Function at 0x40212d
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
call fcn.00403de5
push rbp
mov rbp, rsp
sub rsp, 0x50
call dbg._monstartup
call dbg.__main
mov r9d, 0x24
lea r8, str.OVERHAUL.exe
lea rdx, str.The_software_you_just_executed_is_considered_as_a_safety_malware._r_nThis_malware_will_not_harm_your_computer_and_dosent_makes_it_unusable.__means_pc_still_usable_after_running.__r_nIf_you_are_seeing_this_message_without_knowing_what_you_just_executed__simply_press_No_and_nothing_will_happen._r_nIf_you_know_what_this_malware_does_and_are_using_a_safe_environment_to_test__press_Yes_to_start_it._r_n_r_nDO_YOU_WANT_TO_EXECUTE_THIS_MALWARE__not_RESULTING_IN_AN_UNUSABLE_MACHINE_
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 7
sete al
test al, al
je 0x40217e
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov r9d, 0x24
lea r8, str.OVERHAUL.exe
lea rdx, str.Last_warning__r_n_r_nwell__since_this_is_safety__you_can_run_on_real_pc._r_nwish_for_your_boredom_to_be_cured___r_n_r_nSTILL_EXECUTE_IT_
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 7
sete al
test al, al
je 0x4021b8
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov r9d, 0x24
lea r8, str.OVERHAUL.exe
lea rdx, str.Control_Yourself__traitor__r_nit_can_mess_up_with_your_screen_and_make_loud_noise._OK__r_n_r_nfun_fact:_in_the_last_payload__theres_same_bytebeat_as_from_r_nSMSS_J215728.21_360215.1.exe_two_payloads_combined_with_modfied_one
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 7
sete al
test al, al
je 0x4021f2
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.gdi4_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.gdi4combine_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x10], rax
call sym.sound5s__
mov ecx, 0x7530
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.ShakeA_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x18], rax
mov ecx, 0xea60
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x18]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.ShakeB_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x20], rax
mov ecx, 0x7530
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x20]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x50
pop rbp
ret