Function at 0x40bc6a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push esi
push edi
push ebx
push ecx
cmp word [0x47615c], 0xffff
jne 0x40bca5
push 0x40
push 0x442440
push str.Frame_limit_has_been_exceeded._Recording_has_been_terminated.
push dword [0x49ff24]
call fcn.0043d57a
mov byte [0x47615e], 0
pop ecx
pop ebx
pop edi
pop esi
leave
ret
mov esi, dword [0x4a0bd0]
add esi, 0x32b40
lea edi, [0x4c744e]
mov ebx, 0x10101010
push 0x128
push esi
mov ecx, 0xb0
mov eax, dword [esi]
sub eax, ebx
mov dword [edi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x40bcc7
pop esi
sub esi, 0x2c0
dec dword [esp]
jne 0x40bcc1
add esp, 4
lea eax, [ebp - 0x40c]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.00401000
mov ax, word [0x47615c]
push esi
mov esi, dword [ebp - 0x410]
mov byte [esi + 0x404], 1
mov byte [esi + 0x405], 0x30
call fcn.00401101
pop esi
push edi
mov edi, dword [ebp - 0x410]
push 4
push str..bmpError_recording_frame_bitmap
push edi
call fcn.00401215
pop edi
push dword [0x4c73d4]
lea eax, [ebp - 0x40c]
push eax
call fcn.0043f840
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x4fa24e
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x40bd8d
mov dword [ebp - 4], eax
push 0
push 0x49ffbc
push 0x32e76
push 0x4c73d8
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
jmp 0x40bdab
push 0x40
push 0x442440
push 0x4761ec
push dword [0x49ff24]
call fcn.0043d57a
mov byte [0x47615e], 0
inc word [0x47615c]
pop ecx
pop ebx
pop edi
pop esi
leave
ret

Function at 0x40bf79
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x4fa730], 1
jne 0x40c043
mov byte [0x44d014], 1
call fcn.0040c406
call fcn.0040bf50
call fcn.0040bdc0
push 0x10
push 0xffffffffffffffec
push dword [0x49ff24]
call sub.user32.dll_SetWindowLongA
push 0x90cf0000
push 0xfffffffffffffff0
push dword [0x49ff24]
call sub.user32.dll_SetWindowLongA
push 5
push dword [0x4a0c04]
call sub.user32.dll_ShowWindow
push 5
push dword [0x4a0c08]
call sub.user32.dll_ShowWindow
mov ecx, dword [0x4a0b68]
sub ecx, dword [0x4a0b60]
mov edx, dword [0x4a0b6c]
sub edx, dword [0x4a0b64]
push 1
push edx
push ecx
push dword [0x4a0b64]
push dword [0x4a0b60]
push dword [0x49ff24]
call sub.user32.dll_MoveWindow
mov dword [0x4fa730], 0
push dword [0x49ff24]
call fcn.0040c0eb
mov byte [0x44d014], 0
push 5
push dword [0x49ff24]
call sub.user32.dll_ShowWindow
call fcn.0040d130
call fcn.00405790
ret
push 0
push dword [0x4a0c04]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4a0c08]
call sub.user32.dll_ShowWindow
call fcn.0040a219
mov byte [0x44d014], 1
call fcn.0040c406
call fcn.0040bf50
call fcn.0040bdc0
push 0x4a0b60
push dword [0x49ff24]
call sub.user32.dll_GetWindowRect
push 8
push 0xffffffffffffffec
push dword [0x49ff24]
call sub.user32.dll_SetWindowLongA
push 0x90000000
push 0xfffffffffffffff0
push dword [0x49ff24]
call sub.user32.dll_SetWindowLongA
push 1
push 0x1e0
push 0x280
push 0
push 0
push dword [0x49ff24]
call sub.user32.dll_MoveWindow
mov dword [0x4fa730], 1
push dword [0x49ff24]
call fcn.0040c0eb
mov byte [0x44d014], 0
call fcn.0040d130
call fcn.00405790
ret