Function at 0x6d1354
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6d3062
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x100], 5
xor edx, edx
push ebp
push 0x6d3034
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x3ad3c], 0
mov byte [ebp - 0xe9], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x3ad40], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x398], edx
xor eax, eax
mov dword [ebp - 0xdc], eax
mov byte [ebp - 0xea], 1
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x3ad4c], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x3ad50], edx
push 0x12c
call sub.kernel32.dll_Sleep_1
xor eax, eax
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x429024]
call fcn.0042afa8
mov dword [ebp - 0x8c], eax
call sub.user32.dll_GetDesktopWindow
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
push eax
call sub.user32.dll_GetWindowDC
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0042b99c
mov eax, dword [ebp - 8]
cmp dword [eax + 0x3adc8], 0
jne 0x6d145c
mov dl, 1
mov eax, dword [0x63d47c]
call fcn.006459ec
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x3adc8], ebx
mov eax, ebx
mov dl, 5
call fcn.00646794
mov eax, dword [ebp - 8]
mov byte [eax + 0x3ae1d], 1
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x3ae38]
mov eax, dword [ebp - 8]
sub edx, dword [eax + 0x3ae30]
inc edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064605c
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x3ae3c]
mov eax, dword [ebp - 8]
sub edx, dword [eax + 0x3ae34]
inc edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064621c
mov eax, dword [ebp - 8]
mov dword [eax + 0x3adc0], 0xffffffff
xor eax, eax
push ebp
push 0x6d1553
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00877180
test al, al
je 0x6d1549
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x3ae34]
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x3ae3c]
sar edx, 1
jns 0x6d14e5
adc edx, 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae30]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x3ae38]
sar eax, 1
jns 0x6d14fe
adc eax, 0
call fcn.00887a18
mov ebx, eax
test ebx, ebx
je 0x6d1549
lea edx, [ebp - 0x134]
mov eax, dword [ebx + 4]
call fcn.0087ed08
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x104]
call fcn.0040aabc
mov edx, dword [ebp - 0x104]
mov eax, 0x6d3078
call fcn.00405138
test eax, eax
jle 0x6d1549
mov eax, dword [ebp - 8]
mov dword [eax + 0x3adc0], 6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d155d
xor eax, eax
mov dword [ebp - 0xd8], eax
xor edi, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b3d0
mov eax, dword [ebp - 0x8c]
call fcn.0042b3d0
push 0xcc0020
mov eax, dword [0x8aa338]
mov eax, dword [eax]
call fcn.0046efdc
mov edx, dword [ebp - 8]
add eax, dword [edx + 0x3ae34]
push eax
mov eax, dword [0x8aa338]
mov eax, dword [eax]
call fcn.0046efe8
mov edx, dword [ebp - 8]
add eax, dword [edx + 0x3ae30]
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 8]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
push eax
mov eax, dword [ebp - 0xd8]
push eax
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 0x8c]
call fcn.0042b7f0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b7f0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
mov dword [ebp - 0xd4], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x3adfc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x3ae08], edx
mov eax, dword [ebp - 8]
mov dword [eax + 0x3adf4], 0xffffffff
mov eax, dword [ebp - 8]
mov dword [eax + 0x3adf8], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
mov dword [ebp - 0xb0], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0xbc], 0xffffffff
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x5c]
cmp eax, 0xc
ja case.default.0x6d16c1
jmp dword [eax*4 + 0x6d16c8]
mov dword [ebp - 0xe0], 0x19
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x32
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x64
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x96
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0xc8
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0xfa
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x12c
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x1f4
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x3e8
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x5dc
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x7d0
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0xbb8
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x1388
jmp 0x6d17ab
mov dword [ebp - 0xe0], 0x32
mov dword [ebp - 0x14], 1
mov byte [ebp - 9], 0
test edi, edi
jne 0x6d17e7
cmp byte [ebp - 0xea], 0
je 0x6d17df
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.006c09e0
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.006c0ba0
jmp 0x6d17e7
mov eax, dword [ebp - 8]
call fcn.006c0d24
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
call fcn.004714e0
cmp byte [ebp - 0xea], 0
jne 0x6d1800
test edi, edi
je 0x6d1824
push ebp
call fcn.006d0fc8
pop ecx
mov eax, dword [ebp - 0xe0]
add eax, 0x96
push eax
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
call fcn.004714e0
mov byte [ebp - 0xea], 0
test edi, edi
jne 0x6d1e9a
xor eax, eax
mov dword [ebp - 0x9c], eax
push 0x32
call sub.kernel32.dll_Sleep_1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.006c09e0
push ebp
call fcn.006d0fc8
pop ecx
mov eax, dword [ebp - 0xe0]
push eax
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
call fcn.004714e0
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.006c0ba0
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], edx
cmp dword [ebp - 0x9c], 0
jg 0x6d1dd1
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0x38], 0xffffffff
or ebx, 0xffffffff
or esi, 0xffffffff
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0xc0], 0xfffe1e47
mov dword [ebp - 0xc4], 0xfffe1e47
mov dword [ebp - 0xc8], 0xfffe1e47
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d190b
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov ebx, eax
cmp ebx, 0xffffffff
jg 0x6d1996
push 0
xor ecx, ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d193a
xor ecx, ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov ebx, eax
cmp ebx, 0xffffffff
jg 0x6d1996
push 0
xor ecx, ecx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1965
xor ecx, ecx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov ebx, eax
cmp ebx, 0xffffffff
jg 0x6d1996
push 0
xor ecx, ecx
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1990
xor ecx, ecx
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov ebx, eax
mov dword [ebp - 0xc0], ebx
push 0
mov ecx, 1
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d19bc
mov ecx, 1
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov esi, eax
cmp esi, 0xffffffff
jg 0x6d1a59
push 0
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d19f1
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov esi, eax
cmp esi, 0xffffffff
jg 0x6d1a59
push 0
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1a22
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov esi, eax
cmp esi, 0xffffffff
jg 0x6d1a59
push 0
mov ecx, 1
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1a53
mov ecx, 1
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov esi, eax
mov dword [ebp - 0xc4], esi
push 0
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1a83
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xffffffff
jg 0x6d1b3e
push 0
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1ac0
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xffffffff
jg 0x6d1b3e
push 0
mov ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1af9
mov ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xffffffff
jg 0x6d1b3e
push 0
mov ecx, 2
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1b32
mov ecx, 2
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc0], 0xfffe1e47
jne 0x6d1b76
push 0
xor ecx, ecx
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1b82
xor ecx, ecx
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov dword [ebp - 0xa8], eax
jmp 0x6d1b82
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffff
jg 0x6d1c2c
cmp dword [ebp - 0xc4], 0xfffe1e47
jne 0x6d1bcd
push 0
mov ecx, 1
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1bd9
mov ecx, 1
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov dword [ebp - 0xa8], eax
jmp 0x6d1bd9
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffff
jg 0x6d1c2c
cmp dword [ebp - 0xc8], 0xfffe1e47
jne 0x6d1c20
push 0
mov ecx, 2
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c166c
test al, al
je 0x6d1c2c
mov ecx, 2
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.006c1ac4
mov dword [ebp - 0xa8], eax
jmp 0x6d1c2c
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xa8], eax
mov edx, esi
mov eax, ebx
call fcn.004326fc
mov edx, dword [ebp - 0xa4]
call fcn.004326fc
mov edx, dword [ebp - 0xa8]
call fcn.004326fc
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0xfc], eax
xor ebx, ebx
lea esi, [ebp - 0x30]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.006c22b8
add dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0x3c]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.006c2888
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, 5
jne 0x6d1c5b
mov dword [ebp - 0x1c], 0xffffffff
push ebp
xor eax, eax
call fcn.006d11f0
pop ecx
mov dword [ebp - 0x34], eax
xor ebx, ebx
lea esi, [ebp - 0x30]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.006c336c
add dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0x3c]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.006c37e8
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, 5
jne 0x6d1c9b
mov dword [ebp - 0x1c], 0xffffffff
push ebp
mov al, 1
call fcn.006d11f0
pop ecx
mov ebx, eax
cmp dword [ebp - 0xfc], 0
jne 0x6d1cea
mov dword [ebp - 0x100], 0x14
jmp 0x6d1d02
cmp dword [ebp - 0x100], 5
jle 0x6d1d02
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x100], 5
cmp dword [ebp - 0x38], 0
jle 0x6d1d23
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x34]
jl 0x6d1d23
cmp ebx, dword [ebp - 0x38]
jg 0x6d1d23
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x9c], eax
jmp 0x6d1dd1
cmp dword [ebp - 0x38], 1
jle 0x6d1db7
cmp dword [ebp - 0x34], 1
jle 0x6d1db7
cmp ebx, 1
jle 0x6d1db7
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x34]
cdq
xor eax, edx
sub eax, edx
dec eax
jg 0x6d1d5d
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
call fcn.004326fc
mov dword [ebp - 0x9c], eax
jmp 0x6d1dd1
mov eax, dword [ebp - 0x38]
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
dec eax
jg 0x6d1d7c
mov edx, ebx
mov eax, dword [ebp - 0x38]
call fcn.004326fc
mov dword [ebp - 0x9c], eax
jmp 0x6d1dd1
mov eax, dword [ebp - 0x34]
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
dec eax
jg 0x6d1d9b
mov edx, ebx
mov eax, dword [ebp - 0x34]
call fcn.004326fc
mov dword [ebp - 0x9c], eax
jmp 0x6d1dd1
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
call fcn.004326fc
mov edx, eax
mov eax, ebx
call fcn.004326fc
mov dword [ebp - 0x9c], eax
jmp 0x6d1dd1
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
call fcn.004326fc
mov edx, eax
mov eax, ebx
call fcn.004326fc
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jle 0x6d1e3e
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x6d1e11
mov eax, dword [ebp - 0x9c]
add dword [ebp - 0xb0], eax
inc dword [ebp - 0xb4]
fild dword [ebp - 0xb0]
fmul dword [0x6d3094]
fild dword [ebp - 0xb4]
fdivp st(1)
call fcn.00402f88
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x3ad3c], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x9c]
mov dword [eax + 0x3adfc], edx
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x10]
jle 0x6d1e3e
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetTickCount
xor edx, edx
sub eax, dword [ebp - 0xf8]
sbb edx, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], edx
cmp dword [ebp - 0xf4], 0
jne 0x6d1e71
cmp dword [ebp - 0xf8], 0
jbe 0x6d1e9a
jmp 0x6d1e73
jle 0x6d1e9a
cmp dword [ebp - 0xf4], 0
jne 0x6d1e87
cmp dword [ebp - 0xf8], 0x32
jae 0x6d1e9a
jmp 0x6d1e89
jge 0x6d1e9a
mov eax, 0x32
sub eax, dword [ebp - 0xf8]
push eax
call sub.kernel32.dll_Sleep_1
cmp dword [ebp - 0x9c], 0
jle 0x6d244a
test edi, edi
jne 0x6d1ed7
cmp dword [ebp - 4], 3
jle 0x6d1ed7
mov eax, 1
call fcn.00889844
cmp eax, dword [ebp - 0x9c]
jl 0x6d1ed7
mov eax, 2
call fcn.00889844
cmp eax, dword [ebp - 0x10]
jge 0x6d1ed7
inc dword [ebp - 0x18]
jmp 0x6d1edc
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x9c]
add dword [ebp - 0xd8], eax
test edi, edi
jne 0x6d1f0b
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x3adc8]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 8]
mov edx, eax
add edx, dword [ebp - 0x9c]
mov eax, ebx
call fcn.0064621c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b3d0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b3d0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x578
jl 0x6d1fc2
push 0xcc0020
push 0x258
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x258
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
cmp eax, 0x4b0
jl 0x6d2041
push 0xcc0020
push 0x1f4
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x1f4
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
cmp eax, 0x3e8
jl 0x6d20c0
push 0xcc0020
push 0x1c2
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x1c2
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
cmp eax, 0x320
jl 0x6d213f
push 0xcc0020
push 0x190
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x190
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
cmp eax, 0x2bc
jl 0x6d21be
push 0xcc0020
push 0x15e
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x15e
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
cmp eax, 0x258
jl 0x6d223d
push 0xcc0020
push 0x12c
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x12c
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
cmp eax, 0x1f4
jl 0x6d22bc
push 0xcc0020
push 0xfa
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0xfa
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
cmp eax, 0x12c
jl 0x6d233b
push 0xcc0020
push 0x96
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x96
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
cmp eax, 0x96
jl 0x6d23b2
push 0xcc0020
push 0x32
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x1e
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x32
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2420
push 0xcc0020
push 0x1e
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, 0x14
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x1e
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b7f0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b7f0
test edi, edi
jmp 0x6d244d
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x100]
jl 0x6d29c2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b3d0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b3d0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x578
jl 0x6d2526
push 0xcc0020
push 0x258
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x258
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x258
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d299c
cmp eax, 0x4b0
jl 0x6d25b8
push 0xcc0020
push 0x1f4
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x1f4
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x1f4
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d299c
cmp eax, 0x3e8
jl 0x6d264a
push 0xcc0020
push 0x1c2
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x1c2
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x1c2
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d299c
cmp eax, 0x320
jl 0x6d26dc
push 0xcc0020
push 0x190
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x190
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x190
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d299c
cmp eax, 0x2bc
jl 0x6d276e
push 0xcc0020
push 0x15e
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x15e
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x15e
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d299c
cmp eax, 0x258
jl 0x6d2800
push 0xcc0020
push 0x12c
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x12c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x12c
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d299c
cmp eax, 0x1f4
jl 0x6d2892
push 0xcc0020
push 0xfa
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0xfa
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0xfa
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d299c
cmp eax, 0x12c
jl 0x6d2921
push 0xcc0020
push 0x96
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x96
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x96
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d299c
push 0xcc0020
push 0x32
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x32
push eax
mov eax, dword [ebp - 0xdc]
add eax, edi
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b7f0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b7f0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x100]
jge 0x6d29dd
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3ade8], 0
je 0x6d17b6
xor eax, eax
push ebp
push 0x6d2fd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3ade8], 0
je 0x6d2fcd
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b3d0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b3d0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x578
jl 0x6d2ac3
push 0xcc0020
push 0x258
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x258
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x258
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2fa7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x4b0
jl 0x6d2b65
push 0xcc0020
push 0x1f4
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x1f4
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x1f4
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2fa7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x3e8
jl 0x6d2c07
push 0xcc0020
push 0x1c2
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x1c2
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x1c2
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2fa7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x320
jl 0x6d2ca9
push 0xcc0020
push 0x190
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x190
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x190
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2fa7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x2bc
jl 0x6d2d4b
push 0xcc0020
push 0x15e
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x15e
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x15e
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2fa7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x258
jl 0x6d2ded
push 0xcc0020
push 0x12c
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x12c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x12c
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2fa7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x1f4
jl 0x6d2e8f
push 0xcc0020
push 0xfa
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0xfa
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0xfa
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2fa7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
cmp eax, 0x12c
jl 0x6d2f2e
push 0xcc0020
push 0x96
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x96
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x96
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
jmp 0x6d2fa7
push 0xcc0020
push 0x32
mov eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b91c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ae3c]
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3ae34]
sub eax, 0x32
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
mov edx, dword [eax]
call dword [edx + 0xc]
sub eax, edi
sub eax, dword [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xd8]
add eax, 0x32
push eax
add edi, dword [ebp - 0xdc]
push edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b91c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x388]
call fcn.0043040c
call fcn.0042b7f0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3adc8]
call fcn.0064b924
call fcn.0042b7f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d2fe1
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x3ad98]
test ebx, ebx
je 0x6d3000
cmp byte [ebx + 0x57], 0
je 0x6d3000
mov eax, ebx
call fcn.00455b24
call fcn.008775a4
push 0
call sub.user32.dll_ClipCursor
mov eax, dword [ebp - 0x8c]
call fcn.0042b91c
push eax
mov eax, dword [ebp - 0xe4]
push eax
call sub.user32.dll_ReleaseDC
lea eax, [ebp - 0x8c]
call fcn.00411378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d303e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d3069
lea eax, [ebp - 0x134]
call fcn.00404b34
lea eax, [ebp - 0x104]
call fcn.00404b34
ret