Function at 0x43c980
Capabilities:
Capture screenshot
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xe0e8]
mov dword [esi + 0x84], 0
test eax, eax
je 0x43cb8d
cmp dword [eax + 8], 0
jne 0x43c9cf
mov dword [esi + 0xe118], 1
mov dword [esi + 0xe11c], 1
jmp 0x43cb8d
push 0x9c
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.004b67a0
add esp, 0xc
mov dword [ebp - 0x84], 0x9c
lea eax, [ebp - 0xa8]
push eax
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
push str.USER32
mov dword [ebp - 0x80], 0x1c0000
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x264], eax
test eax, eax
je 0x43cb8d
push str.EnumDisplayDevicesA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x43cb81
push 0x1a8
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.004b67a0
add esp, 0xc
mov dword [ebp - 0x250], 0x1a8
xor edi, edi
mov byte [ebp - 0xa8], 0
lea eax, [ebp - 0x250]
push edi
push eax
push edi
push edi
call ebx
test eax, eax
je 0x43cb81
mov ecx, str.mv_video_hook_driver2
lea eax, [ebp - 0x22c]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43caa0
test dl, dl
je 0x43ca9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43caa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x43ca80
xor eax, eax
jmp 0x43caa5
sbb eax, eax
or eax, 1
test eax, eax
je 0x43cac1
push 0
lea eax, [ebp - 0x250]
inc edi
push eax
push edi
push 0
call ebx
test eax, eax
jne 0x43ca73
jmp 0x43cb81
mov eax, dword [esi + 0xdc10]
test eax, eax
je 0x43cb01
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test eax, eax
jne 0x43caeb
push str.vncdesktop.cpp_:_failed_to_DeleteDC_hrootdc_n
push eax
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
push dword [esi + 0xdc10]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0xdc10], 0
push 0
push 0
lea eax, [ebp - 0x24c]
push eax
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [esi + 0xdc10], eax
lea eax, [ebp - 0xa8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
cmp dword [esi + 0xdc10], 0
mov eax, dword [ebp - 0x7c]
mov dword [esi + 0x74], eax
mov eax, dword [ebp - 0x78]
mov dword [esi + 0x78], eax
je 0x43cb52
mov dword [esi + 0x84], 1
mov ecx, esi
call fcn.0045ef60
cmp dword [esi + 0x14], 0
mov byte [esi + 0xe27c], 0
sete al
mov byte [esi + 0xe27d], al
test al, al
je 0x43cb81
cmp dword [esi + 0xe278], 1
jle 0x43cb81
mov byte [esi + 0xe27c], 1
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esi + 0xdbf4]
mov eax, dword [ecx]
call dword [eax + 0x70]
test eax, eax
je 0x43cbae
cmp dword [esi + 0x6c], 0
jne 0x43cbae
push esi
push 0x43c8e0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esi + 0xdc10], 0
jne 0x43cc39
push str.vncdesktop.cpp_:_No_driver_used__n
push 0
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
mov ecx, esi
call fcn.0045ef60
cmp dword [esi + 0x14], 0
mov byte [esi + 0xe27c], 0
sete al
mov byte [esi + 0xe27d], al
test al, al
je 0x43cbfe
cmp dword [esi + 0xe278], 1
jle 0x43cbfe
mov byte [esi + 0xe27c], 1
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0xdc10], eax
test eax, eax
jne 0x43cc39
push str.vncdesktop.cpp_:_Failed_m_rootdc__n
push eax
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
mov eax, 6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0xe27c], 0
mov eax, dword [esi + 0xe270]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0xe274]
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0xe244]
mov dword [esi + 0x7c], eax
mov ecx, dword [esi + 0xe248]
mov dword [esi + 0x80], ecx
je 0x43cccb
mov eax, dword [esi + 0xe0e8]
test eax, eax
je 0x43cc8d
cmp dword [eax + 8], 0
jne 0x43cccb
mov dword [esi + 0xe118], 1
mov dword [esi + 0xe11c], 1
mov eax, dword [esi + 0xe244]
mov dword [ebp - 0x258], eax
mov eax, dword [esi + 0xe248]
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x254], eax
movdqu xmm0, xmmword [ebp - 0x260]
movdqu xmmword [esi + 0xdc30], xmm0
jmp 0x43cd41
mov eax, dword [esi + 0xe0e8]
test eax, eax
je 0x43ccf3
cmp dword [eax + 8], 0
jne 0x43cda8
mov dword [esi + 0xe118], 1
mov dword [esi + 0xe11c], 1
mov eax, dword [esi + 0xe1a8]
mov dword [ebp - 0x258], eax
mov eax, dword [esi + 0xe1ac]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
movdqu xmm0, xmmword [ebp - 0x260]
movdqu xmmword [esi + 0xdc30], xmm0
mov eax, dword [esi + 0xe1d4]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0xe1d8]
mov dword [esi + 0x78], eax
push dword [esi + 0xdc3c]
push dword [esi + 0xdc38]
push str.vncdesktop.cpp_:_bitmap_dimensions_are__d_x__d_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0x14
push dword [esi + 0xdc10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0xdc0c], eax
test eax, eax
jne 0x43cdde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.vncdesktop.cpp_:_failed_to_create_compatibleDC__d__n
push 0
push 0x4f6c50
call fcn.00414f90
add esp, 0x10
mov eax, 6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x260], eax
mov eax, dword [esi + 0x78]
mov dword [ebp - 0x25c], eax
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], ecx
movdqu xmm0, xmmword [ebp - 0x260]
movdqu xmmword [esi + 0xdc30], xmm0
jmp 0x43cd41
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x26
push dword [esi + 0xdc10]
call ebx
test al, 1
jne 0x43ce1c
push 0x10
push 0x4e38ec
mov edx, str.vncDesktop_:_root_device_doesnt_support_BitBlt_nWinVNC_cannot_be_used_with_this_graphic_device_driver
call fcn.0041b520
add esp, 8
mov eax, 7
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push 0x26
push dword [esi + 0xdc0c]
call ebx
test al, al
js 0x43ce54
push 0x10
push 0x4e38ec
mov edx, str.vncDesktop_:_memory_device_doesnt_support_GetDIBits_nWinVNC_cannot_be_used_with_this_graphics_device_driver
call fcn.0041b520
add esp, 8
mov eax, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push 1
push 1
push dword [esi + 0xdc10]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0xdc14], eax
test eax, eax
jne 0x43ce9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.vncdesktop.cpp_:_failed_to_create_memory_bitmap__d__n
push 0
push 0x4f6c50
call fcn.00414f90
add esp, 0x10
mov eax, 9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push str.vncdesktop.cpp_:_created_memory_bitmap_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
lea eax, [esi + 0xdc40]
push 0x430
push 0
push eax
call fcn.004b67a0
add esp, 0xc
mov dword [esi + 0xdc44], 0x28
xor eax, eax
lea edi, [esi + 0xdc44]
mov word [esi + 0xdc52], ax
push eax
push edi
push eax
push 1
push eax
push dword [esi + 0xdc14]
push dword [esi + 0xdc0c]
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x43cf27
push str.vncdesktop.cpp_:_unable_to_get_display_format_n
push eax
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
mov eax, 0xa
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push 0
push edi
push 0
push 1
push 0
push dword [esi + 0xdc14]
push dword [esi + 0xdc0c]
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x43cf6f
push str.vncdesktop.cpp_:_unable_to_get_display_colour_info_n
push eax
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
mov eax, 0xa
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push str.vncdesktop.cpp_:_got_bitmap_format_n
push 9
push 0x4f6c50
call fcn.00414f90
mov ecx, dword [esi + 0xdc38]
add esp, 0xc
movzx eax, word [esi + 0xdc52]
mov edi, dword [esi + 0xdc3c]
imul eax, ecx
push 0x26
push dword [esi + 0xdc0c]
mov dword [esi + 0xdc48], ecx
imul eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 0xdc58], eax
mov eax, edi
cdq
xor eax, edx
sub eax, edx
neg eax
mov dword [esi + 0xdc4c], eax
call ebx
shr eax, 8
push 1
not eax
push 0
and eax, 1
push 0
mov dword [esi + 0xdc40], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret