Function at 0x1400fa780
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1f8
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x70]
mov rdx, rax
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.USER32.dll_BeginPaint]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xc0], 0
mov dword [rsp + 0xc4], 0
mov dword [rsp + 0xc8], 0
mov dword [rsp + 0xcc], 0
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xd0], rax
mov eax, dword [rsp + 0xc4]
mov ecx, dword [rsp + 0xcc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x140], eax
mov eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xc8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x144], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x148], rax
mov r8d, dword [rsp + 0x140]
mov edx, dword [rsp + 0x144]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x158], rax
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, 0xffffffec
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0x20
test eax, eax
je 0x1400fa901
mov byte [rsp + 0x1c8], 1
jmp 0x1400fa909
mov byte [rsp + 0x1c8], 0
movzx eax, byte [rsp + 0x1c8]
mov byte [rsp + 0xe8], al
movzx eax, byte [rsp + 0xe8]
test eax, eax
je 0x1400faa3b
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.USER32.dll_GetParent]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x110], rax
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0xf8], eax
mov eax, dword [rsp + 0x104]
mov dword [rsp + 0xfc], eax
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [rsp + 0xfc]
mov dword [rsp + 0x16c], eax
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x104]
mov ecx, dword [rsp + 0x10c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x164], eax
mov eax, dword [rsp + 0x100]
mov ecx, dword [rsp + 0x108]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x160], eax
mov dword [rsp + 0x40], 0xcc0020
mov eax, dword [rsp + 0x16c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x168]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x164]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x160]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.GDI32.dll_BitBlt]
mov rax, qword [rsp + 0x200]
mov rax, qword [rax + 8]
mov qword [rsp + 0x170], rax
cmp qword [rsp + 0x170], 0
je 0x1400faa67
mov dword [rsp + 0x1cc], 0
jmp 0x1400faa72
mov dword [rsp + 0x1cc], 0xffffffff
cmp dword [rsp + 0x1cc], 0xffffffff
je 0x1400faacb
mov rax, qword [rsp + 0x200]
mov rax, qword [rax + 8]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
mov rax, qword [rax]
mov r9b, 0x64
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x1d0]
call qword [rax + 0x10]
jmp 0x1400faaf0
movzx eax, byte [rsp + 0xe8]
test eax, eax
jne 0x1400faaf0
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_FillRect]
mov ecx, 0x18
call fcn.140250a78
mov qword [rsp + 0x120], rax
cmp qword [rsp + 0x120], 0
je 0x1400fab42
mov rax, qword [rsp + 0x120]
add rax, 8
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rax], 0
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x1d8], rax
jmp 0x1400fab4e
mov qword [rsp + 0x1d8], 0
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0xd8]
call fcn.1400fb780
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0xd8]
add rax, 8
mov qword [rsp + 0x190], rax
xor eax, eax
test eax, eax
je 0x1400fabc6
mov rax, qword [rsp + 0x190]
mov rcx, qword [rax]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rax, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x188]
mov qword [rax], rcx
mov edx, 0xfffffff0
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1400fac06
xor eax, eax
cmp eax, 0x2000000
je 0x1400fac06
mov dword [rsp + 0x1e0], 1
jmp 0x1400fac11
mov dword [rsp + 0x1e0], 0
mov rax, qword [rsp + 0xd8]
movzx ecx, byte [rsp + 0x1e0]
mov byte [rax], cl
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x208]
mov qword [rax + 0x10], rcx
mov r8, qword [rsp + 0xd8]
lea rdx, [0x1400fb040]
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x198], rax
mov eax, dword [rsp + 0xc4]
mov ecx, dword [rsp + 0xcc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a0], eax
mov eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xc8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + reloc.OLEAUT32.dll_OleTranslateColor], eax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + reloc.OLEAUT32.dll_OleTranslateColor]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_BitBlt]
mov qword [rsp + 0x128], 0
cmp qword [rsp + 0xe0], 0
je 0x1400fad02
mov rcx, qword [rsp + 0xe0]
call fcn.14003c6c0
xor eax, eax
cmp eax, 1
je 0x1400fad36
cmp qword [rsp + 0x50], 0
je 0x1400fad36
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov dword [rsp + 0x1a8], eax
cmp dword [rsp + 0x1a8], 0
je 0x1400fad36
mov qword [rsp + 0x50], 0
xor eax, eax
cmp eax, 1
je 0x1400fad72
cmp qword [rsp + 0xd0], 0
je 0x1400fad72
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0xd0], 0
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rcx, [rsp + 0x60]
call fcn.1400d66b0
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x1e8]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x1f8
ret