Function at 0x471000
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa60
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 0x41c], eax
push esi
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [0x9cef70]
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push str.screenshot
call fcn.005cd9fc
add esp, 4
test eax, eax
je 0x471069
call fcn.005ce25b
cmp dword [eax], 0x11
je 0x471069
jmp 0x471c48
lea edx, [ebp - 0x538]
push edx
call fcn.005cd9ab
add esp, 4
lea eax, [ebp - 0x538]
push eax
call fcn.005cd984
add esp, 4
mov dword [ebp - 0x410], eax
mov dword [ebp - 4], 0
jmp 0x47109f
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x3e8
jge 0x47112d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + 0x10]
add eax, 1
push eax
mov ecx, dword [ebp - 0x410]
mov eax, dword [ecx + 0x14]
cdq
mov ecx, 0x64
idiv ecx
push edx
push str.screenshotCG_02d_02d_02d__03d.bmp
lea edx, [ebp - 0x638]
push edx
call fcn.005cc4f5
add esp, 0x18
push 0x5e9fc4
lea eax, [ebp - 0x638]
push eax
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x471126
mov ecx, dword [ebp - 0x40c]
push ecx
call fcn.005cd459
add esp, 4
jmp 0x471096
jmp 0x47112d
cmp dword [ebp - 4], 0x3e8
jl 0x471162
push 0x5e9fc8
lea edx, [ebp - 0x7b8]
push edx
call fcn.005cc4f5
add esp, 8
push 3
push 4
lea eax, [ebp - 0x7b8]
push eax
call fcn.00461de0
add esp, 0xc
jmp 0x471c48
cmp dword [0x600f80], 8
jne 0x4711d1
mov dword [ebp - 4], 0
jmp 0x47117d
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x100
jge 0x4711cf
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov cl, byte [eax*4 + 0x6b9ee0]
mov byte [ebp + edx*4 - 0x406], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov cl, byte [eax*4 + 0x6b9ee1]
mov byte [ebp + edx*4 - 0x407], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov cl, byte [eax*4 + 0x6b9ee2]
mov byte [ebp + edx*4 - 0x408], cl
mov edx, dword [ebp - 4]
mov byte [ebp + edx*4 - 0x405], 0
jmp 0x471174
jmp 0x471205
cmp dword [0x600f80], 0x10
je 0x4711e3
cmp dword [0x600f80], 0x20
jne 0x471205
mov eax, dword [0x6bbc4c]
mov dword [0x6bc05c], eax
mov ecx, dword [0x6b9ac8]
mov dword [0x6bc060], ecx
mov edx, dword [0x6ba8f4]
mov dword [0x6bc064], edx
cmp dword [0x600f80], 8
jne 0x47121a
mov dword [ebp - 0x524], 0x100
jmp 0x471224
mov dword [ebp - 0x524], 0
push 0x7c
push 0
lea eax, [ebp - 0x6b8]
push eax
call fcn.005cbc50
add esp, 0xc
mov dword [ebp - 0x6b8], 0x7c
push 0
push 1
lea ecx, [ebp - 0x6b8]
push ecx
push 0
mov edx, dword [0x6ba8fc]
mov eax, dword [edx + 8]
mov ecx, dword [0x6ba8fc]
mov edx, dword [ecx + 8]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x64]
call ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x530], eax
je 0x4716a1
push 0
mov edx, dword [0x6ba8fc]
mov eax, dword [edx + 8]
mov ecx, dword [0x6ba8fc]
mov edx, dword [ecx + 8]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x80]
call ecx
mov edx, dword [ebp - 0x530]
mov dword [ebp - 0xa5c], edx
cmp dword [ebp - 0xa5c], 0x887601ae
jg 0x4712ea
cmp dword [ebp - 0xa5c], 0x887601ae
je 0x471369
cmp dword [ebp - 0xa5c], 0x8007000e
je 0x47134c
cmp dword [ebp - 0xa5c], 0x80070057
je 0x47132f
cmp dword [ebp - 0xa5c], 0x88760082
je 0x47130f
jmp 0x4713be
cmp dword [ebp - 0xa5c], 0x887601c2
je 0x471386
cmp dword [ebp - 0xa5c], 0x8876021c
je 0x4713a3
jmp 0x4713be
lea eax, [ebp - 0x638]
push eax
push 0x5e9fe8
lea ecx, [ebp - 0x520]
push ecx
call fcn.005cc4f5
add esp, 0xc
jmp 0x4713be
lea edx, [ebp - 0x638]
push edx
push 0x5ea000
lea eax, [ebp - 0x520]
push eax
call fcn.005cc4f5
add esp, 0xc
jmp 0x4713be
lea ecx, [ebp - 0x638]
push ecx
push 0x5ea018
lea edx, [ebp - 0x520]
push edx
call fcn.005cc4f5
add esp, 0xc
jmp 0x4713be
lea eax, [ebp - 0x638]
push eax
push 0x5ea030
lea ecx, [ebp - 0x520]
push ecx
call fcn.005cc4f5
add esp, 0xc
jmp 0x4713be
lea edx, [ebp - 0x638]
push edx
push 0x5ea048
lea eax, [ebp - 0x520]
push eax
call fcn.005cc4f5
add esp, 0xc
jmp 0x4713be
lea ecx, [ebp - 0x638]
push ecx
push 0x5ea060
lea edx, [ebp - 0x520]
push edx
call fcn.005cc4f5
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x7f8], eax
lea eax, [ebp - 0x7f4]
mov dword [ebp - 0x7bc], eax
mov ecx, dword [ebp - 0x7bc]
mov dword [ecx], 0x28
mov edx, dword [ebp - 0x7bc]
mov dword [edx + 4], 0x280
mov eax, dword [ebp - 0x7bc]
mov dword [eax + 8], 0x1e0
mov ecx, 1
mov edx, dword [ebp - 0x7bc]
mov word [edx + 0xc], cx
mov eax, 0x18
mov ecx, dword [ebp - 0x7bc]
mov word [ecx + 0xe], ax
mov edx, dword [ebp - 0x7bc]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x7bc]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x7bc]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 0x7bc]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp - 0x7bc]
mov dword [eax + 0x20], 0
mov ecx, dword [ebp - 0x7bc]
mov dword [ecx + 0x24], 0
push 0x12c000
call fcn.005ccae8
add esp, 4
mov dword [ebp - 0x528], eax
mov edx, dword [ebp - 0x7f8]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 0
jne 0x4714be
lea eax, [ebp - 0x638]
push eax
push 0x5ea078
lea ecx, [ebp - 0x520]
push ecx
call fcn.005cc4f5
add esp, 0xc
jmp 0x47167a
push 0x1e0
push 0x280
mov edx, dword [ebp - 0x7f8]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 0
jne 0x471509
lea eax, [ebp - 0x638]
push eax
push 0x5ea09c
lea ecx, [ebp - 0x520]
push ecx
call fcn.005cc4f5
add esp, 0xc
jmp 0x47167a
mov edx, dword [ebp - 0x7c8]
push edx
mov eax, dword [ebp - 0x7c0]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x7c4], eax
push 0xcc0020
mov ecx, dword [ebp - 0x414]
push ecx
mov edx, dword [ebp - 0x418]
push edx
mov eax, dword [ebp - 0x7f8]
push eax
push 0x1e0
push 0x280
push 0
push 0
mov ecx, dword [ebp - 0x7c0]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x471581
lea edx, [ebp - 0x638]
push edx
push 0x5ea0c0
lea eax, [ebp - 0x520]
push eax
call fcn.005cc4f5
add esp, 0xc
jmp 0x47167a
mov ecx, dword [ebp - 0x7c4]
push ecx
mov edx, dword [ebp - 0x7c0]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
lea eax, [ebp - 0x7f4]
push eax
mov ecx, dword [ebp - 0x528]
push ecx
push 0x1e0
push 0
mov edx, dword [ebp - 0x7c8]
push edx
mov eax, dword [ebp - 0x7c0]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x4715e9
lea ecx, [ebp - 0x638]
push ecx
push 0x5ea0e4
lea edx, [ebp - 0x520]
push edx
call fcn.005cc4f5
add esp, 0xc
jmp 0x47167a
mov eax, dword [ebp - 0x7c8]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0x7c0]
push ecx
mov edx, dword [0x9cef70]
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x7f8]
push eax
mov ecx, dword [0x9cef70]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
lea edx, [ebp - 0x638]
push edx
push 0x1e0
push 0x280
mov eax, dword [ebp - 0x528]
push eax
call fcn.004722d0
add esp, 0x10
test eax, eax
je 0x47165f
lea ecx, [ebp - 0x638]
push ecx
push 0x5ea108
lea edx, [ebp - 0x520]
push edx
call fcn.005cc4f5
add esp, 0xc
jmp 0x47167a
lea eax, [ebp - 0x638]
push eax
push 0x5ea120
lea ecx, [ebp - 0x520]
push ecx
call fcn.005cc4f5
add esp, 0xc
push 3
push 4
lea edx, [ebp - 0x520]
push edx
call fcn.00461de0
add esp, 0xc
mov eax, dword [ebp - 0x528]
push eax
call fcn.005cbb3c
add esp, 4
jmp 0x471c48
push 0x12c000
call fcn.005ccae8
add esp, 4
mov dword [ebp - 0x52c], eax
push 0x12c000
call fcn.005ccae8
add esp, 4
mov dword [ebp - 0x528], eax
mov ecx, dword [ebp - 0x6a8]
imul ecx, dword [ebp - 0x414]
add ecx, dword [ebp - 0x694]
mov edx, dword [0x600f80]
sar edx, 3
imul edx, dword [ebp - 0x418]
add ecx, edx
mov dword [ebp - 0x7fc], ecx
mov eax, dword [0x600f80]
sar eax, 3
imul eax, eax, 0x280
mov dword [ebp - 0x800], eax
mov dword [ebp - 4], 0
jmp 0x471718
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x1e0
jge 0x47175c
mov edx, dword [ebp - 0x800]
push edx
mov eax, dword [ebp - 0x7fc]
push eax
mov ecx, dword [ebp - 0x800]
imul ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x52c]
push ecx
call fcn.005cc190
add esp, 0xc
mov edx, dword [ebp - 0x7fc]
add edx, dword [ebp - 0x6a8]
mov dword [ebp - 0x7fc], edx
jmp 0x47170f
push 0
mov eax, dword [0x6ba8fc]
mov ecx, dword [eax + 8]
mov edx, dword [0x6ba8fc]
mov eax, dword [edx + 8]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x80]
call edx
test eax, eax
je 0x4717a1
mov eax, dword [ebp - 0x52c]
push eax
call fcn.005cbb3c
add esp, 4
mov ecx, dword [ebp - 0x528]
push ecx
call fcn.005cbb3c
add esp, 4
jmp 0x471c48
mov edx, dword [0x600f80]
mov dword [ebp - 0xa60], edx
cmp dword [ebp - 0xa60], 0x10
je 0x4717d5
cmp dword [ebp - 0xa60], 0x18
je 0x47193c
cmp dword [ebp - 0xa60], 0x20
je 0x471a7c
jmp 0x471ba8
mov dword [ebp - 0x818], 0x780
mov eax, dword [ebp - 0x818]
imul eax, eax, 0x1e0
add eax, dword [ebp - 0x528]
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x52c]
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x81c], 0
jmp 0x47181e
mov edx, dword [ebp - 0x81c]
add edx, 1
mov dword [ebp - 0x81c], edx
cmp dword [ebp - 0x81c], 0x1e0
jge 0x471937
mov eax, dword [ebp - 0x804]
sub eax, dword [ebp - 0x818]
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
mov dword [ebp - 0x814], ecx
mov edx, dword [ebp - 0x808]
mov dword [ebp - 0x810], edx
mov dword [ebp - 0x80c], 0
jmp 0x471873
mov eax, dword [ebp - 0x80c]
add eax, 1
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0x280
jge 0x471920
mov ecx, dword [ebp - 0x80c]
mov edx, dword [ebp - 0x810]
movzx eax, word [edx + ecx*2]
mov ecx, dword [0x6ba6ec]
sar eax, cl
mov ecx, dword [0x6b9acc]
shl eax, cl
mov ecx, dword [ebp - 0x80c]
imul ecx, ecx, 3
mov edx, dword [ebp - 0x814]
mov byte [edx + ecx + 2], al
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp - 0x810]
movzx edx, word [ecx + eax*2]
mov ecx, dword [0x6ba2e0]
sar edx, cl
mov ecx, dword [0x6bc068]
shl edx, cl
mov eax, dword [ebp - 0x80c]
imul eax, eax, 3
mov ecx, dword [ebp - 0x814]
mov byte [ecx + eax + 1], dl
mov edx, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x810]
movzx edx, word [eax + edx*2]
mov ecx, dword [0x6bbc54]
sar edx, cl
mov ecx, dword [0x6bc058]
shl edx, cl
mov eax, dword [ebp - 0x80c]
imul eax, eax, 3
mov ecx, dword [ebp - 0x814]
mov byte [ecx + eax], dl
jmp 0x471864
mov edx, dword [ebp - 0x808]
add edx, 0x500
mov dword [ebp - 0x808], edx
jmp 0x47180f
jmp 0x471ba8
mov dword [ebp - 0x830], 0x780
mov eax, dword [ebp - 0x830]
imul eax, eax, 0x1e0
add eax, dword [ebp - 0x528]
mov dword [ebp - 0x820], eax
mov ecx, dword [ebp - 0x52c]
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x838], 0
jmp 0x471985
mov edx, dword [ebp - 0x838]
add edx, 1
mov dword [ebp - 0x838], edx
cmp dword [ebp - 0x838], 0x1e0
jge 0x471a72
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x830]
mov dword [ebp - 0x820], eax
mov ecx, dword [ebp - 0x820]
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x824]
mov dword [ebp - 0x834], edx
mov dword [ebp - 0x828], 0
jmp 0x4719da
mov eax, dword [ebp - 0x828]
add eax, 1
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0x280
jge 0x471a5b
mov ecx, dword [ebp - 0x828]
imul ecx, ecx, 3
mov edx, dword [ebp - 0x828]
imul edx, edx, 3
mov eax, dword [ebp - 0x82c]
mov esi, dword [ebp - 0x834]
mov cl, byte [esi + ecx]
mov byte [eax + edx + 2], cl
mov edx, dword [ebp - 0x828]
imul edx, edx, 3
mov eax, dword [ebp - 0x828]
imul eax, eax, 3
mov ecx, dword [ebp - 0x82c]
mov esi, dword [ebp - 0x834]
mov dl, byte [esi + edx + 1]
mov byte [ecx + eax + 1], dl
mov eax, dword [ebp - 0x828]
imul eax, eax, 3
mov ecx, dword [ebp - 0x828]
imul ecx, ecx, 3
mov edx, dword [ebp - 0x82c]
mov esi, dword [ebp - 0x834]
mov al, byte [esi + eax + 2]
mov byte [edx + ecx], al
jmp 0x4719cb
mov ecx, dword [ebp - 0x824]
add ecx, 0x780
mov dword [ebp - 0x824], ecx
jmp 0x471976
jmp 0x471ba8
mov dword [ebp - 0x850], 0x780
mov edx, dword [ebp - 0x850]
imul edx, edx, 0x1e0
add edx, dword [ebp - 0x528]
mov dword [ebp - 0x83c], edx
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x854], 0
jmp 0x471ac5
mov ecx, dword [ebp - 0x854]
add ecx, 1
mov dword [ebp - 0x854], ecx
cmp dword [ebp - 0x854], 0x1e0
jge 0x471ba8
mov edx, dword [ebp - 0x83c]
sub edx, dword [ebp - 0x850]
mov dword [ebp - 0x83c], edx
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x84c], eax
mov ecx, dword [ebp - 0x840]
mov dword [ebp - 0x848], ecx
mov dword [ebp - 0x844], 0
jmp 0x471b1a
mov edx, dword [ebp - 0x844]
add edx, 1
mov dword [ebp - 0x844], edx
cmp dword [ebp - 0x844], 0x280
jge 0x471b92
mov eax, dword [ebp - 0x844]
imul eax, eax, 3
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ebp - 0x844]
mov esi, dword [ebp - 0x848]
mov dl, byte [esi + edx*4 + 2]
mov byte [ecx + eax + 2], dl
mov eax, dword [ebp - 0x844]
imul eax, eax, 3
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ebp - 0x844]
mov esi, dword [ebp - 0x848]
mov dl, byte [esi + edx*4 + 1]
mov byte [ecx + eax + 1], dl
mov eax, dword [ebp - 0x844]
imul eax, eax, 3
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ebp - 0x844]
mov esi, dword [ebp - 0x848]
mov dl, byte [esi + edx*4]
mov byte [ecx + eax], dl
jmp 0x471b0b
mov eax, dword [ebp - 0x840]
add eax, 0xa00
mov dword [ebp - 0x840], eax
jmp 0x471ab6
lea ecx, [ebp - 0x638]
push ecx
push 0x1e0
push 0x280
mov edx, dword [ebp - 0x528]
push edx
call fcn.004722d0
add esp, 0x10
test eax, eax
je 0x471bfc
lea eax, [ebp - 0x638]
push eax
push 0x5ea144
lea ecx, [ebp - 0x958]
push ecx
call fcn.005cc4f5
add esp, 0xc
push 3
push 4
lea edx, [ebp - 0x958]
push edx
call fcn.00461de0
add esp, 0xc
jmp 0x471c2a
lea eax, [ebp - 0x638]
push eax
push 0x5ea158
lea ecx, [ebp - 0xa58]
push ecx
call fcn.005cc4f5
add esp, 0xc
push 3
push 4
lea edx, [ebp - 0xa58]
push edx
call fcn.00461de0
add esp, 0xc
mov eax, dword [ebp - 0x52c]
push eax
call fcn.005cbb3c
add esp, 4
mov ecx, dword [ebp - 0x528]
push ecx
call fcn.005cbb3c
add esp, 4
pop esi
mov ecx, dword [ebp - 0x41c]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret