Function at 0x6d09f789
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
push edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x10002
push dword [0x6d0fe4b4]
mov ebx, eax
mov dword [ebp - 4], ebx
call sub.java.dll__JNU_GetEnv_8
push dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push dword [ebp + 0x10]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x6d09f7f4
xor eax, eax
lea edi, [ebp + 0x17]
stosb byte es:[edi], al
mov al, byte [ebp + 0x17]
mov byte [ebp + 0x17], al
push 0x6d0d93c8
lea eax, [ebp + 0x17]
push eax
call sub.MSVCR100.dll__CxxThrowException
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [0x6d0fe8c4]
push esi
push ebx
mov dword [ebp - 0x14], eax
call fcn.6d0a9cf9
push esi
push ebx
mov dword [ebp - 8], eax
call fcn.6d0a9d3d
mov esi, dword [ebp + 0x10]
add esp, 0x10
push 0x40cc0020
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
push edi
push esi
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
test esi, esi
js 0x6d09f7da
or ecx, 0xffffffff
cmp esi, ecx
ja 0x6d09f7da
test edi, edi
js 0x6d09f7da
cmp edi, ecx
ja 0x6d09f7da
test esi, esi
je 0x6d09f861
test edi, edi
je 0x6d09f861
xor edx, edx
mov eax, ecx
div esi
cmp edi, eax
ja 0x6d09f7da
mov ebx, esi
imul ebx, edi
test ebx, ebx
js 0x6d09f7da
cmp ebx, ecx
ja 0x6d09f7da
test ebx, ebx
je 0x6d09f886
cmp ebx, 0x3fffffff
ja 0x6d09f7da
mov eax, ebx
shl eax, 2
test eax, eax
js 0x6d09f7da
cmp eax, ecx
ja 0x6d09f7da
cmp eax, 0xffffffcb
ja 0x6d09f7da
add eax, 0x34
push eax
call fcn.6d0af517
push 0x2c
mov esi, eax
push 0
push esi
lea edi, [esi + 0x34]
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x14]
neg eax
add esp, 0x10
mov dword [esi + 8], eax
xor eax, eax
push 0x20
inc eax
mov word [esi + 0xc], ax
pop eax
push 0
push esi
push edi
push dword [ebp + 0x14]
mov word [esi + 0xe], ax
mov eax, dword [0x6d0d529c]
push 0
push dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [0x6d0d5298]
push dword [ebp - 4]
mov dword [esi + 0x2c], eax
mov eax, dword [0x6d0d5294]
mov dword [esi], 0x28
mov dword [esi + 0x10], 3
mov dword [esi + 0x30], eax
call dword [sym.imp.GDI32.dll_GetDIBits]
and dword [ebp + 0x14], 0
test ebx, ebx
jle 0x6d09f94a
mov ecx, dword [ebp + 0x14]
lea eax, [edi + ecx*4 + 1]
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
or edx, 0xffffff00
shl edx, 8
or edx, eax
movzx eax, byte [edi + ecx*4]
shl edx, 8
or edx, eax
inc dword [ebp + 0x14]
mov dword [edi + ecx*4], edx
cmp dword [ebp + 0x14], ebx
jl 0x6d09f91d
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push edi
push ebx
push 0
push dword [ebp + 0x18]
push eax
call dword [ecx + 0x34c]
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebp - 8], 0
je 0x6d09f984
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 4]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push dword [ebp - 0x18]
call esi
pop edi
pop esi
pop ebx
leave
ret 0x14