Function at 0x413470
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0xb0
mov eax, dword [0x44ae8c]
mov ecx, dword [0x44c2d4]
add eax, 0xffffffc4
push ebx
cdq
idiv ecx
push ebp
mov ebp, dword [esp + 0xbc]
imul ecx, ebp
push esi
push edi
mov edi, dword [0x44ae88]
add ecx, 0x16
mov ebx, ecx
mov esi, 0xc
lea ecx, [edi - 0x20]
mov dword [esp + 0x18], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
test ebp, ebp
mov dword [esp + 0x10], edx
jge 0x4134ed
add edi, 0xffffffd8
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
mov ebx, 4
shr eax, 0x1f
add edx, eax
mov esi, 5
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0x18]
jge 0x413a1b
test ebp, ebp
jl 0x413794
mov ecx, dword [0x45bf04]
push ecx
call fcn.0040c730
mov edx, dword [0x44ae88]
mov ecx, dword [0x44c2d4]
mov ebp, eax
add esp, 4
lea eax, [edx - 0x14]
add ecx, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
mov al, byte [esp + 0xd0]
mov dword [esp + 0x20], esi
test al, 2
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ecx
je 0x413549
mov edx, dword [0x44e6d4]
push edx
jmp 0x41354f
mov eax, dword [0x44e6d0]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0xd0]
and eax, 1
mov dword [esp + 0x14], eax
jne 0x41356f
mov ecx, dword [0x44e6d8]
push ecx
jmp 0x413576
mov edx, dword [0x44e6dc]
push edx
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
push ebp
call fcn.0040ec40
mov eax, dword [0x450fc8]
add esp, 4
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [sym.imp.USER32.dll_DrawTextA]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xcc]
test eax, eax
jl 0x413662
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], ecx
cdq
mov ecx, 0x3c
idiv ecx
push edx
push eax
lea edx, [esp + 0x4c]
push str.__d:_02d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x30]
lea edi, [esp + 0x44]
or ecx, 0xffffffff
push 0xd20
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
push ebp
call esi
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov edx, ecx
sub edx, eax
mov eax, dword [0x44ae88]
lea edi, [eax - 0x20]
cmp edx, edi
jge 0x413662
mov edx, eax
add eax, 0xffffffec
sub edx, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], eax
lea edi, [esp + 0x44]
lea ecx, [ecx + edx - 0x14]
xor eax, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x30]
push 0x922
dec ecx
push edx
lea eax, [esp + 0x4c]
push ecx
push eax
push ebp
call esi
mov edx, dword [esp + 0xc8]
lea ecx, [esp + 0x20]
push 0x8824
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebp
call esi
lea edx, [esp + 0x20]
push 0x8c20
push edx
mov edx, dword [esp + 0xd0]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebp
call esi
mov eax, dword [esp + 0x14]
test eax, eax
mov eax, dword [0x451154]
jne 0x4136b8
mov eax, dword [0x4516f8]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebp
call esi
push 8
mov dword [esp + 0x44], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push ebp
call esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov edi, dword [sym.imp.GDI32.dll_Rectangle]
inc eax
inc ecx
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
push ebp
call edi
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x413709
mov ecx, dword [esp + 0x18]
dec ecx
cmp eax, ecx
jne 0x413761
mov edx, dword [0x4516f8]
push edx
push ebp
call esi
mov eax, dword [esp + 0xc4]
test eax, eax
jne 0x413730
mov eax, dword [0x44ae88]
push 0x18
add eax, 0xffffffed
push eax
push 0x14
push 0xc
push ebp
call edi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc4]
dec ecx
cmp eax, ecx
jne 0x413761
mov edx, dword [0x44ae8c]
mov eax, dword [0x44ae88]
mov ecx, dword [0x44c2d4]
add edx, 0xffffffdb
add eax, 0xffffffed
push edx
add ecx, ebx
push eax
push ecx
push 0xc
push ebp
call edi
mov edx, dword [esp + 0x1c]
push edx
push ebp
call esi
mov eax, dword [esp + 0x14]
push eax
push ebp
call esi
mov ecx, dword [esp + 0x40]
push ecx
push ebp
call esi
mov edx, dword [0x45bf04]
push ebp
push edx
call fcn.0040c750
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret
mov edx, dword [0x45bf04]
mov al, byte [0x450890]
xor ecx, ecx
push edx
mov dword [esp + 0x25], ecx
mov byte [esp + 0x24], al
mov dword [esp + 0x29], ecx
mov byte [esp + 0x2d], cl
call fcn.0040c730
mov ebp, eax
mov eax, dword [0x4518dc]
push eax
call fcn.0040cb70
push ebp
call fcn.0040ec40
mov eax, dword [esp + 0xd8]
add esp, 0xc
test eax, eax
jl 0x413812
cdq
mov ecx, 0x3c
idiv ecx
push edx
push eax
lea edx, [esp + 0x28]
push str._d:_02d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
or eax, 0xffffffff
sub eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
xor ecx, ecx
xor edi, edi
cmp eax, ecx
jle 0x413896
mov edx, dword [esp + 0xc8]
mov al, byte [edi + edx]
test al, al
je 0x41389d
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x18], al
dec ecx
cmp edi, ecx
jne 0x41384e
mov al, byte [edi + edx + 1]
test al, al
je 0x41384e
mov byte [esp + 0x18], 1
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x14]
push edx
push eax
push ecx
call fcn.0040ec70
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4512ac]
add esp, 0xc
push 0xcc0020
push edx
push eax
push ecx
push 6
push 5
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x10]
add esi, 5
inc edi
xor ecx, ecx
cmp edi, eax
jl 0x41381e
mov edx, dword [esp + 0xc8]
cmp byte [edi + edx], 0
jne 0x413901
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x20
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ecx
call fcn.0040ec70
mov eax, dword [esp + 0xd8]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x10]
jl 0x4138cf
inc eax
cmp edi, eax
jge 0x4138ff
sub eax, edi
mov edi, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4512ac]
push 0xcc0020
push ecx
push edx
push eax
push 6
push 5
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
add esi, 5
dec edi
jne 0x4138d7
xor ecx, ecx
cmp dword [esp + 0xcc], ecx
jl 0x4139b8
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x20
call fcn.0040ec70
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x4512ac]
add esp, 0xc
push 0xcc0020
push eax
push ecx
push edx
push 6
push 5
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [0x44ae88]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx*4]
sub esi, eax
mov al, byte [esp + 0x20]
sub esi, 0x1d
test al, al
je 0x4139b6
lea edi, [esp + 0x20]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
call fcn.0040ec70
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x4512ac]
add esp, 0xc
push 0xcc0020
push eax
push ecx
push edx
push 6
push 5
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov al, byte [edi + 1]
add esi, 5
inc edi
test al, al
jne 0x413975
xor ecx, ecx
mov eax, dword [0x44ae88]
lea edi, [eax - 0x1e]
cmp esi, edi
jge 0x413a06
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x20
call fcn.0040ec70
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [0x4512ac]
add esp, 0xc
sub edi, esi
push 0xcc0020
push eax
push ecx
push edx
push 6
push edi
push ebx
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
xor ecx, ecx
push ecx
call fcn.0040cb70
mov eax, dword [0x45bf04]
push ebp
push eax
call fcn.0040c750
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret