Function at 0x4d7434
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1b
push 0
push 0
dec ecx
jne 0x4d743c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
add ebx, 0xffffffb8
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x4d8447
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xa0]
inc eax
mov edx, dword [esi]
cmp eax, dword [edx + 0xa64]
jl 0x4d8407
mov edx, dword [ebp + 8]
mov edx, dword [esi]
cmp eax, dword [edx + 0xa68]
jg 0x4d8407
mov eax, dword [ebp + 8]
mov al, byte [eax - 0x9b]
add al, 0xfe
sub al, 2
jb 0x4d8407
lea eax, [ebp - 8]
call fcn.00404eb0
lea eax, [ebp - 0xc]
call fcn.00404eb0
lea eax, [ebp - 0x10]
call fcn.00404eb0
lea eax, [ebp - 0x14]
call fcn.00404eb0
lea eax, [ebp - 0x18]
call fcn.00404eb0
lea eax, [ebp - 0x1c]
call fcn.00404eb0
lea eax, [ebp - 0x30]
call fcn.00404eb0
mov byte [ebp - 0x31], 1
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax + 4]
cmp eax, 6
ja case.0x4d74f8.0
jmp dword [eax*4 + 0x4d74ff]
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x78]
mov eax, 0x4d8460
call fcn.0040cc6c
push dword [ebp - 0x78]
push 0x4d8470
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405228
jmp case.0x4d74f8.0
push dword [ebp - 0xc]
push 0x4d8470
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x7c]
mov eax, 0x4d8460
call fcn.0040cc6c
push dword [ebp - 0x7c]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405228
jmp case.0x4d74f8.0
push dword [ebp - 0x10]
push 0x4d8470
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x80]
mov eax, 0x4d8460
call fcn.0040cc6c
push dword [ebp - 0x80]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405228
jmp case.0x4d74f8.0
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x84]
mov eax, 0x4d8460
call fcn.0040cc6c
push dword [ebp - 0x84]
push 0x4d8470
push dword [ebp - 0x14]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405228
jmp case.0x4d74f8.0
push dword [ebp - 0x18]
push 0x4d8470
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x88]
mov eax, 0x4d8460
call fcn.0040cc6c
push dword [ebp - 0x88]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405228
jmp case.0x4d74f8.0
push dword [ebp - 0x1c]
push 0x4d8470
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x8c]
mov eax, 0x4d8460
call fcn.0040cc6c
push dword [ebp - 0x8c]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405228
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax + 5]
cmp eax, 6
ja case.0x4d7676.0
jmp dword [eax*4 + 0x4d767d]
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xc]
call fcn.0040cc6c
push dword [ebp - 0x90]
push 0x4d8470
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405228
jmp case.0x4d7676.0
push dword [ebp - 0xc]
push 0x4d8470
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xc]
call fcn.0040cc6c
push dword [ebp - 0x94]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405228
jmp case.0x4d7676.0
push dword [ebp - 0x10]
push 0x4d8470
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xc]
call fcn.0040cc6c
push dword [ebp - 0x98]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405228
jmp case.0x4d7676.0
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xc]
call fcn.0040cc6c
push dword [ebp - 0x9c]
push 0x4d8470
push dword [ebp - 0x14]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405228
jmp case.0x4d7676.0
push dword [ebp - 0x18]
push 0x4d8470
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xc]
call fcn.0040cc6c
push dword [ebp - 0xa0]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405228
jmp case.0x4d7676.0
push dword [ebp - 0x1c]
push 0x4d8470
call fcn.0040bea4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xc]
call fcn.0040cc6c
push dword [ebp - 0xa4]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405228
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax + 6]
cmp eax, 6
ja case.0x4d780c.0
jmp dword [eax*4 + 0x4d7813]
mov eax, dword [ebp - 0x50]
push dword [eax + 0x50]
push 0x4d8470
push ebp
lea eax, [ebp - 0xa8]
call fcn.004d7310
pop ecx
push dword [ebp - 0xa8]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x54]
push 0x4d8470
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 7
call fcn.00405228
jmp case.0x4d780c.0
push dword [ebp - 0xc]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x50]
push 0x4d8470
push ebp
lea eax, [ebp - 0xac]
call fcn.004d7310
pop ecx
push dword [ebp - 0xac]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x54]
lea eax, [ebp - 0xc]
mov edx, 7
call fcn.00405228
jmp case.0x4d780c.0
push dword [ebp - 0x10]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x50]
push 0x4d8470
push ebp
lea eax, [ebp - 0xb0]
call fcn.004d7310
pop ecx
push dword [ebp - 0xb0]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x54]
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.00405228
jmp case.0x4d780c.0
mov eax, dword [ebp - 0x50]
push dword [eax + 0x50]
push 0x4d8470
push ebp
lea eax, [ebp - 0xb4]
call fcn.004d7310
pop ecx
push dword [ebp - 0xb4]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x54]
push 0x4d8470
push dword [ebp - 0x14]
lea eax, [ebp - 0x14]
mov edx, 7
call fcn.00405228
jmp case.0x4d780c.0
push dword [ebp - 0x18]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x50]
push 0x4d8470
push ebp
lea eax, [ebp - 0xb8]
call fcn.004d7310
pop ecx
push dword [ebp - 0xb8]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x54]
lea eax, [ebp - 0x18]
mov edx, 7
call fcn.00405228
jmp case.0x4d780c.0
push dword [ebp - 0x1c]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x50]
push 0x4d8470
push ebp
lea eax, [ebp - 0xbc]
call fcn.004d7310
pop ecx
push dword [ebp - 0xbc]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x54]
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00405228
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x24], 0
je 0x4d7ab6
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax + 0x10]
cmp eax, 6
ja case.0x4d7b23.0
jmp dword [eax*4 + 0x4d79da]
mov eax, dword [ebp - 0x50]
push dword [eax + 0x24]
push 0x4d8470
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
push dword [ebp - 0xc]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x24]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
push dword [ebp - 0x10]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x24]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
mov eax, dword [ebp - 0x50]
push dword [eax + 0x24]
push 0x4d8470
push dword [ebp - 0x14]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
push dword [ebp - 0x18]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x24]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
push dword [ebp - 0x1c]
push 0x4d8470
mov eax, dword [ebp - 0x50]
push dword [eax + 0x24]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xc0]
mov edx, dword [esi]
mov dl, byte [edx + 0x939]
call fcn.004a78ec
cmp al, 1
jne 0x4d7b00
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
call fcn.004a759c
mov eax, dword [ebp - 0x50]
mov al, byte [eax + 0x10]
dec eax
sub al, 3
setb al
mov byte [ebp - 0x31], al
jmp case.0x4d7b23.0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4d7b23.0
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax + 0x10]
cmp eax, 6
ja case.0x4d7b23.0
jmp dword [eax*4 + 0x4d7b2a]
lea ecx, [ebp - 0xc4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xc4]
push 0x4d8470
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
push dword [ebp - 0xc]
push 0x4d8470
lea ecx, [ebp - 0xc8]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xc8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
push dword [ebp - 0x10]
push 0x4d8470
lea ecx, [ebp - 0xcc]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xcc]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
lea ecx, [ebp - 0xd0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xd0]
push 0x4d8470
push dword [ebp - 0x14]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
push dword [ebp - 0x18]
push 0x4d8470
lea ecx, [ebp - 0xd4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xd4]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405228
jmp case.0x4d7b23.0
push dword [ebp - 0x1c]
push 0x4d8470
lea ecx, [ebp - 0xd8]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x28]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xd8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405228
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x54]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov edx, dword [eax + 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov eax, edi
call fcn.00426064
mov edx, eax
mov eax, dword [esi]
call fcn.004d5260
mov edx, eax
mov eax, edi
call fcn.00425fc8
cmp dword [ebp - 8], 0
je 0x4d7cd5
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc8]
neg ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc4]
mov eax, dword [ebx]
call fcn.00426f28
cmp dword [ebp - 0xc], 0
je 0x4d7d14
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx]
mov edx, dword [ebp - 0xc]
call fcn.00427098
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xcc]
sub edx, eax
sub edx, 0x14
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
sub edx, dword [eax + 0x3c]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc8]
neg ecx
mov eax, dword [ebx]
call fcn.00426f28
cmp dword [ebp - 0x10], 0
je 0x4d7d47
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
call fcn.00427098
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xcc]
sub edx, eax
shr edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc8]
neg ecx
mov eax, dword [ebx]
call fcn.00426f28
mov eax, dword [esi]
mov edi, dword [eax + 0x580]
mov al, byte [edi + 0x10]
dec eax
sub al, 3
jae 0x4d7e7d
mov eax, dword [edi + 0x28]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4d7e7d
cmp dword [ebp - 0x30], 0
jne 0x4d7e7d
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 2
jl 0x4d7e7d
inc eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x20], 2
mov eax, dword [ebx]
mov edx, 0x4d847c
call fcn.004270b4
add dword [ebp - 0x24], eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x20]
dec edx
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov eax, dword [eax + 0x28]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov al, byte [eax + 0x10]
dec al
je 0x4d7ddf
dec al
je 0x4d7e03
dec al
je 0x4d7e41
jmp 0x4d7e71
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc8]
neg ecx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc4]
mov eax, dword [ebx]
call fcn.00426f28
jmp 0x4d7e71
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
call fcn.00427098
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xcc]
sub edx, eax
sub edx, 0x14
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
sub edx, dword [eax + 0x3c]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc8]
neg ecx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebx]
call fcn.00426f28
jmp 0x4d7e71
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
call fcn.00427098
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xcc]
sub edx, eax
shr edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc8]
neg ecx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebx]
call fcn.00426f28
inc dword [ebp - 0x20]
dec dword [ebp - 0x54]
jne 0x4d7d9d
cmp dword [ebp - 0x30], 0
setne al
and al, byte [ebp - 0x31]
je 0x4d7fd9
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov eax, dword [eax + 0x34]
neg eax
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xcc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc4]
xor edx, edx
call fcn.00418918
push 1
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_LPtoDP
push 1
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_LPtoDP
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_GetMapMode
mov edi, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
call fcn.00426064
mov dword [ebp - 0x38], eax
push 1
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_SetMapMode
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov eax, dword [eax + 0x18]
call fcn.00426064
mov edx, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
call fcn.00426080
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.004266e8
mov eax, dword [esi]
mov eax, dword [eax + 0x8d4]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 1
push 0
push 0
push 1
push 0
push 1
push 0
push 1
mov eax, dword [ebp + 8]
push dword [eax - 0x4c]
push dword [eax - 0x50]
mov eax, dword [esi]
mov eax, dword [eax + 0x8cc]
push eax
push 0x1fffffff
push 0x1fffffff
push 0x808080
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x74]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xa8c]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xa84]
push eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x64]
mov edx, dword [ebp - 0x30]
call fcn.004bdbf4
push edi
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_SetMapMode
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x38]
call fcn.00426080
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.004266e8
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov eax, edi
call fcn.00426064
mov edx, eax
mov eax, dword [esi]
call fcn.004d5260
mov edx, eax
mov eax, edi
call fcn.00425fc8
cmp dword [ebp - 0x14], 0
je 0x4d804d
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xd0]
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd4]
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x9a]
add ecx, eax
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc4]
mov eax, dword [ebx]
call fcn.00426f28
cmp dword [ebp - 0x18], 0
je 0x4d80a8
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebx]
mov edx, dword [ebp - 0x18]
call fcn.00427098
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xcc]
sub edx, eax
sub edx, 0x14
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
sub edx, dword [eax + 0x3c]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xd0]
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd4]
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x9a]
add ecx, eax
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd8]
mov eax, dword [ebx]
call fcn.00426f28
cmp dword [ebp - 0x1c], 0
je 0x4d80f7
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov edx, dword [ebp - 0x1c]
call fcn.00427098
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xcc]
sub edx, eax
shr edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xd0]
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd4]
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x9a]
add ecx, eax
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd8]
mov eax, dword [ebx]
call fcn.00426f28
mov eax, dword [esi]
mov edi, dword [eax + 0x580]
mov al, byte [edi + 0x10]
add al, 0xfc
sub al, 3
jae 0x4d8289
mov eax, dword [edi + 0x28]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4d8289
cmp dword [ebp - 0x30], 0
jne 0x4d8289
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 2
jl 0x4d8289
inc eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x20], 2
mov eax, dword [ebx]
mov edx, 0x4d847c
call fcn.004270b4
add dword [ebp - 0x24], eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x20]
dec edx
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov eax, dword [eax + 0x28]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov al, byte [eax + 0x10]
sub al, 4
je 0x4d8194
dec al
je 0x4d81d7
dec al
je 0x4d8231
jmp 0x4d827d
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xd0]
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd4]
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x9a]
add ecx, eax
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd8]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc4]
mov eax, dword [ebx]
call fcn.00426f28
jmp 0x4d827d
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
call fcn.00427098
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xcc]
sub edx, eax
sub edx, 0x14
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
sub edx, dword [eax + 0x3c]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xd0]
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd4]
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x9a]
add ecx, eax
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd8]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebx]
call fcn.00426f28
jmp 0x4d827d
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
call fcn.00427098
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xcc]
sub edx, eax
shr edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xd0]
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd4]
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0x9a]
add ecx, eax
mov eax, dword [ebp + 8]
add ecx, dword [eax - 0xd8]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebx]
call fcn.00426f28
inc dword [ebp - 0x20]
dec dword [ebp - 0x54]
jne 0x4d814e
cmp dword [ebp - 0x30], 0
je 0x4d83f7
cmp byte [ebp - 0x31], 0
jne 0x4d83f7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xd0]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xd0]
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
add edx, dword [eax + 0x30]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xcc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc4]
call fcn.00418918
push 1
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_LPtoDP
push 1
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_LPtoDP
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_GetMapMode
mov edi, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
call fcn.00426064
mov dword [ebp - 0x38], eax
push 1
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_SetMapMode
mov eax, dword [esi]
mov eax, dword [eax + 0x580]
mov eax, dword [eax + 0x18]
call fcn.00426064
mov edx, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
call fcn.00426080
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.004266e8
mov eax, dword [esi]
mov eax, dword [eax + 0x8d4]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 1
push 0
push 0
push 1
push 0
push 1
push 0
push 1
mov eax, dword [ebp + 8]
push dword [eax - 0x4c]
push dword [eax - 0x50]
mov eax, dword [esi]
mov eax, dword [eax + 0x8cc]
push eax
push 0x1fffffff
push 0x1fffffff
push 0x808080
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xa8c]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xa84]
push eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x64]
mov edx, dword [ebp - 0x30]
call fcn.004bdbf4
push edi
mov eax, dword [ebx]
call fcn.0042725c
push eax
call sub.gdi32.dll_SetMapMode
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x38]
call fcn.00426080
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.004266e8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x54]
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d844e
lea eax, [ebp - 0xd8]
mov edx, 0x19
call fcn.00404ed4
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00404ed4
lea eax, [ebp - 0x30]
call fcn.00404eb0
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404ed4
ret