Function at 0x10006f70
Capabilities:
Capture screenshot
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x10006f8c
jmp 0x10007201
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x114], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x134], eax
push 8
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x10c], eax
push 0xa
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x108], 0
jge 0x10007022
mov dword [ebp - 0x108], 0
cmp dword [ebp - 0x12c], 0
jge 0x10007035
mov dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x10c]
jle 0x1000704f
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x134]
cmp edx, dword [ebp - 0x110]
jle 0x10007069
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x130]
sub ecx, dword [ebp - 0x108]
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0x134]
sub edx, dword [ebp - 0x12c]
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x120], eax
push 0xcc0020
mov edx, dword [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x11c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x128], eax
push 0x100
push 0
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x100]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x1000db50
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 4
push 0
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
mov eax, dword [0x1000db64]
push eax
call fcn.10002820
add esp, 8
push 0x100087e8
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x100087ec
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [0x1000db64]
add edx, 1
mov dword [0x1000db64], edx
lea eax, [ebp - 0x100]
push eax
mov ecx, dword [ebp - 0x128]
push ecx
call fcn.10005d00
add esp, 8
mov edx, dword [ebp - 0x128]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esp, ebp
pop ebp
ret