Function at 0x6ad11c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x371], 1
xor eax, eax
push ebp
push 0x6ad4f7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
call fcn.0048dda8
push eax
call sub.user32.dll_BeginPaint
xor eax, eax
push ebp
push 0x6ad4d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x64]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00486de8
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
call fcn.0048dda8
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00486de8
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x378]
sub al, 1
jb 0x6ad21b
je 0x6ad2ea
jmp 0x6ad376
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
pop edx
mov ecx, edx
cdq
idiv ecx
test eax, eax
jl 0x6ad416
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00486de8
pop edx
mov ecx, edx
cdq
idiv ecx
mov esi, eax
test esi, esi
jl 0x6ad2d9
inc esi
xor edi, edi
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.00435c54
call fcn.00430cd8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x20]
imul edi
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x20]
push eax
push ebx
call sub.gdi32.dll_BitBlt
inc edi
dec esi
jne 0x6ad271
inc dword [ebp - 0x20]
dec dword [ebp - 0x24]
jne 0x6ad24b
jmp 0x6ad416
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00486de8
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.00435c54
call fcn.00430cd8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00486de8
pop edx
sub eax, edx
push eax
push 0
push ebx
call sub.gdi32.dll_BitBlt
jmp 0x6ad416
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00486de8
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.00435c54
call fcn.00430cd8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00486de8
pop edx
sub eax, edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
pop edx
sub eax, edx
push eax
push ebx
call sub.gdi32.dll_BitBlt
mov eax, 0xff000005
call fcn.0042f29c
push eax
mov eax, dword [ebp - 4]
call fcn.00486de8
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00486de8
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
push eax
push 0
push 0
push ebx
call sub.msimg32.dll_TransparentBlt
push 0xcc0020
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
call fcn.00486de8
push eax
mov eax, dword [ebp - 4]
call fcn.00486da4
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x1c]
push eax
push ebx
call sub.gdi32.dll_SelectObject
push ebx
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x14]
push eax
call sub.gdi32.dll_DeleteObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ad4df
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
call fcn.0048dda8
push eax
call sub.user32.dll_EndPaint
ret