Function at 0x140011299
Capabilities:
Capture screenshot

Disassembly:
jmp 0x14001e680
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x540
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xdc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x568]
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x4e8], rax
lea rcx, [0x140036117]
call fcn.1400118bb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.1400112f8
mov dword [rbp + 0x38], 1
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call fcn.140011267
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x88], rax
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0xa8], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0xc8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0xc8]
mov ecx, dword [rbp + 0xd0]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0xf4], eax
mov eax, dword [rbp + 0xcc]
mov ecx, dword [rbp + 0xd4]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x114], eax
mov r8d, dword [rbp + 0x114]
mov edx, dword [rbp + 0xf4]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0x138], rax
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbp + 0x158], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0xf4]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x18
call fcn.14001168b
mov qword [rbp + 0x428], rax
cmp qword [rbp + 0x428], 0
je 0x14001e82d
mov edx, 0x18
mov rcx, qword [rbp + 0x428]
call fcn.140011947
xor r8d, r8d
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x428]
call fcn.1400111a4
mov qword [rbp + 0x4d8], rax
jmp 0x14001e838
mov qword [rbp + 0x4d8], 0
mov rax, qword [rbp + 0x4d8]
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x178], rax
lea rdx, [rbp + 0x1b4]
lea rcx, [rbp + 0x194]
call fcn.1400115be
mov eax, dword [rbp + 0x1b4]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x1d8], rax
mov r8, qword [rbp + 0x1d8]
mov edx, dword [rbp + 0x1b4]
mov ecx, dword [rbp + 0x194]
call fcn.140011212
mov dword [rbp + 0x224], 0
jmp 0x14001e8ae
mov eax, dword [rbp + 0x224]
inc eax
mov dword [rbp + 0x224], eax
mov eax, dword [rbp + 0x194]
cmp dword [rbp + 0x224], eax
jae 0x14001e90d
movsxd rax, dword [rbp + 0x224]
imul rax, rax, 0x68
lea rdx, str.image_jpeg
mov rcx, qword [rbp + 0x1d8]
mov rcx, qword [rcx + rax + 0x40]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x14001e90b
movsxd rax, dword [rbp + 0x224]
imul rax, rax, 0x68
lea rcx, [rbp + 0x1f8]
mov rdx, qword [rbp + 0x1d8]
mov rdi, rcx
lea rsi, [rdx + rax]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
jmp 0x14001e8a0
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, [rbp + 0x248]
call fcn.1400116f9
nop
lea rax, [rbp + 0x448]
mov qword [rbp + 0x478], rax
lea rax, [rbp + 0x498]
mov qword [rbp + 0x4c8], rax
mov rdx, qword [rbp + 0x478]
mov rcx, qword [rbp + 0x510]
call fcn.140011104
mov qword [rbp + 0x4d8], rax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x510]
call fcn.1400118f2
mov qword [rbp + 0x4e0], rax
mov r8, qword [rbp + 0x4d8]
mov rdx, qword [rbp + 0x4e0]
lea rcx, [rbp + 0x248]
call fcn.1400115e6
lea rcx, [rbp + 0x248]
call fcn.1400112e4
xor r9d, r9d
lea r8, [rbp + 0x1f8]
mov rdx, rax
mov rcx, qword [rbp + 0x178]
call fcn.1400117fd
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.GDI32.dll_DeleteObject]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdx, qword [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rbp + 8]
call fcn.1400114ba
nop
lea rcx, [rbp + 0x248]
call fcn.1400117c1
nop
mov rcx, qword [rbp + 0x510]
call fcn.14001119f
lea rcx, [rbp - 0x50]
lea rdx, [0x140029880]
call fcn.140011776
mov rcx, qword [rbp + 0x4e8]
xor rcx, rbp
call fcn.14001146a
lea rsp, [rbp + 0x4f0]
pop rdi
pop rsi
pop rbp
ret