Function at 0x1400148a0
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov r15, rcx
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rbp, rax
lea edx, [rbx + 0x76]
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r13d, eax
lea edx, [rbx + 0x75]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r14d, eax
mov rcx, rbp
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r12, rax
mov r8d, r14d
mov edx, r13d
mov rcx, rbp
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0x108], rax
mov rdx, rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r14d
mov r9d, r13d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.GDI32.dll_BitBlt]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x94], xmm0
mov qword [rsp + 0xa4], rbx
mov dword [rsp + 0x80], 0x28
mov dword [rsp + 0x84], r13d
mov eax, r14d
neg eax
mov dword [rsp + 0x88], eax
mov qword [rsp + 0x8c], 0x200001
mov eax, r14d
imul eax, r13d
shl eax, 2
movsxd rsi, eax
movdqu xmmword [rsp + 0x68], xmm0
mov edi, ebx
mov qword [rsp + 0x78], rbx
movabs rax, 0x7fffffffffffffff
test rsi, rsi
je 0x140014a0f
cmp rsi, rax
ja 0x140014be3
cmp rsi, 0x1000
jb 0x1400149e2
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x140014be9
call fcn.140043284
test rax, rax
je 0x140014bad
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400149ed
mov rcx, rsi
call fcn.140043284
mov rbx, rax
mov qword [rsp + 0x68], rbx
lea rdi, [rbx + rsi]
mov qword [rsp + 0x78], rdi
mov r8, rsi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x70], rdi
jmp 0x140014a14
mov rbx, qword [rsp + 0x68]
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, r14d
xor r8d, r8d
mov rdx, qword [rsp + 0x108]
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
call fcn.140015d20
mov r12, rax
xor esi, esi
mov dword [rsp + 0xf8], esi
mov qword [rsp + 0x100], rsi
mov dword [rsp + 0x50], 0x800
mov dword [rsp + 0x48], 0x58
mov dword [rsp + 0x40], esi
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, r13d
mov rdx, rbx
mov rcx, r12
call fcn.140015aa0
mov r14d, dword [rsp + 0xf8]
mov rbp, qword [rsp + 0x100]
add r14, rbp
mov qword [r15], rsi
mov qword [r15 + 8], rsi
mov qword [r15 + 0x10], rsi
sub r14, rbp
je 0x140014b73
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x140014bef
cmp r14, 0x1000
jb 0x140014b3b
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x140014bdd
call fcn.140043284
test rax, rax
je 0x140014b34
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140014b46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140043284
mov rsi, rax
mov qword [r15], rsi
mov qword [r15 + 8], rsi
lea rcx, [rsi + r14]
mov qword [r15 + 0x10], rcx
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rsi]
mov qword [r15 + 8], rax
mov rbp, qword [rsp + 0x100]
mov rcx, rbp
call fcn.140015d10
mov rcx, r12
call fcn.140015c40
nop
test rbx, rbx
je 0x140014bbf
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x140014bb4
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014bb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rbx
call fcn.1400432c0
mov rax, r15
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400147e0
nop
call fcn.140014db0
int3
call fcn.1400147e0
nop
call fcn.140014db0
int3