Function at 0x47b8f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [esp + 0x40]
mov eax, 1
mov dword [esp + 0xc], 0
mov ecx, dword [esi + 0x1c]
mov dword [esp + 4], eax
test ecx, ecx
je 0x47c2c3
cmp dword [esi], 0
jne 0x47b927
mov eax, dword [esi + 4]
test eax, eax
jne 0x47b927
xor eax, eax
pop esi
add esp, 0x30
ret
push ebx
push ebp
mov ebp, dword [esp + 0x40]
lea eax, [esp + 0x2c]
push edi
push eax
push esi
push ebp
call fcn.0047ca20
mov edi, dword [esp + 0x54]
add esp, 0xc
push edi
call dword [sym.imp.GDI32.dll_SaveDC]
push edi
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esp + 0x48], ebx
je 0x47b9b5
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x47b9b5
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x47b9b5
push eax
call dword [sym.imp.GDI32.dll_UnrealizeObject]
mov ecx, dword [ebp + 0x24]
push 0
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectPalette]
push edi
mov dword [ebp + 0x20], 1
call dword [sym.imp.GDI32.dll_RealizePalette]
mov edx, dword [ebp + 0x24]
mov dword [ebp + 0x20], 0
push edx
call dword [sym.imp.GDI32.dll_UnrealizeObject]
mov eax, dword [ebp + 0x24]
push 0
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push ebx
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [esi + 4]
test eax, eax
je 0x47ba37
push 8
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.GDI32.dll_SetMapMode]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push 0
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov eax, dword [esi + 0x14]
push 0
cdq
mov ecx, eax
mov eax, dword [esi + 0xc]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ecx, eax
mov eax, dword [esi + 0x10]
cdq
push ecx
mov ecx, eax
mov eax, dword [esi + 8]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ecx, eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push 0
push edx
push eax
push edi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push 0
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x47ba41
mov eax, dword [esi]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x18]
push ecx
push esi
call fcn.0047c940
add esp, 8
test eax, eax
jne 0x47ba61
lea edx, [esp + 0x18]
push edx
push ebp
call fcn.0047c9a0
add esp, 8
cmp dword [esp + 0x18], 3
jne 0x47bb70
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47bb70
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x47bb70
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x30]
push eax
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov ebx, eax
mov eax, dword [esp + 0x3c]
sub eax, edx
push eax
mov eax, dword [esp + 0x34]
sub ecx, eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, eax
push ebp
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x44]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea ecx, [esp + 0x30]
push eax
push ecx
push ebx
mov dword [esp + 0x58], eax
call dword [sym.imp.USER32.dll_FillRect]
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x48]
mov edx, dword [esi + 0x28]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esi + 0x24]
sub eax, edx
push edx
cdq
sub eax, edx
push ecx
sar eax, 1
push eax
mov eax, dword [esp + 0x54]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x48]
push ebp
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
sub eax, ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x24], eax
sub ecx, edx
mov edx, dword [esp + 0x48]
push edx
mov dword [esi + 0x28], ecx
mov dword [esi], ebp
mov dword [esi + 0x18], 1
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ebp, dword [esp + 0x44]
mov dword [esp + 0x48], ebx
test dword [esi + 0x34], 0x100000
je 0x47bba7
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x24]
push 0x186a0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [esi + 0x44]
mov ebx, eax
mov eax, dword [esi + 0x28]
push 0x186a0
push edx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x47bbb1
mov ebx, dword [esi + 0x24]
mov eax, dword [esi + 0x28]
mov dword [esp + 0x1c], ebx
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x14], eax
cmp ebx, ecx
mov dword [esp + 0x24], ecx
jne 0x47bbcc
mov edx, dword [esi + 0x28]
mov byte [esp + 0x4c], 1
cmp eax, edx
je 0x47bbd1
mov byte [esp + 0x4c], 0
mov edx, dword [esp + 0x18]
lea eax, [edx - 1]
cmp eax, 0xa
ja case.0x47bbe1.10
jmp dword [eax*4 + 0x47c914]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x14]
push 0
push 1
push 1
push eax
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
push ebx
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x14]
mov ebx, eax
push ecx
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov al, byte [esp + 0x4c]
push 0xcc0020
test al, al
je 0x47bc64
mov edx, dword [esp + 0x4c]
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
push 0
push 0
push edx
push eax
push ecx
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47bc86
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x1c]
push eax
push 0
push 0
push ecx
push edx
push ebp
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x47bcaa
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x47bcaa
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x47bcaa
mov eax, dword [esi + 0x30]
or eax, 0x2000000
push eax
jmp 0x47bcae
mov ecx, dword [esi + 0x30]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov al, byte [esp + 0x4c]
push 0xcc0020
test al, al
je 0x47bce0
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x14]
push 0
push 0
push ebx
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47bcfc
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
push ebp
push 0
push 0
push ebx
push eax
push ebp
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xffffff
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov al, byte [esp + 0x4c]
push 0x8800c6
test al, al
je 0x47bd3c
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push 0
push 0
push eax
push ecx
push edx
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47bd58
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ebp
push 0
push 0
push ecx
push eax
push ebp
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0xffffff
push edi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov al, byte [esp + 0x4c]
push 0x8800c6
test al, al
je 0x47bdbf
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
mov ebp, dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
push edi
call ebp
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x34]
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
push edi
call ebp
jmp 0x47be00
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push esi
push ebp
push 0
push 0
push edx
push esi
push ebp
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push 0xee0086
push esi
push ebp
push 0
push 0
push ebx
push esi
push ebp
push edx
push eax
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ecx
call esi
push ebx
call esi
mov edx, dword [esp + 0x24]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
mov ecx, dword [esp + 0x44]
mov dword [ecx + 0x10], 0xff00ff
jmp 0x47c2a4
mov eax, dword [ebp + 4]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x38]
xor ebp, ebp
cdq
idiv dword [esi + 0x24]
inc eax
test eax, eax
jle case.0x47bbe1.10
mov eax, dword [esp + 0x3c]
mov ecx, dword [esi + 0x28]
cdq
idiv ecx
xor ebx, ebx
inc eax
test eax, eax
jle 0x47bebe
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47be8f
mov edx, dword [esp + 0x48]
mov eax, dword [esi + 0x24]
push 0xcc0020
push 0
push 0
push edx
push ecx
push eax
imul ecx, ebx
imul eax, ebp
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47beae
mov eax, dword [esi + 0x24]
imul ecx, ebx
imul eax, ebp
push 0
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov ecx, dword [esi + 4]
push ecx
push edi
call dword [sym.imp.GDI32.dll_PlayMetaFile]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esi + 0x28]
cdq
idiv ecx
inc ebx
inc eax
cmp ebx, eax
jl 0x47be63
mov eax, dword [esp + 0x38]
inc ebp
cdq
idiv dword [esi + 0x24]
inc eax
cmp ebp, eax
jl 0x47be52
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47c299
mov ecx, dword [esi + 0x24]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jne 0x47c8d3
mov eax, dword [esi + 0x28]
mov edx, dword [esp + 0x14]
cmp edx, eax
jne 0x47c8d3
mov edx, dword [esp + 0x48]
push 0xcc0020
push 0
push 0
push edx
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47c2a4
mov eax, dword [ebp + 4]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47bf63
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x48]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push 0
push 0
push eax
push ecx
push edx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x47c2a4
push 0
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push 0
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov edx, dword [esi + 4]
push edx
jmp 0x47c29d
mov ecx, dword [ebp + 4]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47bfc9
mov edx, dword [esp + 0x48]
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
push 0xcc0020
push 0
push 0
push edx
push eax
push ecx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47c2a4
push 0
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push 0
push edx
push eax
push edi
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov ecx, dword [esi + 4]
push ecx
jmp 0x47c29d
mov eax, dword [esi + 0x18]
test eax, eax
jne case.0x47bbe1.10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47c299
mov ebp, 1
push edi
mov dword [esi + 0x18], ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 8
mov ebx, eax
push 8
push edi
mov dword [esp + 0x58], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x42
push 8
push 8
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00480e76
add esp, 4
jmp 0x47c05b
mov ebx, dword [esp + 0x4c]
mov eax, 0x66666667
imul ebp
sar edx, 1
mov eax, edx
shr eax, 0x1f
lea edx, [edx + eax + 3]
test edx, edx
jle 0x47c0b7
mov dword [esp + 0x44], edx
call fcn.00480e83
and eax, 0x8000003f
jns 0x47c086
dec eax
or eax, 0xffffffc0
inc eax
mov ecx, eax
push 0xffffff
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x47c09a
dec ecx
or ecx, 0xfffffff8
inc ecx
cdq
and edx, 7
push ecx
add eax, edx
sar eax, 3
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [esp + 0x44]
dec eax
mov dword [esp + 0x44], eax
jne 0x47c075
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x48]
push 0xca0749
push 0
push 0
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x44]
push edx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
inc ebp
cmp ebp, 0x14
jl 0x47c057
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x47c3cb
mov eax, dword [esi + 0x18]
test eax, eax
jne case.0x47bbe1.10
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, 1
mov dword [esi + 0x18], eax
mov dword [esp + 0x44], eax
call ebx
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x24], eax
mov eax, 0x66666667
mov ebx, dword [esi + 0x24]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov ebp, edx
cdq
imul ebp, dword [esp + 0x44]
sub eax, edx
mov ecx, eax
mov eax, 0x66666667
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x4c], edx
cdq
sar ecx, 1
sub eax, edx
lea edx, [ecx + ebp]
sub ecx, ebp
add edx, ebx
mov ebp, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x50]
sar eax, 1
add ecx, ebp
lea ebx, [eax + edx]
mov edx, dword [esp + 0x34]
add ebx, edx
push ebx
push ecx
sub eax, dword [esp + 0x58]
add eax, edx
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov ebp, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47c205
mov eax, dword [esp + 0x48]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47c210
mov edx, dword [esi + 4]
push edx
push edi
call dword [sym.imp.GDI32.dll_PlayMetaFile]
push ebp
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
test ebx, ebx
je 0x47c223
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ebp, dword [esp + 0x24]
sub eax, ebp
cmp eax, 0x19
jae 0x47c23f
call ebx
sub eax, ebp
cmp eax, 0x19
jb 0x47c236
mov eax, dword [esp + 0x44]
inc eax
cmp eax, 0x14
mov dword [esp + 0x44], eax
jl 0x47c14c
push 0
push edi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47c28e
mov eax, dword [esp + 0x48]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
jmp case.0x47bbe1.10
mov edx, dword [esi + 4]
push edx
push edi
call dword [sym.imp.GDI32.dll_PlayMetaFile]
mov eax, dword [esi + 4]
push eax
push edi
call dword [sym.imp.GDI32.dll_PlayMetaFile]
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [esp + 0x2c]
push edx
push edi
call dword [sym.imp.GDI32.dll_RestoreDC]
pop edi
pop ebp
mov eax, 1
pop ebx
pop esi
add esp, 0x30
ret
mov eax, dword [esi + 0x18]
test eax, eax
jne case.0x47bbe1.10
mov eax, 1
mov dword [esi + 0x18], eax
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esi + 0x24]
mov ebp, eax
mov eax, 0x66666667
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
mov ecx, edx
imul ecx, dword [esp + 0x44]
cdq
sub eax, edx
mov edx, dword [esp + 0x34]
mov ebx, edx
add ebx, dword [esi + 0x28]
sar eax, 1
push ebx
lea ebx, [eax + ecx]
sub eax, ecx
add ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x34]
add eax, ecx
push ebx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47c36a
mov ecx, dword [esp + 0x48]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
push 0xcc0020
push 0
push 0
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47c375
mov eax, dword [esi + 4]
push eax
push edi
call dword [sym.imp.GDI32.dll_PlayMetaFile]
mov ecx, dword [esp + 0x4c]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
test ebx, ebx
je 0x47c38c
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, ebp
cmp eax, 0x19
jae 0x47c3a4
call ebx
sub eax, ebp
cmp eax, 0x19
jb 0x47c39b
mov eax, dword [esp + 0x44]
inc eax
cmp eax, 0x14
mov dword [esp + 0x44], eax
jl 0x47c2df
push 0
push edi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47bfe9
mov edx, dword [esp + 0x48]
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x47c2a4
mov eax, dword [esi + 0x18]
test eax, eax
jne case.0x47bbe1.10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47c299
mov eax, ecx
mov dword [esi + 0x18], 1
cdq
and edx, 3
add eax, edx
mov edx, ecx
sar eax, 2
and edx, 0x80000003
jns 0x47c42f
dec edx
or edx, 0xfffffffc
inc edx
je 0x47c454
mov ecx, eax
and ecx, 0x80000001
jns 0x47c440
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x47c44b
lea ebp, [eax*4]
jmp 0x47c468
lea ebp, [eax*4 - 4]
jmp 0x47c468
and eax, 0x80000001
jns 0x47c460
dec eax
or eax, 0xfffffffe
inc eax
lea ebp, [ecx - 8]
jne 0x47c468
lea ebp, [ecx - 4]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xf
test ebp, ebp
mov dword [esp + 0x44], eax
jg 0x47c485
cmp ebx, dword [esp + 0x24]
jge 0x47c2a4
mov edx, dword [esp + 0x48]
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0x34]
push 0xcc0020
push 0
push ebx
push edx
mov edx, dword [esp + 0x40]
push eax
push 4
lea eax, [ebx + edx]
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x47c2a4
mov ecx, dword [esp + 0x48]
mov edx, dword [esi + 0x28]
mov eax, dword [esp + 0x34]
push 0xcc0020
push 0
push ebp
push ecx
mov ecx, dword [esp + 0x40]
push edx
push 4
lea edx, [ecx + ebp]
push eax
push edx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x47c2a4
add ebx, 8
sub ebp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x44]
jae 0x47c501
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x44]
jb 0x47c4f5
mov eax, dword [esp + 0x44]
jmp 0x47c470
mov eax, dword [esi + 0x18]
test eax, eax
jne case.0x47bbe1.10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47c299
mov ebx, dword [esi + 0x28]
mov dword [esi + 0x18], 1
mov eax, ebx
mov ecx, ebx
cdq
sub eax, edx
mov dword [esp + 0x4c], ebx
sar eax, 1
and ecx, 0x80000001
jns 0x47c545
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x47c563
mov edx, eax
and edx, 0x80000001
jns 0x47c556
dec edx
or edx, 0xfffffffe
inc edx
je 0x47c55d
lea ebx, [eax + eax]
jmp 0x47c579
lea ebx, [eax + eax - 2]
jmp 0x47c579
and eax, 0x80000001
jns 0x47c56f
dec eax
or eax, 0xfffffffe
inc eax
je 0x47c576
add ebx, 0xfffffffc
jmp 0x47c579
add ebx, 0xfffffffe
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xf
test ebx, ebx
mov dword [esp + 0x44], eax
jg 0x47c596
cmp ebp, dword [esp + 0x4c]
jge 0x47c2a4
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x34]
mov ecx, dword [esi + 0x24]
push 0xcc0020
push ebp
push 0
push eax
push 2
push ecx
mov ecx, dword [esp + 0x48]
lea eax, [edx + ebp]
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x47c2a4
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x34]
mov eax, dword [esi + 0x24]
push 0xcc0020
push ebx
push 0
push edx
push 2
push eax
mov eax, dword [esp + 0x48]
lea edx, [ebx + ecx]
push edx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x47c2a4
add ebp, 4
sub ebx, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x44]
jae 0x47c612
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x44]
jb 0x47c606
mov eax, dword [esp + 0x44]
jmp 0x47c581
mov eax, dword [esi + 0x18]
test eax, eax
jne case.0x47bbe1.10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47c299
mov ebx, dword [esi + 0x28]
xor ebp, ebp
cmp ecx, ebx
mov dword [esi + 0x18], 1
jg 0x47c644
mov ebx, ecx
mov ecx, ebx
and ecx, 0x80000001
jns 0x47c653
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x47c659
sar ebx, 1
jmp 0x47c65c
sar ebx, 1
inc ebx
xor eax, eax
test ebx, ebx
jl 0x47c669
lea eax, [ebx + 2]
shr eax, 1
shl eax, 1
lea edx, [ebx + 2]
cmp eax, edx
jne 0x47c671
inc ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x28]
add eax, 0xf
cmp ebp, ecx
mov dword [esp + 0x44], eax
jg case.0x47bbe1.10
xor eax, eax
cmp ebp, ecx
jg 0x47c789
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x28]
lea eax, [ebp + ebp]
push 0xcc0020
sub ecx, eax
sub edx, eax
mov eax, dword [esp + 0x4c]
push ebp
push ebp
push eax
mov eax, dword [esp + 0x40]
push 1
mov dword [esp + 0x38], ecx
push ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x38], edx
lea edx, [ecx + ebp]
lea ecx, [eax + ebp]
push edx
push ecx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je case.0x47bbe1.10
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
push 0xcc0020
push ebp
push ebp
push edx
push eax
mov eax, dword [esp + 0x44]
lea edx, [ecx + ebp]
push 1
push edx
lea ecx, [eax + ebp]
push ecx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je case.0x47bbe1.10
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x48]
push 0xcc0020
lea eax, [edx + ebp]
mov edx, dword [esp + 0x28]
push eax
push ebp
push ecx
mov ecx, dword [esp + 0x44]
inc edx
push 1
push edx
mov edx, dword [esp + 0x48]
add eax, ecx
push eax
lea eax, [edx + ebp]
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je case.0x47bbe1.10
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x48]
push 0xcc0020
push ebp
lea eax, [ecx + ebp]
mov ecx, dword [esp + 0x28]
push eax
push edx
mov edx, dword [esp + 0x44]
inc ecx
push ecx
push 1
lea ecx, [edx + ebp]
mov edx, dword [esp + 0x48]
add eax, edx
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je case.0x47bbe1.10
mov eax, 1
test ebx, ebx
jl 0x47c899
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jl 0x47c899
mov eax, dword [esi + 0x24]
mov edx, dword [esp + 0x4c]
lea ecx, [ebx + ebx]
add edx, edx
sub eax, ecx
mov ecx, dword [esi + 0x28]
sub ecx, edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x4c]
push 0xcc0020
push ecx
push ebx
push edx
push 1
mov dword [esp + 0x38], eax
push eax
mov eax, dword [esp + 0x4c]
add ecx, eax
push ecx
mov ecx, dword [esp + 0x4c]
lea edx, [ebx + ecx]
push edx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je case.0x47bbe1.10
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x20]
push 0xcc0020
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
add eax, ecx
push 1
push eax
lea eax, [ebx + edx]
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je case.0x47bbe1.10
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x4c]
push 0xcc0020
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x28]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x44]
inc edx
push 1
push edx
mov edx, dword [esp + 0x48]
add eax, ecx
push eax
lea eax, [ebx + edx]
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je case.0x47bbe1.10
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x48]
push 0xcc0020
lea eax, [ecx + ebx]
mov ecx, dword [esp + 0x50]
push ecx
push eax
push edx
mov edx, dword [esp + 0x30]
inc edx
push edx
mov edx, dword [esp + 0x48]
add ecx, edx
push 1
push ecx
mov ecx, dword [esp + 0x4c]
add eax, ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je case.0x47bbe1.10
jmp 0x47c8a1
test eax, eax
je case.0x47bbe1.10
mov edx, dword [esp + 0x4c]
add ebp, 2
sub edx, 2
sub ebx, 2
mov dword [esp + 0x4c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x44]
jae 0x47c8ca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x44]
jb 0x47c8be
mov eax, dword [esp + 0x44]
jmp 0x47c67f
push 3
push edi
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x48]
push 0xcc0020
push edx
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
push 0
push 0
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push eax
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x47c2a4