Function at 0x40a51c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x1a4
mov eax, dword [0x437b00]
xor eax, ebp
mov dword [ebp + 0x120], eax
push esi
xor esi, esi
mov dword [ebp + 0x14], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xd0
push dword [0x43b52c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x80], 0x16028
mov dword [ebp - 0x70], esi
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x43ca78], esi
je 0x40a590
push str.ECPRCant_change_page_with_rotation.
push 0x20000000
mov dword [0x43ca78], esi
call fcn.00417cf8
push 0x43b520
call fcn.00418e7e
jmp 0x40b2a5
cmp dword [0x43b8ac], 4
jne 0x40b2a5
mov eax, dword [0x43ca88]
cmp eax, esi
je 0x40b2a5
mov edx, dword [ebp + 0x12c]
mov ecx, dword [0x43ca84]
add ecx, edx
cmp ecx, esi
mov dword [ebp + 4], ecx
jl 0x40b2a5
cmp ecx, eax
jge 0x40b2a5
mov eax, dword [0x436a14]
cmp eax, 0xfffffffd
mov dword [ebp - 0x2c], ecx
mov dword [ebp + 0x10], 0x43b8b8
jg 0x40a5f8
cmp edx, 1
je 0x40a5ec
cmp edx, esi
jne 0x40a5f8
cmp ecx, esi
jne 0x40a5f8
cmp eax, 0xfffffffd
jne 0x40a5f8
mov eax, ecx
mov dword [0x436a14], eax
push ebx
push edi
cmp eax, ecx
jne 0x40a6f0
mov eax, dword [0x436a2c]
test eax, eax
je 0x40a625
push eax
push dword [0x436a28]
push dword [0x43ca58]
call fcn.004223c0
add esp, 0xc
jmp 0x40a6f0
mov ebx, dword [0x43ca60]
movzx eax, word [ebx + 0xe]
mov edi, dword [0x436a24]
mov esi, eax
imul eax, dword [0x436a20]
imul esi, dword [0x43ca90]
mov ecx, dword [0x43ca94]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add esi, 0x1f
mov dword [ebp - 0x30], eax
mov eax, dword [0x436a1c]
shr esi, 3
add eax, edi
and esi, 0x1ffffffc
cmp eax, ecx
jle 0x40a67f
mov edi, ecx
sub edi, dword [0x436a1c]
mov dword [0x436a24], edi
cmp word [ebx + 0xe], 4
jne 0x40a69b
mov al, byte [0x436a30]
mov dl, al
and dl, 0xf
shl al, 4
or dl, al
mov byte [0x436a30], dl
movzx eax, word [ebx + 0xe]
imul eax, dword [0x436a18]
sub ecx, dword [0x436a1c]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [0x43ca58]
dec ecx
imul ecx, esi
xor ebx, ebx
add ecx, eax
inc ebx
cmp edi, ebx
mov dword [ebp + 0xc], ecx
jl 0x40a6f0
movzx eax, byte [0x436a30]
push dword [ebp - 0x30]
push eax
push dword [ebp + 0xc]
call fcn.004229f0
sub dword [ebp + 0xc], esi
add esp, 0xc
inc ebx
cmp ebx, dword [0x436a24]
jle 0x40a6ce
mov eax, dword [0x43ca80]
dec eax
je 0x40aabc
dec eax
je 0x40aa26
dec eax
je 0x40a9c9
dec eax
jne 0x40b2a3
lea eax, [ebp - 0x2c]
push eax
call fcn.00408592
mov esi, dword [0x43bd70]
lea eax, [esi + 0x400]
push eax
push 0
push dword [0x43b608]
mov dword [ebp + 0x10], str.::.png
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x40b2a3
cmp dword [ebp - 0x18], 0
jne 0x40a764
push esi
push dword [0x43bd68]
push edi
call fcn.004223c0
add esp, 0xc
jmp 0x40aad4
mov esi, dword [ebp - 0x20]
push esi
push dword [0x43bd68]
mov ebx, esi
push edi
mov dword [ebp + 0x18], ebx
call fcn.004223c0
add esp, 0xc
jmp 0x40a7cc
mov eax, dword [ebp + 0x18]
mov ecx, dword [0x43bd68]
add ecx, eax
mov dword [ebp + 0x1c], ecx
call fcn.0040677a
mov ebx, eax
test ebx, ebx
je 0x40a7d1
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + 4]
cmp eax, 0x54414449
je 0x40a7c2
cmp eax, 0x54416466
je 0x40a7c2
lea eax, [ebx + 0xc]
push eax
push dword [ebp + 0x1c]
lea eax, [esi + edi]
push eax
call fcn.004223c0
add esp, 0xc
lea esi, [esi + ebx + 0xc]
mov eax, dword [ebp + 0x18]
lea ebx, [eax + ebx + 0xc]
mov dword [ebp + 0x18], ebx
cmp ebx, dword [ebp - 0x18]
jb 0x40a77e
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x43bd68]
lea ebx, [ecx + eax]
mov dword [ebp + 0x18], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x10]
mov ecx, ebx
mov dword [edi + 0x14], eax
call fcn.0040677a
mov ecx, dword [ebp + 0x18]
lea eax, [ecx + eax + 0xc]
mov dword [ebp + 0x18], eax
mov al, byte [ebx + 0x20]
test al, al
je 0x40a8ad
xor ecx, ecx
inc ecx
cmp dword [ebp + 0x12c], ecx
je 0x40a82a
cmp dword [ebp + 0x12c], 0
jne 0x40a8ad
cmp dword [ebp + 4], 0
jne 0x40a8ad
cmp al, 1
je 0x40a89f
cmp al, 2
jne 0x40a8aa
cmp dword [0x436a2c], 0
jne 0x40a885
mov eax, dword [0x43ca64]
movzx edi, word [eax + 0xe]
imul edi, dword [0x43ca90]
add edi, 0x1f
shr edi, 3
and edi, 0x1ffffffc
imul edi, dword [0x43ca94]
push edi
push 0
push dword [0x43b608]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x436a28], eax
test eax, eax
je 0x40a87c
mov dword [0x436a2c], edi
cmp dword [0x436a2c], 0
je 0x40a8ad
push dword [0x436a2c]
push dword [0x43ca58]
push dword [0x436a28]
call fcn.004223c0
add esp, 0xc
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [0x436a14], eax
jmp 0x40a8ad
mov dword [ebp - 8], ecx
mov bl, byte [ebx + 0x21]
cmp bl, 1
jne 0x40a8c8
cmp dword [ebp - 0xc], 0xffffffff
mov dword [ebp + 0x14], 0x11
jne 0x40a8d4
and dword [ebp - 0xc], 0
jmp 0x40a8d4
cmp bl, 2
jb 0x40a8d4
mov dword [ebp - 8], 1
mov eax, dword [ebp + 0x18]
cmp eax, dword [0x43bd70]
jae 0x40a99b
mov ebx, eax
mov eax, dword [0x43bd68]
lea ecx, [ebx + eax]
mov dword [ebp + 0x1c], ecx
call fcn.0040677a
mov edi, eax
test edi, edi
je 0x40a99e
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + 4]
cmp eax, 0x4c546366
je 0x40a99e
cmp eax, 0x54416466
jne 0x40a96f
mov eax, dword [ebp + 8]
lea ebx, [esi + eax]
lea edx, [edi - 4]
mov ecx, ebx
mov dword [ebx + 4], 0x54414449
call fcn.004067af
mov ecx, dword [ebp + 0x18]
lea eax, [edi - 4]
push eax
mov eax, dword [0x43bd68]
lea eax, [ecx + eax + 0xc]
push eax
mov eax, dword [ebp + 8]
lea eax, [esi + eax + 8]
push eax
call fcn.004223c0
add esp, 0xc
push 0
push edi
lea eax, [ebx + 4]
push eax
call fcn.00408443
lea ecx, [ebx + edi + 4]
mov edx, eax
call fcn.004067af
mov ebx, dword [ebp + 0x18]
lea esi, [esi + edi + 8]
jmp 0x40a988
lea eax, [edi + 0xc]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
add eax, esi
push eax
call fcn.004223c0
add esp, 0xc
lea esi, [esi + edi + 0xc]
lea ebx, [ebx + edi + 0xc]
mov dword [ebp + 0x18], ebx
cmp ebx, dword [0x43bd70]
jb 0x40a8e5
mov ebx, dword [ebp + 0x18]
mov eax, dword [0x43bd70]
sub eax, ebx
push eax
mov eax, dword [0x43bd68]
add eax, ebx
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.004223c0
sub esi, ebx
add esp, 0xc
add esi, dword [0x43bd70]
jmp 0x40aad4
lea eax, [ebp - 0x2c]
push eax
call fcn.004067d7
mov ebx, eax
test ebx, ebx
je 0x40b2a3
mov esi, dword [0x43bd70]
lea eax, [esi + 0x400]
push eax
push 0
push dword [0x43b608]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x40b2a3
push dword [0x43bd70]
push dword [0x43bd68]
push edi
call fcn.004223c0
add esp, 0xc
lea ecx, [ebp - 0x20]
call ebx
mov dword [edi + 4], eax
jmp 0x40aad4
lea eax, [ebp - 0x2c]
push eax
call fcn.00408810
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
lea esi, [eax + ecx + 1]
lea eax, [esi + 0x400]
push eax
push 0
push dword [0x43b608]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 8], eax
test eax, eax
je 0x40b2a3
push dword [ebp - 0x24]
mov ebx, eax
push dword [0x43bd68]
push ebx
call fcn.004223c0
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x1c]
mov ecx, dword [0x43bd68]
lea edi, [eax + ebx]
mov eax, dword [ebp - 0x20]
add ecx, eax
push ecx
push edi
call fcn.004223c0
push 0x400
lea eax, [esi + ebx - 1]
push 0x3b
push eax
call fcn.004229f0
add esp, 0x24
xor eax, eax
mov word [edi + 1], ax
mov word [edi + 3], ax
mov ax, word [edi + 5]
mov word [ebx + 6], ax
mov ax, word [edi + 7]
mov word [ebx + 8], ax
mov dword [ebp + 0x14], 0x10
jmp 0x40aad7
mov eax, dword [0x43bd68]
or dword [ebp - 0xc], 0xffffffff
mov esi, dword [0x43bd70]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x70], eax
mov ebx, dword [ebp + 8]
push 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x43bd80
push 0x28
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], esi
call dword [sym.imp.PPLIB32W.DLL__VFSGetDibDelay_28]
test eax, eax
je 0x40b279
call fcn.00418d83
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
mov esi, dword [edi + 8]
mov ecx, dword [edi + 4]
mov dword [ebp], edi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], esi
test esi, esi
jge 0x40ab2b
neg esi
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x14]
mov dword [0x436a18], eax
mov eax, dword [ebp - 0x10]
mov dword [0x436a1c], eax
mov eax, dword [0x43ca60]
mov dword [0x436a20], ecx
mov dword [0x436a24], esi
movzx edx, word [eax + 0xe]
mov dword [ebp + 0x1c], edx
movzx edx, word [edi + 0xe]
mov dword [ebp + 0xc], edx
cmp word [ebp + 0x1c], dx
je 0x40ab8a
cmp dword [ebp + 0x14], 0x10
jne 0x40ab6d
cmp word [ebp + 0x1c], 8
je 0x40ab8a
cmp dword [ebp - 0xc], 0
jge 0x40ab83
cmp dword [0x43ca90], ecx
jne 0x40ab83
cmp dword [0x43ca94], esi
je 0x40ab8a
mov dword [ebp - 8], 1
cmp dword [ebp - 0x2c], 0
je 0x40b11d
mov edx, dword [0x43ca80]
cmp edx, 1
je 0x40b11d
cmp edx, 3
je 0x40b11d
mov dx, word [ebp + 0xc]
cmp word [ebp + 0x1c], dx
je 0x40abcb
cmp dword [ebp + 0x14], 0x10
jne 0x40b11d
cmp word [ebp + 0x1c], 8
jne 0x40b11d
mov edx, dword [ebp - 0x10]
add edx, esi
cmp dword [0x43ca94], edx
jl 0x40b11d
mov edx, dword [ebp - 0x14]
lea ebx, [edx + ecx]
mov edx, dword [0x43ca90]
cmp edx, ebx
jl 0x40b11d
cmp dword [ebp - 0xc], 0
jge 0x40ac06
cmp edx, ecx
jne 0x40ac06
cmp dword [0x43ca94], esi
je 0x40b11d
and dword [ebp + 0x18], 0
cmp word [ebp + 0x1c], 8
ja 0x40acb3
mov ebx, dword [eax]
mov cl, byte [ebp + 0xc]
add ebx, eax
mov eax, dword [ebp]
mov edi, dword [eax]
add edi, eax
xor eax, eax
inc eax
shl eax, cl
mov esi, ebx
mov dword [ebp - 0x30], edi
mov ecx, eax
shl ecx, 2
mov dword [ebp + 0xc], eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40ac40
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40acb3
cmp dword [ebp + 0x14], 0x10
mov dword [ebp + 0x18], 1
jne 0x40acb3
mov cl, byte [ebp + 0x1c]
xor esi, esi
inc esi
xor edi, edi
shl esi, cl
cmp dword [ebp + 0xc], edi
jle 0x40acb3
and dword [ebp + 0x1c], 0
lea eax, [esi - 1]
mov dword [ebp + 4], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + edi*4]
mov dword [ebp + 0x10], 0xfffff
mov dword [ebp - 0x44], eax
test esi, esi
jle 0x40aca6
mov eax, dword [ebp + 0x1c]
push dword [ebx + eax*4]
push dword [ebp - 0x44]
call fcn.004084d6
cmp eax, dword [ebp + 0x10]
jge 0x40ac9e
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], eax
mov dword [ebp + 4], ecx
test eax, eax
je 0x40aca6
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], esi
jl 0x40ac7e
mov al, byte [ebp + 4]
mov byte [ebp + edi + 0x20], al
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x40ac60
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov esi, dword [0x43ca60]
xor edx, edx
mov dword [ebp - 0x54], eax
cmp dword [ebp + 0x14], edx
je 0x40ad54
cmp dword [ebp + 0x14], 0x10
jne 0x40ad1c
movzx eax, word [esi + 0xe]
xor ecx, ecx
inc ecx
cmp ax, cx
jne 0x40aced
test byte [ebp - 0x14], 7
je 0x40aced
mov dword [ebp + 0x14], ecx
jmp 0x40ad17
push 4
pop ecx
cmp ax, cx
jne 0x40acfe
mov dword [ebp + 0x14], 2
jmp 0x40ad17
cmp ax, 8
jne 0x40ad10
mov eax, dword [ebp]
mov dword [ebp + 0x14], ecx
cmp word [eax + 0xe], cx
je 0x40ad17
mov dword [ebp + 0x14], 3
mov dword [ebp - 8], edx
jmp 0x40ad54
cmp dword [ebp + 0x14], 0x11
jne 0x40ad54
movzx eax, word [esi + 0xe]
cmp ax, 8
jne 0x40ad35
mov dword [ebp + 0x14], 5
jmp 0x40ad54
cmp ax, 0x20
jne 0x40ad44
mov dword [ebp + 0x14], 7
jmp 0x40ad54
mov dword [ebp + 0x14], 6
cmp ax, 0x18
je 0x40ad54
mov dword [ebp + 0x14], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, edx
mov dword [ebp + 0xc], ecx
jl 0x40ad98
movzx eax, word [esi + 0xe]
cmp ax, 8
jae 0x40ad98
xor edi, edi
inc edi
cmp ax, di
jne 0x40ad76
or dword [ebp + 0xc], 0xffffffff
jmp 0x40ad80
mov eax, ecx
shl eax, 4
or eax, ecx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp]
movzx ecx, word [eax + 0xe]
push 8
pop eax
cdq
idiv ecx
mov ecx, dword [ebp - 0x14]
dec eax
test ecx, eax
je 0x40ad98
mov dword [ebp - 8], edi
mov eax, dword [ebp]
movzx ecx, word [eax + 0xe]
movzx eax, word [esi + 0xe]
imul ecx, dword [ebp - 0x40]
mov edi, eax
imul eax, dword [ebp - 0x14]
imul edi, dword [0x43ca90]
add edi, 0x1f
lea ebx, [ecx + 0x1f]
mov edx, 0x1ffffffc
shr ebx, 3
and ebx, edx
shr edi, 3
and edi, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp - 0x58], eax
lea eax, [ecx + 7]
cdq
and edx, 7
add edx, eax
xor eax, eax
inc eax
sar edx, 3
cmp dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x4c], edx
mov dword [ebp], eax
jl 0x40b0f5
jmp 0x40ae04
mov edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x43ca94]
sub eax, dword [ebp]
mov esi, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x10]
sub esi, dword [ebp]
mov ecx, dword [ebp + 0x14]
imul eax, edi
add eax, dword [ebp - 0x58]
imul esi, ebx
add esi, dword [ebp - 0x54]
add eax, dword [0x43ca58]
dec ecx
je 0x40b086
dec ecx
je 0x40afa9
dec ecx
je 0x40af7d
dec ecx
je 0x40aec6
dec ecx
je 0x40aebd
dec ecx
je 0x40ae9e
dec ecx
je 0x40ae74
push edx
push esi
push eax
call fcn.004223c0
add esp, 0xc
jmp 0x40b0e6
mov ecx, dword [esi]
cmp ecx, 0x60000000
jb 0x40ae6b
mov dword [eax], ecx
sub edx, 4
add esi, 4
add eax, 4
test edx, edx
jne 0x40ae5f
jmp 0x40b0e6
mov ecx, dword [esi]
mov edi, ecx
and edi, 0xffffff
cmp edi, dword [ebp + 0xc]
je 0x40ae95
mov word [eax], cx
shr ecx, 0x10
mov byte [eax + 2], cl
sub edx, 3
add esi, 3
add eax, 3
test edx, edx
jne 0x40ae7d
jmp 0x40b0e6
mov cl, byte [esi]
mov ebx, dword [ebp - 0x30]
movzx edi, cl
cmp dword [ebx + edi*4], 0x60000000
jb 0x40aeba
mov byte [eax], cl
dec edx
inc esi
inc eax
test edx, edx
jne 0x40aea7
jmp 0x40b0e6
mov ecx, dword [ebp - 0x40]
and ecx, 1
test byte [ebp - 0x14], 1
mov dword [ebp + 0x10], ecx
mov ebx, edx
je 0x40af2a
test edx, edx
je 0x40b0e6
mov cl, byte [esi]
mov dl, cl
shr dl, 4
movzx edi, dl
cmp edi, dword [ebp - 0xc]
je 0x40af04
cmp ebx, dword [ebp + 0x10]
jle 0x40af04
cmp dword [ebp + 0x18], 0
je 0x40af00
movzx edx, byte [ebp + edi + 0x20]
jmp 0x40af02
mov edx, edi
mov byte [eax], dl
and cl, 0xf
movzx ecx, cl
cmp ecx, dword [ebp - 0xc]
je 0x40af1d
cmp dword [ebp + 0x18], 0
je 0x40af1a
movzx ecx, byte [ebp + ecx + 0x20]
mov byte [eax + 1], cl
dec ebx
inc esi
inc eax
inc eax
test ebx, ebx
jne 0x40aedf
jmp 0x40b0e6
test edx, edx
je 0x40b0e6
mov cl, byte [esi]
mov dl, cl
and dl, 0xf
movzx edi, dl
cmp edi, dword [ebp - 0xc]
je 0x40af57
cmp ebx, dword [ebp + 0x10]
jle 0x40af57
cmp dword [ebp + 0x18], 0
je 0x40af53
movzx edx, byte [ebp + edi + 0x20]
jmp 0x40af55
mov edx, edi
mov byte [eax], dl
and cl, 4
movzx ecx, cl
cmp ecx, dword [ebp - 0xc]
je 0x40af70
cmp dword [ebp + 0x18], 0
je 0x40af6d
movzx ecx, byte [ebp + ecx + 0x20]
mov byte [eax + 1], cl
dec ebx
inc esi
inc eax
inc eax
test ebx, ebx
jne 0x40af32
jmp 0x40b0e6
mov edi, edx
test edx, edx
je 0x40b0e6
mov cl, byte [esi]
movzx edx, cl
cmp edx, dword [ebp + 0xc]
je 0x40af9d
cmp dword [ebp + 0x18], 0
je 0x40af9b
mov cl, byte [ebp + edx + 0x20]
mov byte [eax], cl
dec edi
inc esi
inc eax
test edi, edi
jne 0x40af87
jmp 0x40b0e6
mov ecx, dword [ebp - 0x40]
and ecx, 1
test byte [ebp - 0x14], 1
mov dword [ebp + 0x10], ecx
jne 0x40b043
mov dword [ebp + 0x1c], edx
test edx, edx
je 0x40b0e6
mov dl, byte [esi]
mov bl, byte [eax]
mov cl, dl
and cl, 0xf
movzx edi, cl
cmp edi, dword [ebp - 0xc]
je 0x40b055
mov ecx, dword [ebp + 0x1c]
cmp ecx, dword [ebp + 0x10]
jle 0x40b055
cmp dword [ebp + 0x18], 0
je 0x40b04c
movzx ecx, byte [ebp + edi + 0x20]
mov dword [ebp + 4], ecx
jmp 0x40b04f
movzx edi, byte [esi]
mov ecx, edi
shr ecx, 4
cmp ecx, dword [ebp - 0xc]
je 0x40b016
cmp edx, dword [ebp + 0x10]
jle 0x40b016
cmp dword [ebp + 0x18], 0
je 0x40b00d
movzx ecx, byte [ebp + ecx + 0x20]
mov bl, byte [eax]
and bl, 0xf0
or bl, cl
mov byte [eax], bl
mov ecx, edi
and ecx, 0xf
cmp ecx, dword [ebp - 0xc]
je 0x40b040
cmp dword [ebp + 0x18], 0
je 0x40b030
movzx ecx, byte [ebp + ecx + 0x20]
shl ecx, 4
jmp 0x40b035
shl edi, 4
mov ecx, edi
mov bl, byte [eax + 1]
and bl, 0xf
or bl, cl
mov byte [eax + 1], bl
dec edx
inc esi
inc eax
test edx, edx
jne 0x40aff0
jmp 0x40b0e6
mov dword [ebp + 4], edi
and bl, 0xf0
or bl, byte [ebp + 4]
shr dl, 4
movzx ecx, dl
cmp ecx, dword [ebp - 0xc]
je 0x40b073
cmp dword [ebp + 0x18], 0
je 0x40b06b
movzx ecx, byte [ebp + ecx + 0x20]
shl ecx, 4
and bl, 0xf
or bl, cl
dec dword [ebp + 0x1c]
inc esi
mov byte [eax], bl
inc eax
cmp dword [ebp + 0x1c], 0
jne 0x40afc7
jmp 0x40b0e6
mov ecx, dword [ebp - 0x14]
and ecx, 7
mov dword [ebp + 0x1c], edx
test edx, edx
je 0x40b0e6
mov dword [ebp + 4], 0xff00
sar dword [ebp + 4], cl
mov dword [ebp + 0x10], 8
sub dword [ebp + 0x10], ecx
movzx di, byte [eax]
movzx bx, byte [esi]
lea edx, [eax + 1]
movzx cx, byte [edx]
shl di, 8
or di, cx
mov ecx, dword [ebp + 4]
not ecx
and di, cx
mov ecx, dword [ebp + 0x10]
shl bx, cl
or di, bx
movzx ecx, di
mov ebx, ecx
shr ebx, 8
dec dword [ebp + 0x1c]
inc esi
cmp dword [ebp + 0x1c], 0
mov byte [eax], bl
mov byte [edx], cl
mov eax, edx
jne 0x40b0a7
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, dword [ebp - 0x3c]
jle 0x40adfb
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_LocalUnlock]
call esi
push dword [ebp - 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
call edi
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x34]
call edi
mov esi, dword [0x43ca60]
jmp 0x40b17f
mov eax, dword [0x43ca6c]
mov esi, dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x40b13d
push eax
call esi
push dword [0x43ca6c]
call ebx
mov eax, dword [0x43ca5c]
test eax, eax
je 0x40b151
push eax
call esi
push dword [0x43ca5c]
call ebx
mov eax, dword [ebp - 0x38]
mov dword [0x43ca6c], eax
mov eax, dword [ebp - 0x34]
push eax
mov dword [0x43ca5c], eax
mov dword [0x43ca60], edi
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov esi, dword [0x43ca60]
push esi
mov dword [0x43ca58], eax
call fcn.00408131
xor edi, edi
cmp dword [esi + 0x20], edi
jne 0x40b19e
movzx ecx, word [esi + 0xe]
cmp cx, 8
ja 0x40b19e
xor eax, eax
inc eax
shl eax, cl
mov dword [esi + 0x20], eax
mov esi, dword [0x43ca60]
push 0x43caac
mov dword [0x43ca64], esi
call fcn.004206f1
mov eax, dword [0x43ca54]
cmp eax, edi
je 0x40b1be
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x43b8a0
call fcn.0040565a
push dword [0x43b52c]
mov dword [0x43b8a4], 0x1b
mov dword [0x43b8a8], 4
call fcn.0041b1c2
mov eax, dword [ebp - 0x2c]
mov dword [0x43ca84], eax
cmp dword [0x43ca8c], edi
je 0x40b246
cmp dword [0x43ca80], 1
jne 0x40b206
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x50]
mov ecx, 0x80000000
test ecx, eax
cmovne eax, edi
sub dword [ebp - 0x28], eax
test dword [ebp - 0x28], ecx
jne 0x40b226
cmp dword [ebp - 0x28], edi
jne 0x40b22d
mov dword [ebp - 0x28], 0xa
push 0x4084a5
push dword [ebp - 0x28]
push 0xd0
push dword [0x43b52c]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x43b2d8], edi
jle 0x40b263
cmp dword [0x43ca8c], edi
jne 0x40b263
cmp dword [0x43ca70], edi
jl 0x40b263
call fcn.004064fd
cmp dword [ebp - 8], edi
je 0x40b28a
push str.ECPSthis_frame_is_not_full_support
push 0x20000000
call fcn.00417cf8
jmp 0x40b28a
push str.ECPLframe_read_error
push 0x20000000
call fcn.00417cf8
xor edi, edi
cmp dword [0x43ca80], 1
jle 0x40b2a3
push dword [ebp + 8]
push edi
push dword [0x43b608]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
pop esi
call fcn.00422725
add ebp, 0x124
leave
ret 4