Function at 0x1000a490
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x7c
push ebx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x1000a4c0
pop esi
pop ebx
add esp, 0x7c
ret
push ebp
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
mov dword [esp + 0xc], ebp
test ebp, ebp
je 0x1000a716
push edi
push 0x10
lea eax, [esp + 0x38]
push eax
call sub.NTDLL.dll_RtlZeroMemory
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edi
mov esi, eax
mov dword [esp + 0x14], 0
cmp eax, 0x640
jg 0x1000a518
cmp edi, 0x640
jle 0x1000a55c
movsd xmm1, qword [0x10001de8]
xorps xmm2, xmm2
movapd xmm0, xmm1
xorps xmm3, xmm3
cvtsi2sd xmm2, eax
cvtsi2sd xmm3, edi
divsd xmm0, xmm2
divsd xmm1, xmm3
comisd xmm0, xmm1
jbe 0x1000a544
movapd xmm0, xmm1
mulsd xmm2, xmm0
mulsd xmm3, xmm0
cvttsd2si esi, xmm2
cvttsd2si edi, xmm3
mov dword [esp + 0x14], 1
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1000a70a
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x1000a6ff
cmp eax, 0xffffffff
je 0x1000a6ff
cmp dword [esp + 0x14], 0
je 0x1000a5c3
push 4
push ebp
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push 0x40cc0020
push edx
mov edx, dword [esp + 0x3c]
push eax
push 0
push 0
push ebx
push edi
push esi
push ecx
push edx
push ebp
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x1000a5e0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 0x40cc0020
push 0
push 0
push ebx
push edi
push esi
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x1000a6ff
push 0
push 0
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ebx, eax
test ebx, ebx
je 0x1000a6fb
push ebx
push edi
lea edx, [esp + 0x24]
push esi
push edx
call fcn.10009150
add esp, 0x10
test eax, eax
je 0x1000a6f3
push 0x48
lea eax, [esp + 0x48]
push eax
call sub.NTDLL.dll_RtlZeroMemory
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x30]
push 1
lea edx, [esp + 0x48]
push edx
push ebx
call eax
test eax, eax
js 0x1000a6f3
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x1000a6f3
push 4
push 0x1000
push edi
push 0
call fcn.1000f100
mov ebp, eax
test ebp, ebp
je 0x1000a6ef
push 8
lea ecx, [esp + 0x2c]
push ecx
call sub.NTDLL.dll_RtlZeroMemory
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
push 0
xorpd xmm0, xmm0
movlpd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 0
push eax
push ecx
push ebx
call edx
test eax, eax
js 0x1000a6e2
xor esi, esi
test edi, edi
je 0x1000a6e2
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
mov edx, edi
sub edx, esi
push edx
mov edx, dword [eax + 0xc]
lea ecx, [esi + ebp]
push ecx
push ebx
mov dword [esp + 0x24], 0
call edx
test eax, eax
js 0x1000a6c2
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000a6c2
add esi, eax
cmp esi, edi
jb 0x1000a692
test esi, esi
je 0x1000a6e2
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
mov dword [eax], esi
mov dword [ecx], ebp
mov dword [esp + 0x20], 1
jmp 0x1000a6ef
push 0x8000
push 0
push ebp
call fcn.1000c2f0
mov ebp, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push ebx
call eax
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [esp + 0x30]
pop edi
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x1c]
pop ebp
pop esi
pop ebx
add esp, 0x7c
ret