Function at 0x140009120
Capabilities:
Capture screenshot
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x14012c040]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov dword [rbp + 7], 1
xor r12d, r12d
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], r12
xor r8d, r8d
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x1f]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r13d, eax
lea ecx, [r12 + 1]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, eax
mov dword [rbp - 0x49], eax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rbx, rax
mov r8d, r15d
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdi, rax
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov r14, rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r15d
mov r9d, r13d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x140009257
movdqa xmm0, xmmword [0x140115fe0]
movdqu xmmword [rbp - 0x41], xmm0
movdqa xmm1, xmmword [str.creen_contents.]
movdqu xmmword [rbp - 0x31], xmm1
lea rdx, [rbp - 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400045e0
lea rdx, [0x1400047c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x140009507
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rax
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rbp - 0x11], rax
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x21]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov rcx, qword [rbp - 0x21]
mov qword [rbp - 9], rcx
mov dword [rbp - 1], r12d
test eax, eax
je 0x14000930b
movdqa xmm0, xmmword [0x140115d60]
movdqu xmmword [rbp - 0x41], xmm0
mov dword [rbp - 0x31], 0x2b494447
mov dword [rbp - 0x2d], 0x74694220
mov dword [rbp - 0x29], 0x2e70616d
mov byte [rbp - 0x25], 0
lea rdx, [rbp - 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400045e0
lea rdx, [0x1400047c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x1400094f2
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov dword [rbp - 0x19], r12d
lea rdx, [rbp - 0x19]
mov rcx, qword [rbp - 9]
call qword [sym.imp.gdiplus.dll_GdipGetImageWidth]
mov ecx, dword [rbp - 1]
test eax, eax
cmovne ecx, eax
mov dword [rbp - 1], ecx
mov dword [rbp - 0x21], r12d
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp - 9]
call qword [sym.imp.gdiplus.dll_GdipGetImageHeight]
mov ecx, dword [rbp - 1]
test eax, eax
cmovne ecx, eax
mov dword [rbp - 1], ecx
mov edi, r12d
mov dword [rbp - 0x15], r12d
lea rdx, [rbp - 0x15]
mov rcx, qword [rbp - 9]
call qword [sym.imp.gdiplus.dll_GdipGetImageHeight]
mov ecx, dword [rbp - 1]
test eax, eax
cmovne ecx, eax
mov dword [rbp - 1], ecx
mov eax, dword [rbp - 0x15]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
movaps xmm0, xmm1
mulss xmm0, dword [0x140115974]
cvttss2si r15, xmm0
mulss xmm1, dword [0x1401159cc]
cvttss2si r14, xmm1
mov esi, r12d
mov r12d, dword [rbp - 0x19]
test r12d, r12d
jle 0x140009417
mov ebx, r15d
cmp r15d, r14d
jae 0x140009410
lea r9, ds:[rbp - 0x19]
mov r8d, ebx
mov edx, esi
mov rcx, qword [rbp - 9]
call qword [sym.imp.gdiplus.dll_GdipBitmapGetPixel]
test eax, eax
je 0x1400093ef
mov dword [rbp - 1], eax
jmp 0x140009409
mov eax, dword [rbp - 0x19]
cmp eax, 0xff36b752
je 0x140009407
nop dword [rax]
cmp eax, 0xff143d0b
jne 0x140009409
inc edi
inc ebx
cmp ebx, r14d
jb 0x1400093d0
inc esi
cmp esi, r12d
jl 0x1400093c8
mov eax, dword [rbp - 0x21]
imul eax, r12d
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mulss xmm0, dword [0x140115934]
cvttss2si eax, xmm0
cmp edi, eax
jle 0x1400094f2
movd xmm0, r13d
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x140115a40]
cvttsd2si edi, xmm0
movd xmm0, dword [rbp - 0x49]
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x140115a40]
cvttsd2si esi, xmm0
xor r13d, r13d
mov ebx, r13d
test esi, esi
jle 0x1400094f2
movabs r14, 0x7ffffffffa0a1eff
mov r12d, 0xff
movabs r15, 0x7fffffffffffffff
nop dword [rax]
mov edx, ebx
mov ecx, edi
call qword [sym.imp.USER32.dll_SetCursorPos]
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, ebx
mov edx, edi
lea ecx, [r9 + 6]
call qword [sym.imp.USER32.dll_mouse_event]
lea rcx, [rbp - 0x21]
call fcn.1400056a0
mov rax, qword ds:[rbp - 0x21]
cmp rax, r14
je 0x1400094de
mov ecx, 1
cmovl ecx, r12d
test cl, cl
jns 0x1400094de
add rax, 0x5f5e100
mov qword [rbp - 0x49], rax
jmp 0x1400094e2
mov qword [rbp - 0x49], r15
lea rcx, [rbp - 0x49]
call fcn.140024f00
add ebx, 0x14
cmp ebx, esi
jl 0x140009490
lea rax, vtable.Gdiplus::Image.0
mov qword [rbp - 0x11], rax
mov rcx, qword [rbp - 9]
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140088df0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret