Function at 0x140212aac
Capabilities:
Capture webcam image

Disassembly:
jmp 0x1403e28e0
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x368
lea rdi, [rsp + 0x40]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x380]
mov rax, qword [0x140961e80]
xor rax, rsp
mov qword [rsp + 0x358], rax
mov rax, qword [rsp + 0x380]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x340], eax
cmp dword [rsp + 0x340], 1
je 0x1403e2947
cmp dword [rsp + 0x340], 0x10001
je 0x1403e2951
jmp 0x1403e2e75
mov eax, 0x30
jmp 0x1403e2e77
mov dword [rsp + 0x48], 0x30
mov dword [rsp + 0x4c], 0x2d
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov edx, 1
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.GDI32.dll_SetBkMode]
mov dword [rsp + 0x94], 0
mov dword [rsp + 0xb4], 0
xor r9d, r9d
mov rax, qword [rsp + 0x380]
mov r8, qword [rax + 0x38]
mov edx, 0x419
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xc4], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x447
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsp + 0xc4]
cmp rax, rcx
jne 0x1403e2a00
mov dword [rsp + 0x344], 1
jmp 0x1403e2a0b
mov dword [rsp + 0x344], 0
movzx eax, byte [rsp + 0x344]
mov byte [rsp + 0xc8], al
xor r9d, r9d
mov rax, qword [rsp + 0x380]
mov r8, qword [rax + 0x38]
mov edx, 0x40b
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x1403e2a51
mov dword [rsp + 0x348], 1
jmp 0x1403e2a5c
mov dword [rsp + 0x348], 0
movzx eax, byte [rsp + 0x348]
mov byte [rsp + 0xc9], al
xor r9d, r9d
mov rax, qword [rsp + 0x380]
mov r8, qword [rax + 0x38]
mov edx, 0x409
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1403e2aa2
mov dword [rsp + 0x34c], 1
jmp 0x1403e2aad
mov dword [rsp + 0x34c], 0
movzx eax, byte [rsp + 0x34c]
mov byte [rsp + 0xca], al
mov rax, qword [rsp + 0x380]
mov eax, dword [rax + 0x38]
lea r9, [rsp + 0x48]
mov r8d, eax
mov edx, 0x43f
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
jne 0x1403e2af0
jmp 0x1403e2e75
movzx eax, byte [rsp + 0xc8]
test eax, eax
je 0x1403e2b5e
mov edx, dword [0x14095f744]
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x14095f740]
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.GDI32.dll_SetDCBrushColor]
mov ecx, 0x12
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rcx, qword [rsp + 0x380]
add rcx, 0x28
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_FillRect]
nop
jmp 0x1403e2b9f
mov edx, dword [0x14095f744]
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.GDI32.dll_SetTextColor]
mov rax, qword [rsp + 0x380]
add rax, 0x28
mov r8, qword [0x14096b2a0]
mov rdx, rax
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_FillRect]
nop
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call sym.SystemInformer.exe_PhGetWindowDpi
mov dword [rsp + 0x84], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x31
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rax
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.GDI32.dll_SelectObject]
cmp dword [rsp + 0x54], 0xffffffff
je 0x1403e2d96
xor r9d, r9d
xor r8d, r8d
mov edx, 0x431
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x1403e2d94
lea r8, [rsp + 0xb4]
lea rdx, [rsp + 0x94]
mov rcx, qword [rsp + 0xd0]
call fcn.14021306a
movzx eax, byte [rsp + 0x59]
and eax, 0x40
test eax, eax
je 0x1403e2cbf
mov edx, dword [rsp + 0x84]
mov ecx, 0x2d
call sym.SystemInformer.exe_PhGetSystemMetrics
mov rcx, qword [rsp + 0x380]
add eax, dword [rcx + 0x28]
mov rcx, qword [rsp + 0x380]
mov dword [rcx + 0x28], eax
mov rax, qword [rsp + 0x380]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0xd8], eax
mov rax, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x380]
mov ecx, dword [rcx + 0x2c]
mov eax, dword [rax + 0x34]
sub eax, ecx
sub eax, dword [rsp + 0xb4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x380]
add eax, dword [rcx + 0x2c]
mov dword [rsp + 0xdc], eax
jmp 0x1403e2d2b
mov rax, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x380]
mov ecx, dword [rcx + 0x28]
mov eax, dword [rax + 0x30]
sub eax, ecx
sub eax, dword [rsp + 0x94]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x380]
add eax, dword [rcx + 0x28]
mov dword [rsp + 0xd8], eax
mov rax, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x380]
mov ecx, dword [rcx + 0x2c]
mov eax, dword [rax + 0x34]
sub eax, ecx
sub eax, dword [rsp + 0xb4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x380]
add eax, dword [rcx + 0x2c]
mov dword [rsp + 0xdc], eax
movzx eax, byte [rsp + 0xca]
test eax, eax
jne 0x1403e2d44
mov dword [rsp + 0x350], 1
jmp 0x1403e2d4f
mov dword [rsp + 0x350], 0
movzx eax, byte [rsp + 0x350]
mov byte [rsp + 0x30], al
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0xdc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xd8]
mov rax, qword [rsp + 0x380]
mov r8, qword [rax + 0x20]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xd0]
call sym.SystemInformer.exe_PhImageListDrawIcon
nop
jmp 0x1403e2d9d
xor eax, eax
jmp 0x1403e2e77
movzx eax, byte [rsp + 0x59]
and eax, 0x40
test eax, eax
je 0x1403e2e6e
lea rax, [rsp + 0xe8]
mov rcx, qword [rsp + 0x380]
mov rdi, rax
lea rsi, [rcx + 0x28]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movzx eax, word [0x14064cc14]
mov word [rsp + 0x120], ax
lea rax, [rsp + 0x122]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x380]
mov eax, dword [rax + 0x38]
lea r9, [rsp + 0x120]
mov r8d, eax
mov edx, 0x44b
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x94]
mov ecx, dword [rsp + 0xe8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xe8], eax
lea rcx, [rsp + 0x120]
call sym.SystemInformer.exe_PhCountStringZ
mov dword [rsp + 0x20], 0x100025
lea r9, [rsp + 0xe8]
mov r8d, eax
lea rdx, [rsp + 0x120]
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_DrawTextW]
nop
mov eax, 4
jmp 0x1403e2e77
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1407981d0]
call fcn.1402124fd
mov rax, rdi
mov rcx, qword [rsp + 0x358]
xor rcx, rsp
call fcn.14020ee98
add rsp, 0x368
pop rdi
pop rsi
ret