Function at 0x467bb0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x468133
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0040e628
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
cmp byte [eax + 0x135], 0
jne 0x467c02
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
je 0x46811d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.user32.dll_GetWindowDC
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46811d
mov eax, dword [ebp - 0x14]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x467c42
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.user32.dll_ReleaseDC
jmp 0x46811d
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.004676c0
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004676c0
mov eax, dword [0x4a45e8]
cmp byte [eax], 0
je 0x467c6d
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.00467378
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
test eax, eax
jne 0x467ca0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteDC
jmp 0x46811d
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x1c], eax
xor ecx, ecx
push ebp
push 0x468116
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0xc]
mov edi, eax
lea esi, [ebp - 0x44]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 5], 0
je 0x467cde
mov eax, 0x80000002
call fcn.00417324
mov edi, eax
jmp 0x467cea
mov eax, 0x80000003
call fcn.00417324
mov edi, eax
cmp byte [ebp - 5], 0
je 0x467cff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.00417324
mov esi, eax
jmp 0x467d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00417324
mov esi, eax
cmp byte [ebp - 5], 0
je 0x467d22
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00417324
mov dword [ebp - 0x18], eax
jmp 0x467d30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00417324
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x40]
sub al, 1
jb 0x467d46
je 0x467d4a
dec al
je 0x467d4e
dec al
je 0x467d53
jmp 0x467d74
mov bl, 1
jmp 0x467d76
xor ebx, ebx
jmp 0x467d76
mov bl, byte [ebp - 5]
jmp 0x467d76
push 0xc
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
cmp byte [ebp - 5], 0
je 0x467d6c
cmp eax, 8
setge bl
jmp 0x467d76
cmp eax, 8
setg bl
jmp 0x467d76
xor ebx, ebx
mov eax, dword [0x4a45e8]
cmp byte [eax], 0
je 0x467da8
test bl, bl
je 0x467d97
lea eax, [ebp - 0x44]
push eax
mov ecx, esi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00468144
jmp 0x467da8
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00468144
test bl, bl
je 0x467dc1
push esi
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004681d4
jmp 0x467dd2
lea eax, [ebp - 0x34]
push eax
mov ecx, edi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00468144
mov eax, dword [0x4a45e8]
cmp byte [eax], 0
je 0x467e0d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
test byte [eax + 0x134], 1
je 0x467df6
mov al, byte [eax + 0x135]
dec eax
sub al, 2
jb 0x467dff
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
je 0x467e0d
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004676e8
mov eax, dword [0x4a45e8]
cmp byte [eax], 0
je 0x467e25
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00467944
mov eax, dword [ebp - 4]
cmp word [eax + 0x5a], 0
je 0x467e9f
mov dl, 1
mov eax, dword [0x4164a8]
call fcn.004180d8
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x467e98
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
call fcn.00418bd0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
call fcn.004177f0
mov edx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
call fcn.0041798c
lea eax, [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467e9f
mov eax, dword [ebp - 0x24]
call fcn.00402fac
ret
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
add eax, 4
call fcn.00403bac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00467ab4
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
movzx eax, byte [eax + 0x1c]
imul ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00467ab4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
movzx edx, byte [edx + 0x1c]
imul edx
add ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00467ab4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
movzx edx, byte [edx + 0x1c]
imul edx
add ebx, eax
mov eax, ebx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
cmp eax, edx
setl byte [ebp - 0x1d]
cmp byte [ebp - 0x1d], 0
je 0x467f40
mov bl, 1
jmp 0x467f94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00467ab4
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
movzx eax, byte [eax + 0x1c]
imul ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00467ab4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
movzx edx, byte [edx + 0x1c]
imul edx
add ebx, eax
mov eax, ebx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
cmp eax, edx
setl bl
test bl, bl
jne 0x467fad
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00467ab4
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x42]
sub dl, 1
jb 0x467feb
dec dl
je 0x467fc2
dec dl
je 0x467fda
jmp 0x468012
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
cmp eax, edx
jge 0x468012
sub edx, eax
sar edx, 1
jns 0x467fd5
adc edx, 0
add dword [ebp - 0x34], edx
jmp 0x468012
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
cmp eax, edx
jge 0x468012
sub edx, eax
add dword [ebp - 0x34], edx
jmp 0x468012
mov edx, dword [0x4a45e8]
cmp byte [edx], 0
jne 0x468012
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
cmp eax, edx
jge 0x468012
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
sub edx, eax
sar edx, 1
jns 0x46800f
adc edx, 0
add dword [ebp - 0x34], edx
cmp byte [ebp - 0x1d], 0
je 0x468049
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
cmp dword [eax + 4], 0
je 0x468049
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0x1c], 0
je 0x468049
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
push eax
mov al, byte [ebp - 5]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004677dc
test bl, bl
je 0x46807e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
cmp dword [eax + 4], 0
je 0x46807e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
cmp byte [eax + 0x1c], 0
je 0x46807e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
mov al, byte [ebp - 5]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004677dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
cmp byte [eax + 0x1c], 0
je 0x46809d
push eax
mov al, byte [ebp - 5]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004677dc
push 0xcc0020
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
push edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0xc]
mov ebx, dword [ebp - 0xc]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 8]
mov ebx, dword [ebp - 0xc]
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0xc]
push edx
mov edx, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.gdi32.dll_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46811d
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_SelectObject
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.user32.dll_ReleaseDC
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46813a
lea eax, [ebp - 0x48]
call fcn.00403b58
ret