Function at 0x40a06f
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x4d8b98
mov esi, 0x4d8b74
cmp dword [ebp + 0xc], 3
jne 0x409bb2
push 0
push ebx
push edi
call fcn.004b7b68
mov dword [esi], eax
mov dword [ebp + 0xc], 2
jmp 0x409bbd
push 1
push ebx
push edi
call fcn.004b7b68
mov dword [esi], eax
mov eax, dword [esi]
test eax, eax
je 0x409bcc
cmp dword [eax + 0x544], 0
jne 0x409bd3
xor eax, eax
jmp 0x40a33e
mov edx, dword [ebx]
sub dword [ebx + 8], edx
xor ecx, ecx
mov dword [ebx], ecx
cmp dword [ebp + 0xc], 0
jne 0x409c6f
mov eax, dword [esi]
mov edx, dword [eax + 0x52c]
cmp edx, dword [ebx + 8]
jne 0x409c08
mov ecx, dword [eax + 0x530]
cmp ecx, dword [ebx + 0xc]
jne 0x409c08
mov eax, 1
jmp 0x40a33e
mov edx, dword [0x4d42a0]
push edx
call sub.USER32.dll_GetTopWindow
mov dword [0x4d8bd4], eax
mov ecx, dword [0x4d8bd4]
push ecx
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x409c6f
cmp edi, dword [0x4d8bd4]
jne 0x409c65
mov eax, dword [esi]
mov edx, dword [eax + 0x52c]
cmp edx, dword [ebx + 8]
jl 0x409c6f
mov ecx, dword [eax + 0x530]
cmp ecx, dword [ebx + 0xc]
jl 0x409c6f
mov eax, dword [esi]
mov eax, dword [eax + 0x53c]
cmp eax, 2
je 0x409c5b
cmp eax, 4
jne 0x409c6f
mov eax, 1
jmp 0x40a33e
mov eax, 1
jmp 0x40a33e
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_GetDC
mov edi, eax
mov dword [0x4d8b78], edi
test edi, edi
jne 0x409c8e
xor eax, eax
jmp 0x40a33e
push edi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [0x4d8b7c], eax
cmp dword [0x4d8b7c], 0
jne 0x409cbc
mov edx, dword [0x4d8b78]
push edx
mov ecx, dword [0x4d429c]
push ecx
call sub.USER32.dll_ReleaseDC
xor eax, eax
jmp 0x40a33e
mov edx, dword [0x4d8b78]
push edx
call sub.GDI32.dll_CreateCompatibleDC
mov edi, eax
mov dword [0x4d8b80], edi
test edi, edi
jne 0x409cf9
mov eax, dword [0x4d8b7c]
push eax
call sub.GDI32.dll_DeleteDC
mov edx, dword [0x4d8b78]
push edx
mov ecx, dword [0x4d429c]
push ecx
call sub.USER32.dll_ReleaseDC
xor eax, eax
jmp 0x40a33e
mov edx, dword [ebx + 0xc]
push edx
mov ecx, dword [ebx + 8]
push ecx
mov eax, dword [0x4d8b78]
push eax
call sub.GDI32.dll_CreateCompatibleBitmap
mov edi, eax
mov dword [0x4d8b68], edi
test edi, edi
jne 0x409d48
mov eax, dword [0x4d8b80]
push eax
call sub.GDI32.dll_DeleteDC
mov edx, dword [0x4d8b7c]
push edx
call sub.GDI32.dll_DeleteDC
mov ecx, dword [0x4d8b78]
push ecx
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_ReleaseDC
xor eax, eax
jmp 0x40a33e
push 0x4d8bbc
push 0x18
mov edx, dword [esi]
mov ecx, dword [edx + 0x544]
push ecx
call sub.GDI32.dll_GetObjectA
mov eax, dword [0x4d8b68]
push eax
mov edx, dword [0x4d8b7c]
push edx
call sub.GDI32.dll_SelectObject
mov dword [0x4d8b6c], eax
mov ecx, dword [esi]
mov eax, dword [ecx + 0x544]
push eax
mov edx, dword [0x4d8b80]
push edx
call sub.GDI32.dll_SelectObject
mov dword [0x4d8b70], eax
mov eax, dword [0x4ca684]
test eax, eax
je 0x409daf
cmp eax, dword [esi]
jne 0x409daf
push 0xc
call sub.USER32.dll_GetSysColor
push eax
call sub.GDI32.dll_CreateSolidBrush
mov dword [0x4d8bb8], eax
jmp 0x409dc7
mov edx, dword [0x4cb054]
mov ecx, dword [edx*4 + 0x4dbb84]
push ecx
call sub.GDI32.dll_CreateSolidBrush
mov dword [0x4d8bb8], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x53c]
cmp edx, 5
ja case.0x409dd8.2
jmp dword [edx*4 + 0x409ddf]
mov ecx, dword [0x4d8bb8]
push ecx
push ebx
mov eax, dword [0x4d8b7c]
push eax
call sub.USER32.dll_FillRect
mov ecx, dword [ebx + 8]
mov edx, dword [0x4d8bc0]
sub ecx, edx
sar ecx, 1
jns 0x409e1c
adc ecx, 0
mov dword [0x4d8ba8], ecx
mov eax, dword [ebx + 0xc]
mov edi, dword [0x4d8bc4]
sub eax, edi
sar eax, 1
jns 0x409e34
adc eax, 0
mov dword [0x4d8bac], eax
push 0xcc0020
push 0
push 0
mov ecx, dword [0x4d8b80]
push ecx
push edi
push edx
push eax
mov eax, dword [0x4d8ba8]
push eax
mov edx, dword [0x4d8b7c]
push edx
call sub.GDI32.dll_BitBlt
jmp 0x40a2ae
push 3
mov eax, dword [0x4d8b7c]
push eax
call sub.GDI32.dll_SetStretchBltMode
push 0xcc0020
mov edx, dword [0x4d8bc4]
push edx
mov ecx, dword [0x4d8bc0]
push ecx
push 0
push 0
mov eax, dword [0x4d8b80]
push eax
mov edx, dword [ebx + 0xc]
push edx
mov ecx, dword [ebx + 8]
push ecx
push 0
push 0
mov eax, dword [0x4d8b7c]
push eax
call sub.GDI32.dll_StretchBlt
jmp 0x40a2ae
mov edx, dword [0x4d8bb8]
push edx
push ebx
mov ecx, dword [0x4d8b7c]
push ecx
call sub.USER32.dll_FillRect
push 0xcc0020
push 0
push 0
mov eax, dword [0x4d8b80]
push eax
mov edx, dword [0x4d8bc4]
push edx
mov ecx, dword [0x4d8bc0]
push ecx
push 0
push 0
mov eax, dword [0x4d8b7c]
push eax
call sub.GDI32.dll_BitBlt
jmp 0x40a2ae
mov edx, dword [0x4d8bb8]
push edx
push ebx
mov ecx, dword [0x4d8b7c]
push ecx
call sub.USER32.dll_FillRect
fild dword [0x4d8bc0]
fstp dword [0x4d8b84]
fild dword [0x4d8bc4]
fstp dword [0x4d8b88]
fld dword [0x4d8b88]
fcomp dword [0x40a348]
fnstsw ax
sahf
jne 0x409f37
mov dword [0x4d8b8c], 0x3f800000
jmp 0x409f6f
fld dword [0x4d8b84]
fdiv dword [0x4d8b88]
fstp dword [0x4d8b8c]
jmp 0x409f6f
fld dword [0x4d8b8c]
fadd dword [0x4d8b84]
fstp dword [0x4d8b84]
fld dword [0x40a34c]
fadd dword [0x4d8b88]
fstp dword [0x4d8b88]
fild dword [ebx + 8]
fcomp dword [0x4d8b84]
fnstsw ax
sahf
jbe 0x409fb1
fild dword [ebx + 0xc]
fcomp dword [0x4d8b88]
fnstsw ax
sahf
ja 0x409f4b
jmp 0x409fb1
fld dword [0x4d8b8c]
fsubr dword [0x4d8b84]
fstp dword [0x4d8b84]
fld dword [0x40a34c]
fsubr dword [0x4d8b88]
fstp dword [0x4d8b88]
fild dword [ebx + 8]
fcomp dword [0x4d8b84]
fnstsw ax
sahf
jb 0x409f8d
fild dword [ebx + 0xc]
fcomp dword [0x4d8b88]
fnstsw ax
sahf
jb 0x409f8d
fld dword [0x4d8b84]
call fcn.004c47e0
mov dword [0x4d8bb0], eax
fld dword [0x4d8b88]
call fcn.004c47e0
mov dword [0x4d8bb4], eax
mov edx, dword [ebx + 8]
sub edx, dword [0x4d8bb0]
sar edx, 1
jns 0x409ffd
adc edx, 0
mov dword [0x4d8ba8], edx
mov ecx, dword [ebx + 0xc]
sub ecx, dword [0x4d8bb4]
sar ecx, 1
jns 0x40a013
adc ecx, 0
mov dword [0x4d8bac], ecx
push 3
mov eax, dword [0x4d8b7c]
push eax
call sub.GDI32.dll_SetStretchBltMode
push 0xcc0020
mov edx, dword [0x4d8bc4]
push edx
mov ecx, dword [0x4d8bc0]
push ecx
push 0
push 0
mov eax, dword [0x4d8b80]
push eax
mov edx, dword [0x4d8bb4]
push edx
mov ecx, dword [0x4d8bb0]
push ecx
mov eax, dword [0x4d8bac]
push eax
mov edx, dword [0x4d8ba8]
push edx
mov ecx, dword [0x4d8b7c]
push ecx
call sub.GDI32.dll_StretchBlt
jmp 0x40a2ae
xor eax, eax
mov dword [0x4d8bac], eax
xor edx, edx
mov dword [0x4d8ba8], edx
push 0xcc0020
push 0
push 0
mov ecx, dword [0x4d8b80]
push ecx
mov eax, dword [0x4d8bc4]
push eax
mov edx, dword [0x4d8bc0]
push edx
mov ecx, dword [0x4d8bac]
push ecx
mov eax, dword [0x4d8ba8]
push eax
mov edx, dword [0x4d8b7c]
push edx
call sub.GDI32.dll_BitBlt
mov ecx, dword [0x4d8bc0]
add dword [0x4d8ba8], ecx
mov eax, dword [0x4d8ba8]
cmp eax, dword [ebx + 8]
jl 0x40a07e
mov edx, dword [0x4d8bc4]
add dword [0x4d8bac], edx
mov ecx, dword [0x4d8bac]
cmp ecx, dword [ebx + 0xc]
jl 0x40a076
jmp 0x40a2ae
mov eax, dword [0x4d8bb8]
push eax
push ebx
mov edx, dword [0x4d8b7c]
push edx
call sub.USER32.dll_FillRect
fild dword [0x4d8bc0]
fstp dword [0x4d8b84]
fild dword [0x4d8bc4]
fstp dword [0x4d8b88]
fld dword [0x4d8b88]
fcomp dword [0x40a348]
fnstsw ax
sahf
jne 0x40a12e
mov dword [0x4d8b8c], 0x3f800000
jmp 0x40a140
fld dword [0x4d8b84]
fdiv dword [0x4d8b88]
fstp dword [0x4d8b8c]
mov edi, 0x78
mov dword [0x4d8b94], edi
mov dword [ebp - 4], edi
fild dword [ebp - 4]
fmul dword [0x4d8b8c]
call fcn.004c47e0
mov dword [0x4d8b90], eax
fild dword [0x4d8b90]
fcomp dword [0x4d8b84]
fnstsw ax
sahf
jb 0x40a1ad
fild dword [0x4d8b94]
fcomp dword [0x4d8b88]
fnstsw ax
sahf
jae 0x40a217
jmp 0x40a1ad
fld dword [0x4d8b8c]
fadd dword [0x4d8b84]
fstp dword [0x4d8b84]
fld dword [0x40a34c]
fadd dword [0x4d8b88]
fstp dword [0x4d8b88]
fild dword [0x4d8b90]
fcomp dword [0x4d8b84]
fnstsw ax
sahf
jbe 0x40a1f5
fild dword [0x4d8b94]
fcomp dword [0x4d8b88]
fnstsw ax
sahf
ja 0x40a189
jmp 0x40a1f5
fld dword [0x4d8b8c]
fsubr dword [0x4d8b84]
fstp dword [0x4d8b84]
fld dword [0x40a34c]
fsubr dword [0x4d8b88]
fstp dword [0x4d8b88]
fild dword [0x4d8b90]
fcomp dword [0x4d8b84]
fnstsw ax
sahf
jb 0x40a1d1
fild dword [0x4d8b94]
fcomp dword [0x4d8b88]
fnstsw ax
sahf
jb 0x40a1d1
fld dword [0x4d8b84]
call fcn.004c47e0
mov dword [0x4d8bb0], eax
fld dword [0x4d8b88]
call fcn.004c47e0
mov dword [0x4d8bb4], eax
xor edx, edx
mov dword [0x4d8bac], edx
mov eax, dword [ebx + 8]
mov edx, dword [0x4d8bb0]
cmp eax, edx
jle 0x40a255
sub eax, edx
mov dword [0x4d8ba8], eax
jmp 0x40a25d
xor ecx, ecx
mov dword [0x4d8ba8], ecx
push 3
mov eax, dword [0x4d8b7c]
push eax
call sub.GDI32.dll_SetStretchBltMode
push 0xcc0020
mov edx, dword [0x4d8bc4]
push edx
mov ecx, dword [0x4d8bc0]
push ecx
push 0
push 0
mov eax, dword [0x4d8b80]
push eax
mov edx, dword [0x4d8bb4]
push edx
mov ecx, dword [0x4d8bb0]
push ecx
mov eax, dword [0x4d8bac]
push eax
mov edx, dword [0x4d8ba8]
push edx
mov ecx, dword [0x4d8b7c]
push ecx
call sub.GDI32.dll_StretchBlt
mov eax, dword [0x4d8bb8]
push eax
call sub.GDI32.dll_DeleteObject
mov edx, dword [0x4d8b70]
push edx
mov ecx, dword [0x4d8b80]
push ecx
call sub.GDI32.dll_SelectObject
mov eax, dword [0x4d8b6c]
push eax
mov edx, dword [0x4d8b7c]
push edx
call sub.GDI32.dll_SelectObject
mov ecx, dword [esi]
mov eax, dword [ecx + 0x524]
test eax, eax
je 0x40a2f0
push eax
call sub.GDI32.dll_DeleteObject
mov eax, dword [esi]
mov edx, dword [0x4d8b68]
mov dword [eax + 0x524], edx
mov ecx, dword [ebx + 8]
mov dword [eax + 0x52c], ecx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0x530], edx
mov eax, dword [0x4d8b80]
push eax
call sub.GDI32.dll_DeleteDC
mov ecx, dword [0x4d8b7c]
push ecx
call sub.GDI32.dll_DeleteDC
mov eax, dword [0x4d8b78]
push eax
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_ReleaseDC
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8