Function at 0x140001725
Capabilities:
Capture screenshot

Disassembly:
push rbp
sub rsp, 0x300
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x290], rcx
lea rdx, [rbp + 0x220]
lea rax, [rbp + 0x218]
mov r8d, 0
mov rcx, rax
call sym.GdiplusStartup
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x268], rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x264], eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x260], eax
mov ecx, dword [rbp + 0x260]
mov edx, dword [rbp + 0x264]
mov rax, qword [rbp + 0x270]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0x258], rax
mov rdx, qword [rbp + 0x258]
mov rax, qword [rbp + 0x268]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov qword [rbp + 0x250], rax
mov ecx, dword [rbp + 0x264]
mov rax, qword [rbp + 0x268]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x270]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x260]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
lea rdx, [rbp + 0x210]
mov rax, qword [rbp + 0x258]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.GdipCreateBitmapFromHBITMAP
movabs rax, 0x670061006d0069
movabs rdx, 0x6d0062002f0065
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], rdx
mov dword [rbp + 0x1f0], 0x70
mov dword [rbp + 0x24c], 0xffffffff
mov dword [rbp + 0x1dc], 0
mov dword [rbp + 0x1d8], 0
lea rdx, [rbp + 0x1d8]
lea rax, [rbp + 0x1dc]
mov rcx, rax
call sym.GdipGetImageEncodersSize
mov eax, dword [rbp + 0x1d8]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x240], rax
mov edx, dword [rbp + 0x1d8]
mov eax, dword [rbp + 0x1dc]
mov rcx, qword [rbp + 0x240]
mov r8, rcx
mov ecx, eax
call sub.gdiplus.dll_GdipGetImageEncoders
mov dword [rbp + 0x27c], 0
jmp 0x14000199e
mov edx, dword [rbp + 0x27c]
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x240]
add rax, rdx
mov rax, qword [rax + 0x40]
lea rdx, [rbp + 0x1e0]
mov rcx, rax
call sym.wcscmp
test eax, eax
jne 0x140001997
mov edx, dword [rbp + 0x27c]
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x240]
add rax, rdx
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], rdx
mov eax, dword [rbp + 0x27c]
mov dword [rbp + 0x24c], eax
jmp 0x1400019b0
add dword [rbp + 0x27c], 1
mov eax, dword [rbp + 0x1dc]
cmp dword [rbp + 0x27c], eax
jb 0x14000190f
mov rax, qword [rbp + 0x240]
mov rcx, rax
call sym.free
mov rdx, qword [rbp + 0x290]
mov dword [rsp + 0x28], 0x100
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rax, qword [rbp + 0x210]
lea rcx, [rbp + 0x200]
lea rdx, [rbp - 0x30]
mov r9d, 0
mov r8, rcx
mov rcx, rax
call sym.GdipSaveImageToFile
mov rax, qword [rbp + 0x210]
mov rcx, rax
call sym.GdipDisposeImage
mov rdx, qword [rbp + 0x250]
mov rax, qword [rbp + 0x268]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov rax, qword [rbp + 0x258]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x268]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x270]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov rax, qword [rbp + 0x218]
mov rcx, rax
call sym.GdiplusShutdown
nop
add rsp, 0x300
pop rbp
ret