Function at 0x110b5110
Capabilities:
Capture screenshot
Check for time delay via gettickcount
Encode data using xor
Enumerate gui resources
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11185c9b
mov eax, dword fs:[0]
push eax
mov eax, 0x5718
call fcn.11164040
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x5628], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x55c4], ecx
mov ecx, dword [ebp + 0x1c]
xor ebx, ebx
push ebx
mov dword [ebp - 0x55ac], edi
mov dword [ebp - 0x561c], edx
mov dword [ebp - 0x55bc], eax
mov dword [ebp - 0x564c], ecx
call dword [sym.imp.uSEr32.dll_GetDC]
mov esi, eax
push ebx
mov dword [ebp - 0x55f0], esi
call dword [sym.imp.Gdi32.Dll_CreateCompatibleDC]
push 0xe
push esi
mov esi, dword [sym.imp.Gdi32.Dll_GetDeviceCaps]
mov dword [ebp - 0x55b4], eax
mov dword [ebp - 0x55e8], ebx
call esi
mov edx, dword [ebp - 0x55f0]
push 0xc
push edx
mov dword [ebp - 0x5630], eax
call esi
mov ecx, dword [ebp - 0x5630]
imul ecx, eax
mov eax, dword [ebp - 0x55c4]
mov dword [ebp - 0x55f8], ecx
mov ecx, dword [ebp + 0x14]
imul eax, ecx
add eax, 0x1f
cdq
and edx, 0x1f
lea esi, [edx + eax]
sar esi, 5
add esi, esi
add esi, esi
mov dword [ebp - 0x55ec], esi
mov byte [edi + 0x79c], bl
cmp ecx, 8
jne 0x110b5247
cmp dword [ebp - 0x55f8], 0x20
jne 0x110b5247
cmp dword [edi + 0x798], 0x32
jl 0x110b5247
mov ecx, dword [0x111ee100]
push ebx
push ebx
push 0x111a9514
push 0x111a0f40
call fcn.1105e820
test eax, eax
jne 0x110b5247
call fcn.1108afd0
mov dword [edi + 0x794], eax
cmp eax, ebx
je 0x110b5247
mov esi, dword [ebp - 0x55c4]
add esi, esi
add esi, esi
mov dword [ebp - 0x55ec], esi
mov byte [edi + 0x79c], 1
movzx edx, byte [edi + 0x79c]
mov eax, dword [edi + 0x798]
mov ecx, dword [ebp + 0x14]
push edx
push eax
push ecx
push 0x111a94e4
call fcn.11147060
mov eax, dword [ebp - 0x55bc]
imul eax, esi
lea esi, [eax + eax]
mov dword [ebp - 0x5660], eax
mov eax, 0x51eb851f
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + esi + 0x120]
mov eax, dword [ebp - 0x55c4]
imul eax, dword [ebp - 0x55f8]
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
mov dword [ebp - 0x55e4], ecx
add eax, eax
add ecx, 0xc
add eax, eax
push ecx
mov dword [ebp - 0x55d8], eax
call fcn.11163a11
mov dl, byte [ebp + 0x14]
add esp, 0x14
mov dword [eax], ebx
push ebx
mov dword [eax + 4], ebx
push 0xffffffffffffffff
mov dword [eax + 8], ebx
mov ecx, 0x9e
push 0x111a94d4
mov word [eax], cx
mov byte [eax + 0xa], dl
mov ecx, dword [0x111ee100]
push 0x111a0f40
mov dword [ebp - 0x55dc], eax
mov byte [ebp - 0x55f1], bl
call fcn.1105e820
cmp eax, ebx
jne 0x110b5309
mov byte [ebp - 0x55ae], bl
jmp 0x110b531f
mov byte [ebp - 0x55ae], 1
jg 0x110b531f
cmp dword [edi + 0x4c], 6
jge 0x110b531f
mov byte [ebp - 0x55f1], 1
push esi
call fcn.11163a11
mov dword [ebp - 0x55cc], eax
add eax, esi
push 0x428
mov dword [ebp - 0x566c], eax
lea eax, [ebp - 0x1588]
push ebx
push eax
call fcn.11162be0
mov ecx, dword [ebp - 0x55c4]
mov ax, word [ebp - 0x55f8]
add esp, 0x10
mov edx, 1
mov dword [ebp - 0x1588], 0x28
mov dword [ebp - 0x1584], ecx
mov word [ebp - 0x157c], dx
mov dword [ebp - 0x1568], ebx
mov dword [ebp - 0x1578], ebx
mov dword [ebp - 0x1574], ebx
mov word [ebp - 0x157a], ax
cmp byte [ebp - 0x55ae], bl
je 0x110b53a2
mov eax, edx
sub eax, dword [ebp - 0x55bc]
sub eax, dword [ebp - 0x561c]
jmp 0x110b53b0
mov ecx, dword [ebp - 0x55bc]
lea edx, [ecx + ecx]
or eax, 0xffffffff
sub eax, edx
cmp dword [ebp - 0x55f8], 8
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x5608], ebx
mov dword [ebp - 0x5630], ebx
mov dword [ebp - 0x5670], ebx
jg 0x110b5572
push 0x400
lea eax, [ebp - 0x918]
push ebx
push eax
call fcn.11162be0
mov edx, dword [ebp - 0x55f0]
add esp, 0xc
lea ecx, [ebp - 0x918]
push ecx
push 0x100
push ebx
push edx
call dword [sym.imp.Gdi32.Dll_GetSystemPaletteEntries]
cmp eax, ebx
je 0x110b556c
push 0x408
push 1
mov dword [ebp - 0x55e8], 1
call fcn.1116406b
lea edi, [eax + 4]
mov dword [eax], 0x1000300
mov ecx, 0x100
lea esi, [ebp - 0x918]
add esp, 8
mov dword [ebp - 0x5630], eax
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x110b5450
movzx ecx, byte [ebp + eax - 0x916]
movzx edx, byte [ebp + eax - 0x917]
mov byte [ebp + eax - 0x1560], cl
movzx ecx, byte [ebp + eax - 0x918]
mov byte [ebp + eax - 0x155f], dl
movzx edx, byte [ebp + eax - 0x912]
mov byte [ebp + eax - 0x155e], cl
movzx ecx, byte [ebp + eax - 0x913]
mov byte [ebp + eax - 0x155c], dl
movzx edx, byte [ebp + eax - 0x914]
mov byte [ebp + eax - 0x155b], cl
movzx ecx, byte [ebp + eax - 0x90e]
mov byte [ebp + eax - 0x155a], dl
movzx edx, byte [ebp + eax - 0x90f]
mov byte [ebp + eax - 0x1558], cl
movzx ecx, byte [ebp + eax - 0x910]
mov byte [ebp + eax - 0x1557], dl
movzx edx, byte [ebp + eax - 0x90a]
mov byte [ebp + eax - 0x1556], cl
movzx ecx, byte [ebp + eax - 0x90b]
mov byte [ebp + eax - 0x1554], dl
movzx edx, byte [ebp + eax - 0x90c]
mov byte [ebp + eax - 0x155d], bl
mov byte [ebp + eax - 0x1559], bl
mov byte [ebp + eax - 0x1555], bl
mov byte [ebp + eax - 0x1553], cl
mov byte [ebp + eax - 0x1552], dl
mov byte [ebp + eax - 0x1551], bl
add eax, 0x10
cmp eax, 0x400
jl 0x110b5450
mov esi, dword [ebp - 0x5630]
push esi
call dword [sym.imp.Gdi32.Dll_CreatePalette]
mov edi, dword [ebp - 0x55b4]
push ebx
push eax
push edi
mov dword [ebp - 0x5630], eax
call dword [sym.imp.Gdi32.Dll_SelectPalette]
push edi
mov dword [ebp - 0x5670], eax
call dword [sym.imp.Gdi32.Dll_RealizePalette]
push esi
call fcn.11163aa5
mov edi, dword [ebp - 0x55ac]
add esp, 4
mov eax, dword [ebp - 0x1580]
mov ecx, dword [edi + 0x4c]
mov dword [ebp - 0x562c], ebx
cmp ecx, 5
je 0x110b559c
cmp ecx, 6
jl 0x110b5642
call fcn.1109ee00
test eax, eax
je 0x110b5642
mov eax, dword [ebp - 0x1580]
cdq
mov esi, eax
xor esi, edx
lea eax, [ebp - 0x5704]
sub esi, edx
imul esi, dword [ebp - 0x55d8]
push eax
call fcn.110ee230
add esp, 4
test eax, eax
je 0x110b5642
push 0x111a9104
add esi, 0x42c
push esi
push ebx
push 4
lea ecx, [ebp - 0x5704]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KeRneL32.DLl_CreateFileMappingA]
mov dword [edi + 0x810], eax
cmp eax, ebx
je 0x110b5642
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KeRneL32.DLl_MapViewOfFile]
mov dword [edi + 0x7c4], eax
cmp eax, ebx
je 0x110b562f
mov edx, dword [ebp - 0x55ac]
mov dword [eax], 0x42c
mov edi, dword [edx + 0x7c4]
add edi, 4
mov ecx, 0x10a
lea esi, [ebp - 0x1588]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x562c], 0x42c
mov edi, edx
jmp 0x110b5642
mov eax, dword [edi + 0x810]
push eax
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
mov dword [edi + 0x810], ebx
mov ecx, dword [ebp - 0x562c]
mov edx, dword [edi + 0x810]
push ecx
push edx
mov edx, dword [ebp - 0x55b4]
lea eax, [ebp - 0x5608]
push eax
push ebx
lea ecx, [ebp - 0x1588]
push ecx
push edx
call dword [sym.imp.Gdi32.Dll_CreateDIBSection]
mov esi, eax
mov dword [ebp - 0x5614], esi
cmp esi, ebx
jne 0x110b568f
push 0x6e3
push 0x111a9228
push 0x111a94cc
call fcn.11029a70
add esp, 0xc
cmp dword [edi + 0x810], ebx
je 0x110b56a3
push 0x111ea738
mov ecx, edi
call fcn.110b3330
mov eax, dword [ebp - 0x55b4]
push esi
push eax
call dword [sym.imp.Gdi32.Dll_SelectObject]
mov dword [ebp - 0x562c], eax
cmp dword [0x111f14f8], ebx
je 0x110b56d5
mov ecx, dword [ebp - 0x55b4]
push ecx
push eax
push esi
push 0x111a94a8
call fcn.11147060
add esp, 0x10
mov eax, dword [ebp + 0x14]
cmp eax, 8
jg 0x110b57c3
mov dword [ebp - 0x55e8], 1
cmp eax, 1
jne 0x110b56fc
mov eax, 0x111e70d8
mov edx, 2
jmp 0x110b5776
cmp eax, 4
jne 0x110b570d
mov eax, 0x111e7098
mov edx, 0x10
jmp 0x110b5776
cmp byte [edi + 0x79c], bl
jne 0x110b5746
push 0x400
push 0x111e6c98
push 0x111f10f8
call fcn.11168345
add esp, 0xc
test eax, eax
je 0x110b5746
mov ecx, 0x100
mov esi, 0x111e6c98
mov edi, 0x111f10f8
rep movsd dword es:[edi], dword [esi]
call fcn.110b0fa0
cmp dword [ebp - 0x55f8], 8
jne 0x110b576c
mov eax, dword [ebp - 0x569c]
mov ecx, 0x100
lea esi, [ebp - 0x1560]
lea edi, [ebp - 0x518]
rep movsd dword es:[edi], dword [esi]
xor edx, edx
jmp 0x110b5776
mov eax, 0x111f10f8
mov edx, 0x100
cmp edx, ebx
jle 0x110b57c3
lea esi, [ebp - 0x517]
lea edi, [ebp - 0x516]
lea ecx, [ebp - 0x515]
sub esi, eax
sub edi, eax
sub ecx, eax
mov dword [ebp - 0x5624], edx
jmp 0x110b57a0
movzx edx, byte [eax + 2]
mov byte [esi + eax - 1], dl
movzx edx, byte [eax + 1]
mov byte [esi + eax], dl
movzx edx, byte [eax]
mov byte [edi + eax], dl
mov byte [ecx + eax], bl
add eax, 4
dec dword [ebp - 0x5624]
jne 0x110b57a0
mov esi, dword [ebp - 0x564c]
mov eax, esi
imul eax, dword [ebp - 0x5660]
push eax
call fcn.11163a11
add esp, 4
mov dword [ebp - 0x5624], eax
mov dword [ebp - 0x5690], ebx
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
push esi
push 1
mov dword [ebp - 0x56b8], ebx
mov dword [ebp - 0x5650], ebx
mov dword [ebp - 0x563c], ebx
call fcn.1116406b
push 0x200e
lea ecx, [ebp - 0x55a8]
push ebx
push ecx
mov dword [ebp - 0x5654], eax
mov dword [ebp - 0x56b0], ebx
call fcn.11162be0
mov edx, dword [ebp - 0x55f0]
mov ecx, dword [0x111ee100]
add esp, 0x14
push ebx
push 2
push 0x111a9498
push 0x111a0f40
mov dword [ebp - 0x5600], ebx
mov dword [ebp - 0x560c], ebx
mov dword [ebp - 0x5688], edx
mov dword [ebp - 0x565c], ebx
mov dword [ebp - 0x56bc], ebx
mov dword [ebp - 0x567c], ebx
mov dword [ebp - 0x56ac], ebx
mov dword [ebp - 0x56c0], ebx
mov dword [ebp - 0x5678], ebx
mov dword [ebp - 0x5694], ebx
mov dword [ebp - 0x56a4], ebx
mov dword [ebp - 0x5680], ebx
mov dword [ebp - 0x5698], ebx
mov dword [ebp - 0x5648], ebx
call fcn.1105e820
push 0x11199e24
mov dword [ebp - 0x5684], eax
call dword [sym.imp.KeRneL32.DLl_LoadLibraryA]
mov dword [ebp - 0x56f8], eax
mov dword [ebp - 0x56f4], ebx
mov dword [ebp - 0x56f0], ebx
mov dword [ebp - 0x56ec], ebx
mov dword [ebp - 0x56e8], ebx
mov dword [ebp - 0x56e4], ebx
mov dword [ebp - 0x56e0], ebx
mov dword [ebp - 0x56dc], ebx
mov dword [ebp - 0x56d8], ebx
mov eax, dword [ebp - 0x55ac]
cmp byte [eax + 0x79c], 0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x5610], ebx
je 0x110b5950
mov ecx, dword [0x111ee100]
push ebx
push 1
push 0x111a9488
push 0x111a0f40
call fcn.1105e820
test eax, eax
je 0x110b5950
push 0x10
call fcn.111101b0
add esp, 4
cmp eax, ebx
je 0x110b592d
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
jmp 0x110b592f
xor eax, eax
mov dword [ebp - 0x5610], eax
cmp eax, ebx
je 0x110b5950
lea ecx, [esi*4]
push ecx
mov ecx, eax
call fcn.110b48d0
jmp 0x110b5950
mov eax, dword [ebp - 0x5684]
xor edi, edi
mov dword [ebp - 0x55e0], edi
mov dword [ebp - 0x5620], edi
cmp eax, 2
jne 0x110b5a9c
mov edx, dword [ebp - 0x5628]
mov ecx, dword [ebp - 0x55b4]
push edx
lea eax, [ebp - 0x55e0]
push eax
push 2
push ecx
call fcn.110b41c0
add esp, 0x10
cmp dword [ebp - 0x55e0], edi
je 0x110b599e
mov dword [ebp - 0x5620], 0x40000000
call fcn.111329b0
test eax, eax
jne 0x110b59c0
call fcn.111329c0
test eax, eax
jne 0x110b59c0
push edi
push edi
push 5
call fcn.11145c70
add esp, 0xc
test eax, eax
jne 0x110b59c6
mov dword [ebp - 0x5620], edi
mov byte [ebp - 0x55b5], 0
mov dword [ebp - 0x568c], edi
mov dword [ebp - 0x56b4], edi
call fcn.1109ee00
test eax, eax
je 0x110b5a4c
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov edx, dword [edx + 0x18]
lea eax, [ebp - 0x56b4]
push eax
lea eax, [ebp - 0x30]
push eax
call edx
test eax, eax
je 0x110b5a4c
mov eax, dword [ebp - 0x56b4]
mov ebx, dword [sym.imp.uSEr32.dll_CloseDesktop]
push eax
call ebx
lea ecx, [ebp - 0x30]
push 0x111ea738
push ecx
call fcn.11081e70
neg eax
sbb esi, esi
lea edx, [ebp - 0x30]
push 0x111ea720
inc esi
push edx
mov dword [ebp - 0x568c], esi
call fcn.11081e70
add esp, 0x10
neg eax
sbb eax, eax
inc eax
cmp esi, edi
jne 0x110b5b46
cmp eax, edi
je 0x110b5b46
mov ebx, dword [ebp - 0x55ac]
mov ecx, dword [ebx + 0x7b4]
mov edx, dword [ebp - 0x5628]
mov eax, dword [ebp - 0x5688]
push ecx
push edx
mov dword [ebp - 0x55f0], eax
call fcn.111175c0
mov esi, eax
add esp, 8
cmp esi, edi
je 0x110b5ab2
mov eax, dword [ebp - 0x5600]
cmp eax, edi
je 0x110b5ab2
push eax
push esi
call dword [sym.imp.Gdi32.Dll_EqualRgn]
push esi
test eax, eax
je 0x110b5aaa
call dword [sym.imp.Gdi32.Dll_DeleteObject]
jmp 0x110b5dc2
cmp eax, 1
je 0x110b5994
jmp 0x110b599e
call fcn.11117380
add esp, 4
cmp dword [ebp - 0x560c], edi
je 0x110b5ae4
mov eax, dword [ebp - 0x55b4]
push 0
push eax
call dword [sym.imp.Gdi32.Dll_SelectClipRgn]
mov ecx, dword [ebp - 0x560c]
mov edi, dword [sym.imp.Gdi32.Dll_DeleteObject]
push ecx
call edi
mov dword [ebp - 0x560c], 0
jmp 0x110b5aea
mov edi, dword [sym.imp.Gdi32.Dll_DeleteObject]
cmp dword [ebp - 0x5600], 0
je 0x110b5b06
mov edx, dword [ebp - 0x5600]
push edx
call edi
mov dword [ebp - 0x5600], 0
cmp dword [ebx + 0x7b4], 0
je 0x110b5b36
mov dword [ebp - 0x5600], esi
test esi, esi
je 0x110b5dc2
push 0
push 0
push 0
push 0
call dword [sym.imp.Gdi32.Dll_CreateRectRgn]
mov dword [ebp - 0x560c], eax
jmp 0x110b5dc2
test esi, esi
je 0x110b5dc2
push esi
call edi
jmp 0x110b5dc2
mov edi, dword [ebp - 0x55ac]
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x7c8]
push ecx
call fcn.11081e70
add esp, 8
test eax, eax
je 0x110b5b84
push 1
mov ecx, edi
call fcn.110b3560
cmp dword [edi + 0x810], 0
je 0x110b5c1c
lea edx, [ebp - 0x30]
push edx
mov ecx, edi
call fcn.110b3330
cmp dword [edi + 0x810], 0
je 0x110b5c1c
mov ebx, dword [ebp - 0x562c]
mov eax, dword [ebp - 0x55b4]
mov esi, dword [sym.imp.Gdi32.Dll_SelectObject]
push ebx
push eax
call esi
cmp eax, dword [ebp - 0x5614]
je 0x110b5bc6
push 0x7c1
push 0x111a9228
push 0x111a9480
call fcn.11029a70
add esp, 0xc
mov ecx, dword [edi + 0x7bc]
push ecx
call dword [sym.imp.KeRneL32.DLl_SetEvent]
mov edx, dword [edi + 0x7c0]
push 0x1f4
push edx
call dword [sym.imp.KeRneL32.DLl_WaitForSingleObject]
mov eax, dword [ebp - 0x5614]
mov ecx, dword [ebp - 0x55b4]
push eax
push ecx
call esi
cmp eax, ebx
je 0x110b5c10
push 0x7c5
push 0x111a9228
push 0x111a9474
call fcn.11029a70
add esp, 0xc
mov byte [ebp - 0x55b5], 1
jmp 0x110b5dc2
test esi, esi
je 0x110b5dc2
cmp dword [ebp - 0x5648], 0
je 0x110b5dc2
cmp dword [ebp - 0x5698], 0
jne 0x110b5dc2
mov esi, dword [ebp - 0x565c]
test esi, esi
jne 0x110b5d4b
push esi
call dword [sym.imp.Gdi32.Dll_CreateCompatibleDC]
mov edx, dword [ebp - 0x561c]
mov esi, eax
mov eax, dword [ebp - 0x55c4]
push edx
push eax
push esi
mov dword [ebp - 0x565c], esi
call dword [sym.imp.Gdi32.Dll_CreateCompatibleBitmap]
mov edi, dword [sym.imp.Gdi32.Dll_SelectObject]
push eax
push esi
mov dword [ebp - 0x56bc], eax
call edi
mov dword [ebp - 0x567c], eax
xor eax, eax
lea ecx, [ebp - 0x1124]
push ecx
mov dword [ebp - 0x1124], eax
mov dword [ebp - 0x1120], 0xffffff
mov dword [ebp - 0x111c], eax
call dword [sym.imp.Gdi32.Dll_CreateBrushIndirect]
mov dword [ebp - 0x56ac], eax
test eax, eax
je 0x110b5cbf
push eax
push esi
call edi
mov dword [ebp - 0x56c0], eax
push 0
push 1
push 0
call dword [sym.imp.Gdi32.Dll_CreatePen]
mov dword [ebp - 0x5678], eax
test eax, eax
je 0x110b5cdf
push eax
push esi
call edi
mov dword [ebp - 0x5694], eax
push 0x3c
lea edx, [ebp - 0x1160]
push 0
push edx
call fcn.11162be0
push 0x183b
mov dword [ebp - 0x1160], 0xfffffff5
mov dword [ebp - 0x1150], 0x190
mov byte [ebp - 0x1149], 1
call fcn.11146710
lea edx, [ebp - 0x1144]
add esp, 0x10
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x110b5d20
lea eax, [ebp - 0x1160]
push eax
call dword [sym.imp.Gdi32.Dll_CreateFontIndirectA]
mov dword [ebp - 0x56a4], eax
test eax, eax
je 0x110b5d4b
push eax
push esi
call edi
mov dword [ebp - 0x5680], eax
mov ecx, dword [ebp - 0x561c]
mov edx, dword [ebp - 0x55c4]
push 0x42
push 0
push 0
push esi
push ecx
push edx
push 0
push 0
push esi
mov dword [ebp - 0x55f0], esi
call dword [sym.imp.Gdi32.Dll_BitBlt]
push 1
push 0
push 0
push 0x111ea738
mov dword [ebp - 0x56d0], esi
mov dword [ebp - 0x56cc], 1
call dword [sym.imp.uSEr32.dll_OpenDesktopA]
mov esi, eax
test esi, esi
je 0x110b5db0
lea eax, [ebp - 0x56d0]
push eax
push 0x110b0ec0
push esi
call dword [sym.imp.uSEr32.dll_EnumDesktopWindows]
push esi
call ebx
jmp 0x110b5dc2
lea ecx, [ebp - 0x56d0]
push ecx
push 0x110b0ec0
call dword [sym.imp.uSEr32.dll_EnumWindows]
mov edx, dword [ebp - 0x5650]
mov ecx, dword [edx*4 + 0x111e71e8]
mov edi, dword [ebp - 0x560c]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x55fc], eax
mov dword [ebp - 0x5644], 0xffffffff
mov dword [ebp - 0x5618], eax
mov dword [ebp - 0x5640], eax
mov dword [ebp - 0x5674], ecx
cmp dword [ebp - 0x5600], eax
je 0x110b5e2c
mov edx, dword [ebp - 0x5600]
push 5
push esi
push edx
push edi
call dword [sym.imp.Gdi32.Dll_CombineRgn]
mov eax, dword [ebp - 0x5628]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
neg ecx
push ecx
neg edx
push edx
push edi
call dword [sym.imp.Gdi32.Dll_OffsetRgn]
mov dword [ebp - 0x5638], esi
mov dword [ebp - 0x5634], esi
mov dword [ebp - 0x56a8], esi
mov dword [ebp - 0x5668], esi
mov dword [ebp - 0x5658], esi
mov dword [ebp - 0x56a0], esi
call dword [sym.imp.WinMM.DlL_timeGetTime]
cmp byte [ebp - 0x55b5], 0
mov dword [ebp - 0x55d0], eax
mov dword [ebp - 0x5664], eax
mov byte [ebp - 0x55ad], 0
jne 0x110b6164
cmp byte [ebp - 0x55ae], 0
je 0x110b616b
test edi, edi
je 0x110b5eb9
mov eax, dword [ebp - 0x1580]
cdq
xor eax, edx
sub eax, edx
imul eax, dword [ebp - 0x55d8]
push eax
mov eax, dword [ebp - 0x5608]
push 0
push eax
call fcn.11162be0
mov ecx, dword [ebp - 0x55b4]
add esp, 0xc
push edi
push ecx
call dword [sym.imp.Gdi32.Dll_SelectClipRgn]
mov eax, dword [ebp - 0x55ac]
mov edx, 0x10000
xor esi, esi
xor ebx, ebx
mov edi, edx
add eax, 0x78
mov dword [ebp - 0x55c8], 8
cmp dword [eax - 0x20], 0
je 0x110b5f06
cmp dword [eax - 4], 0
je 0x110b5f06
mov ecx, dword [eax]
cmp ecx, edx
jge 0x110b5eeb
mov edx, ecx
mov ecx, dword [eax + 4]
cmp ecx, edi
jge 0x110b5ef4
mov edi, ecx
mov ecx, dword [eax + 8]
cmp ecx, esi
jle 0x110b5efd
mov esi, ecx
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
jle 0x110b5f06
mov ebx, ecx
cmp dword [eax + 0x18], 0
je 0x110b5f36
cmp dword [eax + 0x34], 0
je 0x110b5f36
mov ecx, dword [eax + 0x38]
cmp ecx, edx
jge 0x110b5f1b
mov edx, ecx
mov ecx, dword [eax + 0x3c]
cmp ecx, edi
jge 0x110b5f24
mov edi, ecx
mov ecx, dword [eax + 0x40]
cmp ecx, esi
jle 0x110b5f2d
mov esi, ecx
mov ecx, dword [eax + 0x44]
cmp ecx, ebx
jle 0x110b5f36
mov ebx, ecx
cmp dword [eax + 0x50], 0
je 0x110b5f66
cmp dword [eax + 0x6c], 0
je 0x110b5f66
mov ecx, dword [eax + 0x70]
cmp ecx, edx
jge 0x110b5f4b
mov edx, ecx
mov ecx, dword [eax + 0x74]
cmp ecx, edi
jge 0x110b5f54
mov edi, ecx
mov ecx, dword [eax + 0x78]
cmp ecx, esi
jle 0x110b5f5d
mov esi, ecx
mov ecx, dword [eax + 0x7c]
cmp ecx, ebx
jle 0x110b5f66
mov ebx, ecx
cmp dword [eax + 0x88], 0
je 0x110b5fa8
cmp dword [eax + 0xa4], 0
je 0x110b5fa8
mov ecx, dword [eax + 0xa8]
cmp ecx, edx
jge 0x110b5f84
mov edx, ecx
mov ecx, dword [eax + 0xac]
cmp ecx, edi
jge 0x110b5f90
mov edi, ecx
mov ecx, dword [eax + 0xb0]
cmp ecx, esi
jle 0x110b5f9c
mov esi, ecx
mov ecx, dword [eax + 0xb4]
cmp ecx, ebx
jle 0x110b5fa8
mov ebx, ecx
add eax, 0xe0
dec dword [ebp - 0x55c8]
jne 0x110b5ed7
cmp esi, edx
jge 0x110b5fcd
mov esi, dword [ebp - 0x55c4]
mov ebx, dword [ebp - 0x561c]
xor edx, edx
xor edi, edi
mov eax, dword [ebp - 0x5620]
or eax, 0xcc0020
push eax
mov eax, dword [ebp - 0x5628]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
add ecx, edi
push ecx
mov ecx, dword [ebp - 0x55f0]
add eax, edx
push eax
push ecx
sub ebx, edi
push ebx
sub esi, edx
push esi
push edi
push edx
mov edx, dword [ebp - 0x55b4]
push edx
call dword [sym.imp.Gdi32.Dll_BitBlt]
test eax, eax
je 0x110b6081
mov byte [ebp - 0x55ad], 1
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov esi, eax
sub eax, dword [ebp - 0x5664]
mov dword [ebp - 0x55d0], esi
mov dword [ebp - 0x5638], eax
mov eax, dword [ebp - 0x55ac]
cmp dword [eax + 0x4c], 0
je 0x110b616b
test dword [ebp - 0x5620], 0x40000000
jne 0x110b606e
cmp dword [ebp - 0x55e0], 0
jne 0x110b6059
cmp dword [ebp - 0x5684], 0
jne 0x110b606e
mov ecx, dword [ebp - 0x55b4]
push 0
push 0
push 0
push ecx
call fcn.110b41c0
add esp, 0x10
call dword [sym.imp.WinMM.DlL_timeGetTime]
sub eax, esi
mov dword [ebp - 0x56a0], eax
jmp 0x110b616b
mov esi, dword [ebp - 0x55ac]
cmp dword [esi + 0x810], 0
je 0x110b616b
cmp byte [esi + 0x808], 0
jne 0x110b60b8
mov byte [esi + 0x808], 1
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push 0x111a9444
call fcn.11147060
add esp, 8
lea edx, [esi + 0x7c8]
push 0x111ea720
push edx
call fcn.11081e70
add esp, 8
test eax, eax
je 0x110b60e5
push 1
mov ecx, esi
call fcn.110b3560
push 0x111ea720
mov ecx, esi
call fcn.110b3330
mov ebx, dword [ebp - 0x562c]
mov eax, dword [ebp - 0x55b4]
mov edi, dword [sym.imp.Gdi32.Dll_SelectObject]
push ebx
push eax
call edi
cmp eax, dword [ebp - 0x5614]
je 0x110b611a
push 0x8fb
push 0x111a9228
push 0x111a9480
call fcn.11029a70
add esp, 0xc
mov ecx, dword [esi + 0x7bc]
push ecx
call dword [sym.imp.KeRneL32.DLl_SetEvent]
mov edx, dword [esi + 0x7c0]
push 0x3e8
push edx
call dword [sym.imp.KeRneL32.DLl_WaitForSingleObject]
mov eax, dword [ebp - 0x5614]
mov ecx, dword [ebp - 0x55b4]
push eax
push ecx
call edi
cmp eax, ebx
je 0x110b6164
push 0x8ff
push 0x111a9228
push 0x111a9474
call fcn.11029a70
add esp, 0xc
mov byte [ebp - 0x55ad], 1
mov edx, dword [ebp - 0x55ac]
cmp byte [edx + 0x79c], 0
je 0x110b624e
mov eax, dword [ebp + 0x24]
test eax, eax
jne 0x110b618e
cmp dword [ebp + 0x20], eax
je 0x110b624e
mov ecx, dword [0x111e70e0]
push ecx
mov ecx, dword [ebp - 0x561c]
lea edx, [ebp - 0x1118]
push edx
mov edx, dword [ebp - 0x55c4]
push eax
mov eax, dword [ebp - 0x55d8]
push 2
push eax
mov eax, dword [ebp - 0x5608]
push ecx
push edx
push eax
call fcn.1108c170
mov edi, eax
add esp, 0x20
xor esi, esi
test edi, edi
jle 0x110b624e
nop
mov dl, byte [ebp + esi*4 - 0x1116]
mov cl, byte [ebp + esi*4 - 0x1118]
mov al, byte [ebp + esi*4 - 0x1117]
xor ebx, ebx
cmp byte [ebp + esi*4 - 0x518], dl
setne bl
xor edx, edx
cmp byte [ebp + esi*4 - 0x516], cl
mov byte [ebp + esi*4 - 0x516], cl
setne dl
movzx ecx, cl
or ebx, edx
xor edx, edx
cmp byte [ebp + esi*4 - 0x517], al
mov byte [ebp + esi*4 - 0x517], al
setne dl
movzx eax, al
inc esi
or ebx, edx
mov dl, byte [ebp + esi*4 - 0x111a]
or dword [ebp - 0x55e8], ebx
mov byte [ebp + esi*4 - 0x51c], dl
movzx edx, dl
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
mov dword [esi*4 + 0x111f10f4], edx
cmp esi, edi
jl 0x110b61d0
mov edx, dword [ebp - 0x55ac]
xor eax, eax
mov dword [ebp - 0x55c8], eax
mov byte [edx + 0x79e], al
mov dword [ebp - 0x55c0], eax
mov dword [ebp - 0x55d4], eax
cmp dword [ebp - 0x564c], eax
jle 0x110b6b43
mov eax, dword [ebp - 0x55ac]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x110b6b43
mov edx, eax
cmp byte [edx + 0x24], cl
jne 0x110b6b43
mov ebx, dword [ebp - 0x55d8]
cmp byte [ebp - 0x55ad], cl
je 0x110b62b3
mov eax, dword [ebp - 0x55c0]
imul eax, ebx
mov dword [ebp - 0x55c8], eax
mov edi, dword [ebp - 0x560c]
test edi, edi
je 0x110b6314
mov eax, edx
cmp dword [eax + 0x4c], 0
je 0x110b62cb
call dword [sym.imp.Gdi32.Dll_GdiFlush]
cmp byte [ebp - 0x55ad], 0
jne 0x110b6314
mov esi, dword [ebp - 0x55bc]
mov edx, dword [ebp - 0x5608]
mov ecx, esi
imul ecx, ebx
push ecx
push 0
push edx
call fcn.11162be0
add esp, 0xc
cmp dword [ebp - 0x55d4], 0
je 0x110b6306
neg esi
push esi
push 0
push edi
call dword [sym.imp.Gdi32.Dll_OffsetRgn]
mov eax, dword [ebp - 0x55b4]
push edi
push eax
call dword [sym.imp.Gdi32.Dll_SelectClipRgn]
mov ecx, dword [ebp - 0x5654]
mov edx, dword [ebp - 0x55d4]
mov al, byte [edx + ecx]
mov byte [ebp - 0x55b5], al
test al, 7
je 0x110b6340
cmp dword [ebp - 0x55fc], 0
jne 0x110b6340
mov dword [ebp - 0x55fc], 1
mov eax, dword [ebp + 0x24]
test eax, eax
jne 0x110b6358
cmp dword [ebp + 0x20], eax
jne 0x110b6358
cmp dword [ebp - 0x55fc], eax
je 0x110b6602
cmp byte [ebp - 0x55ad], 0
jne 0x110b6432
xor esi, esi
test eax, eax
jne 0x110b6373
cmp dword [0x111f14f8], esi
je 0x110b637b
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov esi, eax
mov eax, dword [ebp - 0x5620]
or eax, 0xcc0020
push eax
mov eax, dword [ebp - 0x5628]
mov ecx, dword [eax + 4]
add ecx, dword [ebp - 0x55c0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x55f0]
push ecx
mov ecx, dword [ebp - 0x55bc]
push edx
mov edx, dword [ebp - 0x55c4]
push eax
mov eax, dword [ebp - 0x55b4]
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.Gdi32.Dll_BitBlt]
test eax, eax
jne 0x110b63e2
cmp byte [0x111f1509], al
jne 0x110b63e2
mov byte [0x111f1509], 1
call dword [sym.imp.KeRneL32.DLl_GetLastError]
cmp eax, 6
je 0x110b6b43
cmp dword [ebp + 0x24], 0
jne 0x110b63f1
cmp dword [0x111f14f8], 0
je 0x110b6405
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov dword [ebp - 0x55d0], eax
sub eax, esi
add dword [ebp - 0x5638], eax
mov ecx, dword [ebp - 0x55ac]
mov edx, dword [ecx + 0x18]
test edx, edx
jne 0x110b6b43
mov eax, ecx
cmp byte [eax + 0x24], dl
jne 0x110b6b43
cmp dword [ecx + 0x4c], edx
je 0x110b642c
call dword [sym.imp.Gdi32.Dll_GdiFlush]
mov ebx, dword [ebp - 0x55d8]
cmp dword [ebp + 0x24], 0
je 0x110b64c1
cmp dword [ebp - 0x55d4], 0
jne 0x110b64c1
cmp dword [0x111f14f8], 0
je 0x110b64d6
mov esi, dword [ebp - 0x5608]
add esi, 0xe
mov edi, 8
movzx edx, byte [esi + 1]
movzx ecx, byte [esi]
movzx eax, byte [esi - 5]
push edx
movzx edx, byte [esi - 1]
push ecx
movzx ecx, byte [esi - 2]
push edx
movzx edx, byte [esi - 3]
push ecx
movzx ecx, byte [esi - 4]
push edx
movzx edx, byte [esi - 7]
push ecx
movzx ecx, byte [esi - 9]
push eax
push eax
movzx eax, byte [esi - 8]
push edx
movzx edx, byte [esi - 0xa]
push eax
movzx eax, byte [esi - 0xb]
push ecx
movzx ecx, byte [esi - 0xc]
push edx
movzx edx, byte [esi - 0xd]
push eax
movzx eax, byte [esi - 0xe]
push ecx
push edx
push eax
push 0x111a93f0
call fcn.11147060
add esp, 0x44
add esi, ebx
dec edi
jne 0x110b6464
cmp dword [0x111f14f8], 0
je 0x110b64d6
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov dword [ebp - 0x55d0], eax
mov ecx, dword [ebp - 0x55c0]
mov edx, dword [ebp - 0x566c]
mov edi, dword [ebp - 0x55ec]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp - 0x55f8]
lea eax, [ebp - 0x918]
push eax
mov eax, dword [ebp - 0x55bc]
push edi
push ebx
mov ebx, dword [ebp - 0x55cc]
push ecx
mov ecx, dword [ebp - 0x55c4]
push edx
push eax
mov eax, dword [ebp - 0x55c8]
add eax, dword [ebp - 0x5608]
push ecx
mov ecx, dword [ebp - 0x55ac]
push ebx
push eax
call fcn.110b24c0
cmp dword [0x111f14f8], 0
je 0x110b6546
call dword [sym.imp.WinMM.DlL_timeGetTime]
sub eax, dword [ebp - 0x55d0]
add dword [ebp - 0x5634], eax
cmp dword [ebp - 0x568c], 0
je 0x110b65aa
cmp dword [ebp - 0x5648], 0
jne 0x110b65aa
mov ecx, dword [ebp - 0x55c0]
add ecx, dword [ebp - 0x55bc]
cmp ecx, dword [ebp - 0x561c]
jge 0x110b65aa
mov eax, dword [ebp - 0x55bc]
dec eax
test eax, eax
jle 0x110b65aa
mov esi, ebx
mov dword [ebp - 0x55e0], eax
nop
push edi
push esi
push ebx
call fcn.11168345
add esp, 0xc
test eax, eax
mov eax, 1
je 0x110b65a0
mov dword [ebp - 0x5648], eax
mov dword [ebp - 0x5698], eax
add esi, edi
sub dword [ebp - 0x55e0], eax
jne 0x110b6580
cmp dword [ebp - 0x55e8], 0
je 0x110b65d4
mov ecx, dword [ebp - 0x55ac]
push 0x100
lea eax, [ebp - 0x518]
push eax
mov dword [ebp - 0x55e8], 0
call fcn.110b3f80
mov ecx, dword [ebp - 0x55ac]
mov edx, dword [ecx + 0x18]
test edx, edx
jne 0x110b6b43
mov eax, ecx
cmp byte [eax + 0x24], dl
jne 0x110b6b43
cmp dword [ebp + 0x24], edx
jne 0x110b69b7
cmp dword [ebp + 0x20], edx
jne 0x110b69b7
mov ecx, dword [ebp - 0x55ac]
mov edx, dword [ecx + 0x18]
test edx, edx
jne 0x110b6b43
mov eax, ecx
cmp byte [eax + 0x24], dl
jne 0x110b6b43
inc dword [ebp - 0x5690]
mov edi, dword [ebp - 0x55bc]
mov esi, dword [ebp - 0x55c0]
cmp dword [ebp - 0x55fc], edx
jne 0x110b68fd
mov ebx, dword [ebp - 0x5674]
cmp byte [ebp - 0x55ad], dl
jne 0x110b66d5
mov eax, dword [ebp - 0x5628]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0x5620]
mov eax, dword [eax]
or ecx, 0xcc0020
push ecx
mov ecx, dword [ebp - 0x55f0]
add edx, esi
add edx, ebx
push edx
mov edx, dword [ebp - 0x55c4]
push eax
mov eax, dword [ebp - 0x55b4]
push ecx
push 1
push edx
push ebx
push 0
push eax
call dword [sym.imp.Gdi32.Dll_BitBlt]
test eax, eax
jne 0x110b66ae
cmp byte [0x111f1508], al
jne 0x110b66ae
mov byte [0x111f1508], 1
call dword [sym.imp.KeRneL32.DLl_GetLastError]
cmp eax, 6
je 0x110b6b43
mov ecx, dword [ebp - 0x55ac]
mov edx, dword [ecx + 0x18]
test edx, edx
jne 0x110b6b43
mov eax, ecx
cmp byte [eax + 0x24], dl
jne 0x110b6b43
cmp dword [ecx + 0x4c], edx
je 0x110b66d5
call dword [sym.imp.Gdi32.Dll_GdiFlush]
mov edx, dword [ebp - 0x55ac]
cmp byte [edx + 0x79c], 0
je 0x110b66fe
mov eax, ebx
imul eax, dword [ebp - 0x55d8]
add eax, dword [ebp - 0x55c8]
add eax, dword [ebp - 0x5608]
jmp 0x110b679c
cmp dword [0x111f14f8], 0
je 0x110b6713
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov dword [ebp - 0x55d0], eax
mov edx, dword [ebp - 0x55c0]
mov ecx, dword [ebp - 0x55ec]
add edx, ebx
push edx
mov edx, dword [ebp - 0x566c]
push edx
lea edx, [ebp - 0x918]
push edx
mov edx, dword [ebp + 0x14]
push ecx
mov eax, ebx
imul eax, ecx
mov ecx, dword [ebp - 0x55d8]
add eax, dword [ebp - 0x55cc]
push ecx
push edx
mov edx, dword [ebp - 0x55f8]
push edx
mov edx, dword [ebp - 0x55c4]
push 1
mov dword [ebp - 0x5604], eax
push edx
push eax
mov eax, ebx
imul eax, ecx
add eax, dword [ebp - 0x55c8]
mov ecx, dword [ebp - 0x55ac]
add eax, dword [ebp - 0x5608]
push eax
call fcn.110b24c0
cmp dword [0x111f14f8], 0
je 0x110b6796
call dword [sym.imp.WinMM.DlL_timeGetTime]
sub eax, dword [ebp - 0x55d0]
add dword [ebp - 0x5634], eax
mov eax, dword [ebp - 0x5604]
mov ecx, dword [ebp - 0x55ec]
mov edx, dword [ebp - 0x55c0]
add edx, ebx
imul edx, ecx
add edx, dword [ebp - 0x5624]
push ecx
push edx
push eax
call fcn.11168345
add esp, 0xc
test eax, eax
je 0x110b6b1f
cmp byte [ebp - 0x55ad], 0
je 0x110b680e
mov eax, dword [ebp - 0x55d4]
dec eax
cmp eax, dword [ebp - 0x5644]
jle 0x110b67ff
mov dword [ebp - 0x55d4], eax
mov eax, dword [ebp - 0x55bc]
sub dword [ebp - 0x55c0], eax
mov dword [ebp - 0x55fc], 2
jmp 0x110b6b31
mov dword [ebp - 0x55fc], 1
jmp 0x110b6b31
mov eax, dword [ebp - 0x55c0]
test eax, eax
je 0x110b6835
cmp dword [ebp - 0x5600], 0
jne 0x110b6835
mov ecx, dword [ebp - 0x55bc]
mov edx, eax
sub edx, ecx
lea esi, [edx + ebx + 1]
mov edi, eax
sub edi, esi
add edi, ecx
mov eax, dword [ebp - 0x5620]
or eax, 0xcc0020
push eax
mov eax, dword [ebp - 0x5628]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x55f0]
add ecx, esi
push ecx
mov ecx, dword [ebp - 0x55c4]
push edx
mov edx, dword [ebp - 0x55b4]
push eax
push edi
push ecx
push 0
push 0
push edx
mov dword [ebp - 0x55fc], 1
call dword [sym.imp.Gdi32.Dll_BitBlt]
test eax, eax
jne 0x110b688d
call dword [sym.imp.KeRneL32.DLl_GetLastError]
cmp eax, 6
je 0x110b6b43
mov eax, dword [ebp - 0x55ac]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x110b6b43
cmp byte [eax + 0x24], cl
jne 0x110b6b43
cmp dword [eax + 0x4c], ecx
je 0x110b68b2
call dword [sym.imp.Gdi32.Dll_GdiFlush]
mov edx, dword [ebp - 0x566c]
mov ebx, dword [ebp - 0x55ec]
mov ecx, dword [ebp - 0x55d8]
push esi
push edx
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x918]
push eax
mov eax, dword [ebp - 0x55f8]
push ebx
push ecx
mov ecx, dword [ebp - 0x55c4]
push edx
mov edx, dword [ebp - 0x55cc]
push eax
mov eax, dword [ebp - 0x5608]
push edi
push ecx
mov ecx, dword [ebp - 0x55ac]
push edx
push eax
call fcn.110b24c0
jmp 0x110b6903
mov ebx, dword [ebp - 0x55ec]
lea ecx, [ebp - 0x5658]
push ecx
lea edx, [ebp - 0x5668]
push edx
mov edx, dword [ebp - 0x5610]
lea eax, [ebp - 0x56a8]
push eax
mov eax, dword [ebp - 0x5600]
lea ecx, [ebp - 0x5618]
push ecx
mov ecx, dword [ebp - 0x55e4]
push edx
mov edx, dword [ebp - 0x55dc]
push eax
mov eax, dword [ebp - 0x55f8]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp - 0x55cc]
push ebx
push ebx
push esi
imul esi, ebx
add esi, dword [ebp - 0x5624]
push 0
push eax
push ecx
mov ecx, dword [ebp - 0x55ac]
push edi
push edx
push esi
call fcn.110b49d0
test eax, eax
jne 0x110b6983
mov eax, dword [ebp - 0x55d4]
dec dword [ebp - 0x55fc]
mov dword [ebp - 0x5644], eax
jmp 0x110b6b1f
add dword [ebp - 0x5640], eax
mov al, byte [ebp - 0x55b5]
mov edx, dword [ebp - 0x55d4]
mov ecx, dword [ebp - 0x5654]
or al, 1
mov byte [edx + ecx], al
mov eax, edx
mov dword [ebp - 0x55fc], 1
mov dword [ebp - 0x5644], eax
jmp 0x110b6b1f
mov esi, dword [ebp - 0x55c0]
mov edi, dword [ebp - 0x5660]
mov edx, dword [ebp - 0x55cc]
mov eax, esi
imul eax, dword [ebp - 0x55ec]
add eax, dword [ebp - 0x5624]
push edi
push edx
push eax
call fcn.11162c60
mov eax, dword [ebp - 0x55dc]
movzx ecx, word [ebp - 0x55c4]
mov edx, dword [ebp - 0x55bc]
mov word [eax + 6], cx
mov ecx, dword [ebp - 0x55ac]
neg edx
mov word [eax + 8], dx
mov dx, word [ecx + 0x7ac]
mov word [eax + 2], dx
movzx ecx, word [ecx + 0x7b0]
mov edx, dword [ebp - 0x55e4]
add cx, si
push edx
mov word [eax + 4], cx
lea esi, [eax + 0xb]
call fcn.11163a11
add esp, 0x10
cmp dword [ebp + 0x14], 0x10
mov ebx, eax
mov dword [ebp - 0x55e0], 0
jle 0x110b6a5c
mov eax, dword [ebp - 0x55e4]
mov ecx, dword [ebp - 0x55cc]
push eax
push esi
push edi
push ecx
call fcn.110ee290
add esp, 0x10
mov esi, eax
jmp 0x110b6ac8
mov eax, dword [ebp + 0x14]
cmp eax, 8
jle 0x110b6e30
mov edx, dword [ebp - 0x55e4]
mov eax, dword [ebp - 0x55cc]
push edx
push esi
push edi
push eax
call fcn.110ee430
add esp, 0x10
mov esi, eax
test ebx, ebx
je 0x110b6ac8
mov ecx, dword [ebp - 0x55e4]
mov edx, dword [ebp - 0x55cc]
push ecx
push ebx
push edi
push edx
call fcn.110ee510
add esp, 0x10
mov dword [ebp - 0x55e0], eax
mov eax, dword [ebp - 0x55e0]
test eax, eax
je 0x110b6ac8
cmp eax, esi
jge 0x110b6ac8
mov esi, eax
mov eax, dword [ebp - 0x55dc]
push esi
add eax, 0xb
push ebx
push eax
call fcn.11162c60
add esp, 0xc
push ebx
call fcn.11163aa5
mov eax, dword [ebp - 0x55ac]
mov ecx, dword [eax + 0x18]
add dword [ebp - 0x5618], esi
add dword [ebp - 0x5640], edi
add esp, 4
test ecx, ecx
jne 0x110b6b43
mov edx, eax
cmp byte [edx + 0x24], cl
jne 0x110b6b43
mov edi, eax
cmp dword [ebp - 0x55d4], ecx
jne 0x110b6b0b
push 1
mov ecx, edi
call fcn.110b42f0
mov byte [edi + 0x79e], 1
mov eax, dword [ebp - 0x55dc]
push 0
add esi, 0xc
push esi
push eax
mov ecx, edi
call fcn.110b3ce0
mov ecx, dword [ebp - 0x55bc]
inc dword [ebp - 0x55d4]
add dword [ebp - 0x55c0], ecx
mov edx, dword [ebp - 0x55d4]
cmp edx, dword [ebp - 0x564c]
jl 0x110b627a
mov edx, dword [ebp - 0x564c]
xor eax, eax
test edx, edx
jle 0x110b6b5d
mov ecx, dword [ebp - 0x5654]
shl byte [eax + ecx], 1
inc eax
cmp eax, edx
jl 0x110b6b55
mov eax, dword [ebp - 0x5610]
test eax, eax
je 0x110b7173
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x110b7173
mov ecx, dword [ebp - 0x55ac]
cmp byte [ecx + 0x79c], 0
je 0x110b6d38
push 0x11
call dword [sym.imp.uSEr32.dll_GetKeyState]
mov edx, dword [ebp - 0x5610]
mov ecx, dword [edx]
movzx esi, ax
shr esi, 0xf
and esi, 1
je 0x110b6bd6
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push eax
mov eax, dword [ecx + 0xc]
push edx
cdq
xor eax, edx
sub eax, edx
push eax
mov eax, dword [ecx + 8]
push eax
push 0x111a93d8
call fcn.11147060
add esp, 0x14
mov edx, dword [ebp - 0x55ac]
mov eax, dword [edx + 0x794]
lea ecx, [ebp - 0xd18]
push ecx
push esi
push eax
call fcn.1108b2a0
xor esi, esi
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x55e8], esi
cmp edi, esi
jle 0x110b6c8e
jmp 0x110b6c10
mov dl, byte [ebp + esi*4 - 0xd16]
mov cl, byte [ebp + esi*4 - 0xd18]
mov al, byte [ebp + esi*4 - 0xd17]
xor ebx, ebx
cmp byte [ebp + esi*4 - 0x518], dl
setne bl
xor edx, edx
cmp byte [ebp + esi*4 - 0x516], cl
mov byte [ebp + esi*4 - 0x516], cl
setne dl
movzx ecx, cl
or ebx, edx
xor edx, edx
cmp byte [ebp + esi*4 - 0x517], al
mov byte [ebp + esi*4 - 0x517], al
setne dl
movzx eax, al
inc esi
or ebx, edx
mov dl, byte [ebp + esi*4 - 0xd1a]
or dword [ebp - 0x55e8], ebx
mov byte [ebp + esi*4 - 0x51c], dl
movzx edx, dl
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
mov dword [esi*4 + 0x111f10f4], edx
cmp esi, edi
jl 0x110b6c10
cmp edi, 0x100
jge 0x110b6cb4
mov edx, 0x100
sub edx, edi
add edx, edx
add edx, edx
push edx
lea eax, [ebp + edi*4 - 0x518]
push 0
push eax
call fcn.11162be0
add esp, 0xc
cmp dword [ebp - 0x55e8], 0
je 0x110b6cda
push edi
lea ecx, [ebp - 0x518]
push ecx
mov ecx, dword [ebp - 0x55ac]
mov dword [ebp - 0x55e8], 0
call fcn.110b3f80
cmp dword [0x111f14f8], 0
je 0x110b6cef
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov dword [ebp - 0x56c4], eax
mov edx, dword [0x111e70e0]
mov ecx, dword [ebp - 0x55ac]
push edx
mov edx, dword [ecx + 0x794]
push 1
lea eax, [ebp - 0xd18]
push eax
push edi
push edx
call fcn.1108b080
add esp, 0x14
cmp dword [0x111f14f8], 0
je 0x110b6d38
call dword [sym.imp.WinMM.DlL_timeGetTime]
sub eax, dword [ebp - 0x56c4]
push eax
push 0x111a547c
call fcn.11147060
add esp, 8
mov esi, dword [ebp - 0x55ac]
push 1
mov ecx, esi
call fcn.110b42f0
mov eax, dword [ebp - 0x5660]
push eax
mov byte [esi + 0x79e], 1
mov dword [ebp - 0x5644], 0
call fcn.11163a11
add esp, 4
mov dword [ebp - 0x55d0], eax
test eax, eax
je 0x110b711f
mov eax, dword [ebp - 0x5610]
mov edi, dword [eax]
cmp edi, dword [eax + 4]
je 0x110b710a
jmp 0x110b6d90
movzx ecx, word [edi + 0xc]
mov eax, dword [ebp - 0x55dc]
mov word [eax + 8], cx
mov dx, word [edi + 8]
mov word [eax + 6], dx
movzx ecx, word [edi]
mov edx, dword [ebp - 0x55ac]
mov word [eax + 2], cx
movzx ecx, word [edi + 4]
mov word [eax + 4], cx
cmp byte [edx + 0x79c], 0
mov dword [ebp - 0x5604], ecx
je 0x110b7003
movzx ebx, word [eax + 6]
movsx eax, word [eax + 8]
mov ecx, dword [edi + 0x10]
cdq
mov esi, eax
mov eax, dword [ebp - 0x55ac]
mov eax, dword [eax + 0x798]
xor esi, edx
sub esi, edx
cmp eax, 0x64
jl 0x110b6fa1
mov edx, dword [ebp - 0x55dc]
movzx eax, word [edx + 2]
movzx edx, word [ebp - 0x5604]
push eax
mov eax, dword [ebp - 0x55ec]
push edx
mov edx, dword [ebp - 0x55d0]
push ebx
push eax
push esi
push ebx
push edx
push ecx
call fcn.110b12d0
add esp, 0x20
imul esi, ebx
mov dword [ebp - 0x5644], esi
jmp 0x110b7051
mov ecx, dword [ebp - 0x55ac]
cmp byte [ecx + 0x79c], 0
je 0x110b6f41
mov eax, dword [ebp - 0x55bc]
mov esi, dword [ebp - 0x55c4]
imul eax, esi
mov dword [ebp - 0x5604], eax
add eax, 0x100
push eax
call fcn.11163a11
mov edx, dword [ebp - 0x55ac]
mov edi, eax
mov eax, dword [edx + 0x798]
add esp, 4
cmp eax, 0x64
jl 0x110b6ea4
mov eax, dword [ebp - 0x55c0]
mov ecx, dword [ebp - 0x55d8]
mov edx, dword [ebp - 0x55bc]
push 0
push eax
mov eax, dword [ebp - 0x55cc]
push esi
push ecx
push edx
push esi
push edi
push eax
call fcn.110b12d0
add esp, 0x20
jmp 0x110b6ee8
mov edx, dword [ebp - 0x55d8]
cmp eax, 0x4b
mov eax, dword [ebp - 0x55bc]
jl 0x110b6ed4
mov ecx, dword [ebp - 0x55c0]
push 0
push ecx
mov ecx, dword [ebp - 0x55cc]
push esi
push edx
push eax
push esi
push edi
push ecx
call fcn.110b14a0
add esp, 0x20
jmp 0x110b6ee8
mov ecx, dword [ebp - 0x55cc]
push esi
push edx
push eax
push esi
push edi
push ecx
call fcn.110b16e0
add esp, 0x18
mov edx, dword [ebp - 0x55e4]
mov eax, dword [ebp - 0x55dc]
push edx
add eax, 0xb
push eax
mov eax, dword [ebp - 0x5604]
push eax
push edi
call fcn.110ee510
add esp, 0x10
mov esi, eax
test ebx, ebx
je 0x110b6f2d
mov ecx, dword [ebp - 0x55e4]
mov edx, dword [ebp - 0x5604]
push ecx
push ebx
push edx
push edi
call fcn.110ee5f0
add esp, 0x10
mov dword [ebp - 0x55e0], eax
push edi
call fcn.11163aa5
mov edi, dword [ebp - 0x5660]
add esp, 4
jmp 0x110b6aa4
cmp eax, 8
jne 0x110b6f82
mov eax, dword [ebp - 0x55e4]
mov ecx, dword [ebp - 0x55cc]
push eax
push esi
push edi
push ecx
call fcn.110ee510
add esp, 0x10
mov esi, eax
test ebx, ebx
je 0x110b6ac8
mov edx, dword [ebp - 0x55e4]
mov eax, dword [ebp - 0x55cc]
push edx
push ebx
push edi
push eax
call fcn.110ee5f0
jmp 0x110b6a9b
mov ecx, dword [ebp - 0x55e4]
mov edx, dword [ebp - 0x55cc]
push ecx
push esi
push edi
push edx
call fcn.110ee5f0
add esp, 0x10
mov esi, eax
jmp 0x110b6ac8
cmp eax, 0x4b
jl 0x110b6fde
mov eax, dword [ebp - 0x55dc]
movzx edx, word [eax + 2]
movzx eax, word [ebp - 0x5604]
push edx
mov edx, dword [ebp - 0x55ec]
push eax
mov eax, dword [ebp - 0x55d0]
push ebx
push edx
push esi
push ebx
push eax
push ecx
call fcn.110b14a0
add esp, 0x20
imul esi, ebx
mov dword [ebp - 0x5644], esi
jmp 0x110b7051
mov edx, dword [ebp - 0x55ec]
mov eax, dword [ebp - 0x55d0]
push ebx
push edx
push esi
push ebx
push eax
push ecx
call fcn.110b16e0
add esp, 0x18
imul esi, ebx
mov dword [ebp - 0x5644], esi
jmp 0x110b7051
mov eax, dword [edi + 0xc]
mov esi, dword [ebp - 0x55d0]
mov ebx, dword [edi + 0x10]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0x55c8], 0
test eax, eax
jle 0x110b7051
mov ecx, dword [edi + 0x14]
push ecx
push ebx
push esi
call fcn.11162c60
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
inc dword [ebp - 0x55c8]
add ebx, dword [ebp - 0x55ec]
cdq
xor eax, edx
sub eax, edx
add esp, 0xc
add esi, ecx
cmp dword [ebp - 0x55c8], eax
jl 0x110b7025
cmp dword [0x111f14f8], 0
je 0x110b7066
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov dword [ebp - 0x56c8], eax
mov ecx, dword [ebp - 0x55e4]
mov eax, dword [ebp - 0x55dc]
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp - 0x55d0]
add eax, 0xb
push eax
mov eax, dword [ebp - 0x5644]
push edx
push eax
push ecx
mov ecx, dword [ebp - 0x55ac]
call fcn.110b27d0
cmp dword [0x111f14f8], 0
mov esi, eax
je 0x110b70bd
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov edx, dword [ebp - 0x56c8]
mov ebx, eax
sub edx, ebx
add dword [ebp - 0x5668], edx
mov dword [ebp - 0x56d4], ebx
jmp 0x110b70c3
mov ebx, dword [ebp - 0x56d4]
mov ecx, dword [ebp - 0x55dc]
push 0
lea eax, [esi + 0xc]
push eax
push ecx
mov ecx, dword [ebp - 0x55ac]
call fcn.110b3ce0
add dword [ebp - 0x5618], esi
cmp dword [0x111f14f8], 0
je 0x110b70f8
call dword [sym.imp.WinMM.DlL_timeGetTime]
sub eax, ebx
add dword [ebp - 0x5658], eax
mov edx, dword [ebp - 0x5610]
add edi, 0x18
cmp edi, dword [edx + 4]
jne 0x110b6d90
mov eax, dword [ebp - 0x55d0]
push eax
call fcn.11163aa5
mov esi, dword [ebp - 0x55ac]
add esp, 4
mov edi, dword [ebp - 0x5610]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
cmp ecx, edx
je 0x110b7163
mov eax, edx
cmp edx, edx
je 0x110b7160
mov ebx, dword [eax]
mov dword [ecx], ebx
mov ebx, dword [eax + 4]
mov dword [ecx + 4], ebx
mov ebx, dword [eax + 8]
mov dword [ecx + 8], ebx
mov ebx, dword [eax + 0xc]
mov dword [ecx + 0xc], ebx
mov ebx, dword [eax + 0x10]
mov dword [ecx + 0x10], ebx
mov ebx, dword [eax + 0x14]
mov dword [ecx + 0x14], ebx
add eax, 0x18
add ecx, 0x18
cmp eax, edx
jne 0x110b7134
mov dword [edi + 4], ecx
push 0
mov ecx, esi
call fcn.110b42f0
mov byte [esi + 0x79e], 0
mov edi, dword [ebp - 0x55ac]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x55c8], ebx
cmp dword [edi + 0x76c], ebx
je 0x110b7262
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 0x5604], eax
call dword [sym.imp.KeRneL32.DLl_EnterCriticalSection]
lea eax, [edi + 0x88]
lea edi, [ebx + 8]
xor edx, edx
cmp dword [eax - 0x30], edx
je 0x110b71c5
mov ecx, dword [eax]
cmp ecx, ebx
jbe 0x110b71b7
mov ebx, ecx
mov ecx, dword [eax + 4]
mov dword [eax], edx
cmp ecx, esi
jbe 0x110b71c2
mov esi, ecx
mov dword [eax + 4], edx
cmp dword [eax + 8], edx
je 0x110b71e2
mov ecx, dword [eax + 0x38]
cmp ecx, ebx
jbe 0x110b71d3
mov ebx, ecx
mov ecx, dword [eax + 0x3c]
mov dword [eax + 0x38], edx
cmp ecx, esi
jbe 0x110b71df
mov esi, ecx
mov dword [eax + 0x3c], edx
cmp dword [eax + 0x40], edx
je 0x110b71ff
mov ecx, dword [eax + 0x70]
cmp ecx, ebx
jbe 0x110b71f0
mov ebx, ecx
mov ecx, dword [eax + 0x74]
mov dword [eax + 0x70], edx
cmp ecx, esi
jbe 0x110b71fc
mov esi, ecx
mov dword [eax + 0x74], edx
cmp dword [eax + 0x78], edx
je 0x110b7228
mov ecx, dword [eax + 0xa8]
cmp ecx, ebx
jbe 0x110b7210
mov ebx, ecx
mov ecx, dword [eax + 0xac]
mov dword [eax + 0xa8], edx
cmp ecx, esi
jbe 0x110b7222
mov esi, ecx
mov dword [eax + 0xac], edx
add eax, 0xe0
dec edi
jne 0x110b71a8
mov dword [ebp - 0x55c8], ebx
cmp ebx, edx
jne 0x110b7255
lea ecx, [esi + esi*4]
add ecx, ecx
mov eax, 0x38e38e39
mul ecx
mov ebx, edx
shr ebx, 2
mov dword [ebp - 0x55c8], ebx
mov edx, dword [ebp - 0x5604]
push edx
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov edi, eax
sub edi, dword [ebp - 0x5664]
cmp dword [0x111f14f8], 0
je 0x110b732e
mov byte [ebp - 0x50], 0
test ebx, ebx
je 0x110b72ce
mov eax, esi
mov dword [ebp - 0x5664], eax
fild dword [ebp - 0x5664]
test eax, eax
jns 0x110b729d
fadd qword [0x111a93d0]
mov ecx, ebx
mov dword [ebp - 0x5664], ecx
fild dword [ebp - 0x5664]
test ecx, ecx
jns 0x110b72b5
fadd qword [0x111a93d0]
fdivp st(1)
sub esp, 8
lea edx, [ebp - 0x50]
fstp qword [esp]
push 0x111a93c8
push edx
call fcn.11163f93
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x5640]
mov eax, 0x10624dd3
mul esi
shr edx, 6
push edx
mov eax, 0x10624dd3
mul ebx
mov eax, dword [ebp - 0x56a0]
shr edx, 6
push edx
mov edx, dword [ebp - 0x5618]
push ecx
mov ecx, dword [ebp - 0x5658]
push edx
mov edx, dword [ebp - 0x5668]
push eax
mov eax, dword [ebp - 0x56a8]
push ecx
mov ecx, dword [ebp - 0x5634]
push edx
mov edx, dword [ebp - 0x5638]
push eax
push ecx
push edx
push edi
push 0x111a9340
call fcn.11147060
add esp, 0x34
mov ebx, dword [ebp - 0x55ac]
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x110b7649
cmp byte [ebx + 0x24], al
jne 0x110b7649
cmp dword [ebp + 0x20], eax
jne 0x110b7649
cmp dword [0x111ee0e0], 0xc0003
jne 0x110b7361
xor esi, esi
jmp 0x110b7397
push 0x200e
lea ecx, [ebp - 0x3598]
push 0
push ecx
call fcn.11162be0
mov edx, dword [ebp - 0x56b0]
mov ecx, dword [0x111ee308]
add esp, 0xc
push edx
push 0x200e
lea eax, [ebp - 0x3598]
push eax
call fcn.11100b30
mov esi, eax
xor edi, edi
test esi, esi
je 0x110b73f0
push 0x200e
lea ecx, [ebp - 0x55a8]
push ecx
lea edx, [ebp - 0x3598]
push edx
call fcn.11168345
add esp, 0xc
test eax, eax
je 0x110b73f0
lea eax, [ebp - 0x3598]
push eax
mov ecx, ebx
call fcn.110b4010
push 0x200e
lea ecx, [ebp - 0x3598]
push ecx
lea edx, [ebp - 0x55a8]
push edx
mov edi, 1
mov dword [ebp - 0x56b0], esi
call fcn.11162c60
add esp, 0xc
cmp byte [ebx + 0x79e], 0
mov esi, dword [ebp - 0x5618]
je 0x110b741d
push 0
mov ecx, ebx
call fcn.110b42f0
push esi
push 0x111a931c
mov byte [ebx + 0x79e], 0
call fcn.11147060
add esp, 8
test esi, esi
jne 0x110b742d
test edi, edi
jne 0x110b7437
inc dword [ebp - 0x563c]
jmp 0x110b7444
mov dword [ebp - 0x563c], 0
push 1
push 0
push 0
mov ecx, ebx
call fcn.110b3ce0
cmp byte [ebx + 0x25], 0
je 0x110b7463
lea eax, [ebp - 0x5714]
push eax
lea ecx, [ebp - 0x5724]
push ecx
mov ecx, ebx
call fcn.110b39f0
mov byte [ebx + 0x25], 0
mov ecx, dword [ebp + 0x24]
test ecx, ecx
jne 0x110b74a3
mov eax, dword [ebp - 0x5650]
inc eax
mov dword [ebp - 0x5650], eax
cmp eax, 7
jg 0x110b74a3
cmp dword [ebp - 0x563c], 2
jl 0x110b7494
mov edx, ebx
mov ebx, dword [edx + 0x768]
mov esi, edx
jmp 0x110b752c
mov eax, ebx
mov ebx, dword [eax + 0x764]
mov esi, eax
jmp 0x110b752c
cmp dword [ebp - 0x5648], 0
jne 0x110b74b6
mov dword [ebp - 0x5648], 1
inc dword [ebp - 0x56b8]
cmp dword [ebp - 0x563c], 2
mov dword [ebp - 0x5650], 0
jl 0x110b74d9
mov esi, ebx
mov ebx, dword [esi + 0x768]
jmp 0x110b74e3
mov edx, ebx
mov ebx, dword [edx + 0x764]
mov esi, edx
test ecx, ecx
je 0x110b752c
mov edi, dword [ebp - 0x5638]
mov eax, dword [ebp - 0x55f8]
mov ecx, dword [ebp - 0x561c]
mov edx, dword [ebp - 0x55c4]
push edi
push eax
push ecx
push edx
push 0x111a92f4
call fcn.11147060
add esp, 0x14
cmp byte [ebp - 0x55f1], 0
je 0x110b7525
cmp edi, 0x50
jb 0x110b7525
mov byte [ebp - 0x55ae], 0
mov dword [ebp + 0x24], 0
cmp dword [esi + 0x28], 0
je 0x110b7542
call dword [sym.imp.WinMM.DlL_timeGetTime]
sub eax, dword [esi + 0x28]
cmp eax, 0x3e8
jb 0x110b7548
add ebx, dword [esi + 0x760]
cmp dword [esi + 0x76c], 0
je 0x110b75d6
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov edi, dword [ebp - 0x55ac]
mov esi, eax
mov eax, dword [ebp - 0x55c8]
push eax
add edi, 0x774
push esi
mov ecx, edi
call fcn.110b46e0
mov ecx, dword [ebp - 0x55ac]
mov edx, dword [ecx + 0x770]
push edx
push esi
mov ecx, edi
call fcn.110b4710
lea eax, [ebp - 0x569c]
push eax
mov ecx, edi
call fcn.110b45c0
mov ecx, dword [ebp - 0x55ac]
sub esi, eax
mov eax, dword [ebp - 0x569c]
je 0x110b75b8
mov edx, dword [ecx + 0x76c]
imul edx, esi
cmp eax, edx
jbe 0x110b75dc
xor edx, edx
div dword [ecx + 0x76c]
sub eax, esi
cmp eax, ebx
jle 0x110b75dc
mov edx, dword [ecx + 0x770]
mov ebx, eax
cmp eax, edx
jbe 0x110b75dc
mov ebx, edx
jmp 0x110b75dc
mov ecx, dword [ebp - 0x55ac]
mov ecx, dword [ecx + 0x794]
test ecx, ecx
je 0x110b75ef
push ecx
call fcn.1108af80
add esp, 4
test ebx, ebx
je 0x110b5950
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov esi, dword [ebp - 0x55ac]
mov eax, dword [esi + 0x20]
push ebx
push eax
call dword [sym.imp.KeRneL32.DLl_WaitForSingleObject]
cmp byte [esi + 0x24], 0
jne 0x110b5950
call dword [sym.imp.WinMM.DlL_timeGetTime]
mov ecx, esi
mov ecx, dword [ecx + 0x28]
test ecx, ecx
je 0x110b5950
sub eax, ecx
cmp eax, 0x32
jae 0x110b5950
mov edx, 0x32
sub edx, eax
push edx
call dword [sym.imp.KeRneL32.DLl_Sleep]
jmp 0x110b5950
mov esi, dword [ebp - 0x5610]
xor edi, edi
cmp esi, edi
je 0x110b7675
mov eax, dword [esi]
cmp eax, edi
je 0x110b7664
push eax
call fcn.11162777
add esp, 4
push esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.11162777
add esp, 4
mov eax, dword [ebx + 0x794]
cmp eax, edi
je 0x110b768e
push eax
call fcn.1108af30
add esp, 4
mov dword [ebx + 0x794], edi
mov eax, dword [ebp - 0x55dc]
push eax
call fcn.11163aa5
mov ecx, dword [ebp - 0x55cc]
push ecx
call fcn.11163aa5
mov edx, dword [ebp - 0x5654]
push edx
call fcn.11163aa5
mov eax, dword [ebp - 0x56c0]
mov ebx, dword [ebp - 0x565c]
mov esi, dword [sym.imp.Gdi32.Dll_SelectObject]
add esp, 0xc
cmp eax, edi
je 0x110b76cf
push eax
push ebx
call esi
mov eax, dword [ebp - 0x56ac]
cmp eax, edi
mov edi, dword [sym.imp.Gdi32.Dll_DeleteObject]
je 0x110b76e2
push eax
call edi
mov eax, dword [ebp - 0x5694]
test eax, eax
je 0x110b76f0
push eax
push ebx
call esi
mov eax, dword [ebp - 0x5678]
test eax, eax
je 0x110b76fd
push eax
call edi
mov eax, dword [ebp - 0x567c]
test eax, eax
je 0x110b770b
push eax
push ebx
call esi
mov eax, dword [ebp - 0x56bc]
test eax, eax
je 0x110b7718
push eax
call edi
mov eax, dword [ebp - 0x5680]
test eax, eax
je 0x110b7726
push eax
push ebx
call esi
mov eax, dword [ebp - 0x56a4]
test eax, eax
je 0x110b7733
push eax
call edi
test ebx, ebx
je 0x110b774a
push ebx
call dword [sym.imp.Gdi32.Dll_DeleteDC]
mov eax, dword [ebp - 0x5688]
mov dword [ebp - 0x55f0], eax
mov edi, dword [ebp - 0x560c]
mov ebx, dword [ebp - 0x55b4]
test edi, edi
je 0x110b776a
push 0
push ebx
call dword [sym.imp.Gdi32.Dll_SelectClipRgn]
push edi
call dword [sym.imp.Gdi32.Dll_DeleteObject]
mov eax, dword [ebp - 0x5600]
test eax, eax
je 0x110b777b
push eax
call dword [sym.imp.Gdi32.Dll_DeleteObject]
mov edi, dword [ebp - 0x562c]
push edi
push ebx
call esi
mov esi, eax
cmp esi, dword [ebp - 0x5614]
je 0x110b77c1
call dword [sym.imp.KeRneL32.DLl_GetLastError]
mov ecx, dword [ebp - 0x5614]
push eax
push ebx
push edi
push ecx
push esi
lea edx, [ebp - 0x118]
push 0x111a92bc
push edx
call dword [sym.imp.uSEr32.dll_wsprintfA]
lea eax, [ebp - 0x118]
push eax
call fcn.11147060
add esp, 0x20
mov eax, dword [ebp - 0x5670]
xor edi, edi
cmp eax, edi
je 0x110b77d6
push edi
push eax
push ebx
call dword [sym.imp.Gdi32.Dll_SelectPalette]
mov eax, dword [ebp - 0x5630]
cmp eax, edi
je 0x110b77e7
push eax
call dword [sym.imp.Gdi32.Dll_DeleteObject]
mov ecx, dword [ebp - 0x5624]
push ecx
call fcn.11163aa5
mov edx, dword [ebp - 0x5614]
add esp, 4
push edx
call dword [sym.imp.Gdi32.Dll_DeleteObject]
mov esi, dword [ebp - 0x55ac]
cmp dword [esi + 0x810], edi
je 0x110b7853
mov eax, dword [esi + 0x7c4]
cmp eax, edi
je 0x110b7828
push eax
call dword [sym.imp.KeRneL32.DLl_UnmapViewOfFile]
mov dword [esi + 0x7c4], edi
mov eax, dword [esi + 0x810]
push eax
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
test eax, eax
jne 0x110b784d
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push 0x111a92a0
call fcn.11147060
add esp, 8
mov dword [esi + 0x810], edi
push ebx
call dword [sym.imp.Gdi32.Dll_DeleteDC]
mov ecx, dword [ebp - 0x55f0]
push ecx
push edi
call dword [sym.imp.uSEr32.dll_ReleaseDC]
mov eax, dword [ebp - 0x56f8]
cmp eax, edi
je 0x110b7879
push eax
call dword [sym.imp.KeRneL32.DLl_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret 0x24