Function at 0x1400079f0
Capabilities:
Capture screenshot
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
lea rdx, [0x1400aaf34]
lea rcx, [0x1400b9fd0]
call fcn.14000a3c0
mov ebx, 0x64
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [0x1400bcb18], rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x1f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x2f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x3f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x4f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x5f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x6f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x8f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0x9f
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ERROR
call fcn.140006400
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400bcb18]
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140007a20
lea r9d, [rbx + 0x10]
xor ecx, ecx
lea r8, str.PCKILLER3.0_Wana_You_DIE_
lea rdx, str.You_no_have_chance_DIE_
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [0x1400aaf78]
call fcn.140038f50
lea rcx, str.color_4F
call fcn.140038f50
lea rcx, str.I_Just_Wana_You_DIE_GoodBye_
call fcn.140006400
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r15d, r15d
lea r14d, [rbx + 0x14]
mov esi, r15d
call fcn.1400362d8
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
cmp r8d, 3
jge 0x140007d6d
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
mov rbp, rax
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007c92
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
shl edi, 8
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007cad
dec eax
or eax, 0xffffff00
inc eax
movzx ebx, al
shl ebx, 0x10
or ebx, edi
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007cca
dec eax
or eax, 0xffffff00
inc eax
movzx edx, al
mov rcx, rbp
or edx, ebx
call qword [sym.imp.GDI32.dll_SetBkColor]
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007ced
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
shl edi, 8
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007d08
dec eax
or eax, 0xffffff00
inc eax
movzx ebx, al
shl ebx, 0x10
or ebx, edi
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007d25
dec eax
or eax, 0xffffff00
inc eax
movzx edx, al
mov rcx, rbp
or edx, ebx
call qword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
call fcn.1400362d8
cdq
xor ecx, ecx
idiv ebx
mov edi, edx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
call fcn.1400362d8
lea r9, str.You_no_have_chance_DIE
mov dword [rsp + 0x20], 0x16
jmp 0x140007e6a
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
mov rbp, rax
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007d94
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
shl edi, 8
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007daf
dec eax
or eax, 0xffffff00
inc eax
movzx ebx, al
shl ebx, 0x10
or ebx, edi
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007dcc
dec eax
or eax, 0xffffff00
inc eax
movzx edx, al
mov rcx, rbp
or edx, ebx
call qword [sym.imp.GDI32.dll_SetBkColor]
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007def
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
shl edi, 8
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007e0a
dec eax
or eax, 0xffffff00
inc eax
movzx ebx, al
shl ebx, 0x10
or ebx, edi
call fcn.1400362d8
and eax, 0x800000ff
jge 0x140007e27
dec eax
or eax, 0xffffff00
inc eax
movzx edx, al
mov rcx, rbp
or edx, ebx
call qword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
call fcn.1400362d8
cdq
xor ecx, ecx
idiv ebx
mov edi, edx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
call fcn.1400362d8
lea r9, str.Hope_you_happy_
mov dword [rsp + 0x20], 0xf
cdq
mov r8d, edi
idiv ebx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_TextOutA]
inc esi
cmp esi, 5
jne 0x140007edf
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
lea ecx, [rsi - 4]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x40], 0x550009
xor r8d, r8d
mov dword [rsp + 0x38], r15d
mov r9d, eax
mov dword [rsp + 0x30], r15d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, r15d
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
sub r14, 1
jne 0x140007c42
lea ebp, [r14 + 5]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
mov dword [rsp + 0x40], 0x1100a6
mov edx, 0x32
mov dword [rsp + 0x38], r15d
mov r8d, edx
mov dword [rsp + 0x30], r15d
mov r9d, esi
mov qword [rsp + 0x28], rax
mov rcx, rax
mov dword [rsp + 0x20], edi
mov rbx, rax
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x40], 0xee0086
mov edx, 0xffffffce
mov dword [rsp + 0x38], r15d
mov r9d, esi
mov dword [rsp + 0x30], r15d
mov rcx, rax
mov qword [rsp + 0x28], rax
mov rbx, rax
lea r8d, [rdx + 0x64]
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x40], 0x660046
mov edx, 0x32
mov dword [rsp + 0x38], r15d
mov r9d, esi
mov dword [rsp + 0x30], r15d
mov rcx, rax
mov qword [rsp + 0x28], rax
mov rbx, rax
lea r8d, [rdx - 0x64]
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x40], 0x8800c6
mov edx, 0xffffffce
mov dword [rsp + 0x38], r15d
mov r8d, edx
mov dword [rsp + 0x30], r15d
mov r9d, esi
mov qword [rsp + 0x28], rax
mov rcx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
call fcn.1400077c0
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbp, 1
jne 0x140007ef8
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x85
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RedrawWindow]
call fcn.140004180
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]