Function at 0x14001139d
Capabilities:
Capture screenshot

Disassembly:
jmp 0x140024570
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x540
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xdc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x568]
mov rax, qword [0x14003b878]
xor rax, rbp
mov qword [rbp + 0x4e8], rax
lea rcx, [0x140045069]
call fcn.140011c44
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.140011415
mov dword [rbp + 0x38], 1
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call fcn.140011361
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x88], rax
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0xa8], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0xc8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0xc8]
mov ecx, dword [rbp + 0xd0]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0xf4], eax
mov eax, dword [rbp + 0xcc]
mov ecx, dword [rbp + 0xd4]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x114], eax
mov r8d, dword [rbp + 0x114]
mov edx, dword [rbp + 0xf4]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0x138], rax
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbp + 0x158], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0xf4]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x18
call fcn.140011910
mov qword [rbp + 0x428], rax
cmp qword [rbp + 0x428], 0
je 0x14002471d
mov edx, 0x18
mov rcx, qword [rbp + 0x428]
call fcn.140011cfd
xor r8d, r8d
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x428]
call fcn.14001124e
mov qword [rbp + 0x4d8], rax
jmp 0x140024728
mov qword [rbp + 0x4d8], 0
mov rax, qword [rbp + 0x4d8]
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x178], rax
lea rdx, [rbp + 0x1b4]
lea rcx, [rbp + 0x194]
call fcn.1400117c6
mov eax, dword [rbp + 0x1b4]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x1d8], rax
mov r8, qword [rbp + 0x1d8]
mov edx, dword [rbp + 0x1b4]
mov ecx, dword [rbp + 0x194]
call fcn.1400112d0
mov dword [rbp + 0x224], 0
jmp 0x14002479e
mov eax, dword [rbp + 0x224]
inc eax
mov dword [rbp + 0x224], eax
mov eax, dword [rbp + 0x194]
cmp dword [rbp + 0x224], eax
jae 0x1400247fd
movsxd rax, dword [rbp + 0x224]
imul rax, rax, 0x68
lea rdx, [0x140033ba0]
mov rcx, qword [rbp + 0x1d8]
mov rcx, qword [rcx + rax + 0x40]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1400247fb
movsxd rax, dword [rbp + 0x224]
imul rax, rax, 0x68
lea rcx, [rbp + 0x1f8]
mov rdx, qword [rbp + 0x1d8]
mov rdi, rcx
lea rsi, [rdx + rax]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
jmp 0x140024790
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, [rbp + 0x248]
call fcn.1400119a6
nop
lea rax, [rbp + 0x448]
mov qword [rbp + 0x478], rax
lea rax, [rbp + 0x498]
mov qword [rbp + 0x4c8], rax
mov rdx, qword [rbp + 0x478]
mov rcx, qword [rbp + 0x510]
call fcn.14001117c
mov qword [rbp + 0x4d8], rax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x510]
call fcn.140011c80
mov qword [rbp + 0x4e0], rax
mov r8, qword [rbp + 0x4d8]
mov rdx, qword [rbp + 0x4e0]
lea rcx, [rbp + 0x248]
call fcn.140011811
lea rcx, [rbp + 0x248]
call fcn.1400113fc
xor r9d, r9d
lea r8, [rbp + 0x1f8]
mov rdx, rax
mov rcx, qword [rbp + 0x178]
call fcn.140011b3b
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.GDI32.dll_DeleteObject]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdx, qword [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rbp + 8]
call fcn.140011677
nop
lea rcx, [rbp + 0x248]
call fcn.140011ac3
nop
mov rcx, qword [rbp + 0x510]
call fcn.140011249
lea rcx, [rbp - 0x50]
lea rdx, [0x140032630]
call fcn.140011a5f
mov rcx, qword [rbp + 0x4e8]
xor rcx, rbp
call fcn.1400115fa
lea rsp, [rbp + 0x4f0]
pop rdi
pop rsi
pop rbp
ret