Function at 0x186c5190
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x1870626c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
lea edx, [ebp - 0x603]
mov ebx, ecx
mov dword [ebp - 0x640], edi
mov dword [ebp - 0x638], ebx
xor al, al
nop
mov byte [edx - 1], al
lea edx, [edx + 3]
mov byte [edx - 3], al
mov byte [edx - 2], al
inc al
cmp al, 0xff
jb 0x186c51c0
push dword [ebx + 0x740]
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebx + 0x748]
mov esi, eax
movzx eax, word [ebx + 0x1a]
imul eax, ecx
mov dword [ebp - 0x664], esi
add eax, dword [ebx + 0x750]
push eax
movzx eax, word [ebx + 0x18]
imul eax, ecx
add eax, dword [ebx + 0x74c]
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push esi
mov dword [ebx + 0xf58], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebx + 0xf58]
mov dword [ebx + 0xf60], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0x748]
mov dword [ebx + 0xf5c], eax
movzx eax, word [ebx + 0x1a]
push 0xcc0020
push 0
imul eax, ecx
push 0
push esi
add eax, dword [ebx + 0x750]
push eax
movzx eax, word [ebx + 0x18]
imul eax, ecx
add eax, dword [ebx + 0x74c]
push eax
push 0
push 0
push dword [ebx + 0xf60]
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x748]
movzx eax, word [ebx + 0x1a]
imul eax, ecx
mov dword [ebp - 0x624], edi
add eax, dword [ebx + 0x750]
push eax
movzx eax, word [ebx + 0x18]
imul eax, ecx
add eax, dword [ebx + 0x74c]
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push esi
mov dword [ebp - 0x65c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0x65c]
mov dword [ebp - 0x628], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0x748]
mov dword [ebp - 0x674], eax
movzx eax, word [ebx + 0x1a]
imul eax, ecx
add eax, dword [ebx + 0x750]
push eax
movzx eax, word [ebx + 0x18]
imul eax, ecx
add eax, dword [ebx + 0x74c]
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push esi
mov dword [ebp - 0x660], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0x660]
mov dword [ebp - 0x62c], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0x6a4]
sub ecx, dword [ebx + 0x6a0]
mov dword [ebp - 0x678], eax
sar ecx, 2
mov dword [ebx + 0xf68], ecx
test ecx, ecx
jle 0x186c5a03
cmp dword [ebp + 8], edi
mov eax, 1
cmove ecx, eax
xor esi, esi
mov dword [ebp - 0x670], ecx
mov dword [ebp - 0x61c], esi
test ecx, ecx
jle 0x186c5a03
xor al, al
lea ecx, [ebp - 0x303]
nop dword [eax + eax]
mov byte [ecx - 1], al
lea ecx, [ecx + 3]
mov byte [ecx - 3], al
mov byte [ecx - 2], al
inc al
cmp al, 0xff
jb 0x186c5360
mov eax, dword [ebx + 0x368]
mov ecx, dword [ebx + 0x364]
sub eax, ecx
movzx edx, word [ebx + 0x1c]
sar eax, 2
cmp eax, esi
jbe 0x186c5a64
mov eax, dword [ecx + esi*4]
cmp word [eax + 8], 0
je 0x186c5429
mov eax, dword [ebx + 0x374]
mov edi, dword [ebx + 0x370]
sub eax, edi
sar eax, 2
cmp eax, esi
jle 0x186c5429
jbe 0x186c5a6e
mov edi, dword [edi + esi*4]
test edi, edi
je 0x186c5429
cmp eax, esi
jbe 0x186c5a6e
inc edi
mov dword [ebp - 0x640], 1
xor esi, esi
mov ebx, 0xff
nop dword [eax]
mov dl, byte [edi - 1]
lea edi, [edi + 3]
mov cl, byte [edi - 3]
lea esi, [esi + 3]
mov al, byte [edi - 2]
mov byte [ebp + esi - 0x307], dl
mov byte [ebp + esi - 0x306], cl
mov byte [ebp + esi - 0x305], al
mov byte [ebp + esi - 0x607], dl
mov byte [ebp + esi - 0x606], cl
mov byte [ebp + esi - 0x605], al
sub ebx, 1
jne 0x186c53e0
mov ebx, dword [ebp - 0x638]
jmp 0x186c54b5
test dx, dx
je 0x186c5462
lea ecx, [ebp - 0x303]
mov esi, 0xff
lea edx, [ebx + 0x2b]
nop dword [eax]
movzx eax, byte [edx - 1]
lea ecx, [ecx + 3]
mov byte [ecx - 4], al
lea edx, [edx + 3]
movzx eax, byte [edx - 3]
mov byte [ecx - 3], al
movzx eax, byte [edx - 2]
mov byte [ecx - 2], al
sub esi, 1
jne 0x186c5440
jmp 0x186c54b5
cmp dword [ebp - 0x640], 1
jne 0x186c59ee
xor eax, eax
mov edx, 0xff
nop word [eax + eax]
movzx ecx, byte [ebp + eax - 0x604]
lea eax, [eax + 3]
mov byte [ebp + eax - 0x307], cl
movzx ecx, byte [ebp + eax - 0x606]
mov byte [ebp + eax - 0x306], cl
movzx ecx, byte [ebp + eax - 0x605]
mov byte [ebp + eax - 0x305], cl
sub edx, 1
jne 0x186c5480
mov ecx, dword [ebx + 0x748]
movzx eax, word [ebx + 0x1a]
mov edi, dword [ebp - 0x664]
imul eax, ecx
push eax
movzx eax, word [ebx + 0x18]
imul eax, ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
mov eax, dword [ebp - 0x61c]
push edi
mov dword [ebx + eax*4 + 0x758], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov eax, dword [ebp - 0x61c]
push esi
push edi
mov dword [ebp - 0x63c], edi
mov dword [ebx + eax*4 + 0xb58], edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp - 0x61c]
mov ecx, 0x64
mov dword [ebp - 0x630], 0
mov byte [ebp - 0x615], 0
mov dword [ebx + esi*4 + 0x958], eax
mov eax, dword [ebx + 0x338]
mov edx, dword [ebx + 0x334]
sub eax, edx
sar eax, 2
test eax, eax
jle 0x186c5598
cmp eax, esi
jbe 0x186c5a6e
mov edx, dword [edx + esi*4]
test edx, edx
je 0x186c5598
test byte [edx + 3], 1
jbe 0x186c5576
movzx eax, byte [edx + 6]
cmp eax, 0x100
jae 0x186c5576
mov al, byte [edx + 6]
mov dword [ebp - 0x630], 1
mov byte [ebp - 0x615], al
mov al, byte [edx + 4]
test al, al
je 0x186c5598
movzx ecx, al
mov al, byte [ebx + 0xf78]
cmp al, 0xa
jbe 0x186c5598
cmp al, 0x64
ja 0x186c5595
lea ecx, [ecx + ecx*4]
add ecx, ecx
jmp 0x186c5598
imul ecx, ecx, 0x64
mov dword [ebx + esi*4 + 0xd58], ecx
mov eax, dword [ebx + 0x344]
mov ecx, dword [ebx + 0x340]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x64c], 0x63
test eax, eax
jle 0x186c55d6
cmp eax, esi
jbe 0x186c5a6e
mov eax, dword [ecx + esi*4]
test eax, eax
je 0x186c55d6
movzx eax, word [eax]
mov dword [ebp - 0x64c], eax
movzx ecx, word [ebx + 0x26]
lea eax, [ebx + ecx*2]
movzx edx, byte [ecx + eax + 0x2c]
movzx eax, byte [ecx + eax + 0x2b]
shl edx, 8
or edx, eax
lea eax, [ebx + ecx*2]
movzx eax, byte [ecx + eax + 0x2a]
shl edx, 8
or edx, eax
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [ebx + 0x748]
mov esi, eax
movzx eax, word [ebx + 0x1a]
imul eax, ecx
push esi
mov dword [ebp - 0x614], 0
mov dword [ebp - 0x610], 0
add eax, dword [ebx + 0x750]
mov dword [ebp - 0x608], eax
movzx eax, word [ebx + 0x18]
imul eax, ecx
add eax, dword [ebx + 0x74c]
mov dword [ebp - 0x60c], eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0x62c]
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebx + 0x368]
mov ecx, dword [ebx + 0x364]
sub eax, ecx
mov edx, dword [ebp - 0x61c]
sar eax, 2
cmp eax, edx
jbe 0x186c5a64
mov eax, dword [ecx + edx*4]
movzx ecx, word [eax]
movzx esi, word [eax + 4]
movzx edx, word [eax + 6]
mov dword [ebp - 0x658], ecx
movzx ecx, word [eax + 2]
mov eax, dword [ebx + 0x6a4]
mov dword [ebp - 0x654], ecx
mov ecx, dword [ebx + 0x6a0]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x648], edx
cmp eax, dword [ebp - 0x61c]
jbe 0x186c5a6e
mov eax, dword [ebp - 0x61c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebx + 0x6ac]
mov dword [ebp - 0x668], eax
mov eax, dword [ebx + 0x6b0]
sub eax, ecx
sar eax, 2
cmp eax, dword [ebp - 0x61c]
jbe 0x186c5a69
mov eax, edx
mov edx, dword [ebp - 0x61c]
imul eax, esi
cmp eax, dword [ecx + edx*4]
jne 0x186c59ca
cmp dword [ebp - 0x624], 1
jne 0x186c5741
mov ecx, dword [ebx + 0x748]
movzx eax, word [ebx + 0x1a]
push 0xcc0020
push 0
push 0
push dword [ebp - 0x628]
imul eax, ecx
push eax
movzx eax, word [ebx + 0x18]
imul eax, ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x186c57c2
mov al, byte [ebp - 0x615]
movzx eax, al
cmp word [ebx + 0x26], ax
jne 0x186c5788
cmp dword [ebp - 0x630], 1
jne 0x186c5788
mov eax, dword [ebx + 0x748]
movzx edx, word [ebx + 0x1a]
movzx ecx, word [ebx + 0x18]
imul edx, eax
push 0xcc0020
imul ecx, eax
push edx
push ecx
push dword [ebx + 0x750]
push dword [ebx + 0x74c]
push dword [ebx + 0xf60]
jmp 0x186c57b5
mov eax, dword [ebx + 0x748]
movzx edx, word [ebx + 0x1a]
movzx ecx, word [ebx + 0x18]
imul edx, eax
push 0xcc0020
imul ecx, eax
push edx
push ecx
push dword [ebx + 0x750]
push dword [ebx + 0x74c]
push dword [ebp - 0x62c]
push edx
push ecx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov edx, dword [ebp - 0x648]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x634], ecx
test edx, edx
je 0x186c58e6
xor edi, edi
test esi, esi
je 0x186c58cb
nop word [eax + eax]
mov ecx, dword [ebp - 0x668]
mov bl, byte [eax + ecx]
movzx eax, bl
lea ecx, [eax + eax*2]
movzx edx, byte [ebp + ecx - 0x302]
movzx eax, byte [ebp + ecx - 0x303]
shl edx, 8
or edx, eax
movzx eax, byte [ebp + ecx - 0x304]
shl edx, 8
or edx, eax
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [ebp - 0x634]
add ecx, dword [ebp - 0x654]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x638]
mov esi, dword [ebp - 0x66c]
mov edx, dword [eax + 0x748]
mov eax, dword [ebp - 0x658]
add eax, edi
imul ecx, edx
imul eax, edx
mov dword [ebp - 0x610], ecx
mov dword [ebp - 0x614], eax
add eax, edx
cmp dword [ebp - 0x630], 1
mov dword [ebp - 0x60c], eax
lea eax, [ecx + edx]
mov dword [ebp - 0x608], eax
jne 0x186c5888
cmp bl, byte [ebp - 0x615]
je 0x186c589c
push esi
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0x63c]
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x644]
inc edi
mov esi, dword [ebp - 0x650]
inc eax
mov dword [ebp - 0x644], eax
cmp edi, esi
jl 0x186c57f0
mov ecx, dword [ebp - 0x634]
mov edx, dword [ebp - 0x648]
inc ecx
mov dword [ebp - 0x634], ecx
cmp ecx, edx
jl 0x186c57e0
mov ebx, dword [ebp - 0x638]
mov edi, dword [ebp - 0x63c]
mov eax, dword [ebp - 0x64c]
cmp eax, 3
ja case.default.0x186c58f5
jmp dword [eax*4 + 0x186c5a74]
mov esi, dword [ebp - 0x61c]
mov edi, 1
mov dword [ebp - 0x624], 0
jmp 0x186c59f0
mov ecx, dword [ebx + 0x748]
movzx eax, word [ebx + 0x1a]
push 0xcc0020
push 0
push 0
imul eax, ecx
push edi
push eax
movzx eax, word [ebx + 0x18]
imul eax, ecx
push eax
push 0
push 0
push dword [ebp - 0x628]
call dword [sym.imp.GDI32.dll_BitBlt]
mov esi, dword [ebp - 0x61c]
mov edi, 1
mov dword [ebp - 0x624], 1
jmp 0x186c59f0
mov edi, dword [ebx + 0x748]
mov esi, edi
mov eax, dword [ebx + 0x750]
mov ecx, edi
imul ecx, dword [ebp - 0x654]
push 0xcc0020
imul esi, edx
mov edx, edi
imul edx, dword [ebp - 0x650]
imul edi, dword [ebp - 0x658]
add eax, ecx
push esi
push edx
push eax
mov eax, dword [ebx + 0x74c]
add eax, edi
push eax
push dword [ebx + 0xf60]
push esi
push edx
push ecx
push edi
push dword [ebp - 0x628]
call dword [sym.imp.GDI32.dll_StretchBlt]
mov dword [ebp - 0x624], 1
mov esi, dword [ebp - 0x61c]
mov edi, 1
jmp 0x186c59f0
push 0x50000
push 0x1885e3c4
push 0x1885e3f8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [ebp - 0x61c]
mov edi, 1
jmp 0x186c59f0
xor edi, edi
inc esi
mov dword [ebp - 0x61c], esi
cmp esi, dword [ebp - 0x670]
jl 0x186c5353
push dword [ebp - 0x674]
mov ebx, dword [ebp - 0x628]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call esi
push dword [ebp - 0x65c]
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
call ebx
push dword [ebp - 0x678]
push dword [ebp - 0x62c]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x62c]
call esi
push dword [ebp - 0x660]
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18615399
mov esp, ebp
pop ebp
ret 4
call fcn.185b2440
call fcn.185b21ef
call fcn.185b21ef
nop
cld
pop eax
insb byte es:[edi], dx
sbb byte [esi], dl
pop ecx
insb byte es:[edi], dx
sbb byte [eax + 0x59], ah
insb byte es:[edi], dx
sbb byte [ebx - 0x33e793a7], dh
int3