Function at 0x14009b6a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
mov rax, qword [0x1402930e8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, rdx
lea r8, [rbp - 0x41]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r15, rcx
call qword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x14009b8f4
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
test rax, rax
je 0x14009b8f4
mov qword [rsp + 0xf0], rdi
mov rdx, r15
mov qword [rsp + 0xb0], r12
mov rcx, rax
mov qword [rsp + 0xa0], r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov r8d, dword [rbp - 0x39]
xor edi, edi
mov ecx, r8d
mov qword [rbp - 0x51], rax
imul ecx, dword [rbp - 0x35]
mov r14, rax
mov eax, 0x4d42
mov dword [rbp - 9], r8d
mov word [rbp - 0x21], ax
lea r8, [0x14010d6ac]
mov eax, dword [rbp - 0x3d]
mov r12d, 1
mov dword [rbp - 0xd], eax
mov rdx, rbx
movzx eax, word [rbp - 0x2f]
add ecx, 0x36
mov dword [rbp - 0x1f], ecx
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x1b], edi
mov dword [rbp - 0x17], Ordinal_60
mov dword [rbp - 0x11], Ordinal_41
mov word [rbp - 5], r12w
mov word [rbp - 3], ax
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], rdi
mov qword [rbp - 0x49], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov r9, qword [rbp - 0x49]
test r9, r9
jne 0x14009b7af
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
xor al, al
jmp 0x14009b836
mov r8, r12
mov qword [rsp + 0xa8], r13
mov edx, reloc.WS2_32.dll_ntohl
lea rcx, [rbp - 0x21]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbp - 0x49]
lea rcx, [rbp - 0x11]
mov r8, r12
mov edx, Ordinal_41
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ebx, dword [rbp - 0x39]
imul ebx, dword [rbp - 0x35]
mov ecx, ebx
mov r13d, ebx
call fcn.140106748
mov r8, rax
mov edx, ebx
mov rcx, r15
mov r12, rax
call qword [sym.imp.GDI32.dll_GetBitmapBits]
test eax, eax
jne 0x14009b867
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r12
call fcn.140106740
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
xor al, al
mov r13, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xa0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140106b10
add rsp, 0xb8
pop r15
pop rsi
pop rbx
pop rbp
ret
movsxd r14, dword [rbp - 0x35]
mov rcx, r13
call fcn.140106748
mov ecx, dword [rbp - 0x39]
mov r15, rax
test ecx, ecx
jle 0x14009b8a8
mov ebx, edi
nop
sub ecx, edi
mov r8, r14
dec ecx
imul ecx, r14d
movsxd rdx, ecx
movsxd rcx, ebx
add rdx, r12
add rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbp - 0x39]
inc edi
add ebx, r14d
cmp edi, ecx
jl 0x14009b880
mov r9, qword [rbp - 0x49]
mov r8, r13
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r12
call fcn.140106740
mov rcx, r15
call fcn.140106740
mov rdx, qword [rbp - 0x51]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov al, 1
jmp 0x14009b82e
xor al, al
jmp 0x14009b84e