Function at 0x1400033e0
Capabilities:
Capture screenshot

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx]
lea rbp, [rdi + rsi]
lea rbx, [rsp + 0x80]
mov qword [rsp + 0x90], rsi
lea r15, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0
cmp rsi, 7
ja 0x1400035f0
mov r9, rsi
mov rdx, rbx
cmp rdi, rbp
je 0x140003848
xor eax, eax
nop dword [rax]
movsx cx, byte [rdi + rax]
mov word [rdx + rax*2], cx
add rax, 1
cmp rax, rsi
jne 0x140003440
xor eax, eax
mov qword [rsp + 0x78], r9
xor ecx, ecx
mov word [rdx + r9*2], ax
mov edx, 1
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rcx, rax
test rax, rax
je 0x1400035dc
mov dword [rsp + 0x90], 0x48
lea rdx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetMonitorInfoA]
test eax, eax
je 0x1400035d0
mov r12d, dword [rsp + 0x9c]
mov r13d, dword [rsp + 0xa0]
xor ecx, ecx
sub r12d, dword [rsp + 0x94]
sub r13d, dword [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdi, rax
mov r8d, r13d
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r14, qword [sym.imp.GDI32.dll_SelectObject]
mov rbp, rax
mov rdx, rax
mov rcx, rdi
call r14
mov qword [rsp + 0x58], rax
mov r9d, r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 0xcc0020
mov rcx, rdi
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.GDI32.dll_BitBlt]
lea r12, [rsp + 0x60]
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x60], 0
mov r8, r12
call sub.gdiplus.dll_GdipCreateBitmapFromHBITMAP
mov rdx, r12
lea rcx, str.image_jpeg
mov r13, qword [rsp + 0x60]
call fcn.140003310
mov rdx, qword [rsp + 0x70]
xor r9d, r9d
mov r8, r12
mov rcx, r13
call sub.gdiplus.dll_GdipSaveImageToFile
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
call r14
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, r13
call sub.gdiplus.dll_GdipDisposeImage
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x1400035b8
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
nop
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [0x1400180c0]
call sub.gdiplus.dll_GdiplusShutdown
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
jne 0x1400035a5
jmp 0x1400035b8
lea rdx, [rsp + 0x90]
xor r8d, r8d
mov rcx, r15
call fcn.14000bab0
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x70], rax
mov rdx, rax
mov qword [rsp + 0x80], r9
cmp rdi, rbp
je 0x140003452
lea rcx, [rsi - 1]
cmp rcx, 0xe
jbe 0x14000343a
lea rax, [rax + rsi*2]
cmp rdi, rax
jae 0x140003644
cmp rdx, rbp
jb 0x14000343a
cmp rcx, 0x1e
jbe 0x140003850
mov rcx, rsi
mov r8, rsi
xor eax, eax
shr rcx, 5
and r8, 0xffffffffffffffe0
nop
vmovdqu ymm0, ymmword [rdi + rax]
vpmovsxbw ymm1, xmm0
vextracti128 xmm0, ymm0, 1
vpmovsxbw ymm0, xmm0
vmovdqu ymmword [rdx + rax*2], ymm1
vmovdqu ymmword [rdx + rax*2 + 0x20], ymm0
add rax, 0x20
cmp rax, r8
jne 0x140003660
shl rcx, 6
lea rax, [rdi + r8]
add rcx, rdx
cmp rsi, r8
je 0x140003866
sub rsi, r8
lea r10, [rsi - 1]
cmp r10, 0xe
jbe 0x14000385e
vzeroupper
vmovdqu xmm0, xmmword [rdi + r8]
lea r10, [rdx + r8*2]
mov r8, rsi
and r8, 0xfffffffffffffff0
vpmovsxbw xmm1, xmm0
vpsrldq xmm0, xmm0, 8
lea rcx, [rcx + r8*2]
add rax, r8
vpmovsxbw xmm0, xmm0
and esi, 0xf
vmovdqu xmmword [r10], xmm1
vmovdqu xmmword [r10 + 0x10], xmm0
je 0x140003452
movsx r8w, byte [rax]
mov word [rcx], r8w
lea r8, [rax + 1]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 1]
mov word [rcx + 2], r8w
lea r8, [rax + 2]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 2]
mov word [rcx + 4], r8w
lea r8, [rax + 3]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 3]
mov word [rcx + 6], r8w
lea r8, [rax + 4]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 4]
mov word [rcx + 8], r8w
lea r8, [rax + 5]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 5]
mov word [rcx + 0xa], r8w
lea r8, [rax + 6]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 6]
mov word [rcx + 0xc], r8w
lea r8, [rax + 7]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 7]
mov word [rcx + 0xe], r8w
lea r8, [rax + 8]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 8]
mov word [rcx + 0x10], r8w
lea r8, [rax + 9]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 9]
mov word [rcx + 0x12], r8w
lea r8, [rax + 0xa]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 0xa]
mov word [rcx + 0x14], r8w
lea r8, [rax + 0xb]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 0xb]
mov word [rcx + 0x16], r8w
lea r8, [rax + 0xc]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 0xc]
mov word [rcx + 0x18], r8w
lea r8, [rax + 0xd]
cmp rbp, r8
je 0x140003452
movsx r8w, byte [rax + 0xd]
mov word [rcx + 0x1a], r8w
lea r8, [rax + 0xe]
cmp rbp, r8
je 0x140003452
movsx ax, byte [rax + 0xe]
mov word [rcx + 0x1c], ax
jmp 0x140003452
xor r9d, r9d
jmp 0x140003452
mov rcx, rdx
mov rax, rdi
xor r8d, r8d
jmp 0x1400036b1
vzeroupper
jmp 0x1400036ec
vzeroupper
jmp 0x140003452