Function at 0x180001180
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [0x180021018]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc8]
call fcn.180004880
mov dword [rsp + 0xd8], 1
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xb0]
call sub.gdiplus.dll_GdiplusStartup
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0xf0]
mov ecx, dword [rsp + 0xf8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0xf4]
mov ecx, dword [rsp + 0xfc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x18
call fcn.180004cd0
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x1800012f9
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.180004810
mov qword [rsp + 0x90], rax
jmp 0x180001305
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x60]
call fcn.180005350
mov eax, dword [rsp + 0x5c]
mov ecx, eax
call fcn.18000948c
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x60]
call fcn.180005320
mov dword [rsp + 0x50], 0
jmp 0x18000135a
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x50], eax
jae 0x1800013ad
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x68
lea rdx, str.image_jpeg
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + rax + 0x40]
call fcn.1800091d4
test eax, eax
jne 0x1800013ab
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x68
lea rcx, [rsp + 0x100]
mov rdx, qword [rsp + 0x68]
mov rdi, rcx
lea rsi, [rdx + rax]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
jmp 0x180001350
mov rcx, qword [rsp + 0x68]
call fcn.180009478
lea rcx, [rsp + 0x110]
call fcn.1800047c0
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x160]
call fcn.180006610
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x160]
call fcn.180006490
mov rcx, qword [rsp + 0x98]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x110]
call fcn.180004320
lea rcx, [rsp + 0x110]
call fcn.180006510
xor r9d, r9d
lea r8, [rsp + 0x100]
mov rdx, rax
mov rcx, qword [rsp + 0xa0]
call fcn.180005380
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.GDI32.dll_DeleteObject]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rsp + 0xb0]
call sub.gdiplus.dll_GdiplusShutdown
lea rcx, [rsp + 0x110]
call fcn.180004bd0
mov rcx, qword [rsp + 0x160]
call fcn.180004ba0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180007320
add rsp, 0x148
pop rdi
pop rsi
ret