Function at 0x1400f10d0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xd8]
sub rsp, 0x1a0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov edi, r9d
mov ebx, r8d
mov r13, rdx
mov qword [rsp + 0x38], rdx
mov qword [rbp - 0x30], rdx
mov r14d, dword [rbp + 0x100]
mov r15, qword [rbp + 0x108]
mov ecx, 0x18
call qword [sym.imp.gdiplus.dll_GdipAlloc]
mov r12, rax
mov qword [rsp + 0x30], rax
xor esi, esi
test rax, rax
je 0x1400f118f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], rax
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [r12], rax
mov qword [rbp - 0x38], rsi
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x26200a
mov r8d, r14d
mov edx, edi
mov ecx, ebx
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov dword [r12 + 0x10], eax
mov rax, qword [rbp - 0x38]
mov qword [r12 + 8], rax
jmp 0x1400f1197
mov r12, rsi
mov qword [rsp + 0x30], rsi
xorps xmm0, xmm0
movss dword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x22009
mov rcx, qword [r12 + 8]
call qword [sym.imp.gdiplus.dll_GdipBitmapConvertFormat]
test eax, eax
je 0x1400f11c4
mov dword [r12 + 0x10], eax
lea r15, [r13 + 0x20]
mov qword [rsp + 0x40], r15
mov r8, r15
mov r9, qword [r15 + 0x18]
cmp r9, 8
jb 0x1400f11dd
mov r8, qword [r15]
mov r10, qword [r15 + 0x10]
mov edi, 0xa
lea r14, [rdi - 0xb]
cmp r10, 3
jne 0x1400f130e
mov rdx, r10
lea rcx, [0x1401f5048]
sub r8, rcx
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400f130e
add rcx, 2
sub rdx, 1
jne 0x1400f1201
mov dword [rbp - 0x38], esi
mov dword [rbp - 0x28], esi
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x38]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rbp - 0x28]
test eax, eax
je 0x1400f12b5
mov ecx, eax
call fcn.1401567b4
mov rbx, rax
test rax, rax
je 0x1400f12b5
mov r8, rax
mov edx, dword [rbp - 0x28]
mov ecx, dword [rbp - 0x38]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r8d, esi
mov r10d, dword [rbp - 0x38]
test r10d, r10d
je 0x1400f12ad
lea r11, str.image_bmp
nop dword [rax]
mov r9d, r8d
imul rax, r9, 0x68
mov rdx, qword [rax + rbx + 0x40]
mov rcx, rsi
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x1400f1301
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x1400f1301
add rcx, 2
cmp rcx, rdi
jne 0x1400f1280
imul rax, r9, 0x68
movups xmm0, xmmword [rax + rbx]
movups xmmword [rbp + 0x60], xmm0
mov rcx, rbx
call fcn.140155e3c
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov rdi, qword [r13 + 0x10]
mov r14, r13
cmp qword [r13 + 0x18], 8
jb 0x1400f12d3
mov r14, qword [r13]
movabs rax, 0x7ffffffffffffffe
cmp rdi, 8
jae 0x1400f1485
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 8], 7
mov ebx, 7
jmp 0x1400f14bb
inc r8d
cmp r8d, r10d
jae 0x1400f12ad
jmp 0x1400f1270
mov r8, r15
cmp r9, 8
jb 0x1400f131a
mov r8, qword [r15]
cmp r10, 4
jne 0x1400f13e4
mov rdx, r10
lea rcx, str.jpeg
sub r8, rcx
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400f13e4
add rcx, 2
sub rdx, 1
jne 0x1400f1331
mov dword [rbp - 0x28], esi
mov dword [rbp - 0x38], esi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x28]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x1400f12b5
mov ecx, eax
call fcn.1401567b4
mov rbx, rax
test rax, rax
je 0x1400f12b5
mov r8, rax
mov edx, dword [rbp - 0x38]
mov ecx, dword [rbp - 0x28]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r8d, esi
mov r10d, dword [rbp - 0x28]
test r10d, r10d
je 0x1400f12ad
lea r11, str.image_jpeg
mov r9d, r8d
imul rax, r9, 0x68
mov rdx, qword [rax + rbx + 0x40]
mov rcx, r14
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x1400f13d6
add rcx, 2
cmp rcx, 0xb
je 0x1400f12a1
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
je 0x1400f13b0
inc r8d
cmp r8d, r10d
jae 0x1400f12ad
jmp 0x1400f13a1
mov dword [rbp - 0x28], esi
mov dword [rbp - 0x38], esi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x28]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x1400f12b5
mov ecx, eax
call fcn.1401567b4
mov rbx, rax
test rax, rax
je 0x1400f12b5
mov r8, rax
mov edx, dword [rbp - 0x38]
mov ecx, dword [rbp - 0x28]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r8d, esi
mov r10d, dword [rbp - 0x28]
test r10d, r10d
je 0x1400f12ad
lea r11, str.image_png
nop dword [rax]
mov r9d, r8d
imul rax, r9, 0x68
mov rdx, qword [rax + rbx + 0x40]
mov rcx, rsi
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x1400f1477
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x1400f1477
add rcx, 2
cmp rcx, rdi
je 0x1400f12a1
jmp 0x1400f1450
inc r8d
cmp r8d, r10d
jae 0x1400f12ad
jmp 0x1400f1440
mov rbx, rdi
or rbx, 7
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x20]
call fcn.140005370
mov qword [rbp - 0x20], rax
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140151a90
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], rdi
lea rcx, [rbp - 0x20]
cmp rbx, 8
cmovae rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f17ae
lea rcx, [rbp - 0x20]
call fcn.140050aa0
mov rbx, rax
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], si
mov r8, rax
cmp qword [rbp - 0x10], rax
cmovb r8, qword [rbp - 0x10]
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.140005060
nop
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], si
mov rax, qword [rbp - 0x10]
cmp rax, rbx
jb 0x1400f18f1
sub rax, rbx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
lea rdx, [rax + rbx*2]
lea rcx, [rbp + 0x40]
call fcn.140005060
nop
mov qword [rbp], rsi
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], 7
mov word [rbp], si
xor r8d, r8d
lea rdx, [0x1401c16d8]
lea rcx, [rbp]
call fcn.140005060
nop
mov r12d, 1
movabs r13, 0x7ffffffffffffffe
mov rbx, qword [rbp + 0x30]
sub r13, rbx
nop dword [rax]
mov edx, r12d
lea rcx, [rbp - 0x58]
call fcn.14000f7c0
mov qword [rbp - 0x38], rax
cmp r13, 1
jb 0x1400f18eb
lea r15, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r15, qword [rbp + 0x20]
mov qword [rsp + 0x48], rsi
lea r14, [rbx + 1]
mov ebx, 7
lea rdi, [rsp + 0x48]
cmp r14, rbx
jbe 0x1400f163c
mov rbx, r14
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
jbe 0x1400f160b
mov rbx, rax
jmp 0x1400f1618
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140005370
mov rdi, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rbx
mov rbx, qword [rbp + 0x30]
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140151a90
mov eax, 0x5f
mov word [rdi + rbx], ax
mov word [rdi + r14*2], si
mov r9, qword [rbp - 0x38]
lea r8, [rsp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.14002ac40
nop
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140011ba0
movups xmm7, xmmword [rax]
movups xmmword [rsp + 0x68], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm6
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rbp]
call fcn.140004ff0
movups xmmword [rbp], xmm7
movups xmmword [rbp + 0x10], xmm6
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
inc r12d
lea rcx, [rsp + 0x68]
call fcn.140004ff0
nop
lea rcx, [rbp - 0x78]
call fcn.140004ff0
nop
lea rcx, [rsp + 0x48]
call fcn.140004ff0
nop
lea rcx, [rbp - 0x58]
call fcn.140004ff0
lea rcx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400f172a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400f1739
cmp r12d, 0x64
jge 0x1400f1782
mov rbx, qword [rbp + 0x30]
jmp 0x1400f15b0
lea r9, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r9, qword [rbp]
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae r8, qword [rbp - 0x20]
lea rdx, str.File_already_exists:__s____Using:__s
mov ecx, 7
call fcn.140083970
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.140005060
nop
lea rcx, [rbp]
call fcn.140004ff0
nop
lea rcx, [rbp + 0x40]
call fcn.140004ff0
nop
lea rcx, [rbp + 0x20]
call fcn.140004ff0
mov r12, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae r8, qword [rbp - 0x20]
lea rdx, str.Saving_screenshot__s
mov ecx, 7
call fcn.140083970
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
xor r9d, r9d
lea r8, [rbp + 0x60]
mov rcx, qword [r12 + 8]
call qword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
mov ebx, eax
test eax, eax
je 0x1400f1869
mov dword [r12 + 0x10], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r9d, eax
mov r8d, ebx
lea rdx, str.Screenshot_status:__d_error:__d
mov ecx, 7
call fcn.140083970
cmp esi, 0x70
jne 0x1400f1869
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [rbp - 0x20]
lea ecx, [rsi - 0x69]
test eax, eax
je 0x1400f1853
cmp qword [rbp - 8], 8
cmovae r8, qword [rbp - 0x20]
lea rdx, str.Disk_full._Deleted_empty_screenshot__s
call fcn.140083970
jmp 0x1400f1869
cmp qword [rbp - 8], 8
cmovae r8, qword [rbp - 0x20]
lea rdx, str.Disk_full._Error_deleting_screenshot__s
call fcn.1400838f0
lea rdi, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdi, qword [rbp - 0x20]
call fcn.1400616f0
mov r9, rdi
mov r8d, esi
mov edx, 0x807c
mov rcx, qword [rax + 0x50]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
lea rcx, [rbp - 0x20]
call fcn.140004ff0
nop
mov rcx, r15
call fcn.140004ff0
mov rcx, r13
call fcn.140004ff0
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14014f2f0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140003c20
nop
call fcn.140009860
int3