Function at 0x4f0610
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x650de8
push eax
mov dword fs:[0], esp
sub esp, 0xc0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
push eax
call dword [0x65f4ac]
push eax
call fcn.00643db0
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4f0f3c
mov ecx, dword [esi + 4]
push ecx
call dword [fcn.0065f598]
mov ecx, dword [edi + 0x20]
lea edx, [esp + 0xb0]
dec eax
push edx
push eax
mov eax, dword [esi + 4]
push eax
push ecx
call dword [0x65f4f4]
mov eax, dword [edi + 0x20]
lea edx, [esp + 0x70]
push edx
push eax
call dword [fcn.0065f4c8]
mov eax, dword [esp + 0xb8]
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x74]
sub eax, esi
sub ecx, edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb4], ecx
lea edx, [eax + 3]
mov eax, dword [esp + 0x78]
sub eax, edx
mov dword [esp + 0x6c], edx
sub eax, esi
sub eax, 0x37
cmp eax, ebx
jle 0x4f0f36
cmp ecx, 0xf
jg 0x4f0f36
lea ebp, [ecx + 0x13]
add eax, edx
push ebp
push eax
lea esi, [edi + 0x1700]
push ecx
push edx
push esi
mov dword [edi + 0x1710], 1
call dword [fcn.0065f4dc]
push 0x826774
lea ecx, [esp + 0x3c]
call fcn.00643edc
push 0x6b9330
lea ecx, [esp + 0x3c]
mov dword [esp + 0xdc], ebx
call fcn.006440b6
mov ecx, dword [edi + 0x20]
push ecx
call dword [0x65f62c]
push eax
call fcn.00644092
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0064414c
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], 0x661a18
cmp ebp, ebx
mov byte [esp + 0xd8], 2
jne 0x4f0743
xor eax, eax
jmp 0x4f0746
mov eax, dword [ebp + 4]
push eax
call dword [fcn.0065e0d0]
push eax
lea ecx, [esp + 0x1c]
call fcn.00644146
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov ebx, dword [esi]
mov edx, dword [ebp + 4]
sub eax, ecx
mov ecx, dword [esi + 8]
sub ecx, ebx
push eax
push ecx
push edx
call dword [fcn.0065e0c8]
push eax
lea ecx, [esp + 0x48]
call fcn.006440f8
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x44]
neg eax
sbb eax, eax
and eax, edx
push eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00644140
mov ecx, dword [esi]
mov ebx, dword [esi + 0xc]
mov edx, dword [esi + 4]
mov dword [esp + 0x54], eax
mov eax, dword [esi + 8]
push 0xf
sub eax, ecx
sub ebx, edx
mov dword [esp + 0x18], eax
call dword [fcn.0065f56c]
mov ecx, dword [esp + 0x14]
push eax
push ebx
push ecx
push 0
push 0
lea ecx, [esp + 0x2c]
call fcn.0064413a
push 1
lea ecx, [esp + 0x1c]
call fcn.0064412e
push 0x6c7010
lea ecx, [esp + 0x14]
call fcn.00643d2c
mov eax, dword [0x73aa38]
mov bl, 3
test eax, eax
mov byte [esp + 0xd8], bl
je 0x4f08c9
mov eax, dword [edi]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call dword [eax + 0xc8]
mov ecx, eax
call fcn.00644164
push 0x69a770
lea ecx, [esp + 0x14]
call fcn.006445e4
cmp eax, 0xffffffff
je 0x4f0852
inc eax
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.006440c8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xdc], 4
call fcn.00644098
lea ecx, [esp + 0x14]
mov byte [esp + 0xd8], bl
call fcn.00643d26
lea edx, [esp + 0x10]
push edx
call fcn.00471eb0
mov eax, dword [esp + 0x14]
add esp, 4
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x4f08c9
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 0x6a0f20
push edx
call fcn.0064409e
push 0x6b932c
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0xe0], 5
push eax
call fcn.00643ea6
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xdc], 6
call fcn.00644098
lea ecx, [esp + 0x14]
mov byte [esp + 0xd8], 5
call fcn.00643d26
lea ecx, [esp + 0x28]
mov byte [esp + 0xd8], bl
call fcn.00643d26
mov eax, dword [0x6e9ee0]
mov edx, dword [esi + 8]
mov ebx, dword [esi]
lea eax, [eax + eax*2]
lea ecx, [eax + eax*4]
shl ecx, 2
sub edx, ecx
sub edx, ebx
sub edx, 2
jns 0x4f08ed
xor ebx, ebx
mov dword [esp + 0x28], ebx
jmp 0x4f08ff
mov eax, dword [esi + 8]
mov edx, dword [esi]
sub eax, ecx
sub eax, edx
sub eax, 2
mov dword [esp + 0x28], eax
mov ebx, eax
mov eax, dword [esp + 0x6c]
push fcn.00404040
add eax, ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x64], eax
mov dword [edi + 0x1714], eax
call fcn.00644122
mov eax, dword [0x6e9ee0]
mov dword [esp + 0x14], 0
test eax, eax
jle 0x4f09bd
mov dword [esp + 0x64], 0x6e9ee4
lea ecx, [ebx + 0x39]
push 0x12
push ecx
push 1
lea edx, [esp + 0xcc]
push ebx
push edx
call dword [fcn.0065f4dc]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xc0]
push 0x2d2d00
push 0
push eax
mov eax, dword [esp + 0xd0]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0xe4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0xe8]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x898828
call fcn.00512f90
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x64]
mov ecx, dword [0x6e9ee0]
inc eax
add ebx, 0x3c
add edx, 0x32
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x64], edx
jl 0x4f093a
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0x661a2c
push 0x69af88
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0xe
mov byte [esp + 0x110], 7
call dword [fcn.0065e0c0]
push eax
lea ecx, [esp + 0x5c]
call fcn.006440f8
lea edx, [esp + 0x58]
lea ecx, [esp + 0x18]
push edx
call fcn.00644128
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x28]
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [fcn.0065e0bc]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x64]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [fcn.0065e0bc]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x28]
add ecx, edx
cmp ecx, ebx
jge 0x4f0abe
push 0xff
lea ecx, [esp + 0x1c]
call fcn.00644122
mov edx, dword [esp + 0x28]
mov eax, ebx
mov ebx, dword [esp + 0x64]
mov ecx, dword [esp + 0x38]
sub eax, ebx
sub eax, edx
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [ecx - 8]
push eax
mov eax, dword [esp + 0x1c]
sar ebx, 1
push ecx
push 2
push ebx
lea ecx, [esp + 0x28]
call dword [eax + 0x64]
push 0xff0000
lea ecx, [esp + 0x1c]
call fcn.00644122
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x2c]
push eax
add ecx, ebx
push 2
push ecx
lea ecx, [esp + 0x28]
call dword [edx + 0x64]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
call fcn.00644128
lea ecx, [esp + 0x58]
call fcn.0064406e
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
mov ebx, dword [esi]
sub ecx, eax
lea eax, [esp + 0x18]
sub edx, ebx
mov ebx, dword [edi + 0x1704]
neg eax
sbb eax, eax
push 0xcc0020
and eax, dword [esp + 0x20]
push 0
push 0
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 4]
push edx
push ebx
mov ebx, dword [fcn.0065e0cc]
push eax
push ecx
call ebx
mov eax, dword [esp + 0x54]
test eax, eax
je 0x4f0b1d
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x1c]
push eax
push edx
call fcn.00644140
lea ecx, [esp + 0x44]
call fcn.0064406e
lea ecx, [esp + 0x18]
call fcn.00644134
mov eax, dword [0x6e9ee0]
xor ecx, ecx
cmp eax, ecx
jle 0x4f0b55
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x60]
mov dword [esi], eax
mov dword [edi + 0x1708], edx
mov eax, 0x661a18
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xd8], 0xa
call fcn.0064414c
lea ecx, [esp + 0xa0]
mov byte [esp + 0xd8], 0xb
call fcn.0064414c
lea ecx, [esp + 0x90]
mov byte [esp + 0xd8], 0xc
call fcn.0064414c
push 0x9b
push 2
push 0x9b
mov byte [esp + 0xe4], 0xd
call fcn.00644176
push eax
call dword [fcn.0065f630]
push eax
lea ecx, [esp + 0x50]
call fcn.006440f8
test ebp, ebp
jne 0x4f0be0
xor eax, eax
jmp 0x4f0be3
mov eax, dword [ebp + 4]
mov esi, dword [fcn.0065e0d0]
push eax
call esi
push eax
lea ecx, [esp + 0x84]
call fcn.00644146
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x4c]
neg eax
sbb eax, eax
and eax, ecx
push eax
mov eax, dword [esp + 0x88]
push eax
call fcn.00644140
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x70]
sub ecx, edx
mov dword [esp + 0x60], eax
lea eax, [esp + 0x80]
push 0xcc0020
lea edx, [ecx - 0x37]
mov ecx, dword [edi + 0x1704]
inc ecx
push 0
neg eax
sbb eax, eax
push 0
and eax, dword [esp + 0x90]
mov dword [edi + 0x16ec], edx
push eax
push 0x10
push 0x10
push ecx
push edx
mov edx, dword [ebp + 4]
push edx
call ebx
mov eax, dword [edi + 0x20]
push eax
call dword [fcn.0065f4f8]
test eax, eax
je 0x4f0c77
push 0x198
push 2
push 0x198
jmp 0x4f0c83
push 0x19a
push 2
push 0x19a
call fcn.00644176
push eax
call dword [fcn.0065f630]
push eax
lea ecx, [esp + 0x34]
call fcn.006440f8
test ebp, ebp
jne 0x4f0ca1
xor eax, eax
jmp 0x4f0ca4
mov eax, dword [ebp + 4]
push eax
call esi
push eax
lea ecx, [esp + 0x94]
call fcn.00644146
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x94]
lea eax, [esp + 0x30]
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call fcn.00644140
mov ecx, dword [esp + 0x78]
mov edx, dword [edi + 0x1704]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x70]
sub ecx, eax
lea eax, [esp + 0x90]
inc edx
sub ecx, 0x26
neg eax
sbb eax, eax
push 0xcc0020
and eax, dword [esp + 0x98]
push 0
push 0
push eax
push 0x10
push 0x10
push edx
mov edx, dword [ebp + 4]
push ecx
push edx
call ebx
push 0x98
push 2
push 0x98
call fcn.00644176
push eax
call dword [fcn.0065f630]
push eax
lea ecx, [esp + 0x40]
call fcn.006440f8
test ebp, ebp
jne 0x4f0d3a
xor eax, eax
jmp 0x4f0d3d
mov eax, dword [ebp + 4]
push eax
call esi
push eax
lea ecx, [esp + 0xa4]
call fcn.00644146
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x3c]
neg eax
sbb eax, eax
and eax, ecx
push eax
mov eax, dword [esp + 0xa8]
push eax
call fcn.00644140
mov ecx, dword [esp + 0x78]
mov edx, dword [edi + 0x1704]
mov esi, eax
mov eax, dword [esp + 0x70]
sub ecx, eax
lea eax, [esp + 0xa0]
inc edx
sub ecx, 0x15
neg eax
sbb eax, eax
push 0xcc0020
and eax, dword [esp + 0xa8]
push 0
push 0
push eax
push 0x10
push 0x10
push edx
push ecx
mov ecx, dword [ebp + 4]
push ecx
call ebx
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4f0db2
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x84]
push eax
push edx
call fcn.00644140
lea ecx, [esp + 0x4c]
call fcn.0064406e
lea ecx, [esp + 0x80]
call fcn.00644134
test esi, esi
je 0x4f0ddc
mov esi, dword [esi + 4]
mov eax, dword [esp + 0xa4]
push esi
push eax
call fcn.00644140
lea ecx, [esp + 0x3c]
call fcn.0064406e
lea ecx, [esp + 0xa0]
call fcn.00644134
mov eax, dword [esp + 0x54]
test eax, eax
je 0x4f0e0a
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x94]
push eax
push ecx
call fcn.00644140
lea ecx, [esp + 0x30]
call fcn.0064406e
lea ecx, [esp + 0x90]
call fcn.00644134
mov edx, dword [ebp + 4]
mov eax, dword [edi + 0x20]
push edx
push eax
call dword [fcn.0065f4e8]
lea ecx, [esp + 0x90]
mov byte [esp + 0xd8], 0xc
call fcn.0064411c
lea ecx, [esp + 0xa0]
mov byte [esp + 0xd8], 0xb
call fcn.0064411c
lea ecx, [esp + 0x80]
mov byte [esp + 0xd8], 0xa
call fcn.0064411c
mov edi, 0x661578
mov dword [esp + 0x30], edi
lea ecx, [esp + 0x30]
mov byte [esp + 0xd8], 0xe
call fcn.0064406e
mov esi, 0x6602dc
mov dword [esp + 0x3c], edi
mov dword [esp + 0x30], esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd8], 0xf
call fcn.0064406e
mov dword [esp + 0x3c], esi
mov dword [esp + 0x4c], edi
lea ecx, [esp + 0x4c]
mov byte [esp + 0xd8], 0x10
call fcn.0064406e
mov dword [esp + 0x4c], esi
mov dword [esp + 0x58], edi
lea ecx, [esp + 0x58]
mov byte [esp + 0xd8], 0x11
call fcn.0064406e
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], esi
mov byte [esp + 0xd8], 2
call fcn.00643d26
mov dword [esp + 0x44], edi
lea ecx, [esp + 0x44]
mov byte [esp + 0xd8], 0x12
call fcn.0064406e
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], esi
mov byte [esp + 0xd8], 0
call fcn.0064411c
lea ecx, [esp + 0x38]
mov dword [esp + 0xd8], 0xffffffff
call fcn.00643d26
jmp 0x4f0f3c
mov dword [edi + 0x1710], ebx
mov ecx, dword [esp + 0xd0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xcc
ret