Function at 0x140006c9c
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
xor ebx, ebx
mov r12, rdx
mov r15, rcx
mov esi, ebx
test rcx, rcx
je 0x140007064
call qword [sym.imp.GDI32.DLL_GetObjectType]
lea r13d, [rbx + 0x20]
cmp eax, 7
je 0x140006dda
lea rdx, [rbp - 0x19]
mov rcx, r15
call qword [sym.imp.USER32.DLL_GetIconInfo]
test eax, eax
je 0x140006dda
mov rcx, qword [rbp - 9]
lea r8, [rbp - 0x39]
mov edx, r13d
call qword [sym.imp.GDI32.DLL_GetObjectW]
test eax, eax
je 0x140006dc6
lea rcx, str.DISPLAY
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.GDI32.DLL_CreateDCW]
mov rdi, rax
test rax, rax
je 0x140006dc6
mov rcx, rax
call qword [sym.imp.GDI32.DLL_CreateCompatibleDC]
mov r14, rax
test rax, rax
je 0x140006dbd
mov r8d, dword [rbp - 0x31]
mov edx, dword [rbp - 0x35]
mov rcx, rdi
call qword [sym.imp.GDI32.DLL_CreateCompatibleBitmap]
mov rsi, rax
test rax, rax
je 0x140006dbd
mov rdx, rax
mov rcx, r14
call qword [sym.imp.GDI32.DLL_SelectObject]
mov ecx, 0xffffff
call qword [sym.imp.GDI32.DLL_CreateSolidBrush]
mov ecx, dword [rbp - 0x31]
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov ecx, dword [rbp - 0x35]
mov r9, r15
xor r8d, r8d
mov dword [rsp + 0x20], ecx
xor edx, edx
mov rcx, r14
mov rbx, rax
call qword [sym.imp.USER32.DLL_DrawIconEx]
mov rcx, rbx
call qword [sym.imp.GDI32.DLL_DeleteObject]
mov rcx, r14
mov r15, rsi
call qword [sym.imp.GDI32.DLL_DeleteDC]
mov rcx, rdi
call qword [sym.imp.GDI32.DLL_DeleteDC]
mov rcx, qword [rbp - 9]
call qword [sym.imp.GDI32.DLL_DeleteObject]
mov rcx, qword [rbp - 1]
call qword [sym.imp.GDI32.DLL_DeleteObject]
lea r8, [rbp - 0x39]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.GDI32.DLL_GetObjectW]
test eax, eax
je 0x140007064
test r12, r12
jne 0x140006e05
lea ecx, [r12 + 0xf]
call qword [sym.imp.GDI32.DLL_GetStockObject]
mov r12, rax
movzx eax, word [rbp - 0x27]
mov ecx, 1
imul ax, word [rbp - 0x29]
cmp ax, cx
ja 0x140006e1e
movzx r14d, cx
jmp 0x140006e46
mov r14d, 4
cmp ax, r14w
jbe 0x140006e46
mov r14d, 8
cmp ax, r14w
jbe 0x140006e46
mov r14d, 0x18
cmp ax, r14w
jbe 0x140006e46
movzx r14d, r13w
mov eax, dword [rbp - 0x35]
mov word [rbp + 0x13], cx
xor ecx, ecx
mov dword [rbp + 0xb], eax
mov eax, dword [rbp - 0x31]
mov dword [rbp + 7], 0x28
mov word [rbp + 0x15], r14w
mov qword [rbp + 0x17], 0
mov qword [rbp + 0x1f], 0
mov dword [rbp + 0x67], eax
mov dword [rbp + 0xf], eax
mov qword [rbp + 0x27], 0
call qword [sym.imp.USER32.DLL_GetDC]
xor r8d, r8d
mov rdx, r12
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.DLL_SelectPalette]
mov rcx, rdi
mov r12, rax
call qword [sym.imp.GDI32.DLL_RealizePalette]
lea rcx, [rbp + 7]
call fcn.140007088
mov ecx, 0x42
movzx edx, ax
add edx, 0x28
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r13, rax
test rax, rax
je 0x140007030
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
and dword [rsp + 0x30], 0
mov r9d, dword [rbp + 0x67]
movups xmm0, xmmword [rbp + 7]
movups xmm1, xmmword [rbp + 0x17]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r8d, r8d
movups xmmword [rax], xmm0
movsd xmm0, qword [rbp + 0x27]
movups xmmword [rax + 0x10], xmm1
mov rdx, r15
mov rcx, rdi
mov rbx, rax
movsd qword [rax + 0x20], xmm0
call qword [sym.imp.GDI32.DLL_GetDIBits]
mov rcx, r13
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 7], xmm0
movsd xmm0, qword [rbx + 0x20]
movups xmmword [rbp - 0x49], xmm1
movsd qword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x17], xmm1
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movups xmm0, xmmword [rbp - 0x49]
psrldq xmm0, 4
movd r9d, xmm0
mov dword [rbp + 0x1b], r9d
test r9d, r9d
jne 0x140006f6c
movzx r9d, r14w
imul r9d, dword [rbp - 0x35]
add r9d, 0x1f
shr r9d, 5
imul r9d, dword [rbp - 0x31]
shl r9d, 2
mov dword [rbp + 0x1b], r9d
lea rcx, [rbp + 7]
call fcn.140007088
xor r8d, r8d
mov rcx, r13
movzx edx, ax
add edx, r9d
add edx, dword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov rbx, rax
test rax, rax
je 0x140007027
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
mov r9, rax
call fcn.140007088
movzx edx, word [r9]
and dword [rsp + 0x30], 0
mov qword [rsp + 0x28], r9
movzx ecx, ax
xor r8d, r8d
add rcx, r9
mov r9d, dword [rbp + 0xf]
add rdx, rcx
mov rcx, rdi
mov qword [rsp + 0x20], rdx
mov rdx, r15
call qword [sym.imp.GDI32.DLL_GetDIBits]
mov rcx, rbx
test eax, eax
jne 0x140006fe8
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x140007030
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r8d, 1
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.GDI32.DLL_SelectPalette]
mov rcx, rdi
call qword [sym.imp.GDI32.DLL_RealizePalette]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.DLL_ReleaseDC]
test rsi, rsi
je 0x140007022
mov rcx, rsi
call qword [sym.imp.GDI32.DLL_DeleteObject]
mov rax, rbx
jmp 0x140007066
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r8d, 1
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.GDI32.DLL_SelectPalette]
mov rcx, rdi
call qword [sym.imp.GDI32.DLL_RealizePalette]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.DLL_ReleaseDC]
test rsi, rsi
je 0x140007064
mov rcx, rsi
call qword [sym.imp.GDI32.DLL_DeleteObject]
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret