Function at 0x1400516a0
Capabilities:
Capture screenshot

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
lea rdi, [rsp + 0x50]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x180]
mov byte [rsp + 0x13d], 0
mov byte [rsp + 0x13c], 0
mov ecx, dword [rsp + 0x1b8]
call fcn.140052950
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1400f9220
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x198]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x198], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x1a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a0], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x1a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x1b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1b0], eax
mov eax, dword [rsp + 0x1a8]
cmp dword [rsp + 0x198], eax
jle 0x140051787
mov dword [rsp + 0x140], 1
jmp 0x140051792
mov dword [rsp + 0x140], 0
movzx eax, byte [rsp + 0x140]
mov byte [rsp + 0x74], al
mov eax, dword [rsp + 0x1b0]
cmp dword [rsp + 0x1a0], eax
jle 0x1400517bb
mov dword [rsp + 0x144], 1
jmp 0x1400517c6
mov dword [rsp + 0x144], 0
movzx eax, byte [rsp + 0x144]
mov byte [rsp + 0x75], al
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x1b0]
mov dword [rsp + 0x84], eax
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x140051826
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0x80], eax
movzx eax, byte [rsp + 0x75]
test eax, eax
je 0x140051848
mov eax, dword [rsp + 0x1b0]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x1c0], 0
jge 0x14005185d
mov dword [rsp + 0x1c0], 0
cmp dword [rsp + 0x1c0], 0xff
jle 0x140051875
mov dword [rsp + 0x1c0], 0xff
cmp dword [rsp + 0x1c0], 0
jle 0x1400518bd
mov eax, dword [rsp + 0x50]
and rax, 0xff
mov byte [rsp + 0x8f], al
movzx eax, word [rsp + 0x50]
sar eax, 8
cdqe
and rax, 0xff
mov byte [rsp + 0x90], al
mov eax, dword [rsp + 0x50]
shr eax, 0x10
mov eax, eax
and rax, 0xff
mov byte [rsp + 0x91], al
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
jne 0x1400518e2
mov eax, 0xa0070000
jmp 0x140052495
mov byte [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x80]
sub ecx, eax
mov eax, ecx
inc eax
mov dword [rsp + 0xc8], eax
mov eax, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x84]
sub ecx, eax
mov eax, ecx
inc eax
mov dword [rsp + 0xcc], eax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x14005199b
mov r8d, dword [rsp + 0xcc]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
jne 0x1400519a5
jmp 0x140052310
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
jne 0x1400519d8
jmp 0x140052310
mov dword [rsp + 0x40], 0xcc0020
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xc8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x140051a31
jmp 0x140052310
mov byte [rsp + 0x13c], 1
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x114]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf4]
lea r8, [rsp + 0xd4]
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
call fcn.1400524c0
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
jne 0x140051a90
jmp 0x140052310
cmp byte [rsp + 0x13c], 0
jne 0x140051aa6
lea rcx, [0x140278880]
call fcn.1401352a0
mov eax, dword [rsp + 0xd4]
imul eax, dword [rsp + 0xf4]
mov dword [rsp + 0x128], eax
movzx eax, byte [rsp + 0x114]
test eax, eax
je 0x140051b91
mov byte [rsp + 0x13d], 1
mov dword [rsp + 0x124], 0
jmp 0x140051b0f
cmp byte [rsp + 0x13d], 0
jne 0x140051af7
lea rcx, [0x140278890]
call fcn.1401352a0
mov eax, dword [rsp + 0x124]
inc eax
mov byte [rsp + 0x13d], 1
mov dword [rsp + 0x124], eax
cmp byte [rsp + 0x13d], 0
jne 0x140051b25
lea rcx, [0x140278890]
call fcn.1401352a0
mov eax, dword [rsp + 0x128]
cmp dword [rsp + 0x124], eax
jge 0x140051b91
cmp byte [rsp + 0x13d], 0
jne 0x140051b4b
lea rcx, [0x140278890]
call fcn.1401352a0
cmp byte [rsp + 0x13d], 0
jne 0x140051b61
lea rcx, [0x140278890]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x124]
mov rcx, qword [rsp + 0xb8]
mov eax, dword [rcx + rax*4]
and eax, 0xf8f8f8f8
movsxd rcx, dword [rsp + 0x124]
mov rdx, qword [rsp + 0xb8]
mov dword [rdx + rcx*4], eax
jmp 0x140051ae1
cmp qword [rsp + 0x1c8], 0
je 0x140051bdd
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0xb8]
mov eax, dword [rcx + rax]
and eax, 0xffffff
mov dword [rsp + 0x12c], eax
mov r8d, dword [rsp + 0x12c]
lea rdx, [0x140278828]
mov rcx, qword [rsp + 0x1c8]
call fcn.14000f7d0
jmp 0x140052310
cmp dword [rsp + 0x1c0], 1
jge 0x140051e39
movzx eax, byte [rsp + 0x114]
test eax, eax
je 0x140051c0a
mov eax, dword [rsp + 0x1b8]
and eax, 0xf8f8f8f8
mov dword [rsp + 0x1b8], eax
mov dword [rsp + 0x130], 0
jmp 0x140051c27
mov eax, dword [rsp + 0x130]
inc eax
mov dword [rsp + 0x130], eax
mov eax, dword [rsp + 0x128]
cmp dword [rsp + 0x130], eax
jge 0x140051e34
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x140051c75
movzx eax, byte [rsp + 0x75]
test eax, eax
je 0x140051c75
mov eax, dword [rsp + 0x130]
mov ecx, dword [rsp + 0x128]
sub ecx, eax
mov eax, ecx
dec eax
mov byte [rsp + 0x13d], 1
mov dword [rsp + 0x124], eax
jmp 0x140051dee
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x140051d31
cmp byte [rsp + 0x13c], 0
jne 0x140051c98
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x140051cae
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x140051cc4
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x140051cda
lea rcx, [0x140278880]
call fcn.1401352a0
mov eax, dword [rsp + 0x130]
cdq
idiv dword [rsp + 0xd4]
imul eax, dword [rsp + 0xd4]
add eax, dword [rsp + 0xd4]
mov dword [rsp + 0x148], eax
mov eax, dword [rsp + 0x130]
cdq
idiv dword [rsp + 0xd4]
mov eax, edx
mov ecx, dword [rsp + 0x148]
sub ecx, eax
mov eax, ecx
dec eax
mov byte [rsp + 0x13d], 1
mov dword [rsp + 0x124], eax
jmp 0x140051dee
movzx eax, byte [rsp + 0x75]
test eax, eax
je 0x140051dd8
cmp byte [rsp + 0x13c], 0
jne 0x140051d54
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x140051d6a
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x140051d80
lea rcx, [0x140278880]
call fcn.1401352a0
mov eax, dword [rsp + 0x130]
mov ecx, dword [rsp + 0x128]
sub ecx, eax
mov eax, ecx
dec eax
cdq
idiv dword [rsp + 0xd4]
imul eax, dword [rsp + 0xd4]
mov dword [rsp + 0x14c], eax
mov eax, dword [rsp + 0x130]
cdq
idiv dword [rsp + 0xd4]
mov eax, edx
mov ecx, dword [rsp + 0x14c]
add ecx, eax
mov eax, ecx
mov byte [rsp + 0x13d], 1
mov dword [rsp + 0x124], eax
jmp 0x140051dee
mov byte [rsp + 0x13d], 1
mov eax, dword [rsp + 0x130]
mov dword [rsp + 0x124], eax
cmp byte [rsp + 0x13d], 0
jne 0x140051e04
lea rcx, [0x140278890]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x124]
mov rcx, qword [rsp + 0xb8]
mov eax, dword [rcx + rax*4]
and eax, 0xffffff
cmp eax, dword [rsp + 0x1b8]
jne 0x140051e2f
mov byte [rsp + 0xa0], 1
jmp 0x140051e34
jmp 0x140051c17
jmp 0x140052310
movzx eax, byte [rsp + 0x114]
test eax, eax
je 0x140051e81
movzx eax, byte [rsp + 0x8f]
and eax, 0xf8
mov byte [rsp + 0x8f], al
movzx eax, byte [rsp + 0x90]
and eax, 0xf8
mov byte [rsp + 0x90], al
movzx eax, byte [rsp + 0x91]
and eax, 0xf8
mov byte [rsp + 0x91], al
movzx eax, byte [rsp + 0x8f]
cmp dword [rsp + 0x1c0], eax
jle 0x140051e9f
mov dword [rsp + 0x150], 0
jmp 0x140051eb5
movzx eax, byte [rsp + 0x8f]
sub eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x150], eax
movzx eax, byte [rsp + 0x150]
mov byte [rsp + 0x92], al
movzx eax, byte [rsp + 0x90]
cmp dword [rsp + 0x1c0], eax
jle 0x140051ee2
mov dword [rsp + 0x154], 0
jmp 0x140051ef8
movzx eax, byte [rsp + 0x90]
sub eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x154], eax
movzx eax, byte [rsp + 0x154]
mov byte [rsp + 0x93], al
movzx eax, byte [rsp + 0x91]
cmp dword [rsp + 0x1c0], eax
jle 0x140051f25
mov dword [rsp + 0x158], 0
jmp 0x140051f3b
movzx eax, byte [rsp + 0x91]
sub eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x158], eax
movzx eax, byte [rsp + 0x158]
mov byte [rsp + 0x94], al
movzx eax, byte [rsp + 0x8f]
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x1c0], eax
jle 0x140051f71
mov dword [rsp + 0x15c], 0xff
jmp 0x140051f87
movzx eax, byte [rsp + 0x8f]
add eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x15c], eax
movzx eax, byte [rsp + 0x15c]
mov byte [rsp + 0x95], al
movzx eax, byte [rsp + 0x90]
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x1c0], eax
jle 0x140051fbd
mov dword [rsp + 0x160], 0xff
jmp 0x140051fd3
movzx eax, byte [rsp + 0x90]
add eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x160], eax
movzx eax, byte [rsp + 0x160]
mov byte [rsp + 0x96], al
movzx eax, byte [rsp + 0x91]
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x1c0], eax
jle 0x140052009
mov dword [rsp + 0x164], 0xff
jmp 0x14005201f
movzx eax, byte [rsp + 0x91]
add eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x164], eax
movzx eax, byte [rsp + 0x164]
mov byte [rsp + 0x97], al
mov dword [rsp + 0x134], 0
jmp 0x14005204b
mov eax, dword [rsp + 0x134]
inc eax
mov dword [rsp + 0x134], eax
mov eax, dword [rsp + 0x128]
cmp dword [rsp + 0x134], eax
jge 0x140052310
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x140052099
movzx eax, byte [rsp + 0x75]
test eax, eax
je 0x140052099
mov eax, dword [rsp + 0x134]
mov ecx, dword [rsp + 0x128]
sub ecx, eax
mov eax, ecx
dec eax
mov byte [rsp + 0x13d], 1
mov dword [rsp + 0x124], eax
jmp 0x140052212
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x140052155
cmp byte [rsp + 0x13c], 0
jne 0x1400520bc
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x1400520d2
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x1400520e8
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x1400520fe
lea rcx, [0x140278880]
call fcn.1401352a0
mov eax, dword [rsp + 0x134]
cdq
idiv dword [rsp + 0xd4]
imul eax, dword [rsp + 0xd4]
add eax, dword [rsp + 0xd4]
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x134]
cdq
idiv dword [rsp + 0xd4]
mov eax, edx
mov ecx, dword [rsp + 0x168]
sub ecx, eax
mov eax, ecx
dec eax
mov byte [rsp + 0x13d], 1
mov dword [rsp + 0x124], eax
jmp 0x140052212
movzx eax, byte [rsp + 0x75]
test eax, eax
je 0x1400521fc
cmp byte [rsp + 0x13c], 0
jne 0x140052178
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x14005218e
lea rcx, [0x140278880]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x1400521a4
lea rcx, [0x140278880]
call fcn.1401352a0
mov eax, dword [rsp + 0x134]
mov ecx, dword [rsp + 0x128]
sub ecx, eax
mov eax, ecx
dec eax
cdq
idiv dword [rsp + 0xd4]
imul eax, dword [rsp + 0xd4]
mov dword [rsp + 0x16c], eax
mov eax, dword [rsp + 0x134]
cdq
idiv dword [rsp + 0xd4]
mov eax, edx
mov ecx, dword [rsp + 0x16c]
add ecx, eax
mov eax, ecx
mov byte [rsp + 0x13d], 1
mov dword [rsp + 0x124], eax
jmp 0x140052212
mov byte [rsp + 0x13d], 1
mov eax, dword [rsp + 0x134]
mov dword [rsp + 0x124], eax
cmp byte [rsp + 0x13d], 0
jne 0x140052228
lea rcx, [0x140278890]
call fcn.1401352a0
movsxd rax, dword [rsp + 0x124]
mov rcx, qword [rsp + 0xb8]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x88]
shr eax, 0x10
mov eax, eax
and rax, 0xff
mov byte [rsp + 0x8c], al
movzx eax, word [rsp + 0x88]
sar eax, 8
cdqe
and rax, 0xff
mov byte [rsp + 0x8d], al
mov eax, dword [rsp + 0x88]
and rax, 0xff
mov byte [rsp + 0x8e], al
movzx eax, byte [rsp + 0x8c]
movzx ecx, byte [rsp + 0x92]
cmp eax, ecx
jl 0x14005230b
movzx eax, byte [rsp + 0x8c]
movzx ecx, byte [rsp + 0x95]
cmp eax, ecx
jg 0x14005230b
movzx eax, byte [rsp + 0x8d]
movzx ecx, byte [rsp + 0x93]
cmp eax, ecx
jl 0x14005230b
movzx eax, byte [rsp + 0x8d]
movzx ecx, byte [rsp + 0x96]
cmp eax, ecx
jg 0x14005230b
movzx eax, byte [rsp + 0x8e]
movzx ecx, byte [rsp + 0x94]
cmp eax, ecx
jl 0x14005230b
movzx eax, byte [rsp + 0x8e]
movzx ecx, byte [rsp + 0x97]
cmp eax, ecx
jg 0x14005230b
mov byte [rsp + 0xa0], 1
jmp 0x140052310
jmp 0x14005203b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x138], eax
mov rdx, qword [rsp + 0x98]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
cmp qword [rsp + 0xa8], 0
je 0x140052367
cmp qword [rsp + 0xc0], 0
je 0x140052359
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.GDI32.dll_DeleteDC]
cmp qword [rsp + 0xb0], 0
je 0x140052380
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.GDI32.dll_DeleteObject]
cmp qword [rsp + 0xb8], 0
je 0x14005239a
mov rcx, qword [rsp + 0xb8]
call fcn.1401a7da0
jmp 0x1400523ab
mov eax, dword [rsp + 0x138]
or eax, 0xa0070000
jmp 0x140052495
cmp qword [rsp + 0x1c8], 0
je 0x1400523c0
mov eax, 1
jmp 0x140052495
movzx eax, byte [rsp + 0xa0]
test eax, eax
je 0x14005247e
cmp byte [rsp + 0x13d], 0
jne 0x1400523e6
lea rcx, [0x140278890]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x1400523fc
lea rcx, [0x140278880]
call fcn.1401352a0
mov eax, dword [rsp + 0x124]
cdq
idiv dword [rsp + 0xd4]
mov eax, edx
mov ecx, dword [rsp + 0x78]
add ecx, eax
mov eax, ecx
sub eax, dword [rsp + 0x68]
mov edx, eax
mov rcx, qword [rsp + 0x188]
call fcn.14000b790
cmp byte [rsp + 0x13d], 0
jne 0x14005243e
lea rcx, [0x140278890]
call fcn.1401352a0
cmp byte [rsp + 0x13c], 0
jne 0x140052454
lea rcx, [0x140278880]
call fcn.1401352a0
mov eax, dword [rsp + 0x124]
cdq
idiv dword [rsp + 0xd4]
mov ecx, dword [rsp + 0x7c]
add ecx, eax
mov eax, ecx
sub eax, dword [rsp + 0x6c]
mov edx, eax
mov rcx, qword [rsp + 0x190]
call fcn.14000b790
movzx eax, byte [rsp + 0xa0]
mov rcx, qword [rsp + 0x180]
mov dword [rcx], eax
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WSOCK32.dll_connect
call fcn.140134a00
mov rax, rdi
add rsp, 0x170
pop rdi
ret