Function at 0x4bc7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5df9db
push eax
mov dword fs:[0], esp
sub esp, 0x528
mov eax, dword [esp + 0x574]
mov edx, dword [esp + 0x580]
push ebx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [esp + 0x568]
push edi
mov dword [ebp + 0xec], ecx
mov ecx, dword [esp + 0x588]
mov dword [ebp + 0xf8], eax
mov eax, dword [esp + 0x570]
mov dword [ebp + 0x100], ecx
mov ecx, dword [ebp + 0x90]
mov dword [ebp + 0x104], eax
mov eax, dword [esp + 0x558]
mov dword [ebp + 0xf4], edx
mov edx, dword [ecx]
push eax
call dword [edx + 0xc]
test eax, eax
mov dword [ebp + 0xe8], eax
je 0x4bdee0
mov edx, dword [eax]
xor edi, edi
mov ecx, eax
mov dword [esp + 0x1c], 0x3c
xor ebx, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x4bc893
mov ecx, esi
call fcn.004a97b0
cmp eax, dword [esp + 0x1c]
jle 0x4bc865
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0xc]
push 0xa
add ebx, 2
push eax
inc edi
call fcn.0055c590
add esp, 8
test eax, eax
jne 0x4bc881
inc dword [esp + 0x18]
jmp 0x4bc882
inc edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov esi, eax
test esi, esi
jne 0x4bc854
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x550]
mov ecx, dword [esp + 0x548]
sub eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x55c]
test eax, eax
je 0x4bc8ba
mov dword [ebp + 0xfc], ebx
jmp 0x4bc8ca
mov ecx, dword [ebp + 0xe8]
movsx edx, word [ecx + 0x18]
mov dword [ebp + 0xfc], edx
mov eax, dword [ebp + 0xfc]
test eax, eax
je 0x4bdec9
mov ecx, dword [ebp + 0xe8]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x58c]
test eax, eax
je 0x4bc8f5
mov eax, 2
jmp 0x4bc905
mov ecx, dword [ebp + 0x78]
mov eax, dword [ecx + 0x28c]
neg eax
sbb eax, eax
add eax, 2
mov edx, dword [ebp]
push eax
mov eax, dword [esp + 0x55c]
mov ecx, ebp
push eax
call dword [edx]
cmp eax, 4
ja case.0x4bc91a.2
jmp dword [eax*4 + 0x4bdefc]
xor edi, edi
jmp 0x4bc959
mov eax, dword [ebp + 0x78]
mov ecx, dword [eax + 0x28c]
test ecx, ecx
je case.0x4bc91a.2
mov edi, dword [eax + 0x2f0]
jmp 0x4bc959
mov ecx, dword [ebp + 0x78]
mov edi, dword [ecx + 0x364]
jmp 0x4bc959
mov edx, dword [ebp + 0x78]
mov edi, dword [edx + 0x390]
jmp 0x4bc959
mov eax, dword [ebp + 0x78]
mov edi, dword [eax + 0x19c]
mov ebx, dword [esp + 0x554]
mov ecx, dword [esp + 0x54c]
sub ebx, ecx
mov ecx, dword [ebp + 0xa8]
mov eax, ebx
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
cdq
idiv dword [ebp + 0xfc]
push 0x5a
push ecx
mov dword [esp + 0x57c], edi
mov dword [esp + 0x28], eax
call esi
mov ecx, eax
mov eax, 0x38e38e39
shl ecx, 4
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
test edi, edi
jle 0x4bc9cb
mov ecx, dword [ebp + 0xa8]
push 0x5a
push ecx
call esi
mov ecx, eax
mov eax, 0xc71c71c7
imul ecx, edi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
jmp 0x4bc9d3
mov esi, dword [esp + 0x20]
cmp esi, edx
jle 0x4bc9d5
mov esi, edx
xor ecx, ecx
test esi, esi
setge cl
dec ecx
and ecx, 0xfffffffe
inc ecx
mov edi, ecx
mov edx, edi
imul edx, esi
cmp edx, 0x10
jle 0x4bca78
lea eax, [edi + edi*2]
lea eax, [eax + eax*4]
mov dword [esp + 0x2c], eax
mov ecx, dword [ebp + 0xf4]
mov edx, dword [ebp + 0x100]
mov eax, dword [ebp + 0xf8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [ebp + 0x104]
push ebx
push ecx
push edx
lea ecx, [esp + 0x150]
push eax
mov eax, dword [esp + 0x584]
lea edx, [esp + 0x8c]
push ecx
mov ecx, dword [ebp + 0xec]
push edx
push eax
mov eax, dword [ebp + 0xa8]
push 0x30
push ecx
mov ecx, dword [esp + 0x5c]
mov edx, esi
sub edx, ecx
mov ecx, dword [ebp + 0xe8]
push edx
push eax
push ecx
mov ecx, ebp
call fcn.004bdf90
test eax, eax
je 0x4bca78
mov edx, edi
mov eax, edi
neg edx
shl edx, 4
add esi, edx
imul eax, esi
cmp eax, 0x10
jg 0x4bc9fb
mov ecx, edi
imul ecx, esi
cmp ecx, 4
jle 0x4bcaf9
mov edx, dword [ebp + 0xf4]
mov eax, dword [ebp + 0x100]
mov ecx, dword [ebp + 0xf8]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [ebp + 0x104]
push ebx
push edx
push eax
lea edx, [esp + 0x150]
push ecx
mov ecx, dword [esp + 0x584]
lea eax, [esp + 0x8c]
push edx
mov edx, dword [ebp + 0xec]
push eax
mov eax, esi
push ecx
mov ecx, dword [ebp + 0xa8]
push 0x30
sub eax, edi
push edx
mov edx, dword [ebp + 0xe8]
push eax
push ecx
push edx
mov ecx, ebp
call fcn.004bdf90
test eax, eax
je 0x4bcaf9
mov eax, edi
mov ecx, edi
neg eax
lea esi, [esi + eax*2]
imul ecx, esi
cmp ecx, 4
jg 0x4bca82
mov edx, dword [ebp + 0xf4]
mov eax, dword [ebp + 0x100]
mov ecx, dword [ebp + 0xf8]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [ebp + 0x104]
push ebx
push edx
push eax
lea edx, [esp + 0x150]
push ecx
mov ecx, dword [esp + 0x584]
lea eax, [esp + 0x8c]
push edx
mov edx, dword [ebp + 0xec]
push eax
mov eax, dword [ebp + 0xa8]
push ecx
mov ecx, dword [ebp + 0xe8]
push 0x30
push edx
push esi
push eax
push ecx
mov ecx, ebp
call fcn.004bdf90
test eax, eax
je 0x4bcbbf
mov edx, dword [ebp + 0xf4]
mov eax, dword [ebp + 0x100]
mov ecx, dword [ebp + 0xf8]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [ebp + 0x104]
push ebx
push edx
push eax
lea edx, [esp + 0x150]
push ecx
mov ecx, dword [esp + 0x584]
lea eax, [esp + 0x8c]
push edx
mov edx, dword [ebp + 0xec]
push eax
mov eax, dword [ebp + 0xa8]
push ecx
mov ecx, dword [ebp + 0xe8]
sub esi, edi
push 0x30
push edx
push esi
push eax
push ecx
mov ecx, ebp
call fcn.004bdf90
test eax, eax
jne 0x4bcb5b
mov eax, dword [esp + 0x560]
test eax, eax
je 0x4bcbe9
mov eax, dword [ebp + 0xfc]
test eax, eax
mov ecx, eax
jne 0x4bcbdb
mov ecx, 1
mov edx, dword [esp + 0x70]
mov eax, ebx
sub eax, edx
dec ecx
cdq
idiv ecx
jmp 0x4bcc19
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x20]
cmp ecx, eax
jge 0x4bcc17
mov edx, dword [esp + 0x574]
test edx, edx
jne 0x4bcc08
add ecx, ecx
cmp ecx, eax
jge 0x4bcc1d
jmp 0x4bcc17
mov edx, dword [esp + 0x80]
add edx, ecx
cmp edx, eax
mov eax, edx
jl 0x4bcc19
mov eax, ecx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x55c]
mov dword [esp + 0x4c], eax
test ecx, ecx
je 0x4bcc4a
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov edx, ecx
add ecx, edi
neg edx
imul ecx, eax
cmp ecx, ebx
jle 0x4bcc46
dec eax
add ecx, edx
jmp 0x4bcc3d
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0xac]
mov ecx, dword [ebp + 0xa8]
mov edx, dword [ebp + 0xa4]
push eax
push esi
push ecx
push edx
call fcn.004ca720
mov ecx, dword [ebp + 0x78]
mov ebx, dword [esp + 0x59c]
add esp, 0x10
mov dword [esp + 0x34], eax
mov edi, dword [ecx + 0x28c]
mov ecx, dword [ebp + 0xa8]
test edi, edi
setne dl
push edx
mov edx, dword [ebp + 0xa4]
test ebx, ebx
mov edi, dword [esp + 0x55c]
push ecx
setne cl
push edx
push ecx
mov ecx, dword [ebp + 0xec]
push edi
test ecx, ecx
setne dl
push edx
push eax
lea eax, [esp + 0x60]
lea ecx, [esp + 0x6c]
push eax
mov eax, dword [esp + 0x568]
push ecx
mov ecx, dword [esp + 0x570]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x584]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x588]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, ebp
call fcn.004bf1a0
mov eax, dword [esp + 0x564]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x4bce2c
mov eax, dword [esp + 0x578]
test eax, eax
jne 0x4bcd13
mov dword [esp + 0x578], 0xa
mov ecx, dword [ebp + 0x90]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
mov edx, dword [ecx]
push eax
mov dword [esp + 0x24], 1
call dword [edx + 8]
cmp di, word [esp + 0x24]
jb 0x4bcd5d
mov ecx, dword [ebp + 0x90]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x2c]
and eax, 0xffff
and ecx, 0xffff
and edi, 0xffff
sub eax, ecx
cmp edi, eax
jl 0x4bcd65
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x50]
mov eax, dword [ebp + 0xa4]
push edx
push eax
call esi
mov edx, dword [ebp + 0xa4]
lea ecx, [esp + 0x100]
push ecx
push edx
mov dword [esp + 0x5c], eax
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
fld dword [0x5f9310]
test ebx, ebx
jne 0x4bce47
mov edi, dword [ebp + 0x78]
mov dword [esp + 0x578], 0xa
fstp st(0)
fild dword [edi + 0x298]
mov ebx, dword [edi + 0x16c]
fdivr qword [0x5f9308]
mov eax, dword [ebp + 0xe8]
mov cl, byte [edi + 0x24c]
fild dword [esp + 0x578]
mov eax, dword [eax + 0x10]
mov edx, dword [edi + 0x23c]
push 1
push ecx
push 0
push eax
mov eax, dword [esp + 0x590]
push edx
fmul st(1)
push eax
call fcn.0055b3c8
mov ecx, dword [esp + 0x594]
mov edx, dword [esp + 0x34]
push eax
push ecx
mov ecx, dword [ebp + 0xac]
push ebx
lea eax, [esp + 0x56c]
push edx
mov edx, dword [ebp + 0xa8]
push eax
mov eax, dword [ebp + 0xa4]
push edi
push ecx
push edx
push eax
fstp st(0)
call fcn.004ccab0
mov ebx, dword [esp + 0x5c8]
add esp, 0x3c
mov eax, dword [ebp + 0x104]
mov edx, dword [esp + 0x84]
test eax, eax
je 0x4bce55
mov dword [esp + 0x28], 0
jmp 0x4bcea7
mov edi, dword [ebp + 0x78]
mov ebx, dword [edi + 0x168]
jmp 0x4bcdbc
mov eax, dword [ebp + 0x78]
test ebx, ebx
je 0x4bce88
mov edi, dword [ebp + 0xf4]
mov ecx, dword [eax + 0x2b0]
test edi, edi
je 0x4bce6d
inc ecx
mov al, byte [eax + 0x2ec]
neg al
sbb eax, eax
and eax, 2
add eax, 2
add eax, ecx
imul eax, edx
mov dword [esp + 0x28], eax
jmp 0x4bcea7
mov cl, byte [eax + 0x2ec]
mov edi, dword [eax + 0x2b0]
neg cl
sbb ecx, ecx
and ecx, 2
add ecx, 2
add ecx, edi
imul ecx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0xe4]
test ecx, ecx
je 0x4bcee1
mov eax, dword [ebp + 0x78]
mov edi, dword [eax + 0x2a4]
test edi, edi
jne 0x4bcee1
mov edi, dword [ebp + 0xf4]
test edi, edi
jne 0x4bcee1
mov al, byte [eax + 0x2ec]
neg al
sbb eax, eax
and eax, 2
add eax, 2
lea ebx, [eax + ecx + 4]
imul ebx, edx
jmp 0x4bcee3
xor ebx, ebx
mov edx, dword [ebp + 0xa4]
mov ecx, dword [esp + 0x54c]
push 1
push edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x40], 0
mov dword [esp + 0x2c], ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [ebp + 0x94]
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
test byte [eax + 0x10], 0x10
je 0x4bd17e
mov cx, word [esp + 0x558]
cmp cx, word [eax + 0xa4]
jne 0x4bd17e
push 0x662078
mov edx, dword [esp + 0x38]
push 0x20
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x190
push 0xfffffe3e
push 0xfffffe3e
lea eax, [edx + edx]
push 0
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov ecx, dword [ebp + 0xa4]
push eax
push ecx
mov dword [esp + 0x3c], eax
call esi
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xa4]
lea edx, [esp + 0xc8]
push edx
push eax
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
mov ecx, dword [ebp + 0xa4]
push 0xc0c0c0
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x550]
mov esi, dword [esp + 0x548]
mov edx, dword [ebp + 0xac]
sub ecx, esi
mov eax, 0x51eb851f
push edx
imul ecx
sar edx, 4
mov eax, edx
mov ecx, dword [ebp + 0xa8]
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x2c]
add edx, ebx
add edx, eax
add edx, esi
push edx
mov edx, dword [ebp + 0xa4]
push ecx
push edx
call fcn.004ca6c0
mov ecx, dword [esp + 0xec]
add esp, 0x10
push 0x66685c
lea esi, [eax + ecx*2]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp + 0xac]
mov ecx, dword [ebp + 0xa8]
push eax
mov eax, dword [esp + 0x550]
push 0x66685c
push edx
mov edx, dword [ebp + 0xa4]
push eax
push ecx
push edx
call fcn.004ca720
fild dword [esp + 0xe0]
add esp, 0x10
mov ebx, eax
fmul qword [0x5f9300]
call fcn.0055b3c8
sub ebx, eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push eax
call edi
push 0x666838
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 0xac]
mov edx, dword [esp + 0x54c]
push eax
mov eax, dword [ebp + 0xa8]
push 0x666838
push ecx
mov ecx, dword [ebp + 0xa4]
push edx
push eax
push ecx
call fcn.004ca720
fild dword [esp + 0xe0]
add esp, 0x10
mov ebx, eax
fmul qword [0x5f92f8]
call fcn.0055b3c8
mov edx, dword [ebp + 0xa4]
sub ebx, eax
push ebx
push esi
push edx
call edi
push 0x666818
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x54c]
mov edx, dword [ebp + 0xa8]
push eax
mov eax, dword [ebp + 0xac]
push 0x666818
push eax
mov eax, dword [ebp + 0xa4]
push ecx
push edx
push eax
call fcn.004ca720
fild dword [esp + 0xe0]
add esp, 0x10
mov ebx, eax
fmul qword [0x5f92f0]
call fcn.0055b3c8
mov ecx, dword [ebp + 0xa4]
sub ebx, eax
push ebx
push esi
push ecx
call edi
push 0x6667fc
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp + 0xac]
mov ecx, dword [ebp + 0xa8]
push eax
mov eax, dword [esp + 0x550]
push 0x6667fc
push edx
mov edx, dword [ebp + 0xa4]
push eax
push ecx
push edx
call fcn.004ca720
fild dword [esp + 0xe0]
add esp, 0x10
mov ebx, eax
fmul qword [0x5f92e8]
call fcn.0055b3c8
sub ebx, eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push eax
call edi
mov ecx, dword [ebp + 0xa4]
push 0
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esp + 0x2c]
mov eax, dword [ebp + 0xa4]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push edx
push eax
call esi
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp + 0xe8]
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
mov dword [esp + 0x14], eax
je 0x4bd904
jmp 0x4bd19d
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x50]
mov ecx, dword [ebp + 0xa4]
push eax
push ecx
call esi
mov edx, dword [ebp + 0xe8]
test byte [edx + 0x14], 2
jne 0x4bd44c
mov eax, dword [ebp + 0x78]
mov cl, byte [eax + 0x2ec]
test cl, cl
je 0x4bd1ec
mov ecx, dword [esp + 0x14]
mov dl, byte [ecx + 4]
lea ecx, [esp + 0xa8]
mov byte [esp + 0x2c], dl
mov eax, dword [esp + 0x2c]
and eax, 0xff
push eax
push 0x6667f4
push ecx
jmp 0x4bd20f
mov edx, dword [esp + 0x14]
mov al, byte [edx + 4]
lea edx, [esp + 0xa8]
mov byte [esp + 0x30], al
mov ecx, dword [esp + 0x30]
and ecx, 0xff
push ecx
push 0x653e44
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
fild dword [ebp + 0x100]
fmul dword [0x5f92e0]
not ecx
dec ecx
sub esp, 0x38
mov ebx, ecx
mov ecx, 0xe
lea esi, [esp + 0xa8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x78]
mov eax, dword [ebp]
push ecx
mov ecx, dword [esp + 0x584]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x598]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x59c]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x5a0]
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x6c]
push edx
push ecx
mov ecx, dword [esp + 0x78]
lea edx, [esp + 0xfc]
fstp dword [esp]
push ecx
mov ecx, dword [ebp + 0x104]
push ebx
push edx
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [ebp + 0xe8]
push edx
push ecx
mov ecx, ebp
call dword [eax + 0x50]
mov eax, dword [esp + 0x558]
mov edx, dword [ebp]
push 4
push eax
mov ecx, ebp
call dword [edx]
test eax, eax
je 0x4bd44c
mov eax, dword [ebp + 0x104]
test eax, eax
je 0x4bd36b
mov ecx, dword [ebp + 0xa4]
push 2
push ecx
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov edx, dword [ebp + 0x20]
mov esi, eax
mov eax, dword [ebp + 0xa4]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp + 0xac]
lea ecx, [esp + 0xa8]
mov edi, eax
mov eax, dword [esp + 0x24]
push ebx
push ecx
mov ecx, dword [ebp + 0xa8]
push edx
mov edx, dword [ebp + 0xa4]
push eax
push ecx
push edx
call fcn.004ca720
mov ecx, dword [esp + 0x588]
mov edx, dword [ebp + 0xa8]
add esp, 0x10
push eax
mov eax, dword [ebp + 0xac]
push eax
mov eax, dword [ebp + 0xa4]
push ecx
push edx
push eax
call fcn.004ca6c0
mov ecx, dword [ebp + 0xa4]
add esp, 0x10
push eax
push ecx
call dword [sym.imp.GDI32.dll_TextOutA]
mov edx, dword [ebp + 0xa4]
push esi
push edx
call dword [sym.imp.GDI32.dll_SetTextAlign]
push edi
jmp 0x4bd43f
mov eax, dword [ebp + 0xe4]
xor edi, edi
test eax, eax
je 0x4bd3a5
mov ecx, dword [ebp + 0x78]
mov eax, dword [ecx + 0x2a4]
test eax, eax
jne 0x4bd3a5
mov eax, dword [esp + 0x58c]
test eax, eax
je 0x4bd3a0
mov eax, dword [ebp + 0xf4]
test eax, eax
jne 0x4bd3a5
mov edi, 2
jmp 0x4bd3a5
mov edi, 1
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0xa4]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp + 0xac]
lea ecx, [esp + 0xa8]
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push ecx
mov ecx, dword [ebp + 0xa8]
push edx
mov edx, dword [ebp + 0xa4]
push eax
push ecx
push edx
call fcn.004ca720
mov ecx, dword [ebp + 0x78]
add esp, 0x10
mov dl, byte [ecx + 0x2ec]
mov ecx, dword [esp + 0x48]
neg dl
sbb edx, edx
push eax
and edx, 2
mov eax, dword [ebp + 0xac]
add edx, 2
push eax
sub edx, edi
mov eax, dword [esp + 0x558]
sub edx, ebx
imul edx, dword [esp + 0x94]
add edx, ecx
mov ecx, dword [ebp + 0xa4]
add edx, eax
mov eax, dword [ebp + 0xa8]
push edx
push eax
push ecx
call fcn.004ca6c0
mov edx, dword [ebp + 0xa4]
add esp, 0x10
push eax
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
push esi
mov eax, dword [ebp + 0xa4]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 0x78]
mov edx, dword [eax + 0x2a4]
cmp edx, 0xffffffff
je 0x4bd57a
mov ecx, dword [ebp + 0xe4]
test ecx, ecx
jle 0x4bd57a
mov esi, dword [esp + 0x14]
mov edi, dword [esi + 0x10]
test edi, edi
je 0x4bd57a
mov esi, dword [ebp + 0xf4]
test esi, esi
jne 0x4bd4c8
test edx, edx
jne 0x4bd492
mov esi, dword [esp + 0x548]
jmp 0x4bd4fa
mov eax, dword [esp + 0x58c]
test eax, eax
je 0x4bd4b2
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x550]
imul edx, ecx
sub esi, edx
jmp 0x4bd4fa
add ecx, 3
mov esi, dword [esp + 0x550]
imul ecx, dword [esp + 0x84]
sub esi, ecx
jmp 0x4bd4fa
test edx, edx
jne 0x4bd4fa
lea edx, [ecx - 2]
mov ecx, dword [esp + 0x84]
imul edx, ecx
sub esi, edx
mov edx, dword [eax + 0x2e0]
test edx, edx
je 0x4bd4fa
mov al, byte [eax + 0x2ec]
neg al
sbb eax, eax
and eax, 2
add eax, 3
imul eax, ecx
sub esi, eax
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp + 0xa4]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 0xac]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [ebp + 0xa8]
push edi
push ecx
mov ecx, dword [ebp + 0xa4]
push edx
push eax
push ecx
call fcn.004ca720
mov edx, dword [ebp + 0xac]
mov ecx, dword [ebp + 0xa4]
add esp, 0x10
push eax
mov eax, dword [ebp + 0xa8]
push edx
push esi
push eax
push ecx
call fcn.004ca6c0
mov edx, dword [ebp + 0xa4]
add esp, 0x10
push eax
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [ebp + 0xa4]
push ebx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
xor al, al
mov dword [esp + 0x34], 0
mov byte [esp + 0x3c], al
mov ebx, 1
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x3c]
and esi, 0xff
mov dl, al
mov ecx, dword [edi + 0xc]
mov byte [esp + 0x10], dl
mov dword [esp + 0x18], esi
mov al, byte [ecx + esi]
test al, al
je 0x4bd5ce
cmp al, 0xa
je 0x4bd5ce
cmp dl, 0xff
jae 0x4bd5ce
inc dl
mov byte [esp + 0x10], dl
mov eax, dword [esp + 0x10]
and eax, 0xff
mov al, byte [eax + ecx]
test al, al
jne 0x4bd5af
mov eax, dword [esp + 0x10]
and eax, 0xff
cmp byte [ecx + eax], 0
je 0x4bd5e6
cmp dl, 0xff
mov dword [esp + 0x48], ebx
jb 0x4bd5ee
mov dword [esp + 0x48], 0
sub eax, esi
mov ebx, eax
cmp ebx, 0x78
mov dword [esp + 0x1c], ebx
jle 0x4bd604
mov ebx, 0x78
mov dword [esp + 0x1c], ebx
mov eax, dword [ebp + 0xf8]
xor esi, esi
cmp eax, 2
jne 0x4bd628
mov ecx, dword [esp + 0x44]
mov edx, dword [ebp + 0xa4]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x4bd803
mov ecx, dword [edi + 8]
test cl, 2
je 0x4bd69e
cmp eax, 4
je 0x4bd752
test eax, eax
je 0x4bd752
mov eax, dword [esp + 0x50]
mov ecx, dword [ebp + 0xa4]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 0xf8]
cmp eax, 5
je 0x4bd667
cmp eax, 7
jne 0x4bd803
mov eax, dword [edi + 0xc]
cmp byte [eax], 0x20
jne 0x4bd679
mov cl, byte [eax + 1]
inc eax
inc esi
cmp cl, 0x20
je 0x4bd66f
mov dl, byte [eax]
inc eax
cmp dl, 0x51
jne 0x4bd684
inc esi
jmp 0x4bd686
xor esi, esi
mov al, byte [eax]
cmp al, 0x2e
je 0x4bd690
cmp al, 0x3a
jne 0x4bd691
inc esi
test esi, esi
je 0x4bd803
jmp 0x4bd771
test cl, 4
je 0x4bd738
cmp eax, 4
je 0x4bd752
cmp eax, 1
je 0x4bd752
mov edx, dword [esp + 0x50]
mov eax, dword [ebp + 0xa4]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 0xf8]
cmp eax, 6
je 0x4bd6db
cmp eax, 7
jne 0x4bd6f6
mov eax, dword [edi + 0xc]
push 2
push 0x6667f0
push eax
call fcn.0055c1b0
add esp, 0xc
test eax, eax
jne 0x4bd6f6
mov cl, 1
jmp 0x4bd6f8
xor cl, cl
mov eax, dword [ebp + 0xf8]
cmp eax, 6
je 0x4bd708
cmp eax, 7
jne 0x4bd769
mov eax, dword [edi + 0xc]
cmp byte [eax], 0x20
jne 0x4bd71a
mov dl, byte [eax + 1]
inc eax
inc esi
cmp dl, 0x20
je 0x4bd710
mov dl, byte [eax]
inc eax
cmp dl, 0x41
jne 0x4bd725
inc esi
jmp 0x4bd727
xor esi, esi
mov al, byte [eax]
cmp al, 0x2e
je 0x4bd731
cmp al, 0x3a
jne 0x4bd732
inc esi
test esi, esi
je 0x4bd769
jmp 0x4bd771
test cl, 8
je 0x4bd803
mov edx, dword [ebp + 0x78]
mov al, byte [edx + 0x2ed]
test al, al
je 0x4bd803
mov eax, dword [esp + 0x44]
mov ecx, dword [ebp + 0xa4]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x4bd803
test cl, cl
je 0x4bd803
mov edx, dword [esp + 0x44]
mov eax, dword [ebp + 0xa4]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
fild dword [ebp + 0x100]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
push 0
push ecx
fmul dword [0x5f92e0]
mov edi, eax
mov eax, dword [ecx + 0xc]
mov edx, dword [ebp]
fstp dword [esp]
push ebx
mov ebx, dword [esp + 0x24]
add eax, ebx
push esi
mov ebx, dword [esp + 0x38]
push eax
mov eax, dword [ebp + 0xac]
push eax
mov eax, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x5c]
add eax, ebx
mov ebx, dword [esp + 0x564]
add eax, ebx
push eax
lea eax, [esp + 0x158]
push eax
mov eax, dword [ebp + 0xa8]
push eax
mov eax, dword [ebp + 0xa4]
push eax
push ecx
mov ecx, dword [ebp + 0xe8]
push ecx
mov ecx, ebp
call dword [edx + 0x54]
mov edx, dword [ebp + 0xa4]
push edi
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
test esi, esi
je 0x4bd826
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 0xc]
xor eax, eax
test esi, esi
jle 0x4bd826
movsx edx, byte [eax + edi]
add ecx, dword [esp + edx*4 + 0x138]
inc eax
cmp eax, esi
jl 0x4bd816
fild dword [ebp + 0x100]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
push 0
push ecx
fmul dword [0x5f92e0]
mov eax, dword [edx + 0xc]
sub ebx, esi
add eax, esi
mov esi, dword [esp + 0x20]
add eax, esi
mov esi, dword [esp + 0x2c]
fstp dword [esp]
push edi
push ebx
push eax
mov eax, dword [ebp + 0xac]
mov ebx, dword [esp + 0x55c]
push eax
mov eax, dword [esp + 0x58]
mov edx, dword [ebp]
add ecx, eax
mov eax, dword [esp + 0x40]
add ecx, eax
mov eax, dword [ebp + 0xa8]
add ecx, ebx
mov ebx, dword [esp + 0x2c]
push esi
push ecx
lea ecx, [esp + 0x158]
push ecx
mov ecx, dword [ebp + 0xa4]
push eax
mov eax, dword [ebp + 0xe8]
push ecx
push ebx
push eax
mov ecx, ebp
call dword [edx + 0x54]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x48]
inc edx
add esi, edi
test eax, eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x24], esi
je 0x4bd8cb
mov al, byte [esp + 0x10]
mov ebx, 1
inc al
mov dword [esp + 0x34], ebx
mov byte [esp + 0x3c], al
jmp 0x4bd58d
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4bd8f1
mov eax, dword [esp + 0x55c]
test eax, eax
je 0x4bd8f1
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x4c]
inc ecx
add esi, eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], esi
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x4bd197
mov esi, dword [ebp + 0x94]
mov edi, dword [esi + 0x130]
cmp dword [edi + 0x1c], 0xffffffff
jle 0x4bdeb7
mov al, byte [esp + 0x594]
test al, al
je 0x4bdeb7
mov eax, dword [ebp + 0x78]
mov cl, byte [eax + 0x3b4]
test cl, cl
je 0x4bdeb7
mov eax, dword [ebp + 0x80]
test eax, eax
jne 0x4bd948
xor edx, edx
jmp 0x4bd961
mov ecx, dword [ebp + 0x84]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
test edx, edx
sete byte [esp + 0x24]
cmp word [esi + 0x12c], 0
mov dword [esp + 0x2c], 0
jbe 0x4bdeb7
add edi, 0x22
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], edi
mov al, byte [esp + 0x24]
test al, al
je 0x4bdc19
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x58]
mov eax, dword [edx - 0x1a]
push eax
call fcn.004ca3c0
mov esi, dword [ebp + 0x84]
mov ecx, dword [ebp + 0x88]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
mov dword [esp + 0x540], 0
shr eax, 0x1f
add edx, eax
mov edi, esi
cmp edx, 1
jae 0x4bdb16
mov ebx, dword [ebp + 0x80]
test ebx, ebx
je 0x4bda05
mov ecx, esi
mov eax, 0x2aaaaaab
sub ecx, ebx
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edx, 1
mov ecx, edx
ja 0x4bda0a
mov ecx, 1
test ebx, ebx
jne 0x4bda12
xor edx, edx
jmp 0x4bda25
sub esi, ebx
mov eax, 0x2aaaaaab
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edx + ecx]
test eax, eax
mov dword [esp + 0x30], eax
jge 0x4bda32
xor eax, eax
lea ecx, [eax + eax*2]
shl ecx, 3
push ecx
call fcn.0059dece
mov esi, dword [ebp + 0x80]
add esp, 4
cmp esi, edi
mov dword [esp + 0x3c], eax
mov ebx, eax
je 0x4bda65
push esi
push ebx
call fcn.004becf0
add esi, 0x18
add esp, 8
add ebx, 0x18
cmp esi, edi
jne 0x4bda51
lea edx, [esp + 0x58]
push edx
push ebx
call fcn.004becf0
mov esi, dword [ebp + 0x84]
add esp, 8
cmp edi, esi
je 0x4bda94
add ebx, 0x18
push edi
push ebx
call fcn.004becf0
add edi, 0x18
add esp, 8
add ebx, 0x18
cmp edi, esi
jne 0x4bda80
mov edi, dword [ebp + 0x84]
mov esi, dword [ebp + 0x80]
cmp esi, edi
je 0x4bdab4
push 0
mov ecx, esi
call fcn.004bed60
add esi, 0x18
cmp esi, edi
jne 0x4bdaa4
mov eax, dword [ebp + 0x80]
push eax
call fcn.0059def7
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x40]
add esp, 4
lea eax, [eax + eax*2]
lea ecx, [esi + eax*8]
mov eax, dword [ebp + 0x80]
test eax, eax
mov dword [ebp + 0x88], ecx
jne 0x4bdae5
xor edx, edx
jmp 0x4bdafe
mov ecx, dword [ebp + 0x84]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [edx + edx*2 + 3]
mov dword [ebp + 0x80], esi
lea edx, [esi + ecx*8]
mov dword [ebp + 0x84], edx
jmp 0x4bdc05
mov ecx, esi
mov eax, 0x2aaaaaab
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
jae 0x4bdba2
cmp edi, esi
mov eax, edi
je 0x4bdb49
lea ebx, [eax + 0x18]
push eax
push ebx
call fcn.004becf0
mov eax, ebx
add esp, 8
cmp eax, esi
jne 0x4bdb36
mov esi, dword [ebp + 0x84]
mov eax, 0x2aaaaaab
mov ecx, esi
sub ecx, edi
imul ecx
sar edx, 2
mov ecx, edx
mov eax, 1
shr ecx, 0x1f
add edx, ecx
sub eax, edx
je 0x4bdb83
mov ebx, eax
lea edx, [esp + 0x58]
push edx
push esi
call fcn.004becf0
add esp, 8
add esi, 0x18
dec ebx
jne 0x4bdb6f
mov esi, dword [ebp + 0x84]
cmp edi, esi
je 0x4bdbfe
lea eax, [esp + 0x58]
mov ecx, edi
push eax
call fcn.004bdf10
add edi, 0x18
cmp edi, esi
jne 0x4bdb8d
jmp 0x4bdbfe
lea ebx, [esi - 0x18]
mov dword [esp + 0x18], esi
cmp ebx, esi
je 0x4bdbcd
mov ecx, dword [esp + 0x18]
push ebx
push ecx
call fcn.004becf0
mov edx, dword [esp + 0x20]
add ebx, 0x18
add esp, 8
add edx, 0x18
cmp ebx, esi
mov dword [esp + 0x18], edx
jne 0x4bdbad
mov ebx, dword [ebp + 0x84]
lea esi, [ebx - 0x18]
cmp edi, esi
je 0x4bdbec
sub esi, 0x18
sub ebx, 0x18
push esi
mov ecx, ebx
call fcn.004bdf10
cmp esi, edi
jne 0x4bdbda
lea edx, [esp + 0x58]
lea eax, [edi + 0x18]
push edx
push eax
push edi
call fcn.004beca0
add esp, 0xc
add dword [ebp + 0x84], 0x18
lea ecx, [esp + 0x58]
mov dword [esp + 0x540], 0xffffffff
call fcn.004ca3a0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x558]
and ecx, 0xffff
cmp ecx, dword [edx - 6]
jne 0x4bde81
mov ecx, dword [ebp + 0xa8]
lea eax, [esp + 0x100]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
mov ecx, dword [ebp + 0xe8]
mov edx, dword [esp + 0x54c]
mov dword [esp + 0x18], edx
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
mov dword [esp + 0x14], eax
je 0x4bde81
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
xor esi, esi
xor cl, cl
mov ebx, dword [edx + 0xc]
mov dword [esp + 0x3c], esi
mov byte [esp + 0x34], cl
mov eax, dword [esp + 0x34]
mov byte [esp + 0x38], cl
mov edx, dword [esp + 0x38]
and eax, 0xff
mov al, byte [eax + ebx]
test al, al
je 0x4bdcba
cmp al, 0xa
je 0x4bdcba
cmp cl, 0xff
jae 0x4bdcba
inc cl
mov byte [esp + 0x38], cl
mov edx, dword [esp + 0x38]
mov eax, edx
and eax, 0xff
mov al, byte [eax + ebx]
test al, al
jne 0x4bdc99
and edx, 0xff
cmp byte [edx + ebx], 0
je 0x4bdcd2
cmp cl, 0xff
jae 0x4bdcd2
mov eax, 1
jmp 0x4bdcd4
xor eax, eax
add edi, dword [esp + 0x20]
test eax, eax
je 0x4bdce9
inc cl
mov esi, 1
mov byte [esp + 0x34], cl
jmp 0x4bdc81
test esi, esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x18], edi
jne 0x4bdd08
mov eax, dword [esp + 0x55c]
test eax, eax
je 0x4bdd08
add edi, dword [esp + 0x4c]
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add eax, 0xffffffde
movzx dx, byte [ecx + 4]
cmp dx, word [eax + 0x20]
jne 0x4bde6c
mov ecx, dword [esp + 0x10]
xor esi, esi
xor edi, edi
cmp word [ecx], si
jle 0x4bdd7b
xor edx, edx
push 0x58
mov dl, byte [esi + ebx]
mov eax, dword [esp + edx*4 + 0x13c]
add edi, eax
mov eax, dword [ebp + 0xa8]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
fild dword [ebp + 0x100]
fmul dword [0x5f92e0]
fmulp st(1)
fmul qword [0x5f92d8]
call fcn.0055b3c8
mov ecx, dword [esp + 0x10]
add edi, eax
inc esi
movsx edx, word [ecx]
cmp esi, edx
jl 0x4bdd2f
mov eax, dword [esp + 0x58c]
mov dword [esp + 0x48], 0x3f800000
test eax, eax
jne 0x4bddc6
mov eax, dword [esp + 0x550]
mov ecx, dword [esp + 0x548]
sub eax, ecx
mov ecx, dword [ebp + 0xcc]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc4]
fild dword [esp + 0x30]
sub ecx, eax
mov dword [esp + 0x30], ecx
fmul qword [0x5f92d0]
fidiv dword [esp + 0x30]
fstp dword [esp + 0x48]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
lea edx, [eax + eax]
sub esi, edx
test ecx, ecx
mov ecx, dword [esp + 0x100]
jne 0x4bddfe
mov edx, dword [esp + 0x55c]
test edx, edx
jne 0x4bddef
add esi, eax
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
neg eax
add esi, eax
push 0x6667e8
push ebx
add esi, ecx
call fcn.0055bac0
add esp, 8
test eax, eax
je 0x4bde22
mov eax, dword [esp + 0x100]
cdq
sub eax, edx
sar eax, 1
neg eax
add esi, eax
mov eax, dword [esp + 0x48]
mov ecx, dword [ebp + 0x78]
mov edx, dword [ebp + 0x80]
push eax
mov eax, dword [ebp + 0xac]
push ecx
mov ecx, dword [esp + 0x24]
add edx, ecx
mov ecx, dword [esp + 0x48]
add edi, ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [ebp + 0xa8]
push eax
mov eax, dword [esp + 0x558]
add edi, ecx
push esi
add edi, eax
mov eax, dword [ebp + 0xa4]
push edi
push edx
push eax
call fcn.004cafd0
add esp, 0x20
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x4bdc6a
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x94]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
add edx, 0x18
inc eax
mov dword [esp + 0x1c], edx
xor edx, edx
mov dx, word [ecx + 0x12c]
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], esi
jl 0x4bd98d
mov eax, dword [esp + 0x54]
mov ecx, dword [ebp + 0xa4]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp + 0x90]
mov eax, dword [ebp + 0xe8]
push eax
mov edx, dword [ecx]
call dword [edx + 0x10]
mov eax, 1
mov ecx, dword [esp + 0x538]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x534
ret 0x50