Function at 0x110b4960
Capabilities:
Capture screenshot
Delete file
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push ebx
mov dword [ebp - 0x454], ecx
mov ecx, dword [ecx + 4]
push esi
xor edx, edx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x460], edx
cmp eax, ecx
je 0x110b49a5
add edx, dword [eax + 4]
add eax, 0xc
cmp eax, ecx
jne 0x110b4995
mov dword [ebp - 0x460], edx
mov esi, dword [edi]
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], ebx
cmp esi, dword [edi + 4]
je 0x110b49f3
push esi
lea eax, [ebp - 0x424]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_UnionRect]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
sub edx, dword [esi + 4]
sub eax, dword [esi]
add esi, 0x10
imul edx, eax
add ebx, edx
cmp esi, dword [edi + 4]
jne 0x110b49c4
mov edx, dword [ebp - 0x460]
mov ecx, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x418]
sub ecx, dword [ebp - 0x424]
sub eax, dword [ebp - 0x420]
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x45c], eax
cmp edx, 0x1f40
jl 0x110b4d6d
imul eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp ebx, eax
jl 0x110b4d6d
lea ecx, [ebp - 0x424]
push 0x1127bba0
push ecx
call fcn.110b3950
add esp, 8
test al, al
je 0x110b4d6d
lea edx, [ebp - 0x414]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1121760c
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x110b4d6d
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push esi
call ebx
push esi
mov edi, eax
call ebx
mov edx, dword [ebp - 0x45c]
mov ebx, eax
mov eax, dword [ebp - 0x458]
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [0x1127bb18]
push ecx
push edi
mov dword [ebp - 0x450], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x450]
push edx
push ebx
mov dword [ebp - 0x464], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 0x45c]
push 0xcc0020
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x458]
push ecx
push edi
push edx
push eax
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x474]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x464]
push edx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
call edi
push ebx
call edi
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [0x1127bb9c], 0
jne 0x110b4b5e
push str.PCIImage.dll
call fcn.111bac00
add esp, 4
mov dword [0x1127bb9c], eax
mov esi, dword [ebp - 0x450]
push 2
push 0x4b
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.11147a20
add esp, 0x10
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
push 1
push 3
push 0
push 1
push closesocket
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x464], ebx
cmp ebx, 0xffffffff
je 0x110b4d60
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x460]
mov edi, eax
test edi, edi
je 0x110b4d2e
lea eax, [ecx + ecx*2]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp edi, eax
jge 0x110b4d2e
lea edx, [edi + 0x25]
push edx
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
xor eax, eax
add esp, 4
cmp esi, eax
je 0x110b4d59
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], al
mov ecx, 0xef
mov word [esi], cx
mov dword [esi + 0xc], edi
movzx edx, word [ebp - 0x424]
mov word [esi + 8], dx
movzx ecx, word [ebp - 0x420]
movzx edx, word [ebp - 0x458]
push eax
mov word [esi + 0xa], cx
movzx ecx, word [ebp - 0x45c]
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x450]
push eax
mov word [esi + 6], cx
push edi
lea ecx, [esi + 0x14]
mov word [esi + 4], dx
push ecx
xor edx, edx
push ebx
mov word [esi + 2], dx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x450], edi
jne 0x110b4d22
mov ecx, dword [ebp - 0x454]
mov ebx, dword [ecx]
cmp ebx, dword [ecx + 4]
je 0x110b4c9c
lea esp, [esp]
mov edx, dword [ebx]
push edx
call dword [sym.imp.MSVCR100.dll_free]
mov eax, dword [ebp - 0x454]
add ebx, 0xc
add esp, 4
cmp ebx, dword [eax + 4]
jne 0x110b4c80
mov ecx, eax
call fcn.11030510
lea edx, [ebp - 0x44c]
mov ecx, 0xbd
push 3
push edx
mov word [ebp - 0x44c], cx
mov byte [ebp - 0x44a], 1
call fcn.111ba520
mov ebx, dword [ebp - 0x454]
mov dword [ebp - 0x470], eax
add esp, 8
lea eax, [ebp - 0x470]
push eax
mov ecx, ebx
mov dword [ebp - 0x46c], 3
mov dword [ebp - 0x468], 0
call fcn.110b4630
lea ecx, [ebp - 0x470]
add edi, 0x15
push ecx
mov ecx, ebx
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x46c], edi
mov dword [ebp - 0x468], 0
call fcn.110b4630
mov ebx, dword [ebp - 0x464]
jmp 0x110b4d59
push esi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
jmp 0x110b4d59
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x458]
push edx
mov edx, dword [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push edx
push eax
push edi
push ecx
push str.not_swapping__d_view_bytes_for__d_jpg_bytes__l_d__t_d__w_d__h_d_n
call fcn.111bd7b0
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 0x420]
mov dword [0x1127bba8], ecx
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x1127bba0], edx
mov edx, dword [ebp - 0x418]
pop esi
xor ecx, ebp
mov dword [0x1127bba4], eax
mov dword [0x1127bbac], edx
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret