Function at 0x4066c0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x28]
push esi
push ebx
sub esp, 0x29c
mov ebx, dword [ebp + 0xc]
call sub.USER32.dll_GetDesktopWindow
mov dword [ebp - 0x260], eax
mov esi, dword [ebp - 0x260]
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.USER32.dll_GetWindowRect
mov ecx, dword [ebp - 0x28]
sub esp, 8
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x260]
sub edx, ecx
sub edi, eax
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x268], edi
mov dword [esp], esi
call sub.USER32.dll_GetDC
mov dword [ebp - 0x26c], eax
sub esp, 4
mov dword [esp], eax
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x270], eax
mov edx, dword [ebp - 0x264]
sub esp, 4
mov ecx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x26c]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.GDI32.dll_CreateCompatibleBitmap
sub esp, 0xc
test eax, eax
mov edx, 0xfffffffe
je 0x4069d2
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x270]
mov edi, 0xcc0020
mov dword [esp], eax
call sub.GDI32.dll_SelectObject
mov edx, dword [ebp - 0x26c]
sub esp, 8
mov esi, dword [ebp - 0x24]
mov dword [esp + 0x20], edi
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x264]
mov dword [esp + 0x14], edx
mov eax, dword [ebp - 0x268]
mov edx, dword [ebp - 0x270]
mov dword [esp + 0x1c], esi
xor esi, esi
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edi
mov edi, 0x1a0
mov dword [esp + 8], esi
mov esi, 0x50
mov dword [esp + 0x10], eax
call sub.GDI32.dll_BitBlt
sub esp, 0x24
lea eax, [ebp - 0x258]
mov dword [esp], eax
call fcn.0040b7dc
mov dword [ebp - 0x1c8], eax
lea ecx, [ebp - 0x1c8]
mov dword [esp], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
call fcn.0040a050
mov eax, dword [ebp + 8]
mov edx, 0x5048a0
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x274], eax
test eax, eax
mov edx, 0xffffffff
je 0x4069d2
mov dword [esp + 4], eax
lea edx, [ebp - 0x1c8]
mov esi, 3
mov dword [esp], edx
call fcn.0040b500
mov dword [ebp - 0x1a4], esi
mov eax, dword [ebp - 0x264]
mov ecx, 2
mov dword [ebp - 0x1a0], ecx
mov edi, dword [ebp - 0x268]
lea edx, [ebp - 0x1c8]
mov dword [esp], edx
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], edi
call fcn.0040ae34
test ebx, ebx
js 0x4069e6
cmp ebx, 0x64
jg 0x4069dc
mov dword [esp + 4], ebx
xor edx, edx
lea eax, [ebp - 0x1c8]
mov dword [esp + 8], edx
mov edi, 1
lea esi, [ebp - 0x1c8]
mov dword [esp], eax
call fcn.0040a920
mov dword [esp + 4], edi
xor edi, edi
mov dword [esp], esi
call fcn.0040a434
mov ecx, dword [ebp - 0x264]
lea ebx, [ecx + ecx*2]
mov dword [esp], ebx
call fcn.004ef170
cmp edi, dword [ebp - 0x268]
mov dword [ebp - 0x25c], eax
jge 0x40696c
lea esi, [esi]
xor esi, esi
cmp esi, dword [ebp - 0x264]
jge 0x40693e
xor ebx, ebx
lea esi, [esi]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x270]
inc esi
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.GDI32.dll_GetPixel
mov ecx, dword [ebp - 0x25c]
sub esp, 0xc
mov byte [ebx + ecx], al
mov edx, dword [ebp - 0x25c]
mov ecx, ebx
add ecx, edx
movzx edx, ah
shr eax, 0x10
mov byte [ecx + 1], dl
mov ecx, dword [ebp - 0x25c]
mov edx, ebx
add ebx, 3
add edx, ecx
mov byte [edx + 2], al
cmp esi, dword [ebp - 0x264]
jl 0x4068f0
mov edx, 1
lea esi, [ebp - 0x25c]
lea ebx, [ebp - 0x1c8]
mov dword [esp + 8], edx
inc edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040a4c0
cmp edi, dword [ebp - 0x268]
jl 0x4068e0
lea edi, [ebp - 0x1c8]
mov dword [esp], edi
call fcn.0040a200
lea edx, [ebp - 0x1c8]
mov dword [esp], edx
call fcn.0040a1a8
mov esi, dword [ebp - 0x25c]
mov dword [esp], esi
call fcn.004ef150
mov ebx, dword [ebp - 0x274]
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call sub.GDI32.dll_DeleteDC
mov ecx, dword [ebp - 0x26c]
sub esp, 4
mov edi, dword [ebp - 0x260]
mov dword [esp + 4], ecx
mov dword [esp], edi
call sub.USER32.dll_ReleaseDC
sub esp, 8
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x64
jmp 0x406889
xor ebx, ebx
jmp 0x406889