Function at 0x1000beb0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x7c
push ebx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x1000bee0
pop esi
pop ebx
add esp, 0x7c
ret
push ebp
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
mov dword [esp + 0xc], ebp
test ebp, ebp
je 0x1000c136
push edi
push 0x10
lea eax, [esp + 0x38]
push eax
call sub.NTDLL.dll_RtlZeroMemory
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edi
mov esi, eax
mov dword [esp + 0x14], 0
cmp eax, 0x640
jg 0x1000bf38
cmp edi, 0x640
jle 0x1000bf7c
movsd xmm1, qword [0x1000e988]
xorps xmm2, xmm2
movapd xmm0, xmm1
xorps xmm3, xmm3
cvtsi2sd xmm2, eax
cvtsi2sd xmm3, edi
divsd xmm0, xmm2
divsd xmm1, xmm3
comisd xmm0, xmm1
jbe 0x1000bf64
movapd xmm0, xmm1
mulsd xmm2, xmm0
mulsd xmm3, xmm0
cvttsd2si esi, xmm2
cvttsd2si edi, xmm3
mov dword [esp + 0x14], 1
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1000c12a
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x1000c11f
cmp eax, 0xffffffff
je 0x1000c11f
cmp dword [esp + 0x14], 0
je 0x1000bfe3
push 4
push ebp
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push 0x40cc0020
push edx
mov edx, dword [esp + 0x3c]
push eax
push 0
push 0
push ebx
push edi
push esi
push ecx
push edx
push ebp
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x1000c000
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 0x40cc0020
push 0
push 0
push ebx
push edi
push esi
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x1000c11f
push 0
push 0
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ebx, eax
test ebx, ebx
je 0x1000c11b
push ebx
push edi
lea edx, [esp + 0x24]
push esi
push edx
call fcn.1000ce50
add esp, 0x10
test eax, eax
je 0x1000c113
push 0x48
lea eax, [esp + 0x48]
push eax
call sub.NTDLL.dll_RtlZeroMemory
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x30]
push 1
lea edx, [esp + 0x48]
push edx
push ebx
call eax
test eax, eax
js 0x1000c113
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x1000c113
push 4
push 0x1000
push edi
push 0
call fcn.1000ca50
mov ebp, eax
test ebp, ebp
je 0x1000c10f
push 8
lea ecx, [esp + 0x2c]
push ecx
call sub.NTDLL.dll_RtlZeroMemory
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
push 0
xorpd xmm0, xmm0
movlpd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 0
push eax
push ecx
push ebx
call edx
test eax, eax
js 0x1000c102
xor esi, esi
test edi, edi
je 0x1000c102
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
mov edx, edi
sub edx, esi
push edx
mov edx, dword [eax + 0xc]
lea ecx, [esi + ebp]
push ecx
push ebx
mov dword [esp + 0x24], 0
call edx
test eax, eax
js 0x1000c0e2
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000c0e2
add esi, eax
cmp esi, edi
jb 0x1000c0b2
test esi, esi
je 0x1000c102
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
mov dword [eax], esi
mov dword [ecx], ebp
mov dword [esp + 0x20], 1
jmp 0x1000c10f
push 0x8000
push 0
push ebp
call fcn.1000bde0
mov ebp, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push ebx
call eax
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [esp + 0x30]
pop edi
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x1c]
pop ebp
pop esi
pop ebx
add esp, 0x7c
ret