Function at 0x140057f14
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rdi, rdx
mov edx, 0x3a
mov r15, rcx
cmp dx, word [rdi]
jne 0x140057f62
add rdi, 2
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrChrW]
xor ebx, ebx
cmp rax, rbx
je 0x140058041
mov rsi, rdi
mov word [rdi], bx
add rdi, 2
jmp 0x140058015
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0x2e]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
xor ebx, ebx
lea rsi, [rax + 2]
cmp rax, rbx
je 0x140058041
lea rdx, [0x1400de4f8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
jne 0x140057fac
lea rsi, str.image_png
jmp 0x14005801a
lea rdx, [0x1400de4d8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
je 0x14005800e
lea rdx, str.jpeg
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
je 0x14005800e
lea rdx, [0x1400de4c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
jne 0x140057ff1
lea rsi, str.image_gif
jmp 0x14005801a
lea rdx, str.tiff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
jne 0x140058041
lea rsi, str.image_tiff
jmp 0x14005801a
lea rsi, str.image_jpeg
cmp rsi, rbx
je 0x140058041
lea rdx, [0x1400de478]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
cmp eax, ebx
je 0x140058041
mov r8, rsi
mov rdx, rdi
mov rcx, r15
call fcn.140057e18
jmp 0x140058336
lea rcx, str.DISPLAY
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r12d, ebx
mov r14, rbx
call qword [sym.imp.GDI32.dll_CreateDCA]
mov edx, 0xe
mov rcx, rax
mov rsi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xc
mov rcx, rsi
mov r13d, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rsi
imul r13d, eax
call qword [sym.imp.GDI32.dll_DeleteDC]
mov edx, 0x20
lea eax, [rdx - 0x1f]
cmp r13d, eax
jg 0x14005809d
mov bp, ax
jmp 0x1400580b1
mov ebp, 4
cmp r13d, ebp
jle 0x1400580b1
mov ebp, 8
cmp r13d, ebp
jg 0x1400580c0
mov cl, bpl
mov r12, rax
shl r12, cl
shl r12d, 2
jmp 0x1400580cd
mov ebp, 0x18
cmp r13d, ebp
jle 0x1400580cd
mov bp, dx
lea r8, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [rsp + 0x54]
mov r8d, dword [rsp + 0x58]
mov eax, 1
mov dword [rsp + 0x74], ecx
mov dword [rsp + 0x70], 0x28
mov word [rsp + 0x7c], ax
movzx eax, bp
mov dword [rsp + 0x78], r8d
mov word [rsp + 0x7e], bp
mov dword [rsp + 0x80], ebx
mov dword [rsp + 0x84], ebx
imul eax, ecx
add eax, 0x1f
mov ecx, 0x42
mov dword [rsp + 0x88], ebx
cdq
mov dword [rsp + 0x8c], ebx
mov dword [rsp + 0x90], ebx
and edx, 0x1f
mov dword [rsp + 0x94], ebx
add eax, edx
sar eax, 5
imul eax, r8d
shl eax, 2
add eax, r12d
mov edx, eax
mov dword [rsp + 0xe8], eax
add rdx, 0x28
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rsp + 0x70]
mov r8d, 0x28
mov rcx, rax
mov rbp, rax
call fcn.1400ba0e0
mov ecx, 0xf
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xf8], rax
cmp rax, rbx
je 0x1400581c7
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rdx, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, rax
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, rsi
mov r14, rax
call qword [sym.imp.GDI32.dll_RealizePalette]
mov r9d, dword [rsp + 0x58]
mov ecx, r12d
mov dword [rsp + 0x30], ebx
lea rdx, [rcx + rbp + 0x28]
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDIBits]
mov r15d, 1
cmp r14, rbx
je 0x14005821f
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_RealizePalette]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [rsp + 0xe8]
mov eax, 0x4d42
mov word [rsp + 0x46], bx
mov word [rsp + 0x40], ax
lea eax, [rsi + 0x36]
add esi, 0x28
mov dword [rsp + 0x42], eax
lea eax, [r12 + 0x36]
mov word [rsp + 0x48], bx
mov dword [rsp + 0x4a], eax
cmp rdi, rbx
je 0x1400582e1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140058299
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
cmove eax, r15d
jmp 0x140058336
lea r9, [rsp + 0xf0]
lea rdx, [rsp + 0x40]
mov r8d, 0xe
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0xf0]
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140058322
lea edx, [rsi + 0xe]
lea rcx, [0x1400f2c08]
mov dword [0x1400f2420], edx
add edx, 8
call fcn.14004bd00
mov rbx, qword [0x1400f2c08]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8d, 0xe
call fcn.1400177f8
lea rcx, [rbx + 0xe]
movsxd r8, esi
mov rdx, rbp
call fcn.1400177f8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret