Function at 0x10007760
Capabilities:
Capture screenshot
Create thread

Disassembly:
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2b4], 0
jne 0x10007738
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x1c], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000720b
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x288]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x290]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x254]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], 0
jmp 0x100072d3
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
cmp edx, dword [ecx + 0x2a8]
jge 0x100074ad
mov dword [ebp - 0x28], 0
jmp 0x100072f7
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
cmp edx, dword [ecx + 0x2a4]
jge 0x100074a8
push 0xcc0020
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x30
push eax
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x30
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x30
push 0x30
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x25c
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x258]
push eax
push 0x30
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x290]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x258]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24c]
shr edx, 2
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x28]
and eax, reloc.WS2_32.dll_accept
jns 0x10007390
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x264]
sub edx, eax
mov dword [ebp - 0x34], edx
mov ebx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebx + ecx*4 - 4]
xor eax, dword [edx + ecx*4 - 4]
je 0x10007452
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x270]
mov edx, dword [ebp - 4]
mov esi, dword [edx + 0x258]
mov edi, dword [ebp - 0x10]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0x24]
push ecx
push 0x30
push 0x30
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x29c]
imul eax, eax, 0x30
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x30
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x29c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x294]
mov word [eax + ecx*4], dx
mov ecx, dword [ebp - 0x20]
imul ecx, ecx, 0x30
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x29c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x294]
mov word [edx + eax*4 + 2], cx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x29c]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x29c], ecx
jmp 0x10007490
dec ecx
jne 0x100073a7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24c]
mov edx, dword [ebp - 0x2c]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24c]
mov eax, dword [ebp - 0x30]
lea ecx, [eax + edx*2]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x34]
sub edx, 2
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
jg 0x1000739e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x270]
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 0x21]
mov dword [ebp - 0x10], eax
jmp 0x100072ee
jmp 0x100072ca
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x29c], 0
jle 0x1000770f
push 0x30
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x29c]
imul edx, edx, 0x30
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x30
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x29c]
imul eax, eax, 0x30
push eax
push 0
push 0
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2b0]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100076f0
mov eax, dword [ebp - 4]
mov dword [eax + 0x330], 0
mov dword [eax + 0x334], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x338], 0
mov dword [ecx + 0x33c], 0
mov edx, dword [ebp - 4]
add edx, 0x330
push edx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x33c]
push ecx
mov edx, dword [eax + 0x338]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x348]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x348]
mov edx, dword [eax]
push ecx
call dword [edx + 0x14]
push 0
mov eax, dword [ebp - 0x3c]
push eax
call fcn.100087c0
add esp, 8
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x348]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 4]
add eax, 0x2cc
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2bc
push ecx
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 4]
push ecx
call fcn.10011032
push eax
mov ecx, dword [ebp - 0x44]
call fcn.100087a0
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x1000762f
push 1
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x48]
call dword [edx]
mov dword [ebp - 0x54], eax
jmp 0x10007636
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x330], 0
mov dword [ecx + 0x334], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x338], 0
mov dword [edx + 0x33c], 0
mov eax, dword [ebp - 4]
add eax, 0x330
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x33c]
push edx
mov eax, dword [ecx + 0x338]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x348]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x348]
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x29c]
mov dword [ecx + 0x2a0], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x2a0]
shl ecx, 2
mov edx, dword [ebp - 4]
mov esi, dword [edx + 0x294]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x298]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2b0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x29c], 0
jmp 0x10007719
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
and byte [ecx], al
adc byte [ebx - 0xaf1bbb], cl
adc eax, sym.imp.USER32.dll_SetThreadDesktop
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 0xa]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100071c9
mov ecx, dword [ebp - 4]
add ecx, 0x134
call fcn.10004c50
mov ecx, dword [ebp - 4]
add ecx, 0x20
call fcn.10004c50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
mov dword [ebp - 0x264], ecx
push eax
xor eax, eax
je 0x1000777e
jae 0x10007716
mov eax, dword [0x8458b58]
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f41
mov ecx, dword [ebp - 0x264]
add ecx, 0x134
call fcn.10004ab0
test eax, eax
je 0x100077b8
mov ecx, dword [ebp + 8]
push ecx
push 0x1f53
mov ecx, dword [ebp - 0x264]
add ecx, 0x20
call fcn.10004ab0
test eax, eax
jne 0x100077bf
xor eax, eax
jmp 0x1000831b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x224], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100077f4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0x220], eax
push 8
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x18], eax
push 0xa
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 0x264]
mov eax, dword [edx + 0x18]
cdq
mov ecx, 0x30
idiv ecx
test edx, edx
jne 0x1000786f
mov edx, dword [ebp - 0x264]
mov eax, dword [edx + 0x18]
cdq
mov ecx, 0x30
idiv ecx
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x2a4], eax
jmp 0x1000788f
mov eax, dword [ebp - 0x264]
mov eax, dword [eax + 0x18]
cdq
mov ecx, 0x30
idiv ecx
add eax, 1
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x2a4], eax
mov eax, dword [ebp - 0x264]
mov eax, dword [eax + 0x1c]
cdq
mov ecx, 0x30
idiv ecx
test edx, edx
jne 0x100078c3
mov edx, dword [ebp - 0x264]
mov eax, dword [edx + 0x1c]
cdq
mov ecx, 0x30
idiv ecx
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x2a8], eax
jmp 0x100078e3
mov eax, dword [ebp - 0x264]
mov eax, dword [eax + 0x1c]
cdq
mov ecx, 0x30
idiv ecx
add eax, 1
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x2a8], eax
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x264]
mov edx, dword [eax + 0x2a4]
imul edx, dword [ecx + 0x2a8]
shl edx, 2
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x240]
mov dword [eax + 0x298], ecx
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x264]
mov ecx, dword [edx + 0x2a4]
imul ecx, dword [eax + 0x2a8]
shl ecx, 2
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x244], eax
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x244]
mov dword [edx + 0x294], eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x288], eax
push 0x30
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x264]
mov ecx, dword [edx + 0x2a4]
imul ecx, dword [eax + 0x2a8]
imul ecx, ecx, 0x30
push ecx
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x28c], eax
push 0x30
push 0x30
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x290], eax
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x25c], 0x28
mov eax, dword [ebp - 0x264]
mov dword [eax + 0x260], 0x30
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x264], 0x30
mov edx, dword [ebp - 0x264]
mov word [edx + 0x268], 1
mov eax, dword [ebp - 0x264]
mov word [eax + 0x26a], 0x18
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x26c], 0
push 0
mov edx, dword [ebp - 0x264]
add edx, 0x25c
push edx
push 0
push 0x30
push 0
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x290]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov eax, dword [ebp - 0x264]
mov eax, dword [eax + 0x270]
xor edx, edx
mov ecx, 0x30
div ecx
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x24c], eax
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x24c]
shr ecx, 1
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x250], ecx
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x264]
mov edx, dword [eax + 0x270]
imul edx, dword [ecx + 0x2a4]
mov eax, dword [ebp - 0x264]
imul edx, dword [eax + 0x2a8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x344], eax
mov edx, dword [ebp - 0x264]
add edx, 0x348
push edx
push 0
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x344]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x264]
mov ecx, dword [edx + 0x270]
imul ecx, dword [eax + 0x2a4]
mov edx, dword [ebp - 0x264]
imul ecx, dword [edx + 0x2a8]
mov eax, dword [ebp - 0x264]
mov dword [eax + 0x330], ecx
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x334]
push edx
mov eax, dword [ecx + 0x330]
push eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x348]
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x348]
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x344]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x340], eax
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x264]
mov ecx, dword [edx + 0x2a4]
imul ecx, dword [eax + 0x2a8]
mov edx, dword [ebp - 0x264]
imul ecx, dword [edx + 0x270]
mov eax, dword [ebp - 0x264]
mov edx, dword [ebp - 0x264]
mov eax, dword [eax + 0x2a4]
imul eax, dword [edx + 0x2a8]
imul eax, eax, 0x21
add ecx, eax
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 0x248]
mov dword [ecx + 0x254], edx
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x264]
mov edx, dword [eax + 0x2a4]
imul edx, dword [ecx + 0x2a8]
mov eax, dword [ebp - 0x264]
imul edx, dword [eax + 0x270]
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ecx + 0x2a4]
imul ecx, dword [eax + 0x2a8]
imul ecx, ecx, 0x21
add ecx, edx
xor eax, eax
mov edx, dword [ebp - 0x264]
mov edi, dword [edx + 0x254]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x270]
add ecx, 0x21
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x24c], eax
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x24c]
mov dword [edx + 0x258], eax
mov ecx, dword [ebp - 0x264]
mov ecx, dword [ecx + 0x270]
add ecx, 0x21
xor eax, eax
mov edx, dword [ebp - 0x264]
mov edi, dword [edx + 0x258]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x288]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x264]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x18]
push edx
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x290]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x254]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x230], 0
jmp 0x10007d61
mov edx, dword [ebp - 0x230]
add edx, 1
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x230]
cmp ecx, dword [eax + 0x2a8]
jge 0x10007e26
mov dword [ebp - 0x23c], 0
jmp 0x10007d94
mov edx, dword [ebp - 0x23c]
add edx, 1
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [eax + 0x2a4]
jge 0x10007e21
push 0xcc0020
mov edx, dword [ebp - 0x230]
imul edx, edx, 0x30
push edx
mov eax, dword [ebp - 0x23c]
imul eax, eax, 0x30
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0x30
push 0x30
push 0
push 0
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
mov eax, dword [ebp - 0x264]
add eax, 0x25c
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0x30
push 0
mov edx, dword [ebp - 0x264]
mov eax, dword [edx + 0x290]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x14]
add eax, dword [edx + 0x270]
mov dword [ebp - 0x14], eax
jmp 0x10007d85
jmp 0x10007d52
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov dword [ebp - 0x238], 4
mov word [ebp - 0x22c], 0
xor ecx, ecx
mov dword [ebp - 0x22a], ecx
mov edx, dword [ebp - 0x264]
mov ax, word [edx + 0x18]
mov word [ebp - 0x22c], ax
mov ecx, dword [ebp - 0x264]
mov dx, word [ecx + 0x1c]
mov word [ebp - 0x22a], dx
mov word [ebp - 0x228], 0x30
push 0
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x264]
add ecx, 8
push ecx
push 6
lea edx, [ebp - 0x22c]
push edx
mov ecx, dword [ebp - 0x264]
add ecx, 0x134
call fcn.10004c90
test eax, eax
jne 0x10007ec8
xor eax, eax
jmp 0x1000831b
mov eax, dword [ebp - 0x264]
xor ecx, ecx
mov cx, word [eax + 8]
cmp ecx, 1
jne 0x10007f02
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x2b8], 0x1e
push str.image_jpeg
mov eax, dword [ebp - 0x264]
add eax, 0x2ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x10007f54
mov ecx, dword [ebp - 0x264]
xor edx, edx
mov dx, word [ecx + 8]
cmp edx, 2
jne 0x10007f2c
push str.image_gif
mov eax, dword [ebp - 0x264]
add eax, 0x2ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x10007f54
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x2b8], 0x64
push str.image_jpeg
mov edx, dword [ebp - 0x264]
add edx, 0x2ec
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x264]
add eax, 0x2bc
push eax
mov ecx, dword [ebp - 0x264]
add ecx, 0x2ec
push ecx
call fcn.1000a4b0
add esp, 8
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x2cc], 1
mov eax, dword [ebp - 0x264]
add eax, 0x2d0
mov ecx, dword [0x100123ec]
mov dword [eax], ecx
mov edx, dword [0x100123f0]
mov dword [eax + 4], edx
mov ecx, dword [0x100123f4]
mov dword [eax + 8], ecx
mov edx, dword [0x100123f8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x264]
mov dword [eax + 0x2e4], 4
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x2e0], 1
mov edx, dword [ebp - 0x264]
add edx, 0x2b8
mov eax, dword [ebp - 0x264]
mov dword [eax + 0x2e8], edx
mov byte [ebp - 0x218], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x218]
push ecx
push 0x40000000
mov ecx, dword [ebp - 0x264]
add ecx, 0x134
call fcn.10004840
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x264]
add ecx, 0x134
call fcn.100040e0
test eax, eax
jne 0x10008052
xor eax, eax
jmp 0x1000831b
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x330], 0
mov dword [ecx + 0x334], 0
mov edx, dword [ebp - 0x264]
mov dword [edx + 0x338], 0
mov dword [edx + 0x33c], 0
mov eax, dword [ebp - 0x264]
add eax, 0x330
push eax
push 0
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x33c]
push edx
mov eax, dword [ecx + 0x338]
push eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x348]
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x348]
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
push 0
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x288]
push edx
call fcn.100087c0
add esp, 8
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x348]
mov dword [ebp - 0x260], ecx
mov edx, dword [ebp - 0x264]
add edx, 0x2cc
push edx
mov eax, dword [ebp - 0x264]
add eax, 0x2bc
push eax
mov ecx, dword [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx + 4]
push eax
call fcn.10011032
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
je 0x10008150
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x258]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x25c], eax
jmp 0x1000815c
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x254], edx
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x10008197
push 1
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x250]
call dword [edx]
mov dword [ebp - 0x268], eax
jmp 0x100081a1
mov dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x264]
mov dword [eax + 0x330], 0
mov dword [eax + 0x334], 0
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x338], 0
mov dword [ecx + 0x33c], 0
mov edx, dword [ebp - 0x264]
add edx, 0x330
push edx
push 1
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x33c]
push ecx
mov edx, dword [eax + 0x338]
push edx
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x348]
mov edx, dword [ebp - 0x264]
mov eax, dword [edx + 0x348]
mov edx, dword [eax]
push ecx
call dword [edx + 0x14]
push 4
mov eax, dword [ebp - 0x264]
add eax, 0x330
push eax
mov ecx, dword [ebp - 0x264]
add ecx, 0x134
call fcn.100040e0
test eax, eax
je 0x10008268
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx + 0x330]
push edx
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax + 0x340]
push ecx
mov ecx, dword [ebp - 0x264]
add ecx, 0x134
call fcn.100040e0
test eax, eax
jne 0x1000826f
xor eax, eax
jmp 0x1000831b
mov dword [ebp - 0xc], 0
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x264]
push eax
push 0
push 0x10008330
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x264]
push ecx
push 0
push 0x100071a0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x264]
push edx
push 0
push 0x10007070
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0xc]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, dword [ebp - 0x264]
mov dword [ecx + 0x2b4], 1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x264]
add ecx, 0x134
call fcn.10004c50
mov ecx, dword [ebp - 0x264]
add ecx, 0x20
call fcn.10004c50
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4