Function at 0x7ff876eece90
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov r12, rcx
xor eax, eax
mov r13, qword [0x7ff876f68028]
mov dword [rbp], 1
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rbp + 0x80]
call qword [sym.imp.GdiPlus.dll_GdiplusStartup]
call qword [sym.imp.user32.dll_GetDesktopWindow]
mov ecx, 0x4e
call qword [sym.imp.user32.dll_GetSystemMetrics]
mov r14d, eax
mov ecx, 0x4f
call qword [sym.imp.user32.dll_GetSystemMetrics]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.user32.dll_GetDC]
mov r15, rax
mov rcx, rax
call qword [sym.imp.gdi32.dll_CreateCompatibleDC]
mov rdi, rax
mov r8d, ebx
mov edx, r14d
mov rcx, r15
call qword [sym.imp.gdi32.dll_CreateCompatibleBitmap]
mov rsi, rax
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.gdi32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
xor eax, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebx
mov r9d, r14d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.gdi32.dll_BitBlt]
mov rcx, rdi
call qword [sym.imp.gdi32.dll_DeleteDC]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.user32.dll_ReleaseDC]
mov qword [rbp + 0x78], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
xor esi, esi
mov qword [rbp - 0x50], rsi
movups xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x7ff876f57560]
movdqu xmmword [rbp - 0x38], xmm1
mov eax, dword [0x7ff876f54e7c]
mov word [rbp - 0x48], ax
movzx eax, byte [0x7ff876f54e7e]
mov byte [rbp - 0x46], al
mov byte [rbp - 0x45], sil
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call fcn.7ff876eef650
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x78]
call fcn.7ff876eec780
test al, al
je 0x7ff876eed34f
mov r8, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x60]
sub r8, rdi
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.7ff876eecad0
nop
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.7ff876ef0f60
nop
lea rax, [rsp + 0x70]
mov qword [rbp + 0x78], rax
mov byte [rsp + 0x70], sil
xor eax, eax
mov qword [rsp + 0x78], rax
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.7ff876ef0ac0
mov byte [rsp + 0x70], 3
lea ecx, [rsi + 0x20]
call fcn.7ff876f1223c
nop
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 6
mov qword [rax + 0x18], 0xf
mov ecx, dword [0x7ff876f550b4]
mov dword [rax], ecx
movzx ecx, word [0x7ff876f550b8]
mov word [rax + 4], cx
mov byte [rax + 6], sil
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], 0xf
mov rax, qword [0x7ff876f54c88]
mov dword [rsp + 0x50], eax
movzx eax, word [0x7ff876f54c8c]
mov word [rsp + 0x54], ax
movzx eax, byte [0x7ff876f54c8e]
mov byte [rsp + 0x56], al
mov byte [rsp + 0x57], sil
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.7ff876ef4060
nop
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x70]
mov byte [rax], cl
mov byte [rsp + 0x70], dl
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0x78]
mov qword [rax + 8], rdx
mov qword [rsp + 0x78], rcx
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.7ff876ef0ac0
nop
lea rax, [rsp + 0x50]
mov qword [rbp + 0x88], rax
mov byte [rsp + 0x50], sil
xor eax, eax
mov qword [rsp + 0x58], rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.7ff876ef0ac0
mov byte [rsp + 0x50], 3
lea ecx, [rsi + 0x20]
call fcn.7ff876f1223c
mov rbx, rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.7ff876eef650
nop
mov qword [rsp + 0x58], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 0xa
mov qword [rbp - 0x78], 0xf
movsd xmm0, qword [0x7ff876f550c0]
movsd qword [rsp + 0x70], xmm0
movzx eax, word [0x7ff876f550c8]
mov word [rsp + 0x78], ax
mov byte [rsp + 0x7a], sil
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.7ff876ef4060
nop
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x50]
mov byte [rax], cl
mov byte [rsp + 0x50], dl
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0x58]
mov qword [rax + 8], rdx
mov qword [rsp + 0x58], rcx
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.7ff876ef0ac0
nop
mov rax, qword [r13]
mov rbx, qword [rax + 0x10]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.7ff876eeede0
nop
mov rdx, rax
mov rcx, r13
call rbx
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x7ff876eed1ff
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876eed1fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876eed440
call fcn.7ff876f125fc
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.GdiPlus.dll_GdiplusShutdown]
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], rsi
mov qword [r12 + 0x18], rsi
mov ecx, 0x20
call fcn.7ff876f1223c
mov qword [r12], rax
mov qword [r12 + 0x10], 0x1c
mov qword [r12 + 0x18], 0x1f
movups xmm0, xmmword [0x7ff876f550d0]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x7ff876f550e0]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x7ff876f550e8]
mov dword [rax + 0x18], ecx
mov byte [rax + 0x1c], 0
movzx edx, byte [rbp - 0x70]
lea rcx, [rbp - 0x68]
call fcn.7ff876ef0ac0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x7ff876eed2ab
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876eed2a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876eed446
call fcn.7ff876f125fc
movdqa xmm0, xmmword [0x7ff876f57550]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x7ff876eed2f8
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876eed2f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876eed44c
call fcn.7ff876f125fc
nop
test rdi, rdi
je 0x7ff876eed331
mov rdx, qword [rbp - 0x50]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x7ff876eed329
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876eed452
mov rcx, rdi
call fcn.7ff876f125fc
mov rax, r12
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.GdiPlus.dll_GdiplusShutdown]
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], rsi
mov qword [r12 + 0x18], rsi
mov ecx, 0x30
call fcn.7ff876f1223c
mov qword [r12], rax
mov qword [r12 + 0x10], 0x29
mov qword [r12 + 0x18], 0x2f
movups xmm0, xmmword [0x7ff876f550f0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x7ff876f55100]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x7ff876f55110]
movsd qword [rax + 0x20], xmm0
movzx ecx, byte [0x7ff876f55118]
mov byte [rax + 0x28], cl
mov byte [rax + 0x29], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x7ff876eed3f6
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876eed3f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876eed434
call fcn.7ff876f125fc
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x7ff876eed331
mov rdx, qword [rbp - 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876eed32c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876eed43a
jmp 0x7ff876eed32c
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
int3