Function at 0x42aaa0
Capabilities:
Capture screenshot
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xe0f4]
push edi
xor edi, edi
mov dword [esi + 0x84], edi
cmp eax, edi
je 0x42acac
cmp dword [eax + 8], edi
jne 0x42aae9
mov eax, 1
mov dword [esi + 0xe124], eax
mov dword [esi + 0xe128], eax
jmp 0x42acac
push 0x9c
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.004b2d10
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x84], 0x9c
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
push str.USER32
mov dword [ebp - 0x80], 0x1c0000
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x254], eax
cmp eax, edi
je 0x42acac
push str.EnumDisplayDevicesA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, edi
je 0x42ac9f
push 0x1a8
lea ecx, [ebp - 0x250]
push edi
push ecx
call fcn.004b2d10
add esp, 0xc
push 0
lea edx, [ebp - 0x250]
push edx
push 0
push 0
mov dword [ebp - 0x250], 0x1a8
mov byte [ebp - 0xa8], 0
call ebx
test eax, eax
je 0x42ac9f
jmp 0x42ab90
mov ecx, str.mv_video_hook_driver2
lea eax, [ebp - 0x22c]
jmp 0x42aba0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42abc0
test dl, dl
je 0x42abbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42abc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x42aba0
xor eax, eax
jmp 0x42abc5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42abe1
push 0
lea eax, [ebp - 0x250]
push eax
inc edi
push edi
push 0
call ebx
test eax, eax
jne 0x42ab90
jmp 0x42ac9f
mov eax, dword [esi + 0xdc1c]
test eax, eax
je 0x42ac21
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test eax, eax
jne 0x42ac0a
push str.vncdesktop.cpp_:_failed_to_DeleteDC_hrootdc_n
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
mov ecx, dword [esi + 0xdc1c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0xdc1c], 0
push 0
push 0
lea edx, [ebp - 0x24c]
push edx
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [esi + 0xdc1c], eax
lea eax, [ebp - 0xa8]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
cmp dword [esi + 0xdc1c], 0
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov dword [esi + 0x74], edx
mov dword [esi + 0x78], eax
je 0x42ac72
mov dword [esi + 0x84], 1
call fcn.0044d180
cmp dword [esi + 0x14], 0
mov byte [esi + 0xe288], 0
sete al
mov byte [esi + 0xe289], al
test al, al
je 0x42ac9f
cmp dword [esi + 0xe284], 1
jle 0x42ac9f
mov byte [esi + 0xe288], 1
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esi + 0xdc00]
mov edx, dword [ecx]
mov eax, dword [edx + 0x70]
call eax
test eax, eax
je 0x42accf
cmp dword [esi + 0x6c], 0
jne 0x42accf
push esi
push 0x42aa00
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esi + 0xdc1c], 0
jne 0x42ad53
push str.vncdesktop.cpp_:_No_driver_used__n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
call fcn.0044d180
cmp dword [esi + 0x14], 0
mov byte [esi + 0xe288], 0
sete al
mov byte [esi + 0xe289], al
test al, al
je 0x42ad19
cmp dword [esi + 0xe284], 1
jle 0x42ad19
mov byte [esi + 0xe288], 1
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0xdc1c], eax
test eax, eax
jne 0x42ad53
push str.vncdesktop.cpp_:_Failed_m_rootdc__n
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
mov eax, 6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0xe288], 0
mov edx, dword [esi + 0xe27c]
mov ebx, dword [esi + 0xe280]
mov eax, dword [esi + 0xe250]
mov ecx, dword [esi + 0xe254]
mov dword [esi + 0x74], edx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], ecx
je 0x42ae39
mov edi, dword [esi + 0xe0f4]
test edi, edi
je 0x42adac
cmp dword [edi + 8], 0
jne 0x42ae39
mov edx, 1
mov dword [esi + 0xe124], edx
mov dword [esi + 0xe128], edx
xor edx, edx
xor ebx, ebx
mov dword [esi + 0xdc3c], edx
mov dword [esi + 0xdc40], ebx
mov dword [esi + 0xdc44], eax
mov dword [esi + 0xdc48], ecx
mov eax, dword [esi + 0xdc48]
mov ecx, dword [esi + 0xdc44]
push eax
push ecx
push str.vncdesktop.cpp_:_bitmap_dimensions_are__d_x__d_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
mov edx, dword [esi + 0xdc1c]
add esp, 0xc
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0xdc18], eax
test eax, eax
jne 0x42ae9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.vncdesktop.cpp_:_failed_to_create_compatibleDC__d__n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 8
mov eax, 6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 0xe0f4]
test edi, edi
je 0x42ae5e
cmp dword [edi + 8], 0
jne 0x42adb0
mov eax, 1
mov dword [esi + 0xe124], eax
mov dword [esi + 0xe128], eax
mov edx, dword [esi + 0xe1b4]
mov ebx, dword [esi + 0xe1b8]
xor eax, eax
xor ecx, ecx
mov dword [esi + 0xdc3c], eax
mov dword [esi + 0xdc40], ecx
mov ecx, dword [esi + 0xe1e0]
mov dword [esi + 0xdc44], edx
mov edx, dword [esi + 0xe1e4]
mov dword [esi + 0xdc48], ebx
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], edx
jmp 0x42adc8
mov eax, dword [esi + 0xdc1c]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x26
push eax
call edi
test al, 1
jne 0x42aedf
push 0x4d8a6c
push str.vncDesktop_:_root_device_doesnt_support_BitBlt_nWinVNC_cannot_be_used_with_this_graphic_device_driver
mov eax, 0x10
call fcn.00409310
add esp, 8
mov eax, 7
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xdc18]
push 0x26
push ecx
call edi
test al, al
js 0x42af1b
push 0x4d8a6c
push str.vncDesktop_:_memory_device_doesnt_support_GetDIBits_nWinVNC_cannot_be_used_with_this_graphics_device_driver
mov eax, 0x10
call fcn.00409310
add esp, 8
mov eax, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0xdc1c]
push 1
push 1
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0xdc20], eax
test eax, eax
jne 0x42af67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.vncdesktop.cpp_:_failed_to_create_memory_bitmap__d__n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 8
mov eax, 9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push str.vncdesktop.cpp_:_created_memory_bitmap_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
push 0x430
lea ebx, [esi + 0xdc4c]
push 0
push ebx
call fcn.004b2d10
mov ecx, dword [esi + 0xdc20]
mov edx, dword [esi + 0xdc18]
add esp, 0xc
xor eax, eax
push eax
lea edi, [esi + 0xdc50]
push edi
push eax
push 1
push eax
push ecx
push edx
mov dword [edi], 0x28
mov word [esi + 0xdc5e], ax
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x42afef
push str.vncdesktop.cpp_:_unable_to_get_display_format_n
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xdc20]
mov ecx, dword [esi + 0xdc18]
push 0
push edi
push 0
push 1
push 0
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ecx, 0x4ecb00
test eax, eax
jne 0x42b038
push str.vncdesktop.cpp_:_unable_to_get_display_colour_info_n
call fcn.00403230
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push str.vncdesktop.cpp_:_got_bitmap_format_n
mov eax, 9
call fcn.00403230
movzx eax, word [esi + 0xdc5e]
mov ecx, dword [esi + 0xdc44]
mov edi, dword [esi + 0xdc48]
imul eax, ecx
imul eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 0xdc64], eax
mov eax, edi
cdq
xor eax, edx
add esp, 4
sub eax, edx
mov edx, dword [esi + 0xdc18]
push 0x26
neg eax
push edx
mov dword [esi + 0xdc54], ecx
mov dword [esi + 0xdc58], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
shr eax, 8
push 1
not eax
push 0
and eax, 1
push 0
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret