Function at 0x140001770
Capabilities:
Capture screenshot

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov ebx, 0x64
mov r14, qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov r15, qword [sym.imp.GDI32.dll_SelectObject]
mov r12, qword [sym.imp.GDI32.dll_BitBlt]
nop word cs:[rax + rax]
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
movzx edi, al
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x26
add ecx, edx
imul ecx, ecx, 0xc8
sub eax, ecx
shl eax, 8
movzx ebp, ax
or ebp, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
movzx ecx, al
shl ecx, 0x10
or ecx, ebp
call r14
mov rcx, rsi
mov rdx, rax
call r15
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea edi, [rax + rcx]
add edi, 0xfffffff6
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea r8d, [rax + rcx]
add r8d, 0xffffffec
mov r9d, dword [0x14000a0a8]
mov eax, dword [0x14000a0ac]
mov rcx, qword [0x14000a0a0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x8800c6
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
call r12
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea edi, [rax + rcx]
add edi, 0xfffffff6
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea r8d, [rax + rcx]
add r8d, 0xfffffff6
mov r9d, dword [0x14000a0a8]
mov eax, dword [0x14000a0ac]
mov rcx, qword [0x14000a0a0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x5a0049
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
call r12
dec ebx
jne 0x1400017b0
mov ebx, 0x64
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
movzx edi, al
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x26
add ecx, edx
imul ecx, ecx, 0xc8
sub eax, ecx
shl eax, 8
movzx ebp, ax
or ebp, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
movzx ecx, al
shl ecx, 0x10
or ecx, ebp
call r14
mov rcx, rsi
mov rdx, rax
call r15
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea edi, [rax + rcx]
add edi, 0xfffffff6
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea r8d, [rax + rcx]
add r8d, 0xffffffec
mov r9d, dword [0x14000a0a8]
mov eax, dword [0x14000a0ac]
mov rcx, qword [0x14000a0a0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x8800c6
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
call r12
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea edi, [rax + rcx]
add edi, 0xfffffff6
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea r8d, [rax + rcx]
add r8d, 0xfffffff6
mov r9d, dword [0x14000a0a8]
mov eax, dword [0x14000a0ac]
mov rcx, qword [0x14000a0a0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x5a0049
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
call r12
dec ebx
jne 0x140001990
mov edi, 0x64
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
movzx ebx, al
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
and ecx, 0xfe
sub eax, ecx
shl eax, 8
movzx ebp, ax
or ebp, ebx
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
and ecx, 0xfe
sub eax, ecx
movzx ecx, al
shl ecx, 0x10
or ecx, ebp
call r14
mov rcx, rsi
mov rdx, rax
call r15
mov rcx, qword [0x14000a0a0]
mov r9d, dword [0x14000a0a8]
mov eax, dword [0x14000a0ac]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x8800c6
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 2
xor edx, edx
xor r8d, r8d
call r12
mov rcx, qword [0x14000a0a0]
mov r9d, dword [0x14000a0a8]
mov eax, dword [0x14000a0ac]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x5a0049
mov dword [rsp + 0x38], 0xa
mov dword [rsp + 0x30], 0xa
xor edx, edx
xor r8d, r8d
call r12
dec edi
jne 0x140001b70
mov ebx, 0x64
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x214d0215
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x24
add ecx, edx
imul ecx, ecx, 0x7b
sub eax, ecx
movzx edi, al
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0xffffffff980e4157
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
shr ecx, 8
add ecx, edx
imul ecx, ecx, 0x1af
sub eax, ecx
shl eax, 8
movzx ebp, ax
or ebp, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x34ae820f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x26
add ecx, edx
imul ecx, ecx, 0x137
sub eax, ecx
movzx ecx, al
shl ecx, 0x10
or ecx, ebp
call r14
mov rcx, rsi
mov rdx, rax
call r15
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x66666667
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
add ecx, ecx
lea ecx, [rcx + rcx*4]
neg ecx
lea edi, [rax + rcx]
add edi, 0xffffffe2
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea r8d, [rax + rcx]
add r8d, 0xfffffff6
mov r9d, dword [0x14000a0a8]
mov eax, dword [0x14000a0ac]
mov rcx, qword [0x14000a0a0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x9273ecef
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
call r12
mov rsi, qword [0x14000a0a0]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea edi, [rax + rcx]
add edi, 0xffffffd8
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x30c30c31
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 2
add ecx, edx
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rdx*4]
neg ecx
lea r8d, [rax + rcx]
add r8d, 0xfffffff6
mov r9d, dword [0x14000a0a8]
mov eax, dword [0x14000a0ac]
mov rcx, qword [0x14000a0a0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x5a0049
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
call r12
dec ebx
jne 0x140001c70
mov r12d, 0x64
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x7c]
sub eax, dword [rsp + 0x70]
sub ecx, dword [rsp + 0x74]
add eax, 0xffffff38
mov dword [rsp + 0x58], eax
add ecx, 0xffffff38
mov dword [rsp + 0x5c], ecx
mov r15, qword [sym.imp.USER32.dll_GetDC]
nop word cs:[rax + rax]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv dword [rsp + 0x58]
mov esi, edx
lea ebx, [rsi - 0x96]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv dword [rsp + 0x5c]
mov edi, edx
lea ebp, [rdi - 0x96]
xor ecx, ecx
call r15
mov r14, rax
mov ecx, ebx
mov edx, ebp
mov r8d, ebx
mov r9d, ebp
mov r13, qword [sym.imp.GDI32.dll_CreateEllipticRgn]
call r13
mov r15, rax
mov rcx, r14
mov rdx, rax
mov r13, qword [sym.imp.GDI32.dll_SelectClipRgn]
call r13
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x40], 0x330008
mov dword [rsp + 0x20], 0
mov rcx, r14
mov edx, ebx
mov r8d, ebp
xor r9d, r9d
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, r15
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
xor ecx, ecx
mov rdx, r14
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov ecx, 0x19
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea ebp, [rsi - 0xc8]
lea r14d, [rdi - 0xc8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
lea r8d, [rsi - 0x64]
lea r9d, [rdi - 0x64]
mov ecx, ebp
mov edx, r14d
call qword [sym.imp.GDI32.dll_CreateEllipticRgn]
mov r15, rax
mov rcx, rbx
mov rdx, rax
call r13
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 0x330008
mov dword [rsp + 0x20], 0x64
mov rcx, rbx
mov edx, ebp
mov r8d, r14d
mov r9d, 0x64
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, r15
mov r15, qword [sym.imp.USER32.dll_GetDC]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
lea ebp, [rsi - 0xfa]
lea r14d, [rdi - 0xfa]
xor ecx, ecx
call r15
mov rbx, rax
add esi, 0xffffffce
add edi, 0xffffffce
mov ecx, ebp
mov edx, r14d
mov r8d, esi
mov r9d, edi
mov rdi, qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.GDI32.dll_CreateEllipticRgn]
mov rsi, rax
mov rcx, rbx
mov rdx, rax
call r13
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 0x330008
mov dword [rsp + 0x20], 0xc8
mov rcx, rbx
mov edx, ebp
mov r8d, r14d
mov r9d, 0xc8
call rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
dec r12d
jne 0x140001ea0
mov esi, 0x64
movdqa xmm6, xmmword [0x140006050]
nop word [rax + rax]
mov rdi, qword [sym.imp.USER32.dll_GetDesktopWindow]
call rdi
mov rcx, rax
call r15
mov rbx, rax
xor ecx, ecx
mov r15, qword [sym.imp.USER32.dll_GetSystemMetrics]
call r15
mov r14d, eax
mov ecx, 1
call r15
mov dword [rsp + 0x58], eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv r14d
mov r15d, edx
mov eax, r14d
shr eax, 0x1f
add eax, r14d
sar eax, 1
sub r15d, eax
lea ebp, [r15 + 0x6e]
call rdi
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0xffffffff80808081
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
shr ecx, 7
add ecx, edx
add ecx, eax
movzx r13d, cl
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0xffffffff80808081
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
shr ecx, 7
add ecx, edx
add ecx, eax
shl ecx, 8
movzx edi, cx
or edi, r13d
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0xffffffff80808081
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
shr ecx, 7
add ecx, edx
add ecx, eax
movzx ecx, cl
shl ecx, 0x10
or ecx, edi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv r14d
mov r13d, edx
mov r9d, dword [rsp + 0x60]
mov rax, qword [rsp + 0x64]
movq xmm0, rax
movd xmm1, r9d
pshufd xmm2, xmm0, 0x55
punpckldq xmm0, xmm1
pshufd xmm0, xmm0, 0x21
paddd xmm0, xmm6
movdqa xmmword [rsp + 0x80], xmm0
lea ecx, [r9 - 0x3d]
mov dword [rsp + 0x90], ecx
mov ecx, dword [rsp + 0x6c]
lea edx, [rcx - 0x3d]
mov dword [rsp + 0x94], edx
movd edx, xmm2
sub edx, r9d
sub ecx, eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rcx, rbx
lea r12, [rsp + 0x80]
mov rdx, r12
mov r8, rbx
mov rdi, qword [sym.imp.GDI32.dll_PlgBlt]
call rdi
mov r9d, dword [rsp + 0x60]
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x68]
sub ecx, r9d
mov edx, dword [rsp + 0x6c]
sub edx, eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rcx, rbx
mov rdx, r12
mov r8, rbx
call rdi
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
shr rcx, 0x20
sar ecx, 5
add ecx, edx
imul ecx, ecx, 0x64
neg ecx
add eax, ecx
add eax, 0xffffffce
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x40], 0xcc0020
mov rcx, rbx
mov edx, r13d
mov r8d, ebp
mov r9d, r13d
call qword [sym.imp.GDI32.dll_BitBlt]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x28], 0x5a0049
mov rcx, rbx
mov edx, r13d
mov r8d, dword [rsp + 0x58]
mov r9d, r13d
call qword [sym.imp.GDI32.dll_PatBlt]
lea r9d, [r14 + 0x20]
lea eax, [r15 + 0x8e]
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rbx
mov edx, 0xfffffff0
mov r8d, 0xfffffff0
mov rdi, qword [sym.imp.GDI32.dll_StretchBlt]
call rdi
add r15d, 0x4e
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], r14d
add r14d, 0xffffffe0
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r15d
mov r15, qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rbx
mov edx, 0x10
mov r8d, 0x10
mov r9d, r14d
call rdi
dec esi
jne 0x140002080
xor eax, eax
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret