Function at 0x140063e50
Capabilities:
Capture screenshot
Create directory
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1400e8180]
xor rax, rsp
mov qword [rsp + 0x188], rax
lea rcx, str.shoot_n
call fcn.1400029d0
nop
lea rcx, [rsp + 0xe0]
call fcn.140057350
nop
xor edi, edi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], 0xf
mov byte [rsp + 0x88], dil
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
cmp byte [0x1400e8e20], dil
je 0x140063f6e
mov rcx, qword [0x1400e9290]
sub rax, rcx
mov rdx, qword [rsp + 0xf0]
cmp rax, rdx
jb 0x14006474e
lea r9, [0x1400e9280]
cmp qword [0x1400e9298], 0x10
cmovae r9, qword [0x1400e9280]
lea rax, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0x10
cmovae rax, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [0x1400e9280]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.14002d660
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rsp + 0x98], xmm1
jmp 0x14006405d
mov rcx, qword [rsp + 0xf0]
sub rax, rcx
cmp rax, 9
jb 0x140064754
lea rax, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0x10
cmovae rax, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:_Users_
lea r8, [rsp + 0xe0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.14002d660
nop
lea rdx, [0x1400e9220]
cmp qword [0x1400e9238], 0x10
cmovae rdx, qword [0x1400e9220]
mov r8, qword [0x1400e9230]
lea rcx, [rsp + 0x68]
call fcn.140021a00
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm1
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14006405d
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064058
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140064759
call fcn.140080f50
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], 0xf
mov byte [rsp + 0x68], 0
mov r8d, 0x1a
lea rdx, str._Screenshot_screenshot.bmp
lea rcx, [rsp + 0x68]
call fcn.1400218a0
nop
lea r8, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x98]
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.14002d980
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14006413c
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064137
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006475f
call fcn.140080f50
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rax, qword [rsp + 0x98]
sub rbx, rax
cmp rbx, 0xb
jb 0x140064765
lea r9, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae r9, qword [rsp + 0x88]
mov qword [rsp + 0x30], 0xb
lea rcx, str._Screenshot
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x88]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x128]
call fcn.14002d660
nop
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0x10
cmovae rcx, qword [rsp + 0x128]
call fcn.14009939c
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x148]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r12d, dword [rsp + 0x154]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r13, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
mov r8d, r12d
mov r14d, dword [rsp + 0x150]
mov edx, r14d
mov rcx, r13
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r15, rax
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov r9d, r14d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x1400645ae
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 0x10
setae cl
mov rdi, qword [rsp + 0xb8]
jb 0x140064294
mov rbx, qword [rsp + 0xa8]
add rdi, rbx
jmp 0x1400642ab
add rdi, rdx
lea rbx, [rsp + 0xa8]
test cl, cl
je 0x1400642ab
mov rbx, qword [rsp + 0xa8]
xor r10d, r10d
mov qword [rsp + 0x68], r10
mov ecx, r10d
mov qword [rsp + 0x78], rcx
mov r8d, 7
mov qword [rsp + 0x80], r8
mov word [rsp + 0x68], r10w
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x1400642f8
lea rcx, [rsp + 0x68]
call fcn.14003d640
xor r10d, r10d
mov ecx, r10d
mov qword [rsp + 0x78], rcx
mov r8, qword [rsp + 0x80]
lea rax, [rsp + 0x68]
mov qword [rsp + 0xc8], rax
cmp rbx, rdi
je 0x140064367
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x140064348
lea rax, [rcx + 1]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
cmp r8, 8
cmovae rax, qword [rsp + 0x68]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r10w
inc rbx
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
jmp 0x140064305
lea rcx, [rsp + 0x68]
call fcn.1400276d0
xor r10d, r10d
inc rbx
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
jmp 0x140064305
lea rcx, [rsp + 0x68]
cmp r8, 8
cmovae rcx, qword [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140064569
mov eax, 0x4d42
mov word [rsp + 0xd0], ax
mov ecx, r12d
imul ecx, r14d
lea r14d, [rcx*4]
lea ecx, [r14 + 0x36]
mov dword [rsp + 0xd2], ecx
mov dword [rsp + 0xd6], edi
mov dword [rsp + 0xda], 0x36
mov dword [rsp + 0x100], 0x28
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x104], eax
mov eax, r12d
neg eax
mov dword [rsp + 0x108], eax
mov qword [rsp + 0x10c], 0x200001
mov qword [rsp + 0x114], rdi
mov qword [rsp + 0x11c], rdi
mov dword [rsp + 0x124], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xc8]
lea r8d, [rdi + 0xe]
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xc8]
lea r8d, [rdi + 0x28]
lea rdx, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
movups xmm0, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x158], xmm0
movups xmm1, xmmword [rsp + 0x110]
movups xmmword [rsp + 0x168], xmm1
movsd xmm0, qword [rsp + 0x120]
movsd qword [rsp + 0x178], xmm0
mov dword [rsp + 0x51], edi
mov eax, edi
mov dword [rsp + 0x180], eax
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, r12d
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDIBits]
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, r12d
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDIBits]
movsxd rcx, r14d
call fcn.1400812b4
mov rdi, rax
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, r12d
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDIBits]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc8]
mov r8d, r14d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140080f50
xor edi, edi
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x1400645ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400645a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006476b
call fcn.140080f50
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x14006461d
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064618
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140064771
call fcn.140080f50
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0xc0]
cmp rdx, 0x10
jb 0x14006467c
inc rdx
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064677
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140064777
call fcn.140080f50
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], 0xf
mov byte [rsp + 0xa8], 0
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x1400646dc
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400646d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006477d
call fcn.140080f50
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x14006471c
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064716
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140064783
call fcn.140080f50
nop
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140080f30
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140002cb0
nop
call fcn.140002cb0
call fcn.1400996b0
nop
call fcn.1400996b0
int3
call fcn.140002cb0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3