Function at 0x14001100f
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
jmp 0x140011e20
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2e8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x308]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x288], rax
lea rcx, [0x1400250a4]
call fcn.14001144c
nop
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x64], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x84], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xc8], 0
lea rax, [rbp + 0xe8]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rax, [rbp + 0x128]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov dword [rbp + 0x154], 0
mov dword [rbp + 0x174], 0
cmp qword [rbp + 0xa8], 0
jne 0x140011f19
lea rcx, str.ERROR:_GetDC___failed_
call fcn.14001120d
nop
xor eax, eax
jmp 0x14001232b
mov eax, dword [rbp + 0x2b8]
mov ecx, dword [rbp + 0x64]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x154], eax
mov eax, dword [rbp + 0x2c0]
mov ecx, dword [rbp + 0x84]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x174], eax
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140011f88
lea rcx, str.ERROR:_CreateCompatibleDC___failed_
call fcn.14001120d
nop
mov rdx, qword [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
xor eax, eax
jmp 0x14001232b
mov r8d, dword [rbp + 0x2c0]
mov edx, dword [rbp + 0x2b8]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x140011fe2
lea rcx, str.ERROR:_CreateCompatibleBitmap___failed.
call fcn.14001120d
nop
mov rdx, qword [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
xor eax, eax
jmp 0x14001232b
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_SelectObject]
nop
mov dword [rsp + 0x40], 0xcc0020
mov eax, dword [rbp + 0x174]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x154]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x2c0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x2b8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x14001207d
lea rcx, str.ERROR:_BitBlt___failed_
call fcn.14001120d
nop
mov rdx, qword [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
xor eax, eax
jmp 0x14001232b
lea r8, [rbp + 0xe8]
mov edx, 0x20
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.GDI32.dll_GetObjectA]
nop
mov eax, 0x4d42
mov word [rbp + 0x128], ax
mov eax, dword [rbp + 0xf4]
imul eax, dword [rbp + 0x2c0]
cdqe
add rax, 0x36
mov dword [rbp + 0x12a], eax
mov dword [rbp + 0x132], 0x36
mov r8d, 0x28
xor edx, edx
lea rcx, [rbp + 0x198]
call fcn.140011370
nop
mov dword [rbp + 0x198], 0x28
mov eax, dword [rbp + 0xec]
mov dword [rbp + 0x19c], eax
mov eax, dword [rbp + 0xf0]
mov dword [rbp + 0x1a0], eax
mov eax, 1
mov word [rbp + 0x1a4], ax
mov eax, 0x20
mov word [rbp + 0x1a6], ax
mov dword [rbp + 0x1a8], 0
mov eax, dword [rbp + 0xf4]
imul eax, dword [rbp + 0xf0]
mov dword [rbp + 0x1ac], eax
cmp qword [rbp + 0x2b0], 0
je 0x1400121d6
lea rdx, [0x14001c384]
mov rcx, qword [rbp + 0x2b0]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14001219c
lea rcx, str.ERROR:_fopen___failed_
call fcn.14001120d
nop
mov rdx, qword [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
xor eax, eax
jmp 0x14001232b
mov r9, qword [rbp + 0x48]
mov r8d, 1
mov edx, 0xe
lea rcx, [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
mov r9, qword [rbp + 0x48]
mov r8d, 1
mov edx, 0x28
lea rcx, [rbp + 0x198]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
mov eax, dword [rbp + 0xf4]
imul eax, dword [rbp + 0x2c0]
cdqe
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140012241
lea rcx, str.ERROR:_malloc___failed_
call fcn.14001120d
nop
mov rdx, qword [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
xor eax, eax
jmp 0x14001232b
mov dword [rsp + 0x30], 0
lea rax, [rbp + 0x198]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x2c0]
xor r8d, r8d
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x1400122c2
lea rcx, str.ERROR:_GetDIBits___failed_
call fcn.14001120d
nop
mov rdx, qword [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
jmp 0x14001232b
cmp qword [rbp + 0x2b0], 0
je 0x1400122fe
mov eax, dword [rbp + 0xf4]
imul eax, dword [rbp + 0x2c0]
cdqe
mov r9, qword [rbp + 0x48]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
mov rdx, qword [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001be20]
call fcn.1400113c5
mov rax, rdi
mov rcx, qword [rbp + 0x288]
xor rcx, rbp
call fcn.14001122b
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret