Function at 0x411b80
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x140
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
push esi
mov ebx, eax
call edi
push 0xa
push esi
mov ebp, eax
call edi
push 0xc
push esi
mov dword [esp + 0x1c], eax
call edi
cmp eax, 0x20
je 0x411bef
cmp eax, 0x10
je 0x411bef
push 0
push 0x435360
push 0x438dec
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
mov edi, dword [esp + 0x154]
cmp edi, ebp
jl 0x411c13
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x14]
cmp edx, eax
jl 0x411c3b
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
mov eax, dword [esp + 0x15c]
test eax, eax
jge 0x411c5f
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
mov ecx, dword [esp + 0x160]
test ecx, ecx
jge 0x411c83
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
test edi, edi
jge 0x411c90
xor edi, edi
mov dword [esp + 0x154], edi
test edx, edx
jge 0x411c9d
xor edx, edx
mov dword [esp + 0x158], edx
cmp eax, ebp
jle 0x411ca3
mov eax, ebp
mov ebp, dword [esp + 0x14]
cmp ecx, ebp
jle 0x411cad
mov ecx, ebp
mov ebp, ecx
sub eax, edi
sub ebp, edx
mov dword [esp + 0x14], eax
push ebp
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
jne 0x411cef
push eax
push 0x435360
push 0x438dd0
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebx
call edi
mov ecx, dword [esp + 0x154]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x158]
push 0x40cc0020
push eax
push ecx
push esi
push ebp
push edx
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x20]
push eax
push ebx
call edi
mov dword [esp + 0x18], eax
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 0x28
lea eax, [eax*4 + 3]
mov dword [esp + 0x3c], ecx
and al, 0xfc
mov word [esp + 0x40], 1
mov dword [esp + 0x5c], eax
imul eax, ecx
push eax
mov word [esp + 0x46], 0x20
mov dword [esp + 0x48], 0
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [0x7ea5d50], eax
test eax, eax
jne 0x411dc2
push eax
push 0x435360
push 0x435350
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
mov edi, dword [esp + 0x18]
xor ebp, ebp
lea edx, [esp + 0x34]
push ebp
push edx
push eax
mov eax, dword [esp + 0x48]
push eax
push ebp
push edi
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x411e29
push ebp
push 0x435360
push 0x438dc4
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [0x7ea5d50]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [0x7ea5d50], ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
push esi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [esp + 0x164]
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push 2
mov ebx, 1
push 0x438dc0
push esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x30], ebp
call edi
add esp, 0xc
test eax, eax
je 0x411e7f
push 2
push 0x438dbc
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x411e86
mov dword [esp + 0x24], ebx
add esi, 2
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push 0x434cb4
push esi
call ebx
add esp, 8
test eax, eax
je 0x411fc5
cmp esi, ebp
je 0x412100
mov edi, dword [sym.imp.MSVCRT.dll_sscanf]
cmp dword [esp + 0x10], 0xa
jge 0x412100
lea edx, [esp + 0x2c]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
push str._d._d._d__d._d._d
push esi
mov dword [esp + 0x50], 0
call edi
mov ecx, dword [esp + 0x40]
mov ebp, dword [esp + 0x30]
mov edx, dword [esp + 0x48]
mov eax, ecx
add esp, 0x20
lea ebp, [esp + ebp*4 + 0x128]
sub eax, edx
mov dword [ebp], eax
jns 0x411f0c
mov dword [ebp], 0
mov ebp, dword [esp + 0x10]
lea eax, [ecx + edx]
cmp eax, 0x168
mov dword [esp + ebp*4 + 0x60], eax
jle 0x411f26
mov dword [esp + ebp*4 + 0x60], 0x168
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, ecx
lea ebp, [esp + ebp*4 + 0x100]
sub eax, edx
mov dword [ebp], eax
jns 0x411f45
mov dword [ebp], 0
mov ebp, dword [esp + 0x10]
lea eax, [ecx + edx]
cmp eax, 0x64
mov dword [esp + ebp*4 + 0x88], eax
jle 0x411f63
mov dword [esp + ebp*4 + 0x88], 0x64
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov eax, ecx
lea ebp, [esp + ebp*4 + 0xb0]
sub eax, edx
mov dword [ebp], eax
jns 0x411f82
mov dword [ebp], 0
lea eax, [ecx + edx]
mov edx, dword [esp + 0x10]
cmp eax, 0x64
lea ecx, [esp + edx*4 + 0xd8]
mov dword [ecx], eax
jle 0x411f9d
mov dword [ecx], 0x64
push 0x438da4
push esi
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x411faf
inc esi
mov ecx, dword [esp + 0x10]
inc ecx
test esi, esi
mov dword [esp + 0x10], ecx
jne 0x411ead
jmp 0x412100
cmp esi, ebp
mov dword [esp + 0x1c], esi
je 0x412100
cmp dword [esp + 0x10], 0xa
jge 0x412100
mov edx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x438d9c
push edx
call dword [sym.imp.MSVCRT.dll_sscanf]
xor eax, eax
xor ebx, ebx
mov al, byte [esp + 0x2a]
xor ecx, ecx
mov cl, byte [esp + 0x26]
mov esi, eax
mov eax, dword [esp + 0x28]
mov edi, ecx
mov ecx, dword [esp + 0x24]
mov bl, ah
and eax, 0xff
mov edx, edi
mov ebp, eax
xor eax, eax
mov al, ch
and ecx, 0xff
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x20]
add esp, 0x10
sub edx, esi
lea ecx, [esp + ecx*4 + 0x100]
mov dword [ecx], edx
jns 0x41204d
mov dword [ecx], 0
mov ecx, dword [esp + 0x10]
add esi, edi
cmp esi, 0xff
mov dword [esp + ecx*4 + 0xd8], esi
jle 0x41206d
mov dword [esp + ecx*4 + 0xd8], 0xff
mov edx, eax
sub edx, ebx
mov dword [esp + ecx*4 + 0xb0], edx
jns 0x412085
mov dword [esp + ecx*4 + 0xb0], 0
add eax, ebx
cmp eax, 0xff
mov dword [esp + ecx*4 + 0x88], eax
jle 0x4120a0
mov dword [esp + ecx*4 + 0x88], 0xff
mov edx, dword [esp + 0x2c]
mov eax, edx
sub eax, ebp
mov dword [esp + ecx*4 + 0x60], eax
jns 0x4120b6
mov dword [esp + ecx*4 + 0x60], 0
lea eax, [edx + ebp]
lea ecx, [esp + ecx*4 + 0x128]
cmp eax, 0xff
mov dword [ecx], eax
jle 0x4120cf
mov dword [ecx], 0xff
mov edx, dword [esp + 0x1c]
push 0x438da4
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4120ef
inc eax
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
jne 0x411fd1
mov eax, dword [esp + 0x3c]
imul eax, dword [esp + 0x38]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
mov dword [0x7ea5d54], edi
jne 0x412144
mov ecx, dword [0x7ea5d50]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [0x7ea5d50], ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x3c]
cmp eax, ebx
je 0x41215c
imul ecx, dword [esp + 0x38]
mov eax, 0x31313131
jmp 0x412166
imul ecx, dword [esp + 0x38]
mov eax, 0x30303030
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x3c]
cmp ecx, ebx
jle 0x4123b4
mov edi, dword [esp + 0x38]
mov eax, ecx
mov esi, dword [0x7ea5d50]
sub eax, ebx
xor ebp, ebp
dec eax
imul eax, dword [esp + 0x5c]
add eax, esi
test edi, edi
jle 0x4123ab
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x412284
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
jle 0x412393
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov dl, byte [esp + 0x16]
mov esi, edx
xor edx, edx
mov dl, ah
and eax, 0xff
cmp dword [esp + 0x24], 0
jne 0x41222a
cmp esi, dword [esp + ecx*4 + 0x100]
jl 0x412272
cmp esi, dword [esp + ecx*4 + 0xd8]
jg 0x412272
cmp edx, dword [esp + ecx*4 + 0xb0]
jl 0x412272
cmp edx, dword [esp + ecx*4 + 0x88]
jg 0x412272
cmp eax, dword [esp + ecx*4 + 0x60]
jl 0x412272
cmp eax, dword [esp + ecx*4 + 0x128]
jg 0x412272
mov eax, ebx
mov edx, dword [0x7ea5d54]
imul eax, edi
add eax, ebp
mov byte [eax + edx], 0x31
jmp 0x41226e
cmp esi, dword [esp + ecx*4 + 0x100]
jl 0x412272
cmp esi, dword [esp + ecx*4 + 0xd8]
jg 0x412272
cmp edx, dword [esp + ecx*4 + 0xb0]
jl 0x412272
cmp edx, dword [esp + ecx*4 + 0x88]
jg 0x412272
cmp eax, dword [esp + ecx*4 + 0x60]
jl 0x412272
cmp eax, dword [esp + ecx*4 + 0x128]
jg 0x412272
mov eax, ebx
mov edx, dword [0x7ea5d54]
imul eax, edi
add eax, ebp
mov byte [eax + edx], 0x30
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
inc ecx
cmp ecx, eax
jl 0x4121be
jmp 0x412393
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jle 0x412393
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
mov edx, eax
lea ecx, [esp + 0x20]
and edx, 0xff
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x24], eax
mov dl, byte [esp + 0x26]
mov cl, ah
push ecx
push edx
call fcn.00412460
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + esi*4 + 0x140]
add esp, 0x18
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x412336
cmp eax, ecx
jl 0x412382
cmp eax, dword [esp + esi*4 + 0x60]
jg 0x412382
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + esi*4 + 0x100]
cmp eax, ecx
jl 0x412382
cmp eax, dword [esp + esi*4 + 0x88]
jg 0x412382
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + esi*4 + 0xb0]
cmp eax, ecx
jl 0x412382
cmp eax, dword [esp + esi*4 + 0xd8]
jg 0x412382
mov eax, ebx
mov ecx, dword [0x7ea5d54]
imul eax, dword [esp + 0x38]
add eax, ebp
mov byte [eax + ecx], 0x31
jmp 0x412382
cmp eax, ecx
jl 0x412382
cmp eax, dword [esp + esi*4 + 0x60]
jg 0x412382
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + esi*4 + 0x100]
cmp eax, ecx
jl 0x412382
cmp eax, dword [esp + esi*4 + 0x88]
jg 0x412382
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + esi*4 + 0xb0]
cmp eax, ecx
jl 0x412382
cmp eax, dword [esp + esi*4 + 0xd8]
jg 0x412382
mov edx, ebx
mov eax, dword [0x7ea5d54]
imul edx, dword [esp + 0x38]
add edx, ebp
mov byte [edx + eax], 0x30
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x412296
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
inc ebp
add ecx, 4
cmp ebp, edi
mov dword [esp + 0x1c], ecx
jl 0x4121a4
mov ecx, dword [esp + 0x3c]
inc ebx
cmp ebx, ecx
jl 0x412184
mov ecx, dword [0x7ea5d50]
mov ebx, dword [sym.imp.MSVCRT.dll_free]
push ecx
call ebx
mov eax, dword [0x7ea5d64]
xor ebp, ebp
add esp, 4
cmp eax, ebp
mov dword [0x7ea5d50], ebp
je 0x412445
mov eax, dword [0x7ea5d58]
cmp eax, ebp
je 0x4123e6
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x3c]
mov dword [0x7ea5d58], ebp
imul edx, dword [esp + 0x38]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, dword [esp + 0x40]
mov esi, dword [0x7ea5d54]
imul ecx, dword [esp + 0x3c]
mov dword [0x7ea5d58], eax
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x7ea5d54]
push ecx
call ebx
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add esp, 8
mov dword [0x7ea5d54], ebp
mov dword [0x7ea5d5c], edx
mov dword [0x7ea5d60], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x140
ret