Function at 0x432cb0
Capabilities:
Capture screenshot
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b6b8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x188
push ebx
push ebp
push esi
lea eax, [esp + 0x70]
push edi
push eax
mov dword [esp + 0x34], ecx
call fcn.00430b70
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
shl eax, 8
sub eax, 0x100
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x24], eax
lea eax, [edx + 1]
shl eax, 8
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x78]
mov eax, SysReAllocString
lea ebp, [ecx + 1]
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], eax
mov eax, SysReAllocStringLen
xor edx, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1a8]
shl edi, 8
movsx ecx, word [eax]
sub edi, 0x100
add eax, 2
shl ebp, 8
test ecx, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x58], ecx
mov dword [esp + 0x60], eax
mov esi, eax
mov dword [0x4d5a74], 0x434820
jle 0x432ecf
mov dword [esp + 0x4c], ecx
movsx ebx, word [esi]
mov eax, dword [esp + 0x1ac]
mov ecx, dword [esp + 0x30]
add esi, 2
inc edx
test eax, eax
push 1
mov dword [esp + 0x20], edx
push esi
je 0x432d86
call fcn.00430c30
jmp 0x432d8b
call fcn.00430ca0
mov ecx, dword [esi + 4]
cmp ecx, ebp
jge 0x432d96
mov dword [esp + 0x2c], ecx
cmp ecx, edi
jle 0x432d9c
mov edi, ecx
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
cmp eax, edx
jge 0x432daa
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x24]
jle 0x432db4
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x1b4]
cmp dword [edx], 1
je 0x432de8
cmp ecx, dword [esp + 0x44]
jge 0x432dca
mov dword [esp + 0x44], ecx
cmp ecx, dword [esp + 0x28]
jle 0x432dd4
mov dword [esp + 0x28], ecx
cmp eax, dword [esp + 0x40]
jge 0x432dde
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x20]
jle 0x432de8
mov dword [esp + 0x20], eax
add esi, 8
test ebx, ebx
jle 0x432eb8
mov dword [esp + 0x38], ebx
movsx ebp, word [esi + 2]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1ac]
add ecx, ebp
add esi, 4
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x30]
test eax, eax
push ebp
push esi
je 0x432e20
call fcn.00430c30
jmp 0x432e25
call fcn.00430ca0
test ebp, ebp
jle 0x432ea6
mov eax, dword [esp + 0x1b4]
mov edx, esi
mov dword [esp + 0x10], ebp
mov ecx, dword [eax]
mov dword [esp + 0x48], ecx
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
jge 0x432e4b
mov dword [esp + 0x2c], ecx
cmp ecx, edi
jle 0x432e51
mov edi, ecx
mov eax, dword [edx]
mov ebx, dword [esp + 0x14]
cmp eax, ebx
jge 0x432e5f
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x24]
jle 0x432e69
mov dword [esp + 0x24], eax
cmp dword [esp + 0x48], 1
je 0x432e98
cmp ecx, dword [esp + 0x44]
jge 0x432e7a
mov dword [esp + 0x44], ecx
cmp ecx, dword [esp + 0x28]
jle 0x432e84
mov dword [esp + 0x28], ecx
cmp eax, dword [esp + 0x40]
jge 0x432e8e
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x20]
jle 0x432e98
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
add edx, 8
dec eax
mov dword [esp + 0x10], eax
jne 0x432e3c
mov eax, dword [esp + 0x38]
lea esi, [esi + ebp*8]
dec eax
mov dword [esp + 0x38], eax
jne 0x432df7
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x4c], eax
jne 0x432d62
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jl 0x43408d
cmp edi, ebp
jl 0x43408d
lea eax, [ebp + 0x80]
sar eax, 8
mov dword [esp + 0x2c], eax
lea eax, [edi + 0x80]
sar eax, 8
inc eax
cmp edx, 4
mov dword [esp + 0x4c], eax
mov ax, 0x10
mov word [0x4d5acc], ax
jae 0x432f17
mov ax, 4
jmp 0x432f23
cmp edx, 9
jae 0x432f29
inc edx
shr edx, 1
lea eax, [edx + edx + 4]
mov word [0x4d5acc], ax
mov edx, dword [0x4d6dc4]
mov esi, dword [esp + 0x1b4]
movsx ecx, ax
lea eax, [edx - 4]
xor edx, edx
lea ecx, [ecx*4 + 2]
div ecx
mov ecx, dword [0x4d6dc8]
mov dword [0x4d5ac4], ecx
mov dword [esp + 0x5c], eax
imul eax, dword [0x4d5acc]
lea edx, [eax*4 + 4]
mov word [0x4d5ac0], dx
mov eax, dword [esi]
cmp eax, 1
je 0x432fb5
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x40]
add eax, 0x80
sar eax, 8
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x20]
add ecx, 0x80
add edx, 0x80
add eax, 0x80
sar ecx, 8
sar edx, 8
sar eax, 8
mov dword [esp + 0x28], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x20], eax
push 0x10
call fcn.004aa6ea
add esp, 4
mov dword [esp + 0x50], eax
test eax, eax
mov dword [esp + 0x1a0], 0
je 0x432fdd
mov ecx, eax
call fcn.004ad59e
mov ebp, eax
jmp 0x432fdf
xor ebp, ebp
mov ecx, dword [esp + 0x30]
xor edi, edi
or ebx, 0xffffffff
mov dword [esp + 0x34], ebp
mov eax, dword [ecx + 0x2c]
mov dword [esp + 0x1a0], ebx
cmp eax, edi
jne 0x432ffe
xor eax, eax
jmp 0x433001
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, ebp
call fcn.004ad655
mov eax, dword [esi]
cmp eax, 1
jne 0x43316b
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x433092
push 8
call fcn.004aa6ea
add esp, 4
mov dword [esp + 0x50], eax
cmp eax, edi
mov dword [esp + 0x1a0], 1
je 0x43306d
mov edx, dword [esi + 0xc]
mov ecx, eax
push edx
call fcn.004ae105
mov esi, dword [esp + 0x30]
mov edi, eax
push edi
mov dword [esp + 0x1a4], ebx
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x28], edi
call fcn.004ad7e9
mov dword [esp + 0x48], eax
jmp 0x433aaa
mov esi, dword [esp + 0x30]
xor eax, eax
mov edi, eax
mov dword [esp + 0x1a0], ebx
mov ecx, dword [esi + 0x2c]
push edi
mov dword [esp + 0x28], edi
call fcn.004ad7e9
mov dword [esp + 0x48], eax
jmp 0x433aaa
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], 0x4bcfb4
shl eax, 4
add eax, 0x4d0ab8
mov dword [esp + 0x1a0], 2
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x3c]
call fcn.004ae048
push 8
call fcn.004aa6ea
add esp, 4
cmp eax, edi
je 0x4330e5
mov dword [eax + 4], edi
mov dword [eax], vtable.CBrush.0
mov esi, eax
jmp 0x4330e7
xor esi, esi
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x38]
neg eax
sbb eax, eax
mov edi, esi
and eax, ebp
mov dword [esp + 0x24], edi
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
mov ecx, esi
call fcn.004ae048
lea ecx, [esp + 0x38]
call fcn.004ae09f
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x1b4]
mov ecx, dword [esi + 0x2c]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2c]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [esp + 0x38], vtable.CGdiObject.0
lea ecx, [esp + 0x38]
mov dword [esp + 0x1a0], 3
call fcn.004ae09f
mov ecx, dword [esi + 0x2c]
push edi
mov dword [esp + 0x1a4], ebx
call fcn.004ad7e9
mov dword [esp + 0x48], eax
jmp 0x433aaa
cmp eax, 2
jne 0x4334ab
mov eax, dword [esi + 4]
lea ecx, [esp + 0x94]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x4d6dd8]
xor esi, esi
cmp eax, edi
jle 0x4331d9
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov eax, dword [0x4d6dd0]
xor ebx, ebx
cmp byte [ebx + eax + 1], 1
jne 0x4331bd
lea edx, [esp + 0x94]
lea eax, [ebx + eax + 2]
push edx
push eax
call edi
test eax, eax
je 0x4331d0
mov eax, dword [0x4d6dd0]
mov ecx, dword [0x4d6dd8]
inc esi
add ebx, 0x116
cmp esi, ecx
jl 0x43319e
jmp 0x4331d9
cmp esi, 0xffffffff
jne 0x4332ea
lea ecx, [esp + 0x94]
push ecx
call fcn.004395a0
mov ebx, eax
add esp, 4
cmp ebx, 2
je 0x433216
cmp ebx, 1
je 0x433216
cmp ebx, 7
je 0x433216
cmp ebx, 6
je 0x433216
test ebp, ebp
je 0x43408d
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx + 4]
jmp 0x43408d
mov edi, dword [0x4d6dc8]
push 0x10000
call fcn.004970a0
add esp, 4
mov dword [0x4d6dc8], eax
test eax, eax
jne 0x43324c
test ebp, ebp
mov dword [0x4d6dc8], edi
je 0x43408d
mov eax, dword [ebp]
push 1
mov ecx, ebp
jmp 0x43408a
xor esi, esi
push 1
push 1
push esi
push esi
push ebx
push 0x32
push 0x32
push esi
lea ebx, [esp + 0xb4]
push esi
push ebx
mov ebx, dword [esp + 0x58]
xor eax, eax
xor ecx, ecx
xor edx, edx
mov ebx, dword [ebx + 0x2c]
push ebx
sub esp, 0x10
mov ebx, esp
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], esi
call fcn.00439900
mov ecx, dword [0x4d6dc8]
mov esi, eax
push ecx
call fcn.00496fcb
add esp, 0x40
mov dword [0x4d6dc8], edi
test esi, esi
je 0x4332b8
test ebp, ebp
je 0x43408d
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx + 4]
jmp 0x43408d
mov eax, dword [0x4d6dd8]
mov ecx, dword [esp + 0x1b4]
lea esi, [eax - 1]
mov edx, dword [ecx + 4]
push edx
mov edx, dword [0x4d6dd0]
lea eax, [esi + esi*2]
shl eax, 3
sub eax, esi
lea eax, [eax + eax*2]
lea ecx, [esi + eax*2]
lea eax, [edx + ecx*2 + 2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + esi*2]
push 8
shl eax, 3
sub eax, esi
lea ecx, [eax + eax*2]
mov eax, dword [0x4d6dd0]
lea esi, [esi + ecx*2]
shl esi, 1
mov ebx, dword [esi + eax + 0x10e]
mov ebp, dword [esi + eax + 0x112]
call fcn.004aa6ea
add esp, 4
test eax, eax
je 0x43332c
mov dword [eax + 4], 0
mov dword [eax], 0x4bcfb4
mov edi, eax
jmp 0x43332e
xor edi, edi
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x38], edi
mov eax, dword [edx + 0x2c]
mov edx, dword [esp + 0x44]
sub ecx, edx
mov eax, dword [eax + 4]
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x40]
push edx
mov dword [esp + 0x2c], edx
inc ecx
push ecx
push eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.004ae048
test edi, edi
je 0x4335ce
mov ecx, dword [esp + 0x34]
mov eax, dword [edi + 4]
push eax
mov edx, dword [ecx + 4]
push edx
call fcn.004ad796
lea ecx, [esp + 0x64]
mov dword [esp + 0x48], eax
call fcn.004ad59e
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1a0], 4
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x4333aa
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x68]
call fcn.004ad655
mov ecx, dword [0x4d6dd0]
mov esi, dword [esi + ecx + 0x106]
test esi, esi
jne 0x4333d0
xor eax, eax
jmp 0x4333d3
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x68]
push eax
push edx
call fcn.004ad796
mov ecx, dword [esp + 0x1b4]
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x84], eax
sub ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x88], edx
sub ebp, edx
mov ecx, ebx
cdq
idiv ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ebp
mov esi, eax
test esi, esi
jl 0x433492
mov eax, dword [esp + 0x28]
xor edi, edi
cdq
idiv ebp
inc esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jl 0x433485
mov dword [esp + 0x18], ecx
xor ecx, ecx
lea ebx, [eax + 1]
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x68]
push 0xcc0020
lea esi, [ecx + eax]
lea eax, [esp + 0x68]
mov edx, esi
sub edx, ecx
neg eax
sbb eax, eax
and eax, ebp
mov ebp, dword [esp + 0x8c]
push ebp
mov ebp, dword [esp + 0x8c]
push ebp
push eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x2c]
push edx
push ecx
mov ecx, dword [eax + 4]
push edi
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
dec ebx
mov ecx, esi
jne 0x433433
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add edi, ecx
dec edx
mov dword [esp + 0x10], edx
jne 0x433426
lea ecx, [esp + 0x64]
mov dword [esp + 0x1a0], 0xffffffff
call fcn.004ad6d3
jmp 0x433aa6
mov esi, dword [esp + 0x1b4]
xor ecx, ecx
push 0x400
mov eax, dword [esi + 0x10]
mov cl, byte [esi + 0x10]
mov ebx, eax
mov dword [esp + 0x4c], ecx
sar eax, 0x10
and eax, 0xff
mov edi, eax
xor eax, eax
mov al, byte [esi + 0x14]
mov dword [esp + 0x1c], edi
sub eax, ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x14]
mov esi, eax
sar eax, 0x10
sar ebx, 8
sar esi, 8
and eax, 0xff
and ebx, 0xff
and esi, 0xff
sub eax, edi
sub esi, ebx
mov dword [esp + 0x18], eax
call fcn.004970a0
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
je 0x4335ce
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x1c], edi
inc eax
mov dword [esp + 0x10], 0x100
mov dl, byte [esp + 0x48]
mov ecx, edi
sar ecx, 8
add cl, dl
mov edx, ebp
sar edx, 8
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x1c]
add dl, bl
add ebp, esi
mov byte [eax], dl
mov dl, byte [esp + 0x18]
sar ecx, 8
add cl, dl
mov edx, dword [esp + 0x14]
mov byte [eax - 1], cl
mov ecx, dword [esp + 0x38]
add edi, ecx
mov ecx, dword [esp + 0x1c]
add ecx, edx
mov byte [eax + 2], 0
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
add eax, 4
dec ecx
mov dword [esp + 0x10], ecx
jne 0x43352a
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x40]
sub eax, ebx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x50], eax
lea eax, [eax*8 + 0x27]
cdq
and edx, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [esp + 0x44]
sar ebx, 5
sub esi, eax
mov eax, ebx
inc esi
imul eax, esi
shl eax, 2
push eax
mov dword [esp + 0x2c], esi
call fcn.004970a0
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4335e6
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00496fcb
add esp, 4
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x43408d
mov edx, dword [ecx]
push 1
call dword [edx + 4]
jmp 0x43408d
mov eax, dword [esp + 0x1b4]
cmp dword [eax + 4], 0x20
jne 0x4336ca
lea eax, [ebx*4]
cdq
sub eax, edx
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
mov edx, eax
mov esi, ecx
imul edx, eax
imul esi, ecx
add edx, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x54], edx
lea edx, [ecx + 1]
imul edx, edx
mov dword [esp + 0x18], edx
lea edi, [eax + 1]
neg ecx
imul edi, edi
lea edx, [eax + eax]
shl ecx, 1
test edx, edx
jle 0x433933
add eax, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x38], edx
lea ebp, [eax + eax]
mov eax, dword [esp + 0x20]
add ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x1c]
sub ecx, esi
add edx, ebp
xor esi, esi
lea edi, [edi + ecx - 1]
mov ecx, dword [esp + 0x18]
test ebp, ebp
mov dword [esp + 0x1c], edx
jle 0x4336af
xor ebx, ebx
mov eax, dword [esp + 0x10]
mov edx, ebx
add eax, eax
add ebx, 2
sub edx, eax
lea ecx, [ecx + edx - 1]
lea eax, [edi + ecx]
shl eax, 8
cdq
idiv dword [esp + 0x54]
mov edx, dword [esp + 0x1c]
inc esi
cmp esi, ebp
mov byte [edx + esi - 1], al
jl 0x433686
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
add ecx, 2
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x38], eax
jne 0x433662
jmp 0x433933
mov edi, dword [eax + 8]
mov edx, dword [eax + 0xc]
neg edi
mov dword [esp + 0x14], edx
jne 0x4336e5
test edx, edx
jne 0x4336e5
mov edx, 1
mov dword [esp + 0x14], edx
test edi, edi
lea ecx, [ebx*4]
jl 0x433795
test edx, edx
jge 0x43378d
mov ebp, ecx
mov eax, esi
imul ebp, edi
imul eax, edx
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x1c], eax
mov eax, ecx
neg eax
test esi, esi
jle 0x433933
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], 0
add eax, edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x38]
xor esi, esi
add edx, ecx
test ecx, ecx
mov dword [esp + 0x38], edx
jle 0x43376f
xor ebx, ebx
mov edx, dword [esp + 0x10]
mov eax, ebx
sub eax, ebp
add ebx, edi
add eax, edx
cdq
xor eax, edx
sub eax, edx
shl eax, 8
cdq
idiv dword [esp + 0x1c]
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ecx
mov byte [edx + esi - 1], al
jl 0x433749
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add edx, eax
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
jne 0x433737
jmp 0x433933
test edi, edi
jg 0x4338b0
test edx, edx
jle 0x433828
mov ebx, esi
mov eax, ecx
imul ebx, edx
imul eax, edi
sub eax, ebx
mov ebp, ecx
cdq
xor eax, edx
mov dword [esp + 0x54], ebx
sub eax, edx
neg ebp
test esi, esi
mov dword [esp + 0x1c], eax
jle 0x433933
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
add ebp, edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
add ebp, ecx
xor esi, esi
test ecx, ecx
jle 0x43380a
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x14]
sub ebx, eax
add ebx, edx
mov eax, ebx
add ebx, edi
cdq
xor eax, edx
sub eax, edx
shl eax, 8
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, ecx
mov byte [esi + ebp - 1], al
jl 0x4337f0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add edx, eax
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
jne 0x4337d8
jmp 0x433933
test edi, edi
jge 0x4338b0
test edx, edx
jg 0x4338b0
mov eax, esi
imul eax, edx
mov edx, ecx
imul edx, edi
add eax, edx
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x1c], eax
mov eax, ecx
neg eax
test esi, esi
jle 0x433933
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], 0
lea ebp, [eax + edx]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
add ebp, ecx
xor esi, esi
test ecx, ecx
jle 0x433892
mov ebx, dword [esp + 0x10]
mov eax, ebx
add ebx, edi
cdq
xor eax, edx
sub eax, edx
shl eax, 8
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, ecx
mov byte [esi + ebp - 1], al
jl 0x433878
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add esi, edx
dec eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
jne 0x43386c
jmp 0x433933
mov esi, dword [esp + 0x28]
mov edx, ecx
mov eax, esi
imul edx, edi
imul eax, dword [esp + 0x14]
add eax, edx
cdq
mov ebx, eax
mov eax, ecx
xor ebx, edx
sub ebx, edx
neg eax
test esi, esi
jle 0x433933
mov edx, dword [esp + 0x20]
mov dword [esp + 0x38], 0
add eax, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
xor esi, esi
add edx, ecx
test ecx, ecx
mov dword [esp + 0x10], edx
jle 0x43391a
mov ebp, dword [esp + 0x38]
mov eax, ebp
add ebp, edi
sub eax, ebx
inc eax
cdq
xor eax, edx
sub eax, edx
shl eax, 8
cdq
idiv ebx
mov edx, dword [esp + 0x10]
inc esi
cmp esi, ecx
mov byte [edx + esi - 1], al
jl 0x4338fb
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x38]
add edx, eax
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x18], eax
jne 0x4338e7
push 0x428
call fcn.004970a0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x433972
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00496fcb
mov edx, dword [esp + 0x24]
push edx
call fcn.00496fcb
mov ecx, dword [esp + 0x3c]
add esp, 8
test ecx, ecx
je 0x43408d
mov eax, dword [ecx]
push 1
jmp 0x43408a
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
xor eax, eax
lea ebp, [ecx + 1]
lea edi, [ebx + 0x28]
mov ecx, 0x100
mov dword [ebx], 0x28
mov dword [ebx + 4], ebp
mov dword [ebx + 8], edx
mov word [ebx + 0xc], 1
mov word [ebx + 0xe], 8
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
rep movsd dword es:[edi], dword [esi]
cmp dword [0x4d6da8], eax
je 0x4339e0
mov ecx, dword [0x4d6dac]
cmp ecx, eax
je 0x4339c6
mov eax, dword [ecx + 4]
mov edi, dword [esp + 0x34]
push eax
mov eax, dword [edi + 4]
push eax
call fcn.004ad796
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x4339e4
mov edi, dword [esp + 0x34]
push 8
call fcn.004aa6ea
add esp, 4
test eax, eax
je 0x433a03
mov dword [eax + 4], 0
mov dword [eax], 0x4bcfb4
mov esi, eax
jmp 0x433a05
xor esi, esi
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
push ecx
push ebp
mov eax, dword [edx + 0x2c]
mov dword [esp + 0x40], esi
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, esi
call fcn.004ae048
test esi, esi
jne 0x433a5f
mov eax, dword [esp + 0x24]
push eax
call fcn.00496fcb
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00496fcb
push ebx
call fcn.00496fcb
add esp, 0xc
test edi, edi
je 0x43408d
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 4]
jmp 0x43408d
mov eax, dword [esi + 4]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.004ad796
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [edi + 4]
push 0
push ebx
mov dword [esp + 0x50], eax
mov eax, dword [esi + 4]
push ebp
push edx
push 0
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetDIBits]
mov edx, dword [esp + 0x24]
push edx
call fcn.00496fcb
push ebp
call fcn.00496fcb
push ebx
call fcn.00496fcb
add esp, 0xc
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x1b4]
mov esi, dword [esp + 0x2c]
cmp dword [eax + 4], 0x20
jne 0x433abc
inc esi
mov eax, dword [esp + 0x4c]
mov dword [0x4d5aa0], esi
cmp esi, eax
jge 0x43404e
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x4c]
add ecx, esi
cmp ecx, eax
mov dword [0x4d5a9c], ecx
jle 0x433aea
mov ecx, eax
mov dword [0x4d5a9c], ecx
mov edx, esi
lea eax, [ecx + 1]
shl edx, 8
sub edx, 0x100
mov dword [0x4d5a98], ecx
mov dword [0x4d5a90], edx
mov edx, dword [0x4d5acc]
shl eax, 8
mov dword [0x4d5a8c], eax
lea eax, [edx*4]
sub ecx, esi
xor edx, edx
and ecx, 0xffff
mov dx, ax
imul ecx, edx
mov edi, dword [0x4d5ac4]
add ecx, 4
mov edx, ecx
mov word [0x4d5aca], ax
or eax, 0xffffffff
mov dword [0x4d5a94], esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [0x4d5a9c]
mov esi, dword [0x4d5aa0]
sub ecx, esi
xor eax, eax
test ecx, ecx
jle 0x433b91
mov edx, dword [0x4d5ac0]
mov ecx, dword [0x4d5ac4]
and edx, 0xffff
add ecx, edx
inc eax
mov word [ecx + eax*2 - 2], 1
mov edx, dword [0x4d5a9c]
mov esi, dword [0x4d5aa0]
sub edx, esi
cmp eax, edx
jl 0x433b63
mov eax, dword [esp + 0x60]
mov byte [0x4d5ac8], 0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x58]
test eax, eax
mov dword [esp + 0x14], 0
jle 0x433dcc
mov ebx, dword [esp + 0x2c]
jmp 0x433bc0
mov esi, dword [0x4d5aa0]
mov al, byte [0x4d5ac8]
test al, al
jne 0x433d88
movsx esi, word [ebx]
mov ecx, dword [ebx + 6]
mov eax, dword [ebx + 2]
add ebx, 2
push ecx
push eax
mov dword [esp + 0x58], esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], ecx
add ebx, 8
call fcn.004340d0
test esi, esi
mov dword [esp + 0x10], 0
jle 0x433ce6
mov al, byte [0x4d5ac8]
test al, al
jne 0x433ce6
movsx ecx, word [ebx]
movsx eax, word [ebx + 2]
add ebx, 4
mov dword [esp + 0x1c], eax
test ecx, ecx
mov dword [esp + 0x2c], ebx
je 0x433c95
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
lea edx, [eax - 1]
mov dword [esp + 0x18], 1
cmp edx, 1
jle 0x433c82
add ebx, 8
mov al, byte [0x4d5ac8]
test al, al
jne 0x433c7a
mov ebp, dword [ebx + 4]
mov edi, dword [ebx]
lea eax, [esi + ebp]
cdq
sub eax, edx
sar eax, 1
push eax
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
push eax
push esi
push ecx
call fcn.004344b0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
inc eax
add ebx, 8
dec edx
mov ecx, edi
cmp eax, edx
mov esi, ebp
mov dword [esp + 0x18], eax
jl 0x433c3a
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov edx, dword [ebx + eax*8 - 4]
mov eax, dword [ebx + eax*8 - 8]
push edx
push eax
push esi
push ecx
call fcn.004344b0
jmp 0x433cc0
xor edi, edi
test eax, eax
jle 0x433cc0
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov al, byte [0x4d5ac8]
test al, al
jne 0x433cc0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ecx
push edx
call fcn.00434180
inc edi
add esi, 8
cmp edi, ebx
jl 0x433ca3
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
lea edx, [eax + ecx*8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x50]
inc eax
cmp eax, ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x10], eax
mov ebx, edx
jl 0x433bff
mov esi, dword [esp + 0x54]
mov eax, dword [esp + 0x20]
push esi
push eax
call fcn.00434180
mov ecx, dword [0x4d5a80]
mov eax, dword [0x4d5a88]
add esi, 0x80
sar esi, 8
cmp ecx, eax
jge 0x433d14
mov eax, ecx
mov dword [0x4d5a88], eax
mov edx, dword [0x4d5a7c]
mov ecx, dword [0x4d5a84]
cmp edx, ecx
jle 0x433d2c
mov ecx, edx
mov dword [0x4d5a84], ecx
cmp eax, ecx
push esi
jne 0x433d39
push eax
call fcn.004349b0
jmp 0x433d40
push ecx
push eax
call fcn.00434a80
mov ecx, dword [0x4d5aa8]
test ecx, ecx
je 0x433d57
mov eax, dword [0x4d5aac]
test eax, eax
je 0x433d64
cmp eax, ecx
je 0x433d64
mov ecx, dword [0x4d5a84]
push esi
push ecx
call fcn.004349b0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x58]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x433bba
mov al, byte [0x4d5ac8]
mov esi, dword [0x4d5aa0]
test al, al
je 0x433dcc
mov ax, word [0x4d5acc]
add ax, 0xa
movsx edx, ax
mov word [0x4d5acc], ax
lea ecx, [edx*4 + 2]
mov edx, dword [0x4d6dc4]
lea eax, [edx - 4]
xor edx, edx
div ecx
mov dword [esp + 0x5c], eax
imul eax, dword [0x4d5acc]
lea eax, [eax*4 + 4]
mov word [0x4d5ac0], ax
jmp 0x434040
mov edi, dword [0x4d5a98]
cmp edi, esi
jge 0x433dde
mov edi, esi
mov dword [0x4d5a98], edi
mov ecx, dword [0x4d5a94]
mov edx, dword [0x4d5a9c]
inc ecx
cmp ecx, edx
mov dword [0x4d5a94], ecx
jle 0x433dfd
mov ecx, edx
mov dword [0x4d5a94], ecx
cmp ecx, edi
jle 0x434038
mov eax, edi
mov ebp, SysReAllocString
sub eax, esi
mov dword [esp + 0x10], ebp
movsx esi, word [0x4d5acc]
imul eax, esi
mov esi, dword [0x4d5ac4]
lea eax, [esi + eax*4]
mov esi, dword [esp + 0x1b8]
test esi, esi
mov dword [esp + 0x14], eax
je 0x433e3c
mov dword [esp + 0x10], OleUIBusyA
cmp edi, ecx
jge 0x434038
jmp 0x433e4a
mov eax, dword [esp + 0x14]
movsx ecx, word [0x4d5acc]
lea ecx, [eax + ecx*4]
cmp eax, ecx
mov dword [esp + 0x18], ecx
jae 0x43401c
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx]
cmp esi, 0xffffffff
je 0x43401c
mov eax, dword [ecx + 4]
add ecx, 4
add esi, 0x80000000
xor edx, edx
add ecx, 4
cmp eax, 0x80000000
mov dword [esp + 0x14], ecx
jae 0x433e96
mov edx, eax
mov eax, dword [ecx]
add ecx, 4
mov dword [esp + 0x14], ecx
mov ebx, dword [ecx]
sub eax, 0x80000000
cmp ebx, 0x80000000
jae 0x433eae
add ecx, 4
mov eax, ebx
mov dword [esp + 0x14], ecx
sub esi, 0x40000000
cmp eax, edx
ja 0x433eba
mov eax, edx
lea ebx, [eax - 0x40000000]
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x10]
cmp eax, edi
jl 0x433f70
jne 0x433f94
cmp ebp, ebx
jge 0x433f94
cmp eax, edi
jne 0x433f70
cmp ebp, esi
jl 0x433f70
mov edx, dword [esp + 0x1b4]
mov eax, dword [edx]
cmp eax, 1
mov eax, dword [esp + 0x1b0]
jne 0x433f28
mov ecx, dword [eax*4 + 0x4d0d0c]
mov eax, dword [esp + 0x30]
mov edx, ebp
push ecx
mov ecx, dword [eax + 0x2c]
sub edx, esi
inc edx
push 1
push edx
mov edx, dword [ecx + 4]
push edi
push esi
push edx
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x433f6d
mov ecx, dword [eax*4 + 0x4d0cf8]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov edx, dword [edx + 0x2c]
test eax, eax
je 0x433f41
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x44]
push ecx
mov ecx, edi
sub ecx, ebx
mov ebx, dword [esp + 0x44]
push ecx
mov ecx, esi
sub ecx, ebx
push ecx
push eax
mov ecx, dword [edx + 4]
mov eax, ebp
sub eax, esi
push 1
inc eax
push eax
push edi
push esi
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ebx, dword [esp + 0x50]
lea esi, [ebp + 1]
push edi
push esi
call dword [esp + 0x1c0]
mov ebp, eax
add esp, 8
and ebp, 0xffff
shr eax, 0x10
add ebp, esi
add eax, edi
mov dword [esp + 0x10], eax
jmp 0x433ec4
mov edx, dword [esp + 0x1b4]
cmp dword [edx], 1
jne 0x433fca
mov eax, dword [esp + 0x1b0]
mov edx, dword [esp + 0x30]
sub ebx, esi
mov ecx, dword [eax*4 + 0x4d0d0c]
mov eax, dword [edx + 0x2c]
push ecx
inc ebx
mov ecx, dword [eax + 4]
push 1
push ebx
push edi
push esi
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x43400c
mov edx, dword [esp + 0x1b0]
mov eax, dword [esp + 0x30]
mov ecx, dword [edx*4 + 0x4d0cf8]
mov edx, dword [eax + 0x2c]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x433fea
mov eax, dword [eax + 4]
push ecx
mov ecx, edi
sub ecx, dword [esp + 0x48]
mov edx, dword [edx + 4]
sub ebx, esi
push ecx
mov ecx, esi
sub ecx, dword [esp + 0x48]
inc ebx
push ecx
push eax
push 1
push ebx
push edi
push esi
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ecx, eax
jb 0x433e64
mov eax, dword [esp + 0x18]
inc edi
mov dword [esp + 0x14], eax
mov eax, dword [0x4d5a94]
cmp edi, eax
jl 0x433e46
mov edx, dword [0x4d5a9c]
mov esi, edx
mov dword [0x4d5aa0], esi
cmp esi, dword [esp + 0x4c]
jl 0x433ace
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1b4]
mov ebx, dword [esp + 0x38]
cmp dword [ecx], 1
jne 0x4340a8
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x48]
push edx
mov ecx, dword [eax + 0x2c]
call fcn.004ad7e9
test edi, edi
je 0x43407c
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 4]
mov esi, dword [esp + 0x34]
test esi, esi
je 0x43408d
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esp + 0x198]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x194
ret 0x14
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4340b3
mov eax, dword [eax + 4]
mov esi, dword [esp + 0x34]
push eax
mov eax, dword [esi + 4]
push eax
call fcn.004ad796
test ebx, ebx
je 0x434080
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx + 4]
jmp 0x434080