Function at 0x14004da80
Capabilities:
Capture screenshot
Log keystrokes

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push r12
lea rbp, [rsp - 0x4f]
sub rsp, 0xd8
mov r12, rcx
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x14004dab7
xor eax, eax
add rsp, 0xd8
pop r12
pop rbp
ret
lea rcx, str.DISPLAY
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xb0], r15
call qword [sym.imp.GDI32.dll_CreateDCW]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r15, rax
test r13, r13
je 0x14004ddae
mov rcx, r13
test rax, rax
je 0x14004ddb6
mov qword [rsp + 0xf0], rbx
mov ebx, dword [r12 + 0xc]
mov qword [rsp + 0xd0], rsi
mov esi, dword [r12]
mov qword [rsp + 0xc8], rdi
mov edi, dword [r12 + 4]
mov qword [rsp + 0xb8], r14
mov r14d, dword [r12 + 8]
sub ebx, edi
sub r14d, esi
mov r8d, ebx
mov edx, r14d
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r15
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov r9d, r14d
xor r8d, r8d
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x28], r13
mov qword [rbp - 0x29], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_BitBlt]
cmp dword [rbp + 0x6f], 0
mov edi, dword [rbp + 0x77]
jne 0x14004db8f
test edi, edi
je 0x14004dd5d
xor eax, eax
mov dword [rbp - 0x35], 0
mov dword [rbp - 0x39], eax
call qword [sym.imp.USER32.dll_GetCursor]
lea rcx, [rbp - 0x31]
mov r14, rax
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.USER32.dll_WindowFromPoint]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
cmp ebx, eax
je 0x14004dbfb
mov r8d, 1
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x14004dbfb
call qword [sym.imp.USER32.dll_GetCursor]
xor r8d, r8d
mov edx, ebx
mov ecx, esi
mov r14, rax
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
lea rdx, [rbp - 0x21]
mov rcx, r14
mov qword [rbp - 0x21], rax
mov dword [rbp - 0x21], eax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
call qword [sym.imp.USER32.dll_GetIconInfo]
cmp dword [rbp + 0x7f], 0
mov ebx, 0x20
je 0x14004dc40
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rbx + 1]
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp - 0x39], eax
jmp 0x14004dc45
mov esi, dword [rbp - 0x35]
mov eax, esi
cmp dword [rbp + 0x6f], 0
je 0x14004dc8e
mov r8d, dword [rbp - 0x2d]
mov edx, dword [rbp - 0x31]
mov dword [rsp + 0x40], 3
sub r8d, dword [r12 + 4]
sub edx, dword [r12]
mov r9, r14
sub r8d, dword [rbp - 0x19]
sub edx, dword [rbp - 0x1d]
mov rcx, r15
sub r8d, eax
xor eax, eax
sub edx, esi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_DrawIconEx]
test edi, edi
je 0x14004dd3f
mov edi, dword [rbp - 0x31]
mov rcx, qword [rbp - 9]
xor eax, eax
sub edi, dword [r12]
mov r14d, ebx
mov qword [rbp - 1], rax
sub edi, dword [rbp - 0x1d]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
sub edi, esi
mov esi, dword [rbp - 0x2d]
mov qword [rbp + 0x17], rax
sub esi, dword [r12 + 4]
sub esi, dword [rbp - 0x19]
sub esi, dword [rbp - 0x39]
test rcx, rcx
je 0x14004dce4
lea r8, [rbp - 1]
mov edx, ebx
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
jle 0x14004dd0b
mov r14d, dword [rbp + 7]
jmp 0x14004dd08
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14004dd0b
lea r8, [rbp - 1]
mov edx, ebx
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
jle 0x14004dd0b
mov eax, dword [rbp + 7]
cdq
sub eax, edx
sar eax, 1
mov r14d, eax
mov ebx, dword [rbp + 3]
mov r8d, dword [rbp - 0x19]
lea ecx, [r14 + r14]
lea r9d, [rbx + rbx]
mov eax, ecx
mov dword [rsp + 0x20], ecx
mov rcx, r15
cdq
sub eax, edx
sar eax, 1
sub r8d, eax
mov eax, r9d
cdq
add r8d, esi
sub eax, edx
mov edx, dword [rbp - 0x1d]
sar eax, 1
sub edx, eax
add edx, edi
call fcn.14004e6d0
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14004dd4e
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14004dd5d
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, qword [rbp - 0x29]
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rbp - 0x29]
mov rbx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov r14, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
mov rax, rbx
mov rbx, qword [rsp + 0xf0]
jmp 0x14004ddbe
test rax, rax
je 0x14004ddbc
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
mov r13, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xb0]
add rsp, 0xd8
pop r12
pop rbp
ret