Function at 0x415de0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0xe0
mov rbp, rsp
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xf8], edx
mov dword [rbp + 0x100], r8d
mov dword [rbp + 0x108], r9d
mov rcx, qword [rbp + 0xf0]
call fcn.00409bc0
nop
cmp dword [rbp + 0xf8], 8
jne 0x415e40
mov rcx, qword [rbp + 0xf0]
mov edx, dword [rbp + 0x100]
mov r8d, dword [rbp + 0x108]
call fcn.004159f0
mov byte [rbp + 0xdf], al
jmp 0x41612c
mov byte [rbp + 0xdf], 0
call sub.user32.dll_GetDesktopWindow
mov qword [rbp + 0x58], rax
mov rcx, qword [rbp + 0x58]
call sub.user32.dll_GetDC
mov qword [rbp + 0xd0], rax
mov rcx, qword [rbp + 0xd0]
call sub.gdi32.dll_CreateCompatibleDC
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0x94]
mov edx, 0x2c
xor r8, r8
call fcn.00405ca0
mov dword [rbp + 0x94], 0x28
mov eax, dword [rbp + 0x108]
mov dword [rbp + 0x9c], eax
mov eax, dword [rbp + 0x100]
mov dword [rbp + 0x98], eax
mov word [rbp + 0xa0], 1
movzx rax, word [rbp + 0xf8]
mov word [rbp + 0xa2], ax
mov dword [rbp + 0xa4], 0
movzx eax, word [rbp + 0xa2]
imul eax, dword [rbp + 0x100]
add eax, 0x1f
test eax, eax
jns 0x415ee3
add eax, 0x1f
sar eax, 5
add eax, eax
add eax, eax
imul eax, dword [rbp + 0x108]
movsxd rax, eax
mov qword [rbp + 0x60], rax
mov eax, dword [rbp + 0x60]
mov dword [rbp + 0xa8], eax
mov rcx, qword [rbp + 0xd0]
lea rdx, [rbp + 0x94]
xor r8, r8
lea r9, [rbp + 0x88]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.gdi32.dll_CreateDIBSection
mov qword [rbp + 0xc0], rax
cmp qword [rbp + 0xc0], 0
je 0x41612c
cmp qword [rbp + 0x88], 0
je 0x41612c
mov rcx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xc0]
call sub.gdi32.dll_SelectObject
mov rcx, qword [rbp + 0xc8]
xor edx, edx
xor r8, r8
mov r9d, dword [rbp + 0x100]
mov eax, dword [rbp + 0x108]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0xd0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0xcc0020
call sub.gdi32.dll_BitBlt
test eax, eax
jne 0x415fb5
mov byte [rbp + 0x57], 1
jmp 0x415fb9
mov byte [rbp + 0x57], 0
mov rcx, qword [rbp + 0xf0]
call fcn.0040ae00
mov rcx, rax
mov edx, 0x40000000
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x80], rax
cmp qword [rbp + 0x80], 0xffffffffffffffff
je 0x4160f6
mov dword [rbp + 0x7c], 0
cmp byte [rbp + 0x57], 0
je 0x416050
lea rcx, [0x004319f8]
call fcn.0040a260
mov rcx, qword [rbp + 0x80]
mov rdx, rax
mov r8d, 0x3a
lea r9, [rbp + 0x7c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov byte [rbp + 0xdf], 0
jmp 0x4160ea
lea rcx, [rbp + 0x6e]
mov edx, 0xe
xor r8, r8
call fcn.00405ca0
mov word [rbp + 0x6e], 0x4d42
mov dword [rbp + 0x78], 0x36
mov eax, dword [rbp + 0xa8]
add eax, dword [rbp + 0x78]
mov dword [rbp + 0x70], eax
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0x6e]
mov r8d, 0xe
lea r9, [rbp + 0x7c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0x94]
mov r8d, 0x28
lea r9, [rbp + 0x7c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
mov r8d, dword [rbp + 0xa8]
lea r9, [rbp + 0x7c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov rcx, qword [rbp + 0x80]
call sub.kernel32.dll_CloseHandle
cmp byte [rbp + 0x57], 0
jne 0x416103
mov byte [rbp + 0xdf], 1
mov rcx, qword [rbp + 0xc8]
call sub.gdi32.dll_DeleteDC
mov rcx, qword [rbp + 0xc0]
call sub.gdi32.dll_DeleteObject
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0xd0]
call sub.user32.dll_ReleaseDC
nop
lea rcx, [rbp + 0xf0]
call fcn.004099f0
movzx rax, byte [rbp + 0xdf]
lea rsp, [rbp + 0xe0]
pop rbp
ret