Function at 0x422060
Capabilities:
Allocate or change rwx memory
Capture screenshot
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x26c
mov dword [esp], 0
call dword [sym.imp.gdi32.dll_CreateCompatibleDC]
mov dword [ebp - 0x258], eax
sub esp, 4
test eax, eax
je 0x422025
mov esi, dword [sym.imp.gdi32.dll_CreateBitmap]
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0x7ffffff
call esi
sub esp, 0x14
test eax, eax
je 0x421f60
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 9
mov dword [esp], 0x7ffffff
call esi
sub esp, 0x14
test eax, eax
je 0x421fd0
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
mov edi, dword fs:[0x18]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0x8000000
call esi
sub esp, 0x14
mov ebx, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x5f8
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 4], str.CreateBitmap_should_fail_n
mov dword [esp], eax
call fcn.00401820
test ebx, ebx
je 0x421fa0
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 0xf
mov dword [esp], 0xf
call esi
sub esp, 0x14
mov ebx, eax
test eax, eax
je 0x422008
lea eax, [ebp - 0x254]
mov dword [esp + 4], 0x18
mov esi, dword [sym.imp.gdi32.dll_GetObjectW]
mov dword [esp + 8], eax
mov dword [esp], ebx
call esi
sub esp, 0xc
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x603
xor eax, eax
cmp edi, 0x18
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], 0x49a5be
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x605
mov eax, dword [ebp - 0x254]
mov dword [esp + 4], str.wrong_bm.bmType__d_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x606
mov eax, dword [ebp - 0x250]
mov dword [esp + 4], str.wrong_bm.bmWidth__d_n
cmp eax, 0xf
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x607
mov eax, dword [ebp - 0x24c]
mov dword [esp + 4], str.wrong_bm.bmHeight__d_n
cmp eax, 0xf
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x608
mov eax, dword [ebp - 0x248]
mov dword [esp + 4], str.wrong_bm.bmWidthBytes__d_n
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x609
movzx edx, word [ebp - 0x244]
mov dword [esp + 4], str.wrong_bm.bmPlanes__d_n
cmp dx, 1
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x60a
movzx edx, word [ebp - 0x242]
mov dword [esp + 4], str.wrong_bm.bmBitsPixel__d_n
cmp dx, 1
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x60b
mov eax, dword [ebp - 0x240]
mov dword [esp + 4], str.wrong_bm.bmBits__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x24c]
cmp eax, 0x100
ja 0x422042
mov eax, dword [sym.imp.gdi32.dll_GetBitmapBits]
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [ebp - 0x25c], eax
call eax
sub esp, 0xc
mov edi, eax
mov eax, 0x611
call fcn.00401020
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x24c]
mov dword [esp + 8], edi
mov dword [esp + 4], str._d____d_n
cmp eax, edi
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x10c]
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xaaaaaaaa
mov ecx, 0x40
lea edx, [ebp - 0x10c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x24c]
mov dword [esp], edx
mov dword [esp + 4], 0
lea edi, [ebp - 0x20c]
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, 0xaaaaaaaa
mov ecx, 0x40
lea edx, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x100
mov ecx, dword [ebp - 0x25c]
call ecx
sub esp, 0xc
mov edi, eax
mov eax, 0x618
call fcn.00401020
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x24c]
mov dword [esp + 8], edi
mov dword [esp + 4], str._d____d_n
cmp eax, edi
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x254]
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
lea edx, [ebp - 0x10c]
mov dword [eax], 0x499014
mov dword [eax + 4], 0x619
mov dword [esp + 4], edx
lea edx, [ebp - 0x20c]
mov dword [esp], edx
mov dword [esp + 8], 0x100
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.buffers_do_not_match_n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov dword [esp + 4], ebx
mov edx, dword [ebp - 0x258]
mov dword [esp], edx
mov edx, dword [sym.imp.gdi32.dll_SelectObject]
mov dword [ebp - 0x264], edx
call edx
sub esp, 8
mov dword [ebp - 0x260], eax
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 4], 0x18
call esi
sub esp, 0xc
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x61e
xor eax, eax
cmp edi, 0x18
sete al
mov dword [esp + 8], edi
lea edi, [ebp - 0x20c]
mov dword [esp], eax
mov dword [esp + 4], 0x49a5be
call fcn.00401820
mov eax, 0x620
call fcn.00401020
mov eax, dword [ebp - 0x254]
mov dword [esp + 4], str.wrong_bm.bmType__d_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov eax, 0x621
call fcn.00401020
mov eax, dword [ebp - 0x250]
mov dword [esp + 4], str.wrong_bm.bmWidth__d_n
cmp eax, 0xf
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x622
mov eax, dword [ebp - 0x24c]
mov dword [esp + 4], str.wrong_bm.bmHeight__d_n
cmp eax, 0xf
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x623
mov eax, dword [ebp - 0x248]
mov dword [esp + 4], str.wrong_bm.bmWidthBytes__d_n
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x624
movzx ecx, word [ebp - 0x244]
mov dword [esp + 4], str.wrong_bm.bmPlanes__d_n
cmp cx, 1
mov dword [esp + 8], ecx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x625
movzx ecx, word [ebp - 0x242]
mov dword [esp + 4], str.wrong_bm.bmBitsPixel__d_n
cmp cx, 1
mov dword [esp + 8], ecx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x626
mov eax, dword [ebp - 0x240]
mov dword [esp + 4], str.wrong_bm.bmBits__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xaaaaaaaa
mov ecx, 0x40
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x20c]
mov dword [esp], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0x100
mov ecx, dword [ebp - 0x25c]
call ecx
sub esp, 0xc
mov edi, eax
mov eax, 0x62a
call fcn.00401020
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x24c]
mov dword [esp + 8], edi
mov dword [esp + 4], str._d____d_n
cmp eax, edi
mov dword [esp + 0xc], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
lea ecx, [ebp - 0x10c]
mov dword [eax], 0x499014
mov dword [eax + 4], 0x62b
mov dword [esp + 4], ecx
lea ecx, [ebp - 0x20c]
mov dword [esp], ecx
mov dword [esp + 8], 0x100
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.buffers_do_not_match_n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov eax, dword [ebp - 0x260]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x258]
mov dword [esp], edx
mov edx, dword [ebp - 0x264]
call edx
sub esp, 8
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x62e
xor eax, eax
cmp ebx, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.wrong_old_bitmap__p_n
call fcn.00401820
lea eax, [ebp - 0x23c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x30
call esi
sub esp, 0xc
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x632
xor eax, eax
cmp edi, 0x18
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], 0x49a5be
call fcn.00401820
lea eax, [ebp - 0x254]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
call esi
sub esp, 0xc
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x635
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str._d___0_n
call fcn.00401820
lea eax, [ebp - 0x254]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call esi
sub esp, 0xc
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x638
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str._d___0_n
call fcn.00401820
lea eax, [ebp - 0x254]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
call esi
sub esp, 0xc
mov esi, eax
mov eax, 0x63b
call fcn.00401020
xor eax, eax
test esi, esi
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str._d___0_n
mov dword [esp], eax
call fcn.00401820
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_DeleteObject]
mov edx, dword [ebp - 0x258]
sub esp, 4
mov dword [esp], edx
call dword [sym.imp.gdi32.dll_DeleteDC]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x5e4
call fcn.00401020
mov edx, dword [ebx + 0x34]
mov eax, 1
cmp edx, 8
je 0x421f7f
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.expected_ERROR_NOT_ENOUGH_MEMORY__got__lu_n
mov dword [esp], eax
call fcn.00401820
jmp 0x42171e
mov eax, 0x5fa
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x49bb28
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
jmp 0x4217e5
mov eax, 0x5ef
call fcn.00401020
mov edx, dword [ebx + 0x34]
mov eax, 1
cmp edx, 8
je 0x421fef
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.expected_ERROR_NOT_ENOUGH_MEMORY__got__lu_n
mov dword [esp], eax
call fcn.00401820
jmp 0x42176c
mov dword [esp + 8], 0x600
mov dword [esp + 4], str..._dlls_gdi32_tests_bitmap.c
mov dword [esp], str.hbmp___NULL
call dword [sym.imp.msvcrt.dll__assert]
mov dword [esp + 8], 0x5de
mov dword [esp + 4], str..._dlls_gdi32_tests_bitmap.c
mov dword [esp], 0x49bad4
call dword [sym.imp.msvcrt.dll__assert]
mov dword [esp + 8], 0x60d
mov dword [esp + 4], str..._dlls_gdi32_tests_bitmap.c
mov dword [esp], str.sizeof_buf____bm.bmWidthBytes__bm.bmHeight
call dword [sym.imp.msvcrt.dll__assert]
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x100
mov dword [esp], 0x49bbbe
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 4
mov ebx, eax
mov dword [esp + 4], str.D3DKMTCreateDCFromMemory
mov dword [esp], eax
call esi
sub esp, 8
mov dword [0x4e400c], eax
mov dword [esp + 4], str.D3DKMTDestroyDCFromMemory
mov dword [esp], ebx
call esi
sub esp, 8
mov dword [0x4e4008], eax
mov dword [esp + 4], str.GdiAlphaBlend
mov dword [esp], ebx
call esi
sub esp, 8
mov dword [0x4e4004], eax
mov dword [esp + 4], 0x49bc09
mov dword [esp], ebx
call esi
sub esp, 8
mov dword [0x4e4000], eax
call fcn.00417ee0
call fcn.0041d1c0
call fcn.00402c30
call fcn.0041bab0
call fcn.004216a0
mov eax, dword [sym.imp.gdi32.dll_CreateCompatibleDC]
mov dword [esp], 0
mov dword [ebp - 0xa8], eax
call eax
mov dword [ebp - 0x9c], eax
sub esp, 4
test eax, eax
je 0x424eb2
mov eax, dword [sym.imp.gdi32.dll_CreateBitmap]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], 0x10
mov dword [ebp - 0xb8], eax
call eax
sub esp, 0x14
mov ebx, eax
test eax, eax
je 0x424eec
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x9c]
xor edi, edi
mov esi, dword [sym.imp.gdi32.dll_SelectObject]
mov dword [esp], eax
call esi
mov dword [ebp - 0xb0], ebx
mov ebx, edi
sub esp, 8
mov eax, dword [ebx*8 + 0x49c760]
mov dword [ebp - 0xa4], eax
mov dword [esp + 4], eax
mov edi, dword [ebp - 0x9c]
mov dword [esp], edi
call dword [sym.imp.gdi32.dll_SetTextColor]
mov eax, dword [ebx*8 + 0x49c764]
sub esp, 8
mov dword [ebp - 0xac], eax
mov dword [esp], edi
xor edi, edi
mov dword [esp + 4], eax
call dword [sym.imp.gdi32.dll_SetBkColor]
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xbc], esi
sub esp, 8
mov dword [esp + 4], 5
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetCurrentObject]
sub esp, 8
mov edx, eax
lea eax, [ebp - 0x4c]
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [ebp - 0xa0], edx
call dword [sym.imp.gdi32.dll_GetPaletteEntries]
mov edx, dword [ebp - 0xa0]
sub esp, 0x10
test eax, eax
je 0x4247ee
movzx ecx, byte [ebp - 0x4c]
mov ebx, 0xff
movzx eax, byte [ebp - 0x4b]
mov esi, 0xff
movzx edx, byte [ebp - 0x4a]
sub ebx, ecx
imul ecx, ecx
mov dword [ebp - 0xa0], ebx
mov ebx, 0xff
sub esi, edx
sub ebx, eax
imul eax, eax
imul edx, edx
imul ebx, ebx
add eax, ecx
lea ecx, [eax + edx]
mov eax, dword [ebp - 0xa0]
mov edx, ebx
mov ebx, 0xffffff
imul eax, eax
add edx, eax
mov eax, esi
imul eax, esi
add edx, eax
xor eax, eax
cmp ecx, edx
mov ecx, edi
cmovge eax, ebx
or ecx, 0x1000000
mov dword [esp], eax
mov ebx, dword [ebp - 0x9c]
mov eax, 0x6e4
mov edx, ebx
call fcn.00402b30
cmp edi, 1
je 0x4247c8
mov dword [esp], 0
mov ecx, edi
mov edx, ebx
mov eax, 0x6e5
or ecx, 0x10ff0000
add edi, 1
call fcn.00402b30
cmp edi, 0x100
jne 0x4221c7
mov dword [ebp - 0xa0], 0
mov ebx, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xbc]
mov dword [ebp - 0xb4], ebx
xor edi, edi
lea esi, [esi]
xor ebx, ebx
lea esi, [esi]
mov dword [esp + 8], ebx
add ebx, 0xf
mov dword [esp + 4], edi
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x9c]
call fcn.0041a500
cmp ebx, 0x10e
jne 0x4222e8
add edi, 0xf
cmp edi, 0x10e
jne 0x4222e0
add dword [ebp - 0xa0], 0xf
mov eax, dword [ebp - 0xa0]
mov ebx, dword [ebp - 0xb4]
cmp eax, 0x10e
jne 0x4222d4
add ebx, 1
cmp ebx, 0xa
jne 0x422179
mov eax, dword [ebp - 0x9c]
mov ebx, dword [ebp - 0xb0]
mov dword [esp], eax
mov eax, dword [sym.imp.gdi32.dll_DeleteDC]
mov dword [ebp - 0xa4], eax
call eax
mov eax, dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
mov dword [esp], ebx
mov ebx, eax
mov dword [ebp - 0xa0], eax
call eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
sub esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], 2
mov edi, dword [ebp - 0xb8]
call edi
sub esp, 0x14
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x6fa
xor eax, eax
test edi, edi
setne al
mov dword [esp + 4], 0x499ee0
mov dword [esp], eax
call fcn.00401820
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x38], 0xffffffff
call fcn.00492bc0
lea edx, [ebp - 0x4c]
mov dword [eax], 0x499014
mov dword [eax + 4], 0x6fd
mov dword [esp + 8], edx
mov dword [esp + 4], 0x18
mov dword [esp], edi
call dword [sym.imp.gdi32.dll_GetObjectW]
sub esp, 0xc
cmp eax, 0x18
sete al
mov dword [esp + 4], str.GetObject_failed_or_returned_a_wrong_structure_size_n
movzx eax, al
mov dword [esp], eax
call fcn.00401820
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0x6ff
xor eax, eax
mov dword [esp + 4], str.bmBits_must_be_NULL_for_device_dependent_bitmaps_n
mov edx, dword [ebp - 0x38]
test edx, edx
sete al
mov dword [esp], eax
call fcn.00401820
mov dword [esp], edi
mov eax, ebx
call eax
mov eax, 1
sub esp, 4
call fcn.00412ee0
mov eax, 4
call fcn.00412ee0
mov eax, 8
call fcn.00412ee0
mov eax, 1
call fcn.0040a680
xor eax, eax
call fcn.0040a680
call fcn.0040ac40
call fcn.00401840
call fcn.0041b360
call fcn.00418910
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x3c], edx
add eax, 4
cmp eax, 0x1c
jb 0x4224d0
mov dword [ebp - 0x4c], 0x28
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 0x200001
mov dword [ebp - 0x38], 4
mov dword [esp], 0
mov ebx, dword [ebp - 0xa8]
call ebx
sub esp, 4
mov dword [ebp - 0x9c], eax
mov dword [esp], eax
call ebx
sub esp, 4
mov edi, eax
mov dword [esp], eax
call ebx
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x94]
sub esp, 4
mov dword [ebp - 0xb0], eax
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov edx, dword [sym.imp.gdi32.dll_CreateDIBSection]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov ebx, edx
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov dword [ebp - 0xac], edx
call edx
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
mov ecx, dword [sym.imp.gdi32.dll_CreateSolidBrush]
sub esp, 8
mov dword [ebp - 0xbc], eax
mov dword [esp], 0x12345678
mov dword [ebp - 0xcc], ecx
call ecx
sub esp, 4
mov dword [ebp - 0xc0], eax
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x7c]
sub esp, 8
mov dword [ebp - 0xc4], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x9c]
mov dword [esp], edx
call ebx
sub esp, 0x18
mov dword [ebp - 0xc8], eax
mov dword [esp + 4], eax
mov ebx, dword [ebp - 0xb0]
mov dword [esp], ebx
call esi
mov edx, ebx
sub esp, 8
mov dword [ebp - 0xb0], eax
mov dword [esp + 0xc], 0xbf1
mov dword [esp + 8], 0xfedcba98
mov dword [esp + 4], 0xcc0020
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbf2
mov edx, ebx
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xee0086
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbf3
mov edx, ebx
mov dword [esp + 8], 0x88888888
mov dword [esp + 4], 0x8800c6
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbf4
mov edx, ebx
mov dword [esp + 8], 0x77777777
mov dword [esp + 4], 0x660046
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbf5
mov edx, ebx
mov dword [esp + 8], 0x76543210
mov dword [esp + 4], 0x440328
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbf6
mov edx, ebx
mov dword [esp + 8], 0x1234567
mov dword [esp + 4], 0x330008
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbf7
mov edx, ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1100a6
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbf8
mov edx, ebx
mov dword [esp + 8], 0x581210
mov dword [esp + 4], 0xc000ca
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbf9
mov edx, ebx
mov dword [esp + 8], 0x89abcdef
mov dword [esp + 4], 0xbb0226
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbfa
mov edx, ebx
mov dword [esp + 8], 0x785634
mov dword [esp + 4], 0xf00021
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbfb
mov edx, ebx
mov dword [esp + 8], 0x89fbdfff
mov dword [esp + 4], 0xfb0a09
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbfc
mov edx, ebx
mov dword [esp + 8], 0x89d39bdb
mov dword [esp + 4], 0x5a0049
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbfd
mov edx, ebx
mov dword [esp + 8], 0x76543210
mov dword [esp + 4], 0x550009
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbfe
mov edx, ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x42
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov dword [esp + 0xc], 0xbff
mov edx, ebx
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xff0062
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x94]
mov eax, edi
call fcn.00402a80
mov eax, dword [ebp - 0xb0]
mov dword [esp + 4], eax
mov dword [ebp - 0xb0], ebx
mov dword [esp], ebx
call esi
mov edx, dword [ebp - 0xc8]
sub esp, 8
mov dword [esp], edx
mov ebx, dword [ebp - 0xa0]
call ebx
mov ecx, dword [ebp - 0xb0]
sub esp, 4
mov dword [esp], ecx
mov ecx, dword [ebp - 0xa4]
call ecx
mov edx, dword [ebp - 0xc4]
sub esp, 4
mov dword [esp + 4], edx
mov dword [esp], edi
call esi
mov edx, dword [ebp - 0xc0]
sub esp, 8
mov dword [esp], edx
call ebx
mov edx, dword [ebp - 0xbc]
sub esp, 4
mov dword [esp + 4], edx
mov dword [esp], edi
call esi
mov edx, dword [ebp - 0xb4]
sub esp, 8
mov dword [esp], edx
call ebx
sub esp, 4
mov dword [esp], edi
mov edi, dword [ebp - 0xa4]
call edi
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], eax
call edi
sub esp, 4
call fcn.0040e6a0
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x3c], edx
add eax, 4
cmp eax, 0x1c
jb 0x422956
mov dword [ebp - 0x4c], 0x28
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x40], 0x200001
mov dword [esp], 0
mov edi, dword [ebp - 0xa8]
call edi
sub esp, 4
mov ebx, eax
mov dword [ebp - 0x9c], eax
mov dword [esp], eax
call edi
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x4c]
sub esp, 4
mov edi, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xac]
call eax
sub esp, 0x18
mov dword [ebp - 0xb0], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call esi
sub esp, 8
mov dword [ebp - 0xb4], eax
mov dword [esp], 0x12345678
mov eax, dword [ebp - 0xcc]
call eax
sub esp, 4
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], edi
call esi
mov ecx, 0xcc0020
sub esp, 8
mov dword [ebp - 0xbc], eax
mov eax, edi
mov dword [esp + 4], 0xdc3
mov dword [esp], 0xfedcba98
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdc4
mov ecx, 0xee0086
mov eax, edi
mov dword [esp], 0xffffffff
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdc5
mov ecx, 0x8800c6
mov eax, edi
mov dword [esp], 0x88888888
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdc6
mov ecx, 0x660046
mov eax, edi
mov dword [esp], 0x77777777
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdc7
mov ecx, 0x440328
mov eax, edi
mov dword [esp], 0x76543210
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdc8
mov ecx, 0x330008
mov eax, edi
mov dword [esp], 0x1234567
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdc9
mov ecx, 0x1100a6
mov eax, edi
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdca
mov ecx, 0xc000ca
mov eax, edi
mov dword [esp], 0x581210
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdcb
mov ecx, 0xbb0226
mov eax, edi
mov dword [esp], 0x89abcdef
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdcc
mov ecx, 0xf00021
mov eax, edi
mov dword [esp], 0x785634
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdcd
mov ecx, 0xfb0a09
mov eax, edi
mov dword [esp], 0x89fbdfff
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdce
mov ecx, 0x5a0049
mov eax, edi
mov dword [esp], 0x89d39bdb
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdcf
mov ecx, 0x550009
mov eax, edi
mov dword [esp], 0x76543210
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdd0
mov ecx, 0x42
mov eax, edi
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov dword [esp + 4], 0xdd1
mov ecx, 0xff0062
mov eax, edi
mov dword [esp], 0xffffffff
mov edx, dword [ebp - 0x98]
call fcn.0040e430
mov ecx, dword [ebp - 0xbc]
mov dword [esp], edi
mov dword [esp + 4], ecx
call esi
sub esp, 8
mov dword [esp], ebx
mov eax, dword [ebp - 0xa0]
call eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0xcafed00d
lea ecx, [ebp - 0x94]
sub esp, 4
mov dword [ebp - 0x94], 0xcafed00d
mov dword [ebp - 0x90], 0xfeedface
mov dword [ebp - 0x8c], 0xfedcba98
mov dword [ebp - 0x88], 0x76543210
mov dword [ebp - 0x78], 0xfeedface
mov dword [ebp - 0x74], 0xfedcba98
mov dword [ebp - 0x70], 0x76543210
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x24], 0xddd
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xbc], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xbc]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xdde
xor eax, eax
cmp edx, 2
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x24], 0xde3
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov ecx, dword [0x5b41f0]
mov ebx, eax
mov dword [ebp - 0xbc], ecx
call fcn.00492bc0
mov ecx, dword [ebp - 0xbc]
mov edx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
add edx, edx
test ecx, ecx
setne cl
movzx ecx, cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x422de7
call fcn.00492bc0
cmp ebx, 1
mov dword [eax], 0x499014
mov dword [eax + 4], 0xde4
sete al
movzx eax, al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
call fcn.00492bc0
shr dword [eax + 0x10], 1
call fcn.00492bc0
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x422db0
lea eax, [ebp - 0x7c]
mov dword [ebp - 0xbc], edx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x7c], 0xfedcba98
mov dword [ebp - 0x78], 0xfedcba98
mov dword [ebp - 0x74], 0xfedcba98
mov dword [ebp - 0x70], 0xfedcba98
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x24], 0xde9
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xdea
xor eax, eax
cmp edx, 2
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x42441000
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x24], 0xdef
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xdf0
xor eax, eax
cmp edx, 2
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
lea ecx, [ebp - 0x94]
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x24], 0xdf5
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 2
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xdf6
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [esp + 0x24], 0xdfb
lea ecx, [ebp - 0x94]
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 2
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xdfc
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [esp + 0x24], 0xe01
lea ecx, [ebp - 0x94]
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0xfffffffe
mov dword [esp + 8], 0xfffffffe
mov dword [esp + 4], 1
mov dword [esp], 1
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xe02
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x70], 0xcafed00d
lea ecx, [ebp - 0x94]
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x24], 0xe07
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 1
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xe08
xor eax, eax
cmp edx, 2
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x94]
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x24], 0xe0d
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], 2
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xe0e
xor eax, eax
cmp edx, 2
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [esp + 0x24], 0xe13
lea ecx, [ebp - 0x94]
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], 4
mov dword [esp + 4], 0xfffffffc
mov dword [esp], 0xfffffffc
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xe14
xor eax, eax
cmp edx, 2
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x74], 0xfeedface
lea ecx, [ebp - 0x94]
mov dword [esp + 0x20], eax
mov eax, edi
mov dword [esp + 0x24], 0xe19
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0xfffffffe
mov dword [esp + 8], 0xfffffffe
mov dword [esp + 4], 1
mov dword [esp], 1
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov dword [ebp - 0xc0], eax
call fcn.00492bc0
mov edx, dword [ebp - 0xc0]
mov dword [eax], 0x499014
mov dword [eax + 4], 0xe1a
xor eax, eax
cmp edx, 2
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x49bc86
call fcn.00401820
mov eax, dword [ebp - 0xb4]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
mov eax, dword [ebp - 0xb0]
sub esp, 8
mov dword [esp], eax
mov eax, dword [ebp - 0xa0]
call eax
lea edx, [ebp - 0x98]
mov dword [ebp - 0x44], 2
sub esp, 4
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x4c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x9c]
mov dword [esp], edx
mov ecx, dword [ebp - 0xac]
call ecx
sub esp, 0x18
mov ebx, eax
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0xfedcba98
lea edx, [ebp - 0x94]
sub esp, 8
mov dword [ebp - 0xb0], eax
mov eax, edi
mov dword [ebp - 0x78], 0x76543210
mov dword [ebp - 0x74], 0xcafed00d
mov dword [ebp - 0x70], 0xfeedface
mov dword [esp + 0x20], ecx
mov ecx, edx
mov dword [esp + 0x24], 0xe28
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x98]
call fcn.00405ab0
mov eax, dword [ebp - 0xb0]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 8
mov dword [esp], ebx
mov eax, dword [ebp - 0xa0]
call eax
sub esp, 4
mov dword [esp], edi
mov edi, dword [ebp - 0xa4]
call edi
mov edx, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], edx
call edi
sub esp, 4
call fcn.0040c670
mov ebx, dword [0x4e4000]
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x84], 2
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x68], 2
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 2
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x50], 3
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x44], 0xff00
mov dword [ebp - 0x40], 0x80000000
mov dword [ebp - 0x3c], 0xa
mov dword [ebp - 0x38], 0xa
mov dword [ebp - 0x34], 0xff000000
mov dword [ebp - 0x30], 0x80000000
mov dword [ebp - 0x2c], 0x14
mov dword [ebp - 0x28], 0xa
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xff00ff00
test ebx, ebx
je 0x424816
mov dword [esp], 0
mov eax, dword [ebp - 0xa8]
call eax
mov edi, eax
mov eax, dword [sym.imp.msvcrt.dll_calloc]
sub esp, 4
mov dword [esp + 4], 0x34
mov dword [esp], 1
mov ebx, eax
call eax
mov dword [eax], 0x28
mov edx, eax
mov dword [eax + 8], 0x14
mov dword [eax + 4], 0x14
mov dword [eax + 0xc], 0x200001
mov dword [eax + 0x10], 0
lea eax, [ebp - 0x98]
mov dword [esp + 4], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [ebp - 0xc0], edx
mov dword [esp], edi
mov eax, dword [ebp - 0xac]
call eax
sub esp, 0x18
mov dword [ebp - 0xb0], eax
mov eax, 0xf2f
call fcn.00401020
mov dword [esp + 4], str.couldnt_create_bitmap_n
xor eax, eax
mov ecx, dword [ebp - 0xb0]
test ecx, ecx
setne al
mov dword [esp], eax
call fcn.00401820
mov eax, dword [ebp - 0xb0]
mov dword [esp + 4], eax
mov dword [ebp - 0x9c], edi
mov dword [esp], edi
call esi
lea edx, [ebp - 0x94]
sub esp, 8
mov edi, dword fs:[0x18]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x4c]
mov dword [esp + 4], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf34
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GdiGradientFill_failed_err__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xb4]
mov dword [esp], ecx
call fcn.00401820
lea edx, [ebp - 0x94]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x4c]
mov dword [esp + 4], edx
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 1
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf37
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf38
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x94]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x4c]
mov dword [esp + 4], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 8], 3
mov dword [esp], 0xdead
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf3b
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf3c
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x94]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf3f
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf40
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x94]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf42
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf43
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x94]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 8], 3
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf46
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf47
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea ecx, [ebp - 0x4c]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf4a
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf4b
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x4c]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf4e
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf4f
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x94]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf52
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf53
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x94]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf56
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf57
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0xdeadbeef
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x84], 1
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf5b
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GdiGradientFill_failed_err__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xb4]
mov dword [esp], ecx
call fcn.00401820
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x94]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf5e
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GdiGradientFill_failed_err__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xb4]
mov dword [esp], ecx
call fcn.00401820
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x4c]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf61
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf62
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x7c]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 1
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf65
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GdiGradientFill_failed_err__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xb4]
mov dword [esp], ecx
call fcn.00401820
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x4c]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 2
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf68
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GdiGradientFill_failed_err__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xb4]
mov dword [esp], ecx
call fcn.00401820
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x7c]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 3
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf6b
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GdiGradientFill_failed_err__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xb4]
mov dword [esp], ecx
call fcn.00401820
lea ecx, [ebp - 0x7c]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 4
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf6e
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf6f
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0xdeadbeef
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x50], 1
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 4
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf73
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf74
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0xdeadbeef
sete al
mov dword [esp], eax
call fcn.00401820
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x50], 0
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 4
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf78
call fcn.00401020
mov dword [esp + 4], str.GdiGradientFill_succeeded_n
xor eax, eax
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.00401820
mov eax, 0xf79
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x499ff0
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0xdeadbeef
sete al
mov dword [esp], eax
call fcn.00401820
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x58], 1
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 4
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4000]
sub esp, 0x18
mov dword [ebp - 0xb4], eax
mov eax, 0xf7d
call fcn.00401020
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GdiGradientFill_failed_err__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xb4]
mov dword [esp], ecx
call fcn.00401820
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov edi, dword [ebp - 0xa4]
call edi
mov eax, dword [ebp - 0xb0]
sub esp, 4
mov dword [esp], eax
mov eax, dword [ebp - 0xa0]
call eax
mov edx, dword [ebp - 0xc0]
sub esp, 4
mov dword [esp], edx
call dword [sym.imp.msvcrt.dll_free]
mov dword [ebp - 0x7c], 0x40201008
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x3c], edx
add eax, 4
cmp eax, 0x18
jb 0x4241f3
mov dword [ebp - 0x4c], 0x28
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], 0x200001
mov dword [esp], 0
mov eax, dword [ebp - 0xa8]
call eax
sub esp, 4
mov dword [ebp - 0xb0], eax
mov edi, eax
mov dword [esp], eax
mov eax, dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [esp + 4], 0xc
mov dword [ebp - 0xdc], eax
call eax
sub esp, 8
cmp eax, 0x20
je 0x424837
mov dword [esp], edi
mov eax, dword [ebp - 0xa4]
call eax
sub esp, 4
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xfc6
mov dword [esp], str.Skipping_32_bit_DDB_test_n
call fcn.00401290
call fcn.004128e0
mov dword [esp], 0
lea edi, [ebp - 0x4c]
call dword [sym.imp.user32.dll_GetDC]
mov ecx, 0x10
mov dword [ebp - 0x9c], eax
xor eax, eax
sub esp, 4
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0xc], 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], 2
mov eax, dword [ebp - 0xb8]
call eax
sub esp, 0x14
mov edi, eax
mov dword [ebp - 0xb0], eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xba8
xor eax, eax
test edi, edi
setne al
mov dword [esp + 4], 0x499ee0
mov dword [esp], eax
call fcn.00401820
mov dword [esp + 4], 0x428
mov dword [esp], 1
call ebx
mov edx, eax
test eax, eax
je 0x424ecf
mov eax, 0x21212121
mov ecx, 0x10a
mov edi, edx
rep stosd dword es:[edi], eax
lea ecx, [edx + 0x12]
lea eax, [edx + 0xe]
mov dword [edx + 0xe], 0
and ecx, 0xfffffffc
mov dword [edx + 0x24], 0
xor edi, edi
sub eax, ecx
add eax, 0x1a
and eax, 0xfffffffc
mov ebx, eax
xor eax, eax
mov dword [ecx + eax], edi
add eax, 4
cmp eax, ebx
jb 0x42435c
mov ecx, 1
mov dword [edx], 0x28
mov dword [edx + 4], 2
mov dword [edx + 8], 2
mov word [edx + 0xc], cx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
mov dword [ebp - 0xb4], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xb0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetDIBits]
sub esp, 0x1c
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xbb7
xor eax, eax
test edi, edi
setne al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.GetDIBits_failed_got__d_n
call fcn.00401820
mov edx, dword [ebp - 0xb4]
lea eax, [edx + 0x28]
xor ecx, ecx
cmp byte [eax], 0x21
setne cl
add eax, 1
add dword [ebp - 0xbc], ecx
mov ecx, eax
sub ecx, edx
cmp ecx, 0x427
jle 0x424401
mov dword [ebp - 0xb4], edx
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xbbc
xor eax, eax
mov dword [esp + 4], str.GetDIBits_wrote_past_the_buffer_given_n
mov edx, dword [ebp - 0xbc]
test edx, edx
sete al
mov dword [esp], eax
call fcn.00401820
mov edx, dword [ebp - 0xb4]
mov dword [esp], edx
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
mov eax, dword [ebp - 0xa0]
call eax
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.user32.dll_ReleaseDC]
sub esp, 8
mov dword [esp], 0
mov ebx, dword [ebp - 0xa8]
call ebx
sub esp, 4
mov edi, eax
mov dword [esp], 0
call ebx
mov dword [ebp - 0x3e], 0
xor ecx, ecx
mov edx, 0x1c
mov dword [ebp - 0x24], 0
sub esp, 4
mov dword [ebp - 0x9c], eax
xor eax, eax
mov dword [ebp + eax - 0x3c], ecx
add eax, 4
cmp eax, edx
jb 0x4244cd
mov eax, 1
mov dword [ebp - 0x4c], 0x28
mov word [ebp - 0x40], ax
mov dword [ebp - 0x48], 0x64
mov dword [ebp - 0x44], 0x64
mov dword [esp], edi
mov dword [esp + 4], 0xc
mov eax, dword [ebp - 0xdc]
call eax
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x3e], ax
sub esp, 8
lea eax, [ebp - 0x7c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x4c]
mov dword [esp], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
call eax
sub esp, 0x18
mov ebx, eax
call fcn.00492bc0
test ebx, ebx
mov dword [eax], 0x499014
mov dword [eax + 4], 0xf98
setne al
movzx eax, al
mov dword [esp + 4], str.Couldnt_create_destination_bitmap_n
mov dword [esp], eax
call fcn.00401820
mov dword [ebp - 0xa8], ebx
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x7c]
sub esp, 8
mov dword [esp + 4], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov ebx, dword [ebp - 0xac]
call ebx
sub esp, 0x18
mov ebx, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xf9c
xor eax, eax
test ebx, ebx
setne al
mov dword [esp + 4], str.Couldnt_create_source_bitmap_n
mov dword [esp], eax
call fcn.00401820
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call esi
mov edx, dword [sym.imp.gdi32.dll_BitBlt]
sub esp, 8
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0x64
mov eax, dword [ebp - 0x9c]
mov dword [esp], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], 0x64
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [ebp - 0xac], edx
call edx
sub esp, 0x24
mov esi, eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xfa0
mov dword [esp], esi
mov dword [esp + 4], 0x49bdc8
call fcn.00401820
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.gdi32.dll_CreateRectRgn]
sub esp, 0x10
mov esi, eax
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.gdi32.dll_SelectClipRgn]
sub esp, 8
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], 0x64
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edx, dword [ebp - 0xac]
call edx
sub esp, 0x24
mov dword [ebp - 0xac], eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xfa6
mov dword [esp + 4], 0x49bdc8
mov edx, dword [ebp - 0xac]
mov dword [esp], edx
call fcn.00401820
mov ecx, dword [ebp - 0xa8]
mov dword [esp], ecx
mov ecx, dword [ebp - 0xa0]
call ecx
sub esp, 4
mov dword [esp], ebx
mov ebx, dword [ebp - 0xa0]
call ebx
sub esp, 4
mov dword [esp], esi
call ebx
sub esp, 4
mov dword [esp], edi
mov esi, dword [ebp - 0xa4]
call esi
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], eax
call esi
mov eax, 0x10
sub esp, 4
call fcn.0041ff00
mov eax, 0x18
call fcn.0041ff00
mov eax, 0x20
call fcn.0041ff00
call fcn.0040def0
call fcn.00405c50
call fcn.004088d0
call fcn.0040a400
call fcn.00420910
call fcn.00413ba0
call fcn.00410800
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00418f40
mov ecx, 0x10ff0001
mov eax, 0x6e5
mov edi, 2
mov dword [esp], 0xffffff
mov edx, dword [ebp - 0x9c]
call fcn.00402b30
jmp 0x4221c7
lea eax, [ebp - 0x4c]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.gdi32.dll_GetPaletteEntries]
sub esp, 0x10
jmp 0x422216
mov eax, 0xf22
call fcn.00401020
mov dword [esp], str.GdiGradientFill_is_not_implemented_n
call fcn.004017f0
mov ebx, dword [sym.imp.msvcrt.dll_calloc]
jmp 0x4241e8
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
mov edx, dword [ebp - 0xa8]
call edx
sub esp, 4
mov edi, eax
lea eax, [ebp - 0x7c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 1
mov ecx, dword [ebp - 0xb8]
call ecx
sub esp, 0x14
mov dword [ebp - 0xc0], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call esi
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xb0]
sub esp, 8
mov dword [esp], eax
mov edx, dword [ebp - 0xa8]
call edx
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x94]
sub esp, 4
mov dword [esp + 4], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [ebp - 0x9c], eax
mov dword [esp], eax
mov edx, dword [ebp - 0xac]
call edx
sub esp, 0x18
mov dword [ebp - 0xc8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [ebp - 0xcc], eax
mov dword [esp + 0x28], 0xcc0020
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StretchBlt]
sub esp, 0x2c
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xfd3
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], str.Expected_color_lx__received_color_lx_n
cmp edx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], edx
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov eax, dword [0x4e4004]
test eax, eax
je 0x424b4c
mov edx, dword [ebp - 0x94]
mov dword [edx], 0x80808080
mov dword [esp + 0x28], 0x800000
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov ecx, dword [ebp - 0x9c]
mov dword [esp], ecx
call eax
sub esp, 0x2c
mov dword [ebp - 0xb4], eax
mov eax, 0xfe0
call fcn.00401020
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x34]
mov dword [ebp - 0xd0], ecx
mov dword [esp + 4], str.GdiAlphaBlend_failed_err__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0xb4]
mov dword [esp], edx
call fcn.00401820
mov eax, 0xfe1
call fcn.00401020
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [esp + 4], 0x49bd34
cmp eax, 0x60504844
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov eax, dword [ebp - 0x94]
mov dword [eax], 0x80808080
mov dword [esp + 0x28], 0x1800000
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [0x4e4004]
sub esp, 0x2c
mov dword [ebp - 0xb4], eax
mov eax, 0xfe5
call fcn.00401020
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ecx + 0x34]
mov dword [esp + 4], str.GdiAlphaBlend_failed_err__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0xb4]
mov dword [esp], edx
call fcn.00401820
mov eax, 0xfe6
call fcn.00401020
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [esp + 4], 0x49bd34
cmp eax, 0x90807874
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov edx, dword [sym.imp.gdi32.dll_CreateDIBPatternBrushPt]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x24], 0x20304050
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0xe0], edx
call edx
sub esp, 8
mov dword [ebp - 0xb4], eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xfec
xor eax, eax
mov dword [esp + 4], str.brush_creation_failed_n
mov edx, dword [ebp - 0xb4]
test edx, edx
setne al
mov dword [esp], eax
call fcn.00401820
mov eax, dword [ebp - 0xb4]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
mov edx, dword [sym.imp.gdi32.dll_PatBlt]
sub esp, 8
mov dword [esp], edi
mov dword [esp + 0x14], 0xf00021
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [ebp - 0xd0], edx
call edx
mov ecx, dword [sym.imp.gdi32.dll_BitBlt]
sub esp, 0x18
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov dword [ebp - 0xd4], ecx
call ecx
sub esp, 0x24
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xff0
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], str.Expected_color_lx__received_color_lx_n
cmp ecx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ecx
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov edx, dword [sym.imp.gdi32.dll_GetStockObject]
mov dword [esp], 4
mov dword [ebp - 0xd8], edx
call edx
sub esp, 4
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
mov ecx, dword [ebp - 0xb4]
sub esp, 8
mov dword [esp], ecx
mov ecx, dword [ebp - 0xa0]
call ecx
mov ecx, 0x18
lea eax, [ebp - 0x4c]
sub esp, 4
mov word [ebp - 0x3e], cx
mov dword [esp + 4], 0
mov dword [esp], eax
mov edx, dword [ebp - 0xe0]
call edx
sub esp, 8
mov dword [ebp - 0xb4], eax
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xff6
xor eax, eax
mov dword [esp + 4], str.brush_creation_failed_n
mov edx, dword [ebp - 0xb4]
test edx, edx
setne al
mov dword [esp], eax
call fcn.00401820
mov edx, dword [ebp - 0xb4]
mov dword [esp], edi
mov dword [esp + 4], edx
call esi
sub esp, 8
mov dword [esp], edi
mov dword [esp + 0x14], 0xf00021
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edx, dword [ebp - 0xd0]
call edx
sub esp, 0x18
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov ecx, dword [ebp - 0xd4]
call ecx
sub esp, 0x24
call fcn.00492bc0
mov dword [eax], 0x499014
mov dword [eax + 4], 0xffa
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], str.Expected_color_lx__received_color_lx_n
mov ecx, eax
and eax, 0xffffff
mov dword [esp + 0xc], edx
and ecx, 0xff000000
cmp eax, edx
sete al
mov dword [esp + 8], ecx
movzx eax, al
mov dword [esp], eax
call fcn.00401820
mov dword [esp], 4
mov edx, dword [ebp - 0xd8]
call edx
sub esp, 4
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
mov edx, dword [ebp - 0xb4]
sub esp, 8
mov dword [esp], edx
mov ecx, dword [ebp - 0xa0]
call ecx
mov edx, dword [ebp - 0xcc]
sub esp, 4
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0xc8]
sub esp, 8
mov dword [esp], edx
mov ecx, dword [ebp - 0xa0]
call ecx
mov eax, dword [ebp - 0x9c]
sub esp, 4
mov dword [esp], eax
mov eax, dword [ebp - 0xa4]
call eax
mov edx, dword [ebp - 0xc4]
sub esp, 4
mov dword [esp + 4], edx
mov dword [esp], edi
call esi
mov edx, dword [ebp - 0xc0]
sub esp, 8
mov dword [esp], edx
mov ecx, dword [ebp - 0xa0]
call ecx
sub esp, 4
mov dword [esp], edi
mov edi, dword [ebp - 0xa4]
call edi
mov eax, dword [ebp - 0xb0]
sub esp, 4
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x424285
mov dword [esp + 8], 0x6d2
mov dword [esp + 4], str..._dlls_gdi32_tests_bitmap.c
mov dword [esp], 0x49bad4
call dword [sym.imp.msvcrt.dll__assert]
mov dword [esp + 8], 0xbab
mov dword [esp + 4], str..._dlls_gdi32_tests_bitmap.c
mov dword [esp], str.info
call dword [sym.imp.msvcrt.dll__assert]
mov dword [esp + 8], 0x6d5
mov dword [esp + 4], str..._dlls_gdi32_tests_bitmap.c
mov dword [esp], str.hbmp___NULL
call dword [sym.imp.msvcrt.dll__assert]
nop
nop
nop
nop
nop
nop
nop