Function at 0x406160
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570003
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x5e1da0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], edx
lea eax, [ebx + 0x138]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [ebp + 0x36]
movzx edi, word [ebp + 0x34]
mov eax, edi
imul eax, ecx
mov dword [ebp - 0x54], ecx
lea ecx, [eax + eax*2]
lea edx, [eax + eax]
mov dword [ebp - 0x84], ecx
xor ecx, ecx
lea eax, [ebp + 0x48]
push 0x58a450
push eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x7c], ecx
call fcn.004044b0
add esp, 8
test eax, eax
je 0x406311
mov ecx, 0x1e0
cmp word [ebp + 0x36], cx
jb 0x406311
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x2c]
push edx
push eax
push esi
mov ecx, ebx
call fcn.00404d90
mov al, byte [ebp - 0x2b]
shr al, 4
and al, 1
jne 0x406275
cmp dword [ebx + 0x12c], 0
jne 0x406275
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x124]
push edi
push esi
push ecx
call fcn.005520f0
add esp, 0xc
mov dword [ebx + 0x128], edi
mov dword [ebx + 0x12c], 1
mov edx, dword [ebx + 0x130]
lea ecx, [ebx + 0x130]
jmp 0x4069e1
test al, al
jne 0x406282
cmp dword [ebx + 0x12c], 0
jne 0x406264
cmp al, 1
jne 0x4062d8
cmp dword [ebx + 0x12c], 0
jne 0x4062d8
imul edi, dword [ebp - 0x54]
mov edx, dword [ebx + 0x124]
push edi
xor esi, esi
push esi
push edx
call fcn.00552060
mov eax, dword [ebx + 0x130]
mov edx, dword [eax + 0x14]
add esp, 0xc
lea ecx, [ebx + 0x130]
mov dword [ebx + 0x128], esi
mov dword [ebx + 0x12c], esi
call edx
push fcn.004011c0
push 0x12
push 4
lea eax, [ebp + 0x468]
push eax
jmp 0x4069f6
mov ecx, dword [ebp + 0x1c]
push ecx
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x84]
push ecx
mov ecx, dword [ebx + 0x128]
lea edx, [ebp - 0x5c]
push edx
mov edx, dword [ebx + 0x124]
push eax
push esi
push ecx
mov dword [ebx + 0x12c], 0
push edx
jmp 0x406334
mov eax, dword [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x7c]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push edx
push esi
mov ecx, dword [ebx + 0x11c]
call fcn.0040bac0
test eax, eax
je 0x4069d5
mov ecx, dword [ebx + 0x11c]
movzx eax, word [ecx + 0x14]
movzx edi, word [ecx + 0x16]
xor esi, esi
mov ecx, 0x2c0
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x50], edi
cmp ax, cx
je 0x4063cd
mov edx, 0x2d0
cmp ax, dx
jne 0x406388
mov ecx, 0xf0
cmp di, cx
je 0x4063e5
mov edx, 0x120
cmp di, dx
jmp 0x4063df
mov ecx, 0x500
cmp ax, cx
jne 0x40639c
mov edx, 0x160
cmp di, dx
jmp 0x4063df
mov ecx, 0x780
cmp ax, cx
jne 0x4063b5
mov edx, 0x210
cmp di, dx
je 0x4063e5
lea ecx, [edx + 0xc]
jmp 0x4063dc
mov edx, 0x3c0
cmp ax, dx
je 0x406374
mov ecx, 0x3b0
cmp ax, cx
jne 0x406484
mov edx, 0xf0
cmp di, dx
je 0x4063e5
mov ecx, 0x120
cmp di, cx
jne 0x406484
movzx esi, ax
movzx ecx, di
mov eax, esi
imul eax, ecx
lea eax, [eax + eax*2]
add eax, eax
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x54], eax
call fcn.004575d3
mov edx, dword [ebp - 0x54]
add esp, 4
push edx
mov dword [ebp - 0x70], eax
call fcn.004575d3
add esp, 4
mov edx, eax
push edx
mov dword [ebp - 0x54], edx
mov edx, dword [ebp - 0x70]
push edx
mov edx, dword [ebp - 0x5c]
push edx
movzx ecx, di
lea eax, [ecx + ecx]
push eax
push esi
push eax
push esi
push ecx
push esi
push 0
push 0
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.0043fb20
lea eax, [edi + edi]
movzx ecx, ax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0xa4], 1
jmp 0x4064b0
movzx ecx, ax
movzx eax, di
imul eax, ecx
lea edi, [eax + eax*2]
push edi
mov dword [ebp - 0x60], ecx
call fcn.004575d3
mov ecx, dword [ebp - 0x5c]
push edi
push ecx
push eax
mov dword [ebp - 0x70], eax
call fcn.005520f0
add esp, 0x10
mov dword [ebp - 0xa4], esi
movzx esi, word [ebp - 0x50]
mov eax, dword [ebp - 0x60]
imul eax, esi
lea edx, [eax + eax*2]
push edx
call fcn.004575d3
add esp, 4
push 0
mov dword [ebp - 0x80], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
mov dword [ebp - 0xa8], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x60]
push esi
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [ebp - 0x4c]
push eax
push ecx
mov dword [ebp - 0x94], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
lea edx, [ebp - 0x40]
push edx
mov edx, dword [ebp - 0x70]
push edx
mov dword [ebp - 0xb8], eax
movzx eax, word [ebp - 0x50]
push eax
lea esi, [ebx + 0x2c]
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x60]
push ecx
push 0
push 0
push eax
push ecx
push 0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x4c]
push 0
push eax
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.GDI32.dll_StretchDIBits]
call fcn.004587ad
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40655f
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x78], eax
mov edx, dword [ebp + 0x30]
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [ebp + 0x20]
push edx
mov edx, dword [ebp + 0x24]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x2c]
mov dword [eax + 8], ecx
mov ecx, ebx
mov byte [ebp - 4], 3
mov dword [eax + 0xc], edx
call fcn.00405da0
mov eax, 5
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
call fcn.004587ad
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4065c2
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x64]
push 0x58a764
push edx
mov byte [ebp - 4], 4
call fcn.004026d0
mov edi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x6c]
add esp, 0xc
push 0
push edi
push eax
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x68], esp
mov esi, esp
push eax
call fcn.004023c0
add eax, 0x10
add esp, 4
mov ecx, ebx
mov dword [esi], eax
call fcn.00405300
cmp dword [ebx + 0x64], 0
je 0x406690
mov eax, dword [ebx + 0x60]
cmp dword [eax - 0xc], 0
je 0x406690
cmp dword [ebx + 0x68], 0
mov dword [ebp - 0x48], 5
jne 0x406642
mov dword [ebp - 0x44], 0x17
jmp 0x40664b
movzx eax, di
add eax, 0xffffffe9
mov dword [ebp - 0x44], eax
mov ecx, dword [ebx + 0x60]
push ecx
lea edx, [ebp - 0x64]
push 0x58a764
push edx
call fcn.004026d0
mov eax, dword [ebp - 0x6c]
add esp, 0xc
push 1
push edi
push eax
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x68], esp
mov esi, esp
push eax
call fcn.004023c0
add eax, 0x10
add esp, 4
mov ecx, ebx
mov dword [esi], eax
call fcn.00405300
cmp dword [ebx + 0x64], 0
mov dword [ebp - 0x48], 0x28
je 0x4066a9
cmp dword [ebx + 0x68], 0
jne 0x4066a9
add dword [ebp - 0x44], 0xa
jmp 0x4066b0
mov dword [ebp - 0x44], 0x14
lea eax, [ebp + 0x468]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
cmp dword [edx - 0xc], 0
je 0x4067e7
add dword [ebp - 0x44], 0xe
call fcn.004587ad
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x406555
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x98]
push 0x58a764
push eax
mov byte [ebp - 4], 5
call fcn.004026d0
mov eax, dword [ebp - 0x6c]
mov ecx, 0xb0
add esp, 0xc
cmp ax, cx
jbe 0x406791
mov edx, 0x160
cmp ax, dx
ja 0x406733
inc dword [ebp - 0x44]
jmp 0x406791
mov ecx, 0x2d0
cmp ax, cx
ja 0x406743
add dword [ebp - 0x44], 3
jmp 0x406791
mov edx, 0x500
cmp ax, dx
ja 0x406753
add dword [ebp - 0x44], 5
jmp 0x406791
mov ecx, 0x550
cmp ax, cx
ja 0x406763
add dword [ebp - 0x44], 5
jmp 0x406791
mov edx, 0x780
cmp ax, dx
ja 0x406773
add dword [ebp - 0x44], 7
jmp 0x406791
mov ecx, 0x800
cmp ax, cx
ja 0x406783
add dword [ebp - 0x44], 7
jmp 0x406791
mov edx, 0xa20
cmp ax, dx
ja 0x406791
add dword [ebp - 0x44], 9
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x98]
push 2
push eax
push ecx
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x4c]
push eax
push ecx
add esi, 0xfffffff0
mov dword [ebp - 0xbc], esp
mov edi, esp
push esi
call fcn.004023c0
add eax, 0x10
add esp, 4
mov ecx, ebx
mov dword [edi], eax
call fcn.00405300
mov byte [ebp - 4], 4
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4067e7
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [ebp - 0x68]
add dword [ebp - 0x74], 4
inc eax
mov dword [ebp - 0x68], eax
cmp eax, 0x12
jl 0x4066c0
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x38]
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x94]
push ecx
mov ecx, dword [ebp - 0x4c]
push edx
push 0
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov edx, dword [ebp - 0xb8]
movzx esi, word [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x60]
push edx
push eax
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x30], edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0xa8]
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 0xa4], 0
je 0x406871
mov cx, word [ebp - 0x50]
mov word [ebp + 0x36], cx
movzx edx, word [ebx + 0x74]
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x58], eax
movzx eax, word [ebx + 0x76]
imul eax, edx
lea eax, [eax + eax*2]
push eax
call fcn.004575d3
mov edx, dword [ebx + 0x78]
add esp, 4
push edx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x80]
push eax
push esi
lea ecx, [ebx + 4]
push edi
call fcn.0040c290
mov edx, dword [ebx + 0x78]
push edi
push edi
lea ecx, [ebp - 0xa0]
push ecx
push edx
mov eax, esi
shr eax, 1
push eax
push esi
push edi
lea ecx, [ebx + 4]
call fcn.0040cfa0
lea ecx, [ebp - 0x90]
push ecx
mov ecx, dword [ebp - 0xa0]
xor eax, eax
push 0xa
lea edx, [ebp - 0x8c]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], eax
push edx
lea eax, [ebp - 0x58]
push eax
push ecx
mov ecx, dword [ebx + 0x120]
mov byte [ebp - 4], 6
call fcn.0040bf10
mov dword [ebp - 4], 4
jmp 0x406918
mov esi, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0xb4]
push esi
push edx
push eax
call fcn.005520f0
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
mov edx, dword [ebp - 0x90]
mov dword [ecx], esi
mov dword [eax], edx
mov eax, dword [ebp - 0x80]
add esp, 0xc
test eax, eax
je 0x406958
push eax
call fcn.004575de
add esp, 4
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x406968
push eax
call fcn.004575de
add esp, 4
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x406978
push eax
call fcn.004575de
add esp, 4
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x40698f
push eax
call fcn.004575de
add esp, 4
mov dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x64]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4069b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x78]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4069d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0x130]
lea ecx, [ebx + 0x130]
mov eax, dword [edx + 0x14]
call eax
push fcn.004011c0
push 0x12
push 4
lea ecx, [ebp + 0x468]
push ecx
mov dword [ebp - 4], 0xffffffff
call fcn.00552a95
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005520da
mov esp, ebp
pop ebp
ret 0x4b8