Function at 0x40c4c4
Capabilities:
Capture screenshot

Disassembly:
push eax
call fcn.0040c308
pop eax
je 0x40c6b5
pushal
mov ebx, eax
call dword [ebx + 0x34]
xor eax, eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x56], eax
mov dword [ebx + 0x5a], eax
mov esi, dword [ebx + 0x1c]
mov edi, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x41]
jecxz 0x40c4fe
mov eax, dword [ebx + 0x3d]
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
test edi, edi
jge 0x40c51d
neg edi
jmp 0x40c51d
mov ecx, dword [ebx + 0x20]
jecxz 0x40c51d
add esp, 0xffffffe8
push esp
push 0x18
push ecx
call sub.gdi32.dll_GetObjectA
xchg ecx, eax
jecxz 0x40c51a
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x18
push 0
call sub.gdi32.dll_CreateCompatibleDC
push eax
cmp byte [ebx + 0x3c], 1
jne 0x40c5cd
push 0
call sub.user32.dll_GetDC
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
xchg ebp, eax
push 0
call sub.user32.dll_ReleaseDC
pop edx
push edx
push ebp
push edx
call sub.gdi32.dll_SelectObject
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push 0
push 0
mov eax, dword [ebx + 0x2c]
call fcn.00409770
push eax
call sub.gdi32.dll_CreateSolidBrush
mov edx, esp
push eax
push eax
push edx
push dword [esp + 0x20]
call sub.user32.dll_FillRect
call sub.gdi32.dll_DeleteObject
add esp, 0x10
mov ecx, dword [ebx + 0x41]
jecxz 0x40c5aa
push dword [esp + 4]
call sub.gdi32.dll_SelectObject
push 0
push dword [ebx + 0x3d]
push dword [ebx + 0x41]
push dword [ebx + 0x18]
push 0
push ebp
push dword [esp + 0x18]
call sub.gdi32.dll_SetDIBits
jmp 0x40c5be
mov edx, dword [esp + 4]
push edx
mov eax, ebx
xor ecx, ecx
push ecx
call fcn.0040c258
call sub.gdi32.dll_SelectObject
mov eax, ebx
call fcn.0040c1e0
mov dword [ebx + 0x20], ebp
jmp 0x40c6a2
movzx eax, byte [ebx + 0x49]
xchg ecx, eax
mov cl, byte [ecx + 0x42a3f0]
movzx eax, byte [0x42a114]
jecxz 0x40c5d1
xor ebp, ebp
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x18]
call fcn.0040c130
push eax
cmp byte [ebx + 0x49], 5
jne 0x40c5fa
call fcn.0040c1c8
pop eax
push eax
call fcn.0040c4b0
mov edx, dword [ebx + 0x18]
mul edx
push eax
push eax
push 0
call sub.kernel32.dll_GlobalAlloc
push eax
push 0
push dword [esp + 0xc]
push eax
mov eax, dword [ebx + 0x18]
cmp eax, edi
jle 0x40c620
mov eax, edi
push eax
push 0
mov eax, ebx
call fcn.00408be4
push eax
push dword [esp + 0x24]
call sub.gdi32.dll_GetDIBits
mov edx, dword [ebx + 0x18]
cmp edx, edi
jle 0x40c63d
mov edx, edi
cmp eax, edx
je 0x40c684
call sub.kernel32.dll_GlobalFree
xor eax, eax
push eax
mov edx, esp
mov ecx, dword [esp + 8]
push eax
push eax
push edx
push 0
push ecx
push dword [esp + 0x20]
call sub.gdi32.dll_CreateDIBSection
xor esi, 0xffffffff
xchg ebp, eax
push ebp
push dword [esp + 0x10]
call sub.gdi32.dll_SelectObject
push eax
mov edx, dword [esp + 0x10]
xor ecx, ecx
push ecx
mov eax, ebx
call fcn.0040c258
push dword [esp + 0x10]
call sub.gdi32.dll_SelectObject
mov eax, ebx
call fcn.0040c1e0
pop dword [ebx + 0x41]
pop dword [ebx + 0x45]
pop dword [ebx + 0x3d]
mov dword [ebx + 0x20], ebp
test esi, esi
mov byte [ebx + 0x72], 0
jge 0x40c6a2
inc byte [ebx + 0x72]
mov ecx, dword [ebx + 0x4a]
jecxz 0x40c6af
pop edx
push edx
push edi
xchg esi, ecx
xchg ebx, eax
call esi
call sub.gdi32.dll_DeleteDC
popal
ret