Function at 0x47abc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor eax, eax
mov ecx, 0xf
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x48]
push ebx
sub esp, 0x7c
rep stosd dword es:[edi], eax
mov dword [esp], 0
call dword [sym.imp.gdi32.dll_CreateCompatibleDC]
lea edx, [ebp - 0x60]
mov byte [ebp - 0x31], 1
sub esp, 4
mov ebx, eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x2c], 0x656d6954
mov dword [ebp - 0x28], 0x654e2073
mov dword [ebp - 0x24], 0x6f522077
mov dword [ebp - 0x20], 0x6e616d
mov dword [ebp - 0x48], 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.gdiplus.dll_GdipCreateFontFromLogfontA
sub esp, 0xc
cmp eax, 0x10
je 0x47b038
cmp eax, 0xa
je 0x47b038
lea eax, [ebp - 0x5c]
lea edi, [ebp - 0x4c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
lea esi, [ebp - 0x64]
mov dword [esp], eax
call sub.gdiplus.dll_GdipCloneFont
xor edx, edx
sub esp, 8
mov ecx, eax
mov eax, 0xbf3
call fcn.00471450
mov dword [esp + 0x14], edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0x4ad148
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x4ada00
mov dword [esp + 4], 4
call sub.gdiplus.dll_GdipRecordMetafile
xor edx, edx
mov ecx, eax
sub esp, 0x18
mov eax, 0xbf7
call fcn.00471450
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_DeleteDC]
sub esp, 4
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sub.gdiplus.dll_GdipGetImageGraphicsContext
sub esp, 8
mov ebx, eax
call fcn.0049bde0
mov dword [eax], 0x4acab6
mov dword [eax + 4], 0xbfd
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4acc08
call fcn.00471350
lea eax, [ebp - 0x58]
mov dword [esp], 0xff0000ff
mov dword [esp + 4], eax
call sub.gdiplus.dll_GdipCreateSolidFill
sub esp, 8
mov ebx, eax
call fcn.0049bde0
mov dword [eax], 0x4acab6
mov dword [eax + 4], 0xc00
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4acc08
call fcn.00471350
lea eax, [ebp - 0x54]
mov dword [esp + 8], 0xffff0000
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xff00ff00
mov dword [esp], 0
call sub.gdiplus.dll_GdipCreateHatchBrush
sub esp, 0x10
mov ebx, eax
call fcn.0049bde0
mov dword [eax], 0x4acab6
mov dword [eax + 4], 0xc04
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4acc08
call fcn.00471350
lea eax, [ebp - 0x50]
mov dword [esp], eax
call sub.gdiplus.dll_GdipCreateMatrix
xor edx, edx
sub esp, 4
mov ecx, eax
mov eax, 0xc07
call fcn.00471450
mov eax, dword [ebp - 0x50]
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0x4ad9e0
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4ad1e0
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sub.gdiplus.dll_GdipDrawDriverString
sub esp, 0x20
mov ebx, eax
call fcn.0049bde0
mov dword [eax], 0x4acab6
mov dword [eax + 4], 0xc0b
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4acc08
call fcn.00471350
fldz
fst dword [esp + 0x18]
fst dword [esp + 0x14]
fld dword [0x4afc10]
fst dword [esp + 0x10]
fxch st(1)
fst dword [esp + 0xc]
fstp dword [esp + 8]
fstp dword [esp + 4]
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call sub.gdiplus.dll_GdipSetMatrixElements
xor edx, edx
sub esp, 0x1c
mov ecx, eax
mov eax, 0xc0e
call fcn.00471450
mov eax, dword [ebp - 0x50]
mov dword [esp + 0x18], 5
mov dword [esp + 0x14], 0x4ad9c0
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp + 8], 5
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.Test
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sub.gdiplus.dll_GdipDrawDriverString
sub esp, 0x20
mov ebx, eax
call fcn.0049bde0
mov dword [eax], 0x4acab6
mov dword [eax + 4], 0xc12
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4acc08
call fcn.00471350
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sub.gdiplus.dll_GdipDeleteGraphics
mov ecx, str.drawdriverstring_metafile
mov edx, 0x4ae4c0
mov dword [ebp - 0x64], 0
sub esp, 4
mov dword [esp + 4], 0x4ada00
mov dword [esp], 0x4ad9a8
mov eax, dword [ebp - 0x4c]
call fcn.00472b30
mov edx, str.drawdriverstring.emf
mov eax, edi
call fcn.00473260
lea eax, [ebp - 0x68]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0x26200a
mov dword [esp + 8], 0
mov dword [esp + 4], 0x64
mov dword [esp], 0x64
call sub.gdiplus.dll_GdipCreateBitmapFromScan0
xor edx, edx
sub esp, 0x18
mov ecx, eax
mov eax, 0xc1c
call fcn.00471450
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.gdiplus.dll_GdipGetImageGraphicsContext
xor edx, edx
sub esp, 8
mov ecx, eax
mov eax, 0xc1f
call fcn.00471450
mov dword [esp + 8], 0x4ada00
mov ecx, 0x4ae4c0
mov dword [esp + 4], 0x4ad9a8
mov dword [esp], str.drawdriverstring_playback
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x4c]
call fcn.004729b0
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call sub.gdiplus.dll_GdipDeleteMatrix
mov eax, dword [ebp - 0x64]
sub esp, 4
mov dword [esp], eax
call sub.gdiplus.dll_GdipDeleteGraphics
mov eax, dword [ebp - 0x58]
sub esp, 4
mov dword [esp], eax
call sub.gdiplus.dll_GdipDeleteBrush
mov eax, dword [ebp - 0x54]
sub esp, 4
mov dword [esp], eax
call sub.gdiplus.dll_GdipDeleteBrush
mov eax, dword [ebp - 0x60]
sub esp, 4
mov dword [esp], eax
call sub.gdiplus.dll_GdipDeleteFont
mov eax, dword [ebp - 0x5c]
sub esp, 4
mov dword [esp], eax
call sub.gdiplus.dll_GdipDeleteFont
mov eax, dword [ebp - 0x68]
sub esp, 4
mov dword [esp], eax
call sub.gdiplus.dll_GdipDisposeImage
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call sub.gdiplus.dll_GdipDisposeImage
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_DeleteDC]
mov eax, 0xbee
sub esp, 4
call fcn.00470b20
mov dword [esp], str.Times_New_Roman_not_installed._n
call fcn.00470db0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret