Function at 0x41d770
Capabilities:
Capture screenshot
Enumerate gui resources

Disassembly:
sub esp, 0x250
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor edi, edi
mov dword [ebp + 0x74], edi
call fcn.0043c700
mov esi, 1
cmp eax, esi
je 0x41d7ab
call fcn.0043c700
cmp eax, 2
jne 0x41d941
mov ecx, ebp
call fcn.0041cf00
test eax, eax
je 0x41d941
push 0x9c
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.0045c220
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0xffffffffffffffff
push edi
mov word [esp + 0x48], 0x9c
mov word [esp + 0x4a], di
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
push str.USER32
mov dword [esp + 0x44], 0x1c0000
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.EnumDisplayDevicesA
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, edi
je 0x41d92b
push 0x1a8
lea edx, [esp + 0xb8]
push edi
push edx
call fcn.0045c220
add esp, 0xc
push edi
lea eax, [esp + 0xb8]
push eax
push edi
push edi
mov dword [esp + 0xc4], 0x1a8
mov byte [esp + 0x28], 0
mov dword [esp + 0x20], edi
call ebx
test eax, eax
je 0x41d92b
jmp 0x41d860
xor edx, edx
mov edi, str.mv_video_hook_driver2
lea esi, [esp + 0xd8]
mov ecx, 0x16
repe cmpsb byte [esi], byte es:[edi]
push edx
je 0x41d898
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xb8]
add eax, 1
push ecx
push eax
push edx
mov dword [esp + 0x20], eax
call ebx
test eax, eax
jne 0x41d860
jmp 0x41d92b
push 0
lea edx, [esp + 0xc0]
push edx
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp + 0xdbcc], eax
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0xc0]
push ecx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
cmp dword [ebp + 0xdbcc], 0
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov dword [ebp + 0x6c], edx
mov dword [ebp + 0x70], eax
mov esi, 1
je 0x41d8e7
mov dword [ebp + 0x74], esi
mov ecx, ebp
call fcn.00439bf0
lea ecx, [ebp + 4]
call fcn.0040f2e0
cmp eax, 2
mov dword [ebp + 0xe1dc], eax
mov dword [ebp + 0xe1d8], esi
jne 0x41d917
cmp dword [ebp + 0xe1d4], esi
jle 0x41d92b
mov dword [ebp + 0xe1d8], eax
jmp 0x41d92b
cmp eax, 3
jne 0x41d92b
cmp dword [ebp + 0xe1d4], 1
jle 0x41d92b
mov dword [ebp + 0xe1d8], eax
mov eax, dword [esp + 0x14]
xor edi, edi
cmp eax, edi
je 0x41d93c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, 1
mov ecx, dword [ebp + 0xdbb0]
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
test eax, eax
je 0x41d963
cmp dword [ebp + 0x64], edi
jne 0x41d963
push ebp
push 0x41b8d0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp + 0xdbcc], edi
jne 0x41da8a
push str.._vncdesktop.cpp_:_No_driver_used__n
push edi
push 0x490660
call fcn.00401810
add esp, 0xc
mov ecx, ebp
call fcn.00439bf0
lea ecx, [ebp + 4]
call fcn.0040f2e0
cmp eax, 2
mov dword [ebp + 0xe1dc], eax
mov dword [ebp + 0xe1d8], esi
jne 0x41d9b2
cmp dword [ebp + 0xe1d4], esi
jle 0x41d9c5
mov dword [ebp + 0xe1d8], eax
jmp 0x41d9c5
cmp eax, 3
jne 0x41d9c5
cmp dword [ebp + 0xe1d4], esi
jle 0x41d9c5
mov dword [ebp + 0xe1d8], eax
mov ebx, 3
cmp dword [ebp + 0xe1d8], ebx
jne 0x41d9d8
mov dword [ebp + 0xe1d8], esi
cmp dword [ebp + 0xe1d8], esi
jne 0x41da0c
push edi
push edi
lea ecx, [ebp + 0xe144]
push ecx
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov edx, dword [ebp + 0xe164]
mov dword [ebp + 0xdbcc], eax
mov eax, dword [ebp + 0xe168]
mov dword [ebp + 0x6c], edx
mov dword [ebp + 0x70], eax
cmp dword [ebp + 0xe1d8], 2
jne 0x41da41
push edi
push edi
lea ecx, [ebp + 0xe178]
push ecx
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov edx, dword [ebp + 0xe198]
mov dword [ebp + 0xdbcc], eax
mov eax, dword [ebp + 0xe19c]
mov dword [ebp + 0x6c], edx
mov dword [ebp + 0x70], eax
cmp dword [ebp + 0xe1d8], ebx
jne 0x41da68
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebp + 0xe1cc]
mov edx, dword [ebp + 0xe1d0]
mov dword [ebp + 0xdbcc], eax
mov dword [ebp + 0x6c], ecx
mov dword [ebp + 0x70], edx
cmp dword [ebp + 0xdbcc], edi
jne 0x41da8a
push str.._vncdesktop.cpp_:_Failed_m_rootdc__n
push edi
push 0x490660
call fcn.00401810
add esp, 0xc
xor eax, eax
jmp 0x41dca4
cmp dword [ebp + 0xe1d8], 3
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
jne 0x41dac6
mov ecx, ebp
call fcn.0041cf00
test eax, eax
jne 0x41dac6
mov edx, dword [ebp + 0xe1a0]
mov esi, dword [ebp + 0xe1a4]
xor ecx, ecx
mov dword [ebp + 0xdbec], eax
mov dword [ebp + 0xdbf0], ecx
mov dword [ebp + 0xdbf4], edx
jmp 0x41daf2
mov eax, dword [ebp + 0xdbcc]
push 0xa
push eax
call ebx
mov ecx, dword [ebp + 0xdbcc]
push 8
push ecx
mov esi, eax
call ebx
mov dword [ebp + 0xdbec], edi
xor ecx, ecx
mov dword [ebp + 0xdbf0], ecx
mov dword [ebp + 0xdbf4], eax
mov edx, esi
push edx
mov dword [ebp + 0xdbf8], esi
mov eax, dword [ebp + 0xdbf4]
push eax
push str.._vncdesktop.cpp_:_bitmap_dimensions_are__d_x__d_n
push 9
push 0x490660
call fcn.00401810
mov ecx, dword [ebp + 0xdbcc]
add esp, 0x14
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
test eax, eax
mov dword [ebp + 0xdbc8], eax
jne 0x41db4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.._vncdesktop.cpp_:_failed_to_create_compatibleDC__d__n
push 0
push 0x490660
call fcn.00401810
add esp, 0x10
xor eax, eax
jmp 0x41dca4
mov edx, dword [ebp + 0xdbcc]
push 0x26
push edx
call ebx
test al, 1
je 0x41da83
mov eax, dword [ebp + 0xdbc8]
push 0x26
push eax
call ebx
test al, al
jns 0x41da83
mov ecx, dword [ebp + 0xdbf8]
mov edx, dword [ebp + 0xdbf4]
mov eax, dword [ebp + 0xdbcc]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp + 0xdbd0], eax
jne 0x41dba8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.._vncdesktop.cpp_:_failed_to_create_memory_bitmap__d__n
jmp 0x41db39
push str.._vncdesktop.cpp_:_created_memory_bitmap_n
push 9
push 0x490660
call fcn.00401810
push 0x430
lea edi, [ebp + 0xdbfc]
push 0
push edi
call fcn.0045c220
mov ecx, dword [ebp + 0xdbd0]
mov edx, dword [ebp + 0xdbc8]
add esp, 0x18
push 0
lea esi, [ebp + 0xdc00]
push esi
push 0
push 1
push 0
push ecx
push edx
mov dword [esi], 0x28
mov word [ebp + 0xdc0e], 0
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x41dc1f
push str.._vncdesktop.cpp_:_unable_to_get_display_format_n
push eax
push 0x490660
call fcn.00401810
add esp, 0xc
xor eax, eax
jmp 0x41dca4
mov eax, dword [ebp + 0xdbd0]
mov ecx, dword [ebp + 0xdbc8]
push 0
push esi
push 0
push 1
push 0
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x41dc57
push str.._vncdesktop.cpp_:_unable_to_get_display_colour_info_n
push eax
push 0x490660
call fcn.00401810
add esp, 0xc
xor eax, eax
jmp 0x41dca4
push str.._vncdesktop.cpp_:_got_bitmap_format_n
push 9
push 0x490660
call fcn.00401810
mov eax, dword [ebp + 0xdc08]
cdq
xor eax, edx
add esp, 0xc
sub eax, edx
mov edx, dword [ebp + 0xdbc8]
push 0x26
neg eax
push edx
mov dword [ebp + 0xdc08], eax
call ebx
shr eax, 8
push 1
not eax
push 0
and eax, 1
push 0
mov dword [edi], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045c20d
add esp, 0x250
ret