Function at 0x6cd7dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x50c], edx
mov dword [ebp - 0x510], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ceeba
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
xor ecx, ecx
push ebp
push 0x6cee87
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x3adc4], 0
xor eax, eax
mov dword [ebp - 0xa0], eax
mov bl, 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x3ad3c], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x378], 0xffffffff
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x3ad40], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x398], edx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x394]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x28]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x28]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x3ad4c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x3ad50], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x3ad4c]
dec eax
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x3ad50]
dec eax
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
call fcn.006c7804
lea edx, [ebp - 0x4f8]
mov eax, dword [0x8aa338]
mov eax, dword [eax]
call fcn.0046ff50
mov eax, dword [ebp - 0x4ec]
add eax, 0xa
push eax
lea eax, [ebp - 0x4e8]
push eax
lea edx, [ebp - 0x508]
mov eax, dword [0x8aa338]
mov eax, dword [eax]
call fcn.0046ff50
mov edx, dword [ebp - 0x4fc]
inc edx
mov ecx, 0xa
xor eax, eax
call fcn.0041d124
lea edx, [ebp - 0x4e8]
mov eax, dword [ebp - 4]
call fcn.0044ecb0
push 0x12c
call sub.kernel32.dll_Sleep_1
xor eax, eax
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x429024]
call fcn.0042afa8
mov dword [ebp - 0x7c], eax
call sub.user32.dll_GetDesktopWindow
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.user32.dll_GetWindowDC
mov edx, eax
mov eax, dword [ebp - 0x7c]
call fcn.0042b99c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3adc8], 0
jne 0x6cd9a1
mov dl, 1
mov eax, dword [0x63d47c]
call fcn.006459ec
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3adc8], edi
mov eax, edi
mov dl, 5
call fcn.00646794
mov eax, dword [ebp - 4]
mov byte [eax + 0x3ae1d], 1
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x28]
sub edx, dword [eax + 8]
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064605c
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x28]
sub edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064621c
xor eax, eax
mov dword [ebp - 0x94], eax
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b3d0
mov eax, dword [ebp - 0x7c]
call fcn.0042b3d0
push 0xcc0020
mov eax, dword [0x8aa338]
mov eax, dword [eax]
call fcn.0046efdc
mov edx, dword [ebp - 0x28]
add eax, dword [edx + 0xc]
push eax
mov eax, dword [0x8aa338]
mov eax, dword [eax]
call fcn.0046efe8
mov edx, dword [ebp - 0x28]
add eax, dword [edx + 8]
push eax
mov eax, dword [ebp - 0x7c]
call fcn.0042b91c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
push eax
mov eax, dword [ebp - 0x94]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 0x7c]
call fcn.0042b7f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b7f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x3adfc], edx
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x5c]
cmp eax, 0xc
ja case.default.0x6cdae1
jmp dword [eax*4 + 0x6cdae8]
mov dword [ebp - 0x98], 0x19
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x32
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x64
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x96
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0xc8
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0xfa
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x12c
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x1f4
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x3e8
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x5dc
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x7d0
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0xbb8
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x1388
jmp 0x6cdbcb
mov dword [ebp - 0x98], 0x32
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
call fcn.008775a4
mov eax, dword [ebp - 4]
mov byte [eax + 0x3ad47], 0
mov eax, dword [ebp - 4]
call fcn.006d3418
cmp dword [ebp - 8], 1
je 0x6cdc68
cmp dword [ebp - 8], 2
je 0x6cdc68
test bl, bl
je 0x6cdc14
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.006c09e0
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.006c0ba0
jmp 0x6cdc22
cmp dword [ebp - 8], 3
je 0x6cdc22
mov eax, dword [ebp - 4]
call fcn.006c0d24
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
call fcn.004714e0
test bl, bl
je 0x6cdc68
mov eax, dword [ebp - 4]
call fcn.006cd31c
mov eax, dword [ebp - 0x98]
add eax, 0x1f4
mov edx, 0x258
call fcn.004326fc
push eax
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
call fcn.004714e0
push 0x64
call sub.kernel32.dll_Sleep_1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 8], 1
je 0x6cdcf9
cmp dword [ebp - 8], 2
je 0x6cdcf9
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.006c09e0
test bl, bl
je 0x6cdcb2
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.006c0ba0
push ebp
call fcn.006cd608
pop ecx
cmp dword [ebp - 0x24], 0
jg 0x6cdcb2
mov eax, dword [ebp - 4]
mov byte [eax + 0x3ad47], 1
mov eax, dword [ebp - 4]
call fcn.006cd31c
mov eax, dword [ebp - 0x98]
add eax, 0x1f4
mov edx, 0x258
call fcn.004326fc
push eax
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
call fcn.004714e0
push 0x64
call sub.kernel32.dll_Sleep_1
test bl, bl
jne 0x6cdcf9
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.006c0ba0
test bl, bl
jne 0x6cdd04
push ebp
call fcn.006cd608
pop ecx
cmp dword [ebp - 0x24], 0
jle 0x6cdd31
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov byte [eax + 0x3ad3c], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov dword [eax + 0x3adfc], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jle 0x6cdd31
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
xor ebx, ebx
cmp dword [ebp - 0x24], 0
jle 0x6ce29d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3adc4], 0
je 0x6cddcd
test edi, edi
jne 0x6cddcd
cmp dword [ebp - 0xa0], 0x64
jge 0x6cddcd
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
push ebp
mov eax, dword [ebp - 0x24]
call fcn.006cd3e8
pop ecx
mov edx, dword [ebp - 0xa0]
mov dword [ebp + edx*4 - 0x278], eax
inc dword [ebp - 0xa0]
call sub.kernel32.dll_GetTickCount
xor edx, edx
sub eax, dword [ebp - 0xb0]
sbb edx, dword [ebp - 0xac]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
mov eax, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xb4]
add eax, dword [ebp - 0xb0]
adc edx, dword [ebp - 0xac]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], edx
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x94], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 8]
mov edx, eax
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064621c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b3d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b3d0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x578
jl 0x6cde9e
push 0xcc0020
push 0x258
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x258
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
cmp eax, 0x4b0
jl 0x6cdf0e
push 0xcc0020
push 0x1f4
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x1f4
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
cmp eax, 0x3e8
jl 0x6cdf7e
push 0xcc0020
push 0x1c2
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x1c2
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
cmp eax, 0x320
jl 0x6cdfee
push 0xcc0020
push 0x190
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x190
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
cmp eax, 0x2bc
jl 0x6ce05e
push 0xcc0020
push 0x15e
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x15e
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
cmp eax, 0x258
jl 0x6ce0ce
push 0xcc0020
push 0x12c
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x12c
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
cmp eax, 0x1f4
jl 0x6ce13e
push 0xcc0020
push 0xfa
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0xfa
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
cmp eax, 0x12c
jl 0x6ce1ae
push 0xcc0020
push 0x96
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x96
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
cmp eax, 0x96
jl 0x6ce216
push 0xcc0020
push 0x32
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x1e
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x32
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce275
push 0xcc0020
push 0x1e
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x20]
add eax, eax
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x1e
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b7f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b7f0
jmp 0x6ce2bc
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3ad3c], 0
je 0x6ce2b2
cmp dword [ebp - 8], 3
jl 0x6ce2bc
mov eax, dword [ebp - 4]
mov byte [eax + 0x3ad47], 1
cmp dword [ebp - 8], 5
jl 0x6ce749
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b3d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b3d0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x578
jl 0x6ce371
push 0xcc0020
push 0x258
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x258
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x258
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce723
cmp eax, 0x4b0
jl 0x6ce3ea
push 0xcc0020
push 0x1f4
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x1f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x1f4
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce723
cmp eax, 0x3e8
jl 0x6ce463
push 0xcc0020
push 0x1c2
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x1c2
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x1c2
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce723
cmp eax, 0x320
jl 0x6ce4dc
push 0xcc0020
push 0x190
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x190
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x190
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce723
cmp eax, 0x2bc
jl 0x6ce555
push 0xcc0020
push 0x15e
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x15e
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x15e
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce723
cmp eax, 0x258
jl 0x6ce5ce
push 0xcc0020
push 0x12c
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x12c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x12c
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce723
cmp eax, 0x1f4
jl 0x6ce647
push 0xcc0020
push 0xfa
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0xfa
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0xfa
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce723
cmp eax, 0x12c
jl 0x6ce6bd
push 0xcc0020
push 0x96
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x96
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x96
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6ce723
push 0xcc0020
push 0x32
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x32
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b7f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b7f0
cmp dword [ebp - 8], 5
jge 0x6ce75f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3ade8], 0
je 0x6cdbe0
xor eax, eax
push ebp
push 0x6cec55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3ade8], 0
je 0x6cec4b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b3d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b3d0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x578
jl 0x6ce827
push 0xcc0020
push 0x258
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x258
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x258
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6cec25
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x4b0
jl 0x6ce8ab
push 0xcc0020
push 0x1f4
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x1f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x1f4
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6cec25
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x3e8
jl 0x6ce92f
push 0xcc0020
push 0x1c2
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x1c2
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x1c2
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6cec25
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x320
jl 0x6ce9b3
push 0xcc0020
push 0x190
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x190
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x190
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6cec25
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x2bc
jl 0x6cea37
push 0xcc0020
push 0x15e
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x15e
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x15e
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6cec25
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x258
jl 0x6ceabb
push 0xcc0020
push 0x12c
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x12c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x12c
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6cec25
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x1f4
jl 0x6ceb3f
push 0xcc0020
push 0xfa
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0xfa
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0xfa
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6cec25
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
cmp eax, 0x12c
jl 0x6cebc0
push 0xcc0020
push 0x96
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x96
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x96
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6cec25
push 0xcc0020
push 0x32
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xc]
sub eax, 0x32
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x94]
add eax, 0x32
push eax
add esi, edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b7f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b7f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6cec5f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3ad98]
test ebx, ebx
je 0x6cec7e
cmp byte [ebx + 0x57], 0
je 0x6cec7e
mov eax, ebx
call fcn.00455b24
call fcn.008775a4
push 0
call sub.user32.dll_ClipCursor
mov eax, dword [ebp - 0x7c]
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.user32.dll_ReleaseDC
lea eax, [ebp - 0x7c]
call fcn.00411378
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3ad3c], 0
je 0x6cecdd
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3adc8]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
push 3
call sub.user32.dll_GetSystemMetrics
pop edx
sub edx, eax
inc edx
mov eax, 3
call fcn.004326fc
mov edx, eax
mov eax, ebx
call fcn.0064605c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3adc4], 0
je 0x6cee7d
cmp dword [ebp - 0xa0], 0
jle 0x6cee7d
xor ecx, ecx
push ebp
push 0x6cee73
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edi, 0x98
lea ebx, [ebp - 0x4d8]
xor eax, eax
mov dword [ebx], eax
add ebx, 4
dec edi
jne 0x6ced13
mov edx, dword [ebp - 0xa0]
dec edx
test edx, edx
jl 0x6ced4a
inc edx
lea ebx, [ebp - 0x278]
mov eax, dword [ebx]
cmp eax, 0xffffffff
jl 0x6ced44
cmp eax, 0x96
jge 0x6ced44
inc dword [ebp + eax*4 - 0x4d4]
add ebx, 4
dec edx
jne 0x6ced2f
lea eax, [ebp - 0xa4]
call fcn.00404b34
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], eax
or edi, 0xffffffff
lea ebx, [ebp - 0x4d8]
mov eax, dword [ebx]
cmp eax, dword [ebp - 0x34]
jle 0x6ced72
mov esi, edi
mov dword [ebp - 0x34], eax
test eax, eax
jle 0x6cedbc
push dword [ebp - 0xa4]
push 0x6ceed0
lea edx, [ebp - 0x50c]
mov eax, edi
call fcn.0040b1b8
push dword [ebp - 0x50c]
push 0x6ceedc
lea edx, [ebp - 0x510]
mov eax, dword [ebx]
call fcn.0040b1b8
push dword [ebp - 0x510]
lea eax, [ebp - 0xa4]
mov edx, 5
call fcn.00404ebc
inc edi
add ebx, 4
cmp edi, 0x97
jne 0x6ced66
test esi, esi
jle 0x6cee69
cmp esi, 0x96
jge 0x6cee69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 8]
cmp eax, 0x96
jle 0x6cee69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 0x64
jle 0x6cee69
inc esi
push esi
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 8]
sub eax, esi
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3adc8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
xor ecx, ecx
call fcn.00649938
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 8]
mov edx, eax
sub edx, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3adc8]
call fcn.0064621c
mov eax, dword [ebp - 0x28]
add dword [eax + 0xc], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6cee7d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6cee91
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ceec1
lea eax, [ebp - 0x510]
mov edx, 2
call fcn.00404b58
lea eax, [ebp - 0xa4]
call fcn.00404b34
ret