Function at 0x1401c4c1c
Capabilities:
Capture screenshot

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x218
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x190], 0xfffffffffffffffe
mov r15, rcx
mov ebx, dword [rdx + 0x8c]
mov r14d, dword [rdx + 0x90]
mov r12d, dword [rdx + 0x94]
mov r13d, dword [rdx + 0x98]
call qword [sym.imp.user32.dll_GetDesktopWindow]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.user32.dll_GetWindowDC]
mov rsi, rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x80], 1
mov qword [rbp + 0x88], rdi
mov rcx, rax
call qword [sym.imp.gdi32.dll_CreateCompatibleDC]
mov rdi, rax
mov qword [rbp + 0x78], rax
and qword [rbp + 0x68], 0
mov byte [rbp + 0x18c], 1
mov rcx, rsi
mov edx, r12d
mov r8d, r13d
call qword [sym.imp.gdi32.dll_CreateCompatibleBitmap]
mov byte [rbp + 0x18e], 0
mov byte [rbp + 0x18d], 1
mov rcx, rdi
mov qword [rbp + 0x168], rax
mov rdx, rax
call qword [sym.imp.gdi32.dll_SelectObject]
mov byte [rbp + 0x18e], 0
mov byte [rbp + 0x18d], 1
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x40], 0xcc0020
mov rcx, rdi
xor edx, edx
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.gdi32.dll_BitBlt]
movabs rsi, 0x8000000000000000
test eax, eax
je 0x1401c53ab
mov qword [rbp + 0x148], r15
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x10], rax
movups xmm0, xmmword [rbp + 0x68]
movaps xmmword [rbp], xmm0
mov eax, r12d
imul eax, r13d
shl eax, 2
mov ecx, r13d
neg ecx
mov dword [rbp - 0x2c], 0x28
mov qword [rbp + 0x98], r12
mov dword [rbp - 0x28], r12d
mov dword [rbp - 0x24], ecx
mov qword [rbp - 0x20], 0x200001
mov dword [rbp - 0x18], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x14], xmm0
and dword [rbp - 4], 0
movsxd rdx, eax
lea rcx, [rbp + 0xf0]
call fcn.1401c5a79
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0xf8]
mov byte [rbp + 0x18f], 1
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
mov rdi, rdx
mov qword [rsp + 0x20], rdx
and dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x168]
xor r8d, r8d
mov qword [rbp + 0xa0], r13
mov r9d, r13d
call qword [sym.imp.gdi32.dll_GetDIBits]
test eax, eax
je 0x1401c53e1
mov r14, qword [rbp + 0x100]
and r14, 0xfffffffffffffffc
lea r13, [rbp + 0x20]
xor eax, eax
mov qword [rbp + 0x120], rax
test r14, r14
je 0x1401c533c
mov r12, rdi
add rdi, 4
add r14, 0xfffffffffffffffc
mov al, byte [r12]
mov cl, byte [r12 + 2]
mov byte [r12], cl
mov byte [r12 + 2], al
cmp byte [r12 + 3], 0
jne 0x1401c4de8
mov qword [rbp + 0x108], rdi
mov byte [rbp + 0x18f], 1
mov rcx, r13
call case.0x140148b47.2019
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x20], rax
jne 0x1401c4e59
and qword [rbp + 0x150], 0
mov qword [rbp + 0x158], 1
and qword [rbp + 0x160], 0
jmp 0x1401c4e6f
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x160], rax
movups xmm0, xmmword [rbp + 0x20]
movaps xmmword [rbp + 0x150], xmm0
mov rcx, r13
call case.0x140148b47.2019
mov rcx, qword [rbp + 0x20]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x1401c4e92
xor ecx, ecx
push 1
pop r8
jmp 0x1401c4f10
mov r8, qword [rbp + 0x28]
mov r9, qword [rbp + 0x30]
test r9, r9
je 0x1401c4f10
cmp r9, 1
jne 0x1401c4ec1
movzx eax, byte [r8]
xor edi, edi
cmp eax, 0x2b
je 0x1401c4f12
mov r10, r8
push 1
pop r9
cmp eax, 0x2d
je 0x1401c4f12
jmp 0x1401c5307
cmp byte [r8], 0x2b
jne 0x1401c52fa
lea r10, [r8 + 1]
lea rax, [r9 - 1]
cmp r9, 0xa
mov r9, rax
jb 0x1401c5307
xor edi, edi
xor r11d, r11d
xor esi, esi
mov eax, esi
push 0xa
pop rdx
mul edx
jo 0x1401c4f12
mov esi, eax
movzx eax, byte [r10 + r11]
add eax, 0xffffffd0
cmp eax, 9
ja 0x1401c4f12
add esi, eax
jb 0x1401c4f10
inc r11
cmp r9, r11
jne 0x1401c4ee7
mov dil, 1
jmp 0x1401c4f14
xor edi, edi
xor esi, esi
mov rdx, r8
call fcn.1400373d1
test dil, dil
je 0x1401c4f30
push 0xb
pop rax
cmp esi, 0x55ef
ja 0x1401c503e
lea rcx, [rbp + 0x130]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionCurrentBuildNumberCurrentMajorVersionNumberIdle_no_name__Process
push 0x2c
pop r8
call case.0x140194648.550
lea rcx, [rbp + 0xa8]
lea rdx, [0x140264886]
push 0x19
pop r8
call case.0x140194648.550
mov rsi, qword [rbp + 0x138]
mov rcx, rsi
call fcn.1401b479d
test rax, rax
je 0x1401c4fc9
mov dword [rbp + 0x12c], 4
and dword [rbp + 0x17c], 0
mov rdi, qword [rbp + 0xb0]
lea rax, [rbp + 0x12c]
mov qword [rsp + 0x20], rax
mov rcx, r13
mov qword [rbp + 0x180], rdx
mov r8, rdi
lea r9, [rbp + 0x17c]
call case.0x140148b47.1542
cmp qword [rbp + 0x20], 0
je 0x1401c4fef
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1401c4fc5
mov rax, qword [rcx]
call qword [rax + 0x10]
xor ebx, ebx
jmp 0x1401c4ff8
mov rcx, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xb0]
call fcn.140005158
mov rcx, qword [rbp + 0x130]
mov rdx, rsi
call fcn.140005158
xor ebx, ebx
jmp 0x1401c502c
mov r15d, dword [rbp + 0x17c]
mov bl, 1
mov rcx, qword [rbp + 0x180]
call fcn.1401b4802
shl r15, 8
movzx ebx, bl
or rbx, r15
mov rcx, qword [rbp + 0xa8]
mov rdx, rdi
call fcn.140005158
mov rcx, qword [rbp + 0x130]
mov rdx, rsi
call fcn.140005158
mov rax, rbx
shr rax, 8
test bl, 1
mov ecx, 0
cmove eax, ecx
mov dword [rbp + 0x17c], eax
lea rax, [rbp + 0x17c]
mov qword [rbp + 0xa8], rax
lea rax, [0x140029230]
mov qword [rbp + 0xb0], rax
lea rax, [0x140289940]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 3
and qword [rbp + 0x40], 0
lea rax, [rbp + 0x150]
mov qword [rbp + 0xb8], rax
lea rax, [0x1400062be]
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 2
lea rcx, [rbp + 0x130]
mov rdx, r13
call fcn.140015f59
mov r15, qword [rbp + 0x130]
mov rbx, qword [rbp + 0x138]
mov rsi, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x150]
mov rdx, qword [rbp + 0x158]
call fcn.1400373d1
movabs rax, 0x8000000000000000
cmp r15, rax
mov rdi, qword [rbp + 0x108]
jne 0x1401c50ff
mov byte [r12 + 3], 0xff
jmp 0x1401c4de8
mov qword [rbp + 0x118], r15
and qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xc0], rsi
and qword [rbp + 0xc8], 0
mov qword [rbp + 0xd0], rsi
movabs rax, 0x2000000020
mov qword [rbp + 0xd8], rax
mov byte [rbp + 0xe0], 1
mov word [rbp + 0xe8], 1
lea rcx, [rbp + 0xa8]
call fcn.1401b7c8a
mov rsi, rax
test rax, rax
je 0x1401c54e6
mov rdi, rdx
push 0x40
pop rcx
call fcn.1401c3e2a
test rax, rax
je 0x1401c54d9
mov qword [rax], rsi
mov qword [rbp + 0x170], rax
mov qword [rax + 8], rdi
push 9
pop rcx
mov rdi, r13
lea rsi, [rbp + 0xa8]
rep movsq qword [rdi], qword [rsi]
push 4
pop rax
mov qword [rbp + 0x180], rax
push 1
pop r15
mov rcx, r13
call fcn.1401b7c8a
mov rsi, rax
test rax, rax
je 0x1401c5298
mov rdi, rdx
mov r8, qword [rbp + 0x180]
cmp r15, r8
jne 0x1401c5229
mov rbx, r8
inc rbx
je 0x1401c54b4
lea rax, [r8 + r8]
cmp rax, rbx
cmova rbx, rax
xor edx, edx
mov rax, rbx
shr rax, 0x3b
sete al
cmp rbx, 5
push 4
pop rcx
cmovb rbx, rcx
test r8, r8
je 0x1401c5232
mov rcx, r8
shl rcx, 4
mov r8, qword [rbp + 0x170]
mov qword [rbp + 0x130], r8
mov qword [rbp + 0x140], rcx
push 8
pop rcx
jmp 0x1401c5234
mov rcx, qword [rbp + 0x170]
jmp 0x1401c5272
xor ecx, ecx
mov r8, rbx
shl r8, 4
mov dl, al
shl edx, 3
mov qword [rbp + 0x138], rcx
lea rcx, [rbp + 0x150]
lea r9, [rbp + 0x130]
call fcn.140059531
cmp qword [rbp + 0x150], 0
jne 0x1401c54b6
mov rcx, qword [rbp + 0x158]
mov r8, rbx
mov qword [rbp + 0x180], r8
mov rax, r15
shl rax, 4
mov qword [rcx + rax], rsi
mov qword [rbp + 0x170], rcx
mov qword [rcx + rax + 8], rdi
inc r15
jmp 0x1401c51b2
test r15, r15
je 0x1401c54f9
mov rbx, qword [rbp + 0x170]
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
call fcn.14002dba0
mov edi, eax
mov esi, edx
mov rcx, qword [rbp + 0x180]
mov rdx, rbx
call fcn.140132e14
mov rcx, qword [rbp + 0x118]
mov rdx, qword [rbp + 0x110]
call fcn.14006095a
test dil, 1
mov rdi, qword [rbp + 0x108]
jne 0x1401c50f4
cmp sil, 7
ja 0x1401c4de8
jmp 0x1401c50f4
mov r10, r8
cmp r9, 9
jae 0x1401c4ee0
xor esi, esi
xor eax, eax
xor r11d, r11d
movzx edx, byte [r10 + rax]
add edx, 0xffffffd0
cmp edx, 0xa
setb dil
jae 0x1401c4f14
imul r11d, r11d, 0xa
add edx, r11d
inc rax
mov r11d, edx
cmp r9, rax
jne 0x1401c530e
mov esi, edx
jmp 0x1401c4f14
mov rcx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0xf8]
mov r9, qword [rbp + 0x98]
lea rax, [r9*4]
mov r10, qword [rbp + 0xa0]
mul r10
jo 0x1401c5433
mov rdx, qword [rbp + 0x100]
cmp rax, rdx
ja 0x1401c5433
movabs rsi, 0x8000000000000000
cmp rcx, rsi
mov rax, qword [rbp + 0x148]
je 0x1401c544c
mov qword [rax], rcx
mov qword [rax + 8], r8
mov qword [rax + 0x10], rdx
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r10d
jmp 0x1401c5471
call fcn.1401c33d4
mov qword [r15 + 8], rsi
and qword [r15 + 0x10], 0
mov dword [r15 + 0x18], edx
mov qword [r15], rsi
mov byte [rbp + 0x18c], 1
mov rcx, qword [rbp + 0x168]
call sub.gdi32.dll_DeleteObject
lea rcx, [rbp + 0x68]
call fcn.1401c4bf9
jmp 0x1401c5493
mov byte [rbp + 0x18f], 1
lea rdx, str.Get_RGBA_data_failedRgbaImage::from_raw_failedC:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fxcap_0.0.9_srcwindowsutils.rs
lea rcx, [rbp + 0x20]
push 0x14
pop r8
call fcn.1401c3f53
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x148]
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], rsi
mov rcx, qword [rbp + 0xf0]
mov rdx, rdi
call fcn.14006095a
mov rcx, qword [rbp + 0x168]
call sub.gdi32.dll_DeleteObject
jmp 0x1401c547d
mov rdx, r8
call fcn.14006095a
mov rax, qword [rbp + 0x148]
movabs rsi, 0x8000000000000000
lea rcx, [rax + 8]
mov byte [rbp + 0x18f], 0
lea rdx, [0x140289ba4]
push 0x1a
pop r8
call fcn.1401c3f53
mov rax, qword [rbp + 0x148]
mov qword [rax], rsi
mov rcx, qword [rbp + 0x168]
call sub.gdi32.dll_DeleteObject
mov byte [rbp + 0x18e], 1
mov byte [rbp + 0x18d], 0
mov rcx, rbp
call fcn.1401c4bf9
lea rcx, [rbp + 0x80]
call fcn.1401c4bf9
nop
add rsp, 0x218
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
jmp 0x1401c54cb
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x120], rax
mov rdx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x120]
call fcn.1401c66e0
jmp 0x1401c5509
push 8
pop rcx
push 0x40
pop rdx
call fcn.1401c66e0
jmp 0x1401c5509
push 8
pop rax
mov qword [rbp + 0x170], rax
xor eax, eax
mov qword [rbp + 0x180], rax
lea r8, [0x140289c28]
xor ecx, ecx
xor edx, edx
call fcn.1401c6eb0
ud2