Function at 0x140011348
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
jmp 0x140011940
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x308
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x328]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x2a8], rax
lea rcx, [0x1400230a2]
call fcn.1400113b6
nop
mov dword [rbp + 4], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x104], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x124], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0x48], rax
mov r8d, dword [rbp + 0x124]
mov edx, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140011a06
lea rcx, str._x__CreateCompatibleBitmap_Failed
call qword [sym.imp.ucrtbased.dll_puts]
nop
mov dword [rbp + 4], 0xffffffff
jmp 0x140011ce4
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.GDI32.dll_SelectObject]
nop
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x124]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x104]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x140011a74
lea rcx, str._x__BitBlt_Failed
call qword [sym.imp.ucrtbased.dll_puts]
nop
mov dword [rbp + 4], 0xffffffff
jmp 0x140011ce4
lea r8, [rbp + 0x88]
mov edx, 0x20
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.GDI32.dll_GetObjectW]
nop
mov dword [rbp + 0x178], 0x28
mov eax, dword [rbp + 0x8c]
mov dword [rbp + 0x17c], eax
mov eax, dword [rbp + 0x90]
mov dword [rbp + 0x180], eax
mov eax, 1
mov word [rbp + 0x184], ax
mov eax, 0x20
mov word [rbp + 0x186], ax
mov dword [rbp + 0x188], 0
mov dword [rbp + 0x18c], 0
mov dword [rbp + 0x190], 0
mov dword [rbp + 0x194], 0
mov dword [rbp + 0x198], 0
mov dword [rbp + 0x19c], 0
mov eax, 0x4d42
mov word [rbp + 0x148], ax
mov dword [rbp + 0x152], 0x36
movzx eax, word [rbp + 0x186]
mov ecx, dword [rbp + 0x8c]
imul ecx, eax
mov eax, ecx
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
imul eax, dword [rbp + 0x90]
mov ecx, dword [rbp + 0x152]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x14a], eax
xor eax, eax
mov word [rbp + 0x14e], ax
xor eax, eax
mov word [rbp + 0x150], ax
lea r8, [0x14001adf0]
mov rdx, qword [rbp + 0x2d0]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.ucrtbased.dll_fopen_s]
mov dword [rbp + 0x1b4], eax
cmp dword [rbp + 0x1b4], 0
jne 0x140011b95
cmp qword [rbp + 0xc8], 0
jne 0x140011bb5
mov rdx, qword [rbp + 0x2d0]
lea rcx, str._x__Failed_to_open_file:__s_n
call fcn.1400111bd
nop
mov dword [rbp + 4], 0xffffffff
jmp 0x140011ce4
mov r9, qword [rbp + 0xc8]
mov r8d, 1
mov edx, 0xe
lea rcx, [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
mov r9, qword [rbp + 0xc8]
mov r8d, 1
mov edx, 0x28
lea rcx, [rbp + 0x178]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
movzx eax, word [rbp + 0x186]
mov ecx, dword [rbp + 0x8c]
imul ecx, eax
mov eax, ecx
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
imul eax, dword [rbp + 0x90]
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x1d8], rax
cmp qword [rbp + 0x1d8], 0
jne 0x140011c6c
lea rcx, str._x__GlobalAlloc_Failed.
call qword [sym.imp.ucrtbased.dll_puts]
nop
mov dword [rbp + 4], 0xffffffff
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
jmp 0x140011ce4
mov dword [rsp + 0x30], 0
lea rax, [rbp + 0x178]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x90]
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.GDI32.dll_GetDIBits]
nop
mov eax, dword [rbp + 0xe4]
mov r9, qword [rbp + 0xc8]
mov r8d, 1
mov edx, eax
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
cmp qword [rbp + 0x68], 0
je 0x140011cf6
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
mov rdx, qword [rbp + 0x28]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ad60]
call fcn.140011343
mov eax, edi
mov rcx, qword [rbp + 0x2a8]
xor rcx, rbp
call fcn.1400111db
lea rsp, [rbp + 0x2b8]
pop rdi
pop rbp
ret