Function at 0x100117b0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x88
mov eax, dword [0x1001f2b8]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x90]
push ebx
push esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x10011818
pop esi
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.10008464
add esp, 0x88
ret
push ebp
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x10011a6e
push edi
push 0x10
lea edx, [esp + 0x40]
push edx
call sub.NTDLL.dll_RtlZeroMemory
lea eax, [esp + 0x3c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edi
mov esi, eax
mov dword [esp + 0x10], 0
cmp eax, 0x640
jg 0x10011870
cmp edi, 0x640
jle 0x100118b4
movsd xmm1, qword [0x10019a40]
xorps xmm2, xmm2
movapd xmm0, xmm1
xorps xmm3, xmm3
cvtsi2sd xmm2, eax
cvtsi2sd xmm3, edi
divsd xmm0, xmm2
divsd xmm1, xmm3
comisd xmm0, xmm1
jbe 0x1001189c
movapd xmm0, xmm1
mulsd xmm2, xmm0
mulsd xmm3, xmm0
cvttsd2si esi, xmm2
cvttsd2si edi, xmm3
mov dword [esp + 0x10], 1
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x20], eax
test eax, eax
je 0x10011a62
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x10011a57
cmp eax, 0xffffffff
je 0x10011a57
cmp dword [esp + 0x10], 0
je 0x1001191b
push 4
push ebp
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
push 0x40cc0020
push ecx
mov ecx, dword [esp + 0x44]
push edx
push 0
push 0
push ebx
push edi
push esi
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x10011938
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
push 0x40cc0020
push 0
push 0
push ebx
push edi
push esi
push edx
push eax
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x10011a57
push 0
push 0
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ebx, eax
test ebx, ebx
je 0x10011a53
push ebx
push edi
lea ecx, [esp + 0x28]
push esi
push ecx
call fcn.1000cf20
add esp, 0x10
test eax, eax
je 0x10011a4b
push 0x48
lea edx, [esp + 0x50]
push edx
call sub.NTDLL.dll_RtlZeroMemory
mov eax, dword [ebx]
mov edx, dword [eax + 0x30]
push 1
lea ecx, [esp + 0x50]
push ecx
push ebx
call edx
test eax, eax
js 0x10011a4b
mov ebp, dword [esp + 0x54]
test ebp, ebp
je 0x10011a47
push 4
push 0x1000
push ebp
push 0
call fcn.10010af0
mov edi, eax
test edi, edi
je 0x10011a47
push 8
lea eax, [esp + 0x28]
push eax
call sub.NTDLL.dll_RtlZeroMemory
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x14]
push 0
xorpd xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push 0
push edx
push eax
push ebx
call ecx
test eax, eax
js 0x10011a3a
xor esi, esi
test ebp, ebp
je 0x10011a3a
lea ebx, [ebx]
mov edx, dword [ebx]
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
sub ecx, esi
push ecx
mov ecx, dword [edx + 0xc]
lea eax, [esi + edi]
push eax
push ebx
mov dword [esp + 0x20], 0
call ecx
test eax, eax
js 0x10011a20
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10011a20
add esi, eax
cmp esi, ebp
jb 0x100119f0
test esi, esi
je 0x10011a3a
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov dword [edx], esi
mov dword [eax], edi
mov dword [esp + 0x1c], 1
jmp 0x10011a47
push 0x8000
push 0
push edi
call fcn.1000d1a0
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebx]
mov edx, dword [ecx + 8]
push ebx
call edx
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [esp + 0x30]
pop edi
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x90]
mov eax, dword [esp + 0x18]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.10008464
add esp, 0x88
ret