Function at 0x403b30
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
lea eax, [esp + 0x38]
push eax
push esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push ecx
push edx
push esi
mov ebx, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xcc0020
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x48]
push edi
push edi
push esi
push eax
push ecx
push edi
push edi
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ebp, dword [esp + 0x40]
lea ecx, [ebp + ebp*2]
shl ecx, 3
lea eax, [ecx + 0x1f]
and al, 0xe0
cdq
and edx, 7
add eax, edx
mov esi, eax
mov eax, ecx
cdq
and edx, 7
mov ecx, ebp
add eax, edx
xor edx, edx
sar esi, 3
sar eax, 3
mov dword [esp + 0x28], edx
sub esi, eax
mov dword [esp + 0x2c], edx
mov word [esp + 0x2e], di
mov dword [esp + 0x30], edx
lea eax, [esi + ebp*2]
mov word [esp + 0x34], dx
mov edx, dword [esp + 0x44]
add ecx, eax
mov word [esp + 0x30], di
imul ecx, edx
add ecx, 0x36
xor eax, eax
mov dword [esp + 0x2a], ecx
mov ecx, 0xb
lea edi, [esp + 0x48]
mov word [esp + 0x28], 0x4d42
rep stosd dword es:[edi], eax
mov dword [esp + 0x32], 0x36
mov dword [esp + 0x48], 0x28
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], edx
lea edx, [esp + 0x48]
push eax
mov edi, dword [sym.imp.GDI32.dll_GetDIBits]
push edx
push eax
push 1
mov dword [esp + 0x68], eax
push eax
mov eax, dword [esp + 0x24]
push eax
push ebx
mov word [esp + 0x70], 1
mov word [esp + 0x72], 0x18
call edi
mov eax, dword [esp + 0x4c]
lea ecx, [esi + eax*2]
add eax, ecx
mov ecx, dword [esp + 0x50]
mov esi, eax
mov dword [esp + 0x14], ecx
imul esi, ecx
push esi
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0x48]
mov ebp, eax
mov eax, dword [esp + 0x14]
push 0
push edx
push ebp
push eax
push 0
push ecx
push ebx
call edi
mov edx, dword [esp + 0x18]
push 0x40b144
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x403ce0
push edi
push 1
lea eax, [esp + 0x30]
push 0xe
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
lea ecx, [esp + 0x60]
push 0x28
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
push esi
push ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x34
push ebp
call sub.MFC42.DLL_operatordelete
mov edx, dword [esp + 0x20]
add esp, 4
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x64
ret