Function at 0x439900
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x7c0
mov ecx, dword [0x8e53fc]
push ebx
push ebp
push esi
lea eax, [esp + 0x18]
push edi
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push str.screenshot
call fcn.00506208
add esp, 4
test eax, eax
je 0x439945
call fcn.005061f6
cmp dword [eax], 0x11
jne 0x439f76
lea edx, [esp + 0x24]
push edx
call fcn.00506076
lea eax, [esp + 0x28]
push eax
call fcn.00505f16
add esp, 8
mov esi, eax
xor edi, edi
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
push edi
inc edx
push ecx
push edx
mov ecx, 0x64
cdq
idiv ecx
push edx
lea edx, [esp + 0x64]
push str.screenshotCG_02d_02d_02d__03d.bmp
push edx
call fcn.0050543d
lea eax, [esp + 0x6c]
push 0x51ac44
push eax
call fcn.00505b50
add esp, 0x20
cmp eax, ebx
je 0x4399af
push eax
call fcn.005058b0
add esp, 4
inc edi
cmp edi, 0x3e8
jl 0x439960
jmp 0x4399b7
cmp edi, 0x3e8
jl 0x4399e8
lea ecx, [esp + 0x2d0]
push 0x51ac18
push ecx
call fcn.0050543d
push 3
lea edx, [esp + 0x2dc]
push 4
push edx
call fcn.00431c70
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c0
ret
mov eax, dword [0x5192f0]
cmp eax, 8
jne 0x439a2f
xor eax, eax
mov cl, byte [eax + 0x5d508c]
mov dl, byte [eax + 0x5d508d]
mov byte [esp + eax + 0x3d2], cl
mov cl, byte [eax + 0x5d508e]
mov byte [esp + eax + 0x3d1], dl
mov byte [esp + eax + 0x3d0], cl
mov byte [esp + eax + 0x3d3], 0
add eax, 4
cmp eax, 0x400
jl 0x4399f4
jmp 0x439a5b
cmp eax, 0x10
je 0x439a39
cmp eax, 0x20
jne 0x439a5b
mov edx, dword [0x5d4560]
mov eax, dword [0x5d5bb8]
mov ecx, dword [0x5d4540]
mov dword [0x5d5ba4], edx
mov dword [0x5d5ba8], eax
mov dword [0x5d5bac], ecx
mov edx, dword [0x5d28e0]
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x254]
rep stosd dword es:[edi], eax
mov dword [esp + 0x254], 0x7c
mov eax, dword [edx + 8]
push ebx
lea edx, [esp + 0x258]
mov ecx, dword [eax]
push 1
push edx
push ebx
push eax
call dword [ecx + 0x64]
mov esi, eax
neg esi
sbb esi, esi
neg esi
je 0x439d13
mov eax, dword [0x5d28e0]
push ebx
mov eax, dword [eax + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
cmp esi, 0x887601ae
jg 0x439b1f
je 0x439b0b
cmp esi, 0x8007000e
je 0x439aff
cmp esi, 0x80070057
je 0x439aeb
cmp esi, 0x88760082
jne 0x439b5d
lea edx, [esp + 0x54]
lea eax, [esp + 0x154]
push edx
push 0x51abf4
push eax
jmp 0x439b55
lea ecx, [esp + 0x54]
lea edx, [esp + 0x154]
push ecx
push 0x51abd0
push edx
jmp 0x439b55
lea eax, [esp + 0x54]
push eax
push 0x51abac
jmp 0x439b4d
lea edx, [esp + 0x54]
lea eax, [esp + 0x154]
push edx
push 0x51ab88
push eax
jmp 0x439b55
cmp esi, 0x887601c2
je 0x439b43
cmp esi, 0x8876021c
jne 0x439b5d
lea ecx, [esp + 0x54]
lea edx, [esp + 0x154]
push ecx
push 0x51ab64
push edx
jmp 0x439b55
lea eax, [esp + 0x54]
push eax
push 0x51ab40
lea ecx, [esp + 0x15c]
push ecx
call fcn.0050543d
add esp, 0xc
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0x12c000
mov ebp, eax
mov dword [esp + 0x2c], 0x28
mov dword [esp + 0x30], 0x280
mov dword [esp + 0x34], 0x1e0
mov word [esp + 0x38], 1
mov word [esp + 0x3a], 0x18
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
call fcn.00505776
add esp, 4
mov ebx, eax
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
jne 0x439bd7
lea edx, [esp + 0x54]
lea eax, [esp + 0x154]
push edx
push 0x51ab18
push eax
jmp 0x439ce6
push 0x1e0
push 0x280
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edi, eax
test edi, edi
jne 0x439bfd
lea ecx, [esp + 0x54]
push ecx
push 0x51aaf0
jmp 0x439cde
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
push 0xcc0020
push eax
push ecx
push ebp
push 0x1e0
push 0x280
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x439c49
lea edx, [esp + 0x54]
lea eax, [esp + 0x154]
push edx
push 0x51aac8
push eax
jmp 0x439ce6
mov ecx, dword [esp + 0x10]
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
lea edx, [esp + 0x28]
push 0
push edx
push ebx
push 0x1e0
push 0
push edi
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x439c84
lea eax, [esp + 0x54]
lea ecx, [esp + 0x154]
push eax
push 0x51aaa0
push ecx
jmp 0x439ce6
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [0x8e53fc]
push esi
mov esi, dword [sym.imp.USER32.dll_ReleaseDC]
push edx
call esi
mov eax, dword [0x8e53fc]
push ebp
push eax
call esi
lea ecx, [esp + 0x54]
push ecx
push 0x1e0
push 0x280
push ebx
call fcn.00439fb0
add esp, 0x10
test eax, eax
je 0x439cd4
lea edx, [esp + 0x54]
lea eax, [esp + 0x154]
push edx
push 0x51aa84
push eax
jmp 0x439ce6
lea ecx, [esp + 0x54]
push ecx
push 0x51aa60
lea edx, [esp + 0x15c]
push edx
call fcn.0050543d
add esp, 0xc
lea eax, [esp + 0x154]
push 3
push 4
push eax
call fcn.00431c70
push ebx
call fcn.005050dd
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c0
ret
push 0x12c000
call fcn.00505776
mov ebp, eax
push 0x12c000
mov dword [esp + 0x20], ebp
call fcn.00505776
mov ecx, dword [0x5192f0]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x26c]
mov esi, dword [esp + 0x280]
imul eax, dword [esp + 0x28]
sar ecx, 3
mov edx, ecx
add esp, 8
imul edx, dword [esp + 0x1c]
add esi, edx
lea edx, [ecx + ecx*4]
add eax, esi
mov dword [esp + 0x10], 0x1e0
shl edx, 7
mov ecx, edx
mov esi, eax
mov ebx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
add ebp, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x264]
mov ecx, dword [esp + 0x10]
add eax, edi
dec ecx
mov dword [esp + 0x10], ecx
jne 0x439d69
mov eax, dword [0x5d28e0]
push 0
mov eax, dword [eax + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
test eax, eax
je 0x439dcc
mov edx, dword [esp + 0x18]
push edx
call fcn.005050dd
mov eax, dword [esp + 0x18]
push eax
call fcn.005050dd
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c0
ret
mov eax, dword [0x5192f0]
cmp eax, 0x10
je 0x439e83
cmp eax, 0x18
je 0x439e2d
cmp eax, 0x20
jne 0x439ef9
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebp, 0x1e0
lea eax, [ecx + 1]
lea edi, [edx + 0xe1001]
sub edi, 0x780
mov esi, 0x280
mov ecx, edi
mov dl, byte [eax + 1]
add eax, 4
mov byte [ecx + 1], dl
mov dl, byte [eax - 4]
mov byte [ecx], dl
mov dl, byte [eax - 5]
mov byte [ecx - 1], dl
add ecx, 3
dec esi
jne 0x439e0b
dec ebp
jne 0x439dfe
jmp 0x439ef9
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], 0x1e0
lea edi, [eax + 0xe1000]
sub edi, 0x780
mov esi, edx
mov ecx, edx
sub esi, edi
lea eax, [edi + 1]
mov ebp, 0x280
mov bl, byte [ecx]
add ecx, 3
mov byte [eax + 1], bl
mov bl, byte [esi + eax]
mov byte [eax], bl
mov bl, byte [ecx - 1]
mov byte [eax - 1], bl
add eax, 3
dec ebp
jne 0x439e57
mov eax, dword [esp + 0x10]
add edx, 0x780
dec eax
mov dword [esp + 0x10], eax
jne 0x439e43
jmp 0x439ef9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, 0x1e0
lea ebp, [ecx + 0xe1001]
sub ebp, 0x780
mov edi, 0x280
mov esi, ebp
mov bx, word [eax]
mov cx, word [0x5d4880]
shr bx, cl
mov ecx, dword [0x5d3d28]
add eax, 2
add esi, 3
shl bl, cl
mov byte [esi - 2], bl
mov bx, word [eax - 2]
mov cx, word [0x5d4c84]
shr bx, cl
mov ecx, dword [0x5d5bb0]
shl bl, cl
mov byte [esi - 3], bl
mov bx, word [eax - 2]
mov cx, word [0x5d4c88]
shr bx, cl
mov ecx, dword [0x5d4138]
shl bl, cl
dec edi
mov byte [esi - 4], bl
jne 0x439ea3
dec edx
jne 0x439e96
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x54]
push edx
push 0x1e0
push 0x280
push esi
call fcn.00439fb0
add esp, 0x10
test eax, eax
lea eax, [esp + 0x54]
push eax
je 0x439f3d
lea ecx, [esp + 0x2d4]
push 0x51aa84
push ecx
call fcn.0050543d
push 3
push 4
lea edx, [esp + 0x2e4]
jmp 0x439f5a
lea ecx, [esp + 0x2d4]
push 0x51aa3c
push ecx
call fcn.0050543d
push 3
push 4
lea edx, [esp + 0x2e4]
push edx
call fcn.00431c70
mov eax, dword [esp + 0x30]
add esp, 0x18
push eax
call fcn.005050dd
push esi
call fcn.005050dd
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c0
ret