Function at 0x4111b0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0xb0
mov eax, dword [0x44e0fc]
mov ecx, dword [0x44f1cc]
add eax, 0xffffffc4
push ebx
cdq
idiv ecx
push ebp
mov ebp, dword [esp + 0xbc]
imul ecx, ebp
push esi
push edi
mov edi, dword [0x44e0f8]
add ecx, 0x16
mov ebx, ecx
mov esi, 0xc
lea ecx, [edi - 0x20]
mov dword [esp + 0x18], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
test ebp, ebp
mov dword [esp + 0x10], edx
jge 0x41122d
add edi, 0xffffffd8
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
mov ebx, 4
shr eax, 0x1f
add edx, eax
mov esi, 5
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0x18]
jge 0x41175e
test ebp, ebp
jl 0x4114d4
mov ecx, dword [0x4618a4]
push ecx
call fcn.0040b150
mov edx, dword [0x44e0f8]
mov ecx, dword [0x44f1cc]
mov ebp, eax
add esp, 4
lea eax, [edx - 0x14]
add ecx, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
mov al, byte [esp + 0xd0]
mov dword [esp + 0x20], esi
test al, 2
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ecx
je 0x411289
mov edx, dword [0x451384]
push edx
jmp 0x41128f
mov eax, dword [0x451380]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0xd0]
and eax, 1
mov dword [esp + 0x14], eax
jne 0x4112af
mov ecx, dword [0x451388]
push ecx
jmp 0x4112b6
mov edx, dword [0x45138c]
push edx
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
push ebp
call fcn.0040d600
mov eax, dword [0x456b10]
add esp, 4
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [sym.imp.USER32.dll_DrawTextA]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xcc]
test eax, eax
jl 0x4113a2
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], ecx
cdq
mov ecx, 0x3c
idiv ecx
push edx
push eax
lea edx, [esp + 0x4c]
push str.__d:_02d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x30]
lea edi, [esp + 0x44]
or ecx, 0xffffffff
push 0xd20
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
push ebp
call esi
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov edx, ecx
sub edx, eax
mov eax, dword [0x44e0f8]
lea edi, [eax - 0x20]
cmp edx, edi
jge 0x4113a2
mov edx, eax
add eax, 0xffffffec
sub edx, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], eax
lea edi, [esp + 0x44]
lea ecx, [ecx + edx - 0x14]
xor eax, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x30]
push 0x922
dec ecx
push edx
lea eax, [esp + 0x4c]
push ecx
push eax
push ebp
call esi
mov edx, dword [esp + 0xc8]
lea ecx, [esp + 0x20]
push 0x8824
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebp
call esi
lea edx, [esp + 0x20]
push 0x8c20
push edx
mov edx, dword [esp + 0xd0]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebp
call esi
mov eax, dword [esp + 0x14]
test eax, eax
mov eax, dword [0x456c80]
jne 0x4113f8
mov eax, dword [0x457220]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebp
call esi
push 8
mov dword [esp + 0x44], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push ebp
call esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov edi, dword [sym.imp.GDI32.dll_Rectangle]
inc eax
inc ecx
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
push ebp
call edi
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x411449
mov ecx, dword [esp + 0x18]
dec ecx
cmp eax, ecx
jne 0x4114a1
mov edx, dword [0x457220]
push edx
push ebp
call esi
mov eax, dword [esp + 0xc4]
test eax, eax
jne 0x411470
mov eax, dword [0x44e0f8]
push 0x18
add eax, 0xffffffed
push eax
push 0x14
push 0xc
push ebp
call edi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc4]
dec ecx
cmp eax, ecx
jne 0x4114a1
mov edx, dword [0x44e0fc]
mov eax, dword [0x44e0f8]
mov ecx, dword [0x44f1cc]
add edx, 0xffffffdb
add eax, 0xffffffed
push edx
add ecx, ebx
push eax
push ecx
push 0xc
push ebp
call edi
mov edx, dword [esp + 0x1c]
push edx
push ebp
call esi
mov eax, dword [esp + 0x14]
push eax
push ebp
call esi
mov ecx, dword [esp + 0x40]
push ecx
push ebp
call esi
mov edx, dword [0x4618a4]
push ebp
push edx
call fcn.0040b170
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret
mov edx, dword [0x4618a4]
mov al, byte [0x4564f8]
xor ecx, ecx
push edx
mov dword [esp + 0x25], ecx
mov byte [esp + 0x24], al
mov dword [esp + 0x29], ecx
mov byte [esp + 0x2d], cl
call fcn.0040b150
mov ebp, eax
mov eax, dword [0x457394]
push 0
push eax
call fcn.0040b4d0
push ebp
call fcn.0040d600
mov eax, dword [esp + 0xdc]
add esp, 0x10
test eax, eax
jl 0x411554
cdq
mov ecx, 0x3c
idiv ecx
push edx
push eax
lea edx, [esp + 0x28]
push str._d:_02d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
or eax, 0xffffffff
sub eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
xor ecx, ecx
xor edi, edi
cmp eax, ecx
jle 0x4115d8
mov edx, dword [esp + 0xc8]
mov al, byte [edi + edx]
test al, al
je 0x4115df
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x18], al
dec ecx
cmp edi, ecx
jne 0x411590
mov al, byte [edi + edx + 1]
test al, al
je 0x411590
mov byte [esp + 0x18], 1
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x14]
push edx
push eax
push ecx
call fcn.0040d630
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x456dd4]
add esp, 0xc
push 0xcc0020
push edx
push eax
push ecx
push 6
push 5
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x10]
add esi, 5
inc edi
xor ecx, ecx
cmp edi, eax
jl 0x411560
mov edx, dword [esp + 0xc8]
cmp byte [edi + edx], 0
jne 0x411643
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x20
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ecx
call fcn.0040d630
mov eax, dword [esp + 0xd8]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x10]
jl 0x411611
inc eax
cmp edi, eax
jge 0x411641
sub eax, edi
mov edi, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [0x456dd4]
push 0xcc0020
push ecx
push edx
push eax
push 6
push 5
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
add esi, 5
dec edi
jne 0x411619
xor ecx, ecx
cmp dword [esp + 0xcc], ecx
jl 0x4116fa
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x20
call fcn.0040d630
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x456dd4]
add esp, 0xc
push 0xcc0020
push eax
push ecx
push edx
push 6
push 5
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [0x44e0f8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx*4]
sub esi, eax
mov al, byte [esp + 0x20]
sub esi, 0x1d
test al, al
je 0x4116f8
lea edi, [esp + 0x20]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
call fcn.0040d630
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x456dd4]
add esp, 0xc
push 0xcc0020
push eax
push ecx
push edx
push 6
push 5
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov al, byte [edi + 1]
add esi, 5
inc edi
test al, al
jne 0x4116b7
xor ecx, ecx
mov eax, dword [0x44e0f8]
lea edi, [eax - 0x1e]
cmp esi, edi
jge 0x411748
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x20
call fcn.0040d630
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [0x456dd4]
add esp, 0xc
sub edi, esi
push 0xcc0020
push eax
push ecx
push edx
push 6
push edi
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
xor ecx, ecx
push ecx
push ecx
call fcn.0040b4d0
mov eax, dword [0x4618a4]
push ebp
push eax
call fcn.0040b170
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret