Function at 0x1000876e
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push 0x488
mov eax, 0x1003cb1e
call fcn.1001d244
mov dword [ebp - 0x494], ecx
push str.DE2wr60O
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2e9f207a
cmova eax, dword [ebp - 0x28]
mov ebx, str._s:__d
push eax
push ebx
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0x10047710
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2822011
cmova eax, dword [ebp - 0x28]
push eax
push ebx
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.hKLPt
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x9a5b16e
cmova eax, dword [ebp - 0x28]
push eax
push ebx
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test edi, edi
je 0x1000885b
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x460]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x454], 0x10
push eax
call ebx
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.ZC5HT.txt
call edi
cmp eax, 0xffffffff
je 0x100088b6
push eax
call esi
push str.AKIAupKvN
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1a5a4f0c
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call ebx
push 0x1004773c
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x313d4f1b
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
mov ebx, dword [ebp - 0x494]
push ecx
push ecx
mov ecx, esp
lea eax, [ebx + 0xc]
push eax
mov dword [ebp - 0x464], eax
call fcn.100014c2
mov edx, ebx
lea ecx, [ebp - 0x458]
call fcn.100187c2
pop ecx
pop ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [ebx + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [ebx + 8], edx
test ecx, ecx
je 0x10008986
call fcn.10001270
mov ecx, dword [ebp - 0x454]
test ecx, ecx
je 0x10008995
call fcn.10001270
push 8
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov ebx, dword [sym.imp.WINMM.dll_timeBeginPeriod]
test eax, eax
jne 0x100089ba
push 1
call ebx
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.7GLD2j6Z4
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x11fbbd70
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0x10
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x10008a51
push 1
call ebx
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.OkvWj
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2f8faf17
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea ecx, [ebp - 0x28]
push str.rUluUAP9C5
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x22226895
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x494]
cmp dword [eax + 4], 0
je 0x100090a1
push 0x10047768
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0xba1b191
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x10047184
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1c15ff0a
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.eoPp
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x31dcab2a
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x454], eax
test eax, eax
je 0x10008c66
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [ebp - 0x478]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x454]
call esi
push 0x10047190
lea ecx, [ebp - 0x28]
call fcn.10001fd7
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push 0x18cd59ce
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x10047194
call edi
cmp eax, 0xffffffff
je 0x10008cc4
push eax
call esi
push 0x100471b0
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1df9a580
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push ecx
push ecx
mov ecx, esp
push dword [ebp - 0x464]
call fcn.100014c2
mov eax, dword [ebp - 0x494]
mov ecx, dword [eax + 4]
call fcn.10018572
test al, al
je 0x100090a1
push str.KGf04CN
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1b443342
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.x0dJA4N
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x287206
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x464]
mov dword [ebp - 0x464], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x400
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0x100471c4
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2158abd1
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 8
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x10008e16
push 1
call ebx
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
call ebx
lea eax, [ebp - 0x18]
push eax
call ebx
push str.aNm88Z4Itd
lea ecx, [ebp - 0x28]
call fcn.10001fd7
mov ebx, 0x10051b50
mov dword [ebp - 4], 1
push 0x279bf6a7
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x460]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x100471d4
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x2a75e9a0
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
mov ecx, ebx
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10002037
mov eax, dword [ebp - 0x494]
mov ecx, dword [eax + 4]
call fcn.10018714
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10008f0f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x470]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push ebx
call esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.Mu.txt
call edi
cmp eax, 0xffffffff
je 0x10008f30
push eax
call esi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.TtgBE677.txt
call edi
cmp eax, 0xffffffff
je 0x10008f4f
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x464], 0x10
push eax
call ebx
push str.mDht
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x5e126e1
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 3
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x464]
mov dword [ebp - 0x464], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call ebx
push str.nOHtCmB5
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1759faaa
cmova eax, dword [ebp - 0x28]
mov ebx, str._s:__d
push eax
push ebx
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.9BtFTA
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x35e9c376
cmova eax, dword [ebp - 0x28]
push eax
push ebx
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, 0x400
lea eax, [ebp - 0x450]
push ebx
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10009080
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push ebx
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.1CJ2.txt
call edi
cmp eax, 0xffffffff
je 0x100090a1
push eax
call esi
call fcn.1001d1f3
ret