Function at 0x14001151e
Capabilities:
Capture screenshot

Disassembly:
jmp 0x140014b60
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1f0], rax
lea rcx, [0x14002a0f2]
call fcn.1400114f6
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x24], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x44], eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0xc8], rax
mov r8d, dword [rbp + 0x44]
mov edx, dword [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0xe8], rax
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.GDI32.dll_SelectObject]
call qword [sym.imp.ucrtbased.dll_rand]
and eax, dword [rbp + 0x24]
mov dword [rbp + 0x104], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
idiv dword [rbp + 0x24]
mov eax, edx
mov ecx, dword [rbp + 0x68]
sub ecx, eax
mov eax, ecx
add eax, dword [rbp + 0x44]
mov ecx, 8
imul rcx, rcx, 0
mov dword [rbp + rcx + 0x98], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
idiv dword [rbp + 0x24]
mov eax, edx
mov ecx, dword [rbp + 0x68]
sub ecx, eax
mov eax, ecx
add eax, dword [rbp + 0x44]
mov ecx, 8
imul rcx, rcx, 0
mov dword [rbp + rcx + 0x9c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
idiv dword [rbp + 0x24]
mov eax, edx
mov ecx, dword [rbp + 0x68]
sub ecx, eax
mov eax, ecx
add eax, dword [rbp + 0x44]
mov ecx, 8
imul rcx, rcx, 1
mov dword [rbp + rcx + 0x98], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
idiv dword [rbp + 0x24]
mov eax, edx
mov ecx, dword [rbp + 0x68]
add ecx, eax
mov eax, ecx
add eax, dword [rbp + 0x44]
mov ecx, 8
imul rcx, rcx, 1
mov dword [rbp + rcx + 0x9c], eax
mov eax, dword [rbp + 0x104]
mov ecx, dword [rbp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x1d4], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
idiv dword [rbp + 0x24]
mov eax, edx
mov ecx, dword [rbp + 0x1d4]
sub ecx, eax
mov eax, ecx
add eax, dword [rbp + 0x44]
mov ecx, 8
imul rcx, rcx, 2
mov dword [rbp + rcx + 0x9c], eax
mov eax, dword [rbp + 0x104]
mov ecx, dword [rbp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x1d4], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
idiv dword [rbp + 0x24]
mov eax, edx
mov ecx, dword [rbp + 0x1d4]
sub ecx, eax
mov eax, ecx
add eax, dword [rbp + 0x44]
mov ecx, 8
imul rcx, rcx, 2
mov dword [rbp + rcx + 0x9c], eax
mov eax, dword [rbp + 0x6c]
mov ecx, dword [rbp + 0x74]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rbp + 0x68]
mov edx, dword [rbp + 0x70]
sub edx, ecx
mov ecx, edx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov eax, dword [rbp + 0x6c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x68]
mov r8, qword [rbp + 8]
lea rdx, [rbp + 0x98]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.GDI32.dll_PlgBlt]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
jne 0x140014dd4
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x140014db9
mov dword [rbp + 0x1d4], 0x8800c6
jmp 0x140014dc3
mov dword [rbp + 0x1d4], 0xee0086
mov eax, dword [rbp + 0x1d4]
mov dword [rbp + 0x1d8], eax
jmp 0x140014e86
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
jne 0x140014e1c
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
jne 0x140014e04
mov dword [rbp + 0x1dc], 0x660046
jmp 0x140014e0e
mov dword [rbp + 0x1dc], 0xee0086
mov eax, dword [rbp + 0x1dc]
mov dword [rbp + 0x1e0], eax
jmp 0x140014e7a
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
jne 0x140014e3a
mov dword [rbp + 0x1e4], 0x8800c6
jmp 0x140014e6e
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
jne 0x140014e58
mov dword [rbp + 0x1e8], 0x440328
jmp 0x140014e62
mov dword [rbp + 0x1e8], 0x1100a6
mov eax, dword [rbp + 0x1e8]
mov dword [rbp + 0x1e4], eax
mov eax, dword [rbp + 0x1e4]
mov dword [rbp + 0x1e0], eax
mov eax, dword [rbp + 0x1e0]
mov dword [rbp + 0x1d8], eax
mov eax, dword [rbp + 0x1d8]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0xc8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x44]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x24]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x50]
lea rdx, [0x140020cc0]
call fcn.14001143d
mov rcx, qword [rbp + 0x1f0]
xor rcx, rbp
call fcn.140011262
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret