Function at 0x140069e70
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9d0]
sub rsp, 0xad0
mov rax, qword [0x140129718]
xor rax, rsp
mov qword [rbp + 0x9c0], rax
xor esi, esi
mov ebx, esi
mov dword [rsp + 0x40], ebx
xor ecx, ecx
call qword [0x1400e8220]
test al, al
je 0x140069ef1
xor r9d, r9d
mov r8d, 0x21d
lea rdx, str.D:jenkinsworkspaceci.dingding.manual.newDingTalk_Winwin_source_appDingTalkSnippingTooluiScreenCaptureComponent.cpp
lea rcx, [rbp - 0x50]
call qword [0x1400e8218]
nop
mov ebx, 1
mov dword [rsp + 0x40], ebx
lea rcx, [rax + 8]
lea rdx, str._CScreenCaptureComponent__SaveCapture
call fcn.14000f940
nop
test bl, 1
je 0x140069f07
and ebx, 0xfffffffe
mov dword [rsp + 0x40], ebx
lea rcx, [rbp - 0x50]
call qword [0x1400e8210]
lea rcx, [rbp + 0x8f0]
lea rax, str.JPEG_File__.jpg_
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rcx], xmm1
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rcx + 0x10], xmm0
movups xmm1, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x20], xmm1
movups xmm0, xmmword [rax + 0xb0]
movups xmmword [rcx + 0x30], xmm0
movzx eax, word [rax + 0xc0]
mov word [rcx + 0x40], ax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14006a718
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14006a723
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x70]
call fcn.140068830
nop
lea r8, [0x1400e8bbc]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140028130
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a015
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Dingtalk_
mov rax, r14
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14006a020
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.14000ede0
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
nop
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14006a72e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
movzx eax, word [rbp + 0x2d4]
movzx ecx, word [rbp + 0x2d2]
movzx edx, word [rbp + 0x2d0]
movzx r10d, word [rbp + 0x2ce]
movzx r9d, word [rbp + 0x2ca]
movzx r8d, word [rbp + 0x2c8]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._4d_02d_02d_02d_02d_02d
lea rcx, [rsp + 0x58]
call fcn.14002d530
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140067170
nop
mov rbx, qword [rsp + 0x68]
mov qword [rbp + 0x2e8], rsi
mov qword [rbp + 0x308], rsi
mov qword [rbp + 0x310], rsi
mov dword [rbp + 0x318], esi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x320], xmm0
movups xmmword [rbp + 0x330], xmm0
movups xmmword [rbp + 0x340], xmm0
movups xmmword [rbp + 0x350], xmm0
movups xmmword [rbp + 0x360], xmm0
movups xmmword [rbp + 0x370], xmm0
movups xmmword [rbp + 0x380], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], rax
mov word [rbp + 0x5bc], si
mov word [rbp + 0x3bc], si
mov dword [rbp + 0x3b8], esi
mov dword [rbp + 0x320], 0x98
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rbp + 0x7d4]
call fcn.1400ddd92
mov dword [rbp + 0x7d0], VarUI4FromDisp
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14006a19a
mov eax, dword [rbp + 0x7d4]
cmp eax, 5
jae 0x14006a1a4
cmp eax, 4
jne 0x14006a19a
cmp dword [rbp + 0x7d8], 0x5a
jae 0x14006a1a4
mov dword [rbp + 0x320], 0x88
lea rax, [rbp + 0x5bc]
mov qword [rbp + 0x350], rax
mov dword [rbp + 0x358], 0x104
lea rax, [0x1400ee160]
mov qword [rbp + 0x388], rax
lea rax, [rbp + 0x3bc]
mov qword [rbp + 0x360], rax
mov dword [rbp + 0x368], 0x100
mov dword [rbp + 0x380], 0x880026
lea rax, [rbp + 0x8f0]
mov qword [rbp + 0x338], rax
mov rax, qword [0x14012e480]
mov qword [rbp + 0x330], rax
lea rax, [0x14006bc10]
mov qword [rbp + 0x398], rax
mov qword [rbp + 0x328], rsi
test rbx, rbx
je 0x14006a262
mov r9, r14
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x5bc]
call qword [0x1400e7e50]
test eax, eax
je 0x14006a262
cmp eax, 0xc
je 0x14006a74f
cmp eax, 0x16
je 0x14006a744
cmp eax, 0x22
je 0x14006a744
cmp eax, 0x50
jne 0x14006a739
lea rax, vtable.WTL::CFileDialog.0
mov qword [rbp + 0x2e0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rbp + 0x328]
test rcx, rcx
cmove rcx, rax
mov qword [rbp + 0x328], rcx
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x2f0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x2f8], eax
lea rcx, [0x140127908]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140127930]
mov qword [rbp + 0x300], rax
lea rax, [rbp + 0x2f0]
mov qword [0x140127930], rax
lea rcx, [0x140127908]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp + 0x320]
cmp dword [rbp + 0x3b8], 0
je 0x14006a2f3
call qword [0x1400e7070]
jmp 0x14006a2f9
call qword [0x1400e7068]
mov qword [rbp + 0x2e8], rsi
test eax, eax
je 0x14006a5d0
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14006a75a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x5bc]
cmp rax, 0x10000
jae 0x14006a34d
lea rax, [rbp + 0x5bc]
movzx edx, ax
lea rcx, [rsp + 0x48]
call fcn.140028a30
jmp 0x14006a37f
lea rcx, [rbp + 0x5bc]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006a360
mov r8d, eax
lea rdx, [rbp + 0x5bc]
lea rcx, [rsp + 0x48]
call fcn.14000ede0
nop
mov edx, 0x2e
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400ddde6
test rax, rax
je 0x14006a535
sub rax, rdi
sar rax, 1
test eax, eax
js 0x14006a535
lea r8d, [rax + 1]
mov r9d, dword [rdi - 0x10]
sub r9d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.140069190
nop
mov rbx, qword [rsp + 0x50]
movsxd r15, dword [rbx - 0x10]
test r15d, r15d
js 0x14006a70d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14006a3f9
mov edx, r15d
lea rcx, [rsp + 0x50]
call fcn.14000eab0
mov rbx, qword [rsp + 0x50]
lea eax, [r15 + 1]
movsxd rdx, eax
mov rcx, rbx
call qword [0x1400e7e58]
cmp r15d, dword [rbx - 0xc]
jg 0x14006a70d
mov dword [rbx - 0x10], r15d
mov word [rbx + r15*2], si
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov rcx, rsi
lea rdx, [0x1400ee1a8]
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14006a4a8
cmp rcx, 4
jne 0x14006a432
mov qword [rbp - 0x78], 1
mov qword [rbp - 0x68], rdi
lea r8, [rbp - 0x78]
mov edx, 0x812
mov rcx, qword [0x14012d7d0]
call fcn.140030cb0
nop
mov eax, r14d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14006a484
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r14d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x14006a62e
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006a62e
mov rcx, rsi
lea rdx, [0x1400ee1b0]
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14006a4cc
cmp rcx, 4
jne 0x14006a4b2
mov qword [rbp - 0x78], rsi
jmp 0x14006a44e
mov rcx, rsi
lea rdx, [0x1400ee1b8]
nop word [rax + rax]
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14006a501
cmp rcx, 4
jne 0x14006a4e0
mov qword [rbp - 0x78], 2
jmp 0x14006a44e
lea rcx, [0x1400ee1c0]
nop dword [rax + rax]
movzx eax, word [rbx + rsi*2]
inc rsi
cmp ax, word [rcx + rsi*2 - 2]
jne 0x14006a446
cmp rsi, 4
jne 0x14006a510
mov qword [rbp - 0x78], InitCommonControls
jmp 0x14006a44e
mov ecx, 1
call qword [0x1400e8220]
test al, al
je 0x14006a59d
mov r9d, 1
mov r8d, 0x232
lea rdx, str.D:jenkinsworkspaceci.dingding.manual.newDingTalk_Winwin_source_appDingTalkSnippingTooluiScreenCaptureComponent.cpp
lea rcx, [rbp + 0xb8]
call qword [0x1400e8218]
nop
mov ebx, dword [rsp + 0x40]
or ebx, 2
mov dword [rsp + 0x40], ebx
lea rcx, [rax + 8]
lea rdx, str._CScreenCaptureComponent__SaveCapture_invalid_file_name
call fcn.14000f940
mov rcx, rax
lea rdx, str._name:
call fcn.14000f940
mov rdx, rdi
mov rcx, rax
call qword [0x1400e8028]
jmp 0x14006a5a1
mov ebx, dword [rsp + 0x40]
test bl, 2
je 0x14006a5b4
lea rcx, [rbp + 0xb8]
call qword [0x1400e8210]
nop
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a62e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006a62e
xor ecx, ecx
call qword [0x1400e8220]
test al, al
je 0x14006a617
xor r9d, r9d
mov r8d, 0x249
lea rdx, str.D:jenkinsworkspaceci.dingding.manual.newDingTalk_Winwin_source_appDingTalkSnippingTooluiScreenCaptureComponent.cpp
lea rcx, [rbp + 0x1c0]
call qword [0x1400e8218]
nop
mov ebx, dword [rsp + 0x40]
or ebx, 4
mov dword [rsp + 0x40], ebx
lea rcx, [rax + 8]
lea rdx, str._CScreenCaptureComponent__SaveCapture_canceled
call fcn.14000f940
jmp 0x14006a61b
mov ebx, dword [rsp + 0x40]
test bl, 4
je 0x14006a62e
lea rcx, [rbp + 0x1c0]
call qword [0x1400e8210]
nop
mov rcx, qword [rbp + 0x308]
test rcx, rcx
je 0x14006a640
call fcn.1400dc3bc
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a660
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a680
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a6a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a6c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14006a6dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x9c0]
xor rcx, rsp
call fcn.1400dc960
lea r11, [rsp + 0xad0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
int3
mov ecx, 0x80070057
call fcn.14000d650
int3
mov ecx, 0x8007000e
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
int3