Function at 0x14002df48
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x558]
sub rsp, 0x630
mov rax, qword [0x140077100]
xor rax, rsp
mov qword [rbp + 0x520], rax
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov esi, 0x400
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edi, edi
test rax, rax
je 0x14002dff7
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 4
lea rdx, str.kCRp
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
mov r14d, 0xf
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x297832db
lea rcx, str._s:__d
call fcn.1400184d4
mov r15d, 0x1000
lea r12d, [r14 + 0x18]
lea r13d, [r14 + 0x10]
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e09b
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e096
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f603
call fcn.140034bfc
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x120]
call fcn.140059690
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea esi, [r9 + 1]
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.Ttb.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002e106
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8d, 2
lea rdx, [0x140060288]
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x65a1bff
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e1be
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e1b9
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f609
call fcn.140034bfc
lea rcx, [rbp + 0x100]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8d, 9
lea rdx, str.m1WAHLuli
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x17b33b76
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e276
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e271
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f60f
call fcn.140034bfc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002e2c1
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x100]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 9
lea rdx, str.09MzTIkJw
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x11509334
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e35e
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e359
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f615
call fcn.140034bfc
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002e3c7
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14002b3a4
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8, rsi
lea rdx, [0x1400602ac]
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x1ddd42d1
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e459
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e454
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f61b
call fcn.140034bfc
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov ebx, 3
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, [0x1400602b0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002e4a3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 7
lea rdx, str.J9kvMcD
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x10d02c56
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e551
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e54c
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f621
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8d, 7
lea rdx, str.cQullrV
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0xfbb24da
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e5fc
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e5f7
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f627
call fcn.140034bfc
lea rcx, [rbp + 0x100]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.GisRk.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002e641
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.Wbrd.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002e679
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8, rbx
lea rdx, [0x140060304]
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x372b5519
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e706
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e701
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f62d
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8, rbx
lea rdx, [0x140060308]
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x1a6fc020
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e7ae
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e7a9
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f633
call fcn.140034bfc
mov edx, 8
lea rcx, [rbp + 0x100]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002e7d4
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ebx, 0x400
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x120]
call fcn.140059690
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x120]
call fcn.140059690
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x40], 0x10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call fcn.140028b78
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002e8a8
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 2
lea rdx, [0x14006030c]
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x1747e299
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e945
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e940
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f639
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8d, 7
lea rdx, str.rt98wE8
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x2ba1a2ae
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002e9f0
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002e9eb
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f63f
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 4
lea rdx, str.uRi7
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x1272d730
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002ea80
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002ea7b
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f645
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov ebx, 6
mov r8d, ebx
lea rdx, str.hS3ukx
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x271aac5f
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002eb12
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002eb0d
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f64b
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8d, 0xa
lea rdx, str.wc361Fvltj
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x1b0c3693
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002ebbd
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002ebb8
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f651
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8, rbx
lea rdx, str.FUts8o
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x2befc20b
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002ec65
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002ec60
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f657
call fcn.140034bfc
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.6Q92p8Ln.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002eca1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 8
mov edx, ebx
lea rcx, [rbp + 0x100]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002ecc9
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8d, 5
lea rdx, str.wDEII
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x15f78449
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002ed74
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002ed6f
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f65d
call fcn.140034bfc
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x120]
call fcn.140059690
mov edx, ebx
lea rcx, [rbp + 0x100]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002edab
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.jU2w3nAhJ5.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002ede7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0x10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002ee4c
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.9w.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002ee88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000ab3c
test al, al
je 0x14002f5cd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002eee0
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, 0x400
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x120]
call fcn.140059690
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.LnpTLMXorX.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002ef3f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x100]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002ef65
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x120]
call fcn.140059690
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002efbe
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002f027
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 8
mov edx, ebx
lea rcx, [rbp + 0x100]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002f04f
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 6
lea rdx, str.FS07R7
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x35c379b
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002f0fd
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002f0f8
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f663
call fcn.140034bfc
mov dword [rsp + 0x40], 0x10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.RiEprFaoKG.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002f153
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0x10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.140024364
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x120]
call fcn.140059690
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8d, 4
lea rdx, str.Kuoy
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x344fcb62
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002f269
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002f264
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f669
call fcn.140034bfc
mov edx, ebx
lea rcx, [rbp + 0x100]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002f28c
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 3
lea rdx, [0x1400603e8]
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x129b245b
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002f31c
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002f317
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f66f
call fcn.140034bfc
mov dword [rsp + 0x40], 0x10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x100]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, ebx
lea rcx, [rbp + 0x100]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002f373
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8d, 7
lea rdx, str.oxU5J1m
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x208a3945
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002f41e
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002f419
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f675
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov r8, rsi
lea rdx, [0x1400602ac]
lea rcx, [rbp + 0x100]
call fcn.14000192c
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x31f8f3ad
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002f4c6
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002f4c1
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f67b
call fcn.140034bfc
mov ebx, 0x10
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x100]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
lea r8d, [rbx - 6]
lea rdx, str.dTTtQ1ZQEY
lea rcx, [rbp + 0x100]
call fcn.14000192c
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], r14
cmova rdx, qword [rbp + 0x100]
mov r8d, 0x34c7aff1
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x118]
cmp rdx, r14
jbe 0x14002f5bd
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, r15
jb 0x14002f5b8
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14002f5fd
call fcn.140034bfc
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov al, sil
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.140034ca0
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3