Function at 0x1400112c6
Capabilities:
Capture screenshot
Check for foreground window switch

Disassembly:
jmp 0x140012080
push rbp
push rdi
mov eax, 0x1208
call fcn.1400110b4
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x31a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f008]
xor rax, rbp
mov qword [rbp + 0x1190], rax
lea rcx, [0x1400250c9]
call fcn.1400113e8
lea rcx, [rbp + 8]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x140012390
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x48], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x68], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x88], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0xa4], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0xc4], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0xe4], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x104], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x124], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x144], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x48], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x68], rax
mov dword [rsp + 0x40], 0x999999
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 2
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0xc4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0xa4]
mov r8d, 1
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
sub eax, 0xa
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
sub eax, 0x14
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x104]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0xe4]
mov ecx, dword [rbp + 0x1184]
mov r8d, ecx
mov edx, eax
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
sub eax, 0xa
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
sub eax, 0x14
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x144]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x124]
mov ecx, dword [rbp + 0x1184]
mov r8d, ecx
mov edx, eax
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rsp + 0x40], 0x660046
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 2
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x144]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x124]
mov ecx, dword [rbp + 0x1184]
mov r8d, ecx
mov edx, eax
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_BitBlt]
mov dword [rbp + 0xd34], 0xf
lea rdx, [rbp + 0xd34]
lea rcx, [rbp + 0xd18]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0xd58]
call fcn.1400112ad
lea r8, [rbp + 8]
mov rdx, rax
lea rcx, [rbp + 0xd78]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x14001238b
jmp 0x140012390
jmp 0x1400120cc
lea rcx, [rbp + 0x168]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x1400124f5
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x188], rax
mov dword [rbp + 0x1a4], 0
mov dword [rbp + 0x1c4], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x1e4], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x204], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x1188], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x118c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rsp + 0x40], 0x8800c6
mov ecx, dword [rbp + 0x1184]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbp + 0x1188]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp + 0x188]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x204]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x1e4]
mov ecx, dword [rbp + 0x118c]
mov r8d, ecx
mov edx, eax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0xdb4], 5
lea rdx, [rbp + 0xdb4]
lea rcx, [rbp + 0xd98]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0xdd8]
call fcn.1400112ad
lea r8, [rbp + 0x168]
mov rdx, rax
lea rcx, [rbp + 0xdf8]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x1400124f0
jmp 0x1400124f5
jmp 0x14001239c
lea rcx, [rbp + 0x228]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x1400126da
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x248], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rbp + 0x268], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0x2a8]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x2a8]
mov ecx, dword [rbp + 0x2b0]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x2d4], eax
mov eax, dword [rbp + 0x2ac]
mov ecx, dword [rbp + 0x2b4]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x2f4], eax
mov eax, dword [rbp + 0x2f4]
add eax, 0x23
mov dword [rsp + 0x50], 0xcc0020
mov ecx, dword [rbp + 0x2f4]
mov dword [rsp + 0x48], ecx
mov ecx, dword [rbp + 0x2d4]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x288]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x2d4]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.GDI32.dll_StretchBlt]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xc
idiv ecx
mov eax, edx
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xc
idiv ecx
mov eax, edx
mov dword [rbp + 0x1188], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x118c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rsp + 0x40], 0x5a0049
mov ecx, dword [rbp + 0x1184]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbp + 0x1188]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp + 0x248]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x2f4]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x2d4]
mov ecx, dword [rbp + 0x118c]
mov r8d, ecx
mov edx, eax
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.GDI32.dll_BitBlt]
mov dword [rbp + 0xe34], 5
lea rdx, [rbp + 0xe34]
lea rcx, [rbp + 0xe18]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0xe58]
call fcn.1400112ad
lea r8, [rbp + 0x228]
mov rdx, rax
lea rcx, [rbp + 0xe78]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x1400126d5
jmp 0x1400126da
jmp 0x140012501
lea rcx, [rbp + 0x318]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x1400127ee
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x338], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x354], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x374], eax
mov eax, dword [rbp + 0x374]
sub eax, 0x64
mov ecx, dword [rbp + 0x354]
sub ecx, 0x64
mov dword [rsp + 0x50], 0xcc0020
mov edx, dword [rbp + 0x374]
mov dword [rsp + 0x48], edx
mov edx, dword [rbp + 0x354]
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x338]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, 0x32
mov edx, 0x32
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.GDI32.dll_StretchBlt]
mov dword [rbp + 0xeb4], 5
lea rdx, [rbp + 0xeb4]
lea rcx, [rbp + 0xe98]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0xed8]
call fcn.1400112ad
lea r8, [rbp + 0x318]
mov rdx, rax
lea rcx, [rbp + 0xef8]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x1400127e9
jmp 0x1400127ee
jmp 0x1400126e6
lea rcx, [rbp + 0x398]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x140012905
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x3b8], rax
mov dword [rbp + 0x3d4], 0
mov dword [rbp + 0x3f4], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x414], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x434], eax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0xc
mov dword [rsp + 0x30], 0xc
mov rax, qword [rbp + 0x3b8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x434]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x414]
mov r8d, 0xa
mov edx, 0xa
mov rcx, qword [rbp + 0x3b8]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0xf34], 0xa
lea rdx, [rbp + 0xf34]
lea rcx, [rbp + 0xf18]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0xf58]
call fcn.1400112ad
lea r8, [rbp + 0x398]
mov rdx, rax
lea rcx, [rbp + 0xf78]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x140012900
jmp 0x140012905
jmp 0x1400127fa
lea rcx, [rbp + 0x458]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x140012a72
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x478], rax
mov dword [rbp + 0x494], 0
mov dword [rbp + 0x4b4], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x4d4], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x4f4], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xc
idiv ecx
mov eax, edx
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xc
idiv ecx
mov eax, edx
mov dword [rbp + 0x1188], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
mov dword [rbp + 0x118c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
mov dword [rsp + 0x40], 0xee0086
mov ecx, dword [rbp + 0x1184]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbp + 0x1188]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp + 0x478]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x4f4]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x4d4]
mov ecx, dword [rbp + 0x118c]
mov r8d, ecx
mov edx, eax
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0xfb4], 5
lea rdx, [rbp + 0xfb4]
lea rcx, [rbp + 0xf98]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0xfd8]
call fcn.1400112ad
lea r8, [rbp + 0x458]
mov rdx, rax
lea rcx, [rbp + 0xff8]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x140012a6d
jmp 0x140012a72
jmp 0x140012911
lea rcx, [rbp + 0x518]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x140012bd7
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x538], rax
mov dword [rbp + 0x554], 0
mov dword [rbp + 0x574], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x594], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x5b4], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x1188], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x118c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rsp + 0x40], 0x660046
mov ecx, dword [rbp + 0x1184]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbp + 0x1188]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp + 0x538]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x5b4]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x594]
mov ecx, dword [rbp + 0x118c]
mov r8d, ecx
mov edx, eax
mov rcx, qword [rbp + 0x538]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1034], 5
lea rdx, [rbp + 0x1034]
lea rcx, [rbp + 0x1018]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0x1058]
call fcn.1400112ad
lea r8, [rbp + 0x518]
mov rdx, rax
lea rcx, [rbp + 0x1078]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x140012bd2
jmp 0x140012bd7
jmp 0x140012a7e
lea rcx, [rbp + 0x5d8]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x140012d3c
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x5f8], rax
mov dword [rbp + 0x614], 0
mov dword [rbp + 0x634], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x654], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x674], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x1188], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rbp + 0x118c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov dword [rsp + 0x40], 0xcc0020
mov ecx, dword [rbp + 0x1184]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbp + 0x1188]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp + 0x5f8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x674]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x654]
mov ecx, dword [rbp + 0x118c]
mov r8d, ecx
mov edx, eax
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x10b4], 7
lea rdx, [rbp + 0x10b4]
lea rcx, [rbp + 0x1098]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0x10d8]
call fcn.1400112ad
lea r8, [rbp + 0x5d8]
mov rdx, rax
lea rcx, [rbp + 0x10f8]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x140012d37
jmp 0x140012d3c
jmp 0x140012be3
lea rcx, [rbp + 0x698]
call fcn.1400112ad
xor eax, eax
cmp eax, 1
je 0x14001326f
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x6b8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x6d4], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x6f4], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x6b8], rax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x136
idiv ecx
mov eax, edx
mov dword [rbp + 0x774], eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0x718]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rbp + 0x6b8]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0x798], rax
mov r8d, dword [rbp + 0x6f4]
mov edx, dword [rbp + 0x6d4]
mov rcx, qword [rbp + 0x6b8]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0x7b8], rax
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x798]
call qword [sym.imp.GDI32.dll_SelectObject]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x136
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x718]
sub ecx, eax
mov eax, ecx
add eax, 0x104
mov ecx, 8
imul rcx, rcx, 0
mov dword [rbp + rcx + 0x748], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x1fe
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x71c]
sub ecx, eax
mov eax, ecx
add eax, 0x136
mov ecx, 8
imul rcx, rcx, 0
mov dword [rbp + rcx + 0x74c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x1fe
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x720]
sub ecx, eax
mov eax, ecx
add eax, 0x136
mov ecx, 8
imul rcx, rcx, 1
mov dword [rbp + rcx + 0x748], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x26c
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x71c]
sub ecx, eax
mov eax, ecx
add eax, 0xd2
mov ecx, 8
imul rcx, rcx, 1
mov dword [rbp + rcx + 0x74c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x1fe
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x718]
sub ecx, eax
mov eax, ecx
sub eax, 0x136
mov ecx, 8
imul rcx, rcx, 2
mov dword [rbp + rcx + 0x748], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x1fe
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x724]
sub ecx, eax
mov eax, ecx
add eax, 0x136
mov ecx, 8
imul rcx, rcx, 2
mov dword [rbp + rcx + 0x74c], eax
mov eax, dword [rbp + 0x71c]
mov ecx, dword [rbp + 0x724]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rbp + 0x718]
mov edx, dword [rbp + 0x720]
sub edx, ecx
mov ecx, edx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov eax, dword [rbp + 0x71c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x718]
mov r8, qword [rbp + 0x6b8]
lea rdx, [rbp + 0x748]
mov rcx, qword [rbp + 0x798]
call qword [sym.imp.GDI32.dll_PlgBlt]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x136
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x718]
sub ecx, eax
mov eax, ecx
sub eax, 0x104
mov ecx, 8
imul rcx, rcx, 0
mov dword [rbp + rcx + 0x748], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x1fe
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x71c]
sub ecx, eax
mov eax, ecx
sub eax, 0x136
mov ecx, 8
imul rcx, rcx, 0
mov dword [rbp + rcx + 0x74c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x1fe
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x720]
sub ecx, eax
mov eax, ecx
sub eax, 0x136
mov ecx, 8
imul rcx, rcx, 1
mov dword [rbp + rcx + 0x748], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x26c
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x71c]
sub ecx, eax
mov eax, ecx
sub eax, 0xd2
mov ecx, 8
imul rcx, rcx, 1
mov dword [rbp + rcx + 0x74c], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x1fe
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x718]
sub ecx, eax
mov eax, ecx
add eax, 0x136
mov ecx, 8
imul rcx, rcx, 2
mov dword [rbp + rcx + 0x748], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x1fe
idiv ecx
mov eax, edx
mov ecx, dword [rbp + 0x724]
sub ecx, eax
mov eax, ecx
sub eax, 0x136
mov ecx, 8
imul rcx, rcx, 2
mov dword [rbp + rcx + 0x74c], eax
mov eax, dword [rbp + 0x71c]
mov ecx, dword [rbp + 0x724]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rbp + 0x718]
mov edx, dword [rbp + 0x720]
sub edx, ecx
mov ecx, edx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov eax, dword [rbp + 0x71c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x718]
mov r8, qword [rbp + 0x6b8]
lea rdx, [rbp + 0x748]
mov rcx, qword [rbp + 0x798]
call qword [sym.imp.GDI32.dll_PlgBlt]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, edx
movzx eax, al
mov dword [rbp + 0x1184], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, edx
movzx eax, al
shl eax, 8
mov ecx, dword [rbp + 0x1184]
or ecx, eax
mov eax, ecx
mov dword [rbp + 0x1188], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, edx
movzx eax, al
shl eax, 0x10
mov ecx, dword [rbp + 0x1188]
or ecx, eax
mov eax, ecx
mov ecx, eax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, qword [rbp + 0x6b8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0x8928e28
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x798]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x6f4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x6d4]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x6b8]
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
cmp eax, 5
jne 0x1400131fe
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1134], 0xf
lea rdx, [rbp + 0x1134]
lea rcx, [rbp + 0x1118]
call fcn.1400110f5
mov qword [rbp + 0x1188], rax
lea rcx, [rbp + 0x1158]
call fcn.1400112ad
lea r8, [rbp + 0x698]
mov rdx, rax
lea rcx, [rbp + 0x1178]
call fcn.1400110b9
mov rcx, qword [rbp + 0x1188]
mov rdx, rcx
mov rcx, rax
call fcn.140011221
movzx eax, al
test eax, eax
je 0x14001326a
jmp 0x14001326f
jmp 0x140012d48
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001bf10]
call fcn.140011375
mov eax, edi
mov rcx, qword [rbp + 0x1190]
xor rcx, rbp
call fcn.1400111ea
lea rsp, [rbp + 0x11a8]
pop rdi
pop rbp
ret