Function at 0x40b9b0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
push edi
cmp byte [esi], 0
je 0x40bff4
mov ebx, dword [esp + 0x58]
lea eax, [esp + 0x5c]
push eax
push esi
mov ecx, dword [ebx + 0x10]
push ecx
call fcn.0042d9b0
test eax, eax
jne 0x40ba02
mov edx, dword [0x444900]
push 0x2c
push edx
call fcn.0042d3b0
test eax, eax
mov dword [esp + 0x5c], eax
je 0x40bff4
push 1
push eax
mov eax, dword [ebx + 0x10]
push esi
push eax
call fcn.0042da50
mov ecx, dword [esp + 0x5c]
cmp dword [ecx], 0
jne 0x40ba30
mov edx, dword [ebx + 4]
push 0
push 0x30
push 0x11
push 0x28
push esi
push edx
call fcn.0042a840
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x40bff4
mov ecx, dword [esp + 0x5c]
mov dword [ecx], eax
mov edx, dword [esp + 0x5c]
mov dword [edx + 0xc], 1
mov eax, dword [esp + 0x5c]
cmp dword [eax], 2
jne 0x40bd68
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x40bcb0
mov ecx, dword [eax]
mov edi, eax
cmp ecx, 7
jg case.0x40bb99.5
cmp ecx, 2
jl case.0x40bb99.5
mov edx, dword [eax + 4]
lea ebp, [eax + 4]
test edx, edx
mov dword [esp + 0x10], ebp
jne 0x40baab
cmp ecx, 7
jne 0x40ba8c
add eax, 8
push eax
mov eax, dword [ebx + 4]
push esi
push eax
call fcn.0042a600
jmp 0x40ba9c
mov ecx, dword [ebx + 4]
add eax, 8
push eax
push 0x11
push esi
push ecx
call fcn.0042a590
test eax, eax
mov dword [ebp], eax
je 0x40bca1
mov eax, dword [esp + 0x5c]
cmp dword [edi], 2
jne 0x40bb73
mov ecx, dword [ebp]
cmp dword [ecx], 0x9ac6cdd7
jne 0x40bae7
movsx edx, word [ecx + 6]
mov esi, dword [ecx + 0x1c]
mov dword [edi + 0x1c], edx
movsx eax, word [ecx + 8]
mov dword [edi + 0x20], eax
mov ebx, 0x16
movsx edx, word [ecx + 0xa]
mov dword [edi + 0x24], edx
movsx eax, word [ecx + 0xc]
shl esi, 1
mov dword [edi + 0x28], eax
jmp 0x40bb00
mov dx, word [ecx]
cmp dx, 1
je 0x40baf9
test dx, dx
jne case.0x40bb99.5
mov esi, dword [ecx + 6]
shl esi, 1
xor ebx, ebx
mov ecx, dword [edi + 8]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x64], eax
je 0x40bca1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x40bb33
mov edx, dword [esp + 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40bca1
mov ecx, dword [ebp]
xor edx, edx
add ecx, ebx
test esi, esi
jbe 0x40bb49
mov bl, byte [ecx]
inc ecx
mov byte [edx + eax], bl
inc edx
cmp edx, esi
jb 0x40bb3e
push eax
push esi
call dword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
test eax, eax
mov dword [edi + 0x10], eax
jne 0x40bc7a
mov esi, dword [esp + 0x64]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40bca1
mov esi, dword [ebp]
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne case.0x40bb99.5
xor ecx, ecx
mov cx, word [esi + 0xe]
dec ecx
cmp ecx, 0x1f
ja case.0x40bb99.5
xor edx, edx
mov dl, byte [ecx + 0x40c7c4]
jmp dword [edx*4 + 0x40c7b0]
mov eax, 8
jmp 0x40bbc9
mov eax, 0x40
jmp 0x40bbb3
mov eax, 0x400
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x40bbc9
lea eax, [ecx*4]
jmp 0x40bbc9
mov eax, dword [esi + 0x20]
shl eax, 2
mov ecx, dword [esi + 4]
mov ebp, dword [esp + 0x58]
mov dword [edi + 0x24], ecx
mov edx, dword [esi + 8]
xor ecx, ecx
mov dword [edi + 0x28], edx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov ebx, dword [esi]
add ebx, esi
add ebx, eax
lea eax, [esp + 0x70]
push eax
push ecx
mov ecx, dword [ebp]
push 0x36
push ecx
call fcn.00403c00
push 0
mov edx, dword [esp + 0x74]
and edx, 0x40
mov dword [ebp + 8], edx
mov dword [edi + 0x18], 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
mov eax, dword [esp + 0x58]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x40bc5c
cmp dword [eax + 0x10], 1
je 0x40bc5c
mov eax, dword [edi]
cmp eax, 3
je 0x40bc48
cmp eax, 7
je 0x40bc48
cmp eax, 6
jne 0x40bc43
mov ecx, dword [esp + 0x58]
mov edx, dword [ecx + 8]
test edx, edx
jne 0x40bc48
cmp eax, 4
jne 0x40bc5c
mov edx, dword [esp + 0x64]
push 1
push ebp
push edx
mov dword [edi + 0x18], 1
call fcn.00405190
push 0
push esi
push ebx
push 4
push esi
push ebp
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push ebp
push 0
mov dword [edi + 0x14], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
test eax, eax
je 0x40bca1
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x40bca1
push 0
push 0x28
push eax
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 4]
push ecx
call fcn.0042a800
mov dword [ebp], 0
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x40bfdb
mov esi, dword [esp + 0x60]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_SaveDC]
lea ebx, [edi + 0x1c]
mov ebp, eax
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x40bd46
push 8
push esi
call dword [sym.imp.GDI32.dll_SetMapMode]
mov ecx, dword [edi + 0x20]
mov edx, dword [ebx]
push 0
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov eax, dword [edi + 0x28]
push 0
cdq
mov ecx, eax
mov eax, dword [edi + 0x20]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ecx, eax
mov eax, dword [edi + 0x24]
cdq
push ecx
mov ecx, eax
mov eax, dword [ebx]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ecx, eax
push ecx
push esi
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
mov ebx, dword [esp + 0x70]
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
sub ecx, eax
mov eax, dword [ebx]
push 0
sub edx, eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov eax, dword [edi + 0x10]
push eax
push esi
call dword [sym.imp.GDI32.dll_PlayMetaFile]
push ebp
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0x1c
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x40c000
mov ecx, dword [eax]
mov edi, eax
cmp ecx, 7
jg case.0x40bec4.5
cmp ecx, 2
jl case.0x40bec4.5
mov edx, dword [eax + 4]
lea ebp, [eax + 4]
test edx, edx
mov dword [esp + 0x10], ebp
jne 0x40bdcb
cmp ecx, 7
jne 0x40bdac
mov ecx, dword [ebx + 4]
add eax, 8
push eax
push esi
push ecx
call fcn.0042a600
jmp 0x40bdbc
mov edx, dword [ebx + 4]
add eax, 8
push eax
push 0x11
push esi
push edx
call fcn.0042a590
test eax, eax
mov dword [ebp], eax
je 0x40bfcc
mov eax, dword [esp + 0x5c]
cmp dword [edi], 2
jne 0x40be9e
mov ecx, dword [ebp]
cmp dword [ecx], 0x9ac6cdd7
jne 0x40be0a
movsx eax, word [ecx + 6]
mov esi, dword [ecx + 0x1c]
mov dword [edi + 0x1c], eax
movsx edx, word [ecx + 8]
mov dword [edi + 0x20], edx
mov dword [esp + 0x10], 0x16
movsx eax, word [ecx + 0xa]
mov dword [edi + 0x24], eax
movsx ecx, word [ecx + 0xc]
shl esi, 1
mov dword [edi + 0x28], ecx
jmp 0x40be29
mov dx, word [ecx]
cmp dx, 1
je 0x40be1c
test dx, dx
jne case.0x40bec4.5
mov esi, dword [ecx + 6]
mov dword [esp + 0x10], 0
shl esi, 1
mov edx, dword [edi + 8]
push edx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x18], ebx
je 0x40bfcc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x40be5a
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40bfcc
mov ecx, dword [ebp]
mov edx, dword [esp + 0x10]
add ecx, edx
xor edx, edx
test esi, esi
jbe 0x40be78
mov bl, byte [ecx]
inc ecx
mov byte [edx + eax], bl
inc edx
cmp edx, esi
jb 0x40be69
mov ebx, dword [esp + 0x18]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
test eax, eax
mov dword [edi + 0x10], eax
jne 0x40bfa5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40bfcc
mov esi, dword [ebp]
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne case.0x40bec4.5
xor ecx, ecx
mov cx, word [esi + 0xe]
dec ecx
cmp ecx, 0x1f
ja case.0x40bec4.5
xor edx, edx
mov dl, byte [ecx + 0x40c7f8]
jmp dword [edx*4 + 0x40c7e4]
mov eax, 8
jmp 0x40bef4
mov eax, 0x40
jmp 0x40bede
mov eax, 0x400
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x40bef4
lea eax, [ecx*4]
jmp 0x40bef4
mov eax, dword [esi + 0x20]
shl eax, 2
mov ecx, dword [esi + 4]
mov ebp, dword [esp + 0x58]
mov dword [edi + 0x24], ecx
mov edx, dword [esi + 8]
xor ecx, ecx
mov dword [edi + 0x28], edx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov ebx, dword [esi]
add ebx, esi
add ebx, eax
lea eax, [esp + 0x18]
push eax
push ecx
mov ecx, dword [ebp]
push 0x36
push ecx
call fcn.00403c00
push 0
mov edx, dword [esp + 0x1c]
and edx, 0x40
mov dword [ebp + 8], edx
mov dword [edi + 0x18], 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
mov eax, dword [esp + 0x58]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x40bf87
cmp dword [eax + 0x10], 1
je 0x40bf87
mov eax, dword [edi]
cmp eax, 3
je 0x40bf73
cmp eax, 7
je 0x40bf73
cmp eax, 6
jne 0x40bf6e
mov ecx, dword [esp + 0x58]
mov edx, dword [ecx + 8]
test edx, edx
jne 0x40bf73
cmp eax, 4
jne 0x40bf87
mov edx, dword [esp + 0x64]
push 1
push ebp
push edx
mov dword [edi + 0x18], 1
call fcn.00405190
push 0
push esi
push ebx
push 4
push esi
push ebp
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push ebp
push 0
mov dword [edi + 0x14], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
test eax, eax
je 0x40bfcc
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x40bfcc
push 0
push 0x28
push eax
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 4]
push ecx
call fcn.0042a800
mov dword [ebp], 0
mov eax, dword [esp + 0x5c]
mov ebx, dword [esp + 0x58]
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x40c000
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x64]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0x1c
mov esi, dword [esp + 0x68]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20
push esi
call fcn.00408d60
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
push 0
push 0x33
push esi
mov dword [esp + 0x28], ebp
call fcn.00408d60
push 0
push 0
push 0
push esi
call fcn.00408d60
cmp eax, 0xffff
je 0x40c044
cmp eax, 0xfffe
jne 0x40c04c
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x60]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push edi
mov dword [esp + 0x14], esi
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x40c090
cmp dword [eax + 0x10], 1
je 0x40c090
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x40c090
mov ecx, dword [esp + 0x64]
push 1
push esi
push ecx
call fcn.00405190
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 0x14]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [sym.imp.USER32.dll_CopyRect]
lea edx, [esp + 0x24]
mov ecx, dword [esp + 0x5c]
add ecx, 0x1c
push ecx
push edx
call edi
cmp ebp, 0x400
mov esi, dword [esp + 0x6c]
ja 0x40c254
cmp ebp, 0x400
je 0x40c1b7
mov eax, ebp
sub eax, 0
je 0x40c0e9
mov ecx, 2
sub eax, ecx
je 0x40c1bc
jmp 0x40c25c
lea eax, [esp + 0x34]
push esi
push eax
call edi
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
sub eax, ebp
sub ecx, edi
cmp ecx, eax
jge 0x40c10b
mov eax, ecx
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x30]
sub edx, ecx
mov ecx, dword [esp + 0x28]
sub ebx, ecx
cmp ebx, edx
jl 0x40c125
mov ebx, edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x6c], ebx
add edx, eax
lea ebp, [eax + edi]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x6c]
add ebx, ecx
add eax, edx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x70]
cmp eax, 2
mov dword [esp + 0x30], ebx
jne 0x40c218
mov dword [esp + 0x6c], ecx
add ecx, 0xfffffffe
sub ebp, 2
sub ebx, 2
xor edx, edx
mov eax, edi
test ecx, ecx
setl dl
dec edx
add edi, 0xfffffffe
and ecx, edx
xor edx, edx
test edi, edi
setl dl
dec edx
mov dword [esp + 0x2c], ebp
and edi, edx
mov dword [esp + 0x30], ebx
mov edx, edi
mov dword [esp + 0x28], ecx
sub edx, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], edi
lea edx, [eax + edx + 2]
mov eax, ecx
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x6c]
sub eax, edx
mov edx, dword [esp + 0x38]
lea eax, [edx + eax + 2]
mov dword [esp + 0x38], eax
jmp 0x40c218
mov ecx, 2
mov eax, dword [esp + 0x70]
cmp eax, ecx
jne 0x40c1ee
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
lea eax, [edx - 2]
cmp eax, ecx
jl 0x40c1d7
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffffe
cmp eax, ecx
jge 0x40c1e8
mov dword [esp + 0x30], ecx
jmp 0x40c1fb
mov dword [esp + 0x30], eax
jmp 0x40c1fb
cmp eax, 1
jne 0x40c1fb
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x60]
push 3
push ecx
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
cmp eax, 1
mov eax, dword [esp + 0x18]
jne 0x40c625
test ah, 8
jne 0x40c625
mov ecx, dword [esp + 0x5c]
and eax, 0x402
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], ecx
je 0x40c350
lea edx, [esp + 0x44]
push esi
push edx
jmp 0x40c35a
cmp ebp, 0x800
je 0x40c208
lea edx, [esp + 0x34]
push esi
push edx
call edi
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov eax, edx
sub eax, ecx
cmp ebp, eax
jle 0x40c291
mov eax, ecx
sub eax, edx
add eax, ebp
cdq
sub eax, edx
mov edi, eax
sar edi, 1
sub ebp, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], ebp
jmp 0x40c2a2
sub eax, ebp
mov edi, dword [esp + 0x24]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
mov eax, ecx
sub eax, ebx
mov ebx, dword [esp + 0x30]
cmp ebx, eax
jle 0x40c2d1
mov eax, dword [esp + 0x38]
sub eax, ecx
add eax, ebx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
sub ebx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ebx
jmp 0x40c2e6
mov ecx, dword [esp + 0x38]
sub eax, ebx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x70], 2
jne 0x40c218
mov dword [esp + 0x6c], ecx
add ecx, 0xfffffffe
sub ebp, 2
sub ebx, 2
xor edx, edx
mov eax, edi
test ecx, ecx
setl dl
dec edx
add edi, 0xfffffffe
and ecx, edx
xor edx, edx
test edi, edi
setl dl
dec edx
mov dword [esp + 0x2c], ebp
and edi, edx
mov dword [esp + 0x30], ebx
mov edx, edi
mov dword [esp + 0x28], ecx
sub edx, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], edi
lea edx, [eax + edx + 2]
mov eax, ecx
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x6c]
sub eax, edx
mov edx, dword [esp + 0x38]
lea eax, [edx + eax + 2]
mov dword [esp + 0x38], eax
jmp 0x40c218
lea eax, [esp + 0x24]
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
lea edx, [esp + 0x6c]
mov eax, dword [esp + 0x68]
push edx
push 0
push 0x1f
push eax
call fcn.00408d60
mov ebp, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, dword [esp + 0x60]
push ebx
call ebp
mov edi, eax
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
sub ecx, eax
mov eax, dword [esp + 0x44]
push ecx
sub edx, eax
push edx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov dword [esp + 0x70], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call ebp
mov ebp, eax
push 0
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
push 1
sub eax, edx
push 1
push eax
mov eax, dword [esp + 0x54]
sub ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
push ebp
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x58]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x40c423
cmp dword [eax + 0x10], 1
je 0x40c423
mov eax, dword [esp + 0x70]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x40c423
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x64]
push 1
push ecx
push edx
call fcn.00405190
push 1
push edi
mov eax, dword [esp + 0x6c]
push eax
call fcn.00405190
or dword [esp + 0x6c], 0x2000000
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xcc0020
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40c52e
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x2c]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 8]
push ecx
mov ecx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 4]
sub ecx, eax
push ecx
mov ecx, dword [esi]
sub edx, ecx
push edx
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0x8800c6
push 0
push 0
sub edx, eax
push ebp
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xcc0020
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x2c]
sub edx, ecx
push edx
mov edx, dword [esi + 8]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 4]
sub ecx, eax
mov eax, dword [esi]
sub edx, eax
push ecx
push edx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
push 0x220326
sub eax, edx
mov edx, dword [esi]
push 0
push 0
push ebp
sub ecx, edx
push eax
push ecx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0xee0086
push 0
push 0
sub edx, eax
push edi
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x40c600
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
mov edx, dword [esp + 0x40]
mov esi, dword [sym.imp.GDI32.dll_BitBlt]
sub edx, eax
mov eax, dword [esp + 0x3c]
sub eax, ecx
push edx
push eax
push 0
push 0
push ebp
call esi
push 0x8800c6
push 0
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
push 0
sub ecx, eax
mov eax, dword [esp + 0x44]
push ebp
push ecx
mov ecx, dword [esp + 0x38]
sub edx, ecx
mov ecx, dword [esp + 0x48]
push edx
push eax
push ecx
push ebx
call esi
push 0xcc0020
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
mov edx, dword [esp + 0x40]
sub edx, eax
mov eax, dword [esp + 0x3c]
sub eax, ecx
push edx
push eax
push 0
push 0
push edi
call esi
push 0x220326
push 0
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
sub ecx, eax
mov eax, dword [esp + 0x2c]
push 0
push ebp
sub edx, eax
push ecx
push edx
push 0
push 0
push edi
call esi
push 0xee0086
push 0
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push 0
sub eax, edx
mov edx, dword [esp + 0x44]
push edi
push eax
sub ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x4c]
push edx
push eax
push ebx
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebp
call esi
push edi
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x68]
push ecx
call esi
mov edx, dword [esp + 0x1c]
push edx
call esi
jmp 0x40c785
test al, 2
jne 0x40c752
test ah, 4
jne 0x40c752
test ah, 8
je 0x40c729
mov eax, dword [esi + 8]
mov edx, dword [esi]
sub eax, edx
sub ebp, edi
cdq
idiv ebp
mov dword [esp + 0x64], 0
test eax, eax
jl 0x40c785
jmp 0x40c661
mov ebx, dword [esp + 0x30]
mov edi, dword [esi + 0xc]
mov ebp, dword [esi + 4]
mov eax, edi
sub ebx, ecx
sub eax, ebp
mov dword [esp + 0x58], 0
cdq
idiv ebx
test eax, eax
jl 0x40c702
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x1c]
sub ecx, edx
mov edx, dword [esi]
mov dword [esp + 0x58], ecx
imul ecx, dword [esp + 0x64]
add ecx, edx
mov edx, dword [eax + 0x28]
sub edx, dword [eax + 0x20]
mov eax, edx
imul eax, ebx
add eax, ebp
sub edi, eax
cmp edi, edx
jge 0x40c6b2
mov edx, edi
mov edi, dword [esi + 8]
mov ebp, dword [esp + 0x58]
sub edi, ecx
cmp edi, ebp
jge 0x40c6c1
mov ebp, edi
mov edi, dword [esp + 0x10]
push 0xcc0020
push 0
push 0
push edi
push edx
push ebp
push eax
mov eax, dword [esp + 0x7c]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov edi, dword [esi + 0xc]
mov ebp, dword [esi + 4]
mov ecx, dword [esp + 0x28]
inc ebx
mov eax, edi
mov dword [esp + 0x58], ebx
mov ebx, dword [esp + 0x30]
sub eax, ebp
cdq
sub ebx, ecx
idiv ebx
mov ebx, dword [esp + 0x58]
cmp ebx, eax
jle 0x40c684
mov eax, dword [esi + 8]
mov edx, dword [esi]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
sub eax, edx
sub ebx, ebp
cdq
idiv ebx
mov edi, dword [esp + 0x64]
inc edi
mov dword [esp + 0x64], edi
cmp edi, eax
jle 0x40c65d
jmp 0x40c785
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
push 0xcc0020
push ecx
push edi
sub ebx, ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x70]
sub ebp, edi
push ebx
push ebp
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x40c785
mov eax, dword [esi + 4]
sub ebx, ecx
push 0xcc0020
sub ebp, edi
push ebx
push ebp
push ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esi]
push edi
push ecx
mov ecx, dword [esi + 0xc]
sub ecx, eax
push ecx
mov ecx, dword [esi + 8]
sub ecx, edx
push ecx
push eax
push edx
mov edx, dword [esp + 0x88]
push edx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x60]
push eax
push ecx
call dword [sym.imp.GDI32.dll_RestoreDC]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0x1c