Function at 0x4cbcb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f2450
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.00440e60
mov dword [esp + 0x1c], 0x4f5178
mov eax, dword [esp + 0x48]
mov dword [esp + 0x3c], 0
xor eax, 0xffffff
push eax
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::Attach
mov edi, dword [esp + 0x44]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call sub.MFC42.DLL_CDC::SelectObject
mov edx, dword [edi]
push 5
mov ecx, edi
mov dword [esp + 0x18], eax
call dword [edx + 0x2c]
push 7
mov ecx, edi
call sub.MFC42.DLL_CDC::SetROP2
mov edi, dword [esi + 0x254]
mov edx, dword [esi + 0x250]
mov ecx, dword [esi + 0x258]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x24c]
mov ebp, edx
sub edi, eax
mov eax, dword [esi + 0x258]
add eax, ebp
sub ecx, edx
cdq
mov ebp, dword [esi + 0x24c]
sub eax, edx
sar eax, 1
mov dword [esp + 0x48], eax
mov eax, dword [esi + 0x254]
add eax, ebp
mov ebx, dword [esp + 0x4c]
cdq
mov ebp, dword [esp + 0x50]
sub eax, edx
mov edx, dword [esi + 0x25c]
sar eax, 1
dec edx
cmp edx, 5
ja case.default.0x4cbd89
jmp dword [edx*4 + 0x4cbfd4]
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
lea eax, [ecx + ebp]
mov dword [esp + 0x48], eax
mov eax, edi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
sub edx, ecx
mov ecx, ebx
lea edi, [eax + ebx]
sub ecx, eax
mov eax, dword [esp + 0x48]
push eax
push edi
push edx
push ecx
jmp 0x4cbe69
lea eax, [ecx + ebp]
lea ecx, [edi + ebx]
push eax
push ecx
push ebp
lea edx, [esp + 0x30]
push ebx
push edx
jmp 0x4cbe6e
mov eax, ebp
lea edx, [edi + ebx]
sub eax, ecx
push ebp
push edx
push eax
lea eax, [esp + 0x30]
push ebx
push eax
jmp 0x4cbe6e
add ecx, ebp
mov eax, ebx
push ecx
sub eax, edi
push ebx
push ebp
push eax
jmp 0x4cbe69
mov eax, ebp
push ebp
sub eax, ecx
mov ecx, ebx
sub ecx, edi
push ebx
push eax
lea edx, [esp + 0x30]
push ecx
push edx
jmp 0x4cbe6e
mov edx, dword [esi + 0x260]
sub edx, eax
mov eax, dword [esi + 0x264]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x48]
sub eax, edx
mov dword [esp + 0x48], eax
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x48]
sar eax, 1
mov dword [esp + 0x10], eax
mov ecx, eax
mov eax, edi
sub ecx, edx
mov edi, dword [esp + 0x4c]
add ecx, ebp
cdq
sub eax, edx
push ecx
sar eax, 1
mov edx, eax
sub edx, edi
mov edi, ebp
sub edi, dword [esp + 0x14]
add edx, ebx
push edx
sub edi, dword [esp + 0x50]
mov dword [esp + 0x50], edi
mov edi, ebx
sub edi, eax
mov eax, dword [esp + 0x54]
sub edi, eax
mov eax, dword [esp + 0x50]
push eax
push edi
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esi + 0x27c]
test eax, eax
jne 0x4cbefd
mov edx, dword [esi + 0x270]
mov eax, dword [esi + 0x268]
sub edx, eax
je 0x4cbeca
mov eax, dword [esi + 0x274]
mov ecx, dword [esi + 0x26c]
sub eax, ecx
je 0x4cbeca
mov ecx, dword [esi + 0x274]
mov edx, dword [esi + 0x270]
mov edi, dword [esp + 0x44]
mov eax, dword [esi + 0x26c]
push ecx
mov ecx, dword [esi + 0x268]
push edx
mov edx, dword [edi + 4]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x4cbf01
mov ecx, dword [esi + 0x26c]
mov eax, dword [esi + 0x268]
mov edi, dword [esp + 0x44]
push ecx
push eax
lea eax, [esp + 0x54]
push eax
mov ecx, edi
call sub.MFC42.DLL_CDC::MoveTo
mov ecx, dword [esi + 0x274]
mov eax, dword [esi + 0x270]
push ecx
push eax
mov ecx, edi
call sub.MFC42.DLL_CDC::LineTo
mov edi, dword [esp + 0x44]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
sub ecx, eax
je 0x4cbf31
mov ecx, dword [esp + 0x30]
mov edx, ecx
sub edx, dword [esp + 0x28]
je 0x4cbf31
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
push ecx
push edx
push eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x4cbf54
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x4c]
push ecx
push eax
push edx
mov ecx, edi
call sub.MFC42.DLL_CDC::MoveTo
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
mov ecx, edi
call sub.MFC42.DLL_CDC::LineTo
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea edx, [esi + 0x268]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x27c], 0
mov dword [edx], eax
mov eax, dword [esp + 0x2c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x14]
push edx
mov ecx, edi
call sub.MFC42.DLL_CDC::SelectObject
mov eax, dword [esp + 0x18]
mov ecx, edi
push eax
call sub.MFC42.DLL_CDC::SetROP2
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x1c], 0x4f4f14
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 0x10