Function at 0x10049170
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072dd5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
push esi
push edi
mov dword [ebp - 0x88], 0xe0a8eac8
mov dword [ebp - 0x88], 0x17
jmp 0x100491b3
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xfffffffd
jge 0x100491ea
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x100491e8
push 0
push 0xf7b
push 0xa9f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x100491a6
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x10049205
push 0
push 0x7c8
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x218], 0xda11525
mov dword [ebp - 0x1f8], 0xffffffff
push 2
lea ecx, [ebp - 0x170]
call fcn.100139c6
and dword [ebp - 4], 0
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x78], 0
jmp 0x10049241
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1004925d
push dword [ebp - 0x78]
lea ecx, [ebp - 0x170]
call fcn.10013a64
mov dword [eax], 0x342eb90d
jmp 0x1004923a
mov dword [ebp - 0x30], 1
jmp 0x1004926d
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10049453
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x60], 0
jmp 0x10049291
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x100492a7
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x160], 0xac453072
jmp 0x1004928a
push dword [ebp - 0x30]
lea ecx, [ebp - 0x170]
call fcn.10013a64
cmp dword [eax], 0
je 0x100492bf
jmp 0x10049453
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x160], 0
jmp 0x100492ed
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x160]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x160], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x160], 1
jg 0x1004944e
mov dword [ebp - 0x104], 0x2ba7b7e8
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x160]
lea ecx, [ebp - 0x170]
call fcn.10013a64
cmp dword [eax], 0
je 0x10049401
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x160]
lea ecx, [ebp - 0x170]
call fcn.10013a64
cmp dword [eax], 0xfffffffe
je 0x10049355
mov dword [ebp - 0x150], 1
jmp 0x1004935c
and dword [ebp - 0x150], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x170]
call fcn.10013a64
mov dword [ebp - 0x104], 0xfff9
imul eax, dword [ebp - 0x104], 0x9855
cmp eax, dword [ebp - 0x30]
jne 0x1004938f
mov dword [ebp - 0xb4], 1
jmp 0x10049396
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0xb4]
jne 0x100493b0
mov dword [ebp - 0x148], 1
jmp 0x100493b7
and dword [ebp - 0x148], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x160]
lea ecx, [ebp - 0x170]
call fcn.10013a64
mov eax, dword [eax]
cmp eax, dword [ebp - 0x148]
jg 0x100493e5
mov dword [ebp - 0x10c], 1
jmp 0x100493ec
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 1
jg 0x10049401
mov dword [ebp - 0xbc], 1
jmp 0x10049408
and dword [ebp - 0xbc], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x160]
lea ecx, [ebp - 0x170]
call fcn.10013a64
mov ecx, dword [ebp - 0xbc]
cmp ecx, dword [eax]
jne 0x10049436
mov dword [ebp - 0x14c], 1
jmp 0x1004943d
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1a0], eax
jmp 0x100492d2
jmp 0x10049266
mov byte [ebp - 0x24], 0
movzx eax, byte [ebp - 0x24]
test eax, eax
je 0x1004947c
push 0
push 0
push 0
push 0
push 0x1a1c
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.10013a48
mov dword [ebp - 0x208], 0x3c69aed2
push 1
lea ecx, [ebp - 0x1f4]
call fcn.100139c6
mov dword [ebp - 4], 1
mov dword [ebp - 0x1a8], 0xfffb
mov dword [ebp - 0x4c], 0xcea5d6c0
mov dword [ebp - 0x174], 0xfffffffa
mov dword [ebp - 0x4c], 0xfffffffd
jmp 0x100494d4
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10049505
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x10049503
push 0
push 0x63
push 0x7f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x100494cd
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x84], 0
jmp 0x10049527
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x10049546
push dword [ebp - 0x84]
lea ecx, [ebp - 0x1f4]
call fcn.10013a64
or dword [eax], 0xffffffff
jmp 0x1004951a
push 0
call fcn.10048c95
pop ecx
lea eax, [ebp - 0x1a8]
push eax
call fcn.1004740a
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f4]
call fcn.10013a48
push 1
lea eax, [ebp - 0x260]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.10046c60
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x23c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x23c]
lea edi, [ebp - 0x1b4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc4], 2
mov dword [ebp - 0x44], 0xd0b5486b
mov dword [ebp - 0x18], 1
mov byte [ebp - 0x28], 0
movzx eax, byte [ebp - 0x28]
test eax, eax
je 0x100495d6
push 0xcce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
cmp dword [ebp - 0xc4], 0
je 0x100496d4
mov dword [ebp - 0x194], 0
xor eax, eax
je 0x100496c2
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x68], 0
jmp 0x1004960f
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10049625
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x248], 0xfffffffe
jmp 0x10049608
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc4]
cmp dword [ebp + eax - 0x248], ecx
je 0x10049646
mov dword [ebp - 0x114], 1
jmp 0x1004964d
and dword [ebp - 0x114], 0
cmp dword [ebp - 0x114], 0xa3cfce2
je 0x10049665
mov dword [ebp - 0xcc], 1
jmp 0x1004966c
and dword [ebp - 0xcc], 0
cmp dword [ebp - 0xcc], 1
je 0x10049681
mov dword [ebp - 0x13c], 1
jmp 0x10049688
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xfffffff9
jl 0x100496a9
mov dword [ebp - 0x11c], 1
jmp 0x100496b0
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0
jmp 0x100496cf
imul eax, dword [ebp - 0x18], 0x9fa8
mov dword [ebp - 0x194], eax
jmp 0x1004975a
mov dword [ebp - 0x184], 0x5fb2
mov dword [ebp - 0x44], 0xffffffea
jmp 0x100496ee
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffe8
jge 0x10049722
mov dword [ebp - 0x18], 0
jmp 0x10049704
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff6
je 0x10049720
mov byte [ebp - 0x2a], 0
movzx eax, byte [ebp - 0x2a]
test eax, eax
je 0x1004971e
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x100496fd
jmp 0x100496e7
mov dword [ebp - 0x18], 0
jmp 0x10049732
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x10
jle 0x1004975a
mov dword [ebp - 0x1a4], 0xfffffff9
cmp dword [ebp - 0x1a4], 0
je 0x1004974d
jmp 0x1004975a
cmp dword [ebp - 0x184], 0
je 0x10049758
jmp 0x1004975a
jmp 0x1004972b
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1d4], 0x8c6a53d0
mov dword [ebp - 0x1dc], 8
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x220], 0xfffffffa
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0x1cc], 0x21dfe4b2
push 3
lea ecx, [ebp - 0x204]
call fcn.100139c6
mov dword [ebp - 4], 2
mov dword [ebp - 0xdc], 0x2250db85
mov dword [ebp - 0x54], 0
jmp 0x100497d8
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x100497f1
push dword [ebp - 0x54]
lea ecx, [ebp - 0x204]
call fcn.10013a64
and dword [eax], 0
jmp 0x100497d1
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
mov byte [ebp - 0x23], 0
movzx eax, byte [ebp - 0x23]
test eax, eax
je 0x10049827
push 0
push 0
push 0
push 0
push 0x1a1c
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x204]
call fcn.10013a48
push 1
lea ecx, [ebp - 0x214]
call fcn.100139c6
mov dword [ebp - 4], 3
mov dword [ebp - 0x80], 0x4f833fcb
mov dword [ebp - 0x70], 0
jmp 0x10049861
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1004987a
push dword [ebp - 0x70]
lea ecx, [ebp - 0x214]
call fcn.10013a64
and dword [eax], 0
jmp 0x1004985a
mov dword [ebp - 0x80], 0
jmp 0x1004988a
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x100498d7
mov dword [ebp - 0x58], 3
mov dword [ebp - 0x58], 0
jmp 0x100498a7
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jg 0x100498d5
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x100498d3
push 0x26ad
push 0x2407
push 0x2103
push 0xb38
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x100498a0
jmp 0x10049883
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.10013a48
mov byte [ebp - 0x21], 0
push 1
lea ecx, [ebp - 0x1c8]
call fcn.100139c6
mov dword [ebp - 4], 4
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x5c], 0
jmp 0x10049915
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10049931
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x1c8]
call fcn.10013a64
mov dword [eax], 0xec2e
jmp 0x1004990e
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x10049951
push 0x2430
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x50], 0
jmp 0x10049961
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x1004999d
mov dword [ebp - 0x64], 0x3d9532bb
mov dword [ebp - 0x64], 0
jmp 0x1004997e
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1004999b
push dword [ebp - 0x50]
lea ecx, [ebp - 0x1c8]
call fcn.10013a64
cmp dword [eax], 0
je 0x10049999
jmp 0x1004999b
jmp 0x10049977
jmp 0x1004995a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c8]
call fcn.10013a48
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x100499cd
push 0x1d7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 1
lea ecx, [ebp - 0x98]
call fcn.100139c6
mov dword [ebp - 4], 5
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x3c], 0x1ce3cb5a
mov dword [ebp - 0x18c], 0x1932e3ca
mov dword [ebp - 0x6c], 0
jmp 0x10049a0c
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10049a28
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x98]
call fcn.10013a64
mov dword [eax], 0xb8f5
jmp 0x10049a05
push 0
lea ecx, [ebp - 0x98]
call fcn.10013a64
mov esi, eax
push 0
lea ecx, [ebp - 0x98]
call fcn.10013a64
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x10049a56
mov dword [ebp - 0xe4], 1
jmp 0x10049a5d
and dword [ebp - 0xe4], 0
push 0
lea ecx, [ebp - 0x98]
call fcn.10013a64
cmp dword [eax], 0
je 0x10049a7b
mov dword [ebp - 0x164], 1
jmp 0x10049a82
and dword [ebp - 0x164], 0
push 0
lea ecx, [ebp - 0x98]
call fcn.10013a64
mov ecx, dword [ebp - 0x164]
cmp ecx, dword [eax]
je 0x10049aa5
mov dword [ebp - 0x180], 1
jmp 0x10049aac
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1e0], eax
push 0
lea ecx, [ebp - 0x98]
call fcn.10013a64
mov esi, dword [ebp - 0xe4]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x98]
call fcn.10013a64
cmp esi, dword [eax]
jg 0x10049aea
mov dword [ebp - 0x124], 1
jmp 0x10049af1
and dword [ebp - 0x124], 0
push 0
lea ecx, [ebp - 0x98]
call fcn.10013a64
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [eax]
jg 0x10049b14
mov dword [ebp - 0x188], 1
jmp 0x10049b1b
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x3c], 0
jmp 0x10049b34
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x10049b4d
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x98]
call fcn.10013a64
or dword [eax], 0xffffffff
jmp 0x10049b2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.10013a48
mov dword [ebp - 0x10], 0xb036
mov dword [ebp - 0x14], 0x13717be9
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0xf0], 0xae734f1
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x74], 0
jmp 0x10049b95
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10049bab
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x22c], 0x697
jmp 0x10049b8e
cmp dword [ebp - 0x10], 0x1f78
jle 0x10049c1c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
jg 0x10049bef
cmp dword [ebp - 0x10], 0
jne 0x10049bd7
cmp dword [ebp - 0x14], 0
jne 0x10049bd7
and dword [ebp - 0xec], 0
jmp 0x10049be1
mov dword [ebp - 0xec], 1
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xec]
mov dword [ebp - 0x14], eax
je 0x10049c01
cmp dword [ebp - 0x10], 0
je 0x10049c01
mov dword [ebp - 0x144], 1
jmp 0x10049c08
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x144], eax
jle 0x10049c1c
and dword [ebp - 0xf4], 0
jmp 0x10049c26
mov dword [ebp - 0xf4], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xf4], eax
jge 0x10049c3d
mov dword [ebp - 0x12c], 1
jmp 0x10049c44
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
add eax, 0xffff
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x224], eax
mov eax, 0x644bb323
test eax, eax
je 0x10049c7a
cmp dword [ebp - 0x14], 0
je 0x10049c7a
mov dword [ebp - 0xfc], 1
jmp 0x10049c81
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xfc], eax
jle 0x10049c98
mov dword [ebp - 0x154], 1
jmp 0x10049c9f
and dword [ebp - 0x154], 0
cmp dword [ebp - 0x154], 0xeb945924
ja 0x10049cb7
mov dword [ebp - 0xac], 1
jmp 0x10049cbe
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xac], eax
je 0x10049cd5
mov dword [ebp - 0x134], 1
jmp 0x10049cdc
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x134], eax
jl 0x10049cf3
mov dword [ebp - 0x198], 1
jmp 0x10049cfa
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
jl 0x10049d20
mov dword [ebp - 0xb0], 1
jmp 0x10049d27
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xb0], eax
jge 0x10049d3e
mov dword [ebp - 0xb8], 1
jmp 0x10049d45
and dword [ebp - 0xb8], 0
imul eax, dword [ebp - 0xb8], 0xfffd
sub eax, 0x397bde51
sub eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jge 0x10049d68
mov dword [ebp - 0xc0], 1
jmp 0x10049d6f
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc0], eax
jne 0x10049d89
cmp dword [ebp - 0x14], 0
jne 0x10049d89
and dword [ebp - 0xc8], 0
jmp 0x10049d93
mov dword [ebp - 0xc8], 1
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x10049db1
cmp dword [ebp - 0x14], 0
jne 0x10049db1
and dword [ebp - 0xd0], 0
jmp 0x10049dbb
mov dword [ebp - 0xd0], 1
cmp dword [ebp - 0xd0], 0xffffffff
jg 0x10049dd0
mov dword [ebp - 0xd8], 1
jmp 0x10049dd7
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x10]
jle 0x10049df2
mov dword [ebp - 0xe0], 1
jmp 0x10049df9
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xe0], eax
jg 0x10049e10
mov dword [ebp - 0xe8], 1
jmp 0x10049e17
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xe8]
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xa9025b0d
jae 0x10049e43
mov dword [ebp - 0xf8], 1
jmp 0x10049e4a
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xf8], eax
jg 0x10049e61
mov dword [ebp - 0x100], 1
jmp 0x10049e68
and dword [ebp - 0x100], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22c]
cmp dword [ebp - 0x100], eax
jg 0x10049e89
mov dword [ebp - 0x108], 1
jmp 0x10049e90
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x190], eax
mov byte [ebp - 0x27], 0
movzx eax, byte [ebp - 0x27]
test eax, eax
je 0x1004a192
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x38], 0xcd9d7
mov dword [ebp - 0x178], 0x42573927
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x20], 0
jmp 0x10049edb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10049ef1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa8], 3
jmp 0x10049ed4
mov dword [ebp - 0x20], 0
jmp 0x10049f01
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10049f17
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x254], 0xe31bb000
jmp 0x10049efa
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa8], 8
jb 0x10049f32
mov dword [ebp - 0x110], 1
jmp 0x10049f39
and dword [ebp - 0x110], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa8], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xa8]
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0xa8]
push 4
pop esi
shl esi, 1
add edx, dword [ebp + esi - 0xa8]
add ecx, edx
imul eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xa8]
mov dword [ebp - 0x38], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa8], 0
je 0x10049fb5
mov eax, 0xfff9
test eax, eax
je 0x10049fa9
cmp dword [ebp - 0x40], 0
mov eax, 0x9150
neg eax
mov dword [ebp - 0x40], eax
jne 0x10049fce
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa8], 0
jne 0x10049fce
and dword [ebp - 0x118], 0
jmp 0x10049fd8
mov dword [ebp - 0x118], 1
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x118], eax
jne 0x10049ff2
mov dword [ebp - 0x8c], 1
jmp 0x10049ff9
and dword [ebp - 0x8c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8c]
mov dword [ebp + eax - 0x254], ecx
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x8c], eax
jg 0x1004a023
mov dword [ebp - 0x120], 1
jmp 0x1004a02a
and dword [ebp - 0x120], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa8]
cmp dword [ebp - 0x120], eax
jl 0x1004a04b
mov dword [ebp - 0x128], 1
jmp 0x1004a052
and dword [ebp - 0x128], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa8]
cmp dword [ebp - 0x128], eax
je 0x1004a073
mov dword [ebp - 0x130], 1
jmp 0x1004a07a
and dword [ebp - 0x130], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x130]
sub ecx, dword [ebp + eax - 0xa8]
mov dword [ebp - 0x7c], ecx
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x38], eax
jl 0x1004a0c8
mov dword [ebp - 0x38], 7
jmp 0x1004a0a7
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 6
jl 0x1004a0c3
mov byte [ebp - 0x2b], 0
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x1004a0c1
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
jmp 0x1004a0a0
jmp 0x1004a18a
mov dword [ebp - 0x1c], 0
jmp 0x1004a0d8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1004a0ee
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1bc], 0xfffffffd
jmp 0x1004a0d1
mov dword [ebp - 0x1c], 0
jmp 0x1004a0fe
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1004a114
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x17c], 0xffffffff
jmp 0x1004a0f7
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa8], 0
je 0x1004a16a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
cmp dword [ebp - 0x40], eax
jne 0x1004a142
mov dword [ebp - 0x138], 1
jmp 0x1004a149
and dword [ebp - 0x138], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
cmp dword [ebp - 0x138], eax
jne 0x1004a16a
mov dword [ebp - 0x140], 1
jmp 0x1004a171
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x7c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7c]
mov dword [ebp + eax - 0x17c], ecx
push 1
call fcn.10048c95
pop ecx
cmp dword [ebp - 0x1b4], 0
je 0x1004a1af
push 4
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret