Function at 0x4354a0
Capabilities:
Capture screenshot

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
call esi
mov dword [esp + 0xc], eax
push 0x4d
call esi
mov dword [esp + 8], eax
push 7
push ebx
call dword [sym.imp.GDI32.dll_GetCurrentObject]
mov edi, eax
lea eax, [esp + 0x40]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
push esi
push ebp
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x10], eax
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x28], eax
push 0xcc0020
push dword [esp + 0xc]
push dword [esp + 0x14]
mov dword [esp + 0x24], ebx
push ebx
push esi
push ebp
push 0
push 0
mov dword [esp + 0x34], edi
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [esp + 0x24], ebp
not ebp
mov dword [esp + 0x20], esi
xor esi, 2
and esi, ebp
mov dword [esp + 4], 0xc28ddff7
cmp esi, 0xffffffff
jl case.default.0x435568
mov dword [esp + 4], 0x2af9cea0
mov ecx, 0xc466a681
xor eax, eax
cmp ecx, 0xcdd2eb34
setl al
jmp dword [eax*4 + 0x44c87c]
xor eax, eax
cmp ecx, 0xc28ddff7
setl al
jmp dword [eax*4 + 0x44c8ac]
xor eax, eax
cmp ecx, 0xc466a681
setl al
jmp dword [eax*4 + 0x44c8b4]
sete al
movzx eax, al
jmp dword [eax*4 + 0x44c8bc]
xor eax, eax
mov ecx, dword [esp + 4]
cmp ecx, 0xcdd2eb34
setl al
jmp dword [eax*4 + 0x44c87c]
xor eax, eax
cmp ecx, 0xaf0f796e
sete al
jmp dword [eax*4 + 0x44c8cc]
mov edx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x2c], 0x6e601203
mov dword [esp + 0x30], 0x7f387b71
mov word [esp + 0x34], 0x767e
mov byte [esp + 0x36], 0xea
lea eax, [esp + 0x37]
mov byte [eax + 4], 0
mov dword [eax], 0
mov ecx, 0xac
mov esi, 0x53
nop
nop
movzx edi, byte [esp + ecx - 0x80]
mov ebx, ecx
xor ebx, esi
and ebx, edi
xor ebx, esi
mov al, 0xa3
sub al, bl
mov byte [esp + ecx - 0x80], al
inc ecx
dec esi
cmp ecx, 0xbc
jne 0x435610
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x6c]
push edx
push ebp
push eax
call fcn.0040d050
mov ebx, eax
mov esi, dword [esp + 0x1c]
mov ecx, 0x5ab02a5
test esi, esi
je 0x435653
mov ecx, 0xcdd2eb34
xor eax, eax
cmp ecx, 0xcdd2eb34
setl al
mov edx, ebx
mov byte [esp + 3], bl
jmp dword [eax*4 + 0x44c87c]
xor eax, eax
cmp ecx, 0xc28ddff7
sete al
jmp dword [eax*4 + 0x44c8c4]
push 0xcc0020
push dword [esp + 0xc]
push dword [esp + 0x14]
push 0
push 0
push dword [esp + 0x2c]
push dword [esp + 0x38]
push dword [esp + 0x40]
push 0
push 0
push dword [esp + 0x3c]
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, 0x2af9cea0
xor eax, eax
cmp ecx, 0xcdd2eb34
setl al
jmp dword [eax*4 + 0x44c87c]
xor eax, eax
cmp ecx, 0x5ab02a5
setl al
jmp dword [eax*4 + 0x44c884]
xor eax, eax
cmp ecx, 0x2af9cea0
setl al
jmp dword [eax*4 + 0x44c88c]
sete al
movzx eax, al
jmp dword [eax*4 + 0x44c894]
mov ebx, dword [esp + 0x28]
push ebx
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0x18]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x1c]
push eax
push ecx
push dword [esp + 0x18]
call fcn.004357f0
add esp, 0xc
mov ecx, 0xaf0f796e
test al, al
jne 0x43574f
mov ecx, 0x5ab02a5
xor ebx, ebx
xor eax, eax
cmp ecx, 0xcdd2eb34
setl al
jmp dword [eax*4 + 0x44c87c]
xor eax, eax
cmp ecx, 0xcdd2eb34
sete al
jmp dword [eax*4 + 0x44c8a4]
push esi
call fcn.0040c570
add esp, 4
mov ecx, 0x5ab02a5
xor eax, eax
cmp ecx, 0xcdd2eb34
setl al
movzx edx, byte [esp + 3]
mov ebx, edx
jmp dword [eax*4 + 0x44c87c]
xor eax, eax
cmp ecx, 0x5ab02a5
sete al
jmp dword [eax*4 + 0x44c89c]
xor eax, eax
cmp ecx, 0xcdd2eb34
setl al
jmp dword [eax*4 + 0x44c87c]
push dword [esp + 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
and bl, 1
mov eax, ebx
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
sub eax, 0x1c790d23
sete cl
mov dword [ebp - 0x334], ecx
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x334]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xe6b6fa88
setl cl
mov dword [ebp - 0x324], ecx
mov ecx, dword [ebp - 0x328]
mov edx, dword [ebp - 0x324]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [ebp - 0x28]
sub esp, 4
mov dword [esp], eax
call fcn.0040c570
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xc2c38419
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0xc2c38419
sete cl
mov dword [ebp - 0x264], ecx
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x264]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xc0b12d08
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x90807c0c
sete cl
mov dword [ebp - 0x1a4], ecx
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xa2d8ba3b
sete cl
mov dword [ebp - 0x1e4], ecx
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xbcfb4afd
sete cl
mov dword [ebp - 0x24c], ecx
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x24c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xd9966ec3
sete cl
mov dword [ebp - 0x2ac], ecx
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x2ac]
mov eax, dword [eax + ecx*4]
jmp eax
or al, 0x46
enter 0x5252, 0x49
jno 0x435f6b
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x29466f80
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x80]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x92890ad6
sete cl
mov dword [ebp - 0x1c4], ecx
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x30573414
setl cl
mov dword [ebp - 0x3bc], ecx
mov ecx, dword [ebp - 0x3c0]
mov edx, dword [ebp - 0x3bc]
mov ecx, dword [ecx + edx*4]
jmp ecx
inc esp
cld
invalid
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x90807c0c
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x100]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
mov eax, dword [ebp - 0x4c]
mov ecx, eax
and ecx, 0xff00ff00
mov edx, eax
xor edx, 0xff000000
and edx, eax
shr edx, 0x10
or ecx, edx
mov dword [ebp - 0x3dc], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xcda86b63
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x108]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xf9ec9c7
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x138]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x1832690
sete cl
mov dword [ebp - 0x2fc], ecx
mov eax, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x2fc]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xae3886d0
sete cl
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x1832690
setl cl
mov dword [ebp - 0x314], ecx
mov ecx, dword [ebp - 0x318]
mov edx, dword [ebp - 0x314]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xab8f46d8
sete cl
mov dword [ebp - 0x1ec], ecx
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov al, byte [ebp - 0x17]
and al, 1
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xe3b05736
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xa2d8ba3b
setl cl
mov dword [ebp - 0x1fc], ecx
mov ecx, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1fc]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x90b21b0f
setl cl
mov dword [ebp - 0x1b4], ecx
mov ecx, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0x1b4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x200828a4
sete cl
mov dword [ebp - 0x344], ecx
mov eax, dword [ebp - 0x348]
mov ecx, dword [ebp - 0x344]
mov eax, dword [eax + ecx*4]
jmp eax
mov al, byte [ebp - 0x19]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
mov edx, eax
sub edx, 0xab8f46d8
setl cl
mov dword [ebp - 0x1f4], ecx
mov ecx, dword [ebp - 0x1f8]
mov edx, dword [ebp - 0x1f4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0xbc75f598
setl cl
mov dword [ebp - 0x23c], ecx
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x31179878
sete cl
mov dword [ebp - 0x37c], ecx
mov eax, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x37c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xee037a30
setl cl
mov dword [ebp - 0x2ec], ecx
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ebp - 0x2ec]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x29466f80
setl cl
mov dword [ebp - 0x35c], ecx
mov ecx, dword [ebp - 0x360]
mov edx, dword [ebp - 0x35c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xcaa13359
sete cl
mov dword [ebp - 0x26c], ecx
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x26c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0x30573414
sete cl
mov dword [ebp - 0x374], ecx
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 0x374]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0x7c50f45
sete cl
mov dword [ebp - 0x304], ecx
mov eax, dword [ebp - 0x308]
mov ecx, dword [ebp - 0x304]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [ebp - 0x4c]
mov ecx, eax
xor ecx, 0xff00
or eax, 0xff
and eax, ecx
shl eax, 0x10
mov ecx, dword [ebp - 0x3dc]
or ecx, eax
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x34]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0x99bfc926
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xf8]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0xd7d59bfd
sete cl
mov dword [ebp - 0x2a4], ecx
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a4]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x30], eax
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x14], eax
push eax
mov eax, esp
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
sub esp, 0xc
mov dword [esp + 8], eax
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], 0x18
mov eax, dword [sym.imp.GDI32.dll_GetObjectW]
call eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x28
mov eax, dword [ebp - 0x30]
add eax, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x30]
add eax, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x14]
mov word [eax + 0xc], 1
mov eax, dword [ebp - 0x30]
mov cx, word [eax + 0x12]
mov eax, dword [ebp - 0x14]
mov word [eax + 0xe], cx
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x18], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x20], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 0
movzx ecx, word [eax + 0xe]
shr ecx, 3
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
imul eax, edx
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov esi, ecx
not esi
mov edi, eax
and edi, esi
mov edx, eax
or edx, esi
not edx
imul edx, edi
mov esi, eax
and esi, ecx
or eax, ecx
imul eax, esi
add eax, edx
sub esp, 4
mov dword [esp], eax
call fcn.0040c560
add esp, 4
mov dword [ebp - 0x28], eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x54]
sub esp, 0x1c
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 8], 0
mov eax, dword [sym.imp.GDI32.dll_GetDIBits]
call eax
test eax, eax
setne byte [ebp - 0x1b]
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xe3532f2d
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x178]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x3ea001
sete cl
mov dword [ebp - 0x2f4], ecx
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x2f4]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xa2d8ba3b
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xe3532f2d
setl cl
mov dword [ebp - 0x2d4], ecx
mov ecx, dword [ebp - 0x2d8]
mov edx, dword [ebp - 0x2d4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x556bb1ad
sete cl
mov dword [ebp - 0x394], ecx
mov eax, dword [ebp - 0x398]
mov ecx, dword [ebp - 0x394]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xbc75f598
sete cl
mov dword [ebp - 0x234], ecx
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov eax, dword [eax + ecx*4]
jmp eax
push 0xffffffffffffffc9
lea ecx, [ebx + 0xc7f045]
invalid
mov eax, dword [ebp - 0x38]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0x31179878
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xb9c9b0e7
setl cl
mov dword [ebp - 0x244], ecx
mov ecx, dword [ebp - 0x248]
mov edx, dword [ebp - 0x244]
mov ecx, dword [ecx + edx*4]
jmp ecx
call fcn.0040dd20
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
setl byte [ebp - 0x1a]
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xb1abd59c
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x130]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x7c50f45
setl cl
mov dword [ebp - 0x30c], ecx
mov ecx, dword [ebp - 0x310]
mov edx, dword [ebp - 0x30c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x93d27f63
sete cl
mov dword [ebp - 0x1cc], ecx
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0x1cc]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xe3b05736
setl cl
mov dword [ebp - 0x2cc], ecx
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [ebp - 0x2cc]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0xc0b12d08
setl cl
mov dword [ebp - 0x25c], ecx
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x25c]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x7c50f45
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ecx + eax*4]
jmp eax
salc
fild word [eax - 0x52]
cmc
pop ds
les edx, [eax - 0x75]
inc ebp
aam 0x8b
add byte [ebx + 0x189104d], cl
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xae3886d0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x85fa6ef3
setl cl
mov dword [ebp - 0x19c], ecx
mov ecx, dword [ebp - 0x1a0]
mov edx, dword [ebp - 0x19c]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x3ea001
mov byte [ebp - 0x16], 1
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, byte [ebp - 0x1b]
test al, al
mov eax, 0x92890ad6
jne 0x436695
mov eax, 0x85fa6ef3
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x170]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0xf9ec9c7
sete cl
mov dword [ebp - 0x32c], ecx
mov eax, dword [ebp - 0x330]
mov ecx, dword [ebp - 0x32c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xee037a30
sete cl
mov dword [ebp - 0x2e4], ecx
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x2e4]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0x85fa6ef3
sete cl
mov dword [ebp - 0x194], ecx
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x194]
mov eax, dword [eax + ecx*4]
jmp eax
mov al, byte [ebp - 0x16]
mov byte [ebp - 0x18], al
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xc0b12d08
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x31179878
setl cl
mov dword [ebp - 0x384], ecx
mov ecx, dword [ebp - 0x388]
mov edx, dword [ebp - 0x384]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0xcda86b63
setl cl
mov dword [ebp - 0x27c], ecx
mov ecx, dword [ebp - 0x280]
mov edx, dword [ebp - 0x27c]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x40]
mov esi, ecx
not esi
mov edi, eax
and edi, esi
mov edx, eax
or edx, esi
not edx
imul edx, edi
mov esi, eax
and esi, ecx
or eax, ecx
imul eax, esi
add eax, edx
mov ecx, dword [ebp - 0x38]
mov edx, eax
not edx
mov esi, ecx
and esi, edx
mov edi, ecx
not edi
mov edx, eax
and edx, edi
imul edx, esi
mov esi, eax
and esi, ecx
or eax, ecx
imul eax, esi
mov ecx, dword [ebp - 0x28]
add ecx, eax
add ecx, edx
mov dword [ebp - 0x3e0], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x99bfc926
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov eax, 0x38c74322
jl 0x436820
mov eax, 0x2261900f
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x150]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x28]
sub esp, 0x1c
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 9
call fcn.004081b0
add esp, 0x1c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
test eax, eax
mov eax, 0xee037a30
jne 0x436894
mov eax, 0x3ea001
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov byte [ebp - 0x16], 0
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x148]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xb1abd59c
setl cl
mov dword [ebp - 0x224], ecx
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x224]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x93d27f63
setl cl
mov dword [ebp - 0x1d4], ecx
mov ecx, dword [ebp - 0x1d8]
mov edx, dword [ebp - 0x1d4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xe3b05736
sete cl
mov dword [ebp - 0x2c4], ecx
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x2c4]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xae3886d0
setl cl
mov dword [ebp - 0x29c], ecx
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ebp - 0x29c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0xc2c38419
setl cl
mov dword [ebp - 0x28c], ecx
mov ecx, dword [ebp - 0x290]
mov edx, dword [ebp - 0x28c]
mov ecx, dword [ecx + edx*4]
jmp ecx
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x7c50f45
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x29466f80
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x110]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x72ca9630
sete cl
mov dword [ebp - 0x39c], ecx
mov eax, dword [ebp - 0x3a0]
mov ecx, dword [ebp - 0x39c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x2261900f
setl cl
mov dword [ebp - 0x364], ecx
mov ecx, dword [ebp - 0x368]
mov edx, dword [ebp - 0x364]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xe6b6fa88
sete cl
mov dword [ebp - 0x2dc], ecx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x2dc]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x85fa6ef3
mov al, byte [ebp - 0x18]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x29466f80
sete cl
mov dword [ebp - 0x354], ecx
mov eax, dword [ebp - 0x358]
mov ecx, dword [ebp - 0x354]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x556bb1ad
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xbc75f598
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x168]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x188]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x38c74322
setl cl
mov dword [ebp - 0x3b4], ecx
mov ecx, dword [ebp - 0x3b8]
mov edx, dword [ebp - 0x3b4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xb1abd59c
sete cl
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x21c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x92890ad6
setl cl
mov dword [ebp - 0x20c], ecx
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x20c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0xd9966ec3
setl cl
mov dword [ebp - 0x2b4], ecx
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ebp - 0x2b4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x1c790d23
setl cl
mov dword [ebp - 0x33c], ecx
mov ecx, dword [ebp - 0x340]
mov edx, dword [ebp - 0x33c]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov al, byte [ebp - 0x15]
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x54]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_ReleaseDC]
call eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xab8f46d8
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x8323d939
sete cl
mov dword [ebp - 0x18c], ecx
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x18c]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [ebp - 0x34]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xd7d59bfd
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x118]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xe6b6fa88
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x31179878
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x158]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x99bfc926
setl cl
mov dword [ebp - 0x204], ecx
mov ecx, dword [ebp - 0x208]
mov edx, dword [ebp - 0x204]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xe3532f2d
sete cl
mov dword [ebp - 0x2bc], ecx
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0x2bc]
mov eax, dword [eax + ecx*4]
jmp eax
mov al, byte [ebp - 0x1a]
test al, al
mov eax, 0x90b21b0f
jne 0x436c76
mov eax, 0x72ca9630
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x128]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xbcfb4afd
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
sub eax, 0x99bfc926
sete cl
mov dword [ebp - 0x1dc], ecx
mov eax, dword [ebp - 0x1e0]
mov ecx, dword [ebp - 0x1dc]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x556bb1ad
setl cl
mov dword [ebp - 0x3ac], ecx
mov ecx, dword [ebp - 0x3b0]
mov edx, dword [ebp - 0x3ac]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0x90807c0c
setl cl
mov dword [ebp - 0x1bc], ecx
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1bc]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x90b21b0f
sete cl
mov dword [ebp - 0x1ac], ecx
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x72ca9630
setl cl
mov dword [ebp - 0x3a4], ecx
mov ecx, dword [ebp - 0x3a8]
mov edx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x2261900f
sete cl
mov dword [ebp - 0x34c], ecx
mov eax, dword [ebp - 0x350]
mov ecx, dword [ebp - 0x34c]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
sub eax, 0xcda86b63
sete cl
mov dword [ebp - 0x274], ecx
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x274]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xae3886d0
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x200828a4
setl cl
mov dword [ebp - 0x36c], ecx
mov ecx, dword [ebp - 0x370]
mov edx, dword [ebp - 0x36c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 0xcaa13359
setl cl
mov dword [ebp - 0x284], ecx
mov ecx, dword [ebp - 0x288]
mov edx, dword [ebp - 0x284]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xb9c9b0e7
sete cl
mov dword [ebp - 0x22c], ecx
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x22c]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x30573414
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x180]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xf9ec9c7
setl cl
mov dword [ebp - 0x3c4], ecx
mov ecx, dword [ebp - 0x3c8]
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0xc0b12d08
sete cl
mov dword [ebp - 0x254], ecx
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x254]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0x3ea001
setl cl
mov dword [ebp - 0x31c], ecx
mov ecx, dword [ebp - 0x320]
mov edx, dword [ebp - 0x31c]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
sub eax, 0x38c74322
sete cl
mov dword [ebp - 0x38c], ecx
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp - 0x38c]
mov eax, dword [eax + ecx*4]
jmp eax
push eax
sub esp, 0x14
mov ebx, esp
sub esp, 0x28
mov edi, esp
push eax
sub esp, 0xc
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], 0x18
mov eax, dword [sym.imp.GDI32.dll_GetObjectW]
call eax
mov dword [edi], 0x28
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
neg eax
mov dword [edi + 8], eax
mov word [edi + 0xc], 1
mov ax, word [ebx + 0x12]
mov word [edi + 0xe], ax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
movzx eax, word [edi + 0xe]
shr eax, 3
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
imul ecx, edx
imul ecx, eax
sub esp, 4
mov dword [esp], ecx
call fcn.0040c560
add esp, 4
mov esi, eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
mov ecx, dword [ebx + 8]
sub esp, 0x1c
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 8], 0
mov eax, dword [sym.imp.GDI32.dll_GetDIBits]
call eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x30573414
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x98]
mov eax, dword [ecx + eax*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 0xbcfb4afd
setl cl
mov dword [ebp - 0x294], ecx
mov ecx, dword [ebp - 0x298]
mov edx, dword [ebp - 0x294]
mov ecx, dword [ecx + edx*4]
jmp ecx
ret