Function at 0x14000c044
Capabilities:
Capture screenshot
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x218]
sub rsp, 0x318
lea r8, [rbp - 0x30]
mov ebx, 1
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov dword [rbp - 0x48], ebx
xor esi, esi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
xor r8d, r8d
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x68]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r15, rax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r12, rax
mov r8d, edi
mov edx, ebx
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r13, rax
mov rdx, rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], edi
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.GDI32.dll_BitBlt]
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x50], rsi
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, r13
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov edi, eax
mov dword [rbp - 0x50], eax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x58], rax
mov dword [rbp + 0x270], esi
mov dword [rbp + 0x268], esi
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x270]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov ecx, dword [rbp + 0x268]
test ecx, ecx
je 0x14000c1cb
call fcn.140019180
mov rbx, rax
test rax, rax
je 0x14000c1cb
mov r8, rax
mov edx, dword [rbp + 0x268]
mov ecx, dword [rbp + 0x270]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov edi, esi
mov esi, dword [rbp + 0x270]
test esi, esi
je 0x14000c1be
mov r14d, edi
imul rcx, r14, 0x68
lea rdx, str.image_png
mov rcx, qword [rcx + rbx + 0x40]
call fcn.14002e0b4
test eax, eax
je 0x14000c1b1
inc edi
cmp edi, esi
jb 0x14000c18d
jmp 0x14000c1be
imul rax, r14, 0x68
movups xmm0, xmmword [rax + rbx]
movdqu xmmword [rbp - 0x28], xmm0
mov rcx, rbx
call fcn.140018a74
xor esi, esi
mov edi, dword [rbp - 0x50]
lea rdx, [rbp + 0x10]
mov ecx, 0xff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rsp + 0x58], rsi
movdqa xmm0, xmmword [0x1400409a0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], si
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400067f4
nop
lea rcx, [rbp - 0x18]
call fcn.140001afc
nop
mov r8d, 4
lea rdx, str..png
mov rcx, rax
call fcn.140007010
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rsp + 0x78]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rsp + 0x58]
call fcn.140007010
nop
lea rcx, [rsp + 0x78]
call fcn.140006790
nop
lea rcx, [rbp - 0x18]
call fcn.140006790
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
xor r9d, r9d
lea r8, [rbp - 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
test eax, eax
cmovne edi, eax
mov dword [rbp - 0x50], edi
mov dword [rbp + 0x278], esi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140006870
lea rdx, [rbp + 0x278]
lea rcx, [rsp + 0x78]
call fcn.140001e14
mov rcx, qword [rbp + 0x260]
mov qword [rcx], rax
mov eax, dword [rbp + 0x278]
mov dword [rcx + 8], eax
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
lea rcx, [rsp + 0x58]
call fcn.140006790
nop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
add rsp, 0x318
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret