Function at 0x10070b50
Capabilities:
Create directory
Get common file path
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbc36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1158
call fcn.100b7e70
mov dword [ebp - 0x1164], ecx
mov eax, dword [ebp + 0x14]
push eax
push str.CaptureReason_s
push 0x64
lea ecx, [ebp - 0xd4]
push ecx
call fcn.10003de0
add esp, 0x10
mov dword [ebp - 0x1148], 0
jmp 0x10070bad
mov edx, dword [ebp - 0x1148]
add edx, 1
mov dword [ebp - 0x1148], edx
lea eax, [ebp - 0xd4]
push eax
call fcn.1009ecbb
add esp, 4
cmp dword [ebp - 0x1148], eax
jae 0x10070bec
mov ecx, dword [ebp - 0x1148]
movzx edx, word [ebp + ecx*2 - 0xd4]
cmp edx, 0x20
jne 0x10070bea
mov eax, 0x5f
mov ecx, dword [ebp - 0x1148]
mov word [ebp + ecx*2 - 0xd4], ax
jmp 0x10070b9e
push 1
lea edx, [ebp - 0xd4]
push edx
mov ecx, dword [0x100f4c54]
call fcn.1000d5d0
mov byte [ebp - 0xb21], al
movzx eax, byte [ebp - 0xb21]
test eax, eax
jne 0x10070c21
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
mov al, 1
jmp 0x10071197
cmp dword [ebp + 8], 0
jne 0x10070cca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp + 8], eax
push bind
push 0
push 0x100
lea edx, [ebp - 0xf34]
push edx
call fcn.1009da4e
mov dword [ebp - 0x1154], eax
cmp dword [ebp - 0x1154], 0
jl 0x10070c7e
push bind
push str.Desktop
push 0
push 0x100
lea eax, [ebp - 0xf34]
push eax
call fcn.1009db9f
mov dword [ebp - 0x1154], eax
push bind
push 0
push 0x100
lea ecx, [ebp - 0xd34]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x1158], eax
cmp dword [ebp - 0x1158], 0
jl 0x10070cc8
push bind
push str.Desktop
push 0
push 0x100
lea edx, [ebp - 0xd34]
push edx
call fcn.1009db9f
mov dword [ebp - 0x1158], eax
jmp 0x10070cf6
push 0xff
lea eax, [ebp - 0xf34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xff
lea edx, [ebp - 0xd34]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [ebp - 0xf8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xb2c], eax
mov ecx, dword [ebp - 0xf4]
mov dword [ebp - 0xb28], ecx
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xe8]
call fcn.1001fbc0
movzx eax, al
test eax, eax
jne 0x10070d7e
mov byte [ebp - 0x114d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.1001f810
mov al, byte [ebp - 0x114d]
jmp 0x10071197
mov ecx, dword [ebp - 0x1164]
movzx edx, byte [ecx]
push edx
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0x1164]
call fcn.10070960
movzx ecx, al
test ecx, ecx
jne 0x10070dc5
mov byte [ebp - 0x114e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.1001f810
mov al, byte [ebp - 0x114e]
jmp 0x10071197
push 0x104
lea edx, [ebp - 0x1144]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.WinSbSScreenShots
push 0x104
lea eax, [ebp - 0x1144]
push eax
call fcn.10001ec0
push 0
lea ecx, [ebp - 0x1144]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.1000a1a0
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x860], edx
lea edx, [ebp - 0xfc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0xfc]
push ecx
mov ecx, dword [0x100f4c50]
call fcn.10019b20
mov dword [ebp - 0xaf8], eax
cmp dword [ebp - 0xaf8], 0
jne 0x10070e72
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov byte [ebp - 0x114f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.1001f810
mov al, byte [ebp - 0x114f]
jmp 0x10071197
mov eax, dword [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x864]
push ecx
push 0x100df610
push 0x14
lea edx, [ebp - 0xb20]
push edx
call fcn.10003de0
add esp, 0x14
lea eax, [ebp - 0xb20]
push eax
lea ecx, [ebp - 0x1144]
push ecx
push str._sScreen_ws.png
push 0x144
lea edx, [ebp - 0xaf4]
push edx
call fcn.10003de0
add esp, 0x14
mov eax, dword [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x864]
push ecx
push str._010I64x
push 0x14
mov edx, dword [ebp - 0x1164]
add edx, 1
push edx
call fcn.10003100
add esp, 0x14
lea ecx, [ebp - 0x85c]
call fcn.10073e10
mov byte [ebp - 4], 1
push 1
push str.WindowGrab
lea ecx, [ebp - 0x85c]
call fcn.10073fb0
push str.Machine
lea ecx, [ebp - 0x85c]
call fcn.10074820
push str.Stamp
lea ecx, [ebp - 0x85c]
call fcn.100746a0
mov eax, dword [ebp - 0xf8]
push eax
push str.window_x
lea ecx, [ebp - 0x85c]
call fcn.100745d0
mov ecx, dword [ebp - 0xf4]
push ecx
push str.window_y
lea ecx, [ebp - 0x85c]
call fcn.100745d0
mov edx, dword [ebp - 0xf0]
sub edx, dword [ebp - 0xf8]
push edx
push str.width
lea ecx, [ebp - 0x85c]
call fcn.100745d0
mov eax, dword [ebp - 0xec]
sub eax, dword [ebp - 0xf4]
push eax
push str.height
lea ecx, [ebp - 0x85c]
call fcn.100745d0
push 0xffffffffffffffff
lea ecx, [ebp - 0xf34]
push ecx
push str.title
lea ecx, [ebp - 0x85c]
call fcn.10074400
push 0xffffffffffffffff
lea edx, [ebp - 0xd34]
push edx
push str.class_name
lea ecx, [ebp - 0x85c]
call fcn.10074400
push 0xffffffffffffffff
lea eax, [ebp - 0xaf4]
push eax
push str.img_file
lea ecx, [ebp - 0x85c]
call fcn.10074400
push 0xffffffffffffffff
push str.false
push str.HasBeenDeleted
lea ecx, [ebp - 0x85c]
call fcn.10074250
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x14]
push ecx
push str.Reason
lea ecx, [ebp - 0x85c]
call fcn.10074400
mov edx, dword [ebp - 0xfc]
xor eax, eax
push eax
push edx
push str.ProcessID
lea ecx, [ebp - 0x85c]
call fcn.10074500
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xaf8]
mov edx, dword [ecx + 0x18]
push edx
push str.ImagePath
lea ecx, [ebp - 0x85c]
call fcn.10074400
push 0xffffffffffffffff
mov eax, dword [ebp - 0xaf8]
mov ecx, dword [eax + 0x39]
push ecx
push str.ImagePathShort
lea ecx, [ebp - 0x85c]
call fcn.10074400
push str.WindowsUser
lea ecx, [ebp - 0x85c]
call fcn.100748d0
push 0xffffffffffffffff
lea edx, [ebp - 0xb20]
push edx
push str.ScreenID
lea ecx, [ebp - 0x85c]
call fcn.10074400
push str.DateCode
lea ecx, [ebp - 0x85c]
call fcn.10074780
lea eax, [ebp - 0x85c]
push eax
mov ecx, 0x100f57d0
call fcn.10073b60
push 0
push 0x20
push 2
push 0
push 2
push 0x40000000
lea ecx, [ebp - 0xaf4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
je 0x10071103
push 0
lea edx, [ebp - 0x114c]
push edx
mov eax, dword [ebp - 0x1164]
mov ecx, dword [eax + 0x35]
push ecx
mov edx, dword [ebp - 0x1164]
mov eax, dword [edx + 0x31]
push eax
mov ecx, dword [ebp - 0xd8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xd8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0xf38], eax
cmp dword [ebp + 0x10], 0
je 0x10071120
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xf38]
mov dword [ecx], edx
mov eax, dword [ebp - 0x1164]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x25], ecx
push 0
call fcn.1009e296
add esp, 4
mov ecx, dword [ebp - 0x1164]
mov dword [ecx + 0x29], eax
mov dword [ecx + 0x2d], edx
mov eax, dword [ebp - 0xf38]
cdq
mov ecx, dword [ebp - 0x1164]
mov dword [ecx + 0x15], eax
mov dword [ecx + 0x19], edx
mov edx, dword [ebp - 0x1164]
mov dword [edx + 0x1d], 0
mov dword [edx + 0x21], 0
mov byte [ebp - 0x1150], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x85c]
call fcn.10073ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.1001f810
mov al, byte [ebp - 0x1150]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10