Function at 0x4d04b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4cc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x128]
test eax, eax
je 0x4d04e6
sub esp, 0x30
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push ebx
movsw word es:[edi], word [esi]
call fcn.004cf6f0
add esp, 0x34
mov esi, dword [ebp + 0x48]
mov edi, dword [ebp + 0x44]
push esi
push edi
lea ecx, [ebp + 0x3c]
call fcn.0041e780
test eax, eax
jne 0x4d26c1
mov ax, word [ebx + 0xc]
mov ecx, ebx
push eax
push 1
call fcn.0040c330
push eax
call fcn.004017f0
mov ecx, dword [ebp + 0x4c]
push eax
push ecx
mov dword [esp + 0x44], eax
call fcn.004c8740
mov edx, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x40]
sub edi, edx
sub esi, ecx
mov dword [esp + 0x58], edi
add esp, 8
fild dword [esp + 0x50]
mov dword [esp + 0x50], esi
mov dword [ebp + 0x4c], eax
fstp qword [esp + 0x70]
fild dword [esp + 0x50]
fst qword [esp + 0x68]
fmul qword [esp + 0x68]
fld qword [esp + 0x70]
fmul qword [esp + 0x70]
faddp st(1)
fstp qword [esp]
call fcn.00402350
call fcn.004d7580
mov edx, dword [esp + 0x74]
mov ecx, dword [esp + 0x6c]
mov edi, eax
mov eax, dword [esp + 0x70]
push edx
mov edx, dword [esp + 0x6c]
push eax
push ecx
push edx
mov dword [esp + 0x94], edi
call fcn.00402310
fmul qword [0x4dcaf8]
fmul qword [0x4dcaf0]
fchs
call fcn.004d7580
mov esi, eax
mov eax, dword [ebp + 0x50]
and eax, 0xffff
push edi
lea edx, [esp + 0xc8]
mov dword [esp + 0x78], esi
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [ebp + 0x4c]
push eax
lea ecx, [ecx + ecx*2]
shl ecx, 2
mov dword [esp + 0xa0], ecx
lea ecx, [ecx + 0x5073c0]
push ecx
push edx
call fcn.004c8770
add esp, 0x28
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x32]
xor edi, edi
push eax
push edi
push 6
mov dword [esp + 0x24], edi
call dword [sym.imp.GDI32.dll_CreatePen]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x48], eax
cmp dword [ebp + 0x4c], ecx
jle 0x4d0606
push 8
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x4d060a
mov eax, dword [esp + 0x48]
mov edx, dword [ebx + 0x10]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x108], eax
mov eax, dword [ebp + 0x32]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
mov dword [esp + 0x10c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x30], 0
mov ax, word [edx + 0x5073c2]
imul ax, word [esp + 0x44]
mov dword [esp + 0x44], eax
and eax, 0xffff
mov dword [esp + 0x38], eax
inc eax
test eax, eax
jle 0x4d2688
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x80]
xor ecx, ecx
mov cx, word [edx + 0x5073c2]
cdq
idiv ecx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x20], edx
mov edx, dword [eax + edx*8 + 0x5073c8]
mov dword [esp + 0x10], edx
lea eax, [edx - 1]
cmp eax, 0xf
ja case.default.0x4d06aa
jmp dword [eax*4 + 0x4d26c8]
mov ecx, dword [esp + 0x34]
mov eax, dword [ebp + 0x4c]
cmp eax, ecx
jle 0x4d25df
mov ecx, dword [ebp + 0x4c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x20]
cdq
mov ecx, dword [esp + ecx*4 + 0xac]
and edx, 3
add eax, edx
sar eax, 2
mov dword [esp + 0x28], eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edx
mov dword [esp + 0x10], edx
cdq
sub eax, edx
lea edx, [esp + 0x60]
sar eax, 1
mov dword [esp + 0x1c], eax
lea ecx, [eax + edi]
mov eax, dword [ebp + 0x3c]
add ecx, eax
mov dword [esp + 0x60], ecx
mov ecx, dword [ebp + 0x40]
push ecx
push eax
push esi
push edx
mov dword [esp + 0x74], ecx
call fcn.00402210
add esp, 0x10
lea eax, [esp + 0x60]
mov ecx, ebx
push eax
call fcn.004023a0
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x1c]
mov ecx, eax
sub ecx, edx
mov dword [esp + 0x8c], ecx
mov ecx, dword [esp + 0x64]
mov edx, ecx
sub edx, dword [esp + 0x28]
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x1c]
add edx, eax
mov eax, dword [esp + 0x28]
add ecx, eax
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], ecx
lea ecx, [esp + 0x8c]
lea edx, [esp + 0xd4]
push ecx
push edx
mov ecx, ebx
call fcn.004197f0
mov eax, dword [ebx + 0x128]
test eax, eax
je 0x4d07f8
push 0
mov ecx, 0xb
sub esp, 0x30
lea esi, [ebp + 0xc]
mov edi, esp
sub esp, 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
mov eax, dword [ebx + 0x240]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x78], eax
push ecx
mov ecx, ebx
mov dword [ebx + 0x240], 0
movsw word es:[edi], word [esi]
call fcn.004d0220
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x5c]
mov dword [ebx + 0x240], edx
jmp 0x4d0822
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xd8]
push eax
mov eax, dword [esp + 0xd8]
push ecx
mov ecx, dword [ebx + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_Ellipse]
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x3c]
add edx, edi
lea eax, [edx + ecx]
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x14], eax
mov dword [esp + 0x168], eax
mov eax, dword [esp + 0x24]
add edx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x16c], edx
mov dword [esp + 0x174], edx
mov edx, dword [esp + 0x24]
lea eax, [edi + eax*2]
add eax, ecx
mov dword [esp + 0x170], eax
mov dword [esp + 0x178], eax
mov eax, dword [ebp + 0x40]
sub eax, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x17c], eax
mov dword [esp + 0x184], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x180], edx
push eax
push ecx
lea ecx, [esp + 0x170]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x188]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x1a0]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x1b8]
push esi
push ecx
call fcn.00402210
add esp, 0x40
lea edx, [esp + 0x168]
push 0
push edx
push 4
push ebx
call fcn.004cf520
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
lea edx, [eax + ecx*2]
mov ecx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
add edx, edi
push ecx
add edx, eax
push eax
lea eax, [esp + 0x80]
push esi
push eax
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], ecx
call fcn.00402210
add esp, 0x20
lea ecx, [esp + 0x68]
push ecx
mov ecx, ebx
call fcn.004023a0
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x1c]
mov edx, eax
sub edx, ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x8c], edx
mov edx, ecx
sub edx, dword [esp + 0x28]
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x1c]
add eax, edx
lea edx, [esp + 0xd4]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x28]
add ecx, eax
mov dword [esp + 0x98], ecx
lea ecx, [esp + 0x8c]
push ecx
push edx
mov ecx, ebx
call fcn.004197f0
mov eax, dword [ebx + 0x128]
test eax, eax
je 0x4d09f2
push 0
mov ecx, 0xb
sub esp, 0x30
lea esi, [ebp + 0xc]
mov edi, esp
sub esp, 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
mov eax, dword [ebx + 0x240]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x78], eax
push ecx
mov ecx, ebx
mov dword [ebx + 0x240], 0
movsw word es:[edi], word [esi]
call fcn.004d0220
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x5c]
mov dword [ebx + 0x240], edx
jmp case.default.0x4d06aa
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xd8]
push eax
mov eax, dword [esp + 0xd8]
push ecx
mov ecx, dword [ebx + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_Ellipse]
jmp case.default.0x4d06aa
mov edx, dword [esp + 0x34]
mov eax, dword [ebp + 0x4c]
cmp eax, edx
jle 0x4d25df
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0xac]
cdq
sub eax, edx
mov edx, dword [ebp + 0x3c]
sar eax, 1
mov dword [esp + 0x14], eax
lea ecx, [eax + edi]
add ecx, edx
mov edx, ecx
mov dword [esp + 0x230], ecx
sub edx, eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x22c], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x228], edx
mov dword [esp + 0x240], ecx
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
sub edx, eax
mov dword [esp + 0x234], edx
mov edx, dword [esp + 0x14]
add edx, ecx
lea ecx, [esp + 0x228]
mov dword [esp + 0x238], edx
mov edx, dword [ebp + 0x40]
add eax, edx
push edx
mov dword [esp + 0x248], eax
mov eax, dword [ebp + 0x3c]
push eax
push esi
push ecx
mov dword [esp + 0x24c], edx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x248]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x260]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x278]
push esi
push ecx
call fcn.00402210
add esp, 0x40
lea edx, [esp + 0x228]
push 0
push edx
push 4
push ebx
call fcn.004cf520
add esp, 0x10
jmp case.default.0x4d06aa
mov eax, dword [esp + 0x34]
mov ecx, dword [ebp + 0x4c]
cmp ecx, eax
jle 0x4d25df
mov ax, word [ebp + 0x54]
mov dword [esp + 0x10], 0
cmp ax, 1
je 0x4d0b3c
cmp ax, 4
jne 0x4d0b44
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
mov ecx, dword [esp + ecx*4 + 0xac]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
sub eax, edx
test ecx, ecx
mov dword [esp + 0x28], eax
jne 0x4d0b91
lea ecx, [eax + edi]
mov eax, dword [ebp + 0x3c]
add ecx, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp + 0x40]
mov dword [esp + 0x40], ecx
jmp 0x4d0bac
mov edx, dword [esp + 0x1c]
lea ecx, [edx + eax]
mov eax, dword [ebp + 0x3c]
add ecx, edi
add ecx, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp + 0x40]
add edx, ecx
mov dword [esp + 0x40], edx
push ecx
push eax
lea edx, [esp + 0x44]
push esi
push edx
call fcn.00402210
add esp, 0x10
lea eax, [esp + 0x3c]
mov ecx, ebx
push eax
call fcn.004023a0
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
mov edx, ecx
add ecx, eax
sub edx, eax
mov dword [esp + 0xa4], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x9c], edx
mov edx, dword [esp + 0x40]
add ecx, eax
sub edx, eax
lea eax, [esp + 0xe4]
mov dword [esp + 0xa0], edx
lea edx, [esp + 0x9c]
mov dword [esp + 0xa8], ecx
push edx
push eax
mov ecx, ebx
call fcn.004197f0
mov eax, dword [ebx + 0x128]
test eax, eax
je 0x4d0c7a
mov ecx, dword [ebx + 0x240]
push 0
sub esp, 0x30
mov dword [esp + 0x48], ecx
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
sub esp, 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
lea edx, [esp + 0x100]
rep movsd dword es:[edi], dword [esi]
push edx
mov ecx, ebx
mov dword [ebx + 0x240], 0
movsw word es:[edi], word [esi]
call fcn.004d0220
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x5c]
mov dword [ebx + 0x240], eax
jmp 0x4d0ca4
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xec]
mov eax, dword [esp + 0xe8]
push ecx
mov ecx, dword [esp + 0xe8]
push edx
mov edx, dword [ebx + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Ellipse]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4d0ccc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp + 0x3c]
sub ecx, edx
add ecx, edi
add ecx, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp + 0x40]
mov edx, ecx
sub edx, dword [esp + 0x1c]
jmp 0x4d0ce6
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
lea ecx, [eax + edi]
mov eax, dword [ebp + 0x3c]
add ecx, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp + 0x40]
lea edx, [ecx + edx*2]
push ecx
push eax
lea eax, [esp + 0x44]
push esi
push eax
mov dword [esp + 0x50], edx
call fcn.00402210
add esp, 0x10
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebx
call fcn.004023a0
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
mov edx, ecx
add ecx, eax
sub edx, eax
mov dword [esp + 0xa4], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x9c], edx
mov edx, dword [esp + 0x40]
add ecx, eax
sub edx, eax
lea eax, [esp + 0xe4]
mov dword [esp + 0xa0], edx
lea edx, [esp + 0x9c]
mov dword [esp + 0xa8], ecx
push edx
push eax
mov ecx, ebx
call fcn.004197f0
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x128]
test eax, eax
je 0x4d0e04
xor eax, eax
mov ecx, 0xb
push eax
lea esi, [esp + 0x4ac]
sub esp, 0x30
mov word [esp + 0x4dc], ax
mov edi, esp
mov dword [esp + 0x502], 0xffffff
mov dword [esp + 0x506], eax
sub esp, 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
lea esi, [esp + 0x50c]
mov edi, esp
mov edx, dword [ebx + 0x240]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x240], eax
lea eax, [esp + 0x100]
push eax
mov ecx, ebx
mov dword [esp + 0x7c], edx
movsw word es:[edi], word [esi]
call fcn.004d0220
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x10]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x5c]
mov dword [ebx + 0x240], ecx
mov ecx, dword [esp + 0x24]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
jmp case.default.0x4d06aa
mov edx, dword [esp + 0xf0]
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
push edx
mov edx, dword [esp + 0xe8]
push eax
mov eax, dword [ebx + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov ecx, dword [esp + 0x24]
mov edx, dword [ebx + 0x10]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
jmp case.default.0x4d06aa
mov ecx, dword [ebp + 0x4c]
mov eax, dword [esp + 0x34]
cmp ecx, eax
jle 0x4d25df
mov eax, 0x2aaaaaab
mov dword [esp + 0x24], 0
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x20]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x28], eax
mov eax, dword [esp + ecx*4 + 0xac]
mov dword [esp + 0x1c], eax
cdq
sub eax, edx
mov ecx, eax
mov ax, word [ebp + 0x54]
sar ecx, 1
cmp ax, 1
mov dword [esp + 0x14], ecx
je 0x4d0ea4
cmp ax, 4
jne 0x4d0eac
mov dword [esp + 0x24], 1
mov edx, dword [ebp + 0x3c]
lea eax, [ecx + edi]
add edx, eax
cmp word [esp + 0x44], 0
mov dword [esp + 0x54], edx
jne 0x4d0ee1
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x1c]
cmp eax, edx
jle 0x4d0edd
sub eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x54]
sar eax, 1
add edx, eax
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4d1038
mov eax, edx
sub eax, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x280], eax
mov eax, dword [esp + 0x10]
cmp eax, 8
mov eax, dword [ebp + 0x40]
jne 0x4d0f0c
add eax, ecx
jmp 0x4d0f0e
sub eax, ecx
mov dword [esp + 0x284], eax
mov eax, dword [esp + 0x18]
sub edx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x288], edx
mov edx, dword [esp + 0x10]
cmp edx, 8
mov edx, dword [ebp + 0x40]
jne 0x4d0f36
sub edx, ecx
jmp 0x4d0f38
add edx, ecx
mov dword [esp + 0x28c], edx
mov edx, dword [esp + 0x54]
add edx, eax
mov eax, dword [esp + 0x10]
cmp eax, 8
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x290], edx
jne 0x4d0f5e
mov edx, eax
sub edx, ecx
jmp 0x4d0f61
lea edx, [ecx + eax]
mov dword [esp + 0x294], edx
mov edx, dword [esp + 0x54]
add edx, ecx
mov dword [esp + 0x298], edx
mov edx, dword [esp + 0x10]
cmp edx, 8
jne 0x4d0f83
lea edx, [ecx + eax]
jmp 0x4d0f87
mov edx, eax
sub edx, ecx
mov dword [esp + 0x29c], edx
mov edx, dword [esp + 0x1c]
add edx, ecx
mov dword [esp + 0x2a0], edx
mov edx, dword [esp + 0x10]
cmp edx, 8
jne 0x4d0fa9
lea edx, [ecx + eax]
jmp 0x4d0fad
mov edx, eax
sub edx, ecx
mov dword [esp + 0x2a4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x2a8], edx
mov edx, dword [esp + 0x10]
cmp edx, 8
jne 0x4d0fd9
mov edx, dword [esp + 0x18]
sub edx, ecx
add edx, eax
mov dword [esp + 0x2ac], edx
jmp 0x4d0fed
mov edx, dword [esp + 0x18]
mov eax, ecx
sub eax, edx
mov edx, dword [ebp + 0x40]
add eax, edx
mov dword [esp + 0x2ac], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
add edx, eax
mov eax, dword [esp + 0x10]
cmp eax, 8
mov dword [esp + 0x2b0], edx
jne 0x4d1015
mov edx, dword [ebp + 0x40]
add ecx, edx
mov dword [esp + 0x2b4], ecx
jmp 0x4d1021
mov eax, dword [ebp + 0x40]
sub eax, ecx
mov dword [esp + 0x2b4], eax
lea eax, [esp + 0x280]
push 0x38
lea ecx, [esp + 0x474]
push eax
push ecx
jmp 0x4d116e
cmp dword [esp + 0x10], 8
jne 0x4d1044
lea eax, [edx + ecx]
jmp 0x4d1048
mov eax, edx
sub eax, ecx
mov dword [esp + 0x248], eax
mov eax, dword [ebp + 0x40]
sub eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24c], eax
cmp dword [esp + 0x10], 8
jne 0x4d106a
sub edx, ecx
jmp 0x4d106c
add edx, ecx
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x250], edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x254], eax
mov eax, dword [esp + 0x10]
cmp eax, 8
mov eax, dword [esp + 0x54]
jne 0x4d1098
sub eax, ecx
jmp 0x4d109a
add eax, ecx
mov dword [esp + 0x258], eax
mov eax, dword [ebp + 0x40]
add edx, eax
mov eax, dword [esp + 0x10]
cmp eax, 8
mov eax, dword [esp + 0x54]
mov dword [esp + 0x25c], edx
jne 0x4d10bf
lea edx, [eax + ecx]
jmp 0x4d10c3
mov edx, eax
sub edx, ecx
mov dword [esp + 0x260], edx
mov edx, dword [ebp + 0x40]
add edx, ecx
mov dword [esp + 0x264], edx
mov edx, dword [esp + 0x10]
cmp edx, 8
jne 0x4d10e4
lea edx, [eax + ecx]
jmp 0x4d10e8
mov edx, eax
sub edx, ecx
mov dword [esp + 0x268], edx
mov edx, dword [esp + 0x2c]
add edx, ecx
mov dword [esp + 0x26c], edx
mov edx, dword [esp + 0x10]
cmp edx, 8
jne 0x4d110f
mov edx, dword [esp + 0x18]
sub eax, ecx
add eax, edx
jmp 0x4d1115
sub eax, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x270], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x274], eax
mov eax, dword [esp + 0x10]
cmp eax, 8
jne 0x4d113e
mov edx, dword [esp + 0x54]
add edx, ecx
mov dword [esp + 0x278], edx
jmp 0x4d114b
mov eax, dword [esp + 0x54]
sub eax, ecx
mov dword [esp + 0x278], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add eax, ecx
lea edx, [esp + 0x248]
mov dword [esp + 0x27c], eax
push 0x38
lea eax, [esp + 0x474]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
add esp, 0xc
lea eax, [esp + 0x470]
push ecx
push edx
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x490]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x4a8]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x4c0]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
add esp, 0x40
lea eax, [esp + 0x490]
push ecx
push edx
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x4b0]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x4c8]
push esi
push eax
call fcn.00402210
lea ecx, [esp + 0x4a0]
push 0
push ecx
push 7
push ebx
call fcn.004cf520
mov eax, dword [esp + 0x64]
add esp, 0x40
test eax, eax
jne 0x4d1299
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp + 0x3c]
lea eax, [ecx + edi]
add eax, edx
cmp word [esp + 0x44], 0
mov dword [esp + 0x4c], eax
jne 0x4d126d
mov eax, dword [esp + 0x20]
mov edx, dword [esp + eax*4 + 0xac]
mov eax, dword [esp + 0x7c]
cmp eax, edx
jle 0x4d126d
sub eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x4c]
sar eax, 1
add edx, eax
mov dword [esp + 0x4c], edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
cmp eax, 8
lea eax, [edx + edx]
jne 0x4d128a
sub ecx, eax
mov eax, dword [ebp + 0x40]
add ecx, eax
mov dword [esp + 0x50], ecx
jmp 0x4d12eb
mov edx, eax
mov eax, dword [ebp + 0x40]
sub edx, ecx
add edx, eax
mov dword [esp + 0x50], edx
jmp 0x4d12eb
cmp dword [esp + 0x10], 8
jne 0x4d12ac
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
sub eax, ecx
jmp 0x4d12b0
mov eax, dword [esp + 0x28]
lea ecx, [edi + eax*2]
mov eax, dword [ebp + 0x3c]
add ecx, eax
cmp word [esp + 0x44], 0
mov dword [esp + 0x4c], ecx
jne 0x4d12e4
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + edx*4 + 0xac]
cmp eax, edx
jle 0x4d12e4
sub eax, edx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [esp + 0x4c], ecx
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x50], eax
push eax
mov eax, dword [ebp + 0x3c]
push eax
lea ecx, [esp + 0x54]
push esi
push ecx
call fcn.00402210
add esp, 0x10
lea edx, [esp + 0x4c]
mov ecx, ebx
push edx
call fcn.004023a0
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x28]
mov edx, ecx
add ecx, eax
sub edx, eax
mov dword [esp + 0x2d0], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x2c8], edx
mov edx, dword [esp + 0x50]
add ecx, eax
sub edx, eax
lea eax, [esp + 0x2d8]
mov dword [esp + 0x2cc], edx
lea edx, [esp + 0x2c8]
mov dword [esp + 0x2d4], ecx
push edx
push eax
mov ecx, ebx
call fcn.004197f0
mov ecx, dword [esp + 0x2e4]
mov edx, dword [esp + 0x2e0]
mov eax, dword [esp + 0x2dc]
push ecx
mov ecx, dword [esp + 0x2dc]
push edx
mov edx, dword [ebx + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Ellipse]
jmp case.default.0x4d06aa
mov eax, dword [esp + 0x34]
mov ecx, dword [ebp + 0x4c]
cmp ecx, eax
jle 0x4d25df
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + ecx*4 + 0xac]
cdq
sub eax, edx
mov edx, dword [ebp + 0x3c]
sar eax, 1
lea ecx, [eax + edi]
add ecx, edx
mov edx, ecx
mov dword [esp + 0x1b0], ecx
sub edx, eax
mov dword [esp + 0x1c0], ecx
mov dword [esp + 0x1a8], edx
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x1ac], edx
sub edx, eax
mov dword [esp + 0x1b4], edx
lea edx, [ecx + eax]
mov dword [esp + 0x1b8], edx
mov edx, dword [ebp + 0x40]
add eax, edx
push edx
mov dword [esp + 0x1c8], eax
mov eax, dword [ebp + 0x3c]
push eax
lea ecx, [esp + 0x1b0]
push esi
push ecx
mov dword [esp + 0x1cc], edx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x1c8]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x1e0]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x1f8]
push esi
push ecx
call fcn.00402210
add esp, 0x40
lea edx, [esp + 0x1a8]
push 0
push edx
push 4
push ebx
call fcn.004cf520
add esp, 0x10
jmp case.default.0x4d06aa
mov eax, dword [esp + 0x34]
mov ecx, dword [ebp + 0x4c]
cmp ecx, eax
jle 0x4d25df
mov ecx, dword [ebp + 0x3c]
lea eax, [edi + ecx]
mov dword [esp + 0x1e8], eax
mov eax, dword [ebp + 0x4c]
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
sub edx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1ec], edx
mov edx, dword [esp + 0x20]
mov edx, dword [esp + edx*4 + 0xac]
add edx, edi
add edx, ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x1f0], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1f4], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x1f8], edx
mov edx, dword [ebp + 0x40]
add eax, edx
lea edx, [edi + ecx]
mov dword [esp + 0x1fc], eax
mov dword [esp + 0x204], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x200], edx
push eax
push ecx
lea ecx, [esp + 0x1f0]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x208]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x220]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x238]
push esi
push ecx
call fcn.00402210
mov eax, dword [esp + 0x50]
add esp, 0x40
cmp eax, 1
jne 0x4d1554
mov dword [esp + 0x24], 3
jmp 0x4d1569
mov eax, dword [esp + 0x10]
sub eax, 2
neg eax
sbb eax, eax
and eax, 3
add eax, 2
mov dword [esp + 0x24], eax
push 8
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [ebx + 0x10]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x32]
push eax
push ecx
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
mov edx, dword [ebx + 0x10]
push eax
push edx
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
inc eax
lea ecx, [esp + 0x1e8]
push eax
push ecx
push 4
push ebx
call fcn.004cf520
mov edx, dword [esp + 0x3c]
mov eax, dword [ebx + 0x10]
add esp, 0x10
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x10]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.default.0x4d06aa
mov ecx, dword [esp + 0x34]
mov eax, dword [ebp + 0x4c]
cmp eax, ecx
jle 0x4d25df
mov eax, 0x2aaaaaab
mov ecx, dword [ebp + 0x3c]
imul dword [ebp + 0x4c]
mov eax, edx
add ecx, edi
shr eax, 0x1f
add edx, eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x148], ecx
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
add edx, eax
mov dword [esp + 0x150], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14c], edx
mov edx, dword [esp + 0x14]
mov ecx, eax
sub ecx, edx
mov edx, dword [ebp + 0x40]
add ecx, edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x154], ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + ecx*4 + 0xac]
mov ecx, dword [ebp + 0x3c]
add edx, edi
add ecx, edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x15c], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x164], edx
mov edx, dword [ebp + 0x3c]
add edx, edi
mov dword [esp + 0x158], ecx
mov dword [esp + 0x128], edx
mov edx, dword [ebp + 0x40]
sub edx, eax
mov dword [esp + 0x160], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x12c], edx
mov edx, dword [ebp + 0x3c]
mov dword [esp + 0x138], ecx
add edx, edi
mov dword [esp + 0x140], ecx
mov dword [esp + 0x130], edx
mov edx, dword [esp + 0x14]
sub edx, eax
mov eax, dword [ebp + 0x40]
mov ecx, dword [esp + 0x18]
add edx, eax
mov dword [esp + 0x134], edx
mov dword [esp + 0x13c], edx
mov edx, dword [ebp + 0x3c]
push eax
push edx
lea eax, [esp + 0x150]
push esi
push eax
mov dword [esp + 0x154], ecx
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x168]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x180]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
push ecx
mov edx, dword [ebp + 0x3c]
lea eax, [esp + 0x194]
push edx
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
add esp, 0x40
lea eax, [esp + 0x128]
push ecx
push edx
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x148]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x160]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x178]
push esi
push eax
call fcn.00402210
add esp, 0x40
lea ecx, [esp + 0x128]
push 0
push ecx
push 4
push ebx
call fcn.004cf520
lea edx, [esp + 0x158]
push 0
push edx
push 4
push ebx
call fcn.004cf520
add esp, 0x20
jmp case.default.0x4d06aa
mov eax, dword [esp + 0x34]
mov ecx, dword [ebp + 0x4c]
cmp ecx, eax
jle 0x4d25df
mov ax, word [ebp + 0x54]
cmp ax, 1
je 0x4d18de
cmp ax, 4
je 0x4d18de
mov ecx, dword [ebp + 0x3c]
push 0x18
lea eax, [edi + ecx]
mov dword [esp + 0x28], eax
mov dword [esp + 0x34c], eax
mov eax, dword [ebp + 0x4c]
cdq
and edx, 3
add eax, edx
mov edx, dword [ebp + 0x40]
mov ecx, eax
sar ecx, 2
lea eax, [ecx + edx]
mov dword [esp + 0x30], eax
mov dword [esp + 0x350], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0xb0]
mov dword [esp + 0x20], eax
cdq
sub eax, edx
mov edx, dword [ebp + 0x3c]
sar eax, 1
add eax, edi
add eax, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x354], eax
mov eax, dword [ebp + 0x4c]
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
mov dword [esp + 0x2c], eax
sub edx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x358], edx
mov edx, dword [ebp + 0x3c]
add eax, edi
add edx, eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x360], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3ac], eax
mov eax, dword [ebp + 0x40]
sub eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x35c], edx
mov dword [esp + 0x3b0], eax
mov dword [esp + 0x3b4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x3b8], eax
mov eax, dword [ebp + 0x40]
add edx, eax
mov dword [esp + 0x3bc], ecx
mov dword [esp + 0x3c0], edx
lea ecx, [esp + 0x34c]
lea edx, [esp + 0x43c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_memmove]
lea eax, [esp + 0x3b4]
push 0x18
lea ecx, [esp + 0x418]
push eax
push ecx
jmp 0x4d19c0
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x37c], eax
mov eax, dword [ebp + 0x4c]
lea edx, [edi + ecx]
push 0x18
mov dword [esp + 0x37c], edx
cdq
and edx, 3
add eax, edx
mov edx, dword [esp + 0x24]
sar eax, 2
mov edx, dword [esp + edx*4 + 0xb0]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edx
sub edx, eax
add edx, edi
lea eax, [edx + ecx]
mov dword [esp + 0x30], eax
mov dword [esp + 0x384], eax
mov eax, dword [ebp + 0x4c]
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
sub edx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x388], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x38c], edx
mov edx, dword [ebp + 0x40]
add eax, edx
mov edx, dword [esp + 0x20]
add edx, edi
mov dword [esp + 0x390], eax
add edx, ecx
mov dword [esp + 0x330], eax
mov dword [esp + 0x31c], edx
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x320], edx
mov edx, dword [esp + 0x18]
add edx, edi
lea eax, [esp + 0x37c]
add ecx, edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x324], ecx
mov dword [esp + 0x32c], ecx
lea ecx, [esp + 0x43c]
push eax
push ecx
mov dword [esp + 0x330], edx
call dword [sym.imp.MSVCRT.dll_memmove]
lea edx, [esp + 0x324]
push 0x18
lea eax, [esp + 0x418]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
add esp, 0x18
lea eax, [esp + 0x438]
push ecx
push edx
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x458]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x470]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x440]
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
add esp, 0x40
lea eax, [esp + 0x410]
push ecx
push edx
push esi
push eax
call fcn.00402210
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x430]
push esi
push eax
call fcn.00402210
mov eax, 0x66666667
mov ecx, dword [ebp + 0x32]
imul dword [ebp + 0x4c]
add esp, 0x20
sar edx, 2
push ecx
mov ecx, edx
shr ecx, 0x1f
mov eax, edx
add eax, ecx
cdq
idiv dword [ebx + 0x260]
push eax
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
push 8
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [ebx + 0x10]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x438]
push 0
push eax
push 3
push ebx
call fcn.004cf520
push 0
lea ecx, [esp + 0x41c]
push ecx
push 3
push ebx
call fcn.004cf520
mov edx, dword [esp + 0x4c]
mov eax, dword [ebx + 0x10]
add esp, 0x20
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.default.0x4d06aa
mov ecx, dword [ebp + 0x4c]
mov eax, dword [esp + 0x34]
cmp ecx, eax
jle 0x4d25df
mov ax, word [ebp + 0x54]
cmp ax, 1
je 0x4d1bfb
cmp ax, 4
je 0x4d1bfb
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4d1b1a
mov edx, dword [ebp + 0x3c]
lea eax, [edi + edx]
mov dword [esp + 0x188], eax
jmp 0x4d1b31
mov eax, ecx
cdq
sub eax, edx
mov edx, edi
sar eax, 1
sub edx, eax
mov eax, dword [ebp + 0x3c]
add edx, eax
mov dword [esp + 0x188], edx
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
mov dword [esp + 0x28], eax
lea ecx, [eax + edx]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18c], ecx
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x4d1b5c
mov ecx, dword [ebp + 0x3c]
add ecx, edi
jmp 0x4d1b62
lea ecx, [eax + edi]
add ecx, dword [ebp + 0x3c]
sub edx, eax
mov dword [esp + 0x190], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x18], edx
mov dword [esp + 0x194], edx
mov edx, dword [esp + 0x30]
cmp edx, ecx
jne 0x4d1b9e
mov eax, dword [esp + 0x20]
mov edx, dword [esp + eax*4 + 0xac]
mov eax, dword [ebp + 0x3c]
lea ecx, [edx + edi]
add ecx, eax
mov dword [esp + 0x198], ecx
jmp 0x4d1bb9
mov edx, dword [esp + 0x20]
mov ecx, dword [ebp + 0x3c]
mov edx, dword [esp + edx*4 + 0xac]
add eax, edx
add eax, edi
add eax, ecx
mov dword [esp + 0x198], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x19c], eax
mov eax, dword [esp + 0x30]
cmp eax, ecx
je 0x4d1bd4
sub edx, dword [esp + 0x28]
mov eax, dword [ebp + 0x3c]
add edx, edi
add edx, eax
push 0x20
mov dword [esp + 0x1a4], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1a8], edx
lea eax, [esp + 0x18c]
jmp 0x4d1ce4
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4d1c12
mov edx, dword [ebp + 0x3c]
lea eax, [edi + edx]
mov dword [esp + 0x1c8], eax
jmp 0x4d1c29
mov eax, ecx
cdq
sub eax, edx
mov edx, edi
sar eax, 1
sub edx, eax
mov eax, dword [ebp + 0x3c]
add edx, eax
mov dword [esp + 0x1c8], edx
mov eax, ecx
mov ecx, dword [ebp + 0x40]
cdq
sub eax, edx
mov edx, ecx
sar eax, 1
sub edx, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1cc], edx
mov edx, dword [esp + 0x30]
test edx, edx
jne 0x4d1c55
mov edx, dword [ebp + 0x3c]
add edx, edi
jmp 0x4d1c5b
lea edx, [eax + edi]
add edx, dword [ebp + 0x3c]
mov dword [esp + 0x1d0], edx
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], edx
mov dword [esp + 0x1d4], edx
mov edx, dword [esp + 0x38]
cmp ecx, edx
jne 0x4d1c8c
mov edx, dword [esp + 0x20]
mov edx, dword [esp + edx*4 + 0xac]
lea eax, [edx + edi]
jmp 0x4d1c9b
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + ecx*4 + 0xac]
add eax, edx
add eax, edi
mov ecx, dword [ebp + 0x3c]
add eax, ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x1d8], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0x30]
cmp eax, ecx
je 0x4d1cc2
sub edx, dword [esp + 0x28]
mov eax, dword [ebp + 0x3c]
add edx, edi
add edx, eax
push 0x20
mov dword [esp + 0x1e4], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e8], edx
lea eax, [esp + 0x1cc]
lea ecx, [esp + 0x454]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_memmove]
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
add esp, 0xc
lea ecx, [esp + 0x450]
push edx
push eax
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x470]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x488]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x4a0]
push esi
push ecx
call fcn.00402210
add esp, 0x40
lea edx, [esp + 0x450]
push 0
push edx
push 4
push ebx
call fcn.004cf520
add esp, 0x10
jmp case.default.0x4d06aa
mov eax, dword [esp + 0x34]
mov edx, dword [ebp + 0x4c]
cmp edx, eax
jle 0x4d25df
mov ax, word [ebp + 0x54]
mov dword [esp + 0x14], 0
cmp ax, 1
je 0x4d1d92
cmp ax, 4
jne 0x4d1d9a
mov dword [esp + 0x14], 1
mov eax, 1
cdq
idiv ecx
mov edx, dword [esp + 0x38]
lea ecx, [eax + edx + 1]
and ecx, reloc.oledlg.dll_OleUIAddVerbMenuA
jns 0x4d1db7
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
test eax, eax
lea eax, [edx + 1]
cdq
jne 0x4d1fb7
sub eax, edx
mov edx, eax
mov eax, dword [esp + 0x30]
sar edx, 1
cmp eax, edx
jge 0x4d1e4e
mov eax, dword [esp + 0x20]
push 0x18
mov ecx, dword [esp + eax*4 + 0xb0]
mov eax, ecx
add ecx, edi
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ebp + 0x3c]
sar edx, 1
add edx, edi
add ecx, eax
add edx, eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x2ec], edx
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x2f0], edx
mov dword [esp + 0x2f4], ecx
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
mov dword [esp + 0x2fc], ecx
mov ecx, dword [ebp + 0x40]
sub edx, eax
add eax, ecx
mov dword [esp + 0x2f8], edx
mov dword [esp + 0x300], eax
lea edx, [esp + 0x2ec]
lea eax, [esp + 0x114]
push edx
push eax
jmp 0x4d2189
test cx, cx
je 0x4d1f42
mov ecx, dword [esp + 0x38]
shr ecx, 1
cmp eax, ecx
jne 0x4d1f42
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x304], eax
push 0x18
lea edx, [edi + ecx]
mov dword [esp + 0x304], edx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + edx*4 + 0xb0]
mov dword [esp + 0x20], eax
cdq
sub eax, edx
sar eax, 1
add eax, edi
add ecx, eax
mov eax, dword [ebp + 0x4c]
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
sub edx, eax
mov dword [esp + 0x30c], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x310], edx
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x314], ecx
add eax, edx
mov edx, dword [ebp + 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x318], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x36c], ecx
add eax, edi
mov dword [esp + 0x374], ecx
mov ecx, dword [esp + 0x14]
add eax, edx
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x364], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x368], edx
mov dword [esp + 0x370], eax
lea edx, [esp + 0x304]
lea eax, [esp + 0x114]
push edx
push eax
mov dword [esp + 0x380], ecx
call dword [sym.imp.MSVCRT.dll_memmove]
push 0x18
lea ecx, [esp + 0x370]
lea edx, [esp + 0x430]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0x18
jmp 0x4d2192
mov eax, dword [esp + 0x20]
push 0x18
mov eax, dword [esp + eax*4 + 0xb0]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 0x3c]
sar ecx, 1
add ecx, edi
add ecx, eax
add eax, edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x39c], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x394], ecx
mov ecx, dword [ebp + 0x40]
cdq
sub eax, edx
mov edx, ecx
sar eax, 1
sub edx, eax
add eax, ecx
mov dword [esp + 0x3a8], eax
mov dword [esp + 0x398], ecx
mov dword [esp + 0x3a0], edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x394]
lea ecx, [esp + 0x114]
push eax
mov dword [esp + 0x3a8], edx
push ecx
jmp 0x4d2189
sub eax, edx
mov edx, eax
mov eax, dword [esp + 0x30]
sar edx, 1
cmp eax, edx
jge 0x4d203a
mov eax, dword [esp + 0x20]
push 0x18
mov ecx, dword [esp + eax*4 + 0xb0]
mov eax, ecx
add ecx, edi
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ebp + 0x3c]
sar edx, 1
add edx, edi
add ecx, eax
add edx, eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x3c4], edx
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x3c8], edx
mov dword [esp + 0x3cc], ecx
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
mov dword [esp + 0x3d4], ecx
mov ecx, dword [ebp + 0x40]
sub edx, eax
add eax, ecx
mov dword [esp + 0x3d0], edx
mov dword [esp + 0x3d8], eax
lea edx, [esp + 0x3c4]
lea eax, [esp + 0x114]
push edx
push eax
jmp 0x4d2189
test cx, cx
je 0x4d211c
mov ecx, dword [esp + 0x38]
shr ecx, 1
cmp eax, ecx
jne 0x4d211c
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x3f4], eax
push 0x18
lea edx, [edi + ecx]
mov dword [esp + 0x3f4], edx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + edx*4 + 0xb0]
mov dword [esp + 0x20], eax
cdq
sub eax, edx
sar eax, 1
add eax, edi
add ecx, eax
mov eax, dword [ebp + 0x4c]
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
sub edx, eax
mov dword [esp + 0x3fc], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x400], edx
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x404], ecx
add eax, edx
mov edx, dword [ebp + 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3e4], ecx
add eax, edi
mov dword [esp + 0x3ec], ecx
mov ecx, dword [esp + 0x14]
add eax, edx
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x3dc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3e0], edx
mov dword [esp + 0x3e8], eax
lea edx, [esp + 0x3f4]
lea eax, [esp + 0x114]
push edx
push eax
mov dword [esp + 0x3f8], ecx
call dword [sym.imp.MSVCRT.dll_memmove]
push 0x18
lea ecx, [esp + 0x3e8]
jmp 0x4d1f2b
mov eax, dword [ebp + 0x3c]
push 0x18
lea ecx, [edi + eax]
mov eax, dword [ebp + 0x4c]
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
mov dword [esp + 0x334], ecx
add edx, eax
mov dword [esp + 0x33c], ecx
mov ecx, dword [ebp + 0x40]
mov dword [esp + 0x338], edx
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x340], edx
mov dword [esp + 0x348], ecx
mov eax, dword [esp + eax*4 + 0xb0]
lea ecx, [esp + 0x334]
cdq
sub eax, edx
mov edx, dword [ebp + 0x3c]
sar eax, 1
add eax, edi
push ecx
add eax, edx
lea edx, [esp + 0x118]
mov dword [esp + 0x348], eax
push edx
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x3c]
push eax
push ecx
lea edx, [esp + 0x118]
push esi
push edx
call fcn.00402210
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x3c]
push eax
push ecx
lea edx, [esp + 0x130]
push esi
push edx
call fcn.00402210
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x3c]
push eax
push ecx
lea edx, [esp + 0x148]
push esi
push edx
call fcn.00402210
mov eax, dword [ebp + 0x32]
add esp, 0x30
push eax
mov eax, 0x66666667
imul dword [ebp + 0x4c]
sar edx, 2
mov ecx, edx
mov eax, edx
shr ecx, 0x1f
add eax, ecx
cdq
idiv dword [ebx + 0x260]
push eax
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
push 8
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [ebx + 0x10]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x110]
push 0
push eax
push 3
push ebx
call fcn.004cf520
add esp, 0x10
cmp word [esp + 0x2c], 0
je 0x4d229c
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
shr ecx, 1
cmp eax, ecx
jne 0x4d229c
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x428]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x440]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x458]
push esi
push ecx
call fcn.00402210
lea edx, [esp + 0x450]
push 0
push edx
push 3
push ebx
call fcn.004cf520
add esp, 0x40
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.default.0x4d06aa
mov eax, dword [esp + 0x34]
mov ecx, dword [ebp + 0x4c]
cmp ecx, eax
jle 0x4d25df
mov ecx, dword [ebp + 0x3c]
lea eax, [edi + ecx]
mov dword [esp + 0x208], eax
mov eax, dword [ebp + 0x4c]
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
sub edx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x20c], edx
mov edx, dword [esp + 0x20]
mov edx, dword [esp + edx*4 + 0xac]
add edx, edi
add edx, ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x210], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x214], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x218], edx
mov edx, dword [ebp + 0x40]
add eax, edx
lea edx, [edi + ecx]
mov dword [esp + 0x21c], eax
mov dword [esp + 0x224], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x220], edx
push eax
push ecx
lea ecx, [esp + 0x210]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x228]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x240]
push esi
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x3c]
push edx
push eax
lea ecx, [esp + 0x258]
push esi
push ecx
call fcn.00402210
add esp, 0x40
lea edx, [esp + 0x208]
push 0
push edx
push 4
push ebx
call fcn.004cf520
add esp, 0x10
jmp case.default.0x4d06aa
mov eax, dword [esp + 0x34]
mov ecx, dword [ebp + 0x4c]
cmp ecx, eax
jle 0x4d25df
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + ecx*4 + 0xac]
mov dword [esp + 0x1c], eax
cdq
sub eax, edx
mov edx, dword [ebp + 0x3c]
sar eax, 1
mov dword [esp + 0x2c], eax
lea ecx, [eax + edi]
add ecx, edx
mov edx, dword [ebp + 0x40]
cmp word [esp + 0x44], 0
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
jne 0x4d2412
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x1c]
cmp eax, edx
jle 0x4d2412
sub eax, edx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [esp + 0x84], ecx
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x3c]
push eax
push ecx
lea edx, [esp + 0x8c]
push esi
push edx
call fcn.00402210
add esp, 0x10
lea eax, [esp + 0x84]
mov ecx, ebx
push eax
call fcn.004023a0
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x2c]
mov edx, ecx
add ecx, eax
sub edx, eax
mov dword [esp + 0x2c0], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x2b8], edx
mov edx, dword [esp + 0x88]
add ecx, eax
sub edx, eax
mov eax, dword [ebx + 0x128]
test eax, eax
mov dword [esp + 0x2bc], edx
mov dword [esp + 0x2c4], ecx
je 0x4d24e4
push 0
mov ecx, 0xb
sub esp, 0x30
lea esi, [ebp + 0xc]
mov edi, esp
sub esp, 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
mov edx, dword [ebx + 0x240]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x31c]
mov ecx, ebx
push eax
mov dword [esp + 0x94], edx
mov dword [ebx + 0x240], 0
movsw word es:[edi], word [esi]
call fcn.004d0220
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x5c]
mov dword [ebx + 0x240], ecx
jmp case.default.0x4d06aa
lea edx, [esp + 0x2b8]
lea eax, [esp + 0xf4]
push edx
push eax
mov ecx, ebx
call fcn.004197f0
cmp dword [esp + 0x10], 0x10
jne 0x4d25b0
mov eax, 0x66666667
mov ecx, dword [ebp + 0x32]
imul dword [ebp + 0x4c]
sar edx, 2
push ecx
mov ecx, edx
shr ecx, 0x1f
mov eax, edx
add eax, ecx
cdq
idiv dword [ebx + 0x260]
push eax
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
mov edx, dword [ebx + 0x10]
push eax
push edx
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 5
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0xfc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xf8]
push ecx
mov ecx, dword [esp + 0xf8]
push edx
mov edx, dword [ebx + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Ellipse]
mov eax, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x10]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.default.0x4d06aa
mov edx, dword [esp + 0x100]
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0xf8]
push edx
mov edx, dword [esp + 0xf8]
push eax
mov eax, dword [ebx + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
jmp case.default.0x4d06aa
mov eax, dword [ebp + 0x3c]
lea edx, [esp + 0x74]
lea ecx, [edi + eax]
mov dword [esp + 0x74], ecx
mov ecx, dword [ebp + 0x40]
push ecx
push eax
push esi
push edx
mov dword [esp + 0x88], ecx
call fcn.00402210
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
add esp, 0x10
push eax
push ecx
mov ecx, ebx
call fcn.004ce760
mov edx, dword [esp + 0x20]
mov eax, dword [ebp + 0x3c]
mov ecx, dword [esp + edx*4 + 0xac]
lea edx, [esp + 0x74]
add ecx, edi
add ecx, eax
mov dword [esp + 0x74], ecx
mov ecx, dword [ebp + 0x40]
push ecx
push eax
push esi
push edx
mov dword [esp + 0x88], ecx
call fcn.00402210
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
add esp, 0x10
push eax
push ecx
mov ecx, ebx
call fcn.004ce690
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + edx*4 + 0xac]
add edi, eax
mov eax, dword [esp + 0x30]
inc eax
inc ecx
cmp eax, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], eax
jl 0x4d0675
mov edx, dword [esp + 0x10c]
mov eax, dword [ebx + 0x10]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push edx
push eax
call esi
mov ecx, dword [esp + 0x104]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
push ecx
call edi
mov edx, dword [esp + 0x108]
mov eax, dword [ebx + 0x10]
push edx
push eax
call esi
mov ecx, dword [esp + 0x48]
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret