Function at 0x798e10
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xc8
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xb0], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0xb8], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0xac], eax
mov eax, dword [0xae662c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [esp], str.gdiplus.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
je 0x799120
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov dword [esp + 4], str.GdipCreateBitmapFromHBITMAP
mov dword [esp], eax
call esi
sub esp, 8
mov dword [ebp - 0xb4], eax
mov dword [esp + 4], str.GdipSaveImageToStream
mov dword [esp], ebx
call esi
mov edx, dword [ebp - 0xb4]
sub esp, 8
mov esi, eax
test edx, edx
je 0x799158
test eax, eax
je 0x799158
lea eax, [ebp - 0xa4]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call edx
sub esp, 0xc
test eax, eax
jne 0x799078
lea eax, [ebp - 0x98]
mov dword [esp], 0x98e9c2
mov dword [esp + 4], eax
call fcn.00797f00
cmp eax, 0xffffffff
je 0x7991a0
mov eax, 1
mov edx, 4
vmovdqu xmm0, xmmword [0xad6f68]
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0xac]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x70], edx
mov dword [ebp - 0xa0], 0
vmovdqu xmmword [ebp - 0x84], xmm0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
sub esp, 0xc
test eax, eax
jne 0x799230
lea eax, [ebp - 0x88]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x98]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xa0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call esi
sub esp, 0x10
test eax, eax
jne 0x799270
mov eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x68]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x30]
sub esp, 0xc
test eax, eax
jne 0x7990d0
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0xb8]
mov dword [esi], eax
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [edi], eax
test eax, eax
je 0x7992a7
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0x14]
mov eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x9c]
sub esp, 0x14
mov edx, dword [eax]
mov dword [esp + 0xc], ecx
mov esi, dword [ebp - 0xb8]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0xc]
sub esp, 0x10
test eax, eax
jne 0x7991e0
mov eax, dword [ebp - 0x9c]
cmp dword [esi], eax
jne 0x7991e0
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
sub esp, 4
jmp 0x7990b3
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_create_GDI_bitmap_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
xor eax, eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [0xae662c]
jne 0x7992a2
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1a
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_get_stream_size_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
jmp 0x7990b1
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_load_gdiplus.dll_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x7990b1
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1e
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_load_GDI_functions_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
jmp 0x7990b1
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x21
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_get_JPEG_encoder_CLSID_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
jmp 0x7990b1
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_read_from_stream_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov eax, dword [edi]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, dword [ebp - 0xb8]
mov dword [edi], 0
mov dword [eax], 0
jmp 0x7990fd
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_create_stream_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
jmp 0x7990b1
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1f
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_save_image_to_stream_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x7990fd
call fcn.00788f70
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1a
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_allocate_buffer_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x7990fd