Function at 0x1400b7030
Capabilities:
Capture screenshot

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd8]
sub rsp, 0x1d8
mov r13, rcx
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4d
mov r12d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4e
mov r14d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4f
mov r15d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov esi, eax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov qword [rbp + 0x130], rax
mov edx, 8
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xa
mov rcx, rbx
mov edi, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, qword [rbp + 0x130]
mov ebx, eax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, ebx
mov edx, edi
mov qword [rbp + 0x120], rax
mov rbx, qword [rbp + 0x130]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, qword [rbp + 0x120]
mov rdx, rax
mov qword [rbp + 0x138], rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0x40cc0020
mov r9d, r15d
mov dword [rsp + 0x38], r14d
xor r8d, r8d
mov r14, qword [rbp + 0x120]
xor edx, edx
mov dword [rsp + 0x30], r12d
mov rcx, r14
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
xor r15d, r15d
lea r8, [rbp + 0x128]
xorps xmm0, xmm0
mov qword [rsp + 0x60], r15
xor ecx, ecx
mov qword [rbp + 0x128], r15
movdqu xmmword [rsp + 0x50], xmm0
lea edx, [r15 + 1]
mov esi, r15d
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea rax, vtable.ATL::CImage.0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov word [rbp - 0x58], r15w
mov qword [rbp - 0x54], 0xffffffffffffffff
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x40], r15d
mov qword [rbp - 0x38], r15
call fcn.1400b39e0
mov rbx, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x30]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [rbp + 0x138]
lea rcx, [rbp - 0x80]
mov rdx, rdi
xor r8d, r8d
call fcn.1400b3190
mov rdx, qword [rbp + 0x128]
lea r8, [0x1400fe348]
lea rcx, [rbp - 0x80]
call fcn.1400b6dd0
mov rcx, qword [rbp + 0x128]
lea rdx, [rsp + 0x68]
call qword [sym.imp.SHLWAPI.dll_IStream_Size]
mov rcx, qword [rbp + 0x128]
mov ebx, dword [rsp + 0x68]
call qword [sym.imp.SHLWAPI.dll_IStream_Reset]
mov edx, ebx
test ebx, ebx
je 0x1400b721d
lea r8, [rbp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.1400ad480
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rbp + 0x128]
mov r8d, ebx
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_IStream_Read]
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [0x140000000]
mov qword [rbp + 0x70], r15
lea rax, [rcx + 0xf1838]
mov qword [rbp + 0x98], r15
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x18]
lea rax, [rcx + 0xf1840]
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x30]
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
movdqa xmmword [rbp + 0xa0], xmm0
xor r9d, r9d
mov qword [rbp + 0x68], rax
xor r8d, r8d
call fcn.1400a9250
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x24], edx
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rbp + rcx - 0x34], edx
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 0x34], edx
lea rcx, [rbp - 0x18]
call fcn.1400b2300
mov r8, qword [rsp + 0x58]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
sub r8, rbx
mov qword [rbp - 0x18], rax
mov rdx, rbx
mov qword [rbp + 0x50], r15
lea rcx, [rbp - 0x20]
mov dword [rbp + 0x58], 4
call fcn.1400c4480
mov rdx, qword [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, qword [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [rbp + 0x58]
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov eax, ecx
mov qword [r13 + 0x10], r15
and al, 0x22
mov qword [r13 + 0x18], send
mov byte [r13], r15b
movups xmmword [rsp + 0x50], xmm0
cmp al, 2
je 0x1400b73aa
mov rax, qword [rbp + 0x28]
mov r8, qword [rax]
test r8, r8
je 0x1400b73aa
cmp r8, qword [rbp + 0x50]
mov rax, qword [rbp + 8]
cmovb r8, qword [rbp + 0x50]
mov rdx, qword [rax]
sub r8, rdx
jmp 0x1400b73db
test cl, 4
jne 0x1400b73d1
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400b73d1
mov rax, qword [rbp]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x38]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x1400b73db
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400b73e8
mov rcx, r13
call fcn.140032d50
lea rcx, [rbp - 0x30]
call fcn.1400a9800
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400b7400
call qword [sym.imp.GDI32.dll_DeleteObject]
call fcn.1400b39e0
mov rdi, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [rdi + 0x30], 1
jne 0x1400b743c
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400b742f
call sub.gdiplus.dll_GdiplusShutdown
lea rcx, [rdi + 8]
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400b747a
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x1400b746f
mov rbx, qword [rbx - 8]
add rsi, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b7491
mov rdx, rsi
mov rcx, rbx
call fcn.1400e2ce8
mov rax, r13
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400c4dd4
int3