Function at 0x408920
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xac
mov dword [esp + 0x14], edx
mov edx, ecx
mov edi, dword [esp + 0xcc]
mov eax, dword [0x501034]
xor eax, esp
xor ebx, ebx
mov ecx, edi
and ecx, 3
setne bl
add ebx, 1
imul ebx, dword [0x502700]
mov ecx, dword [esp + 0xc8]
mov dword [esp], ecx
shr ecx, 0x16
and cl, 1
mov dword [esp + 0xa8], eax
mov esi, ebx
shl ebx, cl
and edi, 3
je 0x408987
lea eax, [edx + edx]
mov ecx, dword [0x502738]
cmp eax, dword [ecx + 0x12c]
jge 0x4098da
mov eax, dword [0x502704]
xor ebp, ebp
test dword [esp + 0xc8], 0x40000000
jne 0x4089a5
mov dword [esp + 0xc], 0
jmp 0x4089ee
cmp dword [0x5027b0], 0
je 0x4089bd
mov ecx, dword [0x502738]
cmp byte [ecx + 0x142], 0
je 0x40899b
mov ecx, dword [0x4c88b0]
lea ebp, [esp + 0xd0]
mov dword [ebp + 4], ecx
mov dword [ebp], ecx
xor ebp, ebp
mov ecx, dword [esp + 0xc8]
and ecx, 0xfecc0000
or ecx, 0x20b04
mov dword [esp], ecx
mov cl, 1
mov dword [esp + 0xc], ecx
imul esi, edx
mov edx, esi
mov ecx, dword [esp + 0x14]
imul ecx, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 8], 1
test edi, edi
mov dword [esp + 0x1c], ebx
je 0x408a17
cmp dword [0x5027b4], 3
je 0x408a34
test edi, edi
je 0x408a27
cmp edi, 1
jne 0x408a2b
mov ebp, 4
jmp 0x408a34
mov ebp, edi
jmp 0x408a30
mov ebp, 0xc
mov dword [esp + 8], edi
add edx, dword [0x502744]
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x14]
add ecx, dword [0x502740]
mov dword [esp + 0x14], ecx
mov ebx, dword [esp]
shr ebx, 0x13
mov edi, ebx
and edi, 0x10
mov ecx, dword [esp + 0xc0]
movzx ecx, word [ecx]
mov edx, ecx
add edx, 0xffffdc46
mov dword [esp + 4], 0
cmp dx, 3
ja 0x408a8f
add cl, 0x46
cmp cl, 3
ja case.default.0x408a82
movzx ecx, cl
jmp dword [ecx*4 + 0x4c8768]
add eax, eax
neg eax
jmp case.0x408a82.68
mov dword [esp + 0x38], 0
jmp 0x408ae1
xor edx, edx
jmp 0x408ab6
mov ecx, 0x99999999
jmp 0x408aab
add eax, eax
mov ecx, 0x66666667
imul ecx
mov eax, edx
shr eax, 0x1f
sar edx, 1
add edx, eax
mov ecx, dword [esp + 8]
shr ecx, 1
shl edx, cl
mov dword [esp + 0x38], edx
movzx ecx, word [0x5022e2]
mov eax, dword [esp + 0xc0]
mov word [eax], cx
and dword [esp], 0xfff7ffff
and bl, 1
mov dword [esp + 4], ebx
mov esi, dword [esp + 0xc4]
or ebp, edi
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x408ba7
cmp esi, 2
jl 0x408b1d
mov eax, dword [esp + 0xc0]
movzx eax, word [eax + 2]
and eax, 0xfc00
cmp eax, 0xdc00
jne 0x408b26
jmp 0x408ba7
cmp esi, 1
jne 0x408ba7
lea edx, [esi - 1]
mov eax, esi
and eax, 7
xor ecx, ecx
cmp edx, 7
mov esi, dword [esp + 0xc0]
jb 0x408b76
mov edx, dword [esp + 0xc4]
and edx, 0xfffffff8
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esi + ecx*2], 0xfffdfffd
mov dword [esi + ecx*2 + 4], 0xfffdfffd
mov dword [esi + ecx*2 + 8], 0xfffdfffd
mov dword [esi + ecx*2 + 0xc], 0xfffdfffd
add ecx, 8
cmp edx, ecx
jne 0x408b50
test eax, eax
je 0x408b9d
mov edx, dword [esp + 0xc0]
lea ecx, [edx + ecx*2]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx + edx*2], 0xfffd
add edx, 1
cmp eax, edx
jne 0x408b90
mov eax, dword [esp + 0xc0]
movzx ecx, word [eax]
and ecx, 0xff00
mov eax, ebp
or eax, 0x20
cmp ecx, 0xdc00
cmovne eax, ebp
mov edi, dword [esp]
mov ecx, edi
and ecx, 0x1ff
mov dword [esp + 0x24], ecx
mov esi, edi
shr esi, 9
and esi, 0x1ff
cmp dword [0x5027b8], 2
sete cl
mov edx, edi
shr edx, 0x12
and dl, cl
movzx ecx, dl
or ecx, eax
mov ebx, ecx
or ebx, 2
cmp byte [0x5027bc], 0
cmove ebx, ecx
test edi, 0x80000
cmove ebx, ecx
mov ecx, ebx
call fcn.00409900
test bl, 2
movzx eax, byte [esp + 4]
mov ecx, 1
cmove ecx, eax
mov ebp, ebx
and ebp, 0xfffffffc
cmp dword [ebx*4 + 0x5027c0], 0
cmovne ebp, ebx
cmovne ecx, eax
mov dword [esp + 0x50], ecx
mov ecx, ebp
call fcn.00409900
mov eax, dword [ebp*4 + 0x5027c0]
test eax, eax
cmove ebp, eax
test edi, 0x100000
jne 0x408c59
mov eax, dword [esp + 0x24]
lea edi, [esp + 0xd0]
jmp 0x408c70
lea edi, [esp + 0xd0]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov eax, esi
mov esi, dword [esp + 0x24]
test dword [esp], 0x40000
sete dl
mov cl, byte [0x5028c0]
test cl, cl
sete ch
or ch, dl
mov edx, dword [esp + 0xc]
or dl, ch
jne 0x408c97
cmp eax, 0xf
ja 0x408cae
or eax, 8
test dword [esp], 0x200000
je 0x408cd2
test cl, cl
je 0x408cd2
cmp esi, 0xf
ja 0x408cc5
or esi, 8
jmp 0x408cd2
xor edx, edx
cmp eax, 0x100
setae dl
or eax, edx
test dword [esp], 0x200000
jne 0x408ca0
jmp 0x408cd2
xor ecx, ecx
cmp esi, 0x100
setae cl
or esi, ecx
mov ecx, dword [0x502778]
test ecx, ecx
jne 0x408cf4
cmp byte [edi], 0
je 0x408cf4
movzx eax, word [edi + 1]
movzx edx, byte [edi + 3]
shl edx, 0x10
or edx, eax
test ecx, ecx
je 0x408cff
jmp 0x408d1d
mov edx, dword [eax*4 + 0x5028c4]
test ecx, ecx
jne 0x408d1d
cmp byte [edi + 4], 0
je 0x408d1d
movzx eax, word [edi + 5]
movzx esi, byte [edi + 7]
shl esi, 0x10
or esi, eax
test dword [esp], 0x1000000
jne 0x408d2d
jmp 0x408d72
mov esi, dword [esi*4 + 0x5028c4]
test dword [esp], 0x1000000
je 0x408d72
test ecx, ecx
jne 0x408d72
movzx eax, dl
add eax, eax
imul ecx, eax, 0xaaab
shr ecx, 0x11
mov eax, edx
shr eax, 7
and eax, 0x1fe
imul eax, eax, 0xaaab
shr eax, 9
and eax, 0xff00
or eax, ecx
shr edx, 0xf
and edx, 0x1fe
imul edx, edx, 0xaaab
shr edx, 1
and edx, 0xff0000
or edx, eax
mov edi, edx
push dword [ebp*4 + 0x5027c0]
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x40], edi
push edi
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetTextColor]
push esi
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp]
sar eax, 0x1f
add eax, 2
push eax
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x74], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x78], ecx
mov eax, dword [0x502704]
add eax, ecx
mov dword [esp + 0x80], eax
mov esi, dword [esp + 0xc4]
test esi, esi
jle 0x408eaa
xor ecx, ecx
xor eax, eax
xor edx, edx
mov ebp, dword [esp + 0xc0]
jmp 0x408e18
mov esi, edx
add esi, 1
mov edx, esi
mov edi, dword [esp + 0xc4]
cmp esi, edi
mov esi, edi
jge 0x408eb3
mov ebx, esi
lea esi, [edx + 1]
movzx edi, word [ebp + edx*2]
cmp esi, ebx
jge 0x408e80
movzx ebx, di
cmp ebx, 0xdb40
jne 0x408e50
movzx ebx, word [ebp + edx*2 + 2]
add ebx, 0x2300
movzx ebx, bx
cmp ebx, 0xf0
jb 0x408e02
jmp 0x408e60
mov ebx, edi
and ebx, 0xfc00
cmp ebx, 0xd800
jne 0x408e80
movzx ebx, word [ebp + edx*2 + 2]
and ebx, 0xfc00
cmp ebx, 0xdc00
jne 0x408e80
add eax, dword [esp + 0x1c]
jmp 0x408e02
lea esi, [edi - 0x180b]
cmp si, 3
jb 0x408e00
and edi, 0xfff0
cmp edi, 0xfe00
mov esi, dword [esp + 0x1c]
cmove esi, ecx
add eax, esi
jmp 0x408e00
xor eax, eax
mov ebp, dword [esp + 0xc0]
add eax, dword [esp + 0x20]
mov dword [esp + 0x7c], eax
mov ecx, dword [0x502738]
mov ecx, dword [ecx + 0x12c]
imul ecx, dword [0x502700]
add ecx, dword [0x502744]
cmp eax, ecx
jle 0x408edc
mov dword [esp + 0x7c], ecx
cmp byte [0x502cdc], 1
jne 0x408f1d
mov ecx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 0x1f
add eax, ecx
sar eax, 1
mov dword [esp + 0x30], eax
push 6
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov dword [esp + 0x10], 0
mov dword [esp + 0x44], 1
test esi, esi
jg 0x408f48
jmp 0x409859
push 0
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov dword [esp + 0x30], 0
mov eax, dword [0x5027a8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x44], esi
test esi, esi
jle 0x409859
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
add eax, ecx
mov dword [esp + 0x28], eax
mov al, 1
jmp 0x408fc4
mov eax, dword [esp + 0x28]
sub eax, ecx
add edi, 0xffffffff
push dword [esp + 0x10]
push esi
push dword [0x502ce0]
lea ecx, [esp + 0x80]
push ecx
push 4
push eax
push edi
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov eax, dword [0x5027a8]
mov dword [eax], 0xffffffff
push 1
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetBkMode]
lea ebp, [ebp + ebx*2]
mov eax, dword [esp + 0x58]
imul eax, dword [esp + 0x1c]
add dword [esp + 0x20], eax
xor eax, eax
mov esi, dword [esp + 0x5c]
sub esi, ebx
jle 0x409859
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
cmp eax, esi
mov ecx, esi
cmovl ecx, eax
mov ebx, ecx
cmp eax, 1
jne 0x409058
movzx eax, word [ebp]
and eax, 0xfc00
mov ebx, ecx
cmp eax, 0xd800
jne 0x409001
movzx eax, word [ebp + 2]
and eax, 0xfc00
xor ebx, ebx
cmp eax, 0xdc00
sete bl
add ebx, ecx
mov eax, esi
sub eax, ebx
jle 0x409058
mov edi, ecx
movzx ecx, word [ebp + ebx*2]
lea edx, [ecx - 0x180b]
cmp dx, 3
jb 0x409053
mov edx, ecx
and edx, 0xfffffff0
movzx edx, dx
cmp edx, 0xfe00
je 0x409053
cmp eax, 2
jb 0x409056
movzx eax, cx
cmp eax, 0xdb40
jne 0x409056
movzx eax, word [ebp + ebx*2 + 2]
add eax, 0x2300
movzx eax, ax
lea ecx, [ebx + 2]
cmp eax, 0xf0
cmovb ebx, ecx
jmp 0x409056
add ebx, 1
mov ecx, edi
cmp ebx, dword [0x5027ac]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ecx
jbe 0x409094
push 0
push 1
push ebx
push 4
push 0x5027ac
push dword [0x5027a8]
call fcn.00439870
add esp, 0x18
mov dword [0x5027a8], eax
mov ecx, dword [esp + 0x10]
test ecx, ecx
cmovne ecx, eax
mov dword [esp + 0x10], ecx
test ebx, ebx
mov dword [esp + 0xc], ebp
mov dword [esp + 4], ebx
jle 0x4091a0
xor ecx, ecx
mov eax, dword [0x5027a8]
jmp 0x4090cc
mov dword [edx], 0
lea edx, [eax + esi*4]
mov ecx, dword [esp + 0x1c]
mov dword [edx], ecx
mov ecx, esi
add ecx, 1
cmp ecx, ebx
jge 0x4091a0
lea edx, [eax + ecx*4]
mov esi, dword [esp + 0x1c]
mov dword [eax + ecx*4], esi
lea esi, [ecx + 1]
movzx edi, word [ebp + ecx*2]
cmp esi, ebx
jge 0x409160
movzx ebp, di
cmp ebp, 0xdb40
jne 0x409120
mov ebx, dword [esp + 0xc]
movzx ebp, word [ebx + ecx*2 + 2]
add ebp, 0x2300
movzx ebp, bp
cmp ebp, 0xef
mov ebp, ebx
mov ebx, dword [esp + 4]
ja 0x409134
test ecx, ecx
jle 0x4090b0
mov dword [eax + ecx*4 - 4], 0
jmp 0x4090b0
mov ebp, edi
and ebp, 0xfc00
cmp ebp, 0xd800
mov ebp, dword [esp + 0xc]
jne 0x409160
mov ebx, dword [esp + 0xc]
movzx ebp, word [ebx + ecx*2 + 2]
mov ebx, dword [esp + 4]
and ebp, 0xfc00
cmp ebp, 0xdc00
mov ebp, dword [esp + 0xc]
je 0x4090b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [edi - 0x180b]
cmp si, 3
jb 0x409181
and edi, 0xfff0
movzx esi, di
cmp esi, 0xfe00
jne 0x4090c1
test ecx, ecx
jle 0x40918d
mov dword [eax + ecx*4 - 4], 0
mov esi, ecx
jmp 0x4090b9
movzx eax, word [ebp]
cmp byte [0x501bf4], 0
je 0x4092b0
mov ecx, eax
and ecx, 0xff00
movzx ecx, cx
cmp ecx, 0xdd00
jne 0x4092b0
cmp ebx, dword [0x502ce4]
jle 0x4091f6
push dword [0x502ce0]
call fcn.00439860
add esp, 4
mov dword [0x502ce4], ebx
push 0
push 2
push ebx
call fcn.004397d0
add esp, 0xc
mov dword [0x502ce0], eax
test ebx, ebx
jle 0x4098da
xor edi, edi
xor ebp, ebp
xor esi, esi
jmp 0x40926b
movzx eax, byte [ebx + ebp*2]
mov byte [esp + 0x84], al
movzx eax, byte [ebx + ebp*2 + 2]
mov byte [esp + 0x85], al
mov eax, dword [0x5027a8]
mov ecx, dword [esp + 0x1c]
add dword [eax + esi*4], ecx
add ebp, 1
mov eax, dword [0x502ce0]
add eax, edi
push 1
push eax
push 2
lea eax, [esp + 0x90]
push eax
push 4
push dword [0x501bf8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esi, 1
add ebp, 1
add edi, 2
cmp ebp, dword [esp + 4]
jge 0x409410
mov eax, dword [0x502ce0]
mov word [eax + esi*2], 0xfffd
mov ebx, dword [esp + 0xc]
movzx eax, byte [ebx + ebp*2]
push eax
push dword [0x501bf8]
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
test eax, eax
jne 0x409210
movzx eax, byte [ebx + ebp*2]
mov byte [esp + 0x84], al
mov eax, dword [0x502ce0]
add eax, edi
push 1
push eax
push 1
jmp 0x409242
and eax, 0xfe00
cmp eax, 0xdc00
jne 0x409440
push 0
push 1
push ebx
push 1
push 0x502cec
push dword [0x502ce8]
call fcn.00439870
add esp, 0x18
mov dword [0x502ce8], eax
test ebx, ebx
je 0x40934e
mov ecx, dword [esp + 4]
lea esi, [ecx - 1]
and ecx, 3
xor edx, edx
cmp esi, 3
jb 0x40932a
mov esi, dword [esp + 4]
and esi, 0xfffffffc
xor edx, edx
nop
nop
nop
movzx ebx, byte [ebp + edx*2]
mov byte [eax + edx], bl
movzx ebx, byte [ebp + edx*2 + 2]
mov byte [eax + edx + 1], bl
movzx ebx, byte [ebp + edx*2 + 4]
mov byte [eax + edx + 2], bl
movzx ebx, byte [ebp + edx*2 + 6]
mov byte [eax + edx + 3], bl
add edx, 4
cmp esi, edx
jne 0x409300
test ecx, ecx
je 0x40934e
mov esi, eax
add esi, edx
lea edx, [edx*2]
add edx, ebp
xor edi, edi
nop
nop
nop
movzx ebx, byte [edx + edi*2]
mov byte [esi + edi], bl
add edi, 1
cmp ecx, edi
jne 0x409340
movzx ecx, byte [esp + 0x18]
and ecx, 1
xor edx, edx
cmp dword [esp + 8], 3
jne 0x409365
mov edx, dword [0x502704]
add ecx, ecx
add ecx, 4
mov edi, dword [esp + 0x28]
sub edi, edx
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
add esi, edx
push dword [esp + 0x10]
mov ebx, dword [esp + 8]
push ebx
push eax
lea eax, [esp + 0x80]
push eax
push ecx
push edi
push esi
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_ExtTextOutA]
test dword [esp], 0x40000
je 0x408f97
cmp dword [0x5027b8], 1
jne 0x408f97
push 1
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetBkMode]
xor ecx, ecx
cmp dword [esp + 8], 3
jne 0x4093d2
mov ecx, dword [0x502704]
mov eax, dword [esp + 0x28]
sub eax, ecx
add esi, 0xffffffff
push dword [esp + 0x10]
push ebx
push dword [0x502ce8]
lea ecx, [esp + 0x80]
push ecx
push 4
push eax
push esi
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x408f97
movzx ecx, byte [esp + 0x18]
and ecx, 1
mov eax, dword [0x502ce0]
cmp dword [esp + 8], 3
jne 0x409760
mov edx, dword [0x502704]
jmp 0x409762
cmp dword [0x502cf4], ebx
jge 0x40946e
push dword [0x502cf0]
call fcn.00439860
add esp, 4
mov dword [0x502cf4], ebx
push 0
push 2
push ebx
call fcn.004397d0
add esp, 0xc
mov dword [0x502cf0], eax
mov eax, dword [0x502cf0]
mov dword [esp + 0x2c], eax
test ebx, ebx
jle 0x4094ff
lea edx, [ebx - 1]
mov eax, ebx
and eax, 3
xor ecx, ecx
cmp edx, 3
mov edi, dword [esp + 0x2c]
jb 0x4094ce
mov edx, ebx
and edx, 0xfffffffc
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [ebp + ecx*2]
mov word [edi + ecx*2], si
movzx esi, word [ebp + ecx*2 + 2]
mov word [edi + ecx*2 + 2], si
movzx esi, word [ebp + ecx*2 + 4]
mov word [edi + ecx*2 + 4], si
movzx esi, word [ebp + ecx*2 + 6]
mov word [edi + ecx*2 + 6], si
add ecx, 4
cmp edx, ecx
jne 0x4094a0
test eax, eax
je 0x4094ff
mov edx, dword [esp + 0x2c]
lea edx, [edx + ecx*2]
lea ecx, [ecx*2]
add ecx, ebp
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
mov word [edx + esi*2], di
add esi, 1
cmp eax, esi
jne 0x4094f0
xor eax, eax
cmp dword [esp + 8], 3
jne 0x40950d
mov eax, dword [0x502704]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
lea esi, [ecx + edx]
test ebx, ebx
jle 0x4097f1
mov ecx, dword [esp + 0x14]
sub ecx, eax
add ecx, dword [esp + 0x38]
mov dword [esp + 0x48], ecx
mov eax, dword [0x5027a8]
mov dword [esp + 0x24], eax
mov eax, dword [0x5027a4]
mov dword [esp + 0x3c], eax
cmp dword [esp], 0
setns al
and al, byte [esp + 0x18]
xor ecx, ecx
mov dword [esp + 0x54], esi
mov ebp, esi
mov edi, ebx
jmp 0x4095b2
mov ebx, edi
mov edi, eax
movzx eax, byte [esp + 0x4c]
and eax, 1
add eax, eax
add eax, 4
push ecx
push edi
push ebx
lea ecx, [esp + 0x80]
push ecx
push eax
push dword [esp + 0x5c]
push dword [esp + 0x30]
mov edi, dword [esp + 0x58]
push edi
call dword [sym.imp.GDI32.dll_ExtTextOutW]
push edi
call dword [sym.imp.GDI32.dll_GetBkMode]
mov ebx, eax
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
xor eax, eax
mov ecx, esi
mov edi, dword [esp + 4]
cmp esi, edi
jge 0x4097dc
mov dword [esp + 0x4c], eax
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + ecx*2]
push eax
mov esi, ecx
call fcn.0041acd0
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x24]
mov ebp, dword [eax + esi*4]
add ebp, ecx
mov dword [esp + 0x34], esi
add esi, 1
cmp esi, edi
jge 0x409620
mov edi, dword [esp + 0x2c]
nop
nop
nop
nop
nop
movzx eax, word [edi + esi*2]
push eax
call fcn.0041acd0
add esp, 4
cmp bl, al
jne 0x409624
mov eax, dword [esp + 0x24]
add ebp, dword [eax + esi*4]
add esi, 1
cmp dword [esp + 4], esi
jne 0x4095f0
mov esi, dword [esp + 4]
jmp 0x409624
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
lea ecx, [eax + edx*4]
cmp byte [0x502cdc], 0
mov eax, 0
cmovne ecx, eax
mov eax, esi
sub eax, edx
lea edi, [edi + edx*2]
test bl, bl
je 0x409560
lea edx, [eax + eax]
add edx, 2
mov dword [esp + 0x68], edx
push 0
push 1
push edx
mov dword [esp + 0x7c], ecx
mov ebx, eax
call fcn.004397d0
add esp, 0xc
mov dword [esp + 0x34], eax
push 0
push 1
push ebx
mov dword [esp + 0x6c], ebx
call fcn.004397d0
add esp, 0xc
mov dword [esp + 0x6c], edi
mov dword [esp + 0x64], eax
lea eax, [esp + 0x88]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
push dword [esp + 0x68]
push 0
mov edi, dword [esp + 0x3c]
push edi
call fcn.004a2450
add esp, 0xc
push ebx
push 3
mov ebx, dword [esp + 0x6c]
push ebx
call fcn.004a2450
add esp, 0xc
mov dword [esp + 0x84], 0x24
mov dword [esp + 0x9c], edi
mov dword [esp + 0x98], ebx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0xa0], ecx
push 0x8113b
lea eax, [esp + 0x88]
push eax
push 0
push ecx
mov ebx, ecx
push dword [esp + 0x7c]
mov edi, dword [esp + 0x50]
push edi
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
movzx eax, byte [esp + 0x4c]
and eax, 1
add eax, eax
add eax, 0x14
push dword [esp + 0x70]
push ebx
push dword [esp + 0x3c]
lea ecx, [esp + 0x80]
push ecx
push eax
push dword [esp + 0x5c]
push dword [esp + 0x30]
push edi
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x409590
xor edx, edx
mov ebp, dword [esp + 0xc]
add ecx, ecx
add ecx, 4
mov ebx, dword [esp + 0x28]
sub ebx, edx
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x30]
add edi, edx
push dword [esp + 0x10]
push esi
push eax
lea eax, [esp + 0x80]
push eax
push ecx
push ebx
push edi
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_ExtTextOutW]
test dword [esp], 0x40000
mov ebx, dword [esp + 4]
je 0x408f8c
cmp dword [0x5027b8], 1
jne 0x408f8c
push 1
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetBkMode]
xor ecx, ecx
cmp dword [esp + 8], 3
jne 0x408f60
mov ecx, dword [0x502704]
jmp 0x408f60
push ebx
push dword [esp + 0x40]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ebp, dword [esp + 0xc]
mov ebx, edi
mov esi, dword [esp + 0x54]
test dword [esp], 0x40000
je 0x408f97
cmp dword [0x5027b8], 1
jne 0x408f97
push 1
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_SetBkMode]
xor ecx, ecx
cmp dword [esp + 8], 3
jne 0x409828
mov ecx, dword [0x502704]
mov eax, dword [esp + 0x28]
sub eax, ecx
add esi, 0xffffffff
push dword [esp + 0x10]
push ebx
push dword [0x502cf0]
lea ecx, [esp + 0x80]
push ecx
push 4
push eax
push esi
push dword [0x5027a4]
call dword [sym.imp.GDI32.dll_ExtTextOutW]
jmp 0x408f97
cmp dword [esp + 8], 2
je 0x4098a6
test dword [esp], 0x80000
sete al
cmp byte [esp + 0x50], 0
jne 0x40987b
or al, byte [0x5027bc]
test al, 1
jne 0x4098a6
mov ecx, dword [0x502cf8]
mov edx, dword [esp + 8]
push dword [esp + 0x40]
push dword [esp + 0x80]
push dword [esp + 0x80]
push dword [esp + 0x80]
call fcn.00409a20
add esp, 0x10
test dword [esp], 0x2000000
je 0x4098da
mov ecx, dword [0x502cfc]
mov edx, dword [esp + 8]
push dword [esp + 0x40]
push dword [esp + 0x80]
push dword [esp + 0x80]
push dword [esp + 0x80]
call fcn.00409a20
add esp, 0x10
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.0049f6f0
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret