Function at 0x4378c0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4d2b83
push eax
mov dword fs:[0], esp
sub esp, 0x464
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi + 0x54], 0
push edi
je 0x43890a
push esi
lea ecx, [esp + 0x24]
call fcn.004928bb
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x98]
push eax
push ecx
mov dword [esp + 0x484], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x98]
mov edi, dword [esp + 0xa0]
mov ebx, dword [esp + 0x9c]
mov ebp, dword [esp + 0xa4]
lea eax, [esp + 0x6c]
push eax
push 4
push str.9999
push ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], edx
lea edx, [eax + ecx + 2]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x6c]
push eax
push 2
push 0x4de500
push ecx
mov dword [esi + 0x408], edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
sub edi, dword [esp + 0x6c]
sub ebp, dword [esp + 0x40]
lea eax, [edi - 2]
mov dword [esi + 0x40c], eax
sub eax, dword [esi + 0x408]
lea ecx, [ebp - 2]
mov dword [esi + 0x414], ecx
mov dword [esi + 0x418], eax
mov eax, dword [esi + 0x7c]
sub ecx, ebx
mov dword [esi + 0x41c], ecx
mov dword [esi + 0x410], ebx
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x2c]
mov dword [esp + 0x34], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x44], ecx
push 0x11
lea ecx, [esp + 0x24]
mov dword [esp + 0x78], edx
call fcn.00492b8b
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], vtable.CBrush.0
mov eax, dword [esp + 0x34]
push eax
mov byte [esp + 0x480], 1
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x68]
call fcn.00492aef
mov ecx, dword [esp + 0x24]
push 1
push ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
fld qword [0x4dddb8]
fcomp qword [esi + 0x60]
fnstsw ax
test ah, 0x44
jp 0x437b20
cmp dword [esi + 0x8c], 0
jne 0x437a66
mov edx, dword [str.Pit_Jitter__ns_]
mov eax, dword [0x4de4f4]
mov ecx, dword [0x4de4f8]
mov dword [esp + 0xa8], edx
mov edx, dword [0x4de4fc]
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb4], edx
jmp 0x437aa5
mov eax, dword [str.Land_Jitter__ns_]
mov ecx, dword [0x4de4e0]
mov edx, dword [0x4de4e4]
mov dword [esp + 0xa8], eax
mov eax, dword [0x4de4e8]
mov dword [esp + 0xac], ecx
mov cl, byte [0x4de4ec]
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], eax
mov byte [esp + 0xb8], cl
lea eax, [esp + 0xa8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x437ab0
mov ecx, dword [esp + 0x24]
sub eax, edx
lea edx, [esp + 0x38]
push edx
push eax
lea eax, [esp + 0xb0]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
lea eax, [esp + 0xa8]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x437ae0
sub eax, edx
push eax
mov eax, dword [esi + 0x410]
sub eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0xac]
push edx
push eax
mov eax, dword [esi + 0x418]
sub eax, dword [esp + 0x44]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esi + 0x408]
push eax
push ecx
call dword [sym.imp.GDI32.dll_TextOutA]
mov ebp, dword [esi + 0x8c]
mov eax, dword [esi + 0x7c]
mov edx, dword [eax + ebp*8 + 0x8c]
test edx, edx
jle 0x437cc9
mov eax, dword [esi + 0x80]
cmp word [eax + 0x570], 0
je 0x437cc9
mov eax, dword [esi + 0x41c]
mov edi, dword [esi + 0x6c]
imul eax, edx
cdq
idiv edi
mov ecx, dword [esi + 0x414]
mov ebx, dword [esi + 0x410]
mov edi, ecx
sub edi, eax
cmp edi, ebx
jge 0x437b72
or edi, 0xffffffff
mov eax, dword [esi + 0x7c]
mov eax, dword [eax + ebp*8 + 0x90]
imul eax, dword [esi + 0x41c]
cdq
idiv dword [esi + 0x6c]
sub ecx, eax
mov ebp, ecx
cmp ebp, ebx
jge 0x437b91
mov ebp, ebx
mov ecx, dword [esp + 0x34]
push 1
push ecx
call fcn.004370b0
add esp, 8
cmp ebp, edi
jg 0x437bc8
mov edx, dword [esi + 0x40c]
mov ecx, dword [esp + 0x24]
push eax
push eax
mov eax, dword [esi + 0x408]
push ebp
add edx, 2
push edx
push ebx
sub eax, 1
push eax
push ecx
mov ecx, esi
call fcn.004049e0
mov edx, dword [esp + 0x34]
push 0
push edx
call fcn.004370b0
add esp, 8
cmp edi, 0xffffffff
je 0x437c02
mov ecx, dword [esi + 0x408]
mov edx, dword [esp + 0x24]
push eax
push eax
mov eax, dword [esi + 0x40c]
push edi
add eax, 2
push eax
push ebp
sub ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004049e0
jmp 0x437c08
mov edi, dword [esi + 0x410]
mov eax, dword [esp + 0x34]
movzx edx, al
movzx ecx, ah
shr eax, 0x10
movzx ebx, al
mov dword [esp + 0x14], ecx
add ecx, ebx
add ecx, edx
mov eax, 0x55555556
mov dword [esp + 0x1c], edx
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x80
jge 0x437c40
add dword [esp + 0x14], 0x50
jmp 0x437c48
sub dword [esp + 0x1c], 0x40
sub ebx, 0x40
mov eax, dword [esp + 0x1c]
mov ecx, 0xff
cmp eax, ecx
jle 0x437c5b
mov dword [esp + 0x1c], ecx
jmp 0x437c67
test eax, eax
jge 0x437c67
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x14]
cmp eax, ecx
jle 0x437c75
mov dword [esp + 0x14], ecx
jmp 0x437c81
test eax, eax
jge 0x437c81
mov dword [esp + 0x14], 0
cmp ebx, ecx
jle 0x437c89
mov ebx, ecx
jmp 0x437c8f
test ebx, ebx
jge 0x437c8f
xor ebx, ebx
movzx ecx, byte [esp + 0x1c]
mov edx, dword [esi + 0x414]
xor eax, eax
mov ah, bl
mov al, byte [esp + 0x14]
shl eax, 8
or eax, ecx
mov ecx, dword [esi + 0x408]
push eax
push eax
mov eax, dword [esi + 0x40c]
push edx
mov edx, dword [esp + 0x30]
add eax, 2
push eax
push edi
sub ecx, 1
push ecx
push edx
jmp 0x437f8a
mov eax, dword [esi + 0x80]
cmp dword [eax + 0x54c], 0
je 0x437f56
mov ecx, dword [esp + 0x34]
movzx edx, bl
movzx eax, cl
sub eax, edx
movzx edi, bh
mov dword [esp + 0x84], eax
movzx eax, ch
sub eax, edi
shr ebx, 0x10
shr ecx, 0x10
mov dword [esp + 0x80], eax
movzx ebx, bl
movzx eax, cl
mov dword [esp + 0x7c], edi
sub eax, ebx
xor edi, edi
cmp dword [esi + 0x41c], edi
mov dword [esp + 0x78], edx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x88], eax
jle 0x437e72
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ebp, dword [esi + 0x41c]
cdq
idiv ebp
mov ebx, eax
add ebx, dword [esp + 0x78]
jns 0x437d57
xor ebx, ebx
jmp 0x437d64
cmp ebx, 0xff
jle 0x437d64
mov ebx, 0xff
mov eax, dword [esp + 0x14]
cdq
idiv ebp
mov ecx, eax
add ecx, dword [esp + 0x7c]
jns 0x437d77
xor ecx, ecx
jmp 0x437d84
cmp ecx, 0xff
jle 0x437d84
mov ecx, 0xff
mov eax, dword [esp + 0x18]
cdq
idiv ebp
add eax, dword [esp + 0x8c]
jns 0x437d98
xor eax, eax
jmp 0x437da4
cmp eax, 0xff
jle 0x437da4
mov eax, 0xff
xor edx, edx
mov dh, al
movzx eax, bl
mov dl, cl
lea ecx, [esp + 0x90]
shl edx, 8
or edx, eax
push edx
push 1
push 0
call fcn.00492c83
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x24]
push ecx
push edx
mov byte [esp + 0x484], 2
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esi + 0x408]
mov ebp, eax
mov eax, dword [esi + 0x410]
add eax, edi
push eax
push ecx
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x2c]
call fcn.00492531
mov eax, dword [esi + 0x410]
mov ecx, dword [esi + 0x40c]
add eax, edi
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.004921d9
mov edx, dword [esp + 0x24]
push ebp
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x90]
mov byte [esp + 0x47c], 1
mov dword [esp + 0x90], vtable.CPen.0
call fcn.00402cb0
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
add dword [esp + 0x1c], eax
add dword [esp + 0x14], ecx
add dword [esp + 0x18], edx
add edi, 1
cmp edi, dword [esi + 0x41c]
jl 0x437d3e
push 0
push 2
push 0
lea ecx, [esp + 0x44]
call fcn.00492c83
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ecx
mov byte [esp + 0x484], 3
call ebx
mov edx, dword [esi + 0x410]
mov edi, eax
mov eax, dword [esi + 0x408]
sub edx, 1
push edx
sub eax, 1
push eax
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00492531
mov edx, dword [esi + 0x410]
mov eax, dword [esi + 0x40c]
sub edx, 1
push edx
add eax, 1
push eax
lea ecx, [esp + 0x28]
call fcn.004921d9
mov ecx, dword [esi + 0x414]
mov edx, dword [esi + 0x40c]
add ecx, 1
push ecx
add edx, 1
push edx
lea ecx, [esp + 0x28]
call fcn.004921d9
mov eax, dword [esi + 0x414]
mov ecx, dword [esi + 0x408]
add eax, 1
sub ecx, 1
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.004921d9
mov edx, dword [esi + 0x410]
mov eax, dword [esi + 0x408]
sub edx, 1
push edx
sub eax, 1
push eax
lea ecx, [esp + 0x28]
call fcn.004921d9
mov ecx, dword [esp + 0x24]
push edi
push ecx
call ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0x47c], 1
mov dword [esp + 0x38], vtable.CPen.0
call fcn.00402cb0
jmp 0x437f97
mov edx, dword [esp + 0x34]
mov eax, dword [esi + 0x414]
mov ecx, dword [esi + 0x40c]
push 0
push edx
mov edx, dword [esi + 0x410]
add eax, 2
push eax
mov eax, dword [esi + 0x408]
add ecx, 2
push ecx
mov ecx, dword [esp + 0x34]
sub edx, 1
push edx
sub eax, 1
push eax
push ecx
mov ecx, esi
call fcn.004049e0
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x74]
push edx
push 1
push 0
lea ecx, [esp + 0x58]
call fcn.00492c83
mov eax, dword [esp + 0x44]
push eax
push 1
push 0
lea ecx, [esp + 0x68]
mov byte [esp + 0x488], 4
call fcn.00492c83
mov ecx, dword [esp + 0x24]
push 6
push ecx
mov byte [esp + 0x484], 5
call dword [sym.imp.GDI32.dll_SetTextAlign]
fld qword [0x4dddb8]
fcomp qword [esi + 0x60]
fnstsw ax
test ah, 0x44
jp 0x4380c0
mov ebp, 1
mov ecx, dword [esi + 0x418]
imul ecx, ebp
mov eax, 0x66666667
imul ecx
mov eax, dword [esp + 0x24]
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [esp + 0x50]
add edi, dword [esi + 0x408]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [ebp + 2]
push ecx
lea edx, [esp + 0xac]
push 0x4de4d8
push edx
mov ebx, eax
call fcn.004b09b2
lea eax, [esp + 0xb4]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x438046
mov edx, dword [esp + 0x24]
sub eax, ecx
mov ecx, dword [esi + 0x414]
push eax
lea eax, [esp + 0xac]
push eax
add ecx, 3
push ecx
push edi
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
test ebp, ebp
jle 0x4380a3
cmp ebp, 1
jge 0x4380a3
mov eax, dword [esi + 0x410]
push eax
push edi
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00492531
mov edx, dword [esi + 0x414]
add edx, 2
push edx
push edi
lea ecx, [esp + 0x28]
call fcn.004921d9
mov eax, dword [esp + 0x24]
push ebx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
add ebp, 1
cmp ebp, 0xa
jl 0x437ff1
jmp 0x4381fa
xor ebp, ebp
cmp dword [esi + 0x68], ebp
mov dword [esp + 0x18], ebp
jl 0x4381fa
nop
mov eax, dword [esi + 0x418]
imul eax, ebp
cdq
idiv dword [esi + 0x68]
mov edi, eax
add edi, dword [esi + 0x408]
mov eax, 0x66666667
imul ebp
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*4]
mov edx, ebp
sub edx, ecx
jne 0x43818c
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call ebx
fld qword [0x4da238]
fcomp qword [esi + 0x60]
mov dword [esp + 0x14], eax
sub esp, 8
fnstsw ax
fild dword [esp + 0x20]
test ah, 5
fmul qword [esi + 0x60]
fidiv dword [esi + 0x68]
fstp qword [esp]
jp 0x438141
push str._4.0f
lea edx, [esp + 0xb4]
push edx
jmp 0x43814e
push str._4.1f
lea eax, [esp + 0xb4]
push eax
call fcn.004b09b2
lea eax, [esp + 0xb8]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x438160
sub eax, edx
mov edx, dword [esi + 0x414]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xac]
push ecx
add edx, 3
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
jmp 0x43819c
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x24]
push ecx
push edx
call ebx
mov dword [esp + 0x14], eax
test ebp, ebp
jle 0x4381de
cmp ebp, dword [esi + 0x68]
jge 0x4381de
mov eax, dword [esi + 0x80]
cmp dword [eax + 0x550], 0
je 0x4381de
mov ecx, dword [esi + 0x410]
push ecx
push edi
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x2c]
call fcn.00492531
mov eax, dword [esi + 0x414]
add eax, 2
push eax
push edi
lea ecx, [esp + 0x28]
call fcn.004921d9
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
push ecx
push edx
call ebx
add ebp, 1
cmp ebp, dword [esi + 0x68]
mov dword [esp + 0x18], ebp
jle 0x4380d0
mov eax, dword [esi + 0x6c]
push eax
mov ecx, esi
call fcn.004372e0
mov ecx, dword [esp + 0x24]
push 2
mov edi, eax
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor ebp, ebp
test edi, edi
jl 0x4383e4
mov eax, dword [esi + 0x41c]
imul eax, ebp
cdq
idiv dword [esp + 0x1c]
mov ebx, dword [esi + 0x414]
mov edx, ebp
mov dword [esp + 0x18], 2
sub ebx, eax
and edx, 0x80000001
jns 0x43824f
dec edx
or edx, 0xfffffffe
inc edx
jne 0x438379
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x20], 3
call dword [sym.imp.GDI32.dll_SelectObject]
test ebp, ebp
mov dword [esp + 0x14], eax
je 0x43838d
mov eax, dword [esi + 0x6c]
imul eax, ebp
cdq
idiv dword [esp + 0x1c]
cdq
idiv dword [esi + 0x70]
lea edx, [esp + 0xa8]
push eax
push 0x4da260
push edx
call fcn.004b09b2
lea eax, [esp + 0xb4]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4382a8
sub eax, ecx
mov ecx, eax
mov eax, dword [esp + 0x40]
cdq
sub eax, edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x408]
sar eax, 1
mov edi, ebx
sub edi, eax
lea eax, [esp + 0xac]
push eax
push edi
sub ecx, 7
push ecx
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [esp + 0x24]
push 0
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
cmp byte [esi + 0x99], 0
je 0x43836a
cmp dword [esi + 0x78], 0xa
jne 0x43836a
mov eax, dword [esi + 0x74]
imul eax, ebp
cdq
idiv dword [esp + 0x1c]
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
lea edx, [esp + 0xac]
push 0x4da260
push edx
call fcn.004b09b2
lea eax, [esp + 0xb4]
add esp, 0xc
lea ecx, [eax + 1]
jmp 0x438340
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x438340
mov edx, dword [esp + 0x24]
sub eax, ecx
mov ecx, dword [esi + 0x40c]
push eax
lea eax, [esp + 0xac]
push eax
push edi
add ecx, 4
push ecx
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [esp + 0x24]
push 2
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x43838d
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x80]
cmp dword [eax + 0x554], 0
je 0x4383c7
mov ecx, dword [esi + 0x408]
sub ecx, dword [esp + 0x18]
push ebx
push ecx
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x2c]
call fcn.00492531
mov eax, dword [esi + 0x40c]
push ebx
push eax
lea ecx, [esp + 0x28]
call fcn.004921d9
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
add ebp, 1
cmp ebp, dword [esp + 0x1c]
jle 0x438222
cmp byte [esi + 0x99], 0
jne 0x4383fa
cmp dword [esi + 0x9c], 0
je 0x43853b
cmp dword [esi + 0x78], 1
jne 0x43853b
mov eax, dword [esi + 0x74]
cmp eax, 0x14
jge 0x438416
mov dword [esp + 0x18], 2
jmp 0x438429
xor ecx, ecx
cmp eax, 0x24
setge cl
lea ecx, [ecx*4 + 4]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x24]
push 0
push edx
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edi, edi
cmp dword [esi + 0x74], edi
jl 0x43853b
mov eax, dword [esi + 0x41c]
imul eax, edi
cdq
idiv dword [esi + 0x74]
mov ebp, dword [esi + 0x414]
mov ebx, 2
sub ebp, eax
mov eax, edi
cdq
idiv dword [esp + 0x18]
test edx, edx
jne 0x4384d9
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x24]
push eax
push ecx
lea ebx, [edx + 4]
call dword [sym.imp.GDI32.dll_SelectObject]
test edi, edi
mov dword [esp + 0x14], eax
je 0x4384ed
push edi
lea edx, [esp + 0xac]
push 0x4da260
push edx
call fcn.004b09b2
lea eax, [esp + 0xb4]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4384a1
sub eax, edx
push eax
lea eax, [esp + 0xac]
push eax
mov eax, dword [esp + 0x48]
cdq
sub eax, edx
mov edx, dword [esi + 0x40c]
sar eax, 1
mov ecx, ebp
sub ecx, eax
mov eax, dword [esp + 0x2c]
push ecx
add edx, ebx
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
jmp 0x4384ed
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x14], eax
cmp byte [esi + 0x99], 0
je 0x43851f
mov eax, dword [esi + 0x40c]
push ebp
push eax
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00492531
mov edx, dword [esi + 0x40c]
push ebp
add edx, ebx
push edx
lea ecx, [esp + 0x28]
call fcn.004921d9
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
add edi, 1
cmp edi, dword [esi + 0x74]
jle 0x438441
call fcn.00442730
test al, al
je 0x4385a0
mov edx, dword [esp + 0x24]
push 0
push edx
call dword [sym.imp.GDI32.dll_SetTextAlign]
cmp byte [esp + 0x34], 0x80
sbb eax, eax
and eax, 0xffffff
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
lea ecx, [esi + 0xa0]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x438574
mov edx, dword [esi + 0x408]
sub eax, edi
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esi + 0x410]
add ecx, 2
push ecx
add edx, 2
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
cmp dword [esi + 0x94], 0xffffffff
je 0x438669
push 0xd0d0d0
push 1
push 0
lea ecx, [esp + 0x44]
call fcn.00492c83
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x24]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push ecx
push edx
mov byte [esp + 0x484], 6
call ebx
mov edi, eax
mov eax, dword [esi + 0x410]
push eax
mov eax, dword [esi + 0x94]
imul dword [esi + 0x418]
mov ecx, eax
mov eax, dword [esi + 0x58]
mov ebp, edx
cdq
push edx
push eax
push ebp
push ecx
call fcn.004b0d50
add eax, dword [esi + 0x408]
lea edx, [esp + 0x58]
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.00492531
mov eax, dword [esi + 0x414]
push eax
mov eax, dword [esi + 0x94]
imul dword [esi + 0x418]
mov ecx, eax
mov eax, dword [esi + 0x58]
mov ebp, edx
cdq
push edx
push eax
push ebp
push ecx
call fcn.004b0d50
add eax, dword [esi + 0x408]
lea ecx, [esp + 0x24]
push eax
call fcn.004921d9
mov edx, dword [esp + 0x24]
push edi
push edx
call ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0x47c], 5
mov dword [esp + 0x38], vtable.CPen.0
call fcn.00402cb0
cmp dword [esi + 0x404], 0
je 0x4387f3
mov eax, dword [esi + 0x408]
mov ebp, dword [esi + 0xe0]
mov dword [esp + 0x110], eax
mov eax, dword [esi + 0x414]
xor edi, edi
test ebp, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x114], eax
jle 0x4386f6
fild dword [esp + 0x18]
lea ebx, [esi + 0xe8]
fild dword [esi + 0x41c]
fild dword [esi + 0x6c]
mov eax, dword [ebx - 4]
fild dword [ebx]
imul eax, dword [esi + 0x418]
fmul st(2)
fdiv st(1)
cdq
idiv dword [esi + 0x58]
fsubr st(3)
add eax, dword [esi + 0x408]
mov dword [esp + edi*8 + 0x118], eax
call fcn.004b0540
mov dword [esp + edi*8 + 0x11c], eax
add edi, 1
add ebx, 8
cmp edi, dword [esi + 0xe0]
jl 0x4386b3
fstp st(2)
fstp st(0)
fstp st(0)
mov eax, dword [esp + ebp*8 + 0x110]
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp dword [esi + 0x8c], edx
mov dword [esp + ebp*8 + 0x118], eax
mov eax, dword [esi + 0x7c]
setne dl
mov dword [esp + ebp*8 + 0x11c], ecx
mov ecx, dword [eax + edx*4 + 0x20]
push ecx
push 1
push 0
lea ecx, [esp + 0x44]
add edx, 5
call fcn.00492c83
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push edx
push eax
call edi
mov ebx, eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], vtable.CBrush.0
mov edx, dword [esi + 0x7c]
xor ecx, ecx
cmp dword [esi + 0x8c], ecx
mov byte [esp + 0x47c], 8
setne cl
mov eax, dword [edx + ecx*4 + 0x20]
push eax
add ecx, 5
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x48]
call fcn.00492aef
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call edi
mov ebp, eax
mov eax, dword [esi + 0xe0]
add eax, 2
push eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x114]
push edx
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov ecx, dword [esp + 0x24]
push ebx
push ecx
call edi
mov edx, dword [esp + 0x24]
push ebp
push edx
call edi
lea ecx, [esp + 0x44]
mov byte [esp + 0x47c], 7
mov dword [esp + 0x44], vtable.CBrush.0
call fcn.00402cb0
lea ecx, [esp + 0x38]
mov byte [esp + 0x47c], 5
mov dword [esp + 0x38], vtable.CPen.0
call fcn.00402cb0
jmp 0x43882a
mov eax, dword [esi + 0x84]
test eax, eax
jle 0x43882a
cmp byte [esi + 0x98], 0
je 0x43882a
xor edi, edi
test eax, eax
jle 0x43882a
lea esp, [esp]
mov eax, dword [esi + 0x8c]
push eax
push edi
mov ecx, esi
call fcn.004374e0
add edi, 1
cmp edi, dword [esi + 0x84]
jl 0x438810
mov eax, dword [esi + 0x88]
test eax, eax
jle 0x438876
cmp byte [esi + 0x99], 0
je 0x438876
xor edi, edi
test eax, eax
jle 0x438876
mov ecx, dword [esi + 0x90]
fldz
mov eax, dword [esi + 0x7c]
lea edx, [ecx + edi*2 + 0x18f7]
shl edx, 4
fcomp qword [edx + eax]
fnstsw ax
test ah, 5
jp 0x43886b
push ecx
push edi
mov ecx, esi
call fcn.00437720
add edi, 1
cmp edi, dword [esi + 0x88]
jl 0x438843
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x4388ae
xor edi, edi
cmp dword [eax + 0x1660], edi
jle 0x4388ae
lea ebx, [ebx]
push 0xff
push edi
mov ecx, esi
call fcn.00437720
mov ecx, dword [esi + 0x9c]
add edi, 1
cmp edi, dword [ecx + 0x1660]
jl 0x438890
mov esi, vtable.CPen.0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x47c], 4
mov dword [esp + 0x5c], esi
call fcn.00402cb0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x47c], 1
mov dword [esp + 0x4c], esi
call fcn.00402cb0
lea ecx, [esp + 0x64]
mov byte [esp + 0x47c], 0
mov dword [esp + 0x64], vtable.CBrush.0
call fcn.00402cb0
lea ecx, [esp + 0x20]
mov dword [esp + 0x47c], 0xffffffff
call fcn.0049290f
mov ecx, dword [esp + 0x474]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret