Function at 0x40149a
Capabilities:
Capture screenshot

Disassembly:
push 0xffffffffffffffff
push 0x40a270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CDC::CDC
xor ebx, ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], ebx
call sub.MFC42.DLL_CDC::CDC
push ebx
push ebx
push ebx
push str.DISPLAY
mov byte [esp + 0x4c], 1
call dword [sym.imp.GDI32.dll_CreateDCA]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CDC::Attach
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
mov edx, dword [esi + 0x40c]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 0x410]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, dword [esp + 0x18]
mov edi, eax
lea eax, [esp + 0x14]
neg eax
sbb eax, eax
and eax, ebp
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CDC::Attach
cmp edi, ebx
je 0x40152d
mov eax, dword [esp + 0x28]
push edi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
jmp 0x401531
mov dword [esp + 0x10], ebx
mov ebp, dword [esp + 0x18]
mov ecx, dword [esi + 0x410]
mov edx, dword [esi + 0x40c]
lea eax, [esp + 0x14]
neg eax
sbb eax, eax
push 0xcc0020
and eax, ebp
push ebx
push ebx
push eax
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push ebx
push ebx
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ebp, dword [sym.imp.USER32.dll_CopyImage]
push 4
push ebx
push ebx
push ebx
push edi
call ebp
push 4
push ebx
push ebx
push ebx
push edi
mov dword [esi + 0x268], eax
call ebp
mov dword [esi + 0x26c], eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push 0xb6
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 4
push ebx
push ebx
push ebx
push edi
mov dword [esi + 0x270], eax
call ebp
lea ebx, [esi + 0x288]
push esi
push 0xbf
mov ecx, ebx
mov dword [esi + 0x2f0], eax
call sub.MFC42.DLL_CDialog::Create
push 1
push 0
push 0
push 0
push 0
mov ecx, ebx
call sub.MFC42.DLL_CWnd::MoveWindow
push 5
mov ecx, ebx
call sub.MFC42.DLL_CWnd::ShowWindow
mov edx, dword [esi + 0x40c]
mov eax, dword [esi + 0x410]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x2e8], edx
mov dword [esi + 0x2ec], eax
mov ecx, dword [esi + 0x214]
push 0
push 0
push 0x173
push ecx
call ebx
push 4
push 0
push 0
push 0
push edi
mov dword [esi + 0x280], eax
call ebp
push eax
push 0
mov edx, dword [esi + 0x214]
push 0x172
push edx
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401643
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
mov eax, dword [esp + 0x2c]
push eax
call ebx
jmp 0x40164b
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x24]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
test eax, eax
mov dword [esi + 0x234], eax
je 0x401684
mov eax, dword [eax + 4]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
call edi
push eax
lea ecx, [esi + 0x238]
call sub.MFC42.DLL_CDC::Attach
mov eax, dword [esi + 0x234]
test eax, eax
je 0x4016a6
mov eax, dword [eax + 4]
push eax
call edi
push eax
lea ecx, [esi + 0x248]
call sub.MFC42.DLL_CDC::Attach
mov eax, dword [esi + 0x234]
test eax, eax
je 0x4016c2
mov eax, dword [eax + 4]
push eax
call edi
push eax
lea ecx, [esi + 0x258]
call sub.MFC42.DLL_CDC::Attach
mov eax, dword [esi + 0x268]
test eax, eax
je 0x4016e7
mov edx, dword [esi + 0x23c]
push eax
push edx
call ebx
jmp 0x4016e9
xor eax, eax
mov dword [esi + 0x274], eax
mov eax, dword [esi + 0x26c]
test eax, eax
je 0x401705
push eax
mov eax, dword [esi + 0x24c]
push eax
call ebx
jmp 0x401707
xor eax, eax
mov dword [esi + 0x278], eax
mov eax, dword [esi + 0x270]
test eax, eax
je 0x401723
mov ecx, dword [esi + 0x25c]
push eax
push ecx
call ebx
jmp 0x401725
xor eax, eax
lea ecx, [esp + 0x24]
mov dword [esi + 0x27c], eax
mov byte [esp + 0x3c], 0
call fcn.00409b5e
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00409b5e
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret