Function at 0x401afb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp - 0x30], eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp - 0x34], eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp - 0x40], rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
shl eax, 0xd
mov edx, eax
mov eax, dword [rbp - 0x44]
xor eax, edx
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
shl eax, 0x11
xor dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
shl eax, 5
xor eax, dword [rbp - 0x48]
mov edx, 0
div dword [rbp - 0x30]
mov dword [rbp - 0x2c], edx
rdtsc
shl rdx, 0x20
or rax, rdx
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
shl eax, 0xd
mov edx, eax
mov eax, dword [rbp - 0x44]
xor eax, edx
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
shl eax, 0x11
xor dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
shl eax, 5
xor eax, dword [rbp - 0x48]
mov edx, 0
div dword [rbp - 0x34]
mov dword [rbp - 0x28], edx
mov ecx, 0xff
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
mov r8d, 0xffffff
mov edx, 2
mov ecx, 0
mov rax, qword [sym.imp.GDI32.dll_CreatePen]
call rax
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x14], 0
cmp dword [rbp - 0x14], 1
jne 0x401c03
mov ecx, SetBitmapBits
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
jmp 0x401cc4
cmp dword [rbp - 0x14], 2
jne 0x401c20
mov ecx, 0xffff
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
jmp 0x401cc4
cmp dword [rbp - 0x14], 3
jne 0x401c3d
mov ecx, 0xff00
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
jmp 0x401cc4
cmp dword [rbp - 0x14], 4
jne 0x401c57
mov ecx, 0xffff00
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
jmp 0x401cc4
cmp dword [rbp - 0x14], 5
jne 0x401c71
mov ecx, 0xff0000
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
jmp 0x401cc4
cmp dword [rbp - 0x14], 6
jne 0x401c8b
mov ecx, 0xd30094
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
jmp 0x401cc4
cmp dword [rbp - 0x14], 7
jne 0x401ca5
mov ecx, 0xff00ff
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
jmp 0x401cc4
cmp dword [rbp - 0x14], 8
jne 0x401cc4
mov ecx, 0xff
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x14], 0
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov edx, dword [rbp - 0x30]
mov eax, dword [rbp - 0x2c]
cmp edx, eax
jle 0x401d0e
mov edx, dword [rbp - 0x34]
mov eax, dword [rbp - 0x28]
cmp edx, eax
jle 0x401d0e
mov eax, dword [rbp - 0x2c]
test eax, eax
jle 0x401d0e
mov eax, dword [rbp - 0x28]
test eax, eax
jg 0x401d80
rdtsc
shl rdx, 0x20
or rax, rdx
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
shl eax, 0xd
mov edx, eax
mov eax, dword [rbp - 0x44]
xor eax, edx
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
shl eax, 0x11
xor dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
shl eax, 5
xor eax, dword [rbp - 0x48]
mov edx, 0
div dword [rbp - 0x30]
mov dword [rbp - 0x2c], edx
rdtsc
shl rdx, 0x20
or rax, rdx
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
shl eax, 0xd
mov edx, eax
mov eax, dword [rbp - 0x44]
xor eax, edx
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
shl eax, 0x11
xor dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
shl eax, 5
xor eax, dword [rbp - 0x48]
mov edx, 0
div dword [rbp - 0x34]
mov dword [rbp - 0x28], edx
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rbp - 0x58], rax
mov eax, dword [rbp - 0x2c]
sub eax, 0x3c
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x28]
sub eax, 0x3c
mov dword [rbp - 8], eax
mov rax, qword [rbp - 0x58]
and eax, 3
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x2c]
add eax, 0x3c
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0x28]
add eax, 0x3c
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x18], 0xa
mov eax, dword [rbp - 4]
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 0x58]
and eax, 3
test rax, rax
jne 0x401e27
mov r9d, dword [rbp - 4]
mov r8d, dword [rbp - 8]
mov edx, dword [rbp - 0x10]
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp - 0xc]
mov dword [rsp + 0x20], ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_Ellipse]
call rax
add dword [rbp - 0x2c], 0x14
add dword [rbp - 0x10], 0x14
add dword [rbp - 0x24], 0x14
add dword [rbp - 0xc], 0x14
add dword [rbp - 0x28], 0x14
add dword [rbp - 8], 0x14
mov ecx, 0x82
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [rbp - 0x24]
mov dword [rbp - 4], eax
jmp 0x401ee7
cmp dword [rbp - 0x48], 1
jne 0x401e69
mov r9d, dword [rbp - 4]
mov r8d, dword [rbp - 8]
mov edx, dword [rbp - 0x10]
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp - 0xc]
mov dword [rsp + 0x20], ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_Ellipse]
call rax
add dword [rbp - 0x2c], 0x14
add dword [rbp - 0x24], 0x14
add dword [rbp - 0x10], 0x14
sub dword [rbp - 0x28], 0x14
sub dword [rbp - 0xc], 0x14
sub dword [rbp - 8], 0x14
jmp 0x401e0e
cmp dword [rbp - 0x48], 2
jne 0x401eae
mov r9d, dword [rbp - 4]
mov r8d, dword [rbp - 8]
mov edx, dword [rbp - 0x10]
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp - 0xc]
mov dword [rsp + 0x20], ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_Ellipse]
call rax
sub dword [rbp - 0x2c], 0x14
sub dword [rbp - 0x10], 0x14
sub dword [rbp - 0x24], 0x14
add dword [rbp - 0xc], 0x14
add dword [rbp - 0x28], 0x14
add dword [rbp - 8], 0x14
jmp 0x401e0e
cmp dword [rbp - 0x48], 3
jne 0x401ee7
mov r9d, dword [rbp - 4]
mov r8d, dword [rbp - 8]
mov edx, dword [rbp - 0x10]
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp - 0xc]
mov dword [rsp + 0x20], ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_Ellipse]
call rax
sub dword [rbp - 0x2c], 0x14
sub dword [rbp - 0x24], 0x14
sub dword [rbp - 0x10], 0x14
jmp 0x401e5b
sub dword [rbp - 0x18], 1
cmp dword [rbp - 0x18], 0
jne 0x401dc8
add dword [rbp - 0x14], 1
jmp 0x401be6