Function at 0x401550
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0xa98
lea rbp, [rsp + 0x80]
call fcn.00401bf0
mov dword [rbp + 0xa0c], 0xf4240
mov dword [rbp + 0xa08], 0
jmp 0x401b08
mov rax, qword [sym.imp.USER32.dll_GetDesktopWindow]
call rax
mov qword [rbp + 0x9f8], rax
mov rax, qword [rbp + 0x9f8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowDC]
call rax
mov qword [rbp + 0x9f0], rax
lea rax, [rbp + 0x9a0]
mov rcx, qword [rbp + 0x9f8]
mov rdx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowRect]
call rax
jmp 0x40164e
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov ecx, eax
mov eax, ebx
cdq
idiv ecx
mov dword [rbp + 0x9ec], edx
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov ecx, eax
mov eax, ebx
cdq
idiv ecx
mov dword [rbp + 0x9e8], edx
mov edx, 0x7f01
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov r8, rax
mov ecx, dword [rbp + 0x9e8]
mov edx, dword [rbp + 0x9ec]
mov rax, qword [rbp + 0x9f0]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DrawIcon]
call rax
add dword [rbp + 0xa08], 1
cmp dword [rbp + 0xa08], 0x31
jle 0x4015c8
mov dword [rbp + 0xa08], 0
mov ecx, 0x44c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp + 0x9c8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
call rax
mov edx, dword [rbp + 0x9ac]
mov eax, dword [rbp + 0x9a4]
sub edx, eax
mov ecx, dword [rbp + 0x9a8]
mov eax, dword [rbp + 0x9a0]
sub ecx, eax
mov r8d, ecx
mov rax, qword [rbp + 0x9f0]
mov dword [rsp + 0x40], 0x330008
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x9f0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edx
mov r9d, r8d
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov r8d, dword [rbp + 0x9ac]
mov ecx, dword [rbp + 0x9a8]
mov eax, dword [rbp + 0x9ac]
lea edx, [rax - 0x64]
mov eax, dword [rbp + 0x9a8]
lea r9d, [rax - 0x64]
mov rax, qword [rbp + 0x9f0]
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x9f0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edx
mov r8d, 0x32
mov edx, 0x32
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_StretchBlt]
call rax
mov edx, dword [rbp + 0x9c8]
mov eax, dword [rbp + 0x9cc]
cmp edx, eax
jne 0x401b08
mov eax, dword [rbp + 0x9c8]
xor eax, 0x13371337
cmp eax, 0x133713bd
jle 0x401b08
mov eax, dword [rbp + 0x9cc]
xor eax, 0x13371336
cmp eax, 0x133713c1
jg 0x401b08
mov ecx, dword [rbp + 0x9cc]
mov edx, 0x43b3d5b
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x79
sub ecx, eax
mov eax, ecx
cmp eax, 0x10
jne 0x401b08
lea rax, [rbp - 0x20]
lea rdx, [0x00404020]
mov ecx, 0x9b9
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x9e4], 0x9b9
mov byte [rbp + 0xa03], 0
mov eax, dword [rbp + 0x9c8]
mov dword [rbp + 0x9e0], eax
mov eax, dword [rbp + 0x9cc]
mov dword [rbp + 0x9dc], eax
mov dword [rbp + 0xa04], 0
jmp 0x401a81
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
mov byte [rbp + 0x9db], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
xor al, byte [rbp + 0xa03]
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
xor eax, 0xffffffaf
mov edx, eax
mov eax, dword [rbp + 0xa04]
cdqe
mov byte [rbp + rax - 0x20], dl
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
mov edx, dword [rbp + 0x9dc]
xor eax, edx
xor eax, 0x3c
mov edx, eax
mov eax, dword [rbp + 0xa04]
cdqe
mov byte [rbp + rax - 0x20], dl
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
mov edx, dword [rbp + 0x9e0]
mov ecx, edx
mov edx, dword [rbp + 0xa04]
add ecx, edx
movzx edx, byte [rbp + 0xa03]
add edx, 0x34
xor edx, ecx
add eax, edx
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx edx, byte [rbp + rax - 0x20]
mov eax, dword [rbp + 0x9dc]
mov ecx, eax
movzx eax, byte [rbp + 0xa03]
add eax, ecx
xor eax, edx
xor eax, 0x19
mov edx, eax
mov eax, dword [rbp + 0xa04]
cdqe
mov byte [rbp + rax - 0x20], dl
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
mov edx, dword [rbp + 0x9e0]
xor edx, 0x50
add eax, edx
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
sub eax, 0x34
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
mov edx, dword [rbp + 0xa04]
xor edx, 0xffffffab
sub eax, edx
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
mov ecx, eax
mov eax, dword [rbp + 0xa04]
mov edx, eax
movzx eax, byte [rbp + 0xa03]
add eax, edx
add eax, 0x74
xor eax, ecx
mov edx, eax
mov eax, dword [rbp + 0xa04]
cdqe
mov byte [rbp + rax - 0x20], dl
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
xor al, byte [rbp + 0xa03]
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
sub al, byte [rbp + 0xa03]
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
xor eax, 0xffffffcc
mov edx, eax
mov eax, dword [rbp + 0xa04]
cdqe
mov byte [rbp + rax - 0x20], dl
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
mov edx, dword [rbp + 0xa04]
add eax, edx
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
xor eax, 0xffffffaa
mov edx, eax
mov eax, dword [rbp + 0xa04]
cdqe
mov byte [rbp + rax - 0x20], dl
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
add eax, 0x31
mov edx, dword [rbp + 0xa04]
movsxd rdx, edx
mov byte [rbp + rdx - 0x20], al
mov eax, dword [rbp + 0xa04]
cdqe
movzx eax, byte [rbp + rax - 0x20]
xor eax, 0x44
mov edx, eax
mov eax, dword [rbp + 0xa04]
cdqe
mov byte [rbp + rax - 0x20], dl
movzx eax, byte [rbp + 0x9db]
mov byte [rbp + 0xa03], al
add dword [rbp + 0xa04], 1
mov eax, dword [rbp + 0xa04]
cmp eax, dword [rbp + 0x9e4]
jl 0x40181a
lea rdx, section..rdata
lea rcx, str.flag.txt
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x9d0], rax
cmp qword [rbp + 0x9d0], 0
je 0x401ae7
mov rdx, qword [rbp + 0x9d0]
lea rax, [rbp - 0x20]
mov r9, rdx
mov r8d, 0x9b9
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x9d0]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x9f0]
mov rax, qword [rbp + 0x9f8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
sub dword [rbp + 0xa0c], 1
cmp dword [rbp + 0xa0c], 0
jg 0x40157f
mov eax, 0
add rsp, 0xa98
pop rbx
pop rbp
ret