mov dword [esp + 0x1f4], edi
lea ecx, [esp + 0x1f4]
mov byte [esp + 0x410], 0x50
call fcn.00420181
mov dword [esp + 0x1f4], esi
mov dword [esp + 0x19c], edi
lea ecx, [esp + 0x19c]
mov byte [esp + 0x410], 0x51
call fcn.00420181
mov dword [esp + 0x19c], esi
mov dword [esp + 0x12c], edi
lea ecx, [esp + 0x12c]
mov byte [esp + 0x410], 0x52
call fcn.00420181
mov dword [esp + 0x12c], esi
mov dword [esp + 0x134], edi
lea ecx, [esp + 0x134]
mov byte [esp + 0x410], 0x53
call fcn.00420181
mov dword [esp + 0x134], esi
mov dword [esp + 0x144], edi
lea ecx, [esp + 0x144]
mov byte [esp + 0x410], 0x54
call fcn.00420181
mov dword [esp + 0x144], esi
mov dword [esp + 0xbc], edi
lea ecx, [esp + 0xbc]
mov byte [esp + 0x410], 0x55
call fcn.00420181
mov dword [esp + 0xbc], esi
mov dword [esp + 0x9c], edi
lea ecx, [esp + 0x9c]
mov byte [esp + 0x410], 0x56
call fcn.00420181
mov dword [esp + 0x9c], esi
mov dword [esp + 0x154], edi
lea ecx, [esp + 0x154]
mov byte [esp + 0x410], 0x57
call fcn.00420181
mov dword [esp + 0x154], esi
mov dword [esp + 0x164], edi
lea ecx, [esp + 0x164]
mov byte [esp + 0x410], 0x58
call fcn.00420181
mov dword [esp + 0x164], esi
mov dword [esp + 0x8c], edi
lea ecx, [esp + 0x8c]
mov byte [esp + 0x410], 0x59
call fcn.00420181
mov dword [esp + 0x8c], esi
mov dword [esp + 0xac], edi
lea ecx, [esp + 0xac]
mov byte [esp + 0x410], 0x5a
call fcn.00420181
mov dword [esp + 0xac], esi
mov dword [esp + 0x174], edi
lea ecx, [esp + 0x174]
mov byte [esp + 0x410], 0x5b
call fcn.00420181
mov dword [esp + 0x174], esi
mov dword [esp + 0x184], edi
lea ecx, [esp + 0x184]
mov byte [esp + 0x410], 0x5c
call fcn.00420181
mov dword [esp + 0x184], esi
mov dword [esp + 0x84], edi
lea ecx, [esp + 0x84]
mov byte [esp + 0x410], 0x5d
call fcn.00420181
mov dword [esp + 0x84], esi
mov dword [esp + 0xe4], edi
lea ecx, [esp + 0xe4]
mov byte [esp + 0x410], 0x5e
call fcn.00420181
mov dword [esp + 0xe4], esi
mov dword [esp + 0x194], edi
lea ecx, [esp + 0x194]
mov byte [esp + 0x410], 0x5f
call fcn.00420181
mov dword [esp + 0x194], esi
mov dword [esp + 0x1a4], edi
lea ecx, [esp + 0x1a4]
mov byte [esp + 0x410], 0x60
call fcn.00420181
mov dword [esp + 0x1a4], esi
mov dword [esp + 0x94], edi
lea ecx, [esp + 0x94]
mov byte [esp + 0x410], 0x61
call fcn.00420181
mov dword [esp + 0x94], esi
mov dword [esp + 0xd4], edi
lea ecx, [esp + 0xd4]
mov byte [esp + 0x410], 0x62
call fcn.00420181
mov dword [esp + 0xd4], esi
mov dword [esp + 0x1b4], edi
lea ecx, [esp + 0x1b4]
mov byte [esp + 0x410], 0x63
call fcn.00420181
mov dword [esp + 0x1b4], esi
mov dword [esp + 0x1c4], edi
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x410], 0x64
call fcn.00420181
mov dword [esp + 0x1c4], esi
mov dword [esp + 0xa4], edi
lea ecx, [esp + 0xa4]
mov byte [esp + 0x410], 0x65
call fcn.00420181
mov dword [esp + 0xa4], esi
mov dword [esp + 0xb4], edi
lea ecx, [esp + 0xb4]
mov byte [esp + 0x410], 0x66
call fcn.00420181
mov dword [esp + 0xb4], esi
mov dword [esp + 0x124], edi
lea ecx, [esp + 0x124]
mov byte [esp + 0x410], 0x67
call fcn.00420181
mov dword [esp + 0x124], esi
mov dword [esp + 0x1ec], edi
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x410], 0x68
call fcn.00420181
mov dword [esp + 0x1ec], esi
mov dword [esp + 0x7c], edi
lea ecx, [esp + 0x7c]
mov byte [esp + 0x410], 0x69
call fcn.00420181
mov dword [esp + 0x7c], esi
mov dword [esp + 0xc4], edi
lea ecx, [esp + 0xc4]
mov byte [esp + 0x410], 0x6a
call fcn.00420181
mov dword [esp + 0xc4], esi
mov dword [esp + 0x4c], edi
lea ecx, [esp + 0x4c]
mov byte [esp + 0x410], 0x6b
call fcn.00420181
mov dword [esp + 0x4c], esi
mov dword [esp + 0x64], edi
lea ecx, [esp + 0x64]
mov byte [esp + 0x410], 0x6c
call fcn.00420181
mov dword [esp + 0x64], esi
mov dword [esp + 0x74], edi
lea ecx, [esp + 0x74]
mov byte [esp + 0x410], 0x6d
call fcn.00420181
mov dword [esp + 0x74], esi
mov dword [esp + 0x34], edi
lea ecx, [esp + 0x34]
mov byte [esp + 0x410], 0x6e
call fcn.00420181
mov dword [esp + 0x34], esi
mov dword [esp + 0x6c], edi
lea ecx, [esp + 0x6c]
mov byte [esp + 0x410], 0x6f
call fcn.00420181
mov dword [esp + 0x6c], esi
mov dword [esp + 0x1fc], edi
lea ecx, [esp + 0x1fc]
mov byte [esp + 0x410], 0x70
call fcn.00420181
mov dword [esp + 0x1fc], esi
mov dword [esp + 0x20c], edi
lea ecx, [esp + 0x20c]
mov byte [esp + 0x410], 0x71
call fcn.00420181
lea ecx, [esp + 0x434]
mov dword [esp + 0x20c], esi
mov byte [esp + 0x410], 0
call fcn.0041ca26
lea ecx, [esp + 0x438]
mov dword [esp + 0x410], 0xffffffff
call fcn.0041ca26
mov ecx, dword [esp + 0x408]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x404
ret