Function at 0x46fb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x489ade
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1914
call fcn.00477c00
mov eax, dword [0x49e7c0]
xor eax, esp
mov dword [esp + 0x1910], eax
push ebx
push esi
push edi
mov eax, dword [0x49e7c0]
xor eax, esp
push eax
lea eax, [esp + 0x1928]
mov dword fs:[0], eax
mov esi, dword [0x4a00f4]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10c], ecx
mov ecx, esi
imul ecx, dword [0x4a00e4]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xf4], eax
mov dword [esp + 0x2c], edx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x34]
xor edi, edi
cmp dword [0x4a00f8], edi
mov eax, ecx
jne 0x46fbb9
mov ecx, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
jmp 0x46fbbf
mov ecx, dword [edx + 0x38]
mov ebx, dword [edx + 0x34]
sub ecx, eax
mov eax, dword [0x4a00e0]
sub ecx, eax
add eax, eax
sub ebx, eax
cmp ecx, edi
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xe0], ecx
jge 0x46fbe5
mov dword [esp + 0xe0], edi
cmp ebx, edi
jge 0x46fbf2
xor ebx, ebx
mov dword [esp + 0xf8], ebx
xor eax, eax
cmp dword [0x4a00dc], edi
mov dword [esp + 0x40], eax
je 0x46fc1e
mov ecx, dword [0x4a00d8]
imul ecx, esi
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x40], eax
lea ecx, [esi + eax]
mov dword [esp + 0xec], ecx
mov ecx, dword [0x4a00e8]
imul ecx, esi
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xec]
lea ecx, [eax + edx]
add eax, ebx
cdq
idiv ecx
mov dword [esp + 0x140], ecx
mov dword [esp + 0xd4], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], edi
mov byte [esp + 0x33], 1
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0xd0], ecx
lea ecx, [esp + 0x24c]
call fcn.0041e6a0
lea ecx, [esp + 0xf5c]
mov dword [esp + 0x1930], edi
call fcn.0041e6a0
lea ecx, [esp + 0x6a4]
mov byte [esp + 0x1930], 1
call fcn.0041e6a0
mov dword [esp + 0x6a4], 0x48ddfc
lea ecx, [esp + 0x13b4]
mov byte [esp + 0x1930], 2
call fcn.0041e6a0
mov dword [esp + 0x13b4], 0x48de08
cmp dword [esp + 0x2c], edi
mov eax, dword [0x4a00f0]
mov byte [esp + 0x1930], 3
mov dword [esp + 0xe4], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x124], edi
mov dword [esp + 0x12c], edi
mov dword [esp + 0x148], edi
mov dword [esp + 0x15c], edi
mov dword [esp + 0x154], edi
mov dword [esp + 0x158], edi
mov dword [esp + 0x144], edi
mov dword [esp + 0xc4], edi
mov dword [esp + 0x150], edi
mov dword [esp + 0x160], edi
mov dword [esp + 0xe8], eax
mov ecx, 8
je 0x4700b0
cmp eax, 1
jne 0x46fd6c
mov dword [esp + 0xc8], 2
jmp 0x46fd91
cmp eax, 2
jne 0x46fd7e
mov dword [esp + 0xc8], 4
jmp 0x46fd91
xor edx, edx
cmp eax, 3
sete dl
lea edx, [edx + edx + 1]
mov dword [esp + 0xc8], edx
mov eax, dword [0x4a00ec]
neg eax
sbb eax, eax
and eax, 0x2bc
cmp dword [0x4a00f8], edi
mov dword [esp + 0x1868], edi
mov byte [esp + 0x187f], 1
mov dword [esp + 0x1874], eax
mov byte [esp + 0x1878], 0
mov byte [esp + 0x1879], 0
mov byte [esp + 0x187a], 0
mov byte [esp + 0x187b], 1
mov byte [esp + 0x187c], 0
mov byte [esp + 0x187d], 0
mov byte [esp + 0x187e], 0
jne 0x46fe20
cmp dword [0x49e504], ecx
mov eax, dword [0x49e4f0]
mov dword [esp + 0x186c], edi
mov dword [esp + 0x1870], edi
jae 0x46fe15
mov eax, 0x49e4f0
push eax
lea ecx, [esp + 0x1884]
push ecx
jmp 0x46fe58
cmp dword [0x49e504], ecx
mov eax, 0xa8c
mov dword [esp + 0x186c], eax
mov dword [esp + 0x1870], eax
mov eax, dword [0x49e4f0]
mov word [esp + 0x1880], 0x40
jae 0x46fe4f
mov eax, 0x49e4f0
push eax
lea edx, [esp + 0x1886]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0xc8]
mov ebx, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov esi, edi
imul esi, dword [esp + 0x18]
mov eax, esi
lea ecx, [esp + 0x1864]
neg eax
push ecx
mov dword [esp + 0x1868], eax
call ebx
imul edi, dword [esp + 0x40]
mov dword [esp + 0x12c], eax
mov edx, edi
lea eax, [esp + 0x1864]
neg edx
push eax
mov dword [esp + 0x1878], 0
mov dword [esp + 0x1868], edx
call ebx
mov ecx, dword [0x4a00d0]
push ecx
mov dword [esp + 0x128], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edx, dword [0x4a00d4]
push edx
push 1
push 0
mov dword [esp + 0xd0], eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
push 0
mov dword [esp + 0x168], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
mov dword [esp + 0x154], eax
call ebx
test eax, eax
mov dword [esp + 0x7c], eax
jne 0x46ff15
mov dword [esp + 0x14], 0xfffffffc
jmp 0x473247
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 8]
mov ecx, dword [esp + 0x7c]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x144], eax
xor eax, eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x44c]
mov eax, dword [eax + 0x450]
mov dword [esp + 0x138], edx
push ecx
lea edx, [esp + 0x134]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x80]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
push 0
call ebx
test eax, eax
mov dword [esp + 0x5c], eax
jne 0x46ff94
mov dword [esp + 0x14], 0xfffffffb
jmp 0x473247
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx + 0x440]
push 1
push 0
push 0
push 1
push 1
push esi
push esi
push 0
push 0
push eax
lea ecx, [esp + 0x274]
call fcn.0041e8e0
mov edx, dword [esp + 0x254]
mov esi, dword [esp + 0x5c]
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x12c]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x4a00d4]
push ecx
push esi
mov dword [esp + 0x164], eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push esi
mov esi, dword [sym.imp.GDI32.dll_SetBkMode]
call esi
push 0
call ebx
test eax, eax
mov dword [esp + 0xe4], eax
jne 0x470020
mov dword [esp + 0x14], 0xfffffffa
jmp 0x473247
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0x440]
push 1
push 0
push 0
push 1
push 1
push edi
push edi
push 0
push 0
push eax
lea ecx, [esp + 0xf84]
call fcn.0041e8e0
mov eax, dword [esp + 0xf64]
mov edi, dword [esp + 0xe4]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push edi
call ebx
mov ecx, dword [esp + 0x124]
push ecx
push edi
mov dword [esp + 0x15c], eax
call ebx
mov edx, dword [0x4a00d4]
push edx
push edi
mov dword [esp + 0x150], eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push edi
call esi
mov ecx, dword [esp + 0x5c]
mov esi, dword [sym.imp.GDI32.dll_GetTextMetricsW]
lea eax, [esp + 0x1d4]
push eax
push ecx
call esi
lea edx, [esp + 0x210]
push edx
push edi
call esi
jmp 0x4700b0
xor ebx, ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x10c]
push esi
lea ecx, [esp + 0x98]
mov byte [esp + 0x1934], 4
call fcn.0046ed10
add esp, 4
test eax, eax
je 0x47011d
mov eax, dword [esp + 0x98]
push eax
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x9c]
mov eax, esi
call fcn.0046c9e0
add esp, 8
test eax, eax
jne 0x47011d
cmp dword [esp + 0x54], ebx
je 0x473026
mov ecx, dword [esp + 0xa0]
cmp ecx, dword [esp + 0xa4]
mov edx, dword [esi + 0x4c]
mov dword [esp + 0x90], edx
mov esi, ecx
jbe 0x470145
call fcn.0047770d
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xb8], esi
mov esi, dword [esp + 0xa4]
cmp ecx, esi
lea eax, [esp + 0x9c]
mov dword [esp + 0xb4], eax
mov dword [esp + 0xac], esi
jbe 0x470178
call fcn.0047770d
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0x98]
lea eax, [esp + 0x9c]
mov dword [esp + 0x74], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0x94]
add edx, eax
cmp eax, edx
mov dword [esp + 0x78], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0xdc], esi
mov dword [esp + 0x100], esi
mov dword [esp + 0x1c], eax
jge 0x472f88
jmp 0x4701d0
mov ebx, dword [esp + 0xb4]
test ebx, ebx
je 0x4701e6
lea eax, [esp + 0x9c]
cmp ebx, eax
je 0x4701eb
call fcn.0047770d
mov edi, dword [esp + 0xb8]
cmp edi, dword [esp + 0xac]
je 0x470b1e
test ebx, ebx
jne 0x470208
call fcn.0047770d
cmp edi, dword [ebx + 8]
jb 0x470212
call fcn.0047770d
mov esi, dword [esp + 0x1c]
cmp dword [edi + 4], esi
jg 0x470b1e
cmp edi, dword [ebx + 8]
jb 0x470229
call fcn.0047770d
cmp esi, dword [edi + 4]
jle 0x470265
cmp edi, dword [ebx + 8]
jb 0x470242
call fcn.0047770d
cmp edi, dword [ebx + 8]
jb 0x470242
call fcn.0047770d
mov ecx, dword [edi + 8]
add ecx, dword [edi + 4]
cmp esi, ecx
jl 0x470265
cmp edi, dword [ebx + 8]
jb 0x470256
call fcn.0047770d
add edi, 0x3c
mov dword [esp + 0xb8], edi
jmp 0x472f67
cmp edi, dword [ebx + 8]
jb 0x47026f
call fcn.0047770d
mov eax, dword [edi]
add eax, 0xffffffff
cmp eax, 0xc
ja case.default.0x470279
jmp dword [eax*4 + 0x473368]
cmp dword [esp + 0x54], 0
jg 0x473099
cmp dword [esp + 0x50], 0
jg 0x473099
jmp case.default.0x470279
cmp edi, dword [ebx + 8]
jb 0x4702ac
call fcn.0047770d
cmp edi, dword [ebx + 8]
jb 0x4702ac
call fcn.0047770d
mov eax, dword [edi + 8]
add eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
jmp case.default.0x470279
cmp edi, dword [ebx + 8]
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], edi
mov byte [esp + 0x33], 1
jb 0x470256
call fcn.0047770d
jmp case.default.0x470279
cmp edi, dword [ebx + 8]
jb 0x4702de
call fcn.0047770d
mov edx, dword [edi + 0xc]
mov eax, dword [esp + 0x34]
mov dword [eax + 0x4c], edx
cmp edi, dword [ebx + 8]
jb 0x4702f2
call fcn.0047770d
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x90], ecx
jmp case.default.0x470279
mov eax, dword [esp + 0x94]
sub eax, esi
add eax, dword [esp + 0x98]
lea edx, [esp + 0x94]
push eax
mov eax, dword [esp + 0x38]
push edx
mov ecx, esi
call fcn.0046c9e0
add esp, 8
cmp edi, dword [ebx + 8]
mov esi, eax
jb 0x470334
call fcn.0047770d
mov ecx, dword [edi + 0xc]
imul ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe0]
lea edx, [ecx + esi]
add edx, dword [esp + 0x50]
cmp edx, eax
jg 0x470367
sub eax, ecx
sub eax, esi
sub eax, dword [esp + 0x50]
cdq
idiv dword [esp + 0x18]
mov dword [esp + 0x90], eax
jmp case.default.0x470279
mov dword [esp + 0x90], 0
jmp case.default.0x470279
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], edi
jmp case.default.0x470279
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], edi
jmp case.default.0x470279
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], edi
jmp case.default.0x470279
mov esi, dword [esp + 0x54]
test esi, esi
je 0x4703e6
lea ecx, [esp + 0xb4]
call fcn.0046c890
cmp dword [eax + 0x34], 0
jle 0x473081
lea ecx, [esp + 0xb4]
call fcn.0046c890
mov eax, dword [eax + 0x34]
add eax, esi
cmp eax, dword [esp + 0xf8]
jg 0x473081
cmp dword [esp + 0x2c], 0
je 0x470a97
xor ebx, ebx
mov eax, 7
mov dword [esp + 0x1860], eax
mov dword [esp + 0x185c], ebx
mov word [esp + 0x184c], bx
mov dword [esp + 0x1828], eax
mov dword [esp + 0x1824], ebx
mov word [esp + 0x1814], bx
mov esi, dword [esp + 0x34]
add esi, 4
cmp dword [esi + 0x18], 8
mov byte [esp + 0x1930], 6
jb 0x47043e
mov eax, dword [esi + 4]
jmp 0x470441
lea eax, [esi + 4]
push eax
call fcn.00442070
mov edi, eax
add esp, 4
cmp edi, 1
lea ecx, [esp + 0x1848]
jg 0x470478
push 0x5c
call fcn.0046cea0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x1850]
push ecx
lea ecx, [esp + 0x181c]
call fcn.00402360
jmp 0x4704b5
push 0xffffffffffffffff
push ebx
push esi
call fcn.00402360
push edi
lea ecx, [esp + 0x184c]
call fcn.00402760
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1850]
push edx
lea ecx, [esp + 0x181c]
call fcn.00402360
add edi, 0xffffffff
push edi
lea ecx, [esp + 0x184c]
call fcn.00402760
mov dword [esp + 0x1844], 7
mov dword [esp + 0x1840], ebx
mov word [esp + 0x1830], bx
mov edi, 8
cmp dword [esi + 0x18], edi
mov byte [esp + 0x1930], 7
jb 0x4704e6
mov esi, dword [esi + 4]
jmp 0x4704e9
add esi, 4
lea eax, [esp + 0x182c]
push eax
push esi
call fcn.00442660
mov eax, dword [esp + 0x1838]
add esp, 8
cmp dword [esp + 0x1844], edi
jae 0x470511
lea eax, [esp + 0x1830]
push eax
call fcn.004010b0
add esp, 4
cmp eax, 3
lea ecx, [esp + 0xb4]
sete bl
call fcn.0046c890
add eax, 0x18
cmp dword [eax + 0x18], edi
jb 0x470539
mov esi, dword [eax + 4]
jmp 0x47053c
lea esi, [eax + 4]
movzx eax, word [esi]
xor edi, edi
cmp ax, di
je 0x47057c
cmp ax, 0x2f
je 0x470558
cmp ax, 0x5c
je 0x470558
movzx eax, ax
push eax
jmp 0x470562
test bl, bl
je 0x470560
push 0x2f
jmp 0x470562
push 0x5c
push 1
lea ecx, [esp + 0x1818]
call fcn.004022b0
movzx eax, word [esi + 2]
add esi, 2
cmp ax, di
jne 0x470546
mov dword [esp + 0xf0], edi
test bl, bl
mov byte [esp + 0x1930], 8
je 0x47071e
mov esi, dword [esp + 0x34]
add esi, 0x50
mov ecx, esi
call fcn.00401310
test eax, eax
jne 0x470697
cmp dword [esp + 0x1844], 8
mov eax, dword [esp + 0x1830]
jae 0x4705c1
lea eax, [esp + 0x1830]
push edi
lea ecx, [esp + 0x12c]
push ecx
push eax
call fcn.00406bd0
add esp, 0xc
test eax, eax
jne 0x470697
mov dword [esp + 0x18dc], 7
mov dword [esp + 0x18d8], edi
mov word [esp + 0x18c8], di
mov eax, dword [esp + 0x128]
push edi
lea edx, [esp + 0x18c8]
push edx
push eax
mov byte [esp + 0x193c], 9
call fcn.00402c00
add esp, 0xc
test eax, eax
jne 0x470672
mov ebx, dword [esp + 0xf4]
mov edi, dword [esp + 0xd4]
test ebx, ebx
je 0x470643
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x120]
push ecx
push edx
push edi
call ebx
test eax, eax
jne 0x4730a6
lea eax, [esp + 0x18c4]
push eax
mov ecx, esi
call fcn.004053a0
mov edx, dword [esp + 0x128]
push 0
lea ecx, [esp + 0x18c8]
push ecx
push edx
call fcn.00402c00
add esp, 0xc
test eax, eax
je 0x470628
xor edi, edi
mov eax, dword [esp + 0x128]
push edi
push eax
call fcn.00402270
add esp, 8
lea ecx, [esp + 0x18c4]
mov byte [esp + 0x1930], 8
call fcn.00401f00
mov ecx, esi
xor ebx, ebx
xor edi, edi
call fcn.00401310
test eax, eax
jle 0x4706d1
push edi
mov ecx, esi
call fcn.00401330
push eax
lea ecx, [esp + 0x1814]
push ecx
call fcn.00401c90
add esp, 8
test al, al
jne 0x4706d1
mov ecx, esi
add edi, 1
call fcn.00401310
cmp edi, eax
jl 0x4706a6
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x4706dc
xor eax, eax
jmp 0x4706f2
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x470750
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0xf4]
push ebx
push edx
push eax
lea ecx, [esp + 0xfc]
push ecx
push edi
mov ecx, esi
call fcn.00401330
push eax
call fcn.00405840
add esp, 0x14
jmp 0x470750
cmp dword [esp + 0x1828], 8
mov eax, dword [esp + 0x1814]
jae 0x470736
lea eax, [esp + 0x1814]
lea edx, [esp + 0xf0]
push edx
push 1
push 1
push edi
push edi
push edi
push eax
call fcn.00408e30
add esp, 0x1c
xor ebx, ebx
cmp dword [esp + 0xf0], ebx
je 0x4709e6
lea ecx, [esp + 0xafc]
call fcn.00444060
lea ecx, [esp + 0x18c4]
call fcn.00432040
mov eax, dword [esp + 0x1814]
mov edi, 8
cmp dword [esp + 0x1828], edi
mov byte [esp + 0x1930], 0xb
mov byte [esp + 0x18c4], 1
jae 0x4707a1
lea eax, [esp + 0x1814]
push eax
call fcn.00443f80
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x18cc], eax
mov eax, dword [esp + 0xf8]
add esp, 4
mov dword [esp + 0x1908], eax
lea eax, [esp + 0x18c4]
push eax
mov eax, dword [esp + 0xf4]
cmp eax, ebx
push ecx
mov edx, 1
mov dword [esp + 0x1914], ecx
mov dword [esp + 0x191c], edx
mov dword [esp + 0x6c], esp
mov ecx, esp
je 0x4707f2
add dword [eax + 4], edx
mov dword [ecx], eax
lea ecx, [esp + 0xb04]
call fcn.00445ab0
cmp eax, ebx
jne 0x4709c4
cmp dword [0x4a00f8], ebx
lea ecx, [esp + 0xb4]
jne 0x47084f
call fcn.0046c890
cmp dword [eax + 0x34], ebx
jne 0x47082a
mov edi, dword [esp + 0xf54]
jmp 0x470839
lea ecx, [esp + 0xb4]
call fcn.0046c890
mov edi, dword [eax + 0x34]
mov eax, edi
imul eax, dword [esp + 0xf50]
cdq
idiv dword [esp + 0xf54]
mov esi, eax
jmp 0x470885
call fcn.0046c890
cmp dword [eax + 0x34], ebx
jne 0x470862
mov esi, dword [esp + 0xf50]
jmp 0x470871
lea ecx, [esp + 0xb4]
call fcn.0046c890
mov esi, dword [eax + 0x34]
mov eax, esi
imul eax, dword [esp + 0xf54]
cdq
idiv dword [esp + 0xf50]
mov edi, eax
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x34]
mov edx, eax
mov ebx, ecx
imul edx, esi
imul ebx, edi
cmp ebx, edx
jle 0x4708c0
cmp dword [0x4a0574], 0
je 0x4708aa
cmp edi, eax
jl 0x4708e3
mov edi, eax
imul eax, dword [esp + 0xf50]
cdq
idiv dword [esp + 0xf54]
mov esi, eax
jmp 0x4708e3
cmp dword [0x4a0574], 0
je 0x4708cd
cmp esi, ecx
jl 0x4708e3
mov esi, ecx
mov eax, esi
imul eax, dword [esp + 0xf54]
cdq
idiv dword [esp + 0xf50]
mov edi, eax
cmp dword [0x4a00f8], 0
jne 0x470907
mov eax, dword [esp + 0x54]
mov dword [esp + 0x198], eax
mov eax, ecx
sub eax, esi
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
jmp 0x470992
lea ecx, [esp + 0xb4]
call fcn.0046c890
cmp dword [eax + 0x34], 0
jne 0x47092b
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx + 0x34]
sub eax, esi
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
jmp 0x470940
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0x34]
sub eax, dword [0x4a00e0]
sub eax, dword [esp + 0x54]
sub eax, esi
mov ebx, eax
lea ecx, [esp + 0xb4]
call fcn.0046c890
mov eax, dword [eax + 0x38]
sub eax, 0
je 0x470987
sub eax, 1
je 0x470970
sub eax, 1
jne 0x470992
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0x38]
sub eax, edi
mov dword [esp + 0x198], eax
jmp 0x470992
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx + 0x38]
sub eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x198], eax
jmp 0x470992
mov dword [esp + 0x198], 0
mov edx, dword [0x4a0568]
mov eax, dword [esp + 0x198]
mov ecx, dword [esp + 0x7c]
push 0
push edx
push edi
push esi
push 0
push 0
push edi
push esi
push eax
push ebx
push ecx
lea ecx, [esp + 0xb28]
call fcn.00444b70
xor ebx, ebx
mov edi, 8
lea ecx, [esp + 0x18c4]
call fcn.00432090
lea ecx, [esp + 0xafc]
mov byte [esp + 0x1930], 8
call fcn.00444b10
jmp 0x4709eb
mov edi, 8
mov eax, dword [esp + 0xf0]
cmp eax, ebx
mov byte [esp + 0x1930], 7
je 0x470a13
add dword [eax + 4], 0xffffffff
mov ecx, eax
add eax, 4
cmp dword [eax], ebx
jne 0x470a13
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp dword [esp + 0x1844], edi
jb 0x470a2c
mov ecx, dword [esp + 0x1830]
push ecx
call fcn.004775de
add esp, 4
cmp dword [esp + 0x1828], edi
mov esi, 7
mov dword [esp + 0x1844], esi
mov dword [esp + 0x1840], ebx
mov word [esp + 0x1830], bx
jb 0x470a60
mov edx, dword [esp + 0x1814]
push edx
call fcn.004775de
add esp, 4
cmp dword [esp + 0x1860], edi
mov dword [esp + 0x1828], esi
mov dword [esp + 0x1824], ebx
mov word [esp + 0x1814], bx
mov byte [esp + 0x1930], 4
jb 0x470a97
mov eax, dword [esp + 0x184c]
push eax
call fcn.004775de
add esp, 4
mov edi, dword [esp + 0xb8]
mov ebx, dword [esp + 0xb4]
cmp edi, dword [ebx + 8]
jb 0x470aaf
call fcn.0047770d
cmp dword [edi + 0x34], 0
je 0x473105
lea ecx, [esp + 0xb4]
call fcn.0046c890
cmp dword [eax + 0x34], 0
je 0x473105
lea ecx, [esp + 0xb4]
call fcn.0046c890
mov ecx, dword [eax + 0x34]
mov esi, dword [esp + 0x54]
add ecx, esi
add ecx, dword [esp + 0xec]
cmp ecx, dword [esp + 0xf8]
jg 0x473105
lea ecx, [esp + 0xb4]
call fcn.0046c890
add esi, dword [eax + 0x34]
mov ebx, dword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
mov dword [esp + 0x54], esi
jmp case.default.0x470279
mov esi, dword [esp + 0xd0]
mov edx, dword [esp + 0x1c]
movzx ebx, word [esi + edx*2]
mov eax, ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x44], ebx
call fcn.0046bf80
test al, al
mov eax, dword [esp + 0x18]
je 0x470ec4
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xfc]
test eax, eax
je 0x470b66
lea ecx, [esp + 0x9c]
cmp eax, ecx
je 0x470b6f
call fcn.0047770d
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x100]
cmp edi, dword [esp + 0xac]
je 0x470ced
mov eax, dword [esp + 0xfc]
test eax, eax
jne 0x470b9a
call fcn.0047770d
mov eax, dword [esp + 0xfc]
cmp edi, dword [eax + 8]
jb 0x470bab
call fcn.0047770d
mov eax, dword [esp + 0xfc]
mov esi, 4
cmp dword [edi + 0xc], esi
jge 0x470cae
cmp edi, dword [eax + 8]
mov dword [esp + 0x14], 5
jb 0x470bd2
call fcn.0047770d
mov eax, dword [esp + 0xfc]
cmp dword [edi + 0xc], 0
jne 0x470c08
mov edx, dword [esp + 0xac]
mov eax, 0x21
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x9c]
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], edx
jmp 0x470db9
cmp edi, dword [eax + 8]
jb 0x470c19
call fcn.0047770d
mov eax, dword [esp + 0xfc]
cmp dword [edi + 0xc], 1
jne 0x470c4f
mov edx, dword [esp + 0xac]
mov eax, 0x3f
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x9c]
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], edx
jmp 0x470db9
cmp edi, dword [eax + 8]
jb 0x470c60
call fcn.0047770d
mov eax, dword [esp + 0xfc]
cmp dword [edi + 0xc], 2
jne 0x470c95
mov edx, dword [esp + 0xac]
lea eax, [esp + 0x9c]
mov word [esp + 0x3c], 0x3f
mov word [esp + 0x3e], 0x21
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], edx
jmp 0x470db9
cmp edi, dword [eax + 8]
jb 0x470c9f
call fcn.0047770d
cmp dword [edi + 0xc], 3
jne 0x470ccc
mov word [esp + 0x3e], 0x3f
jmp 0x470cc5
cmp edi, dword [eax + 8]
jb 0x470cb8
call fcn.0047770d
cmp dword [edi + 0xc], esi
jne 0x470ccc
mov dword [esp + 0x14], 6
mov word [esp + 0x3c], 0x21
mov edx, dword [esp + 0xac]
lea eax, [esp + 0x9c]
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], edx
jmp 0x470db9
mov edi, 1
cmp dword [0x4a00f8], edi
jne 0x470db9
cmp bx, 0xff01
je 0x470d0c
cmp bx, 0xff1f
jne 0x470d59
mov ecx, dword [esp + 0x1c]
movzx eax, word [esi + ecx*2 + 2]
cmp ax, 0xff01
lea edx, [esi + ecx*2 + 2]
je 0x470d25
cmp ax, 0xff1f
jne 0x470d59
mov ax, word [esi + ecx*2]
sub ax, 0xff01
neg ax
mov dword [esp + 0x14], edi
sbb eax, eax
and eax, 0x1e
add eax, 0x21
mov word [esp + 0x3c], ax
mov cx, word [edx]
sub cx, 0xff01
neg cx
sbb ecx, ecx
and ecx, 0x1e
add ecx, 0x21
mov word [esp + 0x3e], cx
cmp dword [0x4a00dc], 0
je 0x470d84
cmp bx, 0x226a
jne 0x470d73
mov dword [esp + 0x44], 0x300a
jmp 0x470db9
cmp bx, 0x226b
jne 0x470d84
mov dword [esp + 0x44], 0x300b
jmp 0x470db9
cmp bx, 0xff0f
jne 0x470db9
mov edx, dword [esp + 0x1c]
movzx eax, word [esi + edx*2 + 2]
cmp ax, 0xff3c
jne 0x470e94
mov dword [esp + 0x14], 3
mov dword [esp + 0x44], 0x304f
mov eax, dword [esp + 0x18]
lea ecx, [eax + eax]
mov dword [esp + 0x24], ecx
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0xd8]
test ebx, ebx
je 0x470dd3
lea eax, [esp + 0x9c]
cmp ebx, eax
je 0x470dd8
call fcn.0047770d
mov esi, dword [esp + 0xdc]
cmp esi, dword [esp + 0xac]
je 0x470e32
test ebx, ebx
jne 0x470df1
call fcn.0047770d
cmp esi, dword [ebx + 8]
jb 0x470e05
call fcn.0047770d
cmp esi, dword [ebx + 8]
jb 0x470e05
call fcn.0047770d
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
cmp dword [esp + 0x1c], ecx
jge 0x470e32
mov eax, edi
cdq
sub eax, edx
sar eax, 1
cmp esi, dword [ebx + 8]
mov edi, eax
mov dword [esp + 0x24], edi
jb 0x470e32
call fcn.0047770d
cmp esi, dword [ebx + 8]
jb 0x470e32
call fcn.0047770d
mov eax, dword [esp + 0x50]
test eax, eax
jle 0x4712b2
mov esi, dword [esp + 0x90]
imul esi, dword [esp + 0x18]
add edi, esi
add edi, eax
cmp edi, dword [esp + 0xe0]
jle 0x4712b2
mov eax, dword [esp + 0x44]
xor ebx, ebx
cmp ax, word [ebx*2 + 0x49e6d8]
je 0x470e73
add ebx, 1
cmp ebx, 0x22
jl 0x470e61
cmp ebx, 4
mov edi, dword [esp + 0x24]
jge 0x471066
mov eax, dword [esp + 0x18]
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
jmp 0x471076
cmp ax, 0x2033
jne 0x470db9
mov edx, dword [esp + 0x1c]
cmp word [esi + edx*2 + 4], 0xff3c
jne 0x470db9
mov dword [esp + 0x14], 4
mov dword [esp + 0x44], 0x3050
jmp 0x470dae
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp bx, 9
mov dword [esp + 0x24], edi
jne 0x470ef7
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x50]
add ecx, ecx
add ecx, ecx
lea eax, [ecx + esi]
cdq
idiv ecx
mov edi, eax
imul edi, ecx
sub edi, esi
mov dword [esp + 0x24], edi
jmp 0x470dbd
mov edx, 1
cmp dword [0x4a00f8], edx
jne 0x470db9
cmp bx, 0x21
je 0x470f14
cmp bx, 0x3f
jne 0x470f33
mov eax, dword [esp + 0x1c]
lea ecx, [esi + eax*2 + 2]
movzx eax, word [ecx]
cmp ax, 0x21
je 0x471048
cmp ax, 0x3f
je 0x471048
lea ecx, [ebx - 0x30]
cmp cx, 9
ja 0x470fce
mov edi, dword [esp + 0x1c]
movzx ecx, word [esi + edi*2 + 2]
lea eax, [esi + edi*2 + 2]
mov dword [esp + 0x64], eax
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x470f9c
mov ax, word [esi + edi*2 + 4]
call fcn.0046bfa0
cmp eax, edx
je 0x470f9c
test edi, edi
je 0x470f7a
mov ax, word [esi + edi*2 - 2]
call fcn.0046bfa0
cmp eax, edx
je 0x470f9c
mov ecx, dword [esp + 0x64]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x14], edx
mov word [esp + 0x3c], bx
mov dx, word [ecx]
mov word [esp + 0x3e], dx
mov dword [esp + 0x24], edi
jmp 0x470dbd
test edi, edi
je 0x470fb2
mov ax, word [esi + edi*2 - 2]
call fcn.0046bfa0
cmp eax, edx
je 0x470db9
mov eax, ecx
call fcn.0046bfa0
cmp eax, edx
je 0x470db9
mov edi, dword [esp + 0x18]
mov dword [esp + 0x24], edi
jmp 0x470dbd
cmp dword [0x4a00dc], 0
je 0x470db9
cmp bx, 0x3c
jne 0x470ff1
mov eax, dword [esp + 0x1c]
cmp word [esi + eax*2 + 2], bx
je 0x47100a
jmp 0x470dbd
cmp bx, 0x3e
jne 0x470db9
mov ecx, dword [esp + 0x1c]
cmp word [esi + ecx*2 + 2], bx
jne 0x470db9
cmp bx, 0x3c
mov dword [esp + 0x14], 2
jne 0x47102d
mov edi, dword [esp + 0x18]
mov dword [esp + 0x44], 0x300a
mov dword [esp + 0x24], edi
jmp 0x470dbd
cmp bx, 0x3e
jne 0x47103b
mov dword [esp + 0x44], 0x300b
mov edi, dword [esp + 0x18]
mov dword [esp + 0x24], edi
jmp 0x470dbd
mov edi, dword [esp + 0x18]
mov dword [esp + 0x14], edx
mov word [esp + 0x3c], bx
mov dx, word [ecx]
mov word [esp + 0x3e], dx
mov dword [esp + 0x24], edi
jmp 0x470dbd
cmp ebx, 0x1a
jge 0x471076
mov eax, dword [esp + 0x18]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp ebx, 0x22
jae 0x4710d3
mov eax, dword [esp + 0x74]
test eax, eax
je 0x47108e
lea edx, [esp + 0x9c]
cmp eax, edx
je 0x471093
call fcn.0047770d
mov eax, dword [esp + 0x78]
cmp eax, dword [esp + 0xac]
jne 0x4710d3
mov ecx, dword [0x4a00f4]
imul ecx, dword [0x4a00e4]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, dword [esp + 0xe0]
add edi, esi
add edi, dword [esp + 0x50]
cmp edi, ecx
jle 0x4712b2
mov edi, dword [esp + 0x1c]
add edi, 0xffffffff
cmp edi, dword [esp + 0x94]
jle 0x47124a
mov eax, dword [esp + 0x74]
test eax, eax
je 0x4710fa
lea edx, [esp + 0x9c]
cmp eax, edx
je 0x4710ff
call fcn.0047770d
mov eax, dword [esp + 0xac]
cmp dword [esp + 0x78], eax
je 0x471137
cmp dword [esp + 0x74], 0
jne 0x471118
call fcn.0047770d
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
cmp ecx, dword [edx + 8]
jb 0x47112a
call fcn.0047770d
mov eax, dword [esp + 0x78]
cmp dword [eax + 4], edi
jle 0x47124a
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0x1c]
movzx eax, word [ecx + edx*2 - 2]
xor ebx, ebx
lea esp, [esp]
cmp ax, word [ebx*2 + 0x49e71c]
je 0x471167
add ebx, 1
cmp ebx, 0x11
jl 0x471150
jmp 0x47124a
cmp ebx, 0x11
jae 0x47124a
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x50], ecx
jle 0x47124a
cmp dword [esp + 0x2c], 0
je 0x471246
call fcn.0046bf80
test al, al
mov eax, ecx
jne 0x471199
cdq
sub eax, edx
sar eax, 1
sub esi, eax
cmp dword [0x4a00f8], 0
jne 0x4711e3
mov ecx, dword [0x4a00e0]
mov edx, dword [esp + 0x54]
add esi, ecx
add esi, dword [esp + 0x50]
add ecx, edx
add ecx, dword [esp + 0x40]
mov dword [esp + 0x130], esi
add esi, eax
mov eax, dword [esp + 0xec]
mov dword [esp + 0x134], ecx
add ecx, eax
mov dword [esp + 0x138], esi
mov dword [esp + 0x13c], ecx
jmp 0x47122b
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx + 0x34]
mov edx, dword [0x4a00e0]
sub ecx, edx
sub ecx, dword [esp + 0x54]
add esi, edx
sub ecx, dword [esp + 0x18]
add esi, dword [esp + 0x50]
sub ecx, dword [esp + 0x40]
mov edx, dword [esp + 0xec]
mov dword [esp + 0x130], ecx
add ecx, edx
mov dword [esp + 0x134], esi
add esi, eax
mov dword [esp + 0x138], ecx
mov dword [esp + 0x13c], esi
mov eax, dword [esp + 0xc4]
mov edx, dword [esp + 0x7c]
push eax
lea ecx, [esp + 0x134]
push ecx
push edx
call dword [sym.imp.USER32.dll_FillRect]
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x54]
add eax, dword [esp + 0x140]
mov edx, dword [esp + 0xec]
mov dword [esp + 0x54], eax
xor ecx, ecx
add eax, edx
cmp eax, dword [esp + 0xf8]
mov dword [esp + 0x50], ecx
jg 0x473135
add dword [esp + 0xd4], 1
cmp dword [esp + 0xf4], ecx
je 0x4712a9
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0xd4]
push eax
push ecx
push edx
call dword [esp + 0x100]
test eax, eax
jne 0x4731b6
cmp ebx, 0x11
jb 0x472f67
cmp word [esp + 0x44], 9
je 0x471f31
cmp dword [esp + 0x2c], 0
je 0x471f31
mov eax, dword [esp + 0x698]
mov ecx, dword [esp + 0x69c]
mov edx, dword [esp + 0xc4]
mov dword [esp + 0x118], eax
push edx
lea eax, [esp + 0x114]
mov dword [esp + 0x120], ecx
mov ecx, dword [esp + 0x60]
push eax
xor esi, esi
push ecx
mov dword [esp + 0x11c], esi
mov dword [esp + 0x120], esi
call dword [sym.imp.USER32.dll_FillRect]
cmp dword [0x4a00f8], esi
jne 0x471423
mov ebx, dword [esp + 0x90]
imul ebx, dword [esp + 0x18]
mov eax, dword [0x4a00e0]
mov edx, dword [esp + 0x54]
add ebx, eax
add ebx, dword [esp + 0x50]
add eax, edx
add eax, dword [esp + 0x40]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x4713ce
cmp eax, 5
je 0x4713ce
cmp eax, 6
mov ecx, dword [esp + 0x1e0]
push esi
push 1
jne 0x4713c8
mov edi, dword [esp + 0x64]
lea eax, [esp + 0x44]
push eax
push esi
push esi
push ecx
push esi
mov esi, dword [sym.imp.GDI32.dll_ExtTextOutW]
push edi
call esi
mov eax, dword [esp + 0x1e0]
push 0
push 1
lea edx, [esp + 0x44]
push edx
push 0
push 0
push eax
mov eax, dword [esp + 0x6b0]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
push edi
call esi
mov edx, dword [esp + 0x1e0]
mov eax, dword [esp + 0x698]
push 0
push 1
lea ecx, [esp + 0x44]
push ecx
push 0
push 0
push edx
cdq
sub eax, edx
sar eax, 1
push eax
push edi
call esi
jmp 0x4713f0
lea eax, [esp + 0x4c]
jmp 0x4713dd
mov ecx, dword [esp + 0x1e0]
push 0
push 2
lea eax, [esp + 0x44]
mov edx, dword [esp + 0x64]
push eax
push 0
push 0
push ecx
push 0
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov eax, dword [esp + 0x69c]
mov ecx, dword [esp + 0x698]
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
lea edx, [esp + 0x268]
push edx
lea ecx, [esp + 0x6c4]
call fcn.00460e30
jmp 0x471dc7
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0x34]
mov ecx, dword [0x4a00e0]
mov ebx, dword [esp + 0x18]
sub eax, ecx
sub eax, dword [esp + 0x54]
xor edi, edi
sub eax, ebx
sub eax, dword [esp + 0x40]
mov dword [esp + 0xbc], esi
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x90]
imul eax, ebx
add eax, ecx
add eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x4c], eax
mov eax, ecx
mov dword [esp + 0x20], edi
call fcn.0046bf80
test al, al
jne 0x471579
add ecx, 0xffffffd0
cmp cx, 9
ja 0x4714c2
mov ecx, dword [esp + 0x1c]
cmp ecx, esi
je 0x4714ae
mov edx, dword [esp + 0xd0]
mov ax, word [edx + ecx*2 - 2]
call fcn.0046bfa0
cmp eax, 1
je 0x4714c2
mov ax, word [edx + ecx*2 + 2]
call fcn.0046bfa0
cmp eax, 1
je 0x4714c2
mov dword [esp + 0xbc], 3
mov edi, 4
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x471686
cmp eax, 5
je 0x471686
cmp eax, 6
mov edx, dword [esp + 0x1e0]
jne 0x47165a
mov esi, dword [esp + 0xc8]
mov eax, dword [esp + 0x5c]
imul esi, ebx
mov ebx, dword [sym.imp.GDI32.dll_ExtTextOutW]
push 0
push 1
lea ecx, [esp + 0x44]
push ecx
push 0
push 0
push 0
add edx, esi
push edx
push eax
mov dword [esp + 0x88], esi
call ebx
mov eax, dword [esp + 0x698]
push 0
push 1
cdq
lea ecx, [esp + 0x44]
push ecx
and edx, 3
push 0
add eax, edx
mov edx, dword [esp + 0x1f0]
push 0
sar eax, 2
push eax
mov eax, dword [esp + 0x74]
add edx, esi
push edx
push eax
call ebx
mov eax, dword [esp + 0x698]
push 0
push 1
cdq
lea ecx, [esp + 0x44]
push ecx
push 0
sub eax, edx
mov edx, dword [esp + 0x1f0]
push 0
sar eax, 1
push eax
mov eax, dword [esp + 0x74]
add edx, esi
push edx
push eax
call ebx
xor esi, esi
jmp 0x4716b7
xor eax, eax
jmp 0x471580
cmp cx, word [eax + 0x49e76c]
je 0x471593
add eax, 2
cmp eax, 0xe
jb 0x471580
jmp 0x47159e
mov dword [esp + 0xbc], 1
xor eax, eax
cmp cx, word [eax*2 + 0x4a1470]
je 0x4715b4
add eax, 1
cmp eax, 1
jl 0x4715a0
jmp 0x4715c4
mov edi, 1
mov dword [esp + 0x104], eax
mov dword [esp + 0x20], edi
xor eax, eax
cmp cx, word [eax*2 + 0x49e780]
je 0x4715da
add eax, 1
cmp eax, 4
jl 0x4715c6
jmp 0x4715f9
cmp eax, esi
jne 0x4715e5
mov edi, 2
jmp 0x4715f5
mov edi, 5
mov dword [esp + 0xbc], 2
mov dword [esp + 0x20], edi
xor eax, eax
jmp 0x471600
cmp cx, word [eax*2 + 0x49e788]
je 0x471614
add eax, 1
cmp eax, 4
jl 0x471600
jmp 0x471633
cmp eax, esi
jne 0x47161f
mov edi, 3
jmp 0x47162f
mov edi, 6
mov dword [esp + 0xbc], 2
mov dword [esp + 0x20], edi
xor eax, eax
jmp 0x471640
cmp cx, word [eax + 0x49e77c]
je 0x4714b9
add eax, 2
cmp eax, 4
jb 0x471640
jmp 0x4714c2
mov eax, dword [esp + 0xc8]
push esi
imul eax, ebx
push 1
lea ecx, [esp + 0x4c]
push ecx
push esi
push esi
push esi
add edx, eax
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x74]
push edx
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutW]
jmp 0x4716c2
mov eax, dword [esp + 0xc8]
mov edx, dword [esp + 0x1e0]
imul eax, ebx
push esi
push 2
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
push esi
add edx, eax
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x74]
push edx
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov dword [esp + 0xbc], 3
cmp edi, esi
je 0x471d43
movzx eax, word [esp + 0x26e]
imul eax, dword [esp + 0x264]
mov ecx, dword [esp + 0x11c]
mov esi, dword [esp + 0x268]
mov edi, dword [esp + 0x118]
mov ebx, dword [esp + 0x110]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x114]
sub esi, ecx
add eax, 3
and eax, 0xfffffffc
sub esi, 1
imul esi, eax
add esi, dword [esp + 0x688]
neg eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x11c]
sub eax, ecx
mov dword [esp + 0x8c], ecx
mov ecx, dword [esp + 0x68c]
and ecx, 0xff
mov dword [esp + 0x80], edi
sub edi, ebx
cmp ecx, 0x10
mov dword [esp + 0x88], ebx
mov dword [esp + 0x48], edi
mov dword [esp + 0x60], ecx
jne 0x4717e8
xor edx, edx
test eax, eax
mov edi, esi
jle 0x471894
xor ecx, ecx
cmp dword [esp + 0x48], ecx
jle 0x4717d8
lea ecx, [ecx]
movzx ebx, word [esi]
cmp word [edi + ecx*2], bx
je 0x4717cf
cmp ecx, dword [esp + 0x80]
jge 0x471799
mov dword [esp + 0x80], ecx
cmp ecx, dword [esp + 0x88]
jl 0x4717ac
lea ebx, [ecx + 1]
mov dword [esp + 0x88], ebx
cmp edx, dword [esp + 0x84]
jge 0x4717bc
mov dword [esp + 0x84], edx
cmp edx, dword [esp + 0x8c]
jl 0x4717cf
lea ebx, [edx + 1]
mov dword [esp + 0x8c], ebx
add ecx, 1
cmp ecx, dword [esp + 0x48]
jl 0x471780
add edi, dword [esp + 0x28]
add edx, 1
cmp edx, eax
jl 0x471775
jmp 0x471894
mov dl, byte [esi + 2]
lea ecx, [esi + 2]
mov byte [esp + 0x5b], dl
xor edx, edx
test eax, eax
jle 0x471894
mov ebx, ecx
mov dword [esp + 0x38], ecx
xor ecx, ecx
test edi, edi
jle 0x471881
mov edi, ebx
mov edi, edi
mov bl, byte [esi]
cmp byte [edi - 2], bl
jne 0x471827
mov bl, byte [esi + 1]
cmp byte [edi - 1], bl
jne 0x471827
mov bl, byte [esp + 0x5b]
cmp byte [edi], bl
je 0x47186d
cmp ecx, dword [esp + 0x80]
jge 0x471837
mov dword [esp + 0x80], ecx
cmp ecx, dword [esp + 0x88]
jl 0x47184a
lea ebx, [ecx + 1]
mov dword [esp + 0x88], ebx
cmp edx, dword [esp + 0x84]
jge 0x47185a
mov dword [esp + 0x84], edx
cmp edx, dword [esp + 0x8c]
jl 0x47186d
lea ebx, [edx + 1]
mov dword [esp + 0x8c], ebx
add ecx, 1
add edi, 3
cmp ecx, dword [esp + 0x48]
jl 0x471810
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x48]
add ebx, dword [esp + 0x28]
add edx, 1
cmp edx, eax
mov dword [esp + 0x38], ebx
jl 0x471802
mov ebx, dword [esp + 0x88]
mov ecx, dword [esp + 0x8c]
mov edi, dword [esp + 0x20]
sub ecx, dword [esp + 0x84]
mov edx, ebx
sub edx, dword [esp + 0x80]
cmp edi, 1
mov dword [esp + 0x38], edx
jne 0x471923
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x80]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
sub edi, eax
sub edi, ebx
add edi, dword [esp + 0x118]
cmp dword [esp + 0x104], 4
mov dword [esp + 0xcc], edi
jge 0x471909
mov eax, dword [esp + 0x11c]
sub eax, dword [esp + 0x8c]
mov dword [esp + 0xc0], eax
jmp 0x471a3c
mov eax, dword [esp + 0x69c]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0xc0], eax
jmp 0x471a3c
cmp edi, 2
jne 0x471952
mov eax, dword [esp + 0x11c]
mov edi, dword [esp + 0x80]
sub eax, ecx
sub eax, dword [esp + 0x84]
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc0], eax
jmp 0x471a3c
cmp edi, 3
jne 0x47197f
mov eax, dword [esp + 0x11c]
sub eax, dword [esp + 0x8c]
mov edi, dword [esp + 0x80]
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc0], eax
jmp 0x471a3c
cmp edi, 4
jne 0x4719dd
cmp dword [esp + 0xbc], 0
jne 0x4719b8
mov eax, dword [esp + 0x118]
sub eax, edx
cdq
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x84]
sar edi, 1
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc0], eax
jmp 0x471a3c
mov eax, dword [esp + 0x11c]
mov edi, dword [esp + 0x80]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc0], eax
jmp 0x471a3c
cmp edi, 5
jne 0x471a02
mov edi, dword [esp + 0x118]
mov eax, dword [esp + 0x84]
sub edi, ebx
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc0], eax
jmp 0x471a3c
cmp edi, 6
jne 0x471a2e
mov edi, dword [esp + 0x118]
mov eax, dword [esp + 0x11c]
sub edi, ebx
sub eax, dword [esp + 0x8c]
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc0], eax
jmp 0x471a3c
mov eax, dword [esp + 0xc0]
mov edi, dword [esp + 0xcc]
test edi, edi
jge 0x471a49
xor edi, edi
mov dword [esp + 0xcc], edi
test eax, eax
jge 0x471a56
xor eax, eax
mov dword [esp + 0xc0], eax
cmp dword [esp + 0x60], 0x10
jne 0x471b8f
movzx edx, word [esi]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
cmp eax, edx
jl 0x471b14
jne 0x471a86
cmp edi, dword [esp + 0x80]
jle 0x471b14
mov ebx, dword [esp + 0x28]
lea edx, [ecx + edx - 1]
imul ebx, edx
add ebx, esi
test ecx, ecx
mov esi, dword [esp + 0x80]
lea ebx, [ebx + esi*2]
jle 0x471d43
mov esi, dword [esp + 0x38]
sub edi, dword [esp + 0x80]
sub eax, edx
lea eax, [eax + ecx - 1]
imul eax, dword [esp + 0x28]
add esi, 0xffffffff
add eax, ebx
mov dword [esp + 0x48], esi
lea esi, [eax + edi*2]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x38], esi
mov edx, dword [esp + 0x48]
test edx, edx
jl 0x471afc
lea eax, [ebx + edx*2]
sub esi, ebx
mov di, word [eax]
mov word [esi + eax], di
mov word [eax], cx
sub edx, 1
sub eax, 2
test edx, edx
jge 0x471ae4
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x38]
sub esi, eax
sub ebx, eax
sub dword [esp + 0x20], 1
mov dword [esp + 0x38], esi
jne 0x471ad7
jmp 0x471d43
mov ebx, dword [esp + 0x28]
imul ebx, edx
mov edx, dword [esp + 0x80]
add ebx, esi
test ecx, ecx
lea esi, [ebx + edx*2]
jle 0x471d43
sub edi, dword [esp + 0x80]
mov edx, eax
sub edx, dword [esp + 0x84]
mov eax, dword [esp + 0x28]
imul edx, eax
add edx, esi
lea ebx, [edx + edi*2]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x48], ecx
test edi, edi
jle 0x471b7f
mov edx, ebx
mov eax, esi
sub edx, esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
movzx ecx, word [esp + 0x60]
mov word [eax], cx
add eax, 2
sub edi, 1
jne 0x471b60
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x38]
add esi, eax
add ebx, eax
sub dword [esp + 0x48], 1
jne 0x471b53
jmp 0x471d43
movzx edx, byte [esi]
mov byte [esp + 0xb2], dl
movzx edx, byte [esi + 1]
mov byte [esp + 0xb3], dl
movzx edx, byte [esi + 2]
mov byte [esp + 0x5b], dl
mov edx, dword [esp + 0x84]
cmp eax, edx
jl 0x471c8d
jne 0x471bca
cmp edi, dword [esp + 0x80]
jle 0x471c8d
mov ebx, dword [esp + 0x28]
lea edx, [ecx + edx - 1]
imul ebx, edx
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x80]
add ebx, esi
lea edx, [edx + edx*2]
add edx, ebx
test ecx, ecx
jle 0x471d43
sub eax, dword [esp + 0x60]
mov esi, dword [esp + 0x38]
lea ebx, [eax + ecx - 1]
imul ebx, dword [esp + 0x28]
add esi, 0xffffffff
mov eax, edi
sub eax, dword [esp + 0x80]
mov dword [esp + 0x48], esi
lea esi, [eax + eax*2]
add ebx, edx
add esi, ebx
mov dword [esp + 0x60], esi
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x48]
test ecx, ecx
jl 0x471c75
lea eax, [ecx + ecx*2]
lea edi, [eax + esi]
lea eax, [eax + edx + 2]
sub esi, edx
movzx ebx, byte [eax - 2]
mov byte [edi], bl
movzx ebx, byte [eax - 1]
mov byte [eax + esi - 1], bl
movzx ebx, byte [eax]
mov byte [eax + esi], bl
movzx ebx, byte [esp + 0xb2]
mov byte [eax - 2], bl
movzx ebx, byte [esp + 0xb3]
mov byte [eax - 1], bl
movzx ebx, byte [esp + 0x5b]
mov byte [eax], bl
sub ecx, 1
sub edi, 3
sub eax, 3
test ecx, ecx
jge 0x471c33
mov esi, dword [esp + 0x60]
mov eax, dword [esp + 0x28]
sub esi, eax
sub edx, eax
sub dword [esp + 0x38], 1
mov dword [esp + 0x60], esi
jne 0x471c1f
jmp 0x471d43
mov eax, dword [esp + 0x28]
imul eax, dword [esp + 0x84]
mov ebx, dword [esp + 0x80]
add eax, esi
lea ebx, [ebx + ebx*2]
add ebx, eax
test ecx, ecx
jle 0x471d43
mov edx, dword [esp + 0xc0]
sub edx, dword [esp + 0x84]
mov eax, dword [esp + 0xcc]
imul edx, dword [esp + 0x28]
sub eax, dword [esp + 0x80]
add edx, ebx
lea eax, [eax + eax*2]
add eax, edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x60], ecx
nop
cmp dword [esp + 0x38], 0
jle 0x471d32
mov edx, dword [esp + 0x48]
mov edi, dword [esp + 0x38]
mov esi, edx
lea eax, [ebx + 2]
sub edx, ebx
movzx ecx, byte [eax - 2]
mov byte [esi], cl
movzx ecx, byte [eax - 1]
mov byte [edx + eax - 1], cl
movzx ecx, byte [eax]
mov byte [edx + eax], cl
movzx ecx, byte [esp + 0xb2]
mov byte [eax - 2], cl
movzx ecx, byte [esp + 0xb3]
mov byte [eax - 1], cl
movzx ecx, byte [esp + 0x5b]
mov byte [eax], cl
add esi, 3
add eax, 3
sub edi, 1
jne 0x471cf6
mov eax, dword [esp + 0x28]
add dword [esp + 0x48], eax
add ebx, eax
sub dword [esp + 0x60], 1
jne 0x471ce0
mov esi, dword [esp + 0xbc]
test esi, esi
push 0
push 0
lea edx, [esp + 0x254]
push 0
je 0x471da2
mov eax, dword [esp + 0x74]
push eax
push eax
push 0
push 0
push edx
lea ecx, [esp + 0x13d4]
call fcn.00409890
push 0
push 0
push 0
push esi
lea ecx, [esp + 0x13c4]
call fcn.00466af0
mov eax, dword [esp + 0x1804]
mov ecx, dword [esp + 0x1800]
push 0
push 0
push 0
lea edx, [esp + 0x13c0]
jmp 0x471db0
mov eax, dword [esp + 0x6a8]
mov ecx, dword [esp + 0x6a4]
push eax
push ecx
push 0
push 0
push edx
lea ecx, [esp + 0x6c4]
call fcn.00460e30
mov ebx, dword [esp + 0x64]
mov eax, dword [esp + 0xd8]
test eax, eax
mov esi, dword [esp + 0x18]
mov edi, esi
je 0x471de3
lea ecx, [esp + 0x9c]
cmp eax, ecx
je 0x471def
call fcn.0047770d
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
cmp ecx, dword [esp + 0xac]
je 0x471e93
test eax, eax
jne 0x471e1a
call fcn.0047770d
mov ecx, dword [esp + 0xdc]
mov eax, dword [esp + 0xd8]
cmp ecx, dword [eax + 8]
jb 0x471e4a
call fcn.0047770d
mov ecx, dword [esp + 0xdc]
mov eax, dword [esp + 0xd8]
cmp ecx, dword [eax + 8]
jb 0x471e4a
call fcn.0047770d
mov ecx, dword [esp + 0xdc]
mov eax, dword [esp + 0xd8]
mov edx, dword [ecx + 8]
add edx, dword [ecx + 4]
cmp dword [esp + 0x1c], edx
jge 0x471e93
cmp ecx, dword [eax + 8]
jb 0x471e67
call fcn.0047770d
mov ecx, dword [esp + 0xdc]
cmp dword [ecx], 0xc
mov esi, dword [esp + 0x18]
jne 0x471e88
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp dword [0x4a00f8], 0
jne 0x471e86
add dword [esp + 0x4c], eax
jmp 0x471e88
add ebx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x471ea1
cmp eax, 4
jne 0x471ea3
add esi, esi
cmp dword [esp + 0xe8], 3
push 0
push 0
push 0
push 6
lea ecx, [esp + 0x6b4]
push esi
jne 0x471ef8
lea edi, [edi + edi*2]
push edi
push esi
push edi
push 0
push 0
call fcn.00460ea0
mov eax, dword [esp + 0xaf4]
mov ecx, dword [esp + 0xaf0]
mov edx, dword [esp + 0x4c]
push 0
push 0
push eax
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push ebx
lea eax, [esp + 0x6bc]
call fcn.0046c1b0
jmp 0x471f2e
push edi
push esi
push edi
push 0
push 0
call fcn.00460ea0
mov ecx, dword [esp + 0xaf4]
mov edx, dword [esp + 0x4c]
push 0
push 0
lea eax, [esp + 0x6ac]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0xb00]
push edx
push ebx
call fcn.0046c080
add esp, 0x18
mov eax, dword [esp + 0x14]
test eax, eax
je 0x471f4c
cmp eax, 4
jge 0x471f45
add dword [esp + 0x1c], 1
jmp 0x471f4c
jne 0x471f4c
add dword [esp + 0x1c], 2
mov eax, dword [esp + 0x74]
test eax, eax
je 0x471f5f
lea ecx, [esp + 0x9c]
cmp eax, ecx
je 0x471f64
call fcn.0047770d
mov ebx, dword [esp + 0x78]
cmp ebx, dword [esp + 0xac]
je 0x47273b
mov esi, dword [esp + 0x74]
test esi, esi
jne 0x471f82
call fcn.0047770d
cmp ebx, dword [esi + 8]
jb 0x471f8c
call fcn.0047770d
mov edx, dword [esp + 0x1c]
cmp dword [ebx + 4], edx
jg 0x47273b
cmp byte [esp + 0x33], 0
mov edi, dword [esp + 0x50]
je 0x471fb9
mov eax, edx
mov dword [esp + 0x14c], edi
mov dword [esp + 0x108], eax
mov byte [esp + 0x33], 0
mov esi, dword [esp + 0x74]
cmp ebx, dword [esi + 8]
jb 0x471fd1
call fcn.0047770d
cmp ebx, dword [esi + 8]
jb 0x471fd1
call fcn.0047770d
mov ecx, dword [ebx + 8]
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [ebx + 4]
lea edx, [esp + 0x98]
push edx
call fcn.0046c9e0
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x154]
add esp, 8
add eax, edi
cmp ebx, dword [esi + 8]
mov dword [esp + 0x68], eax
jb 0x472015
call fcn.0047770d
cmp ebx, dword [esi + 8]
jb 0x472015
call fcn.0047770d
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 4]
lea eax, [ecx + edx - 1]
cmp eax, dword [esp + 0x1c]
jle 0x472048
mov ecx, dword [esp + 0x90]
imul ecx, dword [esp + 0x18]
add ecx, dword [esp + 0x4c]
add ecx, edi
cmp ecx, dword [esp + 0xe0]
jle 0x47273b
mov esi, dword [esp + 0x74]
cmp ebx, dword [esi + 8]
jb 0x472052
call fcn.0047770d
cmp ebx, dword [esi + 8]
mov edi, dword [ebx + 0x10]
mov dword [esp + 0x48], edi
jb 0x472063
call fcn.0047770d
mov edx, dword [esp + 0x108]
cmp dword [ebx + 4], edx
jge 0x472114
cmp dword [esp + 0x4c], 0
jle 0x472114
cmp ebx, dword [esi + 8]
jb 0x472092
call fcn.0047770d
cmp ebx, dword [esi + 8]
jb 0x472092
call fcn.0047770d
mov ecx, dword [ebx + 4]
mov eax, dword [esp + 0x108]
sub eax, ecx
push eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x98]
push edx
call fcn.0046c9e0
mov esi, eax
mov eax, dword [esp + 0x7c]
add esp, 8
cmp ebx, dword [eax + 8]
jb 0x4720c3
call fcn.0047770d
mov eax, dword [ebx + 0x14]
imul eax, esi
cdq
idiv dword [esp + 0x4c]
mov ecx, dword [esp + 0x74]
add edi, eax
cmp ebx, dword [ecx + 8]
mov dword [esp + 0x48], edi
jb 0x4720e2
call fcn.0047770d
cmp edi, dword [ebx + 0x10]
jle 0x472114
mov edx, dword [esp + 0xd0]
movzx ecx, word [edx + edi*2]
xor eax, eax
cmp cx, word [eax*2 + 0x49e740]
je 0x472108
add eax, 1
cmp eax, 0x16
jl 0x4720f4
jmp 0x472114
cmp eax, 0x16
jae 0x472114
add edi, 1
mov dword [esp + 0x48], edi
mov esi, dword [esp + 0x74]
cmp ebx, dword [esi + 8]
jb 0x47212c
call fcn.0047770d
cmp ebx, dword [esi + 8]
jb 0x47212c
call fcn.0047770d
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
lea edx, [eax + ecx - 1]
cmp edx, dword [esp + 0x1c]
jg 0x472178
cmp ebx, dword [esi + 8]
mov byte [esp + 0x33], 1
jb 0x472155
call fcn.0047770d
cmp ebx, dword [esi + 8]
jb 0x472155
call fcn.0047770d
mov esi, dword [ebx + 0x14]
lea eax, [esp + 0x9c]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0xac]
sub esi, edi
add esi, dword [ebx + 0x10]
mov dword [esp + 0x78], eax
jmp 0x47226c
mov esi, dword [esp + 0x108]
sub esi, dword [esp + 0x1c]
add esi, 2
mov ecx, dword [esp + 0x74]
cmp ebx, dword [ecx + 8]
jb 0x472194
call fcn.0047770d
cmp esi, dword [ebx + 8]
jg 0x47273b
mov ecx, dword [esp + 0x108]
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x94]
push esi
push edx
call fcn.0046c9e0
add esp, 8
cmp eax, dword [esp + 0x68]
jg 0x4721c4
add esi, 1
jmp 0x472186
mov ecx, dword [esp + 0x90]
imul ecx, dword [esp + 0x18]
add ecx, eax
add ecx, dword [esp + 0x50]
cmp ecx, dword [esp + 0xe0]
jle 0x47273b
mov edx, dword [esp + 0x74]
cmp ebx, dword [edx + 8]
mov byte [esp + 0x33], 1
jb 0x4721f6
call fcn.0047770d
mov eax, dword [ebx + 0x14]
imul eax, dword [esp + 0x68]
cdq
idiv dword [esp + 0x4c]
mov esi, eax
test esi, esi
mov dword [esp + 0x38], esi
jle 0x47273b
mov eax, dword [esp + 0x74]
cmp ebx, dword [eax + 8]
jb 0x47221f
call fcn.0047770d
mov ecx, dword [esp + 0x74]
cmp ebx, dword [ecx + 8]
jb 0x47222d
call fcn.0047770d
mov edx, dword [ebx + 0x10]
add edx, dword [ebx + 0x14]
lea ecx, [esi + edi]
cmp ecx, edx
jg 0x472270
mov edx, dword [esp + 0xd0]
movzx ecx, word [edx + ecx*2]
xor eax, eax
jmp 0x472250
cmp cx, word [eax*2 + 0x49e740]
je 0x472264
add eax, 1
cmp eax, 0x16
jl 0x472250
jmp 0x472270
cmp eax, 0x16
jae 0x472270
add esi, 1
mov dword [esp + 0x38], esi
test esi, esi
jle 0x47273b
cmp dword [esp + 0x2c], 0
je 0x47273b
cmp dword [esp + 0x4c], 0
jne 0x47228e
fldz
jmp 0x4722cf
mov ecx, dword [esp + 0x68]
mov eax, esi
imul eax, dword [esp + 0x40]
cmp ecx, eax
jge 0x4722b8
fldz
sub ecx, eax
fstp qword [esp + 0x16c]
mov dword [esp + 0x64], ecx
fild dword [esp + 0x64]
fmul qword [0x48b848]
jmp 0x4722d6
sub ecx, eax
mov dword [esp + 0x64], ecx
fild dword [esp + 0x64]
lea eax, [esi + 1]
mov dword [esp + 0x64], eax
fild dword [esp + 0x64]
fdivp st(1)
fst qword [esp + 0x16c]
test esi, esi
fstp qword [esp + 0x164]
mov dword [esp + 0x14], 0
jle 0x47273b
mov ecx, dword [esp + 0x90]
imul ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14c]
add ecx, edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x40]
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x60], eax
mov eax, ecx
neg eax
mov dword [esp + 0x68], eax
mov eax, ecx
neg eax
add eax, eax
imul ebx, ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xd0]
lea edx, [eax + ecx*2]
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], edx
nop
mov eax, dword [esp + 0x13a8]
mov ecx, dword [esp + 0x13ac]
mov edx, dword [esp + 0xc4]
mov dword [esp + 0x1cc], eax
push edx
lea eax, [esp + 0x1c8]
mov dword [esp + 0x1d4], ecx
mov ecx, dword [esp + 0xe8]
push eax
xor esi, esi
push ecx
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1d4], esi
call dword [sym.imp.USER32.dll_FillRect]
mov edx, dword [esp + 0x20]
movzx eax, word [edx]
mov ecx, dword [0x4a00f8]
cmp ecx, 1
mov dword [esp + 0x4c], esi
mov dword [esp + 0x44], eax
jne 0x472450
cmp ax, 0xff0f
jne 0x4723d8
movzx eax, word [edx + 2]
cmp ax, 0xff3c
jne 0x47241e
mov dword [esp + 0x4c], 3
mov dword [esp + 0x44], 0x304f
mov edx, dword [esp + 0x34]
fldz
mov esi, dword [edx + 0x34]
fld qword [esp + 0x164]
sub esi, dword [esp + 0x60]
fcom st(1)
mov eax, dword [0x4a00e0]
mov ecx, dword [esp + 0x64]
sub esi, eax
sub esi, dword [esp + 0x54]
lea edi, [ecx + eax]
fnstsw ax
sub esi, dword [esp + 0x40]
fld st(0)
test ah, 5
fld qword [0x48b848]
jp 0x47254c
fsub st(1), st(0)
jmp 0x47254e
cmp ax, 0x2033
jne 0x4723d8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0xd0]
add edx, eax
cmp word [ecx + edx*2 + 4], 0xff3c
jne 0x4723d8
mov dword [esp + 0x4c], 4
mov dword [esp + 0x44], 0x3050
jmp 0x4723d8
cmp ecx, esi
jne 0x4723d8
fldz
mov eax, dword [0x4a00e0]
fld qword [esp + 0x164]
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
fcom st(1)
lea edi, [ecx + eax]
add edi, dword [esp + 0x54]
lea esi, [edx + eax]
fnstsw ax
fld st(0)
test ah, 5
fld qword [0x48b848]
jp 0x472489
fsub st(1), st(0)
jmp 0x47248b
fadd st(1), st(0)
fxch st(1)
call fcn.00478370
add eax, esi
jns 0x4724a2
mov esi, dword [esp + 0x28]
fstp st(1)
fstp st(0)
fstp st(0)
jmp 0x472500
fild dword [esp + 0x40]
fadd qword [esp + 0x16c]
fild dword [esp + 0x38]
fmul st(1)
fadd st(3)
fcom st(4)
fnstsw ax
test ah, 5
jp 0x4724c2
fsub st(2)
jmp 0x4724c4
fadd st(2)
call fcn.00478370
mov edx, dword [esp + 0x34]
mov ecx, dword [edx + 0x34]
cmp eax, ecx
jle 0x4724e2
fstp st(2)
sub ecx, ebx
fstp st(1)
mov esi, ecx
fstp st(0)
fstp st(0)
jmp 0x472500
fimul dword [esp + 0x14]
faddp st(2)
fxch st(2)
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x4724f7
fsubrp st(1)
jmp 0x4724f9
faddp st(1)
call fcn.00478370
add esi, eax
mov ecx, dword [esp + 0x21c]
mov edx, dword [esp + 0xe4]
push 0
push 1
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push ecx
push 0
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov eax, dword [esp + 0x13ac]
mov ecx, dword [esp + 0x13a8]
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
lea edx, [esp + 0xf78]
push edx
jmp 0x472616
fadd st(1), st(0)
fxch st(1)
call fcn.00478370
add eax, edi
jns 0x472565
mov edi, dword [esp + 0x28]
fstp st(1)
fstp st(0)
fstp st(0)
jmp 0x4725c3
fild dword [esp + 0x40]
fadd qword [esp + 0x16c]
fild dword [esp + 0x38]
fmul st(1)
fadd st(3)
fcom st(4)
fnstsw ax
test ah, 5
jp 0x472585
fsub st(2)
jmp 0x472587
fadd st(2)
call fcn.00478370
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx + 0x38]
cmp eax, ecx
jle 0x4725a5
fstp st(2)
sub ecx, ebx
fstp st(1)
mov edi, ecx
fstp st(0)
fstp st(0)
jmp 0x4725c3
fimul dword [esp + 0x14]
faddp st(2)
fxch st(2)
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x4725ba
fsubrp st(1)
jmp 0x4725bc
faddp st(1)
call fcn.00478370
add edi, eax
mov eax, dword [esp + 0xc8]
imul eax, dword [esp + 0x40]
add eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0xe4]
push 0
push 1
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov edx, dword [esp + 0x13ac]
mov eax, dword [esp + 0x13a8]
push 0
push 0
push 0
push edx
push eax
push 0
push 0
lea ecx, [esp + 0xf78]
push ecx
lea ecx, [esp + 0x6c4]
call fcn.00460e30
mov ecx, dword [esp + 0x4c]
cmp ecx, 3
mov eax, dword [esp + 0x40]
je 0x472634
cmp ecx, 4
jne 0x472636
add eax, eax
cmp dword [esp + 0xe8], 3
mov ecx, dword [esp + 0x40]
push 0
push 0
push 0
push 6
push eax
jne 0x47268b
lea ecx, [ecx + ecx*2]
push ecx
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x6cc]
call fcn.00460ea0
mov edx, dword [esp + 0xaf4]
mov eax, dword [esp + 0xaf0]
mov ecx, dword [esp + 0x2c]
push 0
push 0
push edx
push eax
push edi
push esi
lea eax, [esp + 0x6bc]
call fcn.0046c1b0
jmp 0x4726c4
push ecx
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x6cc]
call fcn.00460ea0
mov edx, dword [esp + 0xaf4]
mov eax, dword [esp + 0x2c]
push 0
push 0
lea ecx, [esp + 0x6ac]
push ecx
mov ecx, dword [esp + 0xafc]
push edx
push edi
push esi
call fcn.0046c080
mov eax, dword [esp + 0x64]
add esp, 0x18
test eax, eax
je 0x472715
cmp eax, 3
jne 0x4726de
mov eax, dword [esp + 0x40]
add dword [esp + 0x28], eax
jmp 0x472707
cmp eax, 4
jne 0x4726ff
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x40]
add dword [esp + 0x14], 2
add eax, eax
add dword [esp + 0x28], eax
add ebx, dword [esp + 0xbc]
jmp 0x472715
mov ecx, dword [esp + 0x40]
add dword [esp + 0x28], ecx
add dword [esp + 0x14], 1
add dword [esp + 0x20], 2
add ebx, dword [esp + 0x68]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x40]
add dword [esp + 0x20], 2
add dword [esp + 0x28], edx
add ebx, dword [esp + 0x68]
add eax, 1
cmp eax, dword [esp + 0x38]
mov dword [esp + 0x14], eax
jl 0x472350
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x47274e
lea ecx, [esp + 0x9c]
cmp eax, ecx
je 0x472753
call fcn.0047770d
mov edx, dword [esp + 0xac]
cmp dword [esp + 0x70], edx
je 0x472f5a
mov esi, dword [esp + 0x6c]
test esi, esi
jne 0x472771
call fcn.0047770d
mov edi, dword [esp + 0x70]
cmp edi, dword [esi + 8]
jb 0x47277f
call fcn.0047770d
mov eax, dword [esp + 0x1c]
cmp dword [edi + 4], eax
jg 0x472f5a
cmp dword [esp + 0x2c], 0
je 0x472f18
cmp dword [0x4a00f8], 0
mov eax, dword [0x4a00e0]
mov edi, dword [esp + 0x70]
jne 0x472b40
mov esi, dword [esp + 0x90]
imul esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x40]
add esi, eax
add esi, dword [esp + 0x50]
add eax, ecx
lea ebx, [eax + edx - 1]
mov eax, dword [esp + 0x6c]
cmp edi, dword [eax + 8]
mov dword [esp + 0x20], esi
jb 0x4727df
call fcn.0047770d
cmp dword [edi], 7
jne 0x472807
mov edi, dword [esp + 0x7c]
push 0
push ebx
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [esp + 0x24]
push ebx
add ecx, esi
push ecx
push edi
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x472f18
mov edx, dword [esp + 0x6c]
cmp edi, dword [edx + 8]
jb 0x472815
call fcn.0047770d
cmp dword [edi], 6
jne 0x472983
mov eax, dword [esp + 0x698]
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0x69c]
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x17c], eax
push edx
lea eax, [esp + 0x178]
push eax
xor edi, edi
push esi
mov dword [esp + 0x180], edi
mov dword [esp + 0x184], edi
mov dword [esp + 0x18c], ecx
call dword [sym.imp.USER32.dll_FillRect]
mov edx, dword [esp + 0x1e0]
push edi
push 1
lea ecx, [esp + 0x4c]
push ecx
push edi
push edi
push edx
push edi
push esi
mov dword [esp + 0x64], 0x3001
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov eax, dword [esp + 0x69c]
mov ecx, dword [esp + 0x698]
push edi
push edi
push edi
push eax
push ecx
push edi
push edi
lea edx, [esp + 0x268]
push edx
lea ecx, [esp + 0x6c4]
call fcn.00460e30
mov edi, dword [esp + 0x18]
lea ecx, [edi + edi]
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x55555556
imul edi
mov eax, dword [esp + 0x18]
push 0
push 0
mov edi, edx
shr edi, 0x1f
push 0
add edi, edx
cmp dword [esp + 0xf4], 3
push 6
push eax
jne 0x472941
mov ecx, dword [esp + 0x6ac]
push ecx
push eax
lea edx, [eax + eax*2]
push edx
push 0
push 0
lea ecx, [esp + 0x6cc]
call fcn.00460ea0
mov eax, dword [esp + 0x18]
mov ecx, eax
push esi
sub ecx, esi
sub esi, eax
mov eax, dword [esp + 0x28]
push 0
push ecx
mov ecx, dword [esp + 0x38]
sub eax, edi
lea edx, [edi + edi*2]
push edx
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x30]
add esi, ebx
push esi
push eax
lea eax, [esp + 0x6bc]
call fcn.0046c1b0
jmp 0x472f15
push eax
push eax
push eax
push 0
push 0
lea ecx, [esp + 0x6cc]
call fcn.00460ea0
push esi
push 0
lea eax, [esp + 0x6ac]
push eax
mov eax, dword [esp + 0x24]
mov ecx, eax
sub ecx, esi
sub esi, eax
mov eax, dword [esp + 0x30]
sub eax, edi
cdq
sub eax, edx
push ecx
add esi, ebx
sar eax, 1
add eax, dword [esp + 0x30]
push esi
mov ecx, edi
jmp 0x472f0b
mov edx, dword [esp + 0x6c]
cmp edi, dword [edx + 8]
jb 0x472991
call fcn.0047770d
cmp dword [edi], 8
je 0x4729b1
mov eax, dword [esp + 0x6c]
cmp edi, dword [eax + 8]
jb 0x4729a4
call fcn.0047770d
cmp dword [edi], 9
jne 0x472f18
mov edi, dword [esp + 0x70]
mov ecx, dword [esp + 0x698]
mov edx, dword [esp + 0x69c]
xor eax, eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x1bc], ecx
push eax
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x1c4], edx
mov edx, dword [esp + 0x60]
push ecx
push edx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [esp + 0x6c]
cmp edi, dword [eax + 8]
jb 0x472a06
call fcn.0047770d
cmp dword [edi], 8
jne 0x472a14
mov ecx, dword [0x4a00d4]
push ecx
jmp 0x472a1b
mov edx, dword [0x4a00d0]
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, eax
mov eax, dword [esp + 0x7c]
push esi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x7c]
mov edi, eax
mov eax, dword [esp + 0x69c]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x69c]
cdq
sub eax, edx
sar eax, 1
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_Ellipse]
mov edx, dword [esp + 0x7c]
push edi
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x69c]
mov ecx, dword [esp + 0x698]
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
lea edx, [esp + 0x268]
push edx
lea ecx, [esp + 0x6c4]
call fcn.00460e30
mov ecx, dword [esp + 0x18]
mov eax, ecx
push 0
cdq
push 0
sub eax, edx
push 0
mov esi, eax
sar esi, 1
cmp dword [esp + 0xf4], 3
push 6
push ecx
jne 0x472b09
mov eax, dword [esp + 0x6ac]
push eax
push ecx
lea ecx, [ecx + ecx*2]
push ecx
push 0
push 0
lea ecx, [esp + 0x6cc]
call fcn.00460ea0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
push 0
push 0
sub eax, esi
push esi
lea edx, [esi + esi*2]
push edx
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x30]
sub ebx, esi
push ebx
push eax
lea eax, [esp + 0x6bc]
call fcn.0046c1b0
jmp 0x472f15
push ecx
push ecx
push ecx
push 0
push 0
lea ecx, [esp + 0x6cc]
call fcn.00460ea0
push 0
push 0
lea eax, [esp + 0x6ac]
push eax
mov eax, dword [esp + 0x30]
sub eax, esi
cdq
sub eax, edx
sub ebx, esi
push esi
sar eax, 1
add eax, dword [esp + 0x30]
push ebx
jmp 0x472f09
mov ebx, dword [esp + 0x90]
imul ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
mov esi, dword [ecx + 0x34]
mov edx, dword [esp + 0x6c]
sub esi, eax
sub esi, dword [esp + 0x54]
add ebx, eax
sub esi, dword [esp + 0x40]
add ebx, dword [esp + 0x50]
cmp edi, dword [edx + 8]
mov dword [esp + 0x20], esi
mov dword [esp + 0x4c], ebx
jb 0x472b79
call fcn.0047770d
cmp dword [edi], 7
jne 0x472ba1
mov edi, dword [esp + 0x7c]
push 0
push ebx
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x24]
add eax, ebx
push eax
push esi
push edi
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x472f18
mov ecx, dword [esp + 0x6c]
cmp edi, dword [ecx + 8]
jb 0x472baf
call fcn.0047770d
cmp dword [edi], 6
jne 0x472d14
mov edx, dword [esp + 0x698]
mov ecx, dword [esp + 0xc4]
mov eax, dword [esp + 0x69c]
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x18c], edx
push ecx
lea edx, [esp + 0x188]
push edx
xor edi, edi
push esi
mov dword [esp + 0x190], edi
mov dword [esp + 0x194], edi
mov dword [esp + 0x19c], eax
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [esp + 0xc8]
mov ebx, dword [esp + 0x18]
push edi
imul ecx, ebx
add ecx, dword [esp + 0x1e4]
push 1
lea eax, [esp + 0x4c]
push eax
push edi
push edi
push edi
push ecx
push esi
mov dword [esp + 0x64], 0x3001
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov edx, dword [esp + 0x69c]
mov eax, dword [esp + 0x698]
push edi
push edi
push edi
push edx
push eax
push edi
push edi
lea ecx, [esp + 0x268]
push ecx
lea ecx, [esp + 0x6c4]
call fcn.00460e30
lea ecx, [ebx + ebx]
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x55555556
imul ebx
push 0
push 0
mov edi, edx
shr edi, 0x1f
push 0
add edi, edx
cmp dword [esp + 0xf4], 3
push 6
lea ecx, [esp + 0x6b4]
push ebx
jne 0x472cde
mov edx, dword [esp + 0x6ac]
push edx
push ebx
lea eax, [ebx + ebx*2]
push eax
push 0
push 0
call fcn.00460ea0
mov eax, dword [esp + 0x24]
push 0
lea ecx, [esi + esi*2]
push ecx
mov ecx, dword [esp + 0x34]
sub eax, edi
sub ebx, esi
push edi
lea edx, [ebx + ebx*2]
push edx
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x34]
push eax
lea eax, [esp + 0x6bc]
call fcn.0046c1b0
jmp 0x472f15
push ebx
push ebx
push ebx
push 0
push 0
call fcn.00460ea0
mov eax, dword [esp + 0x24]
push 0
sub eax, edi
cdq
push esi
lea ecx, [esp + 0x6ac]
push ecx
sub eax, edx
mov edx, dword [esp + 0x2c]
mov ecx, ebx
sar eax, 1
sub ecx, esi
add eax, dword [esp + 0x58]
push edi
push eax
push edx
jmp 0x472f0c
mov eax, dword [esp + 0x6c]
cmp edi, dword [eax + 8]
jb 0x472d22
call fcn.0047770d
cmp dword [edi], 8
je 0x472d42
mov ecx, dword [esp + 0x6c]
cmp edi, dword [ecx + 8]
jb 0x472d35
call fcn.0047770d
cmp dword [edi], 9
jne 0x472f18
mov edi, dword [esp + 0x70]
mov edx, dword [esp + 0x698]
mov ecx, dword [esp + 0xc4]
mov esi, dword [esp + 0x5c]
xor eax, eax
mov dword [esp + 0x1ac], edx
push ecx
lea edx, [esp + 0x1a8]
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], eax
mov eax, dword [esp + 0x6a0]
push edx
push esi
mov dword [esp + 0x1bc], eax
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [0x4a00d4]
push eax
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
push esi
mov dword [esp + 0x68], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x6c]
cmp edi, dword [ecx + 8]
mov dword [esp + 0x64], eax
jb 0x472db7
call fcn.0047770d
cmp dword [edi], 8
jne 0x472dc5
mov edx, dword [0x4a00d4]
push edx
jmp 0x472dcb
mov eax, dword [0x4a00d0]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, dword [esp + 0x5c]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x68], eax
mov eax, dword [0x4a00f4]
lea ecx, [eax + eax*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, esi
imul eax, dword [esp + 0xc8]
push eax
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_Ellipse]
mov ecx, dword [esp + 0x64]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x60]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x68]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x69c]
mov edx, dword [esp + 0x698]
push 0
push 0
push 0
push ecx
push edx
push 0
push 0
lea eax, [esp + 0x268]
push eax
lea ecx, [esp + 0x6c4]
call fcn.00460e30
cmp dword [esp + 0xe8], 3
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push 6
push eax
jne 0x472ed5
mov ecx, dword [esp + 0x6ac]
push ecx
push eax
lea edx, [eax + eax*2]
push edx
push 0
push 0
lea ecx, [esp + 0x6cc]
call fcn.00460ea0
mov ecx, dword [esp + 0x20]
push 0
push 0
push esi
lea eax, [esi + esi*2]
push eax
mov eax, dword [esp + 0x34]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x5c]
push eax
push ecx
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x6bc]
call fcn.0046c1b0
jmp 0x472f15
push eax
push eax
push eax
push 0
push 0
lea ecx, [esp + 0x6cc]
call fcn.00460ea0
mov eax, dword [esp + 0x24]
push 0
sub eax, esi
push 0
lea edx, [esp + 0x6ac]
push edx
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x58]
push esi
push eax
mov eax, dword [esp + 0x34]
mov ecx, esi
push eax
mov eax, dword [esp + 0x44]
call fcn.0046c080
add esp, 0x18
mov edi, dword [esp + 0x70]
mov esi, dword [esp + 0x6c]
cmp edi, dword [esi + 8]
jb 0x472f34
call fcn.0047770d
cmp edi, dword [esi + 8]
jb 0x472f34
call fcn.0047770d
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
lea eax, [ecx + edx - 1]
cmp eax, dword [esp + 0x1c]
jg 0x472f5a
mov ecx, dword [esp + 0xac]
lea eax, [esp + 0x9c]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov edx, dword [esp + 0x24]
add dword [esp + 0x50], edx
add dword [esp + 0x1c], 1
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
add eax, ecx
cmp dword [esp + 0x1c], eax
jl 0x4701d0
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x54]
add eax, dword [esp + 0x140]
mov edx, dword [esp + 0xec]
mov dword [esp + 0x54], eax
xor esi, esi
add eax, edx
cmp eax, dword [esp + 0xf8]
mov dword [esp + 0x50], esi
jg 0x473210
mov eax, dword [esp + 0xf4]
add dword [esp + 0xd4], 1
cmp eax, esi
je 0x472feb
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x120]
push ecx
mov ecx, dword [esp + 0xd8]
push edx
push ecx
call eax
test eax, eax
jne 0x473233
mov ecx, dword [esp + 0xa0]
cmp ecx, esi
je 0x4700b0
mov edx, dword [esp + 0x104]
push edx
mov edx, dword [esp + 0xa8]
lea eax, [esp + 0xa0]
push eax
push edx
push ecx
call fcn.0046d5a0
mov eax, dword [esp + 0xb0]
push eax
call fcn.004775de
add esp, 0x14
jmp 0x4700b0
mov eax, dword [esp + 0xa0]
cmp eax, ebx
mov dword [esp + 0x14], 1
je 0x473067
mov ecx, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0xa8]
lea edx, [esp + 0xa0]
push edx
push ecx
push eax
call fcn.0046d5a0
mov edx, dword [esp + 0xb0]
push edx
call fcn.004775de
add esp, 0x14
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
jmp 0x473247
lea ecx, [esp + 0xb4]
call fcn.0046c890
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x10c]
mov dword [ecx], eax
mov dword [esp + 0x14], 0
jmp 0x47323b
mov ecx, dword [esp + 0x34]
push 0
add ecx, 0x50
call fcn.00405370
lea ecx, [esp + 0x18c4]
mov dword [esp + 0x14], 0x63
call fcn.00401f00
lea ecx, [esp + 0xf0]
mov byte [esp + 0x1930], 7
call fcn.00401000
lea ecx, [esp + 0x182c]
call fcn.00401f00
lea ecx, [esp + 0x1810]
call fcn.00401f00
lea ecx, [esp + 0x1848]
call fcn.00401f00
jmp 0x47323b
cmp edi, dword [ebx + 8]
jb 0x473119
call fcn.0047770d
cmp edi, dword [ebx + 8]
jb 0x473119
call fcn.0047770d
mov edx, dword [edi + 8]
add edx, dword [edi + 4]
mov eax, dword [esp + 0x10c]
mov dword [eax], edx
mov dword [esp + 0x14], 0
jmp 0x47323b
mov esi, dword [esp + 0xa0]
cmp esi, ecx
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov dword [esp + 0x14], ecx
je 0x47319a
mov edi, dword [esp + 0xa4]
cmp esi, edi
je 0x473191
add esi, 0x30
nop
cmp dword [esi], 8
jb 0x473171
mov eax, dword [esi - 0x14]
push eax
call fcn.004775de
add esp, 4
xor eax, eax
mov dword [esi], 7
mov dword [esi - 4], eax
mov word [esi - 0x14], ax
add esi, 0x3c
lea ecx, [esi - 0x30]
cmp ecx, edi
jne 0x473160
mov esi, dword [esp + 0xa0]
push esi
call fcn.004775de
add esp, 4
xor eax, eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
jmp 0x473247
mov eax, dword [esp + 0xa0]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x14], 0x63
je 0x4731f9
mov edx, dword [esp + 0x104]
push edx
mov edx, dword [esp + 0xa8]
lea ecx, [esp + 0xa0]
push ecx
push edx
push eax
call fcn.0046d5a0
mov eax, dword [esp + 0xb0]
push eax
call fcn.004775de
add esp, 0x14
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], esi
jmp 0x473247
cmp ecx, esi
mov dword [esp + 0x14], esi
je 0x4731f9
mov edx, dword [esp + 0x104]
push edx
mov edx, dword [esp + 0xa8]
lea eax, [esp + 0xa0]
push eax
push edx
push ecx
jmp 0x4731e4
mov dword [esp + 0x14], 0x63
lea ecx, [esp + 0x94]
call fcn.0046dfc0
cmp dword [esp + 0x2c], 0
je 0x4732ea
mov ecx, dword [esp + 0x144]
mov edi, dword [esp + 0x7c]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ecx
push edi
call esi
mov edx, dword [esp + 0x150]
push edx
push edi
call esi
mov eax, dword [esp + 0x158]
mov ebx, dword [esp + 0x5c]
push eax
push ebx
call esi
mov ecx, dword [esp + 0x15c]
push ecx
push ebx
call esi
mov edx, dword [esp + 0x154]
mov edi, dword [esp + 0xe4]
push edx
push edi
call esi
mov eax, dword [esp + 0x148]
push eax
push edi
call esi
mov ecx, dword [esp + 0x160]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push ecx
call esi
mov edx, dword [esp + 0x12c]
push edx
call esi
mov eax, dword [esp + 0x124]
push eax
call esi
mov ecx, dword [esp + 0xc4]
push ecx
call esi
mov edx, dword [esp + 0x7c]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push edx
call esi
push ebx
call esi
push edi
call esi
lea ecx, [esp + 0x13b4]
mov byte [esp + 0x1930], 2
call fcn.0041ed00
lea ecx, [esp + 0x6a4]
mov byte [esp + 0x1930], 1
call fcn.0041ed00
lea ecx, [esp + 0xf5c]
mov byte [esp + 0x1930], 0
call fcn.0041ed00
lea ecx, [esp + 0x24c]
mov dword [esp + 0x1930], 0xffffffff
call fcn.0041ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1928]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1910]
xor ecx, esp
call fcn.004777ea
mov esp, ebp
pop ebp
ret