Function at 0x1400014d0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x130
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc0], rcx
mov qword [rbp - 0x28], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov qword [rbp + 0xa8], rax
mov dword [rbp - 0x2c], 0
mov ecx, 0x4c
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0xa4], eax
mov ecx, 0x4d
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0xa0], eax
lea rax, [rbp + 0x5a]
mov r8d, 0xe
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x30]
mov r8d, 0x28
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, rbp
mov r8d, 0x2c
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0x20]
mov r8d, 0x20
mov edx, 0
mov rcx, rax
call sym.memset
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov edx, 7
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetCurrentObject]
call rax
mov qword [rbp + 0x90], rax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x90]
mov r8, rdx
mov edx, 0x20
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetObjectW]
call rax
mov eax, dword [rbp - 0x1c]
mov dword [rbp + 0x8c], eax
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x88], eax
mov rax, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov word [rbp + 0x5a], 0x4d42
mov dword [rbp + 0x64], 0x36
mov dword [rbp + 0x30], 0x28
mov word [rbp + 0x3e], 0x18
mov dword [rbp + 0x40], 0
mov word [rbp + 0x3c], 1
mov eax, dword [rbp + 0x8c]
mov dword [rbp + 0x34], eax
mov eax, dword [rbp + 0x88]
mov dword [rbp + 0x38], eax
mov rax, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x20], rax
mov edx, dword [rbp + 0x8c]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
add eax, 0x1f
and eax, 0xffffffe0
lea edx, [rax + 7]
test eax, eax
cmovs eax, edx
sar eax, 3
imul eax, dword [rbp + 0x88]
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x98]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x78], rax
lea rcx, [rbp - 0x28]
mov rdx, rbp
mov rax, qword [rbp + 0x98]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateDIBSection]
call rax
mov qword [rbp + 0x70], rax
mov rdx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x78]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov ecx, dword [rbp + 0x8c]
mov rax, qword [rbp + 0x78]
mov dword [rsp + 0x40], 0xcc0020
mov edx, dword [rbp + 0xa0]
mov dword [rsp + 0x38], edx
mov edx, dword [rbp + 0xa4]
mov dword [rsp + 0x30], edx
mov rdx, qword [rbp + 0x98]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x88]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0xc0000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
jne 0x1400017d2
mov rax, qword [rbp + 0x78]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x98]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov eax, 0
jmp 0x1400018b0
lea rcx, [rbp - 0x2c]
lea rdx, [rbp + 0x5a]
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0xe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
lea rcx, [rbp - 0x2c]
lea rdx, [rbp + 0x30]
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x28
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rdx, qword [rbp - 0x28]
lea r8, [rbp - 0x2c]
mov ecx, dword [rbp + 0x84]
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x78]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x98]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov eax, 1
add rsp, 0x130
pop rbp
ret