Function at 0x140059a30
Capabilities:
Capture screenshot

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov rax, qword [0x1402a8800]
xor rax, rsp
mov qword [rbp + 7], rax
movzx esi, byte [reloc.WLDAP32.dll_Ordinal_79]
mov edi, ecx
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_79]
xor ecx, ecx
shl eax, 0x10
mov r15d, r9d
shl esi, 8
mov r14d, r8d
or esi, eax
mov ebx, edx
movzx eax, byte [0x14018d084]
or esi, eax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r15d
mov edx, r14d
mov rcx, r12
mov qword [rbp - 0x69], rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, qword [rbp - 0x69]
mov rdx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
sub ebx, r15d
mov eax, ebx
sub edi, r14d
mov rbx, qword [rbp - 0x69]
cdq
sub eax, edx
mov r9d, r14d
sar eax, 1
xor r8d, r8d
mov ecx, eax
mov eax, edi
mov dword [rsp + 0x38], ecx
cdq
sub eax, edx
mov rcx, rbx
sar eax, 1
xor edx, edx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r15d
call qword [sym.imp.GDI32.dll_BitBlt]
xor ecx, ecx
mov dword [rbp - 0x45], r14d
imul r14d, r15d
mov eax, r15d
neg eax
mov dword [rbp - 0x49], Ordinal_46
mov dword [rbp - 0x41], eax
xorps xmm0, xmm0
mov qword [rbp - 0x3d], 0x180001
mov qword [rbp - 0x35], rcx
mov qword [rbp - 0x2d], rcx
mov dword [rbp - 0x25], ecx
movdqu xmmword [rbp - 0x61], xmm0
lea eax, [r14 + r14*2]
mov qword [rbp - 0x51], rcx
movsxd rdi, eax
movabs rax, 0x7fffffffffffffff
test rdi, rdi
je 0x140059bb3
cmp rdi, rax
ja 0x140059d7c
cmp rdi, 0x1000
jb 0x140059b88
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140059d76
call fcn.1400800e0
mov rcx, rax
test rax, rax
je 0x140059d4a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140059b90
mov rcx, rdi
call fcn.1400800e0
lea rbx, [rax + rdi]
mov qword [rbp - 0x61], rax
mov r8, rdi
mov qword [rbp - 0x51], rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x59], rbx
xor ecx, ecx
mov rbx, qword [rbp - 0x69]
mov dword [rsp + 0x30], ecx
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
mov r9d, r15d
mov rax, qword [rbp - 0x61]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetDIBits]
movsxd r10, r14d
test r14d, r14d
jle 0x140059cfc
mov rax, qword [rbp - 0x61]
xor r9d, r9d
inc rax
movzx r11d, sil
nop word [rax + rax]
movzx edx, byte [rax + 1]
sub edx, r11d
mov ecx, edx
neg ecx
cmovs ecx, edx
cmp ecx, 5
jg 0x140059c48
movzx edx, byte [rax]
movzx ecx, si
shr ecx, 8
sub edx, ecx
mov ecx, edx
neg ecx
cmovs ecx, edx
cmp ecx, 5
jg 0x140059c48
movzx r8d, byte [rax - 1]
mov ecx, esi
shr ecx, 0x10
movzx edx, cl
sub r8d, edx
mov ecx, r8d
neg ecx
cmovs ecx, r8d
cmp ecx, 5
jle 0x140059c59
inc r9
add rax, 3
cmp r9, r10
jl 0x140059c00
jmp 0x140059cfc
mov r8d, Ordinal_41
mov dword [rbp - 0x21], 0
lea rdx, [rbp - 0x21]
mov dword [rbp - 0xd], 2
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
lea rcx, [rbp - 0x69]
mov dword [rbp - 0xd], 4
call fcn.14005e540
mov rax, qword [rbp - 0x69]
movabs r8, 0x7ffffffffe8287bf
mov qword [rbp - 0x69], rax
cmp rax, r8
je 0x140059cbc
mov ecx, 1
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x140059cbc
add rax, 0x17d7840
jmp 0x140059cc6
movabs rax, 0x7fffffffffffffff
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x69], rax
call fcn.140048ed0
mov r8d, Ordinal_41
lea rdx, [rbp - 0x21]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
movsxd rax, dword [0x14018d074]
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x69], rax
call fcn.140048e40
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x140059d56
mov rdx, qword [rbp - 0x51]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140059d51
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059d51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008011c
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14007ffa0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14001fd90
int3
call fcn.140058b60
int3