Function at 0x140019cd0
Capabilities:
Capture screenshot
Log keystrokes

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbx
push r14
sub rsp, 0xa8
mov r14, r9
mov rbx, rcx
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x140019d00
xor eax, eax
add rsp, 0xa8
pop r14
pop rbx
ret
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], r12
lea rcx, str.DISPLAY
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x80], r15
call qword [sym.imp.GDI32.dll_CreateDCW]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [rbx]
mov r15d, dword [rbx + 4]
mov edi, dword [rbx + 8]
mov r12, rax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x50], eax
test r14, r14
je 0x140019d85
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
jle 0x140019d85
mov r14d, dword [rsp + 0x50]
mov r13d, dword [rsp + 0x50]
jmp 0x140019da7
mov edx, 8
mov rcx, rbp
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xa
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r13d, eax
xor eax, eax
test esi, esi
jns 0x140019dc1
lea ecx, [rax + 0x50]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
mov eax, 0
cmovle esi, eax
test r15d, r15d
cmovs r15d, eax
cmp edi, r14d
jle 0x140019ddf
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
cmovle edi, r14d
mov eax, dword [rsp + 0x50]
mov rcx, rbp
cmp eax, r13d
cmovg eax, r13d
sub edi, esi
sub eax, r15d
mov edx, edi
mov r8d, eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r12
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r15d
mov r14, rax
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x30], esi
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
cmp dword [rsp + 0xc8], 0
je 0x140019f51
xor eax, eax
mov r15d, eax
mov r13d, eax
call qword [sym.imp.USER32.dll_GetCursor]
lea rcx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_WindowFromPoint]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r14d, eax
cmp esi, eax
je 0x140019ebe
mov r8d, 1
mov edx, esi
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x140019ebe
call qword [sym.imp.USER32.dll_GetCursor]
xor r8d, r8d
mov edx, esi
mov ecx, r14d
mov rdi, rax
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
lea rdx, [rsp + 0x60]
xor esi, esi
mov qword [rsp + 0x60], rax
mov rcx, rdi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetIconInfo]
cmp dword [rsp + 0xd0], esi
je 0x140019f09
lea ecx, [rsi + 0x20]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x21]
mov r15d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r13d, eax
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x40], 0xb
sub r8d, dword [rbx + 4]
sub edx, dword [rbx]
mov qword [rsp + 0x38], rsi
sub r8d, dword [rsp + 0x68]
sub edx, dword [rsp + 0x64]
mov dword [rsp + 0x30], esi
sub r8d, r13d
sub edx, r15d
mov r9, rdi
mov rcx, r12
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_DrawIconEx]
mov r14, qword [rsp + 0x58]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r14
mov rbx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xc0]
mov rax, rbx
add rsp, 0xa8
pop r14
pop rbx
ret