Function at 0x406380
Capabilities:
Check for foreground window switch
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43526c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf6c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x74], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebx
mov dword [ebp - 0x70], eax
call fcn.0040ccc0
test eax, eax
je 0x406e9e
mov eax, dword [ebx + 0x65c]
test eax, eax
je 0x4085ad
lea ecx, [ebp - 0x8c]
call fcn.0043161e
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 0
call fcn.004344b0
mov eax, dword [ebx + 0x5dc]
mov ecx, dword [ebx + 0x5e0]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x90], ecx
lea edi, [ebx + 0x158]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x398]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 4], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x54]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov byte [ebp - 0x840], 0
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 0xb4c], 0
lea eax, [ecx + ebx + 0x54]
cmp eax, edx
mov dword [ebp - 0x50], eax
jb 0x40648d
mov esi, eax
cmp byte [esi], 0x5c
je 0x40646a
dec esi
lea ecx, [ebx + 0x54]
cmp esi, ecx
jae 0x406458
mov dword [ebp - 0x50], esi
jmp 0x40648d
sub eax, esi
lea ecx, [esi + 1]
push eax
lea edx, [ebp - 0xb4c]
push ecx
push edx
mov dword [ebp - 0x50], esi
call fcn.0042096d
mov al, byte [ebp - 0xb4c]
add esp, 0xc
test al, al
jne 0x4064b6
lea edi, [ebx + 0x54]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x50]
lea eax, [ebx + 0x54]
cmp esi, eax
jbe 0x4064db
sub esi, ebx
lea edx, [ebp - 0x840]
lea ecx, [esi - 0x54]
push ecx
push eax
push edx
call fcn.0042096d
add esp, 0xc
mov byte [ebp + esi - 0x894], 0
mov al, byte [ebp - 0x840]
test al, al
jne 0x4064f7
lea eax, [ebp - 0x840]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x1a4]
call fcn.0041b4b0
lea ecx, [ebp - 0x840]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x1a4]
call fcn.0041b5d0
lea edx, [ebp - 0xb4c]
lea ecx, [ebp - 0x1a4]
push edx
call fcn.0041b960
lea eax, [ebp - 0x188]
mov dword [ebp - 0xf8], eax
mov al, byte [0x448cc8]
test al, 1
jne 0x406571
mov cl, byte [ebp + 0xb]
mov dl, al
or dl, 1
xor eax, eax
push 0x409420
mov byte [0x448cc8], dl
mov byte [0x448cb8], cl
mov dword [0x448cbc], eax
mov dword [0x448cc0], eax
mov dword [0x448cc4], eax
call fcn.0042054f
add esp, 4
mov edx, dword [0x4457b0]
mov dword [ebp - 0x73c], edx
mov edi, dword [ebp - 0x184]
mov byte [ebp - 4], 3
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0xf8]
cmp edi, dword [eax + 8]
je 0x40856e
mov esi, dword [0x448cbc]
mov eax, dword [0x448cc0]
cmp esi, eax
je 0x40664e
mov eax, dword [esi]
mov ecx, dword [edi]
push eax
push ecx
call fcn.004208be
add esp, 8
test eax, eax
je 0x4065cf
mov eax, dword [0x448cc0]
add esi, 0x238
cmp esi, eax
jne 0x4065ac
jmp 0x40664e
mov ecx, dword [edi + 0x18]
mov eax, dword [esi + 0x18]
cmp ecx, eax
jne 0x4065e7
mov edx, dword [edi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp edx, eax
je 0x4091e3
mov eax, dword [0x448cc0]
add esi, 0x238
cmp esi, eax
mov dword [ebp - 0x44], eax
je 0x40661f
lea edi, [esi - 0x238]
push esi
mov ecx, edi
call fcn.004046c0
mov eax, dword [ebp - 0x44]
add esi, 0x238
add edi, 0x238
cmp esi, eax
jne 0x4065ff
mov eax, dword [0x448cc0]
lea esi, [eax - 0x238]
mov edi, eax
cmp esi, eax
je 0x406641
mov ecx, esi
call fcn.0042ba44
add esi, 0x238
cmp esi, edi
jne 0x40662b
mov eax, dword [0x448cc0]
mov edi, dword [ebp - 0x38]
sub eax, 0x238
mov dword [0x448cc0], eax
mov edi, dword [edi]
mov ecx, ebx
push edi
mov dword [ebp - 0x5c], 0
call fcn.0040afb0
test eax, eax
je 0x4091e3
mov dword [ebp - 0x48], 0x15
mov eax, dword [ebx + 0x794]
lea esi, [ebx + 0x794]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, esi
call dword [eax + 0x34]
cmp byte [ebp - 0x14], 0x1b
jne 0x406707
mov edx, dword [esi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, esi
mov dword [ebp - 0x5c], 1
call dword [edx + 0x34]
cmp byte [ebp - 0x14], 0x22
jne 0x406707
lea ecx, [ebp - 0xf78]
push 0
push ecx
mov ecx, ebx
call fcn.00412e40
test eax, eax
je 0x406707
mov eax, dword [ebx + 0x894]
push 0
push eax
mov ecx, ebx
call fcn.00413210
mov eax, dword [ebx + 0x5e0]
lea edi, [ebx + 0x158]
mov dword [ebp - 0x90], eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebx + 0x5dc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x7c], edx
lea edx, [ebp - 0x398]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
jne 0x40666e
mov edx, dword [ebx + 0x794]
lea esi, [ebx + 0x794]
mov ecx, esi
call dword [edx + 0x4c]
mov eax, dword [ebx + 0x5a0]
test eax, eax
je 0x4067d0
lea eax, [eax + eax*4]
xor edi, edi
shl eax, 1
test eax, eax
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0x48], edi
jle 0x4067c2
push 0x60
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx]
mov ecx, ebx
push eax
call fcn.0040afb0
test eax, eax
mov dword [ebp - 0xbc], eax
je 0x4091e3
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x30]
mov dword [ebp - 0x168], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x4c]
cmp dword [ebp - 0x168], edi
jne 0x406792
mov ecx, dword [ebp - 0xe8]
xor eax, eax
cmp eax, ecx
je 0x40679e
or edi, dword [ebp - 0xe8]
jne 0x40684f
mov ecx, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebx + 0x5a0]
mov edi, dword [ebp - 0x168]
inc ecx
lea edx, [eax + eax*4]
mov dword [ebp - 0x48], ecx
shl edx, 1
cmp ecx, edx
jl 0x406747
mov eax, dword [ebp - 0xbc]
test eax, eax
je 0x4091e3
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x73c]
push esi
call fcn.0042bb31
mov eax, dword [esi + 0x18]
push 3
mov dword [ebp - 0x724], eax
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x720], ecx
mov ecx, ebx
call fcn.00410510
lea ecx, [ebx + 0x66c]
test ecx, ecx
je 0x406810
mov eax, dword [ecx + 4]
test eax, eax
je 0x406810
call fcn.00431ce9
lea ecx, [ebp - 0x8c]
call fcn.0043173d
xor edi, edi
push 0xac
mov dword [ebp - 0x3c], edi
call fcn.0042b785
add esp, 4
mov dword [ebp - 0x44], eax
test eax, eax
mov byte [ebp - 4], 4
je 0x40685e
mov edx, dword [0x448ccc]
push edi
push 8
push 1
push edx
mov ecx, eax
call fcn.00405b80
mov esi, eax
jmp 0x406860
mov dword [ebp - 0xbc], 0
jmp 0x4091e3
xor esi, esi
mov eax, dword [esi + 0x5c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 3
mov dword [eax + 4], ecx
mov edx, dword [esi + 0x5c]
mov eax, dword [ebx + 4]
mov dword [ebp - 0x48], 0
mov dword [edx + 0x22], eax
mov ecx, dword [ebx + 0x5ac]
mov dword [ebx + 0x5b4], ecx
mov edx, dword [ebx + 0x5b0]
mov dword [ebx + 0x5b8], edx
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x44], eax
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x406a4c
mov ecx, dword [ebx + 4]
push 0
push 0x40b350
push 0
push 0x97
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x4068ff
mov eax, dword [0x448cc0]
lea edx, [ebp - 0x73c]
push edx
push 1
push eax
mov ecx, 0x448cb8
call fcn.00404250
test esi, esi
je 0x4068ef
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 4]
mov eax, dword [ebp - 0x70]
mov ecx, ebx
push eax
call fcn.0040b050
jmp 0x4091e3
lea edi, [ebx + 0x158]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x398]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x90], eax
mov al, byte [ebp - 0x398]
test al, al
je 0x406cd7
lea ecx, [ebp - 0x398]
push ecx
mov ecx, ebx
call fcn.00412730
mov esi, eax
lea edx, [ebp - 0xa0]
push 0
lea eax, [ebp - 0x398]
push edx
push eax
call sub.WINSPOOL.DRV_OpenPrinterA
test eax, eax
je 0x4069d8
mov edx, dword [ebp - 0xa0]
push 0
push 0
lea ecx, [ebp - 0x398]
push 0
push ecx
push edx
push 0
call sub.WINSPOOL.DRV_DocumentPropertiesA
push eax
call fcn.00420784
mov ecx, dword [ebp - 0xa0]
add esp, 4
mov edi, eax
lea eax, [ebp - 0x398]
push 2
push 0
push edi
push eax
push ecx
push 0
mov dword [ebp - 0x3c], edi
call sub.WINSPOOL.DRV_DocumentPropertiesA
cmp eax, 1
jne 0x4069cc
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4069cc
mov word [edi + 0x2c], 2
mov dword [edi + 0x28], 1
mov edx, dword [ebp - 0xa0]
push edx
call sub.WINSPOOL.DRV_ClosePrinter
push edi
lea eax, [ebp - 0x398]
push 0
push eax
push 0
call dword [sym.imp.GDI32.dll_CreateDCA]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004316d5
test eax, eax
jne 0x406c90
test esi, esi
jne 0x406e4b
push str.Unable_to_find_printer__s
lea ecx, [ebp + 8]
push 5
push ecx
mov ecx, ebx
call fcn.00413120
mov eax, dword [eax]
lea edx, [ebp - 0x398]
push edx
push eax
lea eax, [ebp - 0xa48]
push eax
call fcn.00420a4c
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.0042ba44
lea ecx, [ebp - 0xa48]
push ecx
mov ecx, ebx
call fcn.0040cca0
jmp 0x406e4b
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x406939
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x406ab4
push 0x94
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esi + 0x5c]
mov dword [ecx + 8], eax
mov edx, dword [esi + 0x5c]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
test edx, edx
je 0x406ab4
mov ecx, 0x25
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, 1
mov word [edx + 0x24], 0x94
mov word [edx + 0x2c], 2
mov dword [edx + 0x28], eax
mov word [edx + 0x36], ax
mov ecx, dword [esi + 0x5c]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebx + 0x5c8], 1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xb8]
cmp eax, 1
je 0x406b0e
mov edx, dword [0x448cc0]
lea ecx, [ebp - 0x73c]
push ecx
push 1
push edx
mov ecx, 0x448cb8
call fcn.00404250
test esi, esi
je 0x406af4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x70]
mov dword [ebx + 0x5c8], 0
push ecx
mov ecx, ebx
call fcn.0040b050
jmp 0x4091e3
mov edx, dword [ebp - 0x70]
mov ecx, ebx
push edx
mov dword [ebx + 0x5c8], 0
call fcn.0040b050
mov ecx, esi
call fcn.0042ad90
mov edi, eax
push edi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0x13c]
mov ecx, esi
push eax
call fcn.0042ae1e
mov ecx, dword [eax]
lea edx, [ebp - 0xe4]
mov dword [ebp - 0x44], ecx
push edx
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.0042ade0
mov eax, dword [eax]
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, esi
mov byte [ebp - 4], 6
mov dword [ebp - 0x48], eax
call fcn.0042ada3
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov eax, dword [eax]
push edi
push edx
push ecx
push eax
mov byte [ebp - 4], 7
call dword [sym.imp.GDI32.dll_CreateDCA]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004316d5
test eax, eax
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 6
sete byte [ebp - 0x2d]
call fcn.0042ba44
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 5
call fcn.0042ba44
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 3
call fcn.0042ba44
mov al, byte [ebp - 0x2d]
test al, al
je 0x406c05
push str.Printer_error_
lea edx, [ebp - 0x144]
push 1
push edx
mov ecx, ebx
call fcn.00413120
mov eax, dword [eax]
mov ecx, ebx
push eax
mov byte [ebp - 4], 8
call fcn.0040cca0
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 3
call fcn.0042ba44
jmp 0x4091e3
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0xf4]
push edx
mov dword [ebp - 0x48], 1
mov ax, word [ecx + 0xa4]
mov word [ebx + 0x882], ax
call fcn.0042ade0
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x49c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xf4]
call fcn.0042ba44
lea edi, [ebp - 0x49c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x398]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x7c], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x406f02
mov edx, dword [ebp - 0x3c]
lea edi, [ebp - 0x398]
or ecx, 0xffffffff
lea esi, [ebp - 0x49c]
mov ax, word [edx + 0x36]
mov dword [ebp - 0x44], esi
mov word [ebx + 0x882], ax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x48], 2
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x406f05
mov ecx, esi
call fcn.0042ae5c
test eax, eax
jne 0x406d66
push str.You_have_no_default_printer_
lea ecx, [ebp + 8]
push 7
push ecx
mov ecx, ebx
call fcn.00413120
mov eax, dword [eax]
mov ecx, ebx
push eax
mov byte [ebp - 4], 9
call fcn.0040cca0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.0042ba44
lea ecx, [ebp - 0x73c]
mov byte [ebp - 4], 2
call fcn.0042ba44
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 1
call fcn.0041b510
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0
call fcn.00434507
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
call fcn.00431753
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.0042ad90
mov edi, eax
push edi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x406d86
mov word [edi + 0x2c], 2
lea edx, [ebp - 0x128]
mov ecx, esi
push edx
call fcn.0042ae1e
mov edi, dword [eax]
lea eax, [ebp - 0x100]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.0042ade0
mov ecx, dword [eax]
lea edx, [ebp - 0x138]
mov dword [ebp - 0x44], ecx
push edx
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.0042ada3
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x44]
mov eax, dword [eax]
push ecx
push edi
push edx
push eax
mov byte [ebp - 4], 0xc
call dword [sym.imp.GDI32.dll_CreateDCA]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004316d5
test eax, eax
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0xb
sete byte [ebp - 0x2d]
call fcn.0042ba44
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0xa
call fcn.0042ba44
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 3
call fcn.0042ba44
mov al, byte [ebp - 0x2d]
test al, al
je 0x406eb3
push str.Default_printer_error_
lea eax, [ebp + 8]
push 8
push eax
mov ecx, ebx
call fcn.00413120
mov eax, dword [eax]
mov ecx, ebx
push eax
mov byte [ebp - 4], 0xd
call fcn.0040cca0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.0042ba44
push 1
mov ecx, ebx
call fcn.00410510
mov eax, dword [ebx + 0x38]
mov byte [ebp - 4], 2
test eax, eax
lea ecx, [ebp - 0x73c]
jne 0x408578
call fcn.0042ba44
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 1
call fcn.0041b510
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0
call fcn.00434507
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
call fcn.00431753
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x108]
push eax
mov dx, word [ecx + 0x36]
mov ecx, dword [ebp - 0x20]
mov word [ebx + 0x882], dx
call fcn.0042ade0
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x49c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
call fcn.0042ba44
mov edx, dword [ebp - 0x3c]
mov cx, word [edx + 0x2c]
mov word [ebx + 0x87c], cx
mov ax, word [edx + 0x38]
mov word [ebx + 0x87e], ax
mov eax, dword [ebp - 0x20]
mov cx, word [edx + 0x3e]
test eax, eax
mov word [ebx + 0x880], cx
je 0x406f36
mov ecx, eax
push 1
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebx + 0x44]
test eax, eax
jne 0x406f4f
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x406f4f
lea esi, [ebp - 0x8c]
mov dword [ebp - 0x44], esi
jmp 0x406f9c
push 0
call dword [sym.imp.GDI32.dll_CreateMetaFileA]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004316d5
test eax, eax
jne 0x406f73
push str.CreateMetaFile_failed
mov ecx, ebx
call fcn.0040cca0
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0xb0]
push eax
call fcn.004344e2
mov eax, dword [ebx + 0x44]
lea esi, [ebp - 0xb0]
neg eax
sbb al, al
mov dword [ebp - 0x44], esi
and al, 0xc4
add al, 0x5f
mov byte [ebp - 0x50], al
xor ecx, ecx
mov eax, dword [esi]
mov dword [ebp - 0x160], ecx
lea edx, [ebx + 0x464]
mov dword [ebp - 0x15c], ecx
push 5
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x160], 0x14
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x150], ecx
mov ecx, esi
call dword [eax + 0x34]
push 1
mov ecx, esi
call fcn.004318de
mov ecx, dword [esi + 8]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x70
push ecx
call edi
mov edx, dword [esi + 8]
push 0x58
push edx
mov dword [ebp - 0x18], eax
call edi
fild dword [ebx + 0x4c]
fild dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [esi + 8]
push 8
push eax
fmul dword [0x437d78]
fidiv dword [ebp - 0x58]
fsubp st(1)
fstp dword [ebp - 0x34]
call edi
mov ecx, dword [esi + 8]
push 0x58
push ecx
mov dword [ebp - 0x18], eax
call edi
fild dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
fmul dword [0x437d78]
fidiv dword [ebp - 0x58]
fstp dword [ebp - 0x20]
fld dword [ebp - 0x34]
fcomp qword [0x437d70]
fnstsw ax
test ah, 1
jne 0x407056
fld dword [ebp - 0x34]
fcomp dword [ebp - 0x20]
fnstsw ax
test ah, 0x41
jne 0x40705d
mov dword [ebp - 0x34], 0
mov eax, dword [ebx + 0x5c4]
test eax, eax
jne 0x4070da
fld dword [ebp - 0x20]
fsub dword [ebp - 0x34]
fsub qword [0x437d68]
fstp dword [ebp - 0x2c]
fld dword [ebp - 0x2c]
fcomp qword [0x437d60]
mov edx, dword [ebp - 0x2c]
mov dword [ebx + 0x668], edx
fnstsw ax
test ah, 0x41
jne 0x40709b
mov dword [ebx + 0x668], 0x45fa0000
jmp 0x4070c6
fld dword [ebp - 0x2c]
fcomp qword [0x437d58]
fnstsw ax
test ah, 1
je 0x4070c6
fld dword [ebp - 0x2c]
fsubr qword [0x437d58]
fmul qword [0x437d50]
fsubr qword [0x437d60]
fstp dword [ebx + 0x668]
fld dword [ebx + 0x668]
fmul qword [0x437d48]
fstp dword [ebx + 0x870]
jmp 0x407108
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], 0
fild qword [ebp - 0x178]
fmul qword [0x437d40]
fst dword [ebx + 0x870]
fmul qword [0x437d60]
fstp dword [ebx + 0x668]
mov eax, dword [esi + 8]
push 0x71
push eax
call edi
mov ecx, dword [esi + 8]
push 0x5a
push ecx
mov dword [ebp - 0x18], eax
call edi
fild dword [ebx + 0x50]
fild dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
mov edx, dword [esi + 8]
push 0xa
push edx
fmul dword [0x437d78]
fidiv dword [ebp - 0x58]
fsubp st(1)
fstp dword [ebp - 0x54]
call edi
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 8]
push 0x5a
push eax
call edi
mov ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv ecx
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fld dword [ebp - 0x54]
fcomp qword [0x437d70]
fnstsw ax
test ah, 1
jne 0x40717b
fld dword [ebp - 0x54]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x407182
mov dword [ebp - 0x54], 0
fsub dword [ebp - 0x54]
mov eax, dword [ebx + 0x2c]
test eax, eax
fsub dword [0x437d3c]
mov dword [ebp - 0x18], eax
fstp dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x64], ecx
je 0x4071ac
fild dword [ebp - 0x18]
fdivr dword [ebp - 0x2c]
fstp dword [ebx + 0x664]
jmp 0x4071b6
mov dword [ebx + 0x664], 0x4326aaab
lea edx, [ebx + 0x57c]
mov dword [ebx + 0x578], edx
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x407209
push 0
push str.MS_LineDraw
lea ecx, [ebp - 0x504]
call fcn.00403da0
push 1
lea ecx, [ebp - 0x504]
mov byte [ebp - 4], 0xe
call fcn.00403f20
test eax, eax
je 0x4071fa
mov dword [ebx + 0x578], str.MS_LineDraw
lea ecx, [ebp - 0x504]
mov byte [ebp - 4], 3
call fcn.00403e90
push 0
push esi
mov ecx, ebx
call fcn.00409500
mov eax, dword [ebp - 0x38]
mov ecx, ebx
mov eax, dword [eax]
push eax
call fcn.0040afb0
test eax, eax
je 0x4091e3
mov eax, dword [ebx + 0x574]
xor edi, edi
cmp eax, edi
je 0x407245
fld dword [ebp - 0x20]
fsub dword [ebp - 0x34]
push ecx
mov ecx, ebx
fstp dword [esp]
call fcn.00413050
cmp dword [ebx + 0x20], edi
jne 0x407264
mov edx, dword [0x448cc0]
lea ecx, [ebp - 0x73c]
push ecx
push 1
push edx
mov ecx, 0x448cb8
call fcn.00404250
mov eax, dword [ebp - 0x5c]
mov dword [ebx + 0x888], edi
cmp eax, edi
je 0x407278
mov ecx, ebx
call fcn.004125e0
mov ax, word [ebx + 0x882]
mov ecx, dword [ebx + 0x5a8]
mov word [ebx + 0x884], ax
mov eax, 1
cmp ecx, edi
mov dword [ebx + 0x898], eax
je 0x4072ae
lea ecx, [ebp - 0x49c]
push ecx
mov ecx, ebx
call fcn.00412300
jmp 0x4090cf
cmp dword [ebx + 0x5b4], edi
jne 0x408d8c
cmp dword [ebx + 0x5b8], edi
jne 0x408d8c
fld dword [ebp - 0x54]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x60], edi
fchs
fstp dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x68], edi
mov ecx, ebx
call fcn.00411600
mov ecx, ebx
call fcn.00411620
mov eax, dword [ebx + 0x794]
lea edi, [ebx + 0x794]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x408ab6
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 0x1b
ja case.0x407329.11
xor edx, edx
mov dl, byte [eax + 0x409228]
jmp dword [edx*4 + 0x4091f8]
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov edx, dword [ebp - 0x14]
and edx, 0xff
lea eax, [edx - 0xe]
cmp eax, 0x6c
ja case.0x407329.0
xor ecx, ecx
mov cl, byte [eax + 0x40931c]
jmp dword [ecx*4 + 0x409244]
mov dword [ebx + 0x56c], 0xa
xor eax, eax
mov ecx, ebx
push eax
push eax
push esi
mov dword [ebx + 0x68c], eax
mov dword [ebx + 0x570], eax
call fcn.004097a0
jmp case.0x407329.0
mov dword [ebx + 0x56c], 0xc
jmp 0x407367
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x684], 1
call fcn.004097a0
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x684], 0
call fcn.004097a0
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x680], 1
call fcn.004097a0
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x680], 0
call fcn.004097a0
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x31
je 0x407414
cmp al, 1
jne 0x40741e
mov dword [ebx + 0x678], 1
cmp al, 0x30
je 0x40742a
test al, al
jne 0x408351
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x678], 0
call fcn.004097a0
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x56c], 0xf
mov dword [ebx + 0x570], 0
call fcn.004097a0
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x31
je 0x407482
cmp al, 1
jne 0x40748c
mov dword [ebx + 0x68c], 1
cmp al, 0x30
je 0x407498
test al, al
jne 0x408351
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x68c], 0
call fcn.004097a0
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x31
je 0x4074cb
cmp al, 1
jne 0x4074d5
mov dword [ebx + 0x688], 1
cmp al, 0x30
je 0x4074e1
test al, al
jne 0x408351
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x688], 0
call fcn.004097a0
jmp case.0x407329.0
mov edx, dword [edi]
xor eax, eax
mov dword [ebx + 0x688], eax
mov dword [ebx + 0x570], eax
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
test al, 1
je 0x40752a
mov dword [ebx + 0x56c], 0xc
jmp 0x407534
mov dword [ebx + 0x56c], 0xa
test al, 4
je 0x407547
mov ecx, 1
xor edx, edx
mov dword [ebx + 0x568], ecx
jmp 0x407554
xor edx, edx
mov ecx, 1
mov dword [ebx + 0x568], edx
test al, 0x18
jne 0x407560
mov dword [ebx + 0x684], edx
jmp 0x407566
mov dword [ebx + 0x684], ecx
test al, 0x20
je 0x407572
mov dword [ebx + 0x68c], ecx
jmp 0x407578
mov dword [ebx + 0x68c], edx
test al, 0x40
je 0x407584
mov dword [ebx + 0x680], ecx
jmp 0x40758a
mov dword [ebx + 0x680], edx
test al, 0x80
je 0x4075a3
push edx
mov dword [ebx + 0x678], ecx
push edx
push esi
mov ecx, ebx
call fcn.004097a0
jmp case.0x407329.0
push edx
push edx
push esi
mov ecx, ebx
mov dword [ebx + 0x678], edx
call fcn.004097a0
jmp case.0x407329.0
mov eax, dword [ebx + 0x2c]
test eax, eax
jne 0x4075c9
mov dword [ebx + 0x664], 0x4326aaab
mov edx, dword [esi]
xor edi, edi
push edi
mov ecx, esi
mov dword [ebx + 0x568], edi
mov dword [ebx + 0x678], edi
mov dword [ebx + 0x67c], edi
mov dword [ebx + 0x680], edi
mov dword [ebx + 0x684], edi
mov dword [ebx + 0x56c], 0xa
mov dword [ebx + 0x570], edi
mov dword [ebx + 0x68c], edi
mov dword [ebx + 0x688], edi
mov dword [ebx + 0x868], edi
mov dword [ebx + 0x890], edi
call dword [edx + 0x30]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x64], eax
mov al, byte [ebx + 0x28]
cmp al, 0x63
jae 0x40762a
mov byte [ebx + 0x28], 0
push edi
push edi
push esi
mov ecx, ebx
call fcn.004097a0
jmp 0x4072e3
mov dword [ebx + 0x664], 0x4326aaab
jmp case.0x407329.0
mov dword [ebx + 0x664], 0x42fa0000
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
test al, al
je case.0x407329.0
mov ecx, dword [ebx + 0x5a4]
mov edx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
and ecx, 0x24
add ecx, 0xb4
and edx, 0xff
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
fidiv dword [ebp - 0x18]
fdivr dword [0x437d78]
fstp dword [ebx + 0x664]
jmp case.0x407329.0
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov al, byte [ebp - 0x14]
test al, al
je case.0x407329.0
mov edx, dword [ebp - 0x14]
and edx, 0xff
mov dword [ebp - 0x18], edx
fild dword [ebp - 0x18]
fdivr dword [0x437d38]
fdivr dword [0x437d78]
fstp dword [ebx + 0x664]
jmp case.0x407329.0
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov al, byte [ebp - 0x14]
test al, al
je case.0x407329.0
mov edx, dword [ebx + 0x5a4]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
and edx, 0xc
add edx, 0x3c
and eax, 0xff
mov dword [ebp - 0x18], edx
fild dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
fidiv dword [ebp - 0x18]
fdivr dword [0x437d78]
fstp dword [ebx + 0x664]
jmp case.0x407329.0
mov dword [ebx + 0x664], 0x42c271c7
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x568], 1
call fcn.004097a0
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x568], 0
call fcn.004097a0
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
fmul dword [ebx + 0x660]
fstp dword [ebp - 0x34]
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
fmul dword [ebx + 0x664]
fsubr dword [ebp - 0x2c]
fstp dword [ebp - 0x64]
jmp case.0x407329.0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x64], edx
jmp case.0x407329.0
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov al, byte [ebp - 0x14]
test al, al
jne case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x148]
push 2
push eax
mov ecx, edi
call dword [edx + 0x34]
mov ecx, dword [ebp - 0x148]
fld dword [ebx + 0x870]
and ecx, 0xffff
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
fmulp st(1)
fmul qword [0x437d30]
fadd dword [ebp - 0x34]
fstp dword [ebp - 0x1c]
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x96]
push 2
push eax
mov ecx, edi
call dword [edx + 0x34]
movsx ecx, word [ebp - 0x96]
fld dword [ebx + 0x870]
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
fmulp st(1)
fmul qword [0x437d28]
fild dword [ebx + 0x86c]
fdivp st(1)
fadd dword [ebp - 0x1c]
fstp dword [ebp - 0x1c]
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 9
mov byte [ebx + 0x28], al
jne case.0x407329.0
mov byte [ebx + 0x28], 0xa
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x31
je 0x4078b9
cmp al, 1
jne 0x4078c3
mov dword [ebx + 0x868], 1
cmp al, 0x30
je 0x4078cb
test al, al
jne 0x4078d5
mov dword [ebx + 0x868], 2
push 0
push 0
push esi
mov ecx, ebx
call fcn.004097a0
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x868], 0
call fcn.004097a0
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov eax, dword [ebx + 0x5a4]
test eax, eax
je 0x407920
fld qword [0x437d20]
jmp 0x407926
fld qword [0x437d18]
mov ecx, dword [ebp - 0x14]
fld dword [ebp - 0x24]
and ecx, 0xff
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
fdiv st(2)
fsubp st(1)
fstp dword [ebp - 0x24]
fstp st(0)
fld dword [ebp - 0x24]
jmp 0x407db7
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov eax, dword [ebp - 0x14]
and eax, 0xff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov eax, 0x88888889
shl ecx, 3
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [ebx + 0x890], edx
jmp case.0x407329.0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4084c4
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x408711
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x42
jne 0x407a74
mov edx, dword [edi]
lea eax, [ebp - 0xd0]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov eax, dword [ebp - 0xd0]
mov edx, dword [edi]
and eax, 0xff
lea ecx, [ebp - 0xe74]
push eax
push ecx
mov ecx, edi
call dword [edx + 0x34]
lea ecx, [ebp - 0xd6c]
call fcn.00401000
mov edx, dword [ebx + 0x5a4]
mov eax, dword [ebp - 0xd0]
push edx
lea ecx, [ebp - 0xe74]
push eax
push ecx
lea ecx, [ebp - 0xd6c]
mov byte [ebp - 4], 0x25
call fcn.00401040
test eax, eax
je 0x407a60
mov eax, dword [ebx + 0x5ac]
lea edx, [ebx + 0x8d0]
fld dword [ebp - 0x24]
push edx
push 0
push eax
call fcn.00420414
fld dword [ebp - 0x1c]
push eax
call fcn.00420414
push eax
lea ecx, [ebp - 0x110]
push esi
push ecx
lea ecx, [ebp - 0xd6c]
call fcn.00401130
lea ecx, [ebp - 0x110]
call fcn.0042ba44
lea ecx, [ebp - 0xd6c]
mov byte [ebp - 4], 3
call fcn.00401030
jmp case.0x407329.0
cmp al, 0x56
jne 0x407ad2
mov edx, dword [edi]
lea eax, [ebp - 0xd8]
push 2
push eax
mov ecx, edi
call dword [edx + 0x34]
mov edx, dword [edi]
lea eax, [ebp - 0xd8]
push 2
push eax
mov ecx, edi
call dword [edx + 0x34]
mov eax, dword [ebp - 0xd8]
and eax, 0xffff
fld dword [ebp - 0x54]
lea eax, [eax + eax*4]
fchs
lea ecx, [eax + eax*4]
mov eax, 0xb60b60b7
shl ecx, 2
imul ecx
add edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [ebp - 0x18], edx
fisub dword [ebp - 0x18]
fstp dword [ebp - 0x24]
jmp case.0x407329.0
cmp al, 0x2d
jne case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x31
je 0x407b19
cmp al, 1
jne 0x407b23
mov dword [ebx + 0x678], 1
cmp al, 0x32
je 0x407b2b
cmp al, 2
jne 0x407b35
mov dword [ebx + 0x67c], 1
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x30
je 0x407b4d
test al, al
jne 0x407b5b
xor eax, eax
mov dword [ebx + 0x67c], eax
mov dword [ebx + 0x678], eax
push 0
push 0
push esi
mov ecx, ebx
call fcn.004097a0
jmp case.0x407329.0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0xa48]
push ecx
push edx
mov ecx, ebx
mov dword [ebp - 0x18], 0xc8
call fcn.00412e40
test eax, eax
jne case.0x407329.0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4084c4
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x408711
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffff
fld dword [ebp - 0x24]
push eax
call fcn.00420414
fld dword [ebp - 0x1c]
push eax
call fcn.00420414
mov edx, dword [esi + 4]
lea ecx, [ebp - 0xa48]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.00412f40
jmp case.0x407329.0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4084c4
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x408711
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
push 0
push 0
lea eax, [ebp - 0x1c]
push edx
push eax
push esi
lea edx, [ebp - 0x130]
push ecx
push edx
mov ecx, ebx
call fcn.00410a90
lea ecx, [ebp - 0x130]
call fcn.0042ba44
jmp case.0x407329.0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4084c4
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x408711
mov eax, dword [ebp - 0x24]
push 0
push 0
lea ecx, [ebp - 0x1c]
push eax
push ecx
push esi
lea edx, [ebp - 0x118]
push 0
push edx
mov ecx, ebx
call fcn.00410a90
lea ecx, [ebp - 0x118]
call fcn.0042ba44
jmp case.0x407329.0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4084c4
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x408711
mov eax, dword [ebp - 0x24]
push 0
push 0
lea ecx, [ebp - 0x1c]
push eax
push ecx
push esi
lea edx, [ebp - 0x140]
push 1
push edx
mov ecx, ebx
call fcn.00410a90
lea ecx, [ebp - 0x140]
call fcn.0042ba44
jmp case.0x407329.0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4084c4
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x408711
mov eax, dword [ebp - 0x24]
push 0
push 0
lea ecx, [ebp - 0x1c]
push eax
push ecx
push esi
lea edx, [ebp - 0x120]
push 3
push edx
mov ecx, ebx
call fcn.00410a90
lea ecx, [ebp - 0x120]
call fcn.0042ba44
jmp case.0x407329.0
mov ecx, ebx
call fcn.00412b20
jmp case.0x407329.0
mov ecx, ebx
call fcn.00412ac0
jmp case.0x407329.0
mov ecx, ebx
call fcn.004129e0
jmp case.0x407329.0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4084c4
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x408711
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov al, byte [ebp - 0x14]
test al, al
jne 0x407d68
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
fmul dword [ebx + 0x660]
fadd dword [ebp - 0x1c]
fstp dword [ebp - 0x1c]
jmp case.0x407329.0
cmp al, 1
jne case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
cmp dword [ebx + 0x68c], 2
jne 0x407d9c
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x68c], 0
call fcn.004097a0
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
fmul dword [ebx + 0x664]
fsubr dword [ebp - 0x24]
fst dword [ebp - 0x24]
fld dword [ebp - 0x64]
fsubr qword [0x437d10]
fcompp
fnstsw ax
test ah, 1
je case.0x407329.4
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
mov dword [ebp - 0x18], ecx
fild dword [ebp - 0x18]
fmul qword [0x437d08]
fadd dword [ebp - 0x24]
fstp dword [ebp - 0x24]
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
lea eax, [ecx - 1]
cmp eax, 0x35
ja case.0x407e29.7
xor edx, edx
mov dl, byte [eax + 0x4093a8]
jmp dword [edx*4 + 0x40938c]
mov edx, dword [esi]
mov eax, 0xff0000
push eax
mov ecx, esi
mov dword [ebp - 0x60], eax
call dword [edx + 0x30]
jmp case.0x407329.0
mov edx, dword [esi]
mov eax, 0xffff00
push eax
mov ecx, esi
mov dword [ebp - 0x60], eax
call dword [edx + 0x30]
jmp case.0x407329.0
mov edx, dword [esi]
mov eax, 0xff00ff
push eax
mov ecx, esi
mov dword [ebp - 0x60], eax
call dword [edx + 0x30]
jmp case.0x407329.0
mov edx, dword [esi]
mov eax, 0xffff
push eax
mov ecx, esi
mov dword [ebp - 0x60], eax
call dword [edx + 0x30]
jmp case.0x407329.0
mov edx, dword [esi]
mov eax, 0xff
push eax
mov ecx, esi
mov dword [ebp - 0x60], eax
call dword [edx + 0x30]
jmp case.0x407329.0
mov edx, dword [esi]
mov eax, 0xff00
push eax
mov ecx, esi
mov dword [ebp - 0x60], eax
call dword [edx + 0x30]
jmp case.0x407329.0
mov edx, dword [esi]
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp - 0x60], eax
call dword [edx + 0x30]
jmp case.0x407329.0
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x2f
jbe 0x407ed9
add al, 0xd0
mov byte [ebp - 0x14], al
cmp al, 0x11
jae case.0x407329.0
mov edx, dword [ebp - 0x14]
mov ecx, ebx
push edx
call fcn.00412da0
push 0x20
push eax
lea eax, [ebx + 0x57c]
push eax
call fcn.0042096d
add esp, 0xc
mov ecx, ebx
push 1
push esi
call fcn.00409500
push 0
push 0
push esi
mov ecx, ebx
call fcn.004097a0
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
jmp 0x407f55
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov al, byte [ebp - 0x14]
cmp al, 0x30
je 0x407fce
test al, al
je 0x407fce
mov dword [ebx + 0x88c], 1
cmp al, 0x30
je 0x407f89
test al, al
je 0x407f89
lea edi, [ebx + 0x57c]
push str.Courier_New
push edi
mov dword [ebx + 0x86c], 0xb4
call fcn.004208be
add esp, 8
test eax, eax
jne 0x407fb3
push 6
push str.Arial
push edi
jmp 0x407fab
push 0xc
lea ecx, [ebx + 0x57c]
push str.Courier_New
mov dword [ebx + 0x86c], 0x78
mov dword [ebx + 0x88c], 0
push ecx
call fcn.0042096d
add esp, 0xc
push 1
push esi
mov ecx, ebx
call fcn.00409500
push 0
push 0
push esi
mov ecx, ebx
call fcn.004097a0
jmp case.0x407329.0
mov eax, dword [ebx + 0x88c]
test eax, eax
je case.0x407329.0
push 6
mov ecx, esi
mov dword [ebx + 0x88c], 0
call fcn.00431ba5
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
cmp byte [ebp - 0x14], 5
jb 0x408020
mov ecx, dword [ebp - 0x14]
mov eax, 0x168
cdq
and ecx, 0xff
idiv ecx
mov byte [ebx + 0x89c], al
jmp 0x408027
mov byte [ebx + 0x89c], 0
mov edx, dword [edi]
lea eax, [ebx + 0x56c]
push 2
push eax
mov ecx, edi
call dword [edx + 0x34]
mov eax, dword [ebx + 0x56c]
neg eax
mov dword [ebx + 0x56c], eax
mov eax, 0
mov dword [ebx + 0x568], eax
mov dword [ebx + 0x68c], eax
mov dword [ebx + 0x688], eax
mov dword [ebx + 0x570], eax
jns case.0x407329.0
push eax
push eax
push esi
mov ecx, ebx
call fcn.004097a0
jmp case.0x407329.0
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
mov edx, dword [ebp - 0x14]
and edx, 0xff
lea eax, [edx - 0x48]
cmp eax, 0xe
ja case.0x407329.0
xor ecx, ecx
mov cl, byte [eax + 0x4093f8]
jmp dword [ecx*4 + 0x4093e0]
mov word [ebx + 0x87c], 1
jmp case.0x407329.0
mov word [ebx + 0x87c], 2
jmp case.0x407329.0
mov word [ebx + 0x880], 1
jmp case.0x407329.0
mov word [ebx + 0x880], 2
jmp case.0x407329.0
mov word [ebx + 0x880], 3
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebx + 0x882]
push 1
push eax
mov ecx, edi
call dword [edx + 0x34]
mov ax, word [ebx + 0x882]
cmp ax, 0x30
jle case.0x407329.0
add eax, 0xffffffd0
mov word [ebx + 0x882], ax
jmp case.0x407329.0
mov eax, dword [edi]
lea ecx, [ebx + 0x570]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x34]
push 0
push 0
push esi
mov ecx, ebx
call fcn.004097a0
jmp case.0x407329.0
mov edx, dword [edi]
lea eax, [ebx + 0x87e]
push 2
push eax
mov ecx, edi
call dword [edx + 0x34]
cmp word [ebx + 0x87e], 0xff
jne case.0x407329.0
push 0
push 0
push 0xc
lea eax, [ebp - 0x49c]
push 0
push eax
call dword [sym.imp.WINSPOOL.DRV_DeviceCapabilitiesA]
lea edi, [eax + eax*2]
mov dword [ebp - 0x20], eax
shl edi, 3
push edi
call fcn.0042b785
mov edx, eax
mov ecx, edi
mov dword [ebp - 0x18], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0xc
lea ecx, [ebp - 0x49c]
push 0
push ecx
call dword [sym.imp.WINSPOOL.DRV_DeviceCapabilitiesA]
mov edx, dword [ebp - 0x20]
lea eax, [edx + edx]
push eax
call fcn.0042b785
add esp, 4
mov edi, eax
lea ecx, [ebp - 0x49c]
push 0
push edi
push 6
push 0
push ecx
call dword [sym.imp.WINSPOOL.DRV_DeviceCapabilitiesA]
mov edx, dword [0x4457b0]
mov dword [ebp - 0x94], edx
lea eax, [ebp - 0x49c]
lea ecx, [ebp - 0x78]
push eax
mov byte [ebp - 4], 0x26
call fcn.0042bab2
push str.has_this_available_paper_bins:_n
lea ecx, [ebp - 0xfc]
push 0xb
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x27
call fcn.00413120
push eax
lea edx, [ebp - 0xf0]
push 0x442260
push edx
mov byte [ebp - 4], 0x28
call fcn.0042bd01
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x29
call fcn.0042be10
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x28
call fcn.0042ba44
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0x27
call fcn.0042ba44
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x4082c0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x9c]
xor eax, eax
push edx
mov ax, word [ecx]
lea edx, [ebp - 0x94]
push eax
push str._n_d_t_s
push edx
call fcn.0042ab8b
add esp, 0x10
lea eax, [ebp - 0x94]
lea ecx, [ebp - 0x78]
push eax
call fcn.0042be10
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
add edx, 0x18
add ecx, 2
dec eax
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x20], eax
jne 0x40826c
push edi
call fcn.0042069b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0042069b
mov edx, dword [ebp - 0x78]
add esp, 8
push 0
push 0x40
push edx
call fcn.004325b2
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x26
call fcn.0042ba44
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 3
call fcn.0042ba44
jmp case.0x407329.0
fld dword [ebp - 0x1c]
fsub dword [ebx + 0x660]
fstp dword [ebp - 0x1c]
jmp case.0x407329.0
xor ecx, ecx
lea edx, [ebx + 0x7e8]
fld dword [ebp - 0x34]
fadd dword [edx]
fcomp dword [ebp - 0x1c]
fnstsw ax
test ah, 0x41
je 0x408335
inc ecx
add edx, 4
cmp ecx, 0x20
jl 0x408318
jmp case.0x407329.0
fld dword [ebp - 0x34]
fadd dword [ebx + ecx*4 + 0x7e8]
fstp dword [ebp - 0x1c]
jmp case.0x407329.0
mov dword [ebx + 0x68c], 2
push 0
push 0
push esi
mov ecx, ebx
call fcn.004097a0
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x568], 1
call fcn.004097a0
jmp case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x568], 0
call fcn.004097a0
jmp case.0x407329.0
cmp dword [ebx + 0x68c], 2
jne case.0x407329.0
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x68c], 0
call fcn.004097a0
jmp case.0x407329.0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp case.0x407329.0
cmp dword [ebx + 0x68c], 2
jne 0x4083ea
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x68c], 0
call fcn.004097a0
mov al, byte [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
cmp al, 0xa
mov dword [ebp - 0x1c], ecx
je 0x40843c
mov eax, dword [ebx + 0x7e4]
test eax, eax
je 0x40843c
xor ecx, ecx
lea edx, [ebx + 0x7a4]
fld dword [edx]
fsub dword [ebp - 0x54]
fcomp dword [ebp - 0x24]
fnstsw ax
test ah, 1
jne 0x408423
inc ecx
add edx, 4
cmp ecx, 0x10
jl 0x408409
jmp 0x408430
fld dword [ebx + ecx*4 + 0x7a4]
fsub dword [ebp - 0x54]
fstp dword [ebp - 0x24]
cmp ecx, 0x10
jne 0x408448
fld dword [ebp - 0x64]
fchs
jmp 0x408445
fld dword [ebp - 0x24]
fsub dword [ebx + 0x664]
fstp dword [ebp - 0x24]
fld dword [ebp - 0x24]
fld dword [ebp - 0x64]
fsubr qword [0x437d68]
fcompp
fnstsw ax
test ah, 1
jne case.0x407329.0
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x50]
push 0
push ecx
mov eax, dword [edx]
lea edx, [ebp - 0x68]
push eax
push edx
lea eax, [ebp - 0x8c]
push esi
push eax
mov ecx, ebx
call fcn.00411390
test eax, eax
je 0x40848b
mov dword [ebp - 0x5c], 1
cmp dword [ebx + 0x68c], 2
jne 0x4084aa
push 0
push 0
push esi
mov ecx, ebx
mov dword [ebx + 0x68c], 0
call fcn.004097a0
fld dword [ebp - 0x54]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x4c], 1
fchs
fstp dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
jmp case.0x407329.0
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x40870a
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x4085ea
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x5c], 0
test eax, eax
jne 0x4085ea
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x4085ea
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x160]
push ecx
push edx
call dword [sym.imp.GDI32.dll_StartDocA]
test eax, eax
jge 0x4085c5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x4c]
push str.Cannot_print_to__s
lea ecx, [ebp - 0x104]
push 0xc
push ecx
mov ecx, ebx
call fcn.00413120
mov eax, dword [eax]
lea edx, [ebp - 0x49c]
push edx
push eax
lea eax, [ebp - 0xa48]
push eax
call fcn.00420a4c
add esp, 0xc
lea ecx, [ebp - 0x104]
call fcn.0042ba44
lea ecx, [ebp - 0xa48]
push ecx
mov ecx, ebx
call fcn.0040cca0
push 1
mov ecx, ebx
call fcn.00410510
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x73c]
call fcn.0042ba44
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 1
call fcn.0041b510
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0
call fcn.00434507
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
call fcn.00431753
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp word [ebx + 0x882], 1
jle 0x4085ea
mov eax, dword [ebp - 0x3c]
push eax
mov word [eax + 0x36], 1
mov dword [eax + 0x28], pe_nt_image_headers32
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.GDI32.dll_ResetDCA]
mov eax, dword [ebp - 0x3c]
mov ecx, ebx
push eax
push esi
mov dword [ebp - 0x4c], 0
call fcn.00412550
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_StartPage]
mov edx, dword [esi]
push 5
mov ecx, esi
call dword [edx + 0x34]
push 1
mov ecx, esi
call fcn.004318de
mov cl, byte [ebx + 0x360]
lea eax, [ebx + 0x360]
test cl, cl
je 0x408659
mov ecx, dword [ebx + 0x8a8]
push 0xffffffffffffffff
push ecx
mov ecx, dword [ebx + 0x8a4]
mov edx, 0x82
sub edx, ecx
mov ecx, dword [ebx + 0x8a0]
sub ecx, 0xa0
push edx
mov edx, dword [esi + 4]
push ecx
push eax
push edx
mov ecx, ebx
call fcn.00412f40
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4086c0
push esi
mov ecx, ebx
call fcn.0040aa40
test eax, eax
jne 0x4086c0
lea ecx, [ebp - 0x73c]
mov byte [ebp - 4], 2
call fcn.0042ba44
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 1
call fcn.0041b510
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0
call fcn.00434507
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
call fcn.00431753
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x5d4]
test eax, eax
jne 0x4086e1
mov eax, dword [ebx + 0x88c]
test eax, eax
jne 0x4086e1
push 6
mov ecx, esi
call fcn.00431ba5
push 0x2e
jmp 0x4086ec
push 0
mov ecx, esi
call fcn.00431ba5
push 0xe
mov ecx, esi
call fcn.00431bda
mov ecx, dword [ebp - 0x60]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
push 1
push 0
push esi
mov ecx, ebx
call fcn.004097a0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40873b
fld dword [ebp - 0x54]
mov ecx, dword [ebx + 0x888]
mov edx, dword [ebp - 0x34]
mov eax, dword [edi]
push 0
fchs
fstp dword [ebp - 0x24]
push ecx
mov ecx, edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], edx
call dword [eax + 0x28]
jmp case.0x407329.0
fld dword [ebp - 0x1c]
call fcn.00420414
fld dword [ebp - 0x24]
mov edi, eax
call fcn.00420414
mov ecx, dword [ebx + 0x878]
lea edx, [ebp - 0x14]
sub eax, ecx
push edx
mov ecx, ebx
mov dword [ebp - 0x20], eax
call fcn.00409d20
test eax, eax
jne 0x4088d3
mov eax, dword [ebx + 0x59c]
test eax, eax
je 0x408791
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
push ecx
lea edx, [ebp - 0x14]
push esi
push edx
mov ecx, ebx
call fcn.00411650
test eax, eax
jne case.0x407329.0
mov eax, dword [ebx + 0x5d4]
test eax, eax
je 0x4087e4
mov eax, dword [ebp - 0x14]
push 1
push eax
lea ecx, [ebp - 0xe0]
call fcn.0042a5ab
mov eax, dword [ebp - 0xe0]
mov edx, dword [esi]
mov byte [ebp - 4], 0x2a
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [ebp - 0x20]
mov ecx, esi
push eax
push edi
call dword [edx + 0x5c]
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 3
call fcn.0042ba44
fld dword [ebp - 0x1c]
fadd dword [ebx + 0x660]
jmp 0x408a8e
mov eax, dword [ebx + 0x88c]
push 1
test eax, eax
je 0x408876
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xb4]
call fcn.0042a5ab
mov eax, dword [ebp - 0xb4]
mov edx, dword [esi]
mov byte [ebp - 4], 0x2b
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [ebp - 0x20]
mov ecx, esi
push eax
push edi
call dword [edx + 0x5c]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.0042ba44
mov ecx, dword [ebp - 0x14]
push 1
push ecx
lea ecx, [ebp - 0xdc]
call fcn.0042a5ab
mov eax, dword [ebp - 0xdc]
lea edx, [ebp - 0x1ac]
push edx
mov edx, dword [esi + 4]
mov ecx, dword [eax - 8]
push ecx
push eax
push edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
fild dword [ebp - 0x1ac]
lea ecx, [ebp - 0xdc]
fadd dword [ebp - 0x1c]
fstp dword [ebp - 0x1c]
call fcn.0042ba44
jmp 0x408a8b
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc4]
push eax
call fcn.0042a5ab
fld dword [ebx + 0x660]
fmul dword [0x437d00]
mov byte [ebp - 4], 0x2c
call fcn.00420414
sub edi, eax
mov eax, dword [ebp - 0xc4]
mov edx, dword [esi]
add edi, 0xa
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [ebp - 0x20]
mov ecx, esi
push eax
push edi
call dword [edx + 0x5c]
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 3
call fcn.0042ba44
fld dword [ebp - 0x1c]
fadd dword [ebx + 0x660]
jmp 0x408a8e
cmp eax, 3
jne 0x40893d
mov eax, dword [ebx + 0x5d4]
test eax, eax
jne 0x4087d6
mov eax, dword [ebx + 0x88c]
test eax, eax
je 0x4087d6
mov ecx, dword [ebp - 0x14]
push 1
push ecx
lea ecx, [ebp - 0xd4]
call fcn.0042a5ab
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0x1b4]
push edx
mov edx, dword [esi + 4]
mov ecx, dword [eax - 8]
push ecx
push eax
push edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
fild dword [ebp - 0x1b4]
lea ecx, [ebp - 0xd4]
fadd dword [ebp - 0x1c]
fstp dword [ebp - 0x1c]
call fcn.0042ba44
jmp 0x408a8b
cmp eax, 1
push 0
jne 0x40894a
mov eax, dword [ebp - 0x14]
push eax
jmp 0x40894c
push 0
push esi
mov ecx, ebx
call fcn.004097a0
mov eax, dword [ebx + 0x5d4]
test eax, eax
je 0x408999
mov ecx, dword [ebp - 0x14]
push 1
push ecx
lea ecx, [ebp - 0xcc]
call fcn.0042a5ab
mov eax, dword [ebp - 0xcc]
mov edx, dword [esi]
mov byte [ebp - 4], 0x2d
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [ebp - 0x20]
mov ecx, esi
push eax
push edi
call dword [edx + 0x5c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xcc]
jmp 0x408a6e
mov eax, dword [ebx + 0x88c]
push 1
test eax, eax
je 0x408a24
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xb8]
call fcn.0042a5ab
mov eax, dword [ebp - 0xb8]
mov edx, dword [esi]
mov byte [ebp - 4], 0x2e
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [ebp - 0x20]
mov ecx, esi
push eax
push edi
call dword [edx + 0x5c]
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.0042ba44
mov ecx, dword [ebp - 0x14]
push 1
push ecx
lea ecx, [ebp - 0xc0]
call fcn.0042a5ab
mov eax, dword [ebp - 0xc0]
lea edx, [ebp - 0x1bc]
push edx
mov edx, dword [esi + 4]
mov ecx, dword [eax - 8]
push ecx
push eax
push edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
fild dword [ebp - 0x1bc]
lea ecx, [ebp - 0xc0]
fadd dword [ebp - 0x1c]
fstp dword [ebp - 0x1c]
call fcn.0042ba44
jmp 0x408a7f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc8]
push eax
call fcn.0042a5ab
fld dword [ebx + 0x660]
fmul dword [0x437d00]
mov byte [ebp - 4], 0x2f
call fcn.00420414
sub edi, eax
mov eax, dword [ebp - 0xc8]
mov edx, dword [esi]
add edi, 0xa
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [ebp - 0x20]
mov ecx, esi
push eax
push edi
call dword [edx + 0x5c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc8]
call fcn.0042ba44
fld dword [ebp - 0x1c]
fadd dword [ebx + 0x660]
fstp dword [ebp - 0x1c]
push 0
push 0
push esi
mov ecx, ebx
call fcn.004097a0
fld dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x890]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x170], ecx
fild qword [ebp - 0x170]
fadd st(1)
fstp dword [ebp - 0x1c]
fstp st(0)
jmp case.0x407329.0
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x8c]
mov eax, dword [edx]
mov edx, dword [ebp - 0x50]
push edx
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push ecx
mov ecx, ebx
call fcn.00411430
test eax, eax
jne 0x40848b
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x4c]
mov eax, dword [ebx + 0x898]
test eax, eax
jne 0x408d55
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x408d55
cmp eax, 2
jg 0x408c2e
lea ecx, [ebp - 0x228]
call fcn.0042b190
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x30
call fcn.0042b190
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x31
call fcn.0042b190
mov eax, dword [0x4457b0]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], eax
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 0x34
call fcn.0042b190
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x35
call fcn.0042b190
mov eax, dword [ebp - 0x68]
mov edi, 1
cmp eax, edi
mov byte [ebp - 4], 0x36
jl 0x408bb1
movsx eax, byte [ebp - 0x50]
push edi
push eax
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x944]
mov ecx, dword [eax]
push ecx
push str._s_c_d.emf
push edx
call fcn.00420a4c
mov ecx, dword [ebp - 0x1dc]
add esp, 0x14
lea eax, [ebp - 0x944]
push eax
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.0042b36c
mov eax, dword [ebp - 0x68]
inc edi
cmp edi, eax
jle 0x408b70
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x228]
push edx
push eax
mov ecx, ebx
call fcn.00411c90
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x3c
call fcn.0042b1c3
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 0x3b
call fcn.0042b1c3
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0x3a
call fcn.0042ba44
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 0x39
call fcn.0042ba44
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x38
call fcn.0042b1c3
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x37
call fcn.0042b1c3
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 3
call fcn.0042b1c3
jmp 0x408cac
mov ecx, dword [0x4457b0]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x68]
mov edi, 1
cmp eax, edi
mov byte [ebp - 4], 0x3d
jl 0x408c95
movsx eax, byte [ebp - 0x50]
mov edx, dword [ebp - 0x38]
push edi
push eax
lea ecx, [ebp - 0x944]
mov eax, dword [edx]
push eax
push str._s_c_d.emf
push ecx
call fcn.00420a4c
mov edx, dword [ebp - 0x2c]
add esp, 0x14
mov eax, dword [edx - 8]
test eax, eax
je 0x408c7e
push 0x4403e8
lea ecx, [ebp - 0x2c]
call fcn.0042bdd4
lea eax, [ebp - 0x944]
lea ecx, [ebp - 0x2c]
push eax
call fcn.0042bdd4
mov eax, dword [ebp - 0x68]
inc edi
cmp edi, eax
jle 0x408c47
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, ebx
call fcn.00411b10
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0042ba44
mov edx, dword [ebp - 0x70]
mov ecx, ebx
push edx
call fcn.0040b050
mov edi, 1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x5c], edi
cmp edi, eax
jg 0x408d55
movsx eax, byte [ebp - 0x50]
mov ecx, dword [ebp - 0x38]
push edi
push eax
lea eax, [ebp - 0x944]
mov edx, dword [ecx]
push edx
push str._s_c_d.emf
push eax
call fcn.00420a4c
add esp, 0x14
lea ecx, [ebp - 0x944]
mov byte [ebp - 4], 0x3e
push ecx
call fcn.00430430
mov dword [ebp - 4], 3
inc edi
jmp 0x408cbc
mov eax, dword [ebx + 0x44]
test eax, eax
jne 0x408d72
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x408d72
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x4090cf
mov ecx, esi
call fcn.0043170c
push eax
call dword [sym.imp.GDI32.dll_CloseMetaFile]
push eax
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
jmp 0x4090cf
mov edx, dword [ebx + 0x794]
lea ecx, [ebx + 0x794]
lea eax, [ebp - 0x40]
push eax
call dword [edx + 0x18]
mov ecx, dword [0x4457b0]
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebx + 0x5b4]
mov byte [ebp - 4], 0x10
cmp eax, edi
je 0x408dc3
mov dword [ebx + 0x5b8], edi
push str..RTF
jmp 0x408dce
mov dword [ebx + 0x5b4], edi
push str..PDF
lea ecx, [ebp - 0x6c]
call fcn.0042bb81
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x40]
push edx
call fcn.0042be10
mov edi, 1
mov edx, dword [ebp - 0x40]
mov eax, dword [ebx + 0x8d0]
lea ecx, [ebx + 0x8d0]
push 0
push 0x1021
push edx
call dword [eax + 0x20]
test eax, eax
jne 0x408ec4
mov eax, dword [ebx + 0x794]
lea ecx, [ebx + 0x794]
lea edx, [ebp - 0x114]
push edx
call dword [eax + 0x18]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [eax]
push ecx
push edi
push edx
lea eax, [ebp - 0x40]
push str._s_d_s
push eax
mov byte [ebp - 4], 0x11
call fcn.0042ab8b
add esp, 0x14
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x10
call fcn.0042ba44
inc edi
cmp edi, 0x64
jl 0x408de7
push str.Cannot_create_output_file
lea ecx, [ebp - 0x124]
push 9
push ecx
mov ecx, ebx
call fcn.00413120
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 0x12
push edx
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0042bc27
mov eax, dword [eax]
mov ecx, ebx
push eax
mov byte [ebp - 4], 0x13
call fcn.0040cca0
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x12
call fcn.0042ba44
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0x10
call fcn.0042ba44
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xf
call fcn.0042ba44
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0042ba44
jmp 0x4091e3
mov eax, dword [ebx + 0x5b4]
push esi
test eax, eax
mov ecx, ebx
je 0x408ff6
call fcn.004183c0
mov eax, dword [ebx + 0x898]
test eax, eax
jne 0x4090b7
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x4090b7
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x409090
cmp eax, 2
jg 0x409000
lea ecx, [ebp - 0x294]
call fcn.0042b190
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x14
call fcn.0042b190
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0x15
call fcn.0042b190
mov eax, dword [0x4457b0]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x18
call fcn.0042b190
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x19
call fcn.0042b190
mov edx, dword [ebp - 0x248]
lea ecx, [ebp - 0x40]
push ecx
push edx
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x1a
call fcn.0042b398
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x294]
push eax
push ecx
mov ecx, ebx
call fcn.00411c90
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x20
call fcn.0042b1c3
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x1f
call fcn.0042b1c3
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0x1e
call fcn.0042ba44
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x1d
call fcn.0042ba44
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0x1c
call fcn.0042b1c3
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x1b
call fcn.0042b1c3
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0x10
call fcn.0042b1c3
jmp 0x40900b
call fcn.00414020
jmp 0x408eda
mov edx, dword [ebp - 0x40]
mov ecx, ebx
push edx
call fcn.00411b10
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x21
push eax
call fcn.00430430
jmp 0x40907c
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 4], 0x10
push ecx
mov ecx, ebx
call fcn.0040b050
jmp 0x4090b7
mov eax, dword [ebx + 0x5cc]
test eax, eax
mov eax, str.Print
jne 0x4090a4
mov eax, str.open
mov edx, dword [ebp - 0x40]
push 1
push 0
push 0
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xf
call fcn.0042ba44
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0042ba44
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4090f7
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0x41
mov eax, dword [eax]
push eax
call fcn.00430430
jmp 0x4090f0
mov dword [ebp - 4], 3
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x409194
push 6
mov ecx, ebx
call fcn.00410510
mov eax, dword [ebx + 0x18]
test eax, eax
jg 0x409119
mov dword [ebx + 0x18], 7
mov ecx, dword [ebx + 0x18]
mov eax, 0x28
cmp ecx, eax
jle 0x409128
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 0x18]
xor edi, edi
shl ecx, 6
test ecx, ecx
jle 0x409194
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [ebp - 0x70]
cmp esi, eax
jne 0x409165
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.0040ccc0
test eax, eax
je 0x40866c
mov edx, dword [ebx + 0x18]
inc edi
shl edx, 6
cmp edi, edx
jl 0x409134
jmp 0x409194
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x409179
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov ecx, ebx
call fcn.0040b050
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov ecx, ebx
call fcn.0040b050
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x4091ba
mov eax, dword [ebp - 0x48]
cmp eax, 1
jne 0x4091ac
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4091ba
cmp eax, 2
jne 0x4091ba
push ecx
call fcn.0042069b
add esp, 4
mov eax, dword [ebx + 0x894]
lea esi, [ebx + 0x894]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4091e3
push 0
push eax
mov ecx, ebx
call fcn.00413210
push 0x448ce0
mov ecx, esi
call fcn.0042bb81
mov eax, dword [ebp - 0x38]
add eax, 0x238
mov dword [ebp - 0x38], eax
mov edi, eax
jmp 0x40658a