Function at 0x140001488
Capabilities:
Write file on windows

Disassembly:
jmp 0x14000ec20
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x80
xor eax, eax
mov rbp, r8
xor r14d, r14d
mov r12, rdx
mov edi, 0x20
lea r8, [rsp + 0x58]
mov rcx, rbp
mov edx, edi
mov r13, r9
mov word [rsp + 0x48], r14w
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
jne 0x14000ec9c
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
movzx eax, word [rsp + 0x6a]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], r15
mov r15d, 1
imul ax, word [rsp + 0x68]
cmp ax, r15w
jne 0x14000ee67
mov di, r15w
movzx ecx, dil
mov eax, r15d
shl eax, cl
mov ecx, 0x40
movsxd rdx, eax
lea rdx, [rdx*4 + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov dword [rbx], 0x28
mov eax, dword [rsp + 0x5c]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x60]
mov dword [rbx + 8], eax
movzx eax, word [rsp + 0x68]
mov word [rbx + 0xc], ax
movzx eax, word [rsp + 0x6a]
mov word [rbx + 0xe], ax
cmp di, 0x18
jae 0x14000ed2d
movzx ecx, dil
mov eax, r15d
shl eax, cl
mov dword [rbx + 0x20], eax
movzx eax, di
xor ecx, ecx
mov dword [rbx + 0x10], r14d
mov dword [rbx + 0x24], r14d
imul eax, dword [rbx + 4]
add eax, 0x1f
and eax, 0xffffffe0
cdq
and edx, 7
add edx, eax
sar edx, 3
imul edx, dword [rbx + 8]
mov dword [rbx + 0x14], edx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14000ee63
movzx r9d, word [rbx + 8]
mov dword [rsp + 0x30], r14d
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x14000ee63
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000ee63
mov eax, 0x4d42
lea r9, [rsp + 0x40]
mov r8d, 0xe
mov word [rsp + 0x48], ax
mov ecx, dword [rbx + 0x20]
mov eax, dword [rbx + 0x14]
lea edx, [rax + rcx*4]
mov eax, dword [rbx]
mov word [rsp + 0x4e], r14w
lea ecx, [rdx + rax + 0xe]
mov word [rsp + 0x50], r14w
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4a], ecx
mov ecx, dword [rbx + 0x20]
mov eax, dword [rbx]
lea ecx, [rax + rcx*4 + 0xe]
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x52], ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000ee63
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x40]
mov rdx, rbx
lea r8d, [r8*4 + 0x28]
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000ee63
mov r8d, dword [rbx + 0x14]
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000eeba
xor eax, eax
jmp 0x14000eed8
cmp ax, 4
ja 0x14000ee77
mov edi, 4
jmp 0x14000ecd3
cmp ax, 8
ja 0x14000ee87
mov edi, 8
jmp 0x14000ecd3
cmp ax, 0x10
ja 0x14000ee97
mov edi, 0x10
jmp 0x14000ecd3
cmp ax, 0x18
ja 0x14000ecd3
mov edi, 0x18
lea edx, [rdi + 0x10]
lea ecx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
jmp 0x14000ecf5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, r15d
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xc0]
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret