Function at 0x1000b430
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x7c
push ebx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x1000b460
pop esi
pop ebx
add esp, 0x7c
ret
push ebp
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
mov dword [esp + 0xc], ebp
test ebp, ebp
je 0x1000b6b6
push edi
push 0x10
lea eax, [esp + 0x38]
push eax
call sub.NTDLL.dll_RtlZeroMemory
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edi
mov esi, eax
mov dword [esp + 0x14], 0
cmp eax, 0x640
jg 0x1000b4b8
cmp edi, 0x640
jle 0x1000b4fc
movsd xmm1, qword [0x1000e9b0]
xorps xmm2, xmm2
movapd xmm0, xmm1
xorps xmm3, xmm3
cvtsi2sd xmm2, eax
cvtsi2sd xmm3, edi
divsd xmm0, xmm2
divsd xmm1, xmm3
comisd xmm0, xmm1
jbe 0x1000b4e4
movapd xmm0, xmm1
mulsd xmm2, xmm0
mulsd xmm3, xmm0
cvttsd2si esi, xmm2
cvttsd2si edi, xmm3
mov dword [esp + 0x14], 1
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1000b6aa
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x1000b69f
cmp eax, 0xffffffff
je 0x1000b69f
cmp dword [esp + 0x14], 0
je 0x1000b563
push 4
push ebp
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push 0x40cc0020
push edx
mov edx, dword [esp + 0x3c]
push eax
push 0
push 0
push ebx
push edi
push esi
push ecx
push edx
push ebp
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x1000b580
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 0x40cc0020
push 0
push 0
push ebx
push edi
push esi
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x1000b69f
push 0
push 0
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ebx, eax
test ebx, ebx
je 0x1000b69b
push ebx
push edi
lea edx, [esp + 0x24]
push esi
push edx
call fcn.100044b0
add esp, 0x10
test eax, eax
je 0x1000b693
push 0x48
lea eax, [esp + 0x48]
push eax
call sub.NTDLL.dll_RtlZeroMemory
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x30]
push 1
lea edx, [esp + 0x48]
push edx
push ebx
call eax
test eax, eax
js 0x1000b693
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x1000b693
push 4
push 0x1000
push edi
push 0
call fcn.10005120
mov ebp, eax
test ebp, ebp
je 0x1000b68f
push 8
lea ecx, [esp + 0x2c]
push ecx
call sub.NTDLL.dll_RtlZeroMemory
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
push 0
xorpd xmm0, xmm0
movlpd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 0
push eax
push ecx
push ebx
call edx
test eax, eax
js 0x1000b682
xor esi, esi
test edi, edi
je 0x1000b682
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
mov edx, edi
sub edx, esi
push edx
mov edx, dword [eax + 0xc]
lea ecx, [esi + ebp]
push ecx
push ebx
mov dword [esp + 0x24], 0
call edx
test eax, eax
js 0x1000b662
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000b662
add esi, eax
cmp esi, edi
jb 0x1000b632
test esi, esi
je 0x1000b682
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
mov dword [eax], esi
mov dword [ecx], ebp
mov dword [esp + 0x20], 1
jmp 0x1000b68f
push 0x8000
push 0
push ebp
call fcn.1000b800
mov ebp, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push ebx
call eax
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [esp + 0x30]
pop edi
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x1c]
pop ebp
pop esi
pop ebx
add esp, 0x7c
ret