First, it captures the desktop window and sets the background color to black. It then writes "All your files are encrypted. For more information see “README-FOR-DECRYPT.txt" with DrawText API to a bitmap image and saves it as "encr.bmp" in the public pictures folder. Finally, it changes the desktop wallpaper to the new image using the SystemParametersInfoAPI with the SPI_SETDESKWALLPAPER flag