Function at 0x140001000
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov r14d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov r15d, eax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor r12d, r12d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r15d
mov edx, r14d
mov rcx, rbp
mov rsi, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [rsp + 0x6c]
mov r8, rbp
mov r9d, dword [rsp + 0x60]
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x38], r12
lea ecx, [r9 + 0x64]
mov dword [rsp + 0x70], ecx
lea eax, [r9 + 0xa]
mov dword [rsp + 0x78], eax
lea ecx, [rdx - 0xa]
lea eax, [rdx + 0x64]
mov dword [rsp + 0x74], ecx
mov ecx, dword [rsp + 0x64]
mov dword [rsp + 0x7c], eax
mov eax, r9d
sub eax, r14d
mov dword [rsp + 0x80], eax
mov eax, edx
sub eax, r15d
sub edx, ecx
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x68]
sub eax, r9d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_PlgBlt]
mov r8d, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
lea eax, [r9 - 0xa]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x70], eax
lea eax, [r8 + 0xa]
mov dword [rsp + 0x74], eax
lea eax, [rdx - 0x64]
mov dword [rsp + 0x78], eax
sub edx, r9d
lea eax, [r8 - 0xa]
sub r8d, ecx
mov dword [rsp + 0x30], r8d
mov r8, rbp
mov dword [rsp + 0x7c], eax
lea eax, [r9 + 0xa]
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x80], eax
lea eax, [rcx + r14]
mov dword [rsp + 0x20], ecx
mov rcx, rbp
mov dword [rsp + 0x84], eax
call qword [sym.imp.GDI32.dll_PlgBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx ebx, r8b
shl ebx, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 0x10
or edi, ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx ecx, r8b
or ecx, edi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0x8928e28
mov r9d, r14d
mov dword [rsp + 0x38], r12d
xor r8d, r8d
mov dword [rsp + 0x30], r12d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov rcx, rbp
mov dword [rsp + 0x20], r15d
call qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r15d
mov ebx, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x50], 0xee0086
mov r9d, r14d
mov dword [rsp + 0x48], r15d
cdq
idiv r14d
mov dword [rsp + 0x40], r14d
xor r8d, r8d
mov dword [rsp + 0x38], ebx
mov rcx, rbp
mov dword [rsp + 0x30], edx
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r15d
call qword [sym.imp.GDI32.dll_StretchBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r15d
mov ebx, edx
neg ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x50], 0xee0086
cdq
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r14d
idiv r14d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rbp
mov r9d, r14d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_StretchBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r15d
mov ebx, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x50], 0xee0086
mov r9d, r14d
mov dword [rsp + 0x48], r15d
cdq
idiv r14d
mov dword [rsp + 0x40], r14d
xor r8d, r8d
neg edx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
mov rcx, rbp
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.GDI32.dll_StretchBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r15d
mov ebx, edx
neg ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x50], 0xee0086
mov r9d, r14d
mov dword [rsp + 0x48], r15d
cdq
idiv r14d
mov dword [rsp + 0x40], r14d
xor r8d, r8d
neg edx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
mov rcx, rbp
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x140001068