Function at 0x413a80
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x1c0
mov rbp, rsp
mov qword [rbp + 0x1d0], rcx
mov dword [rbp + 0x1d8], edx
mov dword [rbp + 0x1e0], r8d
mov dword [rbp + 0x1e8], r9d
mov rcx, qword [rbp + 0x1d0]
call fcn.00409310
nop
cmp dword [rbp + 0x1d8], 8
jne 0x413ae0
mov rcx, qword [rbp + 0x1d0]
mov edx, dword [rbp + 0x1e0]
mov r8d, dword [rbp + 0x1e8]
call fcn.00413690
mov byte [rbp + 0x1bf], al
jmp 0x413dd9
mov byte [rbp + 0x1bf], 0
call sub.user32.dll_GetDesktopWindow
mov qword [rbp + 0x58], rax
mov rcx, qword [rbp + 0x58]
call sub.user32.dll_GetDC
mov qword [rbp + 0x1b0], rax
mov rcx, qword [rbp + 0x1b0]
call sub.gdi32.dll_CreateCompatibleDC
mov qword [rbp + 0x1a8], rax
lea rcx, [rbp + 0x174]
mov edx, 0x2c
xor r8, r8
call fcn.00405c10
mov dword [rbp + 0x174], 0x28
mov eax, dword [rbp + 0x1e8]
mov dword [rbp + 0x17c], eax
mov eax, dword [rbp + 0x1e0]
mov dword [rbp + 0x178], eax
mov word [rbp + 0x180], 1
movzx rax, word [rbp + 0x1d8]
mov word [rbp + 0x182], ax
mov dword [rbp + 0x184], 0
movzx eax, word [rbp + 0x182]
imul eax, dword [rbp + 0x1e0]
add eax, 0x1f
mov ecx, 0x20
cdq
idiv ecx
add eax, eax
add eax, eax
imul eax, dword [rbp + 0x1e8]
movsxd rax, eax
mov qword [rbp + 0x68], rax
mov eax, dword [rbp + 0x68]
mov dword [rbp + 0x188], eax
mov rcx, qword [rbp + 0x1b0]
lea rdx, [rbp + 0x174]
xor r8, r8
lea r9, [rbp + 0x168]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.gdi32.dll_CreateDIBSection
mov qword [rbp + 0x1a0], rax
cmp qword [rbp + 0x1a0], 0
je 0x413dd9
cmp qword [rbp + 0x168], 0
je 0x413dd9
mov rcx, qword [rbp + 0x1a8]
mov rdx, qword [rbp + 0x1a0]
call sub.gdi32.dll_SelectObject
mov rcx, qword [rbp + 0x1a8]
xor edx, edx
xor r8, r8
mov r9d, dword [rbp + 0x1e0]
mov eax, dword [rbp + 0x1e8]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x1b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0xcc0020
call sub.gdi32.dll_BitBlt
test eax, eax
jne 0x413c53
mov byte [rbp + 0x57], 1
jmp 0x413c57
mov byte [rbp + 0x57], 0
mov rcx, qword [rbp + 0x1d0]
call fcn.0040a4d0
mov rcx, rax
mov edx, 0x40000000
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x160], rax
cmp qword [rbp + 0x160], 0xffffffffffffffff
je 0x413da3
mov dword [rbp + 0x80], 0
cmp byte [rbp + 0x57], 0
je 0x413cf4
lea rcx, [0x0042c578]
call fcn.00409940
mov rcx, qword [rbp + 0x160]
mov rdx, rax
mov r8d, 0x3a
lea r9, [rbp + 0x80]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov byte [rbp + 0x1bf], 0
jmp 0x413d97
lea rcx, [rbp + 0x72]
mov edx, 0xe
xor r8, r8
call fcn.00405c10
mov word [rbp + 0x72], 0x4d42
mov dword [rbp + 0x7c], 0x36
mov eax, dword [rbp + 0x188]
add eax, dword [rbp + 0x7c]
mov dword [rbp + 0x74], eax
mov rcx, qword [rbp + 0x160]
lea rdx, [rbp + 0x72]
mov r8d, 0xe
lea r9, [rbp + 0x80]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov rcx, qword [rbp + 0x160]
lea rdx, [rbp + 0x174]
mov r8d, 0x28
lea r9, [rbp + 0x80]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov rcx, qword [rbp + 0x160]
mov rdx, qword [rbp + 0x168]
mov r8d, dword [rbp + 0x188]
lea r9, [rbp + 0x80]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov rcx, qword [rbp + 0x160]
call sub.kernel32.dll_CloseHandle
cmp byte [rbp + 0x57], 0
jne 0x413db0
mov byte [rbp + 0x1bf], 1
mov rcx, qword [rbp + 0x1a8]
call sub.gdi32.dll_DeleteDC
mov rcx, qword [rbp + 0x1a0]
call sub.gdi32.dll_DeleteObject
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x1b0]
call sub.user32.dll_ReleaseDC
nop
lea rcx, [rbp + 0x1d0]
call fcn.00409180
movzx rax, byte [rbp + 0x1bf]
lea rsp, [rbp + 0x1c0]
pop rbp
ret