Function at 0x403110
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x28], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
lea eax, [esp + 0x38]
push eax
push esi
mov dword [esp + 0x38], esi
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [esp + 0x28], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push ecx
push edx
push esi
mov ebp, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xcc0020
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x48]
push edi
push edi
push esi
push eax
push ecx
push edi
push edi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov esi, dword [esp + 0x40]
lea ecx, [esi + esi*2]
shl ecx, 3
lea eax, [ecx + 0x1f]
and al, 0xe0
cdq
and edx, 7
add eax, edx
mov ebx, eax
mov eax, ecx
cdq
and edx, 7
mov ecx, esi
add eax, edx
xor edx, edx
sar ebx, 3
sar eax, 3
mov dword [esp + 0x14], edx
sub ebx, eax
mov dword [esp + 0x18], edx
mov word [esp + 0x1a], di
mov dword [esp + 0x1c], edx
lea eax, [ebx + esi*2]
mov word [esp + 0x20], dx
mov edx, dword [esp + 0x44]
add ecx, eax
mov word [esp + 0x1c], di
imul ecx, edx
add ecx, 0x36
xor eax, eax
mov dword [esp + 0x16], ecx
mov ecx, 0xa
lea edi, [esp + 0x48]
mov word [esp + 0x14], 0x4d42
rep stosd dword es:[edi], eax
mov dword [esp + 0x1e], 0x36
mov dword [esp + 0x48], 0x28
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], edx
lea edx, [esp + 0x70]
push eax
push edx
push eax
push 1
mov dword [esp + 0x68], eax
mov ecx, 0xa
lea esi, [esp + 0x58]
lea edi, [esp + 0x80]
push eax
mov eax, dword [esp + 0x24]
mov word [esp + 0x68], 1
mov word [esp + 0x6a], 0x18
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.GDI32.dll_GetDIBits]
push eax
push ebp
call edi
mov eax, dword [esp + 0x4c]
lea ecx, [ebx + eax*2]
add eax, ecx
mov ecx, dword [esp + 0x50]
mov esi, eax
mov dword [esp + 0x34], ecx
imul esi, ecx
push esi
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0x70]
mov ebx, eax
mov eax, dword [esp + 0x34]
push 0
push edx
push ebx
push eax
push 0
push ecx
push ebp
call edi
mov edi, dword [esp + 0xa0]
test edi, edi
je 0x4032be
push edi
push 1
lea edx, [esp + 0x1c]
push 0xe
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
lea eax, [esp + 0x60]
push 0x28
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x30
jmp 0x403312
mov ecx, dword [esp + 0x28]
push 0x40c068
mov eax, dword [ecx + 0x1f4c]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x403312
push edi
push 1
lea edx, [esp + 0x1c]
push 0xe
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
lea eax, [esp + 0x60]
push 0x28
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x34
push ebx
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x30]
add esp, 4
push ecx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8c
ret 4