Function at 0x4d2710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4dad56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4ac
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x128]
test eax, eax
je 0x4d275b
sub esp, 0x30
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push ebx
movsw word es:[edi], word [esi]
call fcn.004cf6f0
add esp, 0x34
mov ax, word [ebx + 0xc]
mov ecx, ebx
push eax
push 1
call fcn.0040c330
push eax
call fcn.004017f0
mov ecx, dword [ebp + 0x4c]
mov edi, eax
push edi
push ecx
mov dword [esp + 0x48], edi
call fcn.004c8740
mov esi, eax
add esp, 0x10
cmp esi, edi
mov dword [ebp + 0x4c], esi
jg 0x4d2790
add esi, esi
mov dword [ebp + 0x4c], esi
mov edx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x48]
add eax, edx
cdq
sub eax, edx
mov edx, dword [ebp + 0x40]
sar eax, 1
mov dword [esp + 0x20], eax
lea eax, [edx + ecx]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
neg eax
push eax
mov dword [esp + 0xd0], eax
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.0041cf90
mov edi, dword [ebp + 0x40]
mov edx, dword [ebp + 0x48]
add esp, 0xc
mov ecx, dword [ebp + 0x44]
lea eax, [edi + edx]
mov dword [esp + 0x6c], ecx
cdq
sub eax, edx
lea edx, [esp + 0xa0]
sar eax, 1
mov dword [esp + 0x70], eax
lea eax, [esp + 0x10]
push eax
push edx
lea eax, [esp + 0x74]
push 0x3fffffff
push eax
mov eax, dword [ebp + 0x3c]
sub esp, 0x10
mov dword [esp + 0xc0], 0
mov edx, esp
mov dword [esp + 0x30], 0
mov dword [edx], eax
mov dword [edx + 4], edi
mov dword [edx + 8], ecx
mov ecx, dword [ebp + 0x48]
mov dword [edx + 0xc], ecx
call fcn.0041cfc0
mov edx, dword [ebp + 0x48]
mov eax, dword [ebp + 0x40]
add eax, edx
mov ecx, dword [ebp + 0x44]
cdq
sub eax, edx
mov dword [esp + 0x8c], ecx
sar eax, 1
mov dword [esp + 0x90], eax
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x64], ecx
and eax, 0xffff
xor edi, edi
mov dword [esp + 0x30], edi
lea ecx, [eax*8]
sub ecx, eax
lea eax, [ecx + ecx*2]
mov ecx, dword [esp + 0xc0]
shl eax, 2
mov dword [esp + 0x98], eax
push ecx
lea edx, [eax + 0x507ba0]
push esi
lea eax, [esp + 0x2b8]
push edx
push eax
call fcn.004c8770
mov ecx, dword [ebp + 0x32]
add esp, 0x30
mov dword [esp + 0x74], eax
mov dword [esp + 0x3c], edi
push ecx
push edi
push 6
mov dword [esp + 0x4c], edi
call dword [sym.imp.GDI32.dll_CreatePen]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0xd8], eax
cmp esi, ecx
jle 0x4d28c9
push 8
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [ebx + 0x10]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push edx
call edi
mov dword [esp + 0xd0], eax
mov eax, dword [ebp + 0x32]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
mov dword [esp + 0xdc], eax
call edi
mov edx, dword [esp + 0x78]
mov dword [esp + 0xe0], eax
mov dword [esp + 0x7c], 0
mov ax, word [edx + 0x507ba2]
imul ax, word [esp + 0x74]
and eax, 0xffff
inc eax
test eax, eax
mov dword [esp + 0xdc], eax
jle 0x4d3d5c
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
xor ecx, ecx
mov cx, word [edx + 0x507ba2]
cdq
idiv ecx
mov eax, dword [esp + 0x78]
mov dword [esp + 0x74], edx
mov edx, dword [eax + edx*8 + 0x507ba8]
mov dword [esp + 0x1c], edx
lea eax, [edx - 4]
cmp eax, 0xc
ja case.0x4d295d.6
jmp dword [eax*4 + 0x4d3da8]
cmp esi, dword [esp + 0x38]
jle case.0x4d295d.6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov edx, ecx
mov dword [esp + 0x14], 0
neg edx
sbb edx, edx
and edx, 0x2bf20
add ecx, edx
mov edx, dword [esp + 0x3c]
add eax, edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
add eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x4c], edx
jmp 0x4d29ce
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
dec eax
je 0x4d2a19
dec eax
je 0x4d29f7
dec eax
jne 0x4d2a31
mov edx, dword [esp + 0x24]
lea eax, [edx + edx]
mov edx, eax
mov eax, 0x2bf20
sub edx, esi
mov esi, edx
jmp 0x4d2a2b
mov edx, dword [esp + 0x20]
lea eax, [edx + edx]
mov edx, eax
mov eax, dword [esp + 0x24]
sub edx, edi
mov edi, edx
lea edx, [eax + eax]
mov eax, edx
sub eax, esi
neg ecx
mov esi, eax
mov dword [esp + 0x10], ecx
jmp 0x4d2a31
mov edx, dword [esp + 0x20]
lea eax, [edx + edx]
mov edx, eax
mov eax, 0xfffd40e0
sub edx, edi
mov edi, edx
sub eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
mov eax, edi
sub eax, ecx
push 0x18
lea edx, [ecx + edi]
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1d4], edx
mov edx, esi
sub edx, ecx
add ecx, esi
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], ecx
lea eax, [esp + 0x1d4]
lea ecx, [esp + 0x200]
push eax
push ecx
mov dword [esp + 0x1e0], esi
mov dword [esp + 0x1e8], edx
call dword [sym.imp.MSVCRT.dll_memmove]
mov edx, dword [esp + 0x1c]
push esi
push edi
lea eax, [esp + 0x210]
push edx
push eax
call fcn.00402210
mov ecx, dword [esp + 0x2c]
push esi
push edi
lea edx, [esp + 0x228]
push ecx
push edx
call fcn.00402210
mov eax, dword [esp + 0x3c]
push esi
push edi
lea ecx, [esp + 0x240]
push eax
push ecx
call fcn.00402210
mov edx, dword [ebp + 0x32]
mov eax, dword [esp + 0x88]
add esp, 0x3c
push edx
cdq
idiv dword [ebx + 0x260]
push eax
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
push 8
mov esi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x1fc]
push 0
push ecx
push 3
push ebx
mov edi, eax
call fcn.004cf520
mov edx, dword [ebx + 0x10]
add esp, 0x10
push edi
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 4
mov dword [esp + 0x14], eax
jl 0x4d29ca
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 0x4c]
jmp case.0x4d295d.6
cmp esi, dword [esp + 0x38]
jle case.0x4d295d.6
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], ecx
mov ecx, dword [esp + 0x74]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + ecx*4 + 0x298]
cdq
sub eax, edx
mov ecx, dword [ebp + 0x3c]
sar eax, 1
lea edx, [esp + 0xbc]
push eax
push edx
mov edx, dword [ebp + 0x40]
sub esp, 0x10
xor edi, edi
mov eax, esp
mov dword [esp + 0x38], edi
mov dword [eax], ecx
mov ecx, dword [ebp + 0x44]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x48]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.0041cfc0
mov eax, esi
add esp, 0x20
cdq
sub eax, edx
mov dword [esp + 0x14], edi
sar eax, 1
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0xb8]
dec ecx
mov esi, eax
mov edi, edx
je 0x4d2c0e
dec ecx
je 0x4d2bec
dec ecx
jne 0x4d2c23
mov eax, dword [esp + 0x24]
lea edi, [eax + eax]
mov eax, dword [esp + 0x10]
sub edi, edx
neg eax
mov dword [esp + 0x10], eax
jmp 0x4d2c27
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea esi, [ecx + ecx]
sub esi, eax
lea eax, [edx + edx]
mov ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, edi
neg eax
mov edi, ecx
mov dword [esp + 0x10], eax
jmp 0x4d2c27
mov edx, dword [esp + 0x20]
lea esi, [edx + edx]
sub esi, eax
mov eax, dword [esp + 0x10]
neg eax
mov dword [esp + 0x10], eax
jmp 0x4d2c27
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov edx, esi
sub edx, ecx
add ecx, esi
mov dword [esp + 0x108], edx
mov edx, edi
sub edx, dword [ebp + 0x4c]
mov dword [esp + 0x118], ecx
mov ecx, dword [ebp + 0x4c]
push edi
push esi
push eax
mov dword [esp + 0x120], edx
lea eax, [esp + 0x114]
lea edx, [edi + ecx]
push eax
mov dword [esp + 0x11c], edi
mov dword [esp + 0x120], esi
mov dword [esp + 0x12c], edi
mov dword [esp + 0x130], esi
mov dword [esp + 0x134], edx
call fcn.00402210
mov ecx, dword [esp + 0x20]
push edi
push esi
lea edx, [esp + 0x128]
push ecx
push edx
call fcn.00402210
mov eax, dword [esp + 0x30]
push edi
push esi
lea ecx, [esp + 0x140]
push eax
push ecx
call fcn.00402210
mov edx, dword [esp + 0x40]
push edi
push esi
lea eax, [esp + 0x158]
push edx
push eax
call fcn.00402210
add esp, 0x40
lea ecx, [esp + 0x108]
push 0
push ecx
push 4
push ebx
call fcn.004cf520
mov eax, dword [esp + 0x24]
add esp, 0x10
inc eax
cmp eax, 4
mov dword [esp + 0x14], eax
jl 0x4d2bb8
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 0x4c]
jmp case.0x4d295d.6
cmp esi, dword [esp + 0x38]
jle case.0x4d295d.6
mov ecx, dword [esp + 0x10]
mov eax, 0x2aaaaaab
mov edx, ecx
mov dword [esp + 0x14], 0
neg edx
sbb edx, edx
and edx, 0x2bf20
add ecx, edx
imul esi
mov eax, edx
mov dword [esp + 0x10], ecx
shr eax, 0x1f
add edx, eax
mov eax, esi
mov dword [esp + 0x58], edx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x18], eax
mov eax, esi
cdq
sub eax, edx
mov edx, dword [esp + 0x48]
sar eax, 1
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x40]
add edx, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x44]
add edx, eax
mov dword [esp + 0x28], edx
jmp 0x4d2d6e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
dec eax
je 0x4d2db9
dec eax
je 0x4d2d97
dec eax
jne 0x4d2dd1
mov edx, dword [esp + 0x24]
lea eax, [edx + edx]
mov edx, eax
mov eax, 0xfffd40e0
sub edx, esi
mov esi, edx
jmp 0x4d2dcb
mov edx, dword [esp + 0x20]
lea eax, [edx + edx]
mov edx, eax
mov eax, dword [esp + 0x24]
sub edx, edi
mov edi, edx
lea edx, [eax + eax]
mov eax, edx
sub eax, esi
neg ecx
mov esi, eax
mov dword [esp + 0x10], ecx
jmp 0x4d2dd1
mov edx, dword [esp + 0x20]
lea eax, [edx + edx]
mov edx, eax
mov eax, 0x2bf20
sub edx, edi
mov edi, edx
sub eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov ecx, edi
sub ecx, eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x148], ecx
cmp dword [esp + 0x1c], 8
jne 0x4d2df7
lea ecx, [esi + eax]
mov dword [esp + 0x14c], ecx
jmp 0x4d2e02
mov edx, esi
sub edx, eax
mov dword [esp + 0x14c], edx
mov edx, dword [esp + 0x58]
mov ecx, edi
sub ecx, edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x150], ecx
mov ecx, dword [esp + 0x1c]
cmp ecx, 8
jne 0x4d2e24
mov edx, esi
sub edx, eax
jmp 0x4d2e27
lea edx, [esi + eax]
mov dword [esp + 0x154], edx
mov edx, dword [esp + 0x58]
add edx, edi
cmp ecx, 8
mov dword [esp + 0x158], edx
jne 0x4d2e46
mov edx, esi
sub edx, eax
jmp 0x4d2e49
lea edx, [esi + eax]
mov dword [esp + 0x15c], edx
lea edx, [edi + eax]
cmp ecx, 8
mov dword [esp + 0x160], edx
jne 0x4d2e64
lea edx, [esi + eax]
jmp 0x4d2e68
mov edx, esi
sub edx, eax
mov dword [esp + 0x164], edx
mov edx, dword [esp + 0x30]
add edx, eax
cmp ecx, 8
mov dword [esp + 0x168], edx
jne 0x4d2e86
lea edx, [esi + eax]
jmp 0x4d2e8a
mov edx, esi
sub edx, eax
mov dword [esp + 0x16c], edx
cmp ecx, 8
mov dword [esp + 0x170], edi
mov edx, esi
jne 0x4d2ea9
mov ecx, dword [esp + 0x58]
sub edx, eax
add edx, ecx
jmp 0x4d2eb1
mov ecx, dword [esp + 0x58]
sub edx, ecx
add edx, eax
mov dword [esp + 0x174], edx
mov edx, dword [esp + 0x34]
add edx, ecx
mov ecx, dword [esp + 0x1c]
cmp ecx, 8
mov dword [esp + 0x178], edx
jne 0x4d2ed9
add eax, esi
mov dword [esp + 0x17c], eax
jmp 0x4d2ee4
mov ecx, esi
sub ecx, eax
mov dword [esp + 0x17c], ecx
lea edx, [esp + 0x148]
push 0x38
lea eax, [esp + 0x25c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov ecx, dword [esp + 0x1c]
push esi
push edi
lea edx, [esp + 0x26c]
push ecx
push edx
call fcn.00402210
mov eax, dword [esp + 0x2c]
push esi
push edi
lea ecx, [esp + 0x284]
push eax
push ecx
call fcn.00402210
mov edx, dword [esp + 0x3c]
push esi
push edi
lea eax, [esp + 0x29c]
push edx
push eax
call fcn.00402210
mov ecx, dword [esp + 0x4c]
push esi
push edi
lea edx, [esp + 0x2b4]
push ecx
push edx
call fcn.00402210
mov eax, dword [esp + 0x5c]
add esp, 0x4c
lea ecx, [esp + 0x278]
push esi
push edi
push eax
push ecx
call fcn.00402210
mov edx, dword [esp + 0x20]
push esi
push edi
lea eax, [esp + 0x298]
push edx
push eax
call fcn.00402210
mov ecx, dword [esp + 0x30]
push esi
push edi
lea edx, [esp + 0x2b0]
push ecx
push edx
call fcn.00402210
lea eax, [esp + 0x288]
push 0
push eax
push 7
push ebx
call fcn.004cf520
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x68]
add esp, 0x40
cmp eax, 8
mov dword [esp + 0x5c], ecx
lea eax, [edx + edx]
jne 0x4d2fd4
mov edx, dword [esp + 0x4c]
mov ecx, eax
mov eax, edx
sub eax, ecx
mov ecx, dword [esp + 0x48]
add eax, ecx
mov ecx, dword [esp + 0x40]
add eax, ecx
mov dword [esp + 0x60], eax
jmp 0x4d2fee
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
sub eax, ecx
mov ecx, dword [esp + 0x40]
add eax, edx
mov edx, dword [esp + 0x4c]
add eax, ecx
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x14]
dec ecx
je 0x4d3029
dec ecx
je 0x4d300b
dec ecx
jne 0x4d303a
mov ecx, dword [esp + 0x24]
add ecx, ecx
sub ecx, eax
add ecx, edx
mov dword [esp + 0x60], ecx
jmp 0x4d303a
mov ecx, dword [esp + 0x20]
add ecx, ecx
sub ecx, dword [esp + 0x5c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x24]
add ecx, ecx
sub ecx, eax
add ecx, edx
mov dword [esp + 0x60], ecx
jmp 0x4d303a
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x5c]
lea eax, [edx + edx]
sub eax, ecx
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x10]
push esi
push edi
lea edx, [esp + 0x64]
push ecx
push edx
call fcn.00402210
add esp, 0x10
lea eax, [esp + 0x5c]
mov ecx, ebx
push eax
call fcn.004023a0
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x18]
mov edx, ecx
add ecx, eax
sub edx, eax
mov dword [esp + 0x188], ecx
mov dword [esp + 0x180], edx
mov edx, dword [esp + 0x60]
mov esi, edx
add edx, eax
sub esi, eax
lea eax, [esp + 0x180]
lea ecx, [esp + 0x190]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x18c], esi
mov dword [esp + 0x194], edx
call fcn.004197f0
mov edx, dword [esp + 0x19c]
mov eax, dword [esp + 0x198]
mov ecx, dword [esp + 0x194]
push edx
mov edx, dword [esp + 0x194]
push eax
mov eax, dword [ebx + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 4
mov dword [esp + 0x14], eax
jl 0x4d2d6a
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 0x4c]
jmp case.0x4d295d.6
cmp esi, dword [esp + 0x38]
jle case.0x4d295d.6
mov ecx, dword [esp + 0x44]
mov eax, esi
cdq
sub eax, edx
mov edx, dword [esp + 0x3c]
sar eax, 1
add ecx, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x18], 0
add eax, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
dec eax
je 0x4d3165
dec eax
je 0x4d3156
dec eax
jne 0x4d317e
mov edx, dword [esp + 0x24]
lea eax, [edx + edx]
mov ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, edi
neg eax
mov edi, ecx
mov dword [esp + 0x10], eax
jmp 0x4d3182
mov edx, dword [esp + 0x20]
lea eax, [edx + edx]
mov ecx, eax
sub ecx, esi
mov esi, ecx
jmp 0x4d313d
mov edx, dword [esp + 0x20]
lea eax, [edx + edx]
mov ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, esi
neg eax
mov esi, ecx
mov dword [esp + 0x10], eax
jmp 0x4d3182
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, esi
sub edx, ecx
add ecx, ecx
mov dword [esp + 0x128], edx
mov edx, edi
sub edx, ecx
push edi
mov dword [esp + 0x138], edx
mov edx, dword [esp + 0x18]
push esi
push eax
lea eax, [esp + 0x134]
add edx, esi
add ecx, edi
push eax
mov dword [esp + 0x13c], edi
mov dword [esp + 0x140], esi
mov dword [esp + 0x148], edx
mov dword [esp + 0x14c], edi
mov dword [esp + 0x150], esi
mov dword [esp + 0x154], ecx
call fcn.00402210
mov ecx, dword [esp + 0x20]
push edi
push esi
lea edx, [esp + 0x148]
push ecx
push edx
call fcn.00402210
mov eax, dword [esp + 0x30]
push edi
push esi
lea ecx, [esp + 0x160]
push eax
push ecx
call fcn.00402210
mov edx, dword [esp + 0x40]
push edi
push esi
lea eax, [esp + 0x178]
push edx
push eax
call fcn.00402210
add esp, 0x40
lea ecx, [esp + 0x128]
push 0
push ecx
push 4
push ebx
call fcn.004cf520
mov eax, dword [esp + 0x28]
add esp, 0x10
inc eax
cmp eax, 4
mov dword [esp + 0x18], eax
jl 0x4d3128
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 0x4c]
jmp case.0x4d295d.6
cmp esi, dword [esp + 0x38]
jle case.0x4d295d.6
mov eax, 0x2aaaaaab
mov ecx, dword [ebp + 0x32]
imul esi
mov eax, edx
push ecx
shr eax, 0x1f
add edx, eax
mov ax, word [ebx + 0xc]
push eax
push edx
mov dword [esp + 0x3c], edx
call fcn.004021e0
cdq
idiv dword [ebx + 0x260]
add esp, 8
push eax
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
mov dword [esp + 0x60], eax
call edi
push 5
mov dword [esp + 0x50], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [ebx + 0x10]
push eax
push edx
call edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ebp + 0x40]
mov dword [esp + 0x80], ecx
mov ecx, dword [ebp + 0x44]
mov dword [esp + 0x84], edx
mov edx, dword [ebp + 0x48]
sub eax, 0
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], edx
je 0x4d3303
dec eax
jne 0x4d331c
mov eax, dword [esp + 0xcc]
push eax
push eax
lea eax, [esp + 0x88]
push eax
jmp 0x4d3314
mov eax, esi
lea ecx, [esp + 0x80]
cdq
sub eax, edx
sar eax, 1
push eax
push eax
push ecx
call fcn.0041cf90
add esp, 0xc
mov eax, dword [ebx + 0x128]
test eax, eax
je 0x4d3491
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x8c]
add eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x84]
sar eax, 1
mov dword [esp + 0xa4], eax
lea eax, [ecx + edx]
cdq
sub eax, edx
mov ecx, ebx
sar eax, 1
mov dword [esp + 0xa8], eax
lea eax, [esp + 0xa4]
push eax
call fcn.004023a0
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x84]
fild dword [ebx + 0x260]
sub ecx, edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x80]
fild dword [esp + 0x34]
sub esp, 8
sub edx, eax
mov dword [esp + 0x3c], edx
mov eax, dword [ebx + 0x240]
fidiv dword [ebx + 0x264]
sub esp, 8
lea ecx, [esp + 0x3c8]
neg eax
sub esp, 8
sub esp, 8
sub esp, 8
fmul qword [0x4dc298]
fstp qword [esp + 0x20]
fild dword [esp + 0x5c]
mov dword [esp + 0x5c], eax
fdiv st(1)
fmul qword [0x4dc298]
fstp qword [esp + 0x18]
fild dword [esp + 0x5c]
fmul qword [0x4dc290]
fstp qword [esp + 0x10]
fild dword [esp + 0xd0]
fdiv st(1)
fstp qword [esp + 8]
fild dword [esp + 0xcc]
fdiv st(1)
fstp qword [esp]
push str.newpath_n_g__g__g__g__g_0_360_EllipticalArc_r_n
push ecx
fstp st(0)
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [ebx + 0x128]
add esp, 0x30
lea edx, [esp + 0x3b8]
push eax
push edx
call fcn.0044dba0
sub esp, 0x30
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push ebx
movsw word es:[edi], word [esi]
call fcn.004cf6f0
fild dword [esp + 0x64]
add esp, 0x2c
lea eax, [esp + 0x3c0]
fidiv dword [ebx + 0x260]
fstp qword [esp]
push str.closepath_n_g_setlinewidth_r_nstroke_r_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push eax
lea ecx, [esp + 0x3bc]
push ecx
mov ecx, dword [ebx + 0x128]
call fcn.0044dba0
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 0x4c]
jmp 0x4d353b
lea ecx, [esp + 0x1e8]
call fcn.0041ba00
lea ecx, [esp + 0x244]
mov dword [esp + 0x4c0], 0
call fcn.0041ecd0
lea edx, [esp + 0x244]
lea eax, [esp + 0x1e8]
push edx
lea ecx, [esp + 0x84]
push eax
push ecx
push ebx
mov byte [esp + 0x4d0], 1
call fcn.0041b860
add esp, 0x10
lea ecx, [esp + 0x1e8]
call fcn.00477de0
push eax
lea ecx, [esp + 0x248]
call fcn.004d5160
push eax
lea ecx, [esp + 0x1f0]
call fcn.004d5160
mov edx, dword [ebx + 0x10]
push eax
push edx
call fcn.004d4ef0
add esp, 0x10
lea ecx, [esp + 0x244]
mov byte [esp + 0x4c0], 0
call fcn.0041ee40
lea ecx, [esp + 0x1e8]
mov dword [esp + 0x4c0], 0xffffffff
call fcn.0041ba20
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 2
mov dword [esp + 0x18], eax
jl 0x4d32c0
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call edi
mov edx, dword [esp + 0x4c]
mov eax, dword [ebx + 0x10]
push edx
push eax
call edi
mov ecx, dword [esp + 0x58]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x4d295d.6
cmp esi, dword [esp + 0x38]
jle case.0x4d295d.6
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x48]
add edx, eax
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x40]
mov eax, esi
add ecx, edx
cdq
and edx, 3
mov dword [esp + 0x14], 0
add eax, edx
mov dword [esp + 0x2c], ecx
sar eax, 2
mov dword [esp + 0x18], eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x4c], edx
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
dec eax
je 0x4d3624
dec eax
je 0x4d35fe
dec eax
jne 0x4d363b
mov ecx, dword [esp + 0x24]
lea edx, [ecx + ecx]
mov ecx, dword [esp + 0x10]
mov eax, edx
sub eax, edi
neg ecx
mov edi, eax
mov dword [esp + 0x10], ecx
jmp 0x4d363b
mov edx, dword [esp + 0x20]
lea eax, [edx + edx]
mov edx, dword [esp + 0x24]
mov ecx, eax
sub ecx, esi
lea eax, [edx + edx]
mov edx, dword [esp + 0x10]
mov esi, ecx
mov ecx, eax
sub ecx, edi
neg edx
mov edi, ecx
mov dword [esp + 0x10], edx
jmp 0x4d363b
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax]
mov eax, dword [esp + 0x10]
mov edx, ecx
sub edx, esi
neg eax
mov esi, edx
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add edx, edi
mov eax, esi
mov dword [esp + 0x1a4], edx
mov edx, edi
sub edx, ecx
sub eax, ecx
mov dword [esp + 0x1ac], edx
mov edx, dword [esp + 0x18]
add edx, edi
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x1b4], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1b8], eax
mov eax, edi
sub eax, edx
add ecx, esi
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1c4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1b0], ecx
mov dword [esp + 0x1c0], ecx
lea edx, [esp + 0x1a0]
lea ecx, [edi + eax]
push 0x18
lea eax, [esp + 0x218]
push edx
push eax
mov dword [esp + 0x1b4], esi
mov dword [esp + 0x1d4], esi
mov dword [esp + 0x1d8], ecx
call dword [sym.imp.MSVCRT.dll_memmove]
lea ecx, [esp + 0x1c4]
push 0x18
lea edx, [esp + 0x23c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [esp + 0x28]
push edi
push esi
lea ecx, [esp + 0x234]
push eax
push ecx
call fcn.00402210
mov edx, dword [esp + 0x38]
push edi
push esi
lea eax, [esp + 0x24c]
push edx
push eax
call fcn.00402210
mov ecx, dword [esp + 0x48]
push edi
push esi
lea edx, [esp + 0x264]
push ecx
push edx
call fcn.00402210
mov eax, dword [esp + 0x58]
add esp, 0x48
lea ecx, [esp + 0x22c]
push edi
push esi
push eax
push ecx
call fcn.00402210
mov edx, dword [esp + 0x20]
push edi
push esi
lea eax, [esp + 0x24c]
push edx
push eax
call fcn.00402210
mov ecx, dword [esp + 0x30]
push edi
push esi
lea edx, [esp + 0x264]
push ecx
push edx
call fcn.00402210
mov eax, dword [ebp + 0x32]
add esp, 0x30
push eax
mov eax, dword [esp + 0x50]
cdq
idiv dword [ebx + 0x260]
push eax
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
push 8
mov esi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
lea edx, [esp + 0x214]
push 0
push edx
push 3
push ebx
mov edi, eax
call fcn.004cf520
lea eax, [esp + 0x23c]
push 0
push eax
push 3
push ebx
call fcn.004cf520
mov ecx, dword [ebx + 0x10]
add esp, 0x20
push edi
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 4
mov dword [esp + 0x14], eax
jl 0x4d35d0
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 0x4c]
jmp case.0x4d295d.6
cmp esi, dword [esp + 0x38]
jle case.0x4d295d.6
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x48]
add edx, eax
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x40]
mov eax, esi
add ecx, edx
cdq
sub eax, edx
mov dword [esp + 0x18], 0
sar eax, 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
dec eax
je 0x4d3867
dec eax
je 0x4d384b
dec eax
jne 0x4d387e
mov eax, dword [esp + 0x24]
lea ecx, [eax + eax]
mov edx, ecx
sub edx, edi
mov edi, edx
jmp 0x4d3874
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax]
mov eax, dword [esp + 0x24]
mov edx, ecx
sub edx, esi
lea ecx, [eax + eax]
mov esi, edx
mov edx, ecx
sub edx, edi
mov edi, edx
jmp 0x4d3874
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax]
mov edx, ecx
sub edx, esi
mov esi, edx
mov eax, dword [esp + 0x10]
neg eax
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x1c]
mov eax, esi
mov ecx, edi
sub eax, edx
sub ecx, edx
add edx, esi
mov dword [esp + 0xec], ecx
mov dword [esp + 0xf0], edx
mov dword [esp + 0xf4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xf8], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0xe8], eax
mov dword [esp + 0x100], eax
push edi
push esi
lea eax, [esp + 0xf0]
add ecx, edi
push edx
push eax
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x114], ecx
call fcn.00402210
mov ecx, dword [esp + 0x20]
push edi
push esi
lea edx, [esp + 0x108]
push ecx
push edx
call fcn.00402210
mov eax, dword [esp + 0x30]
push edi
push esi
lea ecx, [esp + 0x120]
push eax
push ecx
call fcn.00402210
mov edx, dword [esp + 0x40]
push edi
push esi
lea eax, [esp + 0x138]
push edx
push eax
call fcn.00402210
add esp, 0x40
lea ecx, [esp + 0xe8]
push 0
push ecx
push 4
push ebx
call fcn.004cf520
mov eax, dword [esp + 0x28]
add esp, 0x10
inc eax
cmp eax, 4
mov dword [esp + 0x18], eax
jl 0x4d3827
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 0x4c]
jmp case.0x4d295d.6
cmp esi, dword [esp + 0x38]
jle case.0x4d295d.6
mov ecx, dword [esp + 0x3c]
mov eax, esi
cdq
sub eax, edx
mov edx, dword [esp + 0x44]
add edx, ecx
mov ecx, dword [esp + 0x40]
sar eax, 1
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x34], eax
xor eax, eax
add edx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], edx
je 0x4d39cc
dec eax
je 0x4d39b1
dec eax
jne 0x4d39d9
mov eax, dword [esp + 0x24]
lea ecx, [eax + eax]
sub ecx, edx
mov dword [esp + 0x68], ecx
jmp 0x4d39d9
mov eax, dword [esp + 0x20]
add eax, eax
sub eax, ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x64], eax
lea eax, [ecx + ecx]
sub eax, edx
mov dword [esp + 0x68], eax
jmp 0x4d39d9
mov edx, dword [esp + 0x20]
lea eax, [edx + edx]
sub eax, ecx
mov dword [esp + 0x64], eax
lea ecx, [esp + 0x64]
push ecx
mov ecx, ebx
call fcn.004023a0
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x34]
mov edx, ecx
add ecx, eax
sub edx, eax
mov dword [esp + 0x98], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x68]
add ecx, eax
sub edx, eax
lea eax, [esp + 0xbc]
mov dword [esp + 0x94], edx
lea edx, [esp + 0x90]
mov dword [esp + 0x9c], ecx
push edx
push eax
mov ecx, ebx
call fcn.004197f0
mov eax, dword [ebx + 0x128]
test eax, eax
je 0x4d3bf5
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x98]
lea eax, [edx + ecx]
cdq
sub eax, edx
mov edx, dword [esp + 0x9c]
mov ecx, eax
mov eax, dword [esp + 0x94]
add eax, edx
cdq
sub eax, edx
sar eax, 1
sar ecx, 1
mov dword [esp + 0xb0], eax
push eax
lea eax, [esp + 0xb0]
mov dword [esp + 0xb0], ecx
push ecx
push eax
mov ecx, ebx
call fcn.00402360
cmp dword [esp + 0x1c], 0x10
jne 0x4d3aa8
mov eax, 0x66666667
imul esi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, edx
jmp 0x4d3aaa
xor ecx, ecx
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x90]
sub eax, ecx
mov edi, dword [esp + 0x94]
sub eax, edx
sub esp, 8
cdq
fild dword [ebx + 0x264]
sub eax, edx
sub esp, 8
sar eax, 1
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xac]
fild dword [ebx + 0x260]
sub eax, ecx
sub eax, edi
fstp qword [esp + 0x5c]
cdq
sub eax, edx
lea edx, [esp + 0x2c8]
sar eax, 1
mov dword [esp + 0x40], eax
fild dword [esp + 0x40]
fdiv st(1)
fstp qword [esp + 8]
fild dword [esp + 0x24]
fdiv qword [esp + 0x5c]
fstp qword [esp]
fild dword [esp + 0xc0]
push 0
push 0
sub esp, 8
fdiv st(1)
sub esp, 8
fstp qword [esp + 8]
fstp st(0)
fild dword [esp + 0xd4]
fdiv qword [esp + 0x74]
fstp qword [esp]
push str.newpath_n_g__g__g__g__g_0_360_EllipticalArc_closepath_r_n
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [ebx + 0x128]
add esp, 0x30
push eax
lea eax, [esp + 0x2bc]
push eax
call fcn.0044dba0
sub esp, 0x30
mov ecx, 0xb
lea esi, [ebp + 0xc]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push ebx
movsw word es:[edi], word [esi]
call fcn.004cf6f0
mov eax, dword [esp + 0x50]
add esp, 0x34
cmp eax, 0x10
jne 0x4d3bbd
mov eax, 0x66666667
sub esp, 8
imul dword [ebp + 0x4c]
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [esp + 0x38], edx
lea edx, [esp + 0x2c0]
fild dword [esp + 0x38]
fidiv dword [ebx + 0x260]
fstp qword [esp]
push str._g_setlinewidth_r_nstroke_r_n
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4d3bd3
lea eax, [esp + 0x2b8]
push str.fill_r_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea ecx, [esp + 0x2b8]
push eax
push ecx
mov ecx, dword [ebx + 0x128]
call fcn.0044dba0
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 0x4c]
jmp 0x4d3cc0
cmp dword [esp + 0x1c], 0x10
jne 0x4d3c96
mov edx, dword [ebp + 0x32]
mov eax, 0x66666667
push edx
imul esi
sar edx, 2
mov ecx, edx
mov eax, edx
shr ecx, 0x1f
add eax, ecx
cdq
idiv dword [ebx + 0x260]
push eax
push 6
call dword [sym.imp.GDI32.dll_CreatePen]
mov edx, dword [ebx + 0x10]
push eax
push edx
mov dword [esp + 0x54], eax
call edi
push 5
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [ebx + 0x10]
push eax
call edi
mov ecx, dword [esp + 0xc8]
mov edx, dword [esp + 0xc4]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xc0]
push ecx
mov ecx, dword [esp + 0xc0]
push edx
mov edx, dword [ebx + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Ellipse]
mov eax, dword [esp + 0x30]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call edi
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x10]
push edx
push eax
call edi
mov ecx, dword [esp + 0x4c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4d3cc0
mov edx, dword [esp + 0xc8]
mov eax, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc0]
push edx
mov edx, dword [esp + 0xc0]
push eax
mov eax, dword [ebx + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 4
mov dword [esp + 0x18], eax
jl 0x4d3989
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xe4]
push ecx
mov ecx, dword [esp + eax*4 + 0x294]
push edx
lea edx, [esp + 0x74]
push ecx
mov ecx, dword [ebp + 0x3c]
push edx
mov edx, dword [ebp + 0x40]
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x104], 0
mov dword [eax], ecx
mov ecx, dword [ebp + 0x44]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x48]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.0041cfc0
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
sub eax, edx
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x90]
sub eax, ecx
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x9c]
add esp, 0x20
inc eax
cmp eax, ecx
mov dword [esp + 0x7c], eax
jl 0x4d292a
mov eax, dword [esp + 0xe0]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call edi
mov edx, dword [esp + 0xd4]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push edx
call esi
mov eax, dword [esp + 0xd0]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call edi
mov edx, dword [esp + 0xd8]
push edx
call esi
mov ecx, dword [esp + 0x4b8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret