Function at 0x435d90
Capabilities:
Capture screenshot

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
call edi
mov dword [esp + 0x14], eax
push 0x4d
call edi
mov dword [esp + 0x10], eax
push 7
push esi
call dword [sym.imp.GDI32.dll_GetCurrentObject]
mov edi, eax
lea eax, [esp + 0x34]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0x3c]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
push ebx
mov edi, dword [esp + 0x10]
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 8], eax
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x1c], eax
push 0xcc0020
push dword [esp + 0x14]
push dword [esp + 0x1c]
push esi
push ebx
push edi
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, edi
not eax
lea ecx, [ebx + ebx]
and ecx, 4
neg ecx
mov dword [esp + 0x20], ebx
add ecx, ebx
add ecx, 2
and ecx, eax
mov dword [esp + 4], 0x2f421fef
cmp ecx, 0xffffffff
jl case.default.0x435e60
mov dword [esp + 4], 0xbc1dce23
mov ecx, 0x691c8b9e
xor eax, eax
cmp ecx, 0x2f421fef
setl al
jmp dword [eax*4 + 0x44cae4]
xor eax, eax
cmp ecx, 0x37ff3a5a
setl al
jmp dword [eax*4 + 0x44caec]
xor eax, eax
cmp ecx, 0x691c8b9e
setl al
jmp dword [eax*4 + 0x44caf4]
sete al
movzx eax, al
jmp dword [eax*4 + 0x44cafc]
xor eax, eax
mov ecx, dword [esp + 4]
cmp ecx, 0x2f421fef
setl al
jmp dword [eax*4 + 0x44cae4]
xor eax, eax
cmp ecx, 0x2f421fef
sete al
jmp dword [eax*4 + 0x44cb0c]
push 0xcc0020
push dword [esp + 0x14]
push dword [esp + 0x1c]
push 0
push 0
push esi
push dword [esp + 0x38]
push dword [esp + 0x28]
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, 0xbc1dce23
xor eax, eax
cmp ecx, 0x2f421fef
setl al
jmp dword [eax*4 + 0x44cae4]
xor eax, eax
cmp ecx, 0x37ff3a5a
sete al
jmp dword [eax*4 + 0x44cb04]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], 0x6e601203
mov dword [esp + 0x28], 0x7f387b71
mov dword [esp + 0x2c], 0xea767e
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
add bl, 0x2c
xor bl, byte [esp + ecx + 0x24]
add bl, 0x24
mov byte [esp + ecx + 0x24], bl
inc ecx
cmp ecx, 0xc
jne 0x435f50
lea edi, [esp + 0x24]
mov ecx, dword [esp + 0x60]
push edx
push eax
push edi
call fcn.0040d7b0
mov ebx, eax
mov edi, dword [esp + 0x18]
mov ecx, 0xc43cb4ea
test edi, edi
je 0x435f8a
mov ecx, 0xaf41d972
xor eax, eax
cmp ecx, 0x2f421fef
setl al
mov edx, ebx
mov byte [esp + 3], bl
jmp dword [eax*4 + 0x44cae4]
xor eax, eax
cmp ecx, 0xbc1dce23
setl al
jmp dword [eax*4 + 0x44cb14]
xor eax, eax
cmp ecx, 0xc43cb4ea
setl al
jmp dword [eax*4 + 0x44cb1c]
xor eax, eax
cmp ecx, 0xbc1dce23
sete al
jmp dword [eax*4 + 0x44cb2c]
mov ebx, dword [esp + 0x1c]
push ebx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x18]
push eax
push ecx
push dword [esp + 0x10]
call fcn.004360c0
add esp, 0xc
mov ecx, 0x37ff3a5a
test al, al
jne 0x43602d
mov ecx, 0xc43cb4ea
xor ebx, ebx
xor eax, eax
cmp ecx, 0x2f421fef
setl al
jmp dword [eax*4 + 0x44cae4]
xor eax, eax
cmp ecx, 0xaf41d972
sete al
jmp dword [eax*4 + 0x44cb34]
push edi
call fcn.0040cbc0
add esp, 4
mov ecx, 0xc43cb4ea
xor eax, eax
cmp ecx, 0x2f421fef
setl al
movzx edx, byte [esp + 3]
mov ebx, edx
jmp dword [eax*4 + 0x44cae4]
sete al
movzx eax, al
jmp dword [eax*4 + 0x44cb24]
xor eax, eax
cmp ecx, 0x2f421fef
setl al
jmp dword [eax*4 + 0x44cae4]
push dword [esp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
and bl, 1
mov eax, ebx
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
sub eax, 0x3068f024
sete cl
mov dword [esp + 0x1d4], ecx
mov eax, dword [esp + 0x1d8]
mov ecx, dword [esp + 0x1d4]
mov eax, dword [eax + ecx*4]
jmp eax
mov al, byte [esp + 0x21]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], 0x4876d16f
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xc5cde07f
setl cl
mov dword [esp + 0x13c], ecx
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x31848db5
setl cl
mov dword [esp + 0x1e4], ecx
mov ecx, dword [esp + 0x1e8]
mov edx, dword [esp + 0x1e4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xc5cde07f
sete cl
mov dword [esp + 0x134], ecx
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x134]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xcc97938
setl cl
mov dword [esp + 0x1a4], ecx
mov ecx, dword [esp + 0x1a8]
mov edx, dword [esp + 0x1a4]
mov ecx, dword [ecx + edx*4]
jmp ecx
jmp ebp
call fcn.0040e590
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.0040cbc0
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x74bde9cd
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, byte [esp + 0x22]
and al, 1
movzx eax, al
add esp, 0x2bc
pop esi
pop edi
pop ebx
pop ebp
ret
lodsd eax, dword [esi]
cld
aaa
cmpsd dword [esi], dword es:[edi]
push esi
stosb byte es:[edi], al
stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x3068f024
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x1ee76785
setl cl
mov dword [esp + 0x1c4], ecx
mov ecx, dword [esp + 0x1c8]
mov edx, dword [esp + 0x1c4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xf4f08820
sete cl
mov dword [esp + 0x164], ecx
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x164]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x34], eax
call fcn.0040e590
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x31848db5
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xf0]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x2d8]
mov dword [ecx], eax
mov eax, dword [esp + 0x48]
mov dword [edi], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], 0xd44b2ac
mov byte [esp + 0x21], 1
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0xa0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xb5be1850
setl cl
mov dword [esp + 0x14c], ecx
mov ecx, dword [esp + 0x150]
mov edx, dword [esp + 0x14c]
mov ecx, dword [ecx + edx*4]
jmp ecx
call fcn.0040e590
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x295c1dfa
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x88]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x483b8588
setl cl
mov dword [esp + 0x214], ecx
mov ecx, dword [esp + 0x218]
mov edx, dword [esp + 0x214]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x1268de7d
setl cl
mov dword [esp + 0x194], ecx
mov ecx, dword [esp + 0x198]
mov edx, dword [esp + 0x194]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x5d227528
sete cl
mov dword [esp + 0x22c], ecx
mov eax, dword [esp + 0x230]
mov ecx, dword [esp + 0x22c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0x1268de7d
sete cl
mov dword [esp + 0x18c], ecx
mov eax, dword [esp + 0x190]
mov ecx, dword [esp + 0x18c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xb5be1850
sete cl
mov dword [esp + 0x124], ecx
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xa7992541
setl cl
mov dword [esp + 0x11c], ecx
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x11c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x483b8588
sete cl
mov dword [esp + 0x20c], ecx
mov eax, dword [esp + 0x210]
mov ecx, dword [esp + 0x20c]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x108]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xf4f08820
setl cl
mov dword [esp + 0x16c], ecx
mov ecx, dword [esp + 0x170]
mov edx, dword [esp + 0x16c]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x3e17ef8d
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x3068f024
setl cl
mov dword [esp + 0x1ec], ecx
mov ecx, dword [esp + 0x1f0]
mov edx, dword [esp + 0x1ec]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x940cc88d
sete cl
mov dword [esp + 0x10c], ecx
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x38b17551
setl cl
mov dword [esp + 0x254], ecx
mov ecx, dword [esp + 0x258]
mov edx, dword [esp + 0x254]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0xbf14e2b5
setl cl
mov dword [esp + 0x144], ecx
mov ecx, dword [esp + 0x148]
mov edx, dword [esp + 0x144]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x74bde9cd
sete cl
mov dword [esp + 0x234], ecx
mov eax, dword [esp + 0x238]
mov ecx, dword [esp + 0x234]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0x38b17551
sete cl
mov dword [esp + 0x1fc], ecx
mov eax, dword [esp + 0x200]
mov ecx, dword [esp + 0x1fc]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040e590
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x3068f024
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0xd0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x295c1dfa
setl cl
mov dword [esp + 0x1f4], ecx
mov ecx, dword [esp + 0x1f8]
mov edx, dword [esp + 0x1f4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x4876d16f
sete cl
mov dword [esp + 0x224], ecx
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x224]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x38b17551
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf8]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x1ee76785
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0xc0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0xf3cf61f7
sete cl
mov dword [esp + 0x15c], ecx
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x15c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xf3cf61f7
setl cl
mov dword [esp + 0x174], ecx
mov ecx, dword [esp + 0x178]
mov edx, dword [esp + 0x174]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xd46aa82b
sete cl
mov dword [esp + 0x154], ecx
mov eax, dword [esp + 0x158]
mov ecx, dword [esp + 0x154]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0x1ee76785
sete cl
mov dword [esp + 0x1bc], ecx
mov eax, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x1bc]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0x3e17ef8d
sete cl
mov dword [esp + 0x204], ecx
mov eax, dword [esp + 0x208]
mov ecx, dword [esp + 0x204]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xcc97938
sete cl
mov dword [esp + 0x17c], ecx
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x17c]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.0040cbc0
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x295c1dfa
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040e590
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov ecx, dword [esp + 0x34]
sub ecx, eax
setl byte [esp + 0x23]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0xa7992541
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xe8]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x5d227528
setl cl
mov dword [esp + 0x244], ecx
mov ecx, dword [esp + 0x248]
mov edx, dword [esp + 0x244]
mov ecx, dword [ecx + edx*4]
jmp ecx
call fcn.0040e590
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x38]
mov edx, ecx
not edx
mov ebx, eax
and ebx, edx
mov ebp, eax
or ebp, edx
not ebp
imul ebp, ebx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, ebp
mov ecx, dword [esp + 0x34]
imul eax, ecx
mov ecx, dword [esp + 0x24]
add ecx, eax
mov dword [esp + 0x26c], ecx
mov eax, dword [esp + 0x1c]
mov dword [eax], 0xf4f08820
mov eax, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc8]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x34]
inc eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], 0x38b17551
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0xd44b2ac
sete cl
mov dword [esp + 0x184], ecx
mov eax, dword [esp + 0x188]
mov ecx, dword [esp + 0x184]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xbf14e2b5
sete cl
mov dword [esp + 0x12c], ecx
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x12c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0x295c1dfa
sete cl
mov dword [esp + 0x1cc], ecx
mov eax, dword [esp + 0x1d0]
mov ecx, dword [esp + 0x1cc]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x26c]
mov ecx, dword [esp + 0x30]
mov esi, dword [eax + ecx*4]
mov edx, esi
not edx
mov ebp, esi
xor ebp, 0xff000000
mov ebx, esi
or ebx, 0xff0000
and ebx, ebp
shr ebx, 0x10
or edx, 0xff00ff
not ebx
and edx, ebx
not edx
mov ebx, esi
xor ebx, 0xff00
and ebx, esi
shl ebx, 0x10
or edx, ebx
mov dword [eax + ecx*4], edx
mov eax, dword [esp + 0x30]
inc eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], 0x1ee76785
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa8]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x31848db5
sete cl
mov dword [esp + 0x1dc], ecx
mov eax, dword [esp + 0x1e0]
mov ecx, dword [esp + 0x1dc]
mov eax, dword [eax + ecx*4]
jmp eax
mov al, byte [esp + 0x23]
test al, al
mov eax, 0x1268de7d
jne 0x436e8f
mov eax, 0xcc97938
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0xdc]
mov ecx, dword [esp + 0xe0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x1aa10f51
sete cl
mov dword [esp + 0x1b4], ecx
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x1b4]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x270]
test eax, eax
mov eax, 0xbf14e2b5
jne 0x436ee1
mov eax, 0x4876d16f
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0x100]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x3e17ef8d
setl cl
mov dword [esp + 0x21c], ecx
mov ecx, dword [esp + 0x220]
mov edx, dword [esp + 0x21c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x74bde9cd
setl cl
mov dword [esp + 0x23c], ecx
mov ecx, dword [esp + 0x240]
mov edx, dword [esp + 0x23c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x4876d16f
setl cl
mov dword [esp + 0x24c], ecx
mov ecx, dword [esp + 0x250]
mov edx, dword [esp + 0x24c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xa7992541
sete cl
mov dword [esp + 0x114], ecx
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x30]
sub ecx, eax
mov eax, 0x5d227528
jl 0x436fb8
mov eax, 0x940cc88d
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb8]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xd44b2ac
setl cl
mov dword [esp + 0x19c], ecx
mov ecx, dword [esp + 0x1a0]
mov edx, dword [esp + 0x19c]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x24]
lea ebx, [esp + 0x50]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 9
call fcn.00408850
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
test eax, eax
mov eax, 0xb5be1850
jne 0x437056
mov eax, 0xd44b2ac
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov byte [esp + 0x21], 0
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0xd8]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, byte [esp + 0x20]
mov byte [esp + 0x22], al
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_ReleaseDC]
call eax
sub esp, 8
mov eax, dword [esp + 0x1c]
mov dword [eax], 0xf3cf61f7
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x90]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xd46aa82b
setl cl
mov dword [esp + 0x1ac], ecx
mov ecx, dword [esp + 0x1b0]
mov edx, dword [esp + 0x1ac]
mov ecx, dword [ecx + edx*4]
jmp ecx