Function at 0x18007b7bb
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
jmp 0x180163be0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2f8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x318]
mov rax, qword [0x1801cc9c0]
xor rax, rbp
mov qword [rbp + 0x290], rax
lea rcx, [0x1801e2769]
call fcn.18007c341
nop
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x44], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x64], eax
mov r8d, dword [rbp + 0x64]
mov edx, dword [rbp + 0x44]
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0x88], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_SelectObject]
nop
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x44]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_BitBlt]
nop
mov eax, 0x4d42
mov word [rbp + 0xa8], ax
mov dword [rbp + 0xb2], 0x36
imul eax, dword [rbp + 0x44], 3
add eax, 3
and eax, 0xfffffffc
imul eax, dword [rbp + 0x64]
mov ecx, dword [rbp + 0xb2]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0xaa], eax
xor eax, eax
mov word [rbp + 0xae], ax
xor eax, eax
mov word [rbp + 0xb0], ax
mov dword [rbp + 0xd8], 0x28
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0xdc], eax
mov eax, dword [rbp + 0x64]
neg eax
mov dword [rbp + 0xe0], eax
mov eax, 1
mov word [rbp + 0xe4], ax
mov eax, 0x18
mov word [rbp + 0xe6], ax
mov dword [rbp + 0xe8], 0
mov dword [rbp + 0xec], 0
mov dword [rbp + 0xf0], 0
mov dword [rbp + 0xf4], 0
mov dword [rbp + 0xf8], 0
mov dword [rbp + 0xfc], 0
mov rcx, qword [rbp + 0x2c0]
call fcn.18007a334
lea r8, [0x1801b3634]
mov rdx, rax
lea rcx, [rbp + 0x118]
call qword [sym.imp.ucrtbased.dll_fopen_s]
mov dword [rbp + 0x134], eax
cmp dword [rbp + 0x134], 0
jne 0x180163ef7
cmp qword [rbp + 0x118], 0
je 0x180163ef7
mov r9, qword [rbp + 0x118]
mov r8d, 1
mov edx, 0xe
lea rcx, [rbp + 0xa8]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
mov r9, qword [rbp + 0x118]
mov r8d, 1
mov edx, 0x28
lea rcx, [rbp + 0xd8]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
imul eax, dword [rbp + 0x44], 3
add eax, 3
and eax, 0xfffffffc
imul eax, dword [rbp + 0x64]
cdqe
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x158]
call fcn.18007aefb
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x258]
mov qword [rbp + 0x178], rax
mov dword [rsp + 0x30], 0
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x64]
xor r8d, r8d
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_GetDIBits]
nop
mov r9, qword [rbp + 0x118]
mov r8d, 1
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x278], rax
mov rcx, qword [rbp + 0x278]
call fcn.18007b077
cmp qword [rbp + 0x278], 0
jne 0x180163ec3
mov qword [rbp + 0x288], 0
jmp 0x180163edc
mov qword [rbp + 0x178], 0x8123
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x288], rax
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
mov rcx, qword [rbp + 0x2c0]
call fcn.18007c29c
nop
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x1801b20a0]
call fcn.18007bd6a
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.18007b0a4
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret