Function at 0x484f20
Capabilities:
Capture screenshot
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a05c4
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4c70c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], edx
mov ebx, ecx
mov dword [ebp - 0x98], ebx
mov eax, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 0xac], eax
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea esi, [ecx + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x484f80
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x54]
call fcn.0040be60
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0x6e
mov eax, dword [ebp - 0x2c]
xor al, 0x53
mov byte [ebp - 0x28], al
mov eax, dword [ebp - 0x2c]
inc al
xor al, 0x63
mov byte [ebp - 0x27], al
mov eax, dword [ebp - 0x2c]
add al, 2
xor al, 0x72
mov byte [ebp - 0x26], al
mov eax, dword [ebp - 0x2c]
add al, 3
xor al, 0x65
mov byte [ebp - 0x25], al
mov eax, dword [ebp - 0x2c]
add al, 4
xor al, 0x65
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 0x2c]
add al, 5
xor al, 0x6e
mov byte [ebp - 0x23], al
mov eax, dword [ebp - 0x2c]
add al, 6
xor al, 0x73
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 0x2c]
add al, 7
xor al, 0x68
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x2c]
add al, 8
xor al, 0x6f
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x2c]
add al, 9
xor al, 0x74
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 0x2c]
add al, 0xa
xor al, 0x20
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x2c]
add al, 0xb
xor al, 0x74
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x2c]
add al, 0xc
xor al, 0x61
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x2c]
add al, 0xd
xor al, 0x6b
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x2c]
add al, 0xe
xor al, 0x69
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x2c]
add al, 0xf
xor al, 0x6e
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x2c]
add al, 0x10
xor al, 0x67
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x2c]
add al, 0x11
xor al, 0x3a
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x2c]
add al, 0x12
mov byte [ebp - 0x15], 0
xor al, 0x20
xor edx, edx
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0x28]
lea esp, [esp]
mov al, byte [ebp + edx - 0x28]
mov ecx, dword [ebp - 0x2c]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x28], cl
inc edx
cmp edx, 0x13
jb 0x485070
sub esp, 0x18
mov byte [ebp - 0x15], 0
mov ecx, esp
lea edx, [ebp - 0x54]
push 0
call fcn.004612d0
add esp, 4
lea eax, [ebp - 0x28]
mov ecx, 0x4cb378
push eax
call fcn.0040b380
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x40]
cmp ecx, 8
jb 0x4850ea
mov edx, dword [ebp - 0x54]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4850e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48543f
push ecx
push edx
call fcn.00435dd2
add esp, 8
cmp byte [0x4cb101], 0
jne 0x4850fa
mov eax, 1
jmp 0x485166
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x485164
lea eax, [ebp - 0x94]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x48515b
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x48515b
mov ecx, dword [ebp - 0x88]
sub ecx, dword [ebp - 0x90]
push ecx
mov ecx, dword [ebp - 0x8c]
sub ecx, dword [ebp - 0x94]
push ecx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
mov dword [ebp - 0x9c], ebx
test ebx, ebx
jne 0x485182
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00435b39
mov esp, ebp
pop ebp
ret
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push edi
push dword [ebp - 0x98]
mov dword [ebp - 0xa8], eax
call dword [sym.imp.USER32.dll_PrintWindow]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x4851e0
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x88]
push 0xcc0020
push ecx
push edx
push esi
sub eax, ecx
push eax
mov eax, dword [ebp - 0x8c]
sub eax, edx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x98], eax
push dword [ebp - 0xa8]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
lea ecx, [ebp - 0x6c]
push str.image_png
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
call fcn.0040af30
mov dword [ebp - 4], 1
cmp dword [ebp - 0x98], 0
jne 0x485240
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [ebp - 0x6c]
xor ebx, ebx
call fcn.0040aed0
mov eax, ebx
jmp 0x485166
cmp dword [ebp - 0x58], 8
lea edx, [ebp - 0x6c]
jb 0x48524c
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x3c]
mov ecx, ebx
push eax
push dword [ebp - 0xac]
call fcn.00484af0
add esp, 8
mov ebx, eax
push dword [ebp - 0x9c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test ebx, ebx
jne 0x485291
lea ecx, [ebp - 0x6c]
call fcn.0040aed0
mov eax, ebx
jmp 0x485166
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0
push eax
mov edx, 1
mov ecx, ebx
call fcn.00484dd0
add esp, 4
test al, al
je 0x4852d3
mov ecx, 0x4cb360
lea edx, [ebp - 0x3c]
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4852ed
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4852c2
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
lea ecx, [ebp - 0x6c]
mov ebx, 1
call fcn.0040aed0
mov eax, ebx
jmp 0x485166
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov edi, dword [ebp - 0x98]
mov ecx, ebx
mov dword [0x4cb360], eax
mov eax, dword [ebp - 0x38]
mov dword [0x4cb364], eax
mov eax, dword [ebp - 0x34]
mov dword [0x4cb368], eax
mov eax, dword [ebp - 0x30]
mov dword [0x4cb36c], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0
call fcn.00484dd0
add esp, 4
mov dword [ebp - 0xa0], 0
lea eax, [ebp - 0xa0]
push eax
push ebx
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [0x4cb0f8]
mov dword [ebp - 0x9c], eax
cmp edx, 3
jb 0x48536a
mov edx, 3
cmp dword [0x4cb0fc], 8
mov ecx, 0x4cb0e8
jb 0x48537e
mov ecx, dword [0x4cb0e8]
push 4
push 0x4b02d8
call fcn.0040be00
push dword [ebp - 0xb0]
neg eax
lea ecx, [ebp - 0x84]
mov edx, 0x4cb0e8
sbb esi, esi
add esi, 3
call fcn.0042b6b0
add esp, 0xc
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x4853b6
mov eax, dword [eax]
push 0
push 0x80
push esi
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
mov esi, eax
call fcn.0040aed0
mov dword [ebp - 0xa4], 0
cmp esi, 0xffffffff
je 0x485413
push 0
lea eax, [ebp - 0xa4]
push eax
push edi
push dword [ebp - 0x9c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
xor ebx, ebx
lea ecx, [ebp - 0x6c]
cmp dword [ebp - 0xa4], edi
sete bl
call fcn.0040aed0
mov eax, ebx
jmp 0x485166
call fcn.0043f67c
int3