Function at 0x18000f78c
Capabilities:
Capture screenshot
Get common file path

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x4c8], rbx
mov qword [rbp + 0x4d0], rsi
mov qword [rbp + 0x4d8], rdi
mov rax, qword [0x180295a70]
xor rax, rbp
mov qword [rbp + 0x480], rax
test dl, dl
mov rax, qword [rbp + 0x4e8]
mov dword [rbp + 0x1c], r9d
mov byte [rbp + 1], r8b
mov bl, dl
mov rdi, rcx
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rcx
jne 0x18000f7fa
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [rdi]
je 0x18000f7fa
mov esi, 0x80070057
jmp 0x18000f7fc
xor esi, esi
xor r12d, r12d
xor r14d, r14d
test esi, esi
mov dword [rbp + 0x18], r12d
js 0x18000f890
and dword [rbp + 8], r12d
xor eax, eax
test bl, bl
mov dword [rbp + 0xc], eax
mov dword [rbp + 0x10], eax
mov dword [rbp + 0x14], eax
jne 0x18000f837
mov rcx, qword [rdi]
lea rdx, [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r14d, dword [rbp + 0x14]
mov eax, dword [rbp + 0xc]
jmp 0x18000f881
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, 0x4c
mov qword [rdi], rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4d
mov dword [rbp + 8], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4e
mov dword [rbp + 0xc], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4f
add eax, dword [rbp + 8]
mov dword [rbp + 0x10], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, eax
mov eax, dword [rbp + 0xc]
add r14d, eax
mov r12d, dword [rbp + 0x10]
sub r12d, dword [rbp + 8]
sub r14d, eax
mov dword [rbp + 0x18], r12d
xor r15d, r15d
test esi, esi
mov ebx, 0x80070000
js 0x18000f8bd
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetWindowDC]
test rax, rax
mov r15, rax
jne 0x18000f8bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
xor r13d, r13d
test esi, esi
js 0x18000f8e5
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
test rax, rax
mov r13, rax
jne 0x18000f8e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
xor edi, edi
test esi, esi
mov qword [rbp + 0x20], rdi
js 0x18000f91a
mov r8d, r14d
mov edx, r12d
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test rax, rax
mov rdi, rax
mov qword [rbp + 0x20], rax
jne 0x18000f91a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
and qword [rbp + 8], 0
test esi, esi
js 0x18000f98d
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
test rax, rax
mov qword [rbp + 8], rax
jne 0x18000f948
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
js 0x18000f98d
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov r9d, r12d
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x18000f98d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
and word [rbp + 0x270], 0
mov ebx, 0x206
lea rcx, [rbp + 0x272]
mov r8, rbx
xor edx, edx
call fcn.1801603e0
and word [rbp + 0x60], 0
lea rcx, [rbp + 0x62]
mov r8, rbx
xor edx, edx
call fcn.1801603e0
and dword [rbp + 0x38], 0
xor edx, edx
lea r8d, [rdx + 0x1c]
lea rcx, [rbp + 0x3c]
call fcn.1801603e0
test esi, esi
js 0x18000fa1e
lea rdx, [rbp + 0x270]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x60]
lea rdx, [0x18018c1a8]
lea rcx, [rbp + 0x270]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea r8, [rbp + 0x38]
mov edx, 0x20
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, 0x80004005
test eax, eax
cmove esi, ecx
xor r12d, r12d
test esi, esi
mov byte [rbp], r12b
js 0x18000fae6
xor ecx, ecx
call fcn.18004cb20
movzx r8d, word [rbp + 0x4a]
mov edx, dword [rbp + 0x40]
mov ecx, dword [rbp + 0x3c]
and dword [rsp + 0x28], r12d
and dword [rsp + 0x20], r12d
xor r9d, r9d
mov byte [rbp], 1
call fcn.180051190
mov r12, rax
mov eax, 0x80004003
test r12, r12
cmove esi, eax
test esi, esi
js 0x18000fae6
mov rcx, r12
call fcn.18004d700
mov rcx, r12
mov dword [rbp + 4], eax
call fcn.18004d5c0
mov rcx, r12
mov edi, eax
call fcn.180053690
mov rcx, r12
mov rbx, rax
call fcn.18004d460
and dword [rsp + 0x30], 0
mov r9d, edi
mov rdi, qword [rbp + 0x20]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, r13
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x18000fabd
cmp eax, 0x57
jne 0x18000fac2
mov esi, 0x80070057
test esi, esi
js 0x18000fae6
mov rcx, r12
call fcn.18004d460
mov ecx, 0x80004003
test rax, rax
cmove esi, ecx
test esi, esi
js 0x18000fae6
mov ecx, dword [rbp + 4]
mov dword [rax + 0x24], ecx
mov dword [rax + 0x20], ecx
xor ebx, ebx
test esi, esi
js 0x18000fcb8
cmp byte [rbp + 1], bl
mov rcx, r12
je 0x18000fb3e
call fcn.180053390
mov rbx, rax
call qword [0x1802886b0]
mov ecx, dword [rbp + 0x4e0]
mov dword [rbp + 4], eax
call fcn.18000ce48
lea rcx, [rbp + 0x60]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test rbx, rbx
lea r9d, [rax + 1]
je 0x18000fbe8
cmp r9d, 0x3fffffff
jle 0x18000fb76
xor r8d, r8d
jmp 0x18000fbe3
call fcn.180052860
cmp dword [rbp + 0x1c], 0x18
je 0x18000fafd
test rax, rax
mov rdi, rax
je 0x18000fb6c
and qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
mov r8d, 0xff
mov rcx, rax
call fcn.1800523d0
mov rbx, rax
mov rcx, rdi
call fcn.180052160
jmp 0x18000fb00
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000fb8f
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180188080
sub rsp, rcx
xor ecx, ecx
lea rdi, [rsp + 0x50]
cmp rdi, rcx
je 0x18000fbe0
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
lea eax, [r9 + r9]
mov byte [rdi], cl
mov ecx, dword [rbp + 4]
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x60]
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb r8, r8
and r8, rdi
jmp 0x18000fbe3
mov r8, rcx
mov rdx, rbx
jmp 0x18000fc66
cmp r9d, 0x3fffffff
jle 0x18000fbf6
xor r8d, r8d
jmp 0x18000fc63
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000fc0f
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180188080
sub rsp, rcx
xor ecx, ecx
lea rdi, [rsp + 0x50]
cmp rdi, rcx
je 0x18000fc60
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
lea eax, [r9 + r9]
mov byte [rdi], cl
mov ecx, dword [rbp + 4]
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x60]
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb r8, r8
and r8, rdi
jmp 0x18000fc63
mov r8, rcx
mov rdx, r12
xor r9d, r9d
mov ecx, esi
call fcn.18004b820
mov eax, dword [rbp + 0x4f0]
mov r8d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x60]
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x1c]
mov edx, esi
mov dword [rsp + 0x20], eax
call fcn.18000e9c0
test rbx, rbx
mov esi, eax
je 0x18000fcb4
mov rcx, rbx
call fcn.180052160
mov rdi, qword [rbp + 0x20]
test r12, r12
je 0x18000fcc5
mov rcx, r12
call fcn.180052160
cmp byte [rbp], 0
je 0x18000fcd0
call fcn.18004d340
mov rax, qword [rbp + 8]
test rax, rax
je 0x18000fce5
mov rdx, rax
mov rcx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
test rdi, rdi
je 0x18000fcf3
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
test r13, r13
je 0x18000fd01
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteDC]
test r15, r15
je 0x18000fd0f
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov eax, esi
mov rcx, qword [rbp + 0x480]
xor rcx, rbp
call fcn.1801604e0
mov rbx, qword [rbp + 0x4c8]
mov rsi, qword [rbp + 0x4d0]
mov rdi, qword [rbp + 0x4d8]
lea rsp, [rbp + 0x490]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret