Function at 0x14000a530
Capabilities:
Capture screenshot

Disassembly:
sub rsp, 0x28
call fcn.1400098b0
add rsp, 0x28
jmp 0x14000a530
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x14000a566
call fcn.1400242e0
test eax, eax
jg 0x14000a98f
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0xf0], r13
lea rcx, str.DISPLAY
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xe0], r15
call qword [sym.imp.GDI32.dll_CreateDCW]
mov rcx, rax
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, 8
mov rcx, r15
mov r13, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xa
mov rcx, r15
mov edi, eax
mov dword [rbp - 0x39], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r8d, reloc.WSOCK32.dll_recv
mov edx, edi
mov rcx, r15
mov ebx, eax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r13
mov rdx, rax
mov rdi, rax
mov qword [rbp - 0x21], rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea r8, [rbp - 0x19]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rdi
mov qword [rbp - 0x29], rax
call qword [sym.imp.GDI32.dll_GetObjectW]
movzx r14d, word [rbp - 9]
lea rdx, str..crypto_rand_rand_win.c
imul r14d, dword [rbp - 0x11]
mov r8d, 0x306
imul r14d, dword [rbp - 0xd]
mov ecx, r14d
call fcn.14000dc90
mov rsi, rax
test rax, rax
je 0x14000a937
mov qword [rsp + 0xf8], r12
lea r12d, [rbx - 0x10]
xor edi, edi
test r12d, r12d
jle 0x14000a8fd
movaps xmmword [rsp + 0xd0], xmm6
xorpd xmm6, xmm6
lea rbx, [0x140340af0]
nop word [rax + rax]
mov r9d, dword [rbp - 0x39]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 0
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], reloc.WSOCK32.dll_recv
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, qword [rbp - 0x21]
mov r8, rsi
mov edx, r14d
call qword [sym.imp.GDI32.dll_GetBitmapBits]
xor r11d, r11d
mov qword [rbp - 0x31], rbx
mov eax, r11d
mov qword [rbp - 0x49], r11
mov qword [rbp - 0x59], r11
and eax, 0xfffffffd
mov qword [rbp - 0x51], r11
mov qword [rbp - 0x41], r11
or eax, 1
mov dword [rbp - 0x49], eax
test r11, r11
je 0x14000a6f5
cmp dword [r11], 0x40
je 0x14000a77e
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x59]
call fcn.14002a890
test eax, eax
je 0x14000a807
mov r11, qword [rbp - 0x59]
mov rbx, qword [rbp - 0x31]
cmp r11, rbx
je 0x14000a77e
test r11, r11
je 0x14000a72c
cmp dword [r11 + 0x60], 0
je 0x14000a72c
mov rcx, qword [rbp - 0x41]
call fcn.14000df10
mov qword [rbp - 0x59], rbx
mov ecx, dword [rbx + 0x60]
mov r11, rbx
test ecx, ecx
je 0x14000a77e
lea rdx, str..cryptoevpdigest.c
mov r8d, 0x131
call fcn.14000dc90
mov qword [rbp - 0x41], rax
test rax, rax
jne 0x14000a77a
lea r9, str..cryptoevpdigest.c
lea ecx, [rax + 6]
lea r8d, [rax + 0x41]
mov edx, 0x80
mov dword [rsp + 0x20], 0x134
call fcn.14000c930
jmp 0x14000a807
mov r11, qword [rbp - 0x59]
lea rcx, [rbp - 0x59]
call qword [r11 + reloc.WSOCK32.dll_recv]
test eax, eax
je 0x14000a807
mov rax, qword [rbp - 0x59]
lea rcx, [rbp - 0x59]
mov r8d, r14d
mov rdx, rsi
call qword [rax + Ordinal_26]
test eax, eax
je 0x14000a807
mov rax, qword [rbp - 0x59]
cmp dword [rax + 8], 0x40
jle 0x14000a7d2
lea r9, str.ctx__digest__md_size___EVP_MAX_MD_SIZE
lea rdx, str..cryptoevpdigest.c
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x159
call fcn.140024400
call fcn.140264f80
mov rax, qword [rbp - 0x59]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov r11, qword [rbp - 0x59]
mov rax, qword [r11 + 0x30]
test rax, rax
je 0x14000a7f8
lea rcx, [rbp - 0x59]
call rax
or dword [rbp - 0x49], 2
mov r11, qword [rbp - 0x59]
movsxd r8, dword [r11 + 0x60]
mov rcx, qword [rbp - 0x41]
xor edx, edx
call fcn.14025e980
mov rax, qword [rbp - 0x59]
test rax, rax
je 0x14000a853
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x14000a829
test byte [rbp - 0x49], 2
jne 0x14000a829
lea rcx, [rbp - 0x59]
call rdx
mov rax, qword [rbp - 0x59]
test rax, rax
je 0x14000a853
movsxd rdx, dword [rax + 0x60]
test edx, edx
je 0x14000a853
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14000a853
test byte [rbp - 0x49], 4
jne 0x14000a853
call fcn.140020010
mov rcx, qword [rbp - 0x41]
call fcn.14000df10
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14000a861
call fcn.14001fc80
xor eax, eax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov rax, qword [0x1403f2060]
test rax, rax
jne 0x14000a8c9
cmp qword [0x1403f2170], rax
je 0x14000a8bb
lea edx, [rax + 1]
lea rcx, [0x1403f2170]
call fcn.140049330
mov r11, rax
test rax, rax
je 0x14000a8bb
mov rax, qword [rax + 0x38]
mov qword [0x1403f2060], rax
test rax, rax
jne 0x14000a9a4
mov rcx, r11
call fcn.14001fc80
lea rax, [0x1403e33c0]
mov qword [0x1403f2060], rax
mov r8, qword [rax + 0x18]
test r8, r8
je 0x14000a8e2
lea rcx, [rbp + 7]
movapd xmm2, xmm6
mov edx, reloc.WSOCK32.dll_sendto
call r8
add edi, 0x10
lea rbx, [0x140340af0]
cmp edi, r12d
jl 0x14000a680
movaps xmm6, xmmword [rsp + 0xd0]
mov rax, qword [0x1403f20b0]
mov r12, qword [rsp + 0xf8]
test rax, rax
je 0x14000a918
xor edx, edx
mov rcx, rsi
call rax
mov rcx, rsi
call qword [fcn.14025db40]
mov r11, qword [0x1403f20b0]
test r11, r11
je 0x14000a937
mov edx, 1
xor ecx, ecx
call r11
mov rdx, qword [rbp - 0x29]
mov rcx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov r15, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xe8]
mov r13, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x110]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x100
pop rbp
ret
mov qword [0x1403f2068], r11
jmp 0x14000a8c9