Function at 0x40a2c0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
lea eax, [ebx + ebx*4]
push edi
mov esi, ecx
lea edi, [eax*4 + 0x81]
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x40a35b
mov ecx, dword [esp + 0x28]
push ecx
push 0x86
mov ecx, esi
call fcn.00409020
test ebx, ebx
jle 0x40a354
mov ebp, ebx
mov edx, dword [esi + 0xc9c]
mov eax, dword [esi + 0xc50]
push 0xcc0020
push 0
push 0
push edx
push 0x72
sub edi, 0x14
push 0x52
push 0x172
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esi + 0xc50]
mov edx, dword [esp + 0x28]
push 0xcc0020
push 0
push 0
push ecx
push 0x1f4
push 0x2ad
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
dec ebp
jne 0x40a2f6
mov ecx, esi
call fcn.00409100
mov ecx, 0x11
mov dword [esp + 0x14], 0x6e
cmp ebx, ecx
jg 0x40a501
lea eax, [ebx - 1]
test eax, eax
jle 0x40a4e7
mov edx, 1
lea eax, [esi + 0x922]
mov dword [esp + 0x10], edx
cmp edx, ebx
jge 0x40a4cc
mov ecx, ebx
lea edi, [eax + 6]
sub ecx, edx
mov dword [esp + 0x30], ecx
cmp word [eax], 0x11
jg 0x40a3ea
mov cx, word [eax - 2]
cmp cx, word [edi + 4]
jge 0x40a3ea
lea ecx, [eax - 6]
mov ebx, ecx
mov edx, dword [ebx]
mov ebp, dword [ebx + 4]
mov dword [esp + 0x1c], ebp
mov ebx, dword [ebx + 8]
mov dword [esp + 0x20], ebx
mov ebx, edi
mov ebp, dword [ebx]
mov dword [ecx], ebp
mov ebp, dword [ebx + 4]
mov dword [ecx + 4], ebp
mov ebx, dword [ebx + 8]
mov dword [ecx + 8], ebx
mov ecx, edi
mov ebx, dword [esp + 0x2c]
mov dword [ecx], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x20]
mov dword [ecx + 8], edx
cmp word [eax + 0xf0], 0x11
jg 0x40a450
mov cx, word [eax + 0xee]
cmp cx, word [edi + 0xf4]
jge 0x40a450
lea ecx, [eax + 0xea]
mov edx, ecx
mov ebx, dword [edx]
mov dword [esp + 0x18], ebx
mov ebx, dword [edx + 4]
mov dword [esp + 0x1c], ebx
mov edx, dword [edx + 8]
mov dword [esp + 0x20], edx
lea edx, [edi + 0xf0]
mov ebx, edx
mov ebp, dword [ebx]
mov dword [ecx], ebp
mov ebp, dword [ebx + 4]
mov dword [ecx + 4], ebp
mov ebx, dword [ebx + 8]
mov dword [ecx + 8], ebx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], ecx
cmp word [eax + 0x1e0], 0x11
jg 0x40a4b6
mov dx, word [eax + 0x1de]
cmp dx, word [edi + 0x1e4]
jge 0x40a4b6
lea ecx, [eax + 0x1da]
mov edx, ecx
mov ebx, dword [edx]
mov dword [esp + 0x18], ebx
mov ebx, dword [edx + 4]
mov dword [esp + 0x1c], ebx
mov edx, dword [edx + 8]
mov dword [esp + 0x20], edx
lea edx, [edi + 0x1e0]
mov ebx, edx
mov ebp, dword [ebx]
mov dword [ecx], ebp
mov ebp, dword [ebx + 4]
mov dword [ecx + 4], ebp
mov ebx, dword [ebx + 8]
mov dword [ecx + 8], ebx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x30]
add edi, 0xc
dec ecx
mov dword [esp + 0x30], ecx
jne 0x40a39d
mov edx, dword [esp + 0x10]
inc edx
lea ecx, [ebx - 1]
add eax, 0xc
mov dword [esp + 0x10], edx
lea edi, [edx - 1]
cmp edi, ecx
jl 0x40a38a
mov ecx, 0x11
mov word [esi + 0x922], cx
mov word [esi + 0xa12], cx
mov word [esi + 0xb02], cx
jmp 0x40a705
cmp ebx, 0x14
jl 0x40a705
mov eax, dword [esi + 0x648]
sub eax, 0
je 0x40a669
dec eax
je 0x40a5c8
dec eax
jne 0x40a705
lea eax, [ebx - 1]
test eax, eax
jle 0x40a5ba
mov edx, 1
lea ecx, [esi + 0xafc]
mov dword [esp + 0x10], edx
cmp edx, ebx
jge 0x40a5a8
mov edi, ebx
lea eax, [ecx + 0xc]
sub edi, edx
mov dword [esp + 0x30], edi
mov di, word [ecx + 4]
cmp di, word [eax + 4]
jge 0x40a59a
mov edi, ecx
mov edx, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esp + 0x1c], ebx
mov ebx, ecx
mov edi, dword [edi + 8]
mov dword [esp + 0x20], edi
mov edi, eax
mov ebp, dword [edi]
mov dword [ebx], ebp
mov ebp, dword [edi + 4]
mov dword [ebx + 4], ebp
mov edi, dword [edi + 8]
mov dword [ebx + 8], edi
mov edi, eax
mov ebx, dword [esp + 0x2c]
mov dword [edi], edx
mov edx, dword [esp + 0x1c]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
mov dword [edi + 8], edx
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x30]
add eax, 0xc
dec edi
mov dword [esp + 0x30], edi
jne 0x40a550
inc edx
lea eax, [ebx - 1]
add ecx, 0xc
mov dword [esp + 0x10], edx
lea edi, [edx - 1]
cmp edi, eax
jl 0x40a541
mov word [esi + 0xb02], 0x14
jmp 0x40a705
lea eax, [ebx - 1]
test eax, eax
jle 0x40a65b
mov edx, 1
lea ecx, [esi + 0xa0c]
mov dword [esp + 0x10], edx
cmp edx, ebx
jge 0x40a649
mov edi, ebx
lea eax, [ecx + 0xc]
sub edi, edx
mov dword [esp + 0x30], edi
mov di, word [ecx + 4]
cmp di, word [eax + 4]
jge 0x40a63b
mov edi, ecx
mov edx, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esp + 0x1c], ebx
mov ebx, ecx
mov edi, dword [edi + 8]
mov dword [esp + 0x20], edi
mov edi, eax
mov ebp, dword [edi]
mov dword [ebx], ebp
mov ebp, dword [edi + 4]
mov dword [ebx + 4], ebp
mov edi, dword [edi + 8]
mov dword [ebx + 8], edi
mov edi, eax
mov ebx, dword [esp + 0x2c]
mov dword [edi], edx
mov edx, dword [esp + 0x1c]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
mov dword [edi + 8], edx
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x30]
add eax, 0xc
dec edi
mov dword [esp + 0x30], edi
jne 0x40a5f1
inc edx
lea eax, [ebx - 1]
add ecx, 0xc
mov dword [esp + 0x10], edx
lea edi, [edx - 1]
cmp edi, eax
jl 0x40a5e2
mov word [esi + 0xa12], 0x14
jmp 0x40a705
lea eax, [ebx - 1]
test eax, eax
jle 0x40a6fc
mov edx, 1
lea ecx, [esi + 0x91c]
mov dword [esp + 0x10], edx
cmp edx, ebx
jge 0x40a6ea
mov edi, ebx
lea eax, [ecx + 0xc]
sub edi, edx
mov dword [esp + 0x30], edi
mov di, word [ecx + 4]
cmp di, word [eax + 4]
jge 0x40a6dc
mov edi, ecx
mov edx, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esp + 0x1c], ebx
mov ebx, ecx
mov edi, dword [edi + 8]
mov dword [esp + 0x20], edi
mov edi, eax
mov ebp, dword [edi]
mov dword [ebx], ebp
mov ebp, dword [edi + 4]
mov dword [ebx + 4], ebp
mov edi, dword [edi + 8]
mov dword [ebx + 8], edi
mov edi, eax
mov ebx, dword [esp + 0x2c]
mov dword [edi], edx
mov edx, dword [esp + 0x1c]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
mov dword [edi + 8], edx
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x30]
add eax, 0xc
dec edi
mov dword [esp + 0x30], edi
jne 0x40a692
inc edx
lea eax, [ebx - 1]
add ecx, 0xc
mov dword [esp + 0x10], edx
lea edi, [edx - 1]
cmp edi, eax
jl 0x40a683
mov word [esi + 0x922], 0x14
mov eax, dword [esi + 0xc58]
mov ecx, dword [esi + 0xc50]
push 0xcc0020
mov ebp, dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
push eax
push 0x1f4
push 0x2bc
push 0
push 0
push ecx
call ebp
xor ebx, ebx
cmp word [esi + 0x922], bx
jle 0x40a7ce
lea edi, [esi + 0x924]
mov edx, dword [esp + 0x28]
mov eax, dword [edi - 8]
push edx
push eax
mov ecx, esi
call fcn.00409020
movsx eax, word [edi]
mov ecx, dword [esp + 0x14]
push 0xcc0020
lea edx, [eax + eax*4]
push 0
add ecx, 0x14
lea eax, [eax + edx*8]
mov edx, dword [esi + 0xc9c]
shl eax, 1
push eax
mov eax, dword [esi + 0xc50]
push edx
push 0x72
push 0x52
push 0x172
push ecx
push eax
mov dword [esp + 0x38], ecx
call ebp
mov ecx, dword [esi + 0xc50]
mov edx, dword [esp + 0x28]
push 0xcc0020
push 0
push 0
push ecx
push 0x1f4
push 0x2ad
push 0
push 0
push edx
call ebp
mov ecx, esi
call fcn.00409100
movsx eax, word [esi + 0x922]
inc ebx
add edi, 0xc
cmp ebx, eax
jl 0x40a747
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc