Function at 0x435500
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0xbc
mov eax, dword [0x441260]
push ebx
push ebp
push esi
cmp eax, 0xffffffff
push edi
mov dword [esp + 0x2c], 0
jne 0x435543
push 0x1003
push 0x5000
call fcn.0042ab70
test eax, eax
mov dword [0x441260], eax
jge 0x435543
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x18
push 0x49
push eax
call fcn.0042abe0
mov ebp, eax
test ebp, ebp
jne 0x43555e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x18
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xd4]
mov esi, dword [esp + 0xe4]
mov edi, dword [sym.imp.USER32.dll_GetClassInfoA]
lea edx, [esp + 0xa4]
mov dword [ebp + 4], eax
mov dword [ebp], ecx
mov dword [ebp + 0x20], 1
mov dword [ebp + 0x44], esi
mov eax, dword [0x445c90]
push edx
push 0x4452b0
push eax
call edi
test eax, eax
mov ebx, 8
jne 0x43560a
mov eax, 4
push 1
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov eax, dword [0x445c90]
mov dword [esp + 0x48], ebx
push eax
mov dword [esp + 0x50], sym.DEMO32.EXE_WinSupWndProc
mov dword [esp + 0x5c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x60], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [esp + 0x44]
mov dword [esp + 0x60], 0x11
push ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], 0x4459d8
mov dword [esp + 0x6c], 0x4452bc
call dword [sym.imp.USER32.dll_RegisterClassA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x7c]
mov byte [esp + 0x7c], 0
mov ecx, dword [ebp + 4]
push edx
push eax
push 0x28
push ecx
call fcn.00403b80
mov al, byte [esp + 0x7c]
test al, al
jne 0x43563c
lea edx, [esp + 0x7c]
push 0x4452c8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 4]
lea eax, [esp + 0x10]
push eax
push 0
push 0x10
push ecx
call fcn.00403b80
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x43565b
mov dword [ebp + 0x2c], ebx
jmp 0x435662
mov dword [ebp + 0x2c], 0
mov eax, dword [ebp + 4]
lea edx, [esp + 0x10]
push edx
push 0
push 0x22
push eax
call fcn.00403b80
mov ebx, 1
cmp dword [esp + 0x10], ebx
jne 0x435bb0
mov edx, dword [ebp + 4]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x33
push edx
call fcn.00403b80
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov eax, dword [0x445c84]
jne 0x435778
test eax, eax
jne 0x4357af
mov ecx, dword [ebp + 4]
lea eax, [esp + 0x10]
push eax
push 0
push 0x1f
push ecx
call fcn.00403b80
mov eax, dword [0x445c90]
lea edx, [esp + 0xa4]
push edx
push 0x4452d4
push eax
call edi
test eax, eax
jne 0x43573b
mov ecx, 0xa
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
mov eax, dword [0x445c90]
push 1
push eax
mov dword [esp + 0x50], sym.DEMO32.EXE_WinSupBackWndProc
mov dword [esp + 0x5c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x60], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x5c], eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea edx, [esp + 0x44]
mov dword [esp + 0x68], 0x4452e4
push edx
mov dword [esp + 0x64], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov eax, dword [0x445c90]
push 0
push eax
push 0
push 0
push 1
call ebx
push eax
push 0
call ebx
mov edx, dword [ebp + 0x2c]
push eax
push 0
push 0
lea ecx, [esp + 0x9c]
push 0x82000000
push ecx
push 0x4452f4
push edx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x445c84], eax
jmp 0x4357af
test eax, eax
je 0x4357af
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4357af
mov eax, dword [0x445c84]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [0x445c90]
mov dword [0x445c84], 0
push ecx
push str.WinSupBackClass
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [ebp + 4]
lea edx, [esp + 0x10]
push edx
push 0
push 0xc
push eax
call fcn.00403b80
mov eax, dword [esp + 0x10]
test ax, ax
jne 0x4357d3
mov dword [esi + 8], 0x280
jmp 0x4357eb
cmp ax, 0x32
jae 0x4357e0
mov ecx, 0x32
jmp 0x4357e8
mov ecx, eax
and ecx, 0xffff
mov dword [esi + 8], ecx
shr eax, 0x10
test ax, ax
jne 0x4357fc
mov dword [esi + 0xc], 0x1e0
jmp 0x435811
cmp ax, 0x32
jae 0x435809
mov eax, 0x32
jmp 0x43580e
and eax, 0xffff
mov dword [esi + 0xc], eax
push 0
mov dword [esp + 0x20], 0x800000
call ebx
cmp dword [esi + 8], eax
jne 0x435833
push 1
call ebx
cmp dword [esi + 0xc], eax
jne 0x435833
mov dword [esp + 0x1c], 0
mov edx, dword [ebp + 4]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x1d
push edx
call fcn.00403b80
mov ecx, dword [esi + 8]
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esi], ecx
mov edi, eax
push edx
shr eax, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 4]
push 0
and edi, 0xffff
push 0x2f
push eax
mov dword [esp + 0x38], edi
call fcn.00403b80
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4358ff
push 0
call ebx
mov ecx, eax
mov eax, 0x66666667
imul ecx, edi
imul ecx
sar edx, 8
mov ecx, edx
push 1
shr ecx, 0x1f
add edx, ecx
mov edi, edx
mov dword [esp + 0x2c], edi
call ebx
mov ecx, eax
mov eax, 0x88888889
imul ecx, dword [esp + 0x24]
imul ecx
add edx, ecx
push 0
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x28], edx
call ebx
mov ecx, eax
mov eax, 0x66666667
imul ecx, dword [esi]
imul ecx
sar edx, 8
mov ecx, edx
push 1
shr ecx, 0x1f
add edx, ecx
mov dword [esi], edx
call ebx
mov ecx, eax
mov eax, 0x88888889
imul ecx, dword [esi + 4]
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 4], edx
mov edx, dword [ebp + 4]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x13
push edx
call fcn.00403b80
mov ecx, dword [esi]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
dec eax
neg eax
sbb eax, eax
and eax, 0xca0000
test ecx, ecx
mov dword [esp + 0x20], eax
je 0x435944
push 5
call ebx
mov edx, dword [esp + 0x18]
lea eax, [edx + eax*2]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x435957
push 5
call ebx
mov ecx, dword [esp + 0x18]
lea edx, [ecx + eax*4]
mov dword [esp + 0x18], edx
push 0
call ebx
cmp dword [esp + 0x18], eax
jle 0x43599c
push 0
call ebx
push 0
mov dword [esp + 0x1c], eax
call ebx
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x435985
push 5
call ebx
mov ecx, dword [esi]
neg eax
shl eax, 1
add ecx, eax
mov dword [esi], ecx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43599c
push 5
call ebx
mov ecx, dword [esi]
neg eax
shl eax, 2
add ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4359ba
push 6
call ebx
mov ecx, dword [esp + 0x14]
lea edx, [ecx + eax*2]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4359db
push 6
call ebx
push 4
mov edi, eax
call ebx
add eax, dword [esp + 0x14]
lea eax, [eax + edi*4]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], eax
push 1
call ebx
cmp dword [esp + 0x14], eax
jle 0x435a31
push 1
call ebx
push 1
mov dword [esp + 0x18], eax
call ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x435a0c
push 6
call ebx
mov ecx, dword [esi + 4]
neg eax
shl eax, 1
add ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x435a31
push 4
call ebx
mov edi, eax
push 6
neg edi
call ebx
shl eax, 2
sub edi, eax
mov eax, dword [esi + 4]
add eax, edi
mov edi, dword [esp + 0x28]
mov dword [esi + 4], eax
mov edx, dword [ebp + 4]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x16
push edx
call fcn.00403b80
mov esi, 1
cmp dword [esp + 0x10], esi
jne 0x435a6d
push 0
call ebx
push esi
sub eax, dword [esp + 0x1c]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
call ebx
sub eax, dword [esp + 0x14]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
jmp 0x435a71
mov ebx, dword [esp + 0x24]
mov ecx, dword [0x445a0c]
cmp ecx, 0xfffffc18
je 0x435a93
mov eax, dword [0x445a10]
cmp eax, 0xfffffc18
je 0x435a93
mov edi, ecx
mov dword [esp + 0x24], eax
mov ebx, eax
push 0x18
mov dword [ebp + 0x30], 0
call fcn.00429fb0
mov dword [ebp + 0x40], eax
mov eax, dword [0x445c90]
mov ecx, dword [0x445c84]
mov edx, dword [esp + 0x14]
push 0
push eax
mov eax, dword [esp + 0x20]
push 0
push ecx
push edx
push eax
mov eax, dword [esp + 0x34]
push ebx
push edi
mov edi, dword [esp + 0x40]
mov edx, dword [ebp + 0x2c]
or eax, edi
lea ecx, [esp + 0x9c]
or eax, 0x82000000
push eax
push ecx
push 0x445314
push edx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [0x445c84]
test ecx, ecx
mov dword [esp + 0x40], eax
je 0x435b04
push esi
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x435b2d
mov eax, dword [ebp + 0x40]
push eax
call fcn.0042a000
mov ecx, dword [0x441260]
push ebp
push ecx
call fcn.0042ad10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x18
lea edx, [esp + 0x6c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov dword [esp + 0x2c], esi
mov eax, dword [ebp + 0x40]
lea edx, [esp + 0x2c]
push edx
push eax
call fcn.00429da0
push ebp
push 0
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
mov edx, dword [esp + 0x44]
push edx
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov esi, eax
test esi, esi
je 0x435d1d
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
push 0
push 0
push 0x800
push esi
call edi
push str.About...
push 0x1000
push 0
push esi
call edi
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x18
mov eax, dword [esp + 0xe0]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
call ebx
mov ecx, eax
mov eax, dword [esi + 8]
imul eax, ecx
cdq
idiv dword [esi + 0xc]
push 0
mov dword [esi + 4], ecx
mov dword [esi], eax
call ebx
cmp dword [esi], eax
jle 0x435bff
push 0
call ebx
mov ecx, eax
mov eax, dword [esi + 0xc]
imul eax, ecx
cdq
idiv dword [esi + 8]
mov dword [esi], ecx
mov dword [esi + 4], eax
push 0
push 0
push 0
push 0x44532c
call dword [sym.imp.GDI32.dll_CreateDCA]
mov edx, dword [esi + 4]
mov ebx, eax
mov eax, dword [esi]
push edx
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp + 0x30], eax
je 0x435c5e
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp + 0x30]
mov edi, eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0xcc0020
push 0
push 0
push ebx
push edx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0x18
call fcn.00429fb0
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp + 0x40], eax
xor esi, esi
mov ecx, dword [0x445c90]
push 0
push ecx
mov edx, dword [ebp + 0x2c]
push 0
push 0
push 0x14
push 0x14
push esi
push esi
push 0x80000000
push 0x4459dc
push 0x445334
push edx
call ebx
test eax, eax
mov dword [esp + 0x40], eax
je 0x435cf8
lea ecx, [esp + 0x6c]
push ecx
push eax
call edi
lea edx, [esp + 0x6c]
lea eax, [esp + 0x30]
push edx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov edx, dword [ebp + 0x40]
lea ecx, [esp + 0x2c]
push ecx
push edx
call fcn.00429da0
push ebp
push 0
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
add esi, 0x32
cmp esi, 0x64
jl 0x435c7d
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x18
mov ecx, dword [ebp + 0x40]
push ecx
call fcn.0042a000
mov edx, dword [0x441260]
push ebp
push edx
call fcn.0042ad10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x18
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x18