Function at 0x101d3490
Capabilities:
Capture screenshot
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022d6e0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x20a8
call fcn.10229ed0
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], 0
push eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call sub.gdiplus.dll_GdiplusStartup
push str.Gameloop_64beta_
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x101d39fb
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
sub eax, dword [ebp - 0x40]
sub esi, dword [ebp - 0x3c]
push edi
mov dword [ebp - 0x2064], eax
mov dword [ebp - 0x2068], esi
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
push dword [ebp - 0x2064]
mov edi, eax
push dword [ebp - 0x18]
mov dword [ebp - 0x206c], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x2074], eax
call edi
push 0xcc0020
push 0
push 0
push dword [ebp - 0x18]
mov esi, eax
push dword [ebp - 0x2068]
push dword [ebp - 0x2064]
push 0
push 0
push dword [ebp - 0x206c]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [ebp - 0x206c]
push esi
call edi
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x2064]
mov dword [ebp - 0x2064], 0
push eax
push 0
push dword [ebp - 0x2074]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20a0], xmm0
mov dword [ebp - method.Gdiplus::Image.virtual_0], 0x103559a8
call sub.gdiplus.dll_GdipCreateBitmapFromHBITMAP
mov dword [ebp - 0x2098], eax
mov eax, dword [ebp - 0x2064]
mov dword [ebp - 0x209c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x1c], 0
call sub.gdiplus.dll_GdipGetImageEncodersSize
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x101d373d
cmp edi, 0x7fffffff
ja 0x101d3a41
cmp edi, 0x1000
jb 0x101d3669
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x101d3a46
push eax
call fcn.10229475
add esp, 4
test eax, eax
je 0x101d39f5
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x101d3674
push edi
call fcn.10229475
add esp, 4
mov esi, eax
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call sub.gdiplus.dll_GdipGetImageEncoders
xor eax, eax
mov dword [ebp - 0x206c], eax
cmp dword [ebp - 0x18], eax
jbe 0x101d3711
lea ecx, [esi + 0x30]
mov dword [ebp - 0x2068], ecx
mov ecx, dword [ecx]
mov eax, 0x103559e8
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x101d36d6
test dx, dx
je 0x101d36d2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x101d36d6
add ecx, 4
add eax, 4
test dx, dx
jne 0x101d36b0
xor eax, eax
jmp 0x101d36db
sbb eax, eax
or eax, 1
test eax, eax
je 0x101d3702
mov edx, dword [ebp - 0x206c]
mov ecx, dword [ebp - 0x2068]
inc edx
add ecx, 0x4c
mov dword [ebp - 0x206c], edx
mov dword [ebp - 0x2068], ecx
cmp edx, dword [ebp - 0x18]
jb 0x101d36a2
jmp 0x101d3711
imul eax, dword [ebp - 0x206c], 0x4c
movups xmm0, xmmword [eax + esi]
movups xmmword [ebp - 0x50], xmm0
test esi, esi
je 0x101d373d
cmp edi, 0x1000
jb 0x101d3733
mov ecx, dword [esi - 4]
add edi, 0x23
sub esi, ecx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x101d39f5
mov esi, ecx
push edi
push esi
call fcn.102294a5
add esp, 8
mov edi, dword [ebp - 0x2064]
lea eax, [ebp - 0x50]
push 0
push eax
push str.C:Winner.png
push edi
call sub.gdiplus.dll_GdipSaveImageToFile
mov ecx, dword [ebp - 0x2098]
test eax, eax
mov dword [ebp - 0x5c], 0x1388
cmovne ecx, eax
mov eax, dword [0x1036d0bc]
mov dword [ebp - 0x2098], ecx
mov dword [ebp - 0x2060], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 0x1000
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x205c]
push 0
push eax
mov dword [ebp - 0x54], edx
call sub.VCRUNTIME140.dll_memset
push 0x1000
lea eax, [ebp - 0x105c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [str.zZB_:]
add esp, 0x18
mov dword [ebp - 0x2074], eax
xor edx, edx
mov ax, word [0x103559b4]
mov word [ebp - 0x2070], ax
mov al, byte [0x103559b6]
mov byte [ebp - 0x206e], al
mov dword [ebp - 0x2068], edx
nop word [eax + eax]
mov eax, 0xa0a0a0a1
mul edx
shr edx, 5
movsx eax, dl
mov edx, dword [ebp - 0x2068]
mov cl, dl
imul eax, eax, 0x33
sub cl, al
add cl, 0x34
xor byte [ebp + edx - 0x2074], cl
inc edx
mov dword [ebp - 0x2068], edx
cmp edx, 7
jl 0x101d37e0
lea eax, [ebp - 0x2074]
push eax
lea eax, [ebp - 0x2060]
push eax
call fcn.1017c810
movups xmm0, xmmword [str.gVDR_WISSI]
mov al, byte [0x103559d0]
xor edx, edx
add esp, 8
mov byte [ebp - 0x2078], al
cmp dword [0x106c5e68], 2
movups xmmword [ebp - 0x2090], xmm0
mov dword [ebp - 0x18], edx
movq xmm0, qword [0x103559c8]
movq qword [ebp - 0x2080], xmm0
jl 0x101d3986
movaps xmm0, xmmword [0x102f26e0]
movaps xmm4, xmmword [0x1022fa00]
movaps xmm3, xmmword [0x10355a60]
movaps xmm5, xmmword [str.3333]
movaps xmm6, xmmword [0x1022fa10]
movaps xmmword [ebp - 0x20b0], xmm0
mov ecx, dword [ebp - 0x20b0]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x2090]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + edx - 0x2090], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x208c]
xorps xmm2, xmm0
movd dword [ebp + edx - 0x208c], xmm2
add edx, 8
cmp edx, 0x18
jl 0x101d3891
mov dword [ebp - 0x18], edx
cmp edx, 0x19
jge 0x101d39ba
mov eax, 0xa0a0a0a1
imul edx
add edx, dword [ebp - 0x18]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x18]
movsx eax, al
mov cl, dl
imul eax, eax, 0x33
sub cl, al
add cl, 0x34
xor byte [ebp + edx - 0x2090], cl
inc edx
mov dword [ebp - 0x18], edx
cmp edx, 0x19
jl 0x101d3986
lea eax, [ebp - 0x2090]
push eax
lea eax, [ebp - 0x2060]
push eax
call fcn.1017c7d0
push str.Screenshot_saved_successfully_
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1001cf50
add esp, 0x10
mov ecx, eax
push 0x10034ed0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push edi
call sub.gdiplus.dll_GdipDisposeImage
jmp 0x101d3a1b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push str.Window_not_found
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1001cf50
add esp, 8
mov ecx, eax
push 0x10034ed0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [ebp - 0x20]
call sub.gdiplus.dll_GdiplusShutdown
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10229364
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10004e20
call fcn.10004d60
int3