Function at 0x414170
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c042b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x2d8
push esi
push edi
push 0x4dc690
mov edx, str._Temp__
mov dword [ebp - 0x2c], 0x28
lea ecx, [ebp - 0xdc]
call fcn.00405bc0
push str._Files_Screen_Desktop.jpeg
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.00405d20
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x4141e4
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x2e8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x80]
cmp edx, 8
jb 0x414234
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41422a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414544
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov edx, dword [ebp - 0xc8]
xor eax, eax
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 7
mov word [ebp - 0x94], ax
cmp edx, 8
jb 0x41428e
mov ecx, dword [ebp - 0xdc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414284
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414544
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 1
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x38], 0
push eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x48]
push 0xc
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x1c]
mov edi, eax
mov eax, dword [ebp - 0x18]
neg ecx
mov dword [ebp - 0x74], eax
mov eax, 1
push 0
push 0
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x7c]
push eax
push 1
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x28
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x70], ecx
mov word [ebp - 0x6a], si
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x414387
push edi
call esi
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x28]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
push edi
call dword [sym.imp.GDI32.dll_SaveDC]
push dword [ebp - 0x20]
mov esi, eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push edi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call esi
push dword [ebp - 0x14]
call esi
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x414405
lea eax, [ebp - 0x18]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x18], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 4], eax
jmp 0x41440c
mov dword [ebp - 0x24], 0
movups xmm0, xmmword [0x4c13a8]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xa0], 1
push eax
movups xmmword [ebp - 0xb0], xmm0
mov dword [ebp - 0x9c], 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4144db
push eax
call fcn.004a9d98
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
test edi, edi
je 0x4144db
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
xor esi, esi
cmp dword [ebp - 0x14], esi
jbe 0x4144d2
add edi, 0x30
nop dword [eax]
mov ecx, dword [edi]
mov eax, str.image_jpeg
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4144bd
test dx, dx
je 0x4144b9
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4144bd
add ecx, 4
add eax, 4
test dx, dx
jne 0x414497
xor eax, eax
jmp 0x4144c2
sbb eax, eax
or eax, 1
test eax, eax
je 0x414530
inc esi
add edi, 0x4c
cmp esi, dword [ebp - 0x14]
jb 0x414490
mov edi, dword [ebp - 0x18]
push edi
call fcn.004a9b70
add esp, 4
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x2e8]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
test eax, eax
je 0x414503
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x28]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0x18]
imul eax, esi, 0x4c
push ecx
movups xmm0, xmmword [eax + ecx]
movups xmmword [ebp - 0xc4], xmm0
jmp 0x4144d3
call fcn.004a9d47
int3