Function at 0x42be20
Capabilities:
Capture screenshot
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a2081
mov eax, dword fs:[0]
push eax
sub esp, 0x1f0
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc0], ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42c32b
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jne 0x42be81
jmp 0x42cc3d
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0xf8]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x104], eax
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x126c], 0
je 0x42c01b
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [eax + 0xc]
imul edx, dword [ecx + 0x10]
shl edx, 2
push edx
push 0xffffff
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 0x126c]
push ecx
call fcn.0066eb10
add esp, 0xc
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x11b8]
mov dword [ebp - 0x17c], eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x11b4]
mov dword [ebp - 0x188], edx
mov dword [ebp - 0xe8], 0
jmp 0x42bf2b
mov eax, dword [ebp - 0xe8]
add eax, 1
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [ebp - 0x188]
jge 0x42bfea
mov dword [ebp - 0xe0], 0
jmp 0x42bf58
mov edx, dword [ebp - 0xe0]
add edx, 1
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x17c]
jge 0x42bfe5
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xe0]
imul edx, dword [ecx + 0x11b4]
add edx, dword [ebp - 0xe8]
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 0x11bc]
mov edx, dword [ebp - 0x184]
lea eax, [ecx + edx*4]
push eax
call fcn.00429bb0
add esp, 4
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x1224]
add edx, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xc0]
imul edx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xc0]
add edx, dword [ecx + 0x1220]
add edx, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx + 0x126c]
mov dword [ecx + edx*4], eax
jmp 0x42bf49
jmp 0x42bf1c
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x126c]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc0]
mov eax, dword [ecx + 0xc]
imul eax, dword [edx + 0x10]
shl eax, 2
push eax
mov ecx, dword [ebp - 0x104]
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
mov edx, dword [ebp - 0xf8]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x180], eax
push 0xfdfbf7
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0x18c], eax
lea edx, [ebp - 0xa4]
push edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x10]
sub eax, 0x43
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x18c]
push eax
lea ecx, [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xc8]
push edx
call dword [sym.imp.USER32.dll_FillRect]
push 0x2d
call fcn.004f50a0
add esp, 4
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00418f80
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1d0], esp
push ecx
call fcn.00415190
add esp, 4
mov dword [ebp - 0x19c], eax
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x1e4], edx
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1c8], esp
push str.www.dvdfab.cn
call fcn.00418f80
mov dword [ebp - 0x1cc], eax
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x1fc]
push ecx
mov byte [ebp - 4], 0
call fcn.004ea0d0
add esp, 0x38
mov dword [ebp - 0x1e0], eax
lea ecx, [ebp - 0x1fc]
call fcn.00419320
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x1224]
add eax, 0x50
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
add ecx, 0x50
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x74], 0x1e
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0xc]
sub eax, 0x1e
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x170], 0
push 1
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x121c]
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x1264]
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x170], eax
lea ecx, [ebp - 0xbc]
call fcn.0041b040
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xf0]
add edx, 2
mov dword [ebp - 0x158], edx
mov eax, dword [ebp - 0xf0]
mov cx, word [eax]
mov word [ebp - 0x10a], cx
add dword [ebp - 0xf0], 2
cmp word [ebp - 0x10a], 0
jne 0x42c1e9
mov edx, dword [ebp - 0xf0]
sub edx, dword [ebp - 0x158]
sar edx, 1
mov dword [ebp - 0x164], edx
push 0x15
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x164]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.0041b040
push eax
mov edx, dword [ebp - 0xc8]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp - 0xc8]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0xc0]
mov edx, dword [edx]
mov ecx, dword [eax + 0x20]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc8]
push ecx
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x24]
mov eax, dword [edx + 4]
call eax
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0xc8]
push ecx
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0xc]
push edx
push 0
push 0
mov eax, dword [ebp - 0xf8]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
mov ecx, dword [ebp - 0x104]
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0xc8]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x104]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 0xc8]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.00419320
jmp 0x42cc3d
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x42c34f
jmp 0x42cc3d
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x126c], 0
jne 0x42c363
jmp 0x42cc3d
mov ecx, dword [ebp - 0xc0]
call fcn.0042b430
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0xd8]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0xfc], eax
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x126c]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc0]
mov eax, dword [ecx + 0xc]
imul eax, dword [edx + 0x10]
shl eax, 2
push eax
mov ecx, dword [ebp - 0xfc]
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
mov edx, dword [ebp - 0xd8]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x148], 0
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x1268], 0
je 0x42c52b
lea ecx, [ebp - 0x94]
call fcn.0042cc60
mov dword [ebp - 4], 2
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x1268]
mov eax, dword [ebp - 0xc0]
mov edx, dword [edx]
mov ecx, dword [eax + 0x1268]
mov eax, dword [edx + 0x20]
call eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.004288a0
add esp, 4
push 4
lea ecx, [ebp - 0x54]
call fcn.00413f70
lea ecx, [ebp - 0x54]
call fcn.004289c0
lea edx, [ebp - 0x1d8]
push edx
lea ecx, [ebp - 0x7c]
call fcn.00428960
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
jmp 0x42c4ae
push 0
lea ecx, [ebp - 0x1d4]
push ecx
lea ecx, [ebp - 0x54]
call fcn.00428a00
lea edx, [ebp - 0x1dc]
push edx
lea ecx, [ebp - 0x7c]
call fcn.00428990
push eax
lea ecx, [ebp - 0x54]
call fcn.00428a50
movzx eax, al
test eax, eax
je 0x42c501
lea ecx, [ebp - 0x54]
call fcn.004289e0
add eax, 8
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x140]
cmp dword [ecx + 0x48], 0
jne 0x42c4ff
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x100]
add eax, dword [edx + 0x44]
mov dword [ebp - 0x100], eax
jmp 0x42c49d
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0xcc], ecx
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0xec], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0042cc80
mov dword [ebp - 0x130], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
sub eax, dword [0x78b2fc]
cmp eax, 0x3e8
ja 0x42c561
cmp dword [0x78b2f8], 0
jne 0x42c5f1
mov ecx, dword [ebp - 0x100]
mov dword [0x78b2f8], ecx
mov edx, dword [ebp - 0xcc]
sub edx, dword [0x78b2f4]
mov dword [ebp - 0x124], edx
cvtsi2sd xmm0, dword [ebp - 0x124]
mov eax, dword [ebp - 0x124]
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x744540]
mov ecx, dword [ebp - 0x114]
sub ecx, dword [0x78b2fc]
mov dword [ebp - 0x12c], ecx
cvtsi2sd xmm1, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x12c]
shr edx, 0x1f
addsd xmm1, qword [edx*8 + 0x744540]
divsd xmm1, qword [0x744510]
divsd xmm0, xmm1
call fcn.006727f1
mov dword [0x78b2f8], eax
mov eax, dword [ebp - 0xcc]
mov dword [0x78b2f4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x78b2fc], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x134], ecx
cvtsi2sd xmm0, dword [ebp - 0x134]
mov edx, dword [ebp - 0x134]
shr edx, 0x1f
addsd xmm0, qword [edx*8 + 0x744540]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x13c], eax
cvtsi2sd xmm1, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
shr ecx, 0x1f
addsd xmm1, qword [ecx*8 + 0x744540]
divsd xmm1, qword [0x744510]
mov edx, dword [0x78a820]
mov dword [ebp - 0x144], edx
cvtsi2sd xmm2, dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
shr eax, 0x1f
addsd xmm2, qword [eax*8 + 0x744540]
subsd xmm1, xmm2
divsd xmm0, xmm1
call fcn.006727f1
mov dword [ebp - 0x148], eax
mov byte [ebp - 0x30], 0
xor ecx, ecx
mov dword [ebp - 0x2f], ecx
mov dword [ebp - 0x2b], ecx
mov dword [ebp - 0x27], ecx
mov dword [ebp - 0x23], ecx
mov dword [ebp - 0x1f], ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov word [ebp - 0x13], cx
mov byte [ebp - 0x11], cl
mov byte [ebp - 0x50], 0
xor edx, edx
mov dword [ebp - 0x4f], edx
mov dword [ebp - 0x4b], edx
mov dword [ebp - 0x47], edx
mov dword [ebp - 0x43], edx
mov dword [ebp - 0x3f], edx
mov dword [ebp - 0x3b], edx
mov dword [ebp - 0x37], edx
mov word [ebp - 0x33], dx
mov byte [ebp - 0x31], dl
push 0x20
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [0x78b2f8]
push ecx
call fcn.004ebc50
add esp, 0xc
push eax
push 0x740a24
push 0x20
lea edx, [ebp - 0x30]
push edx
call fcn.0066d9fe
add esp, 0x10
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc0]
add ecx, 0x12c8
call fcn.004157b0
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x10]
sub edx, 0x2f
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
add eax, 0x14
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], 0x14
mov ecx, dword [ebp - 0x64]
add ecx, 0x64
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x118], 0
push 1
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 0x1210]
push ecx
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 0x1264]
push ecx
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x1c4], 0
xor eax, eax
mov dword [ebp - 0x1c3], eax
mov dword [ebp - 0x1bf], eax
mov dword [ebp - 0x1bb], eax
mov dword [ebp - 0x1b7], eax
mov dword [ebp - 0x1b3], eax
mov dword [ebp - 0x1af], eax
mov dword [ebp - 0x1ab], eax
mov word [ebp - 0x1a7], ax
mov byte [ebp - 0x1a5], al
mov ecx, dword [ebp - 0xcc]
cmp ecx, dword [ebp - 0xec]
jae 0x42c7d6
cmp dword [ebp - 0xcc], 0
ja 0x42c8a7
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0xcc], edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 0xc]
sub ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0x64]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x64]
add edx, dword [ebp - 0x64]
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0xcc], 0
ja 0x42c812
mov dword [ebp - 0x14c], 0x31
jmp 0x42c81c
mov dword [ebp - 0x14c], 0x30
mov eax, dword [ebp - 0x14c]
push eax
call fcn.004f50a0
add esp, 4
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0xdc], ecx
mov edx, dword [ebp - 0xdc]
add edx, 2
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0xdc]
mov cx, word [eax]
mov word [ebp - 0x10c], cx
add dword [ebp - 0xdc], 2
cmp word [ebp - 0x10c], 0
jne 0x42c84c
mov edx, dword [ebp - 0xdc]
sub edx, dword [ebp - 0x160]
sar edx, 1
mov dword [ebp - 0x190], edx
push 0x25
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x190]
push ecx
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
jmp 0x42cb3b
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0xd4]
add edx, 1
mov dword [ebp - 0x168], edx
mov eax, dword [ebp - 0xd4]
mov cl, byte [eax]
mov byte [ebp - 0xcd], cl
add dword [ebp - 0xd4], 1
cmp byte [ebp - 0xcd], 0
jne 0x42c8bf
mov edx, dword [ebp - 0xd4]
sub edx, dword [ebp - 0x168]
mov dword [ebp - 0x16c], edx
push 0x24
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x16c]
push ecx
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.USER32.dll_DrawTextA]
cmp dword [ebp - 0xec], 0
jne 0x42c928
movsd xmm0, qword [0x7444a8]
movsd qword [ebp - 0x1a4], xmm0
jmp 0x42c988
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x11c], ecx
cvtsi2sd xmm0, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x11c]
shr edx, 0x1f
addsd xmm0, qword [edx*8 + 0x744540]
mulsd xmm0, qword [0x744508]
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x138], eax
cvtsi2sd xmm1, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x138]
shr ecx, 0x1f
addsd xmm1, qword [ecx*8 + 0x744540]
divsd xmm0, xmm1
movsd qword [ebp - 0x1a4], xmm0
cvtsd2ss xmm0, qword [ebp - 0x1a4]
movss dword [ebp - 0x108], xmm0
movss xmm0, dword [0x7444a0]
comiss xmm0, dword [ebp - 0x108]
jbe 0x42c9b9
movss xmm0, dword [0x7444a0]
movss dword [ebp - 0x108], xmm0
mov dword [ebp - 0x174], 0x740a2c
mov edx, dword [ebp - 0x174]
push edx
cvtss2sd xmm0, dword [ebp - 0x108]
sub esp, 8
movsd qword [esp], xmm0
push str._.0f_s
push 0x20
lea eax, [ebp - 0x30]
push eax
call fcn.0066d9fe
add esp, 0x18
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0xc0]
add ecx, 0x12e0
call fcn.004157b0
cvttss2si edx, dword [ebp - 0x108]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 0xc]
sub ecx, 0x14
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x5c]
sub edx, 0x64
mov dword [ebp - 0x64], edx
lea eax, [ebp - 0x30]
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0xe4]
add ecx, 1
mov dword [ebp - 0x150], ecx
mov edx, dword [ebp - 0xe4]
mov al, byte [edx]
mov byte [ebp - 0xce], al
add dword [ebp - 0xe4], 1
cmp byte [ebp - 0xce], 0
jne 0x42ca40
mov ecx, dword [ebp - 0xe4]
sub ecx, dword [ebp - 0x150]
mov dword [ebp - 0x178], ecx
push 0x26
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp - 0x178]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 0xc]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x96
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ecx + 0xc]
cdq
sub eax, edx
sar eax, 1
add eax, 0x96
mov dword [ebp - 0x5c], eax
push 0x36
call fcn.004f50a0
add esp, 4
mov dword [ebp - 0x128], eax
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0xf4], edx
mov eax, dword [ebp - 0xf4]
add eax, 2
mov dword [ebp - 0x198], eax
mov ecx, dword [ebp - 0xf4]
mov dx, word [ecx]
mov word [ebp - 0x10e], dx
add dword [ebp - 0xf4], 2
cmp word [ebp - 0x10e], 0
jne 0x42cae5
mov eax, dword [ebp - 0xf4]
sub eax, dword [ebp - 0x198]
sar eax, 1
mov dword [ebp - 0x154], eax
push 0x25
lea ecx, [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x1310], 0
je 0x42cb7e
mov eax, dword [ebp - 0xc0]
movzx ecx, byte [eax + 0x12a7]
push ecx
mov edx, dword [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x100]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0xc0]
mov ecx, dword [edx + 0x1310]
call fcn.004fb990
mov eax, dword [ebp - 0xc4]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0xc0]
mov edx, dword [edx]
mov ecx, dword [eax + 0x24]
mov eax, dword [edx + 4]
call eax
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0xc]
push edx
push 0
push 0
mov eax, dword [ebp - 0xd8]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
mov ecx, dword [ebp - 0xfc]
push ecx
call dword [sym.imp.GDI32.dll_SetBitmapBits]
mov edx, dword [ebp - 0x15c]
push edx
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0xfc]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0xd8]
push edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 4