Function at 0x18000b8d8
Capabilities:
Capture screenshot
Delete file
Get common file path
Print debug messages
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x330
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rax, r8
mov qword [rsp + 0xa8], rax
mov r13d, edx
mov rsi, rcx
mov qword [rsp + 0xb0], rax
xor r12d, r12d
xor eax, eax
mov qword [rsp + 0x68], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DISPLAY
call qword [sym.imp.GDI32.dll_CreateDCA]
mov r14, rax
mov qword [rsp + 0x50], rax
lea edx, [r12 + 8]
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
lea edx, [r12 + 0xa]
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r15, rax
mov qword [rsp + 0x70], rax
mov r8d, ebx
mov edx, edi
mov rcx, r14
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], r12d
and dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ebx
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.USER32.dll_GetCursor]
mov rbx, rax
test rax, rax
je 0x18000b9fb
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r9, rbx
mov r8d, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x58]
mov rcx, r15
call qword [sym.imp.USER32.dll_DrawIcon]
mov rdx, qword [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdi, rax
mov qword [rsp + 0xa0], rax
mov eax, 1
cmp r13d, eax
jg 0x18000ba23
movzx ebx, ax
jmp 0x18000ba37
mov ebx, 4
cmp r13d, ebx
jle 0x18000ba37
mov ebx, 8
cmp r13d, ebx
jg 0x18000ba45
mov cl, bl
mov r12d, eax
shl r12d, cl
shl r12d, 2
jmp 0x18000ba4f
mov ebx, 0x10
cmp r13d, ebx
jg 0x18000ba56
mov edx, 0x20
jmp 0x18000ba66
mov ebx, 0x18
lea edx, [rbx + 8]
cmp r13d, ebx
jle 0x18000ba66
movzx ebx, dx
lea r8, [rsp + 0xb8]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetObjectA]
mov dword [rsp + 0x78], 0x28
mov ecx, dword [rsp + 0xbc]
mov dword [rsp + 0x7c], ecx
mov r8d, dword [rsp + 0xc0]
mov dword [rsp + 0x80], r8d
mov eax, 1
mov word [rsp + 0x84], ax
mov word [rsp + 0x86], bx
xor r9d, r9d
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], r9
movzx eax, bx
imul eax, ecx
add eax, 0x1f
and eax, 0xffffffe0
cdq
and edx, 7
lea ecx, [rdx + rax]
sar ecx, 3
imul ecx, r8d
lea r13d, [r12 + 0x28]
add r13d, ecx
cmp r13d, dword [rsi]
je 0x18000bb52
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18000bb0e
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rsi + 8], rax
mov edx, r13d
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
jne 0x18000bb44
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
and dword [rsi], 0
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x18000bd5a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
jmp 0x18000bb56
mov rbx, qword [rsi + 8]
mov rcx, rbx
lea rdx, [rsp + 0x78]
mov r8d, 0x28
call fcn.18001b580
mov ecx, 0xf
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x18000bbaa
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r14, rax
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.GDI32.dll_SelectPalette]
mov qword [rsp + 0x68], rax
mov rcx, r14
call qword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x18000bbaf
mov r14, qword [rsp + 0x70]
lea rcx, [r12 + rbx + 0x28]
and dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0xc0]
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18000bc0e
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_RealizePalette]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov qword [rsi + 8], rbx
mov dword [rsi], r13d
xor r14d, r14d
test r13d, r13d
jne 0x18000bc30
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x50]
jmp 0x18000bb30
mov eax, 0x4d42
mov word [rsp + 0xe0], ax
mov dword [rsp + 0xe2], r13d
mov dword [rsp + 0xe6], r14d
lea eax, [r12 + 0x36]
mov dword [rsp + 0xea], eax
lea r9, [rsp + 0x210]
xor r8d, r8d
lea rdx, [0x18003f5d4]
lea rcx, [0x180050870]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x18000bcf3
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
mov r8d, 0xe
lea rdx, [rsp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
mov r8d, dword [rsi]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0xf0]
call fcn.18001761c
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0xf0]
call fcn.180017470
nop
lea rcx, [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rcx, str.faenflalkwnfelne
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov al, 1
jmp 0x18000bd5c
xor al, al
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.180019850
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret