Function at 0x404240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x5384d2
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
push ebx
push esi
push edi
mov eax, dword [0x587c80]
xor eax, esp
push eax
lea eax, [esp + 0xf8]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
inc dword [0x59c634]
lea ecx, [esp + 0xb4]
call fcn.0041799d
xor eax, eax
mov dword [esp + 0x100], eax
cmp esi, eax
je 0x404297
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0xb8]
call fcn.004180ca
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], vtable.CBitmap.0
mov ebx, dword [ebp + 8]
mov byte [esp + 0x100], 1
mov ecx, dword [ebx + 0x8c]
sub ecx, dword [ebx + 0x84]
mov esi, dword [ebx + 0x90]
sub esi, dword [ebx + 0x88]
lea eax, [ebx + 0x84]
mov dword [esp + 0x74], eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edi, [eax + eax*4]
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
push esi
mov esi, dword [ebp + 0xc]
add eax, edx
lea ebx, [eax + eax*4]
mov eax, dword [esi + 4]
push ecx
add ebx, ebx
push eax
add edi, edi
mov dword [esp + 0x60], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0xb0]
call fcn.0041839e
mov ecx, dword [esp + 0xb0]
mov edx, dword [esp + 0xb8]
push ecx
push edx
call fcn.0041842f
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x74]
push 0xffffff
push eax
lea ecx, [esp + 0xbc]
call fcn.00419eb6
mov dword [esp + 0xa0], 0
mov dword [esp + 0x9c], vtable.CFont.0
push 0
push 0x566298
push 0x50
lea ecx, [esp + 0xa8]
mov byte [esp + 0x10c], 2
call fcn.0041a2a3
push 0
push 2
push 0
lea ecx, [esp + 0x98]
call fcn.0041855f
lea ecx, [esp + 0x8c]
push ecx
mov ecx, esi
mov byte [esp + 0x104], 3
call fcn.0041848b
push 0
push 0x14
lea edx, [esp + 0x9c]
push edx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x68], eax
call fcn.00417dc1
push ebx
push 0x14
lea ecx, [esp + 0xbc]
call fcn.0041783c
lea esi, [ebx - 0x1a4]
push esi
push 0x14
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0xc0]
mov dword [esp + 0x74], esi
call fcn.00417dc1
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
push 0
push 0x14
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0xc0]
call fcn.00417dc1
push 0xa
push 0xf
lea ecx, [esp + 0xbc]
call fcn.0041783c
push 0
push 0x14
lea edx, [esp + 0x9c]
push edx
lea ecx, [esp + 0xc0]
call fcn.00417dc1
push 0xa
push 0x19
lea ecx, [esp + 0xbc]
call fcn.0041783c
push esi
push edi
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0xc0]
call fcn.00417dc1
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffe61
push ecx
lea ebx, [edi - 0xa]
push ebx
lea ecx, [esp + 0xbc]
call fcn.0041783c
push esi
push edi
lea edx, [esp + 0x9c]
push edx
lea ecx, [esp + 0xc0]
call fcn.00417dc1
mov eax, dword [esp + 0x54]
add eax, 0xfffffe57
push eax
push ebx
lea ecx, [esp + 0xbc]
call fcn.0041783c
mov ecx, dword [esp + 0x5c]
push ecx
lea ecx, [esp + 0xb8]
call fcn.0041848b
push 0xaa9955
push 1
push 2
lea ecx, [esp + 0xb0]
call fcn.0041855f
lea edx, [esp + 0xa4]
push edx
lea ecx, [esp + 0xb8]
mov byte [esp + 0x104], 4
call fcn.0041848b
mov dword [esp + 0x5c], eax
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404530
push 0x80004005
call fcn.00401aa0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x60], eax
mov ebx, dword [esp + 0x54]
lea ecx, [ebx - 0x1ae]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
mov byte [esp + 0x100], 5
test esi, esi
jle 0x40467a
mov eax, dword [esp + 0x54]
lea ecx, [esi + esi*4 + 0xa]
lea ebx, [esi + esi*4]
add ecx, ecx
add ebx, ebx
sub eax, ecx
mov dword [esp + 0x64], 0xa
mov dword [esp + 0x58], eax
jmp 0x404590
push ebx
push 0x14
lea edx, [esp + 0x9c]
push edx
lea ecx, [esp + 0xc0]
call fcn.00417dc1
cmp dword [esp + 0x58], 0
jle 0x404654
mov eax, dword [esp + 0x58]
cdq
mov ecx, 0x64
idiv ecx
test edx, edx
jne 0x404654
lea edx, [esp + 0x8c]
push edx
lea ecx, [esp + 0xb8]
call fcn.0041848b
push ebx
lea eax, [edi - 0x14]
push eax
lea ecx, [esp + 0xbc]
call fcn.0041783c
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0xb8]
call fcn.0041848b
mov ecx, dword [esp + 0x64]
push ecx
lea edx, [esp + 0x64]
push 0x566454
push edx
call fcn.00401b70
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx - 0xc]
add esp, 0xc
push eax
mov eax, dword [esp + 0xb8]
mov edx, dword [eax + 0x5c]
push ecx
push ebx
push 0
lea ecx, [esp + 0xc4]
call edx
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0xb8]
call fcn.0041848b
add dword [esp + 0x64], 0xa
mov dword [esp + 0x5c], eax
jmp 0x404665
push ebx
lea eax, [edi - 0x14]
push eax
lea ecx, [esp + 0xbc]
call fcn.0041783c
add dword [esp + 0x58], 0xa
dec esi
sub ebx, 0xa
test esi, esi
jg 0x404590
mov ebx, dword [esp + 0x54]
mov eax, 0x66666667
imul ebx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ebx, 0xfffffe70
mov eax, 0x66666667
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jle 0x4046de
lea esi, [ecx + ecx*4]
add esi, esi
sub ecx, eax
mov ebx, ecx
nop
push esi
push 0x14
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0xc0]
call fcn.00417dc1
push esi
lea eax, [edi - 0x14]
push eax
lea ecx, [esp + 0xbc]
call fcn.0041783c
sub esi, 0xa
dec ebx
jne 0x4046b0
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.004059c0
fld1
lea esi, [edi - 0x14]
mov dword [esp + 0x70], esi
fild dword [esp + 0x70]
fcom st(2)
fnstsw ax
test ah, 5
jp 0x40470a
fstp st(1)
fdivp st(1)
fadd qword [0x567538]
jmp 0x40470e
fstp st(2)
fstp st(1)
fld qword [0x5674d0]
fmul st(1), st(0)
fxch st(1)
call fcn.00517f30
mov dword [esp + 0x70], eax
fidivr dword [esp + 0x70]
mov eax, 0x66666667
imul esi
fstp qword [esp + 0x94]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 3
jle 0x40485c
add eax, 0xfffffffd
mov esi, 0x1e
mov dword [esp + 0x64], 0xa
mov dword [esp + 0x6c], eax
lea ebx, [ebx]
push 0
push esi
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0xc0]
call fcn.00417dc1
lea ebx, [esi - 0x14]
test ebx, ebx
jle 0x40483a
mov eax, ebx
cdq
mov ecx, 0x64
idiv ecx
test edx, edx
jne 0x40483a
lea edx, [esp + 0x8c]
push edx
lea ecx, [esp + 0xb8]
call fcn.0041848b
mov eax, dword [esp + 0x54]
push eax
push esi
lea ecx, [esp + 0xbc]
call fcn.0041783c
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0xb8]
call fcn.0041848b
fild dword [esp + 0x64]
fmul qword [esp + 0x94]
call fcn.00517f30
push eax
lea edx, [esp + 0x64]
push 0x566454
push edx
call fcn.00401b70
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx - 0xc]
mov edx, dword [esp + 0xc0]
add esp, 0xc
push eax
mov eax, dword [esp + 0x58]
push ecx
add eax, 0xfffffe66
push eax
mov eax, dword [edx + 0x5c]
add ebx, 0xc
push ebx
lea ecx, [esp + 0xc4]
call eax
lea ecx, [esp + 0xa4]
push ecx
lea ecx, [esp + 0xb8]
call fcn.0041848b
add dword [esp + 0x64], 0xa
mov dword [esp + 0x5c], eax
jmp 0x40484c
mov edx, dword [esp + 0x54]
push edx
push esi
lea ecx, [esp + 0xbc]
call fcn.0041783c
add esi, 0xa
dec dword [esp + 0x6c]
jne 0x404760
mov ebx, dword [ebp + 8]
mov eax, dword [esp + 0x5c]
push eax
lea ecx, [esp + 0xb8]
call fcn.0041848b
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0xb8]
call fcn.0041848b
mov dword [esp + 0x6c], eax
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40489f
push 0x80004005
call fcn.00401aa0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x5c], esi
mov ecx, 0x5662a4
mov byte [esp + 0x100], 6
test ecx, 0xffff0000
jne 0x4048e8
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x74], eax
call fcn.0041d199
test eax, eax
je 0x4048fc
mov ecx, dword [esp + 0x70]
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.00403ef0
jmp 0x4048f8
push 4
push 0x5662a4
lea ecx, [esp + 0x64]
call fcn.00405f20
mov esi, dword [esp + 0x5c]
mov byte [esp + 0x100], 7
mov eax, dword [esi - 0xc]
mov edx, dword [esp + 0xb4]
push eax
mov eax, dword [edx + 0x5c]
push esi
push 0
push 0x1e
lea ecx, [esp + 0xc4]
call eax
add esi, 0xfffffff0
mov byte [esp + 0x100], 5
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404944
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40495e
push 0x80004005
call fcn.00401aa0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x5c], esi
mov ecx, 0x5662b0
mov byte [esp + 0x100], 8
test ecx, 0xffff0000
jne 0x4049a7
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x74], eax
call fcn.0041d199
test eax, eax
je 0x4049bb
mov ecx, dword [esp + 0x70]
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.00403ef0
jmp 0x4049b7
push 5
push 0x5662b0
lea ecx, [esp + 0x64]
call fcn.00405f20
mov esi, dword [esp + 0x5c]
mov edx, dword [esp + 0x54]
mov byte [esp + 0x100], 9
mov eax, dword [esi - 0xc]
push eax
mov eax, dword [esp + 0xb8]
push esi
add edx, 0xfffffe48
push edx
mov edx, dword [eax + 0x5c]
add edi, 0xffffffd8
push edi
lea ecx, [esp + 0xc4]
call edx
lea eax, [esi - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404a0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x6c]
push ecx
lea ecx, [esp + 0xb8]
call fcn.0041848b
lea ecx, [esp + 0x8c]
call fcn.004183f8
mov edx, dword [ebx + 0x94]
mov eax, dword [edx*4 + 0x5893a0]
push eax
push 3
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x90]
call fcn.0041839e
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0xb8]
call fcn.0041848b
mov dword [esp + 0x6c], eax
mov eax, dword [ebx + 0x98]
test eax, eax
je 0x405882
cmp dword [eax], 0
je 0x405882
mov ecx, dword [ebx + 0x94]
fild dword [esp + 0x68]
mov edx, dword [eax]
imul ecx, ecx, 0x324
fstp dword [esp + 0x58]
fld dword [esp + 0x58]
fld dword [ecx + edx + 0xc]
fmul qword [0x5674d0]
fsubp st(1)
lea eax, [ecx + edx + 0xc]
mov dword [esp + 0x5c], eax
call fcn.00517f30
mov esi, eax
push esi
push 0x14
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0xc0]
call fcn.00417dc1
push esi
mov edi, 0x1e
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
mov ecx, dword [ebx + 0x98]
mov edx, dword [ecx]
mov eax, dword [edx]
inc eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x68], 0
test eax, eax
jle 0x405712
mov eax, dword [esp + 0x5c]
add eax, 0x28
mov dword [esp + 0x50], eax
jmp 0x404b10
mov ecx, dword [esp + 0x68]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xa0], ecx
mov byte [esp + 0x4f], 0
lea ecx, [esp + 0x8c]
jne 0x404b67
call fcn.004183f8
push 0xff00
push 3
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x90]
call fcn.0041839e
lea edx, [esp + 0x8c]
push edx
lea ecx, [esp + 0xb8]
call fcn.0041848b
mov byte [esp + 0x4f], 1
jmp 0x404ba5
call fcn.004183f8
mov eax, dword [ebx + 0x94]
mov eax, dword [eax*4 + 0x5893a0]
push eax
push 3
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x90]
call fcn.0041839e
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0xb8]
call fcn.0041848b
fldz
mov ebx, dword [esp + 0x50]
fcom dword [ebx + 0x20]
mov dword [esp + 0x6c], eax
fnstsw ax
test ah, 5
jnp 0x404bc6
fcom dword [ebx]
fnstsw ax
test ah, 5
jp 0x404d0f
fstp st(0)
mov dword [esp + 0x80], edi
fld dword [ebx]
mov dword [esp + 0x7c], esi
fld qword [0x5674d0]
fmul st(1), st(0)
fxch st(1)
fdiv qword [esp + 0x94]
call fcn.00517f30
mov edx, dword [esp + 0x5c]
fld dword [edx]
add edi, eax
fmul dword [ebx + 0x20]
fmulp st(1)
fsubr dword [esp + 0x58]
call fcn.00517f30
mov esi, eax
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
cmp byte [esp + 0x4f], 0
je 0x404d0d
fldz
fcom dword [ebx]
fnstsw ax
test ah, 5
jp 0x404d0f
fstp st(0)
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x64], ebx
mov ecx, 0x5662bc
mov byte [esp + 0x100], 0xa
test ecx, 0xffff0000
jne 0x404c8a
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x7c], eax
call fcn.0041d199
test eax, eax
je 0x404c9e
mov ecx, dword [esp + 0x78]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00403ef0
jmp 0x404c9a
push 1
push 0x5662bc
lea ecx, [esp + 0x6c]
call fcn.00405f20
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x100], 0xb
mov eax, dword [ebx - 0xc]
push eax
mov eax, dword [esp + 0x80]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
push ebx
push eax
mov eax, edi
sub eax, dword [esp + 0x8c]
lea ecx, [esp + 0xc0]
cdq
sub eax, edx
sar eax, 1
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0xc0]
sub edx, 6
push edx
mov edx, dword [eax + 0x5c]
call edx
lea eax, [ebx - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404d09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x50]
fldz
fcom dword [ebx + 0x24]
fnstsw ax
test ah, 5
jnp 0x404d2b
fcom dword [ebx + 4]
fnstsw ax
test ah, 5
jp 0x404e79
mov ebx, dword [esp + 0x50]
fstp st(0)
mov dword [esp + 0x78], edi
fld dword [ebx + 4]
mov dword [esp + 0x7c], esi
fld qword [0x5674d0]
fmul st(1), st(0)
fxch st(1)
fdiv qword [esp + 0x94]
call fcn.00517f30
mov ecx, dword [esp + 0x5c]
fld dword [ecx]
add edi, eax
fmul dword [ebx + 0x24]
fmulp st(1)
fsubr dword [esp + 0x58]
call fcn.00517f30
mov esi, eax
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
cmp byte [esp + 0x4f], 0
je 0x404e77
fldz
mov edx, dword [esp + 0x50]
fcom dword [edx + 4]
fnstsw ax
test ah, 5
jp 0x404e79
fstp st(0)
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x64], ebx
mov ecx, 0x5662c0
mov byte [esp + 0x100], 0xc
test ecx, 0xffff0000
jne 0x404df8
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x84], eax
call fcn.0041d199
test eax, eax
je 0x404e0c
mov ecx, dword [esp + 0x80]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00403ef0
jmp 0x404e08
push 1
push 0x5662c0
lea ecx, [esp + 0x6c]
call fcn.00405f20
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x100], 0xd
mov eax, dword [ebx - 0xc]
push eax
mov eax, dword [esp + 0x80]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
push ebx
push eax
mov eax, edi
sub eax, dword [esp + 0x84]
lea ecx, [esp + 0xc0]
cdq
sub eax, edx
sar eax, 1
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0xc0]
sub edx, 6
push edx
mov edx, dword [eax + 0x5c]
call edx
lea eax, [ebx - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404e77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
fldz
mov ebx, dword [esp + 0x50]
fcom dword [ebx + 0x28]
fnstsw ax
test ah, 5
jnp 0x404e95
fcom dword [ebx + 8]
fnstsw ax
test ah, 5
jp 0x404fe3
fstp st(0)
mov dword [esp + 0x78], edi
fld dword [ebx + 8]
mov dword [esp + 0x7c], esi
fld qword [0x5674d0]
fmul st(1), st(0)
fxch st(1)
fdiv qword [esp + 0x94]
call fcn.00517f30
mov ecx, dword [esp + 0x5c]
fld dword [ecx]
add edi, eax
fmul dword [ebx + 0x28]
fmulp st(1)
fsubr dword [esp + 0x58]
call fcn.00517f30
mov esi, eax
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
cmp byte [esp + 0x4f], 0
je 0x404fe1
fldz
mov edx, dword [esp + 0x50]
fcom dword [edx + 8]
fnstsw ax
test ah, 5
jp 0x404fe3
fstp st(0)
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x64], ebx
mov ecx, 0x5662c4
mov byte [esp + 0x100], 0xe
test ecx, 0xffff0000
jne 0x404f62
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x84], eax
call fcn.0041d199
test eax, eax
je 0x404f76
mov ecx, dword [esp + 0x80]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00403ef0
jmp 0x404f72
push 1
push 0x5662c4
lea ecx, [esp + 0x6c]
call fcn.00405f20
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x100], 0xf
mov eax, dword [ebx - 0xc]
push eax
mov eax, dword [esp + 0x80]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
push ebx
push eax
mov eax, edi
sub eax, dword [esp + 0x84]
lea ecx, [esp + 0xc0]
cdq
sub eax, edx
sar eax, 1
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0xc0]
sub edx, 0xa
push edx
mov edx, dword [eax + 0x5c]
call edx
lea eax, [ebx - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404fe1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
fldz
mov ebx, dword [esp + 0x50]
fcom dword [ebx + 0x2c]
fnstsw ax
test ah, 5
jnp 0x404fff
fcom dword [ebx + 0xc]
fnstsw ax
test ah, 5
jp 0x40514d
fstp st(0)
mov dword [esp + 0x78], edi
fld dword [ebx + 0xc]
mov dword [esp + 0x7c], esi
fld qword [0x5674d0]
fmul st(1), st(0)
fxch st(1)
fdiv qword [esp + 0x94]
call fcn.00517f30
mov ecx, dword [esp + 0x5c]
fld dword [ecx]
add edi, eax
fmul dword [ebx + 0x2c]
fmulp st(1)
fsubr dword [esp + 0x58]
call fcn.00517f30
mov esi, eax
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
cmp byte [esp + 0x4f], 0
je 0x40514b
fldz
mov edx, dword [esp + 0x50]
fcom dword [edx + 0xc]
fnstsw ax
test ah, 5
jp 0x40514d
fstp st(0)
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x64], ebx
mov ecx, 0x5662c8
mov byte [esp + 0x100], 0x10
test ecx, 0xffff0000
jne 0x4050cc
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x84], eax
call fcn.0041d199
test eax, eax
je 0x4050e0
mov ecx, dword [esp + 0x80]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00403ef0
jmp 0x4050dc
push 1
push 0x5662c8
lea ecx, [esp + 0x6c]
call fcn.00405f20
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x100], 0x11
mov eax, dword [ebx - 0xc]
push eax
mov eax, dword [esp + 0x80]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
push ebx
push eax
mov eax, edi
sub eax, dword [esp + 0x84]
lea ecx, [esp + 0xc0]
cdq
sub eax, edx
sar eax, 1
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0xc0]
sub edx, 6
push edx
mov edx, dword [eax + 0x5c]
call edx
lea eax, [ebx - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40514b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
fldz
mov ebx, dword [esp + 0x50]
fcom dword [ebx + 0x30]
fnstsw ax
test ah, 5
jnp 0x405169
fcom dword [ebx + 0x10]
fnstsw ax
test ah, 5
jp 0x4052b7
fstp st(0)
mov dword [esp + 0x78], edi
fld dword [ebx + 0x10]
mov dword [esp + 0x7c], esi
fld qword [0x5674d0]
fmul st(1), st(0)
fxch st(1)
fdiv qword [esp + 0x94]
call fcn.00517f30
mov ecx, dword [esp + 0x5c]
fld dword [ecx]
add edi, eax
fmul dword [ebx + 0x30]
fmulp st(1)
fsubr dword [esp + 0x58]
call fcn.00517f30
mov esi, eax
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
cmp byte [esp + 0x4f], 0
je 0x4052b5
fldz
mov edx, dword [esp + 0x50]
fcom dword [edx + 0x10]
fnstsw ax
test ah, 5
jp 0x4052b7
fstp st(0)
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x64], ebx
mov ecx, 0x5662cc
mov byte [esp + 0x100], 0x12
test ecx, 0xffff0000
jne 0x405236
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x84], eax
call fcn.0041d199
test eax, eax
je 0x40524a
mov ecx, dword [esp + 0x80]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00403ef0
jmp 0x405246
push 1
push 0x5662cc
lea ecx, [esp + 0x6c]
call fcn.00405f20
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x100], 0x13
mov eax, dword [ebx - 0xc]
push eax
mov eax, dword [esp + 0x80]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
push ebx
push eax
mov eax, edi
sub eax, dword [esp + 0x84]
lea ecx, [esp + 0xc0]
cdq
sub eax, edx
sar eax, 1
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0xc0]
sub edx, 6
push edx
mov edx, dword [eax + 0x5c]
call edx
lea eax, [ebx - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4052b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
fldz
mov ebx, dword [esp + 0x50]
fcom dword [ebx + 0x34]
fnstsw ax
test ah, 5
jnp 0x4052d3
fcom dword [ebx + 0x14]
fnstsw ax
test ah, 5
jp 0x405421
fstp st(0)
mov dword [esp + 0x78], edi
fld dword [ebx + 0x14]
mov dword [esp + 0x7c], esi
fld qword [0x5674d0]
fmul st(1), st(0)
fxch st(1)
fdiv qword [esp + 0x94]
call fcn.00517f30
mov ecx, dword [esp + 0x5c]
fld dword [ecx]
add edi, eax
fmul dword [ebx + 0x34]
fmulp st(1)
fsubr dword [esp + 0x58]
call fcn.00517f30
mov esi, eax
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
cmp byte [esp + 0x4f], 0
je 0x40541f
fldz
mov edx, dword [esp + 0x50]
fcom dword [edx + 0x14]
fnstsw ax
test ah, 5
jp 0x405421
fstp st(0)
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x64], ebx
mov ecx, 0x5662d0
mov byte [esp + 0x100], 0x14
test ecx, 0xffff0000
jne 0x4053a0
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x84], eax
call fcn.0041d199
test eax, eax
je 0x4053b4
mov ecx, dword [esp + 0x80]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00403ef0
jmp 0x4053b0
push 1
push 0x5662d0
lea ecx, [esp + 0x6c]
call fcn.00405f20
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x100], 0x15
mov eax, dword [ebx - 0xc]
push eax
mov eax, dword [esp + 0x80]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
push ebx
push eax
mov eax, edi
sub eax, dword [esp + 0x84]
lea ecx, [esp + 0xc0]
cdq
sub eax, edx
sar eax, 1
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0xc0]
sub edx, 6
push edx
mov edx, dword [eax + 0x5c]
call edx
lea eax, [ebx - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40541f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
fldz
mov ebx, dword [esp + 0x50]
fcom dword [ebx + 0x38]
fnstsw ax
test ah, 5
jnp 0x40543d
fcom dword [ebx + 0x18]
fnstsw ax
test ah, 5
jp 0x40558b
fstp st(0)
mov dword [esp + 0x78], edi
fld dword [ebx + 0x18]
mov dword [esp + 0x7c], esi
fld qword [0x5674d0]
fmul st(1), st(0)
fxch st(1)
fdiv qword [esp + 0x94]
call fcn.00517f30
mov ecx, dword [esp + 0x5c]
fld dword [ecx]
add edi, eax
fmul dword [ebx + 0x38]
fmulp st(1)
fsubr dword [esp + 0x58]
call fcn.00517f30
mov esi, eax
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
cmp byte [esp + 0x4f], 0
je 0x405589
fldz
mov edx, dword [esp + 0x50]
fcom dword [edx + 0x18]
fnstsw ax
test ah, 5
jp 0x40558b
fstp st(0)
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x64], ebx
mov ecx, 0x5662d4
mov byte [esp + 0x100], 0x16
test ecx, 0xffff0000
jne 0x40550a
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x84], eax
call fcn.0041d199
test eax, eax
je 0x40551e
mov ecx, dword [esp + 0x80]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00403ef0
jmp 0x40551a
push 1
push 0x5662d4
lea ecx, [esp + 0x6c]
call fcn.00405f20
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x100], 0x17
mov eax, dword [ebx - 0xc]
push eax
mov eax, dword [esp + 0x80]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
push ebx
push eax
mov eax, edi
sub eax, dword [esp + 0x84]
lea ecx, [esp + 0xc0]
cdq
sub eax, edx
sar eax, 1
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0xc0]
sub edx, 6
push edx
mov edx, dword [eax + 0x5c]
call edx
lea eax, [ebx - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405589
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
fldz
mov ebx, dword [esp + 0x50]
fcom dword [ebx + 0x3c]
fnstsw ax
test ah, 5
jnp 0x4055a9
fcomp dword [ebx + 0x1c]
fnstsw ax
test ah, 5
jp 0x4056f3
jmp 0x4055ab
fstp st(0)
fld dword [ebx + 0x1c]
mov dword [esp + 0x78], edi
fld qword [0x5674d0]
mov dword [esp + 0x7c], esi
fmul st(1), st(0)
fxch st(1)
fdiv qword [esp + 0x94]
call fcn.00517f30
mov ecx, dword [esp + 0x5c]
fld dword [ecx]
add edi, eax
fmul dword [ebx + 0x3c]
fmulp st(1)
fsubr dword [esp + 0x58]
call fcn.00517f30
mov esi, eax
push esi
push edi
lea ecx, [esp + 0xbc]
call fcn.0041783c
cmp byte [esp + 0x4f], 0
je 0x4056f3
fldz
mov edx, dword [esp + 0x50]
fcomp dword [edx + 0x1c]
fnstsw ax
test ah, 5
jp 0x4056f3
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x64], ebx
mov ecx, 0x5662d8
mov byte [esp + 0x100], 0x18
test ecx, 0xffff0000
jne 0x405674
mov edx, ecx
movzx eax, dx
push eax
mov dword [esp + 0x84], eax
call fcn.0041d199
test eax, eax
je 0x405688
mov ecx, dword [esp + 0x80]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00403ef0
jmp 0x405684
push 1
push 0x5662d8
lea ecx, [esp + 0x6c]
call fcn.00405f20
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x100], 0x19
mov eax, dword [ebx - 0xc]
push eax
mov eax, dword [esp + 0x80]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
push ebx
push eax
mov eax, edi
sub eax, dword [esp + 0x84]
lea ecx, [esp + 0xc0]
cdq
sub eax, edx
sar eax, 1
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0xc0]
sub edx, 6
push edx
mov edx, dword [eax + 0x5c]
call edx
lea eax, [ebx - 0x10]
mov byte [esp + 0x100], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4056f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x68]
add dword [esp + 0x50], 0x64
inc eax
mov dword [esp + 0x68], eax
cmp eax, dword [esp + 0x70]
jl 0x404b10
mov eax, dword [esp + 0x70]
mov ebx, dword [ebp + 8]
fld qword [esp + 0x94]
mov ecx, dword [esp + 0x54]
sub esp, 8
fstp qword [esp]
add ecx, 0xffffff38
fld dword [0x567530]
push eax
push ecx
fstp dword [esp]
push ecx
mov dword [esp + 0x94], ecx
push ebx
lea ecx, [esp + 0xcc]
call fcn.00405b80
mov ecx, dword [esp + 0x80]
add ecx, 0xffffff38
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], ecx
call fcn.00419903
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404526
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x70], eax
mov byte [esp + 0x100], 0x1a
mov ecx, dword [esp + 0x64]
push ecx
lea edx, [esp + 0x74]
push str.MN_d
push edx
call fcn.00401b70
add esp, 0xc
mov dword [esp + 0x98], 0
mov dword [esp + 0x94], vtable.CFont.0
push 0
push 0x566298
push 0x78
lea ecx, [esp + 0xa0]
mov byte [esp + 0x10c], 0x1b
call fcn.0041a2a3
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0xb8]
call fcn.0041848b
mov ebx, dword [esp + 0x70]
mov eax, dword [ebx - 0xc]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0xb4]
push eax
mov eax, dword [edx + 0x5c]
push ebx
push ecx
push 0x14
lea ecx, [esp + 0xc4]
call eax
add dword [esp + 0x68], 0x32
mov byte [esp + 0x100], 0x1a
lea ecx, [esp + 0x94]
mov dword [esp + 0x94], vtable.CFont.0
call fcn.00401b90
add ebx, 0xfffffff0
mov byte [esp + 0x100], 5
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405857
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov eax, dword [esp + 0x64]
inc eax
mov dword [esp + 0x64], eax
cmp eax, 8
jl 0x405762
push esi
push edi
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0xc0]
call fcn.00417dc1
mov ebx, dword [ebp + 8]
mov ecx, dword [esp + 0x6c]
push ecx
lea ecx, [esp + 0xb8]
call fcn.0041848b
mov ecx, dword [ebx + 0x8c]
mov edx, dword [esp + 0x74]
sub ecx, dword [edx]
mov eax, dword [ebx + 0x90]
sub eax, dword [ebx + 0x88]
mov edx, dword [esp + 0xb8]
push 0xcc0020
push 0
push 0
push edx
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [eax + 4]
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x88]
test eax, eax
je 0x4058dd
mov eax, dword [eax + 4]
mov edx, dword [esp + 0xb8]
push eax
push edx
call fcn.0041842f
mov byte [esp + 0x100], 4
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405913
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x100], 3
mov esi, vtable.CPen.0
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa4], esi
call fcn.00401b90
mov byte [esp + 0x100], 2
lea ecx, [esp + 0x8c]
mov dword [esp + 0x8c], esi
call fcn.00401b90
mov byte [esp + 0x100], 1
lea ecx, [esp + 0x9c]
mov dword [esp + 0x9c], vtable.CFont.0
call fcn.00401b90
mov byte [esp + 0x100], 0
lea ecx, [esp + 0xac]
mov dword [esp + 0xac], vtable.CBitmap.0
call fcn.00401b90
lea ecx, [esp + 0xb4]
mov dword [esp + 0x100], 0xffffffff
call fcn.0041814b
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8