Function at 0x1400333a0
Capabilities:
Capture screenshot
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a8]
sub rsp, 0x9a8
xor esi, esi
xorps xmm0, xmm0
mov ebx, esi
mov byte [rbp + 0x910], sil
mov qword [rbp - 0x40], rbx
mov r12, rcx
mov qword [rbp - 0x80], rbx
mov r14d, esi
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x30], esi
mov byte [rbp - 0x28], sil
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rsi
movdqu xmmword [rsp + 0x70], xmm0
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, r12
mov qword [rbp + 0x80], rax
mov r13, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov qword [rbp - 0x78], rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0x78], rax
mov r15, rax
test rax, rax
je 0x140033b3d
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClientRect]
lea edx, [rsi + 4]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetStretchBltMode]
mov eax, dword [rsp + 0x6c]
xor r8d, r8d
mov r9d, dword [rsp + 0x68]
xor edx, edx
mov dword [rsp + 0x50], 0xcc0020
mov rcx, rdi
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_StretchBlt]
test eax, eax
je 0x140033b3d
mov r8d, dword [rsp + 0x6c]
mov rcx, rdi
mov edx, dword [rsp + 0x68]
sub r8d, dword [rsp + 0x64]
sub edx, dword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp - 0x68], rax
mov r14, rax
test rax, rax
je 0x140033b3a
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [rsp + 0x6c]
xor r8d, r8d
sub ecx, dword [rsp + 0x64]
xor edx, edx
mov r9d, dword [rsp + 0x68]
sub r9d, dword [rsp + 0x60]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ecx
mov rcx, r15
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x140033b3d
lea r8, [rbp + 0x48]
mov rcx, r14
lea edx, [rsi + 0x20]
call qword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [rbp + 0x50]
mov eax, dword [rbp + 0x4c]
mov dword [rbp + 0x28], ecx
imul ecx, eax
mov dword [rbp + 0x20], 0x28
mov dword [rbp + 0x24], eax
mov qword [rbp + 0x2c], 0x200001
mov qword [rbp + 0x34], rsi
shl ecx, 2
mov ebx, ecx
mov edx, ecx
lea ecx, [rsi + 0x42]
mov qword [rbp + 0x3c], rsi
mov dword [rbp + 0x44], esi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov qword [rbp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r9d, dword [rbp + 0x50]
xor r8d, r8d
mov r12, rax
mov qword [rbp + 0x68], rax
lea rax, [rbp + 0x20]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.GDI32.dll_GetDIBits]
mov r14d, dword [rbp + 0x4c]
lea rcx, [rbp + 8]
mov r15d, dword [rbp + 0x50]
mov edx, ebx
mov dword [rbp - 0x2c], 0x64
call fcn.1400372d0
mov r13, qword [rbp + 8]
mov r8d, ebx
mov rcx, r13
mov rdx, r12
call fcn.140171d30
mov rax, qword [rbp + 0x10]
mov ecx, r14d
imul ecx, r15d
sub rax, r13
shl ecx, 2
cmp rax, rcx
jne 0x140033b33
mov dword [rsp + 0x28], esi
lea r8d, [rsi + 0x18]
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.FreeImage64.dll_FreeImage_Allocate]
mov r12, rax
test rax, rax
je 0x140033b33
mov edi, esi
test r14d, r14d
je 0x14003363f
mov ebx, esi
test r15d, r15d
je 0x140033638
nop
mov eax, ebx
mov r8d, ebx
imul eax, r14d
mov edx, edi
mov rcx, r12
add eax, edi
lea r9, [rax*4]
add r9, r13
call qword [sym.imp.FreeImage64.dll_FreeImage_SetPixelColor]
inc ebx
cmp ebx, r15d
jb 0x140033610
inc edi
cmp edi, r14d
jb 0x140033607
mov rcx, r12
call qword [sym.imp.FreeImage64.dll_FreeImage_GetWidth]
mov rcx, r12
call qword [sym.imp.FreeImage64.dll_FreeImage_GetHeight]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.FreeImage64.dll_FreeImage_OpenMemory]
mov r9d, 0x4080
mov rdx, r12
mov r8, rax
mov ecx, 2
mov rbx, rax
call qword [sym.imp.FreeImage64.dll_FreeImage_SaveToMemory]
mov rcx, rbx
call qword [sym.imp.FreeImage64.dll_FreeImage_TellMemory]
movsxd rdi, eax
test eax, eax
jle 0x1400336c3
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400372d0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.FreeImage64.dll_FreeImage_SeekMemory]
mov r15, qword [rsp + 0x70]
mov r9, rbx
mov rcx, r15
mov r8d, 1
mov edx, edi
call qword [sym.imp.FreeImage64.dll_FreeImage_ReadMemory]
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x40], rax
jmp 0x1400336c8
mov r15, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.FreeImage64.dll_FreeImage_CloseMemory]
mov rcx, r12
call qword [sym.imp.FreeImage64.dll_FreeImage_Unload]
mov rdi, qword [rsp + 0x78]
cmp r15, rdi
je 0x140033b06
xor r9d, r9d
lea rax, [rbp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140033b06
mov rbx, 0xffffffffffffffff
lea rdx, [rbp + 0xa0]
mov r8, rbx
lea rax, [rbp + 0xa0]
inc r8
cmp word [rax + r8*2], si
jne 0x140033726
xorps xmm0, xmm0
mov qword [rbp - 8], rsi
lea rcx, [rbp - 0x18]
mov qword [rbp], rsi
movups xmmword [rbp - 0x18], xmm0
call fcn.14003b630
lea rdx, str.Microsoft_Windows_Themes_WallpaperEngineOverride.jpg
lea rcx, [rbp - 0x18]
call fcn.140006e10
sub edi, r15d
lea rcx, [rbp - 0x18]
cmp qword [rbp], 8
mov r8d, edi
mov rdx, r15
cmovae rcx, qword [rbp - 0x18]
call fcn.1400065b0
test al, al
je 0x140033ac6
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x18]
call fcn.140006fe0
mov rdi, qword [rbp + 0x900]
mov rdx, rax
mov rcx, rdi
call fcn.140039330
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400337d6
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400337d1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033bfd
call fcn.14005ca98
mov rax, qword [rbp + 0x908]
cmp rax, rdi
je 0x1400337fb
cmp qword [rdi + 0x18], 0x10
mov r8, qword [rdi + 0x10]
jb 0x1400337f0
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.1400390e0
mov rax, qword [rbp + 0x8f8]
mov byte [rbp + 0x910], 1
mov r10d, dword [rax]
test r10d, r10d
js 0x140033ac6
mov edx, dword [rax + 4]
test edx, edx
js 0x140033ac6
mov ecx, dword [rax + 8]
mov r14d, ecx
sub r14d, r10d
mov dword [rbp - 0x70], r14d
cmp r14d, 2
jle 0x140033ac6
mov eax, dword [rax + 0xc]
mov r8d, eax
sub r8d, edx
mov dword [rbp + 0x918], r8d
cmp r8d, 2
jle 0x140033ac6
mov r11d, dword [rbp + 0x4c]
cmp ecx, r11d
jg 0x140033ac6
mov r9d, dword [rbp + 0x50]
cmp eax, r9d
jg 0x140033ac6
sub edx, eax
mov ecx, r9d
sub ecx, eax
add edx, r9d
test edx, edx
mov eax, esi
cmovle eax, edx
cmp eax, ecx
jl 0x140033887
test edx, edx
mov ecx, edx
cmovg ecx, esi
imul ecx, r11d
mov eax, r8d
imul eax, r14d
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rbp - 0x80], rsi
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp + 0x98], rsi
add ecx, r10d
shl ecx, 2
movsxd rdi, ecx
lea rcx, [rsp + 0x70]
add rdi, qword [rbp + 0x68]
shl eax, 2
movsxd rdx, eax
movdqu xmmword [rbp + 0x88], xmm1
call fcn.1400372d0
mov r13d, dword [rbp + 0x918]
lea eax, [r14*4]
mov r14, qword [rsp + 0x70]
movsxd r12, eax
nop word [rax + rax]
mov r8, r12
mov rdx, rdi
mov rcx, r14
call fcn.140171d30
mov eax, dword [rbp + 0x4c]
add r14, r12
lea eax, [rax*4]
movsxd rcx, eax
add rdi, rcx
sub r13, 1
jne 0x1400338f0
mov eax, dword [rbp - 0x70]
lea r8, [rbp + 0x88]
mov dword [rbp - 0x38], eax
lea rdx, [rsp + 0x70]
mov eax, dword [rbp + 0x918]
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x34], eax
call fcn.140052f00
mov rdi, qword [rbp + 0x88]
mov r13, qword [rbp + 8]
test al, al
je 0x140033a4f
lea rdx, [rbp + 0xa0]
lea rax, [rbp + 0xa0]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], si
jne 0x140033960
xorps xmm0, xmm0
mov qword [rbp - 0x50], rsi
mov r8, rbx
mov qword [rbp - 0x48], rsi
lea rcx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
call fcn.14003b630
lea rdx, str.Microsoft_Windows_Themes_WallpaperEngineLockOverride.jpg
lea rcx, [rbp - 0x60]
call fcn.140006e10
mov r8d, dword [rbp + 0x90]
lea rcx, [rbp - 0x60]
sub r8d, edi
mov rdx, rdi
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
call fcn.1400065b0
test al, al
je 0x140033a0f
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x60]
call fcn.140006fe0
mov rcx, qword [rbp + 0x908]
mov rdx, rax
call fcn.140039330
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140033a0f
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033a0a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033c03
call fcn.14005ca98
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140033a4f
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033a4a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033c09
call fcn.14005ca98
test rdi, rdi
je 0x140033a8b
mov rdx, qword [rbp + 0x98]
mov rax, rdi
sub rdx, rdi
cmp rdx, 0x1000
jb 0x140033a83
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033c0f
mov rcx, rdi
call fcn.14005ca98
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140033ac6
mov rdx, qword [rbp - 0x80]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140033ac1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033c0f
call fcn.14005ca98
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x140033b06
mov rcx, qword [rbp - 0x18]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033b01
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033c0f
call fcn.14005ca98
mov rdi, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rsi, qword [rbp + 0x18]
mov rbx, qword [rbp - 0x40]
mov r14, qword [rbp - 0x68]
mov r12, qword [rbp + 0x8f0]
jmp 0x140033b46
mov r15, qword [rsp + 0x70]
jmp 0x140033b0a
mov r14, rax
mov r13, qword [rbp + 8]
mov r15, qword [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, qword [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
test r15, r15
je 0x140033ba8
sub rbx, r15
mov rax, r15
cmp rbx, 0x1000
jb 0x140033b9d
mov r15, qword [r15 - 8]
add rbx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033bf7
mov rdx, rbx
mov rcx, r15
call fcn.14005ca98
test r13, r13
je 0x140033bdc
sub rsi, r13
mov rax, r13
cmp rsi, 0x1000
jb 0x140033bd1
mov r13, qword [r13 - 8]
add rsi, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033bf7
mov rdx, rsi
mov rcx, r13
call fcn.14005ca98
movzx eax, byte [rbp + 0x910]
add rsp, 0x9a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140176448
int3
call fcn.140176448
int3
call fcn.140176448
int3
call fcn.140176448
int3
call fcn.140176448
int3