Function at 0x140002c50
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1403622b0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x31], rdx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
mov r8d, dword [r15 + 4]
mov edx, dword [r15]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdi, rax
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
lea r8, [rbp + 7]
mov edx, 0x20
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetObjectW]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x45], xmm0
xor r12d, r12d
mov dword [rbp - 0x35], r12d
mov dword [rbp - 0x59], 0x28
mov ecx, dword [rbp + 0xb]
mov dword [rbp - 0x55], ecx
mov ecx, dword [rbp + 0xf]
mov dword [rbp - 0x51], ecx
movzx eax, word [rbp + 0x17]
mov word [rbp - 0x4d], ax
movzx eax, word [rbp + 0x19]
mov word [rbp - 0x4b], ax
mov dword [rbp - 0x49], r12d
mov edx, dword [rbp + 0x13]
imul edx, ecx
mov dword [rbp - 0x45], edx
mov dword [rbp - 0x63], r12d
mov eax, 0x4d42
mov word [rbp - 0x69], ax
lea eax, [rdx + 0x36]
mov dword [rbp - 0x67], eax
mov dword [rbp - 0x5f], gethostname
xor eax, eax
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rax
lea rcx, [rbp - 0x11]
call fcn.1400051a0
nop
mov dword [rsp + 0x40], 0xcc0020
mov eax, dword [r15 + 0xc]
mov dword [rsp + 0x38], eax
mov eax, dword [r15 + 8]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
mov eax, dword [r15 + 4]
mov dword [rsp + 0x20], eax
mov r9d, dword [r15]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
mov dword [rsp + 0x30], r12d
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, dword [r15 + 4]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDIBits]
mov ebx, dword [rbp - 0x45]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rax
lea edx, [rbx + 0x36]
lea rcx, [rbp - 0x29]
call fcn.1400051a0
nop
mov rcx, qword [rbp - 0x29]
movsd xmm0, qword [rbp - 0x69]
movsd qword [rcx], xmm0
mov eax, dword [rbp - 0x61]
mov dword [rcx + 8], eax
movzx eax, word [rbp - 0x5d]
mov word [rcx + 0xc], ax
mov rax, qword [rbp - 0x29]
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rax + 0xe], xmm0
movups xmm1, xmmword [rbp - 0x49]
movups xmmword [rax + 0x1e], xmm1
movsd xmm0, qword [rbp - 0x39]
movsd qword [rax + 0x2e], xmm0
mov r8d, dword [rbp - 0x45]
mov rcx, qword [rbp - 0x29]
add rcx, 0x36
mov rdx, qword [rbp - 0x11]
call fcn.1401e1740
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
lea r8d, [rbx + 0x36]
mov rdx, qword [rbp - 0x29]
mov rcx, r14
call fcn.140002f10
nop
lea edi, [r12 - 1]
mov rbx, qword [rbp - 0x21]
test rbx, rbx
je 0x140002e62
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140002e62
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140002e62
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rbx, qword [rbp - 9]
test rbx, rbx
je 0x140002e93
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140002e93
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140002e93
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15 + 0x38]
cmp rdx, 8
jb 0x140002ecf
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15 + 0x20]
cmp rdx, 0x1000
jb 0x140002eca
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f08
mov rcx, r8
call fcn.1401df0d0
mov qword [r15 + 0x30], r12
mov qword [r15 + 0x38], 7
mov word [r15 + 0x20], r12w
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1401df0b0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1401ee5b8
int3