Function at 0x140052540
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov r14, qword [rbp + 0xc8]
xor r12d, r12d
mov dword [rsp + 0x2c], r9d
mov r13d, r8d
mov r15, rdx
mov rbx, rcx
mov word [r14], r12w
test rdx, rdx
jne 0x14005258d
xor eax, eax
jmp 0x140052622
mov rcx, rdx
mov qword [rsp + 0x158], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
movzx eax, word [rax + 0xe]
cmp ax, 8
ja 0x140052863
mov edx, 0x112
bt edx, eax
jae 0x140052863
lea rdx, [0x140183390]
mov rcx, rbx
mov qword [rsp + 0x160], rsi
call fcn.1400fafe4
mov rsi, rax
test rax, rax
jne 0x140052640
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1401fbba0]
lea r9d, [rsi + 0x40]
lea r8, [rsp + 0x40]
mov edx, 0x4e71
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rsp + 0x40]
mov r8, rbx
mov rcx, r14
call fcn.1400f98c8
xor eax, eax
mov rsi, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret
mov edx, 1
lea rcx, str.GIF89a
mov r9, rax
lea r8d, [rdx + 5]
call fcn.1400faf54
mov ecx, 0xffff
cmp dword [rdi + 4], ecx
jge 0x14005266d
movzx eax, word [rdi + 4]
mov word [rsp + 0x28], ax
jmp 0x140052672
mov word [rsp + 0x28], cx
cmp dword [rdi + 8], ecx
jge 0x140052682
movzx eax, word [rdi + 8]
mov word [rsp + 0x24], ax
jmp 0x140052687
mov word [rsp + 0x24], cx
movzx edx, byte [rdi + 0xe]
mov eax, r13d
mov r9, rsi
lea r8d, [rdx - 1]
mov byte [rsp + 0x20], r12b
mov byte [rsp + 0x22], r12b
shl r8b, 4
neg eax
sbb cl, cl
dec dl
and cl, 0x80
add r8b, cl
lea rcx, [rsp + 0x28]
add r8b, dl
mov edx, 1
mov byte [rsp + 0x21], r8b
lea r8d, [rdx + 1]
call fcn.1400faf54
mov edx, 1
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 1]
mov r9, rsi
call fcn.1400faf54
mov edx, 1
lea rcx, [rsp + 0x21]
mov r8d, edx
mov r9, rsi
call fcn.1400faf54
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
mov r9, rsi
call fcn.1400faf54
mov edx, 1
lea rcx, [rsp + 0x22]
mov r8d, edx
mov r9, rsi
call fcn.1400faf54
test r13d, r13d
je 0x1400527d7
mov eax, dword [rdi + 0x20]
test eax, eax
jne 0x14005273e
movzx ecx, byte [rdi + 0xe]
mov eax, 1
shl eax, cl
test eax, eax
je 0x140052786
lea rbx, [rdi + 0x29]
mov r14d, eax
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov edx, 1
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], al
movzx eax, byte [rbx]
lea r8d, [rdx + 2]
mov byte [rsp + 0x31], al
movzx eax, byte [rbx - 1]
mov r9, rsi
mov byte [rsp + 0x32], al
call fcn.1400faf54
lea rbx, [rbx + 4]
dec r14
jne 0x140052750
cmp dword [rdi + 0x20], r12d
je 0x1400527d7
mov word [rsp + 0x30], r12w
mov byte [rsp + 0x32], r12b
movzx ecx, byte [rdi + 0xe]
mov ebx, dword [rdi + 0x20]
mov eax, 1
shl eax, cl
cmp ebx, eax
jae 0x1400527d7
nop dword [rax]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r9, rsi
lea r8d, [rdx + 2]
call fcn.1400faf54
movzx ecx, byte [rdi + 0xe]
mov eax, 1
shl eax, cl
inc ebx
cmp ebx, eax
jb 0x1400527b0
mov ecx, dword [rbp + 0xc0]
mov edx, 1
mov word [rsp + 0x3c], r12w
test ecx, ecx
movzx eax, cl
lea r8d, [rdx + 7]
setns byte [rsp + 0x3b]
test ecx, ecx
lea rcx, [rsp + 0x38]
cmovns r12d, eax
mov r9, rsi
mov word [rsp + 0x38], 0xf921
mov byte [rsp + 0x3a], 4
mov byte [rsp + 0x3f], 0
mov byte [rsp + 0x3e], r12b
call fcn.1400faf54
mov r9d, dword [rsp + 0x2c]
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
call fcn.140052ad0
mov edx, 1
lea rcx, [0x140187910]
mov r8d, edx
mov r9, rsi
mov ebx, eax
call fcn.1400faf54
mov rcx, rsi
call fcn.1400fa904
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, ebx
jmp 0x140052612
xor eax, eax
jmp 0x14005261a