Function at 0x14007d0b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rdi, rdx
mov edx, 0x3a
mov r14, r9
mov ebp, r8d
mov r12, rcx
cmp dx, word [rdi]
jne 0x14007d109
add rdi, 2
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrChrW]
xor ebx, ebx
cmp rax, rbx
je 0x14007d20b
mov rsi, rdi
mov word [rdi], bx
add rdi, 2
jmp 0x14007d1dc
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0x2e]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
xor ebx, ebx
lea rsi, [rax + 2]
cmp rax, rbx
je 0x14007d20b
lea rdx, [0x140127380]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
jne 0x14007d156
lea rsi, str.image_png
jmp 0x14007d1e1
lea rdx, [0x140127360]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
je 0x14007d1d5
lea rdx, str.jpeg
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
je 0x14007d1d5
lea rdx, [0x140127348]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
jne 0x14007d19b
lea rsi, str.image_gif
jmp 0x14007d1e1
lea rdx, str.tiff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
jne 0x14007d1b8
lea rsi, str.image_tiff
jmp 0x14007d1e1
lea rdx, [0x140127300]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
jne 0x14007d20b
lea rsi, str.image_bmp
jmp 0x14007d1e1
lea rsi, str.image_jpeg
cmp rsi, rbx
je 0x14007d20b
lea rdx, [0x140127300]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
cmp eax, ebx
je 0x14007d20b
mov r9d, ebp
mov r8, rsi
mov rdx, rdi
mov rcx, r12
call fcn.14007cfa0
jmp 0x14007d519
cmp ebp, ebx
je 0x14007d219
mov eax, 1
jmp 0x14007d519
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov r13d, ebx
mov r15, rbx
call qword [sym.imp.GDI32.dll_CreateDCW]
mov edx, 0xe
mov rcx, rax
mov rbp, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xc
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rbp
imul r14d, eax
call qword [sym.imp.GDI32.dll_DeleteDC]
mov edx, 0x20
lea esi, [rdx - 0x1f]
cmp r14d, esi
jg 0x14007d272
mov r12w, si
jmp 0x14007d288
mov r12d, 4
cmp r14d, r12d
jle 0x14007d288
mov r12d, 8
cmp r14d, r12d
jg 0x14007d297
mov cl, r12b
mov r13d, esi
shl r13d, cl
shl r13d, 2
jmp 0x14007d2a6
mov r12d, 0x18
cmp r14d, r12d
jle 0x14007d2a6
mov r12w, dx
mov rcx, qword [rsp + 0xf0]
lea r8, [rsp + 0x60]
call qword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x68]
movzx eax, r12w
mov dword [rsp + 0x84], ecx
mov dword [rsp + 0x80], 0x28
mov dword [rsp + 0x88], r8d
mov word [rsp + 0x8c], si
mov word [rsp + 0x8e], r12w
imul eax, ecx
add eax, 0x1f
mov ecx, 0x42
mov dword [rsp + 0x90], ebx
cdq
mov dword [rsp + 0x94], ebx
mov dword [rsp + 0x98], ebx
and edx, 0x1f
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0xa0], ebx
add eax, edx
mov dword [rsp + 0xa4], ebx
sar eax, 5
imul eax, r8d
shl eax, 2
add eax, r13d
mov edx, eax
mov dword [rsp + 0xf8], eax
add rdx, 0x28
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rsp + 0x80]
mov r8d, 0x28
mov rcx, rax
mov r12, rax
call fcn.140102b50
mov ecx, 0xf
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0x48], rax
cmp rax, rbx
je 0x14007d3ae
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rdx, qword [rsp + 0x48]
xor r8d, r8d
mov rcx, rax
mov rbp, rax
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, rbp
mov r15, rax
call qword [sym.imp.GDI32.dll_RealizePalette]
mov r9d, dword [rsp + 0x68]
mov ecx, r13d
mov dword [rsp + 0x30], ebx
lea rdx, [rcx + r12 + 0x28]
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0xf0]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_GetDIBits]
cmp r15, rbx
je 0x14007d405
mov r8d, esi
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_RealizePalette]
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ebp, dword [rsp + 0xf8]
mov eax, 0x4d42
mov word [rsp + 0x56], bx
mov word [rsp + 0x50], ax
lea eax, [rbp + 0x36]
add ebp, 0x28
mov dword [rsp + 0x52], eax
lea eax, [r13 + 0x36]
mov word [rsp + 0x58], bx
mov dword [rsp + 0x5a], eax
cmp rdi, rbx
je 0x14007d4bf
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007d47d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
cmove eax, esi
jmp 0x14007d519
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0xe
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14007d505
lea eax, [rbp + 0xe]
lea rcx, [0x14013e0e0]
movsxd rdx, eax
mov qword [0x14013d870], rdx
add rdx, 8
call fcn.1400630a4
mov rbx, qword [0x14013e0e0]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov r8d, 0xe
call fcn.14001d7d8
lea rcx, [rbx + 0xe]
movsxd r8, ebp
mov rdx, r12
call fcn.14001d7d8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret