Function at 0x4b1c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x65c588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3e0
push ebx
push ebp
mov ebp, dword [esp + 0x3f8]
push esi
push edi
mov dword [esp + 0x48], ecx
push ebp
mov dword [ebp], 0xfffffc18
mov dword [ebp + 4], 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0
push 0
push 0
push str.DISPLAY
mov edi, eax
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push edi
push esi
mov dword [esp + 0x4c], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, dword [sym.imp.GDI32.dll_GetOutlineTextMetricsA]
push 0
push 0
push esi
mov dword [esp + 0x58], eax
call ebx
mov edi, eax
test edi, edi
jne 0x4b1ce8
mov eax, dword [esp + 0x4c]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
jmp 0x4b2bc4
push edi
call fcn.00492910
mov ecx, dword [esp + 0x48]
add esp, 4
mov esi, eax
push esi
push edi
push ecx
call ebx
mov dl, byte [ebp + 0x17]
mov al, byte [ebp + 0x14]
sub dl, 2
neg dl
sbb edx, edx
and edx, 0x1c
add edx, 4
test al, al
mov dword [esp + 0x2c], edx
je 0x4b1d1f
mov eax, edx
or al, 0x40
mov dword [esp + 0x2c], eax
mov al, byte [ebp + 0x1b]
mov cl, al
and cl, 3
cmp cl, 1
jne 0x4b1d31
or dword [esp + 0x2c], 1
and al, 0xf8
cmp al, 0x10
jne 0x4b1d3c
or dword [esp + 0x2c], 2
cmp al, 0x40
jne 0x4b1d4a
mov eax, dword [esp + 0x2c]
or al, 8
mov dword [esp + 0x2c], eax
mov ecx, dword [esi + 0x58]
mov eax, 0x66666667
imul ecx
mov ecx, dword [esi + 0x60]
push esi
sar edx, 2
mov eax, edx
mov dword [esp + 0x58], ecx
mov ecx, dword [esi + 0x74]
shr eax, 0x1f
add edx, eax
mov eax, dword [esi + 0x6c]
mov dword [esp + 0x5c], edx
mov edx, dword [esi + 0x64]
mov dword [esp + 0x54], edx
mov edx, dword [esi + 0x80]
mov dword [esp + 0x60], eax
mov eax, dword [esi + 0x7c]
mov dword [esp + 0x64], ecx
mov ecx, dword [esi + 0x78]
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
call fcn.00492960
add esp, 4
lea edx, [ebp + 0x1c]
lea ecx, [esp + 0x30]
push 0xffffffffffffffff
push edx
call fcn.00498990
mov edi, 0x73d670
xor ebx, ebx
mov eax, edi
mov dword [esp + 0x3f8], ebx
test eax, eax
mov dword [esp + 0x3c], edi
je 0x4b1dd6
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x40], ecx
jmp 0x4b1dda
mov dword [esp + 0x40], ebx
mov edi, 0x6e0e1c
mov ecx, edi
mov dword [esp + 0x18], edi
test ecx, ecx
je 0x4b1df9
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4b1dfd
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x3c]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x38]
call fcn.00499aa0
mov eax, dword [ebp + 0x10]
cmp eax, 0x1f4
jle 0x4b1e36
mov cl, byte [ebp + 0x14]
test cl, cl
je 0x4b1e28
push str._BoldItalic
jmp 0x4b1e42
cmp eax, 0x1f4
jle 0x4b1e36
push str._Bold
jmp 0x4b1e42
mov al, byte [ebp + 0x14]
test al, al
je 0x4b1e4b
push str._Italic
lea ecx, [esp + 0x34]
call fcn.00498c30
push 0x14
call fcn.00492990
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
cmp esi, ebx
mov edi, 6
je 0x4b1e88
mov dword [esi], 0x66cd4c
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov byte [esp + 0x3f8], 2
call fcn.00580d00
mov dword [esi], 0x66cd48
mov dword [esi + 4], edi
jmp 0x4b1e8a
xor esi, esi
mov al, byte [ebp + 0x17]
mov dword [esp + 0x28], esi
test al, al
mov byte [esp + 0x3f8], 0
mov dword [esp + 0x3c], esi
jne 0x4b2167
push 0xffffffffffffffff
push str.Font
lea ecx, [esp + 0x28]
call fcn.00498990
mov edi, str.Type
mov byte [esp + 0x3f8], 3
mov ecx, edi
mov dword [esp + 0x18], edi
test ecx, ecx
je 0x4b1edc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4b1ee0
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.00497c60
lea ecx, [esp + 0x20]
mov byte [esp + 0x3f8], 0
call fcn.00498970
push 0xffffffffffffffff
push str.TrueType
lea ecx, [esp + 0x28]
call fcn.00498990
mov ebp, str.Subtype
mov byte [esp + 0x3f8], 4
mov ecx, ebp
mov dword [esp + 0x18], ebp
test ecx, ecx
je 0x4b1f3b
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4b1f3f
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.00497c60
lea ecx, [esp + 0x20]
mov byte [esp + 0x3f8], 0
call fcn.00498970
mov edi, str.BaseFont
mov ecx, edi
mov dword [esp + 0x18], edi
test ecx, ecx
je 0x4b1f80
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4b1f84
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x30]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.00497c60
push 0xffffffffffffffff
push str.WinAnsiEncoding
lea ecx, [esp + 0x28]
call fcn.00498990
mov edi, str.Encoding
mov byte [esp + 0x3f8], 5
mov ecx, edi
mov dword [esp + 0x18], edi
test ecx, ecx
je 0x4b1fcc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4b1fd0
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.00497c60
lea ecx, [esp + 0x20]
mov byte [esp + 0x3f8], 0
call fcn.00498970
mov edi, str.FirstChar
mov ecx, edi
mov dword [esp + 0x18], edi
test ecx, ecx
je 0x4b2011
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4b2015
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x18]
push 0x42000000
push edx
mov ecx, esi
call fcn.00497d80
mov edi, str.LastChar
mov eax, edi
mov dword [esp + 0x18], edi
test eax, eax
je 0x4b2045
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4b2049
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x18]
push 0x437f0000
push ecx
mov ecx, esi
call fcn.00497d80
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x70]
push edx
push 0xff
push 0x20
push eax
call dword [sym.imp.GDI32.dll_GetCharWidthA]
push 0x20
call fcn.00492990
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x4b20b3
mov dword [esi], 0x66cd4c
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
push 4
mov byte [esp + 0x3fc], 7
call fcn.0049a090
mov dword [esi], 0x66cd44
mov dword [esi + 4], 5
mov dword [esp + 0x20], esi
jmp 0x4b20b7
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x3f8], 0
lea ebx, [esp + 0x70]
mov dword [esp + 0x24], 0xe0
lea ebp, [ecx + 0xc]
push 0x14
call fcn.00492990
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov byte [esp + 0x3f8], 8
je 0x4b20fa
mov edx, dword [ebx]
mov ecx, eax
push edx
call fcn.00496df0
mov esi, eax
jmp 0x4b20fc
xor esi, esi
mov edi, dword [ebp + 4]
push 0xffffffffffffffff
mov ecx, ebp
mov byte [esp + 0x3fc], 0
lea eax, [edi + 1]
push eax
call fcn.0049a0c0
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp]
add ebx, 4
dec eax
mov dword [ecx + edi*4], esi
mov dword [esp + 0x24], eax
jne 0x4b20d2
mov edi, str.Widths
mov edx, edi
mov dword [esp + 0x18], edi
test edx, edx
je 0x4b2149
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor ebx, ebx
mov dword [esp + 0x1c], ecx
jmp 0x4b214f
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00497b20
jmp 0x4b2821
push 0x14
call fcn.00492990
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
cmp esi, ebx
je 0x4b219f
mov dword [esi], 0x66cd4c
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov byte [esp + 0x3f8], 0xa
call fcn.00580d00
mov dword [esi], 0x66cd48
mov dword [esi + 4], edi
jmp 0x4b21a1
xor esi, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
push 0x20
mov byte [esp + 0x3fc], 0xc
call fcn.00492990
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
cmp esi, ebx
mov edi, 5
je 0x4b21f8
mov dword [esi], 0x66cd4c
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
push 4
mov byte [esp + 0x3fc], 0xe
call fcn.0049a090
mov dword [esi], 0x66cd44
mov dword [esi + 4], edi
jmp 0x4b21fa
xor esi, esi
mov al, byte [ebp + 0x17]
mov byte [esp + 0x3f8], 0xc
cmp al, 0x88
jne 0x4b2261
mov eax, dword [esp + 0x404]
cmp eax, ebx
mov eax, str.ETHK_B5_V
jne 0x4b221e
mov eax, str.ETHK_B5_H
push eax
lea ecx, [esp + 0x38]
call fcn.00498b70
push str.CNS1
lea ecx, [esp + 0x3c]
call fcn.00498b70
mov dword [esp + 0x24], 4
push 1
mov ecx, esi
call fcn.004973e0
push 0x5f
mov ecx, esi
call fcn.004973e0
push 0x1f4
mov ecx, esi
call fcn.004973e0
jmp 0x4b23ab
cmp al, 0x86
jne 0x4b22d4
mov eax, dword [esp + 0x404]
cmp eax, ebx
mov eax, str.GBK_EUC_V
jne 0x4b227a
mov eax, str.GBK_EUC_H
push eax
lea ecx, [esp + 0x38]
call fcn.00498b70
push 0x6ed08c
lea ecx, [esp + 0x3c]
call fcn.00498b70
push 0x1e24
mov ecx, esi
mov dword [esp + 0x28], 2
call fcn.004973e0
push 0x1e24
mov ecx, esi
call fcn.004973e0
push 0x1f4
mov ecx, esi
call fcn.004973e0
push 0x32e
mov ecx, esi
call fcn.004973e0
push 0x38b
jmp 0x4b2249
cmp al, 0x81
jne 0x4b2312
mov eax, dword [esp + 0x404]
cmp eax, ebx
mov eax, str.KSCms_UHC_V
jne 0x4b22ed
mov eax, str.KSCms_UHC_H
push eax
lea ecx, [esp + 0x38]
call fcn.00498b70
push str.Korea1
lea ecx, [esp + 0x3c]
call fcn.00498b70
mov dword [esp + 0x24], 2
jmp 0x4b223e
cmp al, 0x80
mov eax, dword [esp + 0x404]
jne 0x4b2381
cmp eax, ebx
mov eax, str.90ms_RKSJ_V
jne 0x4b232b
mov eax, str.90ms_RKSJ_H
push eax
lea ecx, [esp + 0x38]
call fcn.00498b70
push str.Japan1
lea ecx, [esp + 0x3c]
call fcn.00498b70
push 0xe7
mov ecx, esi
mov dword [esp + 0x28], edi
call fcn.004973e0
push 0x144
mov ecx, esi
call fcn.004973e0
push 0x1f4
mov ecx, esi
call fcn.004973e0
push 0x277
mov ecx, esi
call fcn.004973e0
push 0x277
jmp 0x4b2249
cmp eax, ebx
mov eax, str.Identity_V
jne 0x4b238f
mov eax, str.Identity_H
push eax
lea ecx, [esp + 0x38]
call fcn.00498b70
push str.Identity
lea ecx, [esp + 0x3c]
call fcn.00498b70
mov dword [esp + 0x24], ebx
push 0xffffffffffffffff
push str.Font
lea ecx, [esp + 0x20]
call fcn.00498990
mov ebx, str.Type
mov byte [esp + 0x3f8], 0xf
mov edx, ebx
mov dword [esp + 0x10], ebx
test edx, edx
je 0x4b23e4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b23ec
mov dword [esp + 0x14], 0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00497c60
lea ecx, [esp + 0x18]
mov byte [esp + 0x3f8], 0xc
call fcn.00498970
push 0xffffffffffffffff
push str.Type0
lea ecx, [esp + 0x20]
call fcn.00498990
mov ebp, str.Subtype
mov byte [esp + 0x3f8], 0x10
mov edx, ebp
mov dword [esp + 0x10], ebp
test edx, edx
je 0x4b2449
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2451
mov dword [esp + 0x14], 0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00497c60
lea ecx, [esp + 0x18]
mov byte [esp + 0x3f8], 0xc
call fcn.00498970
mov edx, str.BaseFont
mov dword [esp + 0x10], str.BaseFont
test edx, edx
je 0x4b2498
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b24a0
mov dword [esp + 0x14], 0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00497c60
mov edi, str.Encoding
mov edx, edi
mov dword [esp + 0x10], edi
test edx, edx
je 0x4b24d2
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b24da
mov dword [esp + 0x14], 0
lea eax, [esp + 0x34]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00497c60
mov edi, 0x6e87e8
mov edx, edi
mov dword [esp + 0x10], edi
test edx, edx
je 0x4b250c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2514
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push esi
push eax
call fcn.00497b20
push 0xffffffffffffffff
push str.Font
lea ecx, [esp + 0x20]
call fcn.00498990
mov ecx, ebx
mov byte [esp + 0x3f8], 0x11
test ecx, ecx
mov dword [esp + 0x10], ebx
je 0x4b2557
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b255f
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00497c60
lea ecx, [esp + 0x18]
mov byte [esp + 0x3f8], 0xc
call fcn.00498970
push 0xffffffffffffffff
push str.CIDFontType2
lea ecx, [esp + 0x20]
call fcn.00498990
mov ecx, ebp
mov byte [esp + 0x3f8], 0x12
test ecx, ecx
mov dword [esp + 0x10], ebp
je 0x4b25b9
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b25c1
mov dword [esp + 0x14], 0
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00497c60
lea ecx, [esp + 0x18]
mov byte [esp + 0x3f8], 0xc
call fcn.00498970
mov edi, str.BaseFont
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b2602
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b260a
mov dword [esp + 0x14], 0
mov ebp, dword [esp + 0x20]
lea edx, [esp + 0x30]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, ebp
call fcn.00497c60
push 0x14
call fcn.00492990
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
xor ebx, ebx
cmp esi, ebx
je 0x4b265d
mov dword [esi], 0x66cd4c
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov byte [esp + 0x3f8], 0x14
call fcn.00580d00
mov dword [esi], 0x66cd48
mov dword [esi + 4], 6
jmp 0x4b265f
xor esi, esi
push 0xffffffffffffffff
push str.Adobe
lea ecx, [esp + 0x20]
mov byte [esp + 0x400], 0xc
call fcn.00498990
mov edi, str.Registry
mov byte [esp + 0x3f8], 0x15
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b269e
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b26a2
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00497cf0
lea ecx, [esp + 0x18]
mov byte [esp + 0x3f8], 0xc
call fcn.00498970
mov edi, str.Ordering
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b26e3
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b26e7
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x38]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00497cf0
mov edi, str.Supplement
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b2717
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b271b
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00497c10
mov edi, str.CIDSystemInfo
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b274b
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b274f
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x10]
push esi
push edx
mov ecx, ebp
call fcn.00497b20
push 0x20
call fcn.00492990
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x4b279a
mov dword [esi], 0x66cd4c
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
push 4
mov byte [esp + 0x3fc], 0x17
call fcn.0049a090
mov dword [esi], 0x66cd44
mov dword [esi + 4], 5
jmp 0x4b279c
xor esi, esi
mov edi, str.DescendantFonts
mov byte [esp + 0x3f8], 0xc
mov eax, edi
mov dword [esp + 0x10], edi
test eax, eax
je 0x4b27c3
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b27c7
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
push esi
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00497b20
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x20]
push ebx
lea edi, [ebp + 0x1c]
mov ecx, edi
call fcn.004987d0
mov ecx, dword [ebx + 8]
mov eax, ebp
neg eax
sbb eax, eax
push ecx
and eax, edi
mov ecx, esi
push eax
call fcn.004975d0
lea ecx, [esp + 0x38]
mov byte [esp + 0x3f8], 0xb
call fcn.00498970
lea ecx, [esp + 0x34]
mov byte [esp + 0x3f8], 0
call fcn.00498970
xor ebx, ebx
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x28]
push eax
lea ecx, [edx + 0x1c]
call fcn.004987d0
push 0x14
call fcn.00492990
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x4b286e
mov dword [esi], 0x66cd4c
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov byte [esp + 0x3f8], 0x19
call fcn.00580d00
mov dword [esi], 0x66cd48
mov dword [esi + 4], 6
jmp 0x4b2870
xor esi, esi
push 0xffffffffffffffff
push str.FontDescriptor
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], esi
mov byte [esp + 0x400], 0
call fcn.00498990
mov edi, str.Type
mov byte [esp + 0x3f8], 0x1a
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b28b3
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b28b7
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00497c60
lea ecx, [esp + 0x18]
mov byte [esp + 0x3f8], 0
call fcn.00498970
mov edi, str.FontName
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b28f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b28fc
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x30]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00497c60
mov edi, str.Flags
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b292c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2930
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00497c10
push 0x20
call fcn.00492990
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x4b2983
mov dword [esi], 0x66cd4c
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
push 4
mov byte [esp + 0x3fc], 0x1c
call fcn.0049a090
mov dword [esi], 0x66cd44
mov dword [esi + 4], 5
mov dword [esp + 0x20], esi
jmp 0x4b2987
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x3f8], 0
lea ebx, [esp + 0x60]
mov dword [esp + 0x18], 4
lea ebp, [ecx + 0xc]
push 0x14
call fcn.00492990
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x3f8], 0x1d
je 0x4b29ca
mov edx, dword [ebx]
mov ecx, eax
push edx
call fcn.00496df0
mov esi, eax
jmp 0x4b29cc
xor esi, esi
mov edi, dword [ebp + 4]
push 0xffffffffffffffff
mov ecx, ebp
mov byte [esp + 0x3fc], 0
lea eax, [edi + 1]
push eax
call fcn.0049a0c0
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
add ebx, 4
dec eax
mov dword [ecx + edi*4], esi
mov dword [esp + 0x18], eax
jne 0x4b29a2
mov edi, str.FontBBox
mov edx, edi
mov dword [esp + 0x10], edi
test edx, edx
je 0x4b2a19
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor ebp, ebp
mov dword [esp + 0x14], ecx
jmp 0x4b2a1f
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00497b20
mov edi, str.ItalicAngle
mov edx, edi
mov dword [esp + 0x10], edi
test edx, edx
je 0x4b2a53
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2a57
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00497c10
mov edi, str.Ascent
mov edx, edi
mov dword [esp + 0x10], edi
test edx, edx
je 0x4b2a87
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2a8b
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00497c10
mov edi, str.Descent
mov edx, edi
mov dword [esp + 0x10], edi
test edx, edx
je 0x4b2abb
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2abf
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00497c10
mov edi, str.CapHeight
mov edx, edi
mov dword [esp + 0x10], edi
test edx, edx
je 0x4b2aef
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2af3
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00497c10
mov edi, str.StemV
mov edx, edi
mov dword [esp + 0x10], edi
test edx, edx
je 0x4b2b23
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2b27
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x10]
push 0x64
push eax
mov ecx, esi
call fcn.00497c10
mov ebx, dword [esp + 0x48]
push esi
lea edi, [ebx + 0x1c]
mov ecx, edi
call fcn.004987d0
mov edx, ebx
neg edx
sbb edx, edx
and edx, edi
mov edi, str.FontDescriptor
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x4b2b6b
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4b2b6f
mov dword [esp + 0x14], ebp
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x3c]
push eax
push edx
lea edx, [esp + 0x18]
push edx
call fcn.00497e20
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x44]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, ebx
call fcn.004b6580
lea ecx, [esp + 0x30]
mov esi, eax
mov dword [esp + 0x3f8], 0xffffffff
call fcn.00498970
mov eax, esi
mov ecx, dword [esp + 0x3f0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3ec
ret 8