Function at 0x140003ec8
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x310
mov rax, qword [0x140010008]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor r12d, r12d
cmp byte [0x140010da9], r12b
jne 0x140003f31
lea rcx, [rsp + 0x60]
call qword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
js 0x140003f26
mov ecx, 0x258
cmp dword [rsp + 0x60], r12d
jne 0x140003f2b
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
or ebx, 0xffffffff
mov byte [0x140010b46], r12b
mov r9d, ebx
lea r8, str.DisableScreenClippings
lea rdx, str.SoftwarePoliciesMicrosoftOffice16.0OneNoteOptionsOther
call fcn.140002740
cmp eax, ebx
jne 0x140003f6b
xor r9d, r9d
lea r8, str.DisableScreenClippings
lea rdx, str.SoftwareMicrosoftOffice16.0OneNoteOptionsOther
call fcn.140002740
mov esi, 1
cmp eax, esi
setne al
test al, al
je 0x140003fa1
call fcn.140001e70
test al, al
jne 0x140003fd3
mov dl, sil
mov ecx, 0x420b
call fcn.140002c64
test al, al
je 0x140003fa1
xor edx, edx
lea rcx, [0x14000babc]
call fcn.140002d0c
xor al, al
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140008c20
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rax, str.Microsoft_Office:MSODRM_REFCOUNT_FILE
mov r8d, 4
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r8d
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x140004031
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, r12b
mov rcx, rdi
cmp eax, 0xb7
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140004031
xor edx, edx
mov ecx, 0x2730
call fcn.140002c64
jmp 0x140003fa1
cmp qword [0x140010b30], r12
jne 0x140003fa1
mov rcx, qword [0x140010af8]
lea r8, [rbp]
mov r9d, 0xff
mov byte [reloc.AppVIsvSubsystems64.dll_Ordinal_1], sil
mov edx, 0x2711
call qword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x50
lea rcx, [rbp - 0x60]
mov r8d, ebx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x140010da0]
lea rax, [0x140004440]
lea r13, str.OneNoteM.ScreenCapture
mov qword [rbp - 0x58], rax
mov rdx, rsi
mov qword [rbp - 0x48], rcx
mov dword [rbp - 0x60], ebx
mov qword [rbp - 0x20], r13
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x40], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
lea rbx, [0x140010a60]
mov dword [rsp + 0x20], r12d
mov rcx, rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetRect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
lea r9, [rsp + 0x78]
mov dword [rsp + 0x7c], r12d
mov r15, rax
mov qword [rbp - 0x80], rbx
lea rax, [0x140010b20]
xor edx, edx
mov qword [rbp - 0x78], rax
lea r8, [0x1400043f0]
lea rax, [0x140010b70]
mov rcx, r15
mov qword [rbp - 0x70], rax
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov rcx, qword [rbp - 0x80]
sub dword [0x140010a6c], esi
mov edi, dword [rcx + 8]
mov ebx, dword [rcx + 0xc]
sub edi, dword [rcx]
sub ebx, dword [rcx + 4]
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, ebx
mov edx, edi
mov rcx, r15
mov qword [0x140010b20], rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edi, dword [0x140010a68]
mov r14d, dword [0x140010a6c]
sub edi, dword [0x140010a60]
sub r14d, dword [0x140010a64]
cmp byte [0x140010da9], r12b
mov qword [0x140010b70], rax
je 0x14000417a
call fcn.1400046e0
mov bl, sil
test al, al
jne 0x14000417d
mov bl, r12b
mov rdx, qword [0x140010b70]
mov rcx, qword [0x140010b20]
call qword [sym.imp.GDI32.dll_SelectObject]
test bl, bl
jne 0x1400041e3
mov r9d, 0x180
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [0x140010a64]
mov r9d, edi
mov rcx, qword [0x140010b20]
xor r8d, r8d
mov dword [rsp + 0x40], 0x40cc0020
xor edx, edx
mov dword [rsp + 0x38], eax
mov eax, dword [0x140010a60]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, qword [0x140010b20]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, qword [0x140010b20]
mov r8d, r14d
mov edx, edi
mov qword [0x140010b08], rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, qword [0x140010b08]
mov rdx, rax
mov qword [0x140010b10], rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov r9d, edi
mov dword [rsp + 0x20], r14d
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call qword [sym.imp.USER32.dll_SetRect]
mov ecx, 0xffffff
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rcx, qword [0x140010b08]
lea rdx, [rbp - 0x10]
mov r8, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov edx, 0x10
mov word [rsp + 0x60], r12w
xorps xmm0, xmm0
lea r8, [rsp + 0x68]
movups xmmword [rsp + 0x68], xmm0
xor r9d, r9d
mov dword [rsp + 0x68], edx
lea ecx, [rdx + 0x32]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov al, byte [rsp + 0x6c]
mov r9d, edi
and al, sil
mov byte [rsp + 0x63], r12b
neg al
sbb cl, cl
xor r8d, r8d
and cl, 0xaa
xor edx, edx
add cl, 0x55
mov byte [rsp + 0x62], cl
mov eax, dword [rsp + 0x60]
mov rcx, qword [0x140010b08]
mov dword [rsp + 0x50], eax
mov rax, qword [0x140010b20]
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.MSIMG32.dll_AlphaBlend]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, qword [0x140010da0]
lea r8, [rbp]
mov qword [rsp + 0x58], r12
mov r9d, 0x90000000
mov qword [rsp + 0x50], rax
mov rdx, r13
mov eax, dword [0x140010a64]
mov ecx, 8
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
mov eax, dword [0x140010a60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
jne 0x14000434f
call fcn.140004a1c
jmp 0x140003fa1
mov rcx, rax
mov qword [0x140010b30], rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x140010b30]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [0x140010b30]
call qword [sym.imp.USER32.dll_SetCapture]
mov edx, 0x7f03
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea rcx, [0x140010a50]
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov rcx, qword [0x140010b30]
mov r9d, 0x100
xor r8d, r8d
mov byte [0x140010a70], r12b
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov al, byte [0x140010d9c]
mov r9b, sil
neg al
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
sbb ecx, ecx
xor r8d, r8d
neg ecx
xor edx, edx
add ecx, 0x2726
call fcn.1400031e4
mov al, sil
jmp 0x140003fa3