Function at 0x1400177e0
Capabilities:
Capture screenshot

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x20], rcx
lea r8, [rbp - 0x38]
xor ecx, ecx
mov edx, 1
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
call fcn.140008f90
cdqe
lea rcx, [0x140086aec]
mov eax, dword [rcx + rax*4]
mov dword [rbp - 0x30], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rcx, [rbp - 8]
lea rdx, [rbp - 0x30]
xor r8d, r8d
call sub.gdiplus.dll_GdiplusStartup
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r14, rax
mov rdi, qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
call rdi
mov esi, eax
xor ecx, ecx
call rdi
mov r15d, eax
mov rcx, r14
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rbx, rax
mov rcx, r14
mov edx, r15d
mov r8d, esi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdi, rax
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
mov r9d, r15d
call qword [sym.imp.GDI32.dll_BitBlt]
mov qword [rbp], 0
mov r15, rbp
mov rcx, rdi
xor edx, edx
mov r8, r15
call sub.gdiplus.dll_GdipCreateBitmapFromHBITMAP
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
lea rcx, str.image_jpeg
lea rdx, [rbp - 0x18]
call fcn.140017b20
mov r13, qword [rbp + 0x20]
mov rsi, qword [r13 + 0x18]
call fcn.140017f10
cdqe
lea r12, [0x140086b20]
mov rbx, r13
cmp qword [r12 + rax*8], rsi
ja 0x140017914
mov rbx, qword [r13]
add rbx, qword [r13 + 0x10]
mov rdi, qword [r13 + 0x18]
call fcn.140017f10
cdqe
mov rsi, r13
cmp qword [r12 + rax*8], rdi
ja 0x140017930
mov rsi, qword [r13]
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
mov qword [rbp + 0x10], 0
call fcn.140009c70
cdqe
lea r12, [0x140086bc0]
mov rax, qword [r12 + rax*8]
mov qword [rbp + 0x18], rax
cmp rsi, rbx
je 0x1400179aa
mov rax, rbx
xor rax, rsi
not rax
mov rcx, rsi
not rcx
or rcx, rbx
mov rdx, rbx
not rdx
mov rdi, rsi
or rdi, rdx
lea r9, [rdx + rbx*2]
add r9, rax
add rcx, rsi
sub r9, rcx
sub r9, rdi
mov r15, rbp
mov rcx, r15
mov rdx, rsi
mov r8, rbx
call fcn.140017c30
cmp qword [rbp + 0x18], 8
mov r13, qword [rbp + 0x20]
jb 0x1400179bb
mov r15, qword [rbp]
jmp 0x1400179bb
movaps xmm0, xmmword [0x140086c10]
movaps xmmword [rbp + 0x10], xmm0
mov word [rbp], 0
lea r8, [rbp - 0x18]
mov rdi, qword [rbp + 0x28]
mov rcx, rdi
mov rdx, r15
xor r9d, r9d
call sub.gdiplus.dll_GdipSaveImageToFile
mov r15d, eax
call fcn.140008f50
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x140017a76
mov rsi, qword [rbp]
movabs rcx, 0x7ffffffffffffffe
xor rcx, rax
movabs rdx, 0x3ffffffffffffffe
or rdx, rax
sub rax, rdx
lea r14, [rcx + rax*2]
lea rbx, [r14 + r14]
add rbx, 0xfffffffffffffffe
call fcn.1400093c0
cdqe
lea rcx, [0x140086b40]
cmp qword [rcx + rax*8], rbx
ja 0x140017a6b
mov rdi, qword [rsi - 8]
call fcn.140011fc0
mov rax, rdi
or rax, rsi
not rsi
and rsi, rdi
add rsi, rdi
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x20
jae 0x140017ace
lea rbx, [r14 + r14]
add rbx, 2
add rbx, 0x23
mov rsi, rdi
mov rdi, qword [rbp + 0x28]
mov rcx, rsi
mov rdx, rbx
call fcn.14003c800
call fcn.140011eb0
cdqe
mov rax, qword [r12 + rax*8]
mov qword [rbp + 0x10], rax
call fcn.140009c30
mov rcx, rdi
call sub.gdiplus.dll_GdipDisposeImage
mov rcx, qword [rbp - 8]
call sub.gdiplus.dll_GdiplusShutdown
call fcn.14000b2f0
cdqe
lea rcx, [0x140086bf8]
cmp r15d, dword [rcx + rax*4]
sete bl
mov rcx, r13
call fcn.140004dd0
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14005730c
int3