Function at 0x1400025b4
Capabilities:
Capture screenshot

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x180], rcx
lea rax, [rbp + 0xa0]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call fcn.140021430
lea rdx, [rbp + 0xa0]
lea rax, [rbp + 0x98]
mov r8d, 0
mov rcx, rax
call sub.gdiplus.dll_GdiplusStartup
mov rax, qword [sym.imp.USER32.dll_SetProcessDPIAware]
call rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x13c], eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x138], eax
mov rax, qword [sym.imp.USER32.dll_GetDesktopWindow]
call rax
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x12c], eax
mov rax, qword [rbp + 0x130]
mov edx, 0xa
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x128], eax
mov rax, qword [rbp + 0x130]
mov edx, 0x58
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x124], eax
mov rax, qword [rbp + 0x130]
mov edx, 0x5a
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x120], eax
mov eax, dword [rbp + 0x124]
movsxd rdx, eax
imul rdx, rdx, 0x2aaaaaab
shr rdx, 0x20
sar edx, 4
sar eax, 0x1f
mov ecx, eax
mov eax, edx
sub eax, ecx
mov dword [rbp + 0x11c], eax
mov eax, dword [rbp + 0x120]
movsxd rdx, eax
imul rdx, rdx, 0x2aaaaaab
shr rdx, 0x20
sar edx, 4
sar eax, 0x1f
mov ecx, eax
mov eax, edx
sub eax, ecx
mov dword [rbp + 0x118], eax
mov eax, dword [rbp + 0x13c]
imul eax, dword [rbp + 0x11c]
mov dword [rbp + 0x114], eax
mov eax, dword [rbp + 0x138]
imul eax, dword [rbp + 0x118]
mov dword [rbp + 0x110], eax
mov rax, qword [rbp + 0x130]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x108], rax
mov ecx, dword [rbp + 0x110]
mov edx, dword [rbp + 0x114]
mov rax, qword [rbp + 0x130]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0x100], rax
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov ecx, dword [rbp + 0x114]
mov rax, qword [rbp + 0x108]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x130]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x110]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov rdx, qword [rbp + 0x100]
lea rax, [rbp + 0x80]
mov r8d, 0
mov rcx, rax
call fcn.140021600
lea rax, [rbp + 0x70]
lea rdx, str.image_png
mov rcx, rax
call fcn.140002439
mov dword [rbp + 0x40], 1
mov rax, qword [0x14013c130]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rdx
mov dword [rbp + 0x5c], 4
mov dword [rbp + 0x58], 1
mov dword [rbp + 0x3c], 0x64
lea rax, [rbp + 0x3c]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
mov r8, rax
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
call rax
mov rdx, qword [rbp + 0x30]
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x70]
lea rax, [rbp + 0x80]
mov r9, r8
mov r8, rcx
mov rcx, rax
call fcn.140021480
mov qword [rbp + 0x28], 0
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov r10, qword [rax]
mov rax, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov r9, rcx
mov r8d, 2
mov rcx, rax
call r10
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov r10, qword [rax]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
lea rax, [rbp + 0xc6]
mov rcx, rax
call fcn.140090cc0
mov eax, dword [rbp + 0x20]
mov ecx, eax
lea rdx, [rbp + 0xc6]
mov rax, rbp
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call fcn.140104140
lea rax, [rbp + 0xc6]
mov rcx, rax
call fcn.140090d30
mov dword [rbp - 4], 0
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
add rax, 0x18
mov rbx, qword [rax]
mov rax, qword [rbp + 0x30]
mov rsi, rax
mov rax, rbp
mov rcx, rax
call fcn.1400465a0
mov edi, eax
mov rax, rbp
mov rcx, rax
call fcn.140103c50
lea rdx, [rbp - 4]
mov r9, rdx
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call rbx
mov rcx, qword [rbp + 0x180]
call fcn.14010bef0
lea rax, [rbp + 0xc7]
mov rcx, rax
call fcn.140090c40
lea rdx, [rbp + 0xc7]
lea rax, [rbp - 0x30]
mov r8, rdx
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rcx, rax
call fcn.14010c2a0
lea rax, [rbp + 0xc7]
mov rcx, rax
call fcn.140090c70
mov rax, rbp
mov rcx, rax
call fcn.1400465a0
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0xf8]
add rax, 2
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
mov rax, rdx
shr rax, 1
shl rax, 2
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 0xf0]
mov rdx, rax
mov rcx, qword [rbp + 0x180]
call fcn.140108870
mov rax, rbp
mov rcx, rax
call fcn.140103c50
mov qword [rbp + 0xe8], rax
mov edx, 0
mov rcx, qword [rbp + 0x180]
call fcn.14010d4c0
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x140], 0
jmp 0x140002c32
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0xf8]
jae 0x140002a8a
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0x148]
lea rdx, [rax + 1]
mov qword [rbp + 0x148], rdx
add rax, rcx
movzx eax, byte [rax]
movzx eax, al
jmp 0x140002a8f
mov eax, 0
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0xf8]
jae 0x140002ac9
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0x148]
lea rdx, [rax + 1]
mov qword [rbp + 0x148], rdx
add rax, rcx
movzx eax, byte [rax]
movzx eax, al
jmp 0x140002ace
mov eax, 0
mov dword [rbp + 0xd0], eax
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0xf8]
jae 0x140002b08
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0x148]
lea rdx, [rax + 1]
mov qword [rbp + 0x148], rdx
add rax, rcx
movzx eax, byte [rax]
movzx eax, al
jmp 0x140002b0d
mov eax, 0
mov dword [rbp + 0xcc], eax
mov eax, dword [rbp + 0xd4]
shl eax, 0x10
mov edx, eax
mov eax, dword [rbp + 0xd0]
shl eax, 8
add edx, eax
mov eax, dword [rbp + 0xcc]
add eax, edx
mov dword [rbp + 0xc8], eax
mov eax, dword [rbp + 0xc8]
shr eax, 0x12
mov eax, eax
and eax, 0x3f
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140049b10
movzx eax, byte [rax]
mov ecx, eax
mov r8, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x140]
lea rdx, [rax + 1]
mov qword [rbp + 0x140], rdx
add rax, r8
mov byte [rax], cl
mov eax, dword [rbp + 0xc8]
shr eax, 0xc
mov eax, eax
and eax, 0x3f
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140049b10
movzx eax, byte [rax]
mov ecx, eax
mov r8, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x140]
lea rdx, [rax + 1]
mov qword [rbp + 0x140], rdx
add rax, r8
mov byte [rax], cl
mov eax, dword [rbp + 0xc8]
shr eax, 6
mov eax, eax
and eax, 0x3f
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140049b10
movzx eax, byte [rax]
mov ecx, eax
mov r8, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x140]
lea rdx, [rax + 1]
mov qword [rbp + 0x140], rdx
add rax, r8
mov byte [rax], cl
mov eax, dword [rbp + 0xc8]
and eax, 0x3f
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140049b10
movzx eax, byte [rax]
mov ecx, eax
mov r8, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x140]
lea rdx, [rax + 1]
mov qword [rbp + 0x140], rdx
add rax, r8
mov byte [rax], cl
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0xf8]
jb 0x140002a56
mov rcx, qword [rbp + 0xf8]
movabs rdx, 0xaaaaaaaaaaaaaaab
mov rax, rcx
mul rdx
shr rdx, 1
mov rax, rdx
add rax, rax
add rax, rdx
sub rcx, rax
mov rdx, rcx
mov eax, 3
sub rax, rdx
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 3
je 0x140002ca5
mov rax, qword [rbp + 0xf0]
sub rax, qword [rbp + 0xd8]
mov rdx, rax
mov rcx, qword [rbp + 0x180]
call fcn.140108870
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x130]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov rax, qword [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
add rax, 0x10
mov rax, qword [rax]
mov rdx, qword [rbp + 0x30]
mov rcx, rdx
call rax
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14010ce50
mov rax, rbp
mov rcx, rax
call fcn.140104350
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.140021710
jmp 0x140002d95
mov rax, qword [rbp + 0x180]
add rsp, 0x1d8
pop rbx
pop rsi
pop rdi
pop rbp
ret