Function at 0x1400114dd
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
jmp 0x140017040
push rbp
push rsi
push rdi
sub rsp, 0x420
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x94
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025018]
xor rax, rbp
mov qword [rbp + 0x3c8], rax
lea rcx, [0x14002c0f6]
call fcn.1400116ef
xor eax, eax
cmp eax, 1
je 0x14001744c
call qword [sym.imp.ucrtbased.dll__kbhit]
test eax, eax
je 0x140017447
call qword [sym.imp.ucrtbased.dll__getch]
mov byte [rbp + 4], al
movsx eax, byte [rbp + 4]
cmp eax, 0x73
je 0x1400170b6
movsx eax, byte [rbp + 4]
cmp eax, 0x53
jne 0x140017447
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x44], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x64], eax
mov dword [rbp + 0x44], 0xf00
mov dword [rbp + 0x64], 0x870
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0x88], rax
mov r8d, dword [rbp + 0x64]
mov edx, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0xa8], rax
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x44]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_BitBlt]
mov edx, 0xc
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rbp + 0xc4], eax
mov edx, 0xe
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rbp + 0xe4], eax
mov dword [rbp + 0x108], 0x28
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x10c], eax
mov eax, dword [rbp + 0x64]
neg eax
mov dword [rbp + 0x110], eax
movzx eax, word [rbp + 0xe4]
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0xc4]
mov word [rbp + 0x116], ax
mov dword [rbp + 0x118], 0
mov dword [rbp + 0x11c], 0
mov dword [rbp + 0x120], 0
mov dword [rbp + 0x124], 0
mov dword [rbp + 0x128], 0
mov dword [rbp + 0x12c], 0
mov edx, 0x28
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x148], rax
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0x108]
mov rdi, qword [rbp + 0x168]
mov rsi, rax
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rbp + 0x44]
imul eax, dword [rbp + 0x64]
shl eax, 2
cdqe
mov rdx, rax
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x188], rax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rbp + 0x1a8], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x168]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x64]
xor r8d, r8d
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_GetDIBits]
mov eax, 0x4d42
mov word [rbp + 0x1c8], ax
mov eax, dword [rbp + 0x44]
imul eax, dword [rbp + 0x64]
shl eax, 2
cdqe
add rax, 0x36
mov dword [rbp + 0x1ca], eax
xor eax, eax
mov word [rbp + 0x1ce], ax
xor eax, eax
mov word [rbp + 0x1d0], ax
mov dword [rbp + 0x1d2], 0x36
lea rcx, [rbp + 0x1f8]
call fcn.1400118bb
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400117c6
lea r8, [0x140020c24]
mov rdx, rax
lea rcx, [rbp + 0x238]
call qword [sym.imp.ucrtbased.dll_fopen_s]
cmp qword [rbp + 0x238], 0
je 0x14001739f
mov r9, qword [rbp + 0x238]
mov r8d, 0xe
mov edx, 1
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov r9, qword [rbp + 0x238]
mov r8d, 0x28
mov edx, 1
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov eax, dword [rbp + 0x44]
imul eax, dword [rbp + 0x64]
shl eax, 2
cdqe
mov r9, qword [rbp + 0x238]
mov r8, rax
mov edx, 1
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, qword [rbp + 0x28]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rdx, str.Screenshot_saved_as
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [rbp + 0x1f8]
mov rcx, rax
call fcn.140011654
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x1f8]
call fcn.14001115e
jmp 0x14001744c
jmp 0x14001707e
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x1400224a0]
call fcn.1400115d7
mov eax, edi
mov rcx, qword [rbp + 0x3c8]
xor rcx, rbp
call fcn.14001134d
lea rsp, [rbp + 0x3d0]
pop rdi
pop rsi
pop rbp
ret