Function at 0x140088754
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rdi
mov eax, 0x2dc00
call fcn.1400d9c00
sub rsp, rax
mov rax, qword [0x140134040]
xor rax, rsp
mov qword [rsp + 0x2dbf0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Cdgz.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeb8], rax
cmp qword [rsp + 0xeb8], 0xffffffffffffffff
je 0x1400887ca
mov rcx, qword [rsp + 0xeb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2a0], 1
mov edx, 8
lea rcx, [rsp + 0x1e58]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140088822
mov eax, dword [rsp + 0x1e58]
mov dword [rsp + 0x159c], eax
mov eax, dword [rsp + 0x1e5c]
mov dword [rsp + 0x15a0], eax
mov ecx, dword [rsp + 0x2a0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2a0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1818], 0x10
lea rdx, [rsp + 0x1818]
lea rcx, [rsp + 0x6e28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x7ff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
jmp 0x14008886b
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0x400
jae 0x140088894
movsxd rax, dword [rsp + 0x44]
mov al, byte [rsp + rax + 0x7ff0]
inc al
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0x7ff0], al
jmp 0x140088861
lea r9, [rsp + 0x4088]
lea r8, [rsp + 0x4090]
lea rdx, [rsp + 0x1ee8]
lea rcx, [0x14011ec78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x83f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
jmp 0x1400888e1
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x400
jae 0x14008890a
movsxd rax, dword [rsp + 0x48]
mov al, byte [rsp + rax + 0x83f0]
inc al
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0x83f0], al
jmp 0x1400888d7
mov dword [rsp + 0x4f8], 0x2c8b8e9a
lea rdx, [0x14011ec70]
lea rcx, [rsp + 0x54f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x54f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x4f8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x54f8]
call fcn.14000389c
lea rax, [rsp + 0x87f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 0
jmp 0x140088992
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
cmp rax, 0x400
jae 0x1400889bb
movsxd rax, dword [rsp + 0x4c]
mov al, byte [rsp + rax + 0x87f0]
inc al
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x87f0], al
jmp 0x140088988
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x580], rax
cmp qword [rsp + 0x580], 0
je 0x140088a25
lea rax, [rsp + 0x1ef0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ef8]
lea r8, [rsp + 0x1f00]
lea rdx, [rsp + 0x1f08]
mov rcx, qword [rsp + 0x580]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x580]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Y66LDLT.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeb0], rax
cmp qword [rsp + 0xeb0], 0xffffffffffffffff
je 0x140088a7a
mov rcx, qword [rsp + 0xeb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1810], 0x10
lea rdx, [rsp + 0x1810]
lea rcx, [rsp + 0x6e48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x8bf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x140088ac3
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x140088aec
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0x8bf0]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x8bf0], al
jmp 0x140088ab9
mov dword [rsp + 0x2a4], 1
mov edx, 8
lea rcx, [rsp + 0x1e70]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140088b44
mov eax, dword [rsp + 0x1e70]
mov dword [rsp + 0x15a4], eax
mov eax, dword [rsp + 0x1e74]
mov dword [rsp + 0x1598], eax
mov ecx, dword [rsp + 0x2a4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2a4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x500], 0x1369e319
lea rdx, str.HA39iJ0PNW
lea rcx, [rsp + 0x5518]
call fcn.1400038c4
lea rcx, [rsp + 0x5518]
call fcn.14000a750
mov r8d, dword [rsp + 0x500]
mov rdx, rax
lea rcx, [0x14011ecc0]
call fcn.140015614
lea rcx, [rsp + 0x5518]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hrA0RqNXkE.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xea8], rax
cmp qword [rsp + 0xea8], 0xffffffffffffffff
je 0x140088be9
mov rcx, qword [rsp + 0xea8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x570], rax
cmp qword [rsp + 0x570], 0
je 0x140088c53
lea rax, [rsp + 0x1f10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f18]
lea r8, [rsp + 0x1f20]
lea rdx, [rsp + 0x1f28]
mov rcx, qword [rsp + 0x570]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x570]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x538], rax
cmp qword [rsp + 0x538], 0
je 0x140088cbd
lea rax, [rsp + 0x1f30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f38]
lea r8, [rsp + 0x1f40]
lea rdx, [rsp + 0x1f48]
mov rcx, qword [rsp + 0x538]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x538]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.EC.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xea0], rax
cmp qword [rsp + 0xea0], 0xffffffffffffffff
je 0x140088d12
mov rcx, qword [rsp + 0xea0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x8ff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x140088d3a
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x140088d63
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0x8ff0]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0x8ff0], al
jmp 0x140088d30
lea rcx, [rsp + 0x1f50]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x6578]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x520], rax
cmp qword [rsp + 0x520], 0
je 0x140088de9
lea rax, [rsp + 0x1f58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f60]
lea r8, [rsp + 0x1f68]
lea rdx, [rsp + 0x1f70]
mov rcx, qword [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.eK.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe98], rax
cmp qword [rsp + 0xe98], 0xffffffffffffffff
je 0x140088e3e
mov rcx, qword [rsp + 0xe98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2a8], 1
mov edx, 8
lea rcx, [rsp + 0x1ea0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140088e96
mov eax, dword [rsp + 0x1ea0]
mov dword [rsp + 0x15ac], eax
mov eax, dword [rsp + 0x1ea4]
mov dword [rsp + 0x15b0], eax
mov ecx, dword [rsp + 0x2a8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2a8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x6958]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x6968]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x504], 0x294e9711
lea rdx, str.nRdF
lea rcx, [rsp + 0x5538]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5538]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x504]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5538]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x4f0], rax
cmp qword [rsp + 0x4f0], 0
je 0x140088f7c
lea rax, [rsp + 0x1f78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f80]
lea r8, [rsp + 0x1f88]
lea rdx, [rsp + 0x1f90]
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x508], 0x2a07a29e
lea rdx, [0x14011ecf0]
lea rcx, [rsp + 0x5558]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5558]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x508]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5558]
call fcn.14000389c
mov dword [rsp + 0x2ac], 1
mov edx, 8
lea rcx, [rsp + 0x1ea8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140089034
mov eax, dword [rsp + 0x1ea8]
mov dword [rsp + 0x15b4], eax
mov eax, dword [rsp + 0x1eac]
mov dword [rsp + 0x15b8], eax
mov ecx, dword [rsp + 0x2ac]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2ac]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x6978]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x2b0], 1
mov edx, 8
lea rcx, [rsp + 0x1eb0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008909a
mov eax, dword [rsp + 0x1eb0]
mov dword [rsp + 0x15bc], eax
mov eax, dword [rsp + 0x1eb4]
mov dword [rsp + 0x15c0], eax
mov ecx, dword [rsp + 0x2b0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2b0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x50c], 0x16275aea
lea rdx, str.oEktN3UouJ
lea rcx, [rsp + 0x5578]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5578]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x50c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5578]
call fcn.14000389c
mov dword [rsp + 0x1804], 0x10
lea rdx, [rsp + 0x1804]
lea rcx, [rsp + 0x6e68]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x1800], 0x10
lea rdx, [rsp + 0x1800]
lea rcx, [rsp + 0x6e88]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x518], 0x6ccacb1
lea rdx, str.7qDBuUO0A
lea rcx, [rsp + 0x5598]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5598]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x518]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5598]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe60], rax
cmp qword [rsp + 0xe60], 0
je 0x140089206
lea rax, [rsp + 0x1f98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1fa0]
lea r8, [rsp + 0x1fa8]
lea rdx, [rsp + 0x1fb0]
mov rcx, qword [rsp + 0xe60]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.kaaRSgi.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe90], rax
cmp qword [rsp + 0xe90], 0xffffffffffffffff
je 0x14008925b
mov rcx, qword [rsp + 0xe90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x17fc], 0x10
lea rdx, [rsp + 0x17fc]
lea rcx, [rsp + 0x6ea8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x93f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x1400892a4
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x1400892cd
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0x93f0]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0x93f0], al
jmp 0x14008929a
lea r9, [rsp + 0x1fb8]
lea r8, [rsp + 0x1fc0]
lea rdx, [rsp + 0x1fc8]
lea rcx, [0x14011ed20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x528], 0x6c8de85
lea rdx, str.PvgM
lea rcx, [rsp + 0x55b8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x55b8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x528]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x55b8]
call fcn.14000389c
mov dword [rsp + 0x52c], 0x1b01b0ae
lea rdx, [0x14011ed68]
lea rcx, [rsp + 0x55d8]
call fcn.1400038c4
lea rcx, [rsp + 0x55d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x52c]
mov rdx, rax
lea rcx, [0x14011ed60]
call fcn.140015614
lea rcx, [rsp + 0x55d8]
call fcn.14000389c
mov dword [rsp + 0x2b4], 1
mov edx, 8
lea rcx, [rsp + 0x1ec0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400893fa
mov eax, dword [rsp + 0x1ec0]
mov dword [rsp + 0x15c4], eax
mov eax, dword [rsp + 0x1ec4]
mov dword [rsp + 0x15c8], eax
mov ecx, dword [rsp + 0x2b4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2b4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x530], 0x20e80acc
lea rdx, [0x14011ed5c]
lea rcx, [rsp + 0x55f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x55f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x530]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x55f8]
call fcn.14000389c
mov dword [rsp + 0x1808], 0x10
lea rdx, [rsp + 0x1808]
lea rcx, [rsp + 0x6ec8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x540], 0x28e652bf
lea rdx, str.6tyzd
lea rcx, [rsp + 0x5618]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5618]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x540]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5618]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe40], rax
cmp qword [rsp + 0xe40], 0
je 0x140089545
lea rax, [rsp + 0x1fd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1fd8]
lea r8, [rsp + 0x1fe0]
lea rdx, [rsp + 0x1fe8]
mov rcx, qword [rsp + 0xe40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x544], 0x30b765ed
lea rdx, [0x14011ed84]
lea rcx, [rsp + 0x5638]
call fcn.1400038c4
lea rcx, [rsp + 0x5638]
call fcn.14000a750
mov r8d, dword [rsp + 0x544]
mov rdx, rax
lea rcx, [0x14011ed7c]
call fcn.140015614
lea rcx, [rsp + 0x5638]
call fcn.14000389c
lea rax, [rsp + 0x97f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x1400895bd
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x1400895e6
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0x97f0]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0x97f0], al
jmp 0x1400895b3
lea rcx, [rsp + 0x6988]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x548], 0x2523dcf5
lea rdx, str.iFf0b
lea rcx, [rsp + 0x5658]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5658]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x548]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5658]
call fcn.14000389c
lea rax, [rsp + 0x9bf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x14008967c
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x1400896a5
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0x9bf0]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0x9bf0], al
jmp 0x140089672
mov dword [rsp + 0x2b8], 1
mov edx, 8
lea rcx, [rsp + 0x1ec8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400896fd
mov eax, dword [rsp + 0x1ec8]
mov dword [rsp + 0x15cc], eax
mov eax, dword [rsp + 0x1ecc]
mov dword [rsp + 0x15d0], eax
mov ecx, dword [rsp + 0x2b8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2b8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1ff0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x9ff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x140089733
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x14008975c
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0x9ff0]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0x9ff0], al
jmp 0x140089729
lea rax, [rsp + 0xa3f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x140089784
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x1400897ad
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0xa3f0]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0xa3f0], al
jmp 0x14008977a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe30], rax
cmp qword [rsp + 0xe30], 0
je 0x140089817
lea rax, [rsp + 0x1ff8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2000]
lea r8, [rsp + 0x2008]
lea rdx, [rsp + 0x2010]
mov rcx, qword [rsp + 0xe30]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x54c], 0x31232cf5
lea rdx, [0x14011eda8]
lea rcx, [rsp + 0x5678]
call fcn.1400038c4
lea rcx, [rsp + 0x5678]
call fcn.14000a750
mov r8d, dword [rsp + 0x54c]
mov rdx, rax
lea rcx, [0x14011eda0]
call fcn.140015614
lea rcx, [rsp + 0x5678]
call fcn.14000389c
lea r9, [rsp + 0x2018]
lea r8, [rsp + 0x2020]
lea rdx, [rsp + 0x2028]
lea rcx, [0x14011ed98]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xa7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x1400898b4
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x1400898dd
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0xa7f0]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0xa7f0], al
jmp 0x1400898aa
lea r9, [rsp + 0x2030]
lea r8, [rsp + 0x2038]
lea rdx, [rsp + 0x2040]
lea rcx, [0x14011ed90]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe28], rax
cmp qword [rsp + 0xe28], 0
je 0x14008996c
lea rax, [rsp + 0x2048]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2050]
lea r8, [rsp + 0x2058]
lea rdx, [rsp + 0x2060]
mov rcx, qword [rsp + 0xe28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe20], rax
cmp qword [rsp + 0xe20], 0
je 0x1400899d6
lea rax, [rsp + 0x2068]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2070]
lea r8, [rsp + 0x2078]
lea rdx, [rsp + 0x2080]
mov rcx, qword [rsp + 0xe20]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6998]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.3cE5P.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe88], rax
cmp qword [rsp + 0xe88], 0xffffffffffffffff
je 0x140089a39
mov rcx, qword [rsp + 0xe88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x69a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x69b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x550], 0x25d1dc84
lea rdx, str.DPRjEK9
lea rcx, [rsp + 0x5698]
call fcn.1400038c4
lea rcx, [rsp + 0x5698]
call fcn.14000a750
mov r8d, dword [rsp + 0x550]
mov rdx, rax
lea rcx, [0x14011edc4]
call fcn.140015614
lea rcx, [rsp + 0x5698]
call fcn.14000389c
lea rcx, [rsp + 0x2088]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xabf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x140089adb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x140089b04
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0xabf0]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0xabf0], al
jmp 0x140089ad1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.qPROw.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe80], rax
cmp qword [rsp + 0xe80], 0xffffffffffffffff
je 0x140089b59
mov rcx, qword [rsp + 0xe80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x69c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x554], 0x8743a8d
lea rdx, str.2vKurr
lea rcx, [rsp + 0x56b8]
call fcn.1400038c4
lea rcx, [rsp + 0x56b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x554]
mov rdx, rax
lea rcx, [0x14011ee00]
call fcn.140015614
lea rcx, [rsp + 0x56b8]
call fcn.14000389c
lea r9, [rsp + 0x2090]
lea r8, [rsp + 0x2098]
lea rdx, [rsp + 0x20a0]
lea rcx, [0x14011edf8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1a28], 0x10
lea rdx, [rsp + 0x1a28]
lea rcx, [rsp + 0x6ee8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x20a8]
lea r8, [rsp + 0x20b0]
lea rdx, [rsp + 0x20b8]
lea rcx, [0x14011edf0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x69d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Fs3DF0j3h.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe78], rax
cmp qword [rsp + 0xe78], 0xffffffffffffffff
je 0x140089c85
mov rcx, qword [rsp + 0xe78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x69e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x55c], 0x2335d3ec
lea rdx, [0x14011ee20]
lea rcx, [rsp + 0x56d8]
call fcn.1400038c4
lea rcx, [rsp + 0x56d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x55c]
mov rdx, rax
lea rcx, [0x14011ee18]
call fcn.140015614
lea rcx, [rsp + 0x56d8]
call fcn.14000389c
lea rcx, [rsp + 0x69f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1a18], 0x10
lea rdx, [rsp + 0x1a18]
lea rcx, [rsp + 0x6f08]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x2bc], 1
mov edx, 8
lea rcx, [rsp + 0x1a38]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140089d6a
mov eax, dword [rsp + 0x1a38]
mov dword [rsp + 0x15d4], eax
mov eax, dword [rsp + 0x1a3c]
mov dword [rsp + 0x15d8], eax
mov ecx, dword [rsp + 0x2bc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2bc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x6a08]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x564], 0x5c91723
lea rdx, str.vClCql4
lea rcx, [rsp + 0x56f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x56f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x564]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x56f8]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe10], rax
cmp qword [rsp + 0xe10], 0
je 0x140089e42
lea rax, [rsp + 0x20c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20c8]
lea r8, [rsp + 0x20d0]
lea rdx, [rsp + 0x20d8]
mov rcx, qword [rsp + 0xe10]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2c0], 1
mov edx, 8
lea rcx, [rsp + 0x1a40]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140089e9a
mov eax, dword [rsp + 0x1a40]
mov dword [rsp + 0x15dc], eax
mov eax, dword [rsp + 0x1a44]
mov dword [rsp + 0x15e0], eax
mov ecx, dword [rsp + 0x2c0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2c0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x20e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.KhVUxEsL4.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe70], rax
cmp qword [rsp + 0xe70], 0xffffffffffffffff
je 0x140089efd
mov rcx, qword [rsp + 0xe70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x568], 0xf4dc681
lea rdx, str.B2jKHTIMK
lea rcx, [rsp + 0x5718]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5718]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x568]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5718]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe00], rax
cmp qword [rsp + 0xe00], 0
je 0x140089fc7
lea rax, [rsp + 0x20e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20f0]
lea r8, [rsp + 0x20f8]
lea rdx, [rsp + 0x2100]
mov rcx, qword [rsp + 0xe00]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6a18]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x6a28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xaff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x14008a00b
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x14008a034
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0xaff0]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0xaff0], al
jmp 0x14008a001
lea r9, [rsp + 0x2108]
lea r8, [rsp + 0x2110]
lea rdx, [rsp + 0x2118]
lea rcx, [0x14011ee50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x2120]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x2128]
lea r8, [rsp + 0x2130]
lea rdx, [rsp + 0x2138]
lea rcx, [0x14011ee48]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x56c], 0x3ae618ef
lea rdx, str.WPDgzvB
lea rcx, [rsp + 0x5738]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5738]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x56c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5738]
call fcn.14000389c
lea r9, [rsp + 0x2140]
lea r8, [rsp + 0x2148]
lea rdx, [rsp + 0x2150]
lea rcx, [0x14011ee98]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x6a38]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x2158]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x2c4], 1
mov edx, 8
lea rcx, [rsp + 0x1a48]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008a185
mov eax, dword [rsp + 0x1a48]
mov dword [rsp + 0x15e4], eax
mov eax, dword [rsp + 0x1a4c]
mov dword [rsp + 0x15e8], eax
mov ecx, dword [rsp + 0x2c4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2c4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1a10], 0x10
lea rdx, [rsp + 0x1a10]
lea rcx, [rsp + 0x6f28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0xb3f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x14008a1ce
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x14008a1f7
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0xb3f0]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0xb3f0], al
jmp 0x14008a1c4
mov dword [rsp + 0x1a00], 0x10
lea rdx, [rsp + 0x1a00]
lea rcx, [rsp + 0x6f48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x6a48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x19f8], 0x10
lea rdx, [rsp + 0x19f8]
lea rcx, [rsp + 0x6f68]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x2160]
lea r8, [rsp + 0x2168]
lea rdx, [rsp + 0x2170]
lea rcx, [0x14011ee90]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x6a58]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x2178]
lea r8, [rsp + 0x2180]
lea rdx, [rsp + 0x2188]
lea rcx, [0x14011ee88]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x588], 0x319fd776
lea rdx, str.y14fsa1Z2f
lea rcx, [rsp + 0x5758]
call fcn.1400038c4
lea rcx, [rsp + 0x5758]
call fcn.14000a750
mov r8d, dword [rsp + 0x588]
mov rdx, rax
lea rcx, [0x14011eee0]
call fcn.140015614
lea rcx, [rsp + 0x5758]
call fcn.14000389c
mov dword [rsp + 0x19f0], 0x10
lea rdx, [rsp + 0x19f0]
lea rcx, [rsp + 0x6f88]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hEODWvj9eT.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe68], rax
cmp qword [rsp + 0xe68], 0xffffffffffffffff
je 0x14008a365
mov rcx, qword [rsp + 0xe68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6a68]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x2190]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.7PBP.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xec0], rax
cmp qword [rsp + 0xec0], 0xffffffffffffffff
je 0x14008a3d6
mov rcx, qword [rsp + 0xec0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x14011ef18]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xec8], rax
cmp qword [rsp + 0xec8], 0xffffffffffffffff
je 0x14008a42b
mov rcx, qword [rsp + 0xec8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x598], 0x53e8d68
lea rdx, [0x14011ef14]
lea rcx, [rsp + 0x5778]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5778]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x598]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5778]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdf8], rax
cmp qword [rsp + 0xdf8], 0
je 0x14008a4f5
lea rax, [rsp + 0x2198]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21a0]
lea r8, [rsp + 0x21a8]
lea rdx, [rsp + 0x21b0]
mov rcx, qword [rsp + 0xdf8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xde0], rax
cmp qword [rsp + 0xde0], 0
je 0x14008a55f
lea rax, [rsp + 0x21b8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21c0]
lea r8, [rsp + 0x21c8]
lea rdx, [rsp + 0x21d0]
mov rcx, qword [rsp + 0xde0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xde0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2c8], 1
mov edx, 8
lea rcx, [rsp + 0x1a50]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008a5b7
mov eax, dword [rsp + 0x1a50]
mov dword [rsp + 0x15ec], eax
mov eax, dword [rsp + 0x1a54]
mov dword [rsp + 0x15f0], eax
mov ecx, dword [rsp + 0x2c8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2c8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x2cc], 1
mov edx, 8
lea rcx, [rsp + 0x1a58]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008a60f
mov eax, dword [rsp + 0x1a58]
mov dword [rsp + 0x15f4], eax
mov eax, dword [rsp + 0x1a5c]
mov dword [rsp + 0x15f8], eax
mov ecx, dword [rsp + 0x2cc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2cc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.VCyDA.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xed0], rax
cmp qword [rsp + 0xed0], 0xffffffffffffffff
je 0x14008a664
mov rcx, qword [rsp + 0xed0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x19ec], 0x10
lea rdx, [rsp + 0x19ec]
lea rcx, [rsp + 0x6fa8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x19e4], 0x10
lea rdx, [rsp + 0x19e4]
lea rcx, [rsp + 0x6fc8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x21d8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x6a78]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x2d0], 1
mov edx, 8
lea rcx, [rsp + 0x1a60]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008a71a
mov eax, dword [rsp + 0x1a60]
mov dword [rsp + 0x15fc], eax
mov eax, dword [rsp + 0x1a64]
mov dword [rsp + 0x1600], eax
mov ecx, dword [rsp + 0x2d0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2d0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xb7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x14008a742
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x14008a76b
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0xb7f0]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0xb7f0], al
jmp 0x14008a738
lea rcx, [rsp + 0x21e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdd8], rax
cmp qword [rsp + 0xdd8], 0
je 0x14008a7e3
lea rax, [rsp + 0x21e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21f0]
lea r8, [rsp + 0x21f8]
lea rdx, [rsp + 0x2200]
mov rcx, qword [rsp + 0xdd8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2208]
lea r8, [rsp + 0x2210]
lea rdx, [rsp + 0x2218]
lea rcx, [0x14011eef8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x2220]
lea r8, [rsp + 0x2228]
lea rdx, [rsp + 0x2230]
lea rcx, [0x14011ef40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x2238]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x2240]
lea r8, [rsp + 0x2248]
lea rdx, [rsp + 0x2250]
lea rcx, [0x14011ef38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x5b0], 0x4bc664d
lea rdx, [0x14011ef34]
lea rcx, [rsp + 0x4098]
call fcn.1400038c4
lea rcx, [rsp + 0x4098]
call fcn.14000a750
mov r8d, dword [rsp + 0x5b0]
mov rdx, rax
lea rcx, [0x14011ef2c]
call fcn.140015614
lea rcx, [rsp + 0x4098]
call fcn.14000389c
mov dword [rsp + 0x2d4], 1
mov edx, 8
lea rcx, [rsp + 0x1a68]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008a908
mov eax, dword [rsp + 0x1a68]
mov dword [rsp + 0x1604], eax
mov eax, dword [rsp + 0x1a6c]
mov dword [rsp + 0x1608], eax
mov ecx, dword [rsp + 0x2d4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2d4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x2d8], 1
mov edx, 8
lea rcx, [rsp + 0x1a70]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008a960
mov eax, dword [rsp + 0x1a70]
mov dword [rsp + 0x160c], eax
mov eax, dword [rsp + 0x1a74]
mov dword [rsp + 0x1610], eax
mov ecx, dword [rsp + 0x2d8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2d8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xbbf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x14008a991
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x14008a9c3
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0xbbf0]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0xbbf0], al
jmp 0x14008a981
lea rax, [rsp + 0xbff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x14008a9f4
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x14008aa26
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0xbff0]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0xbff0], al
jmp 0x14008a9e4
lea rcx, [rsp + 0x6a88]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xc3f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0
jmp 0x14008aa65
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
movsxd rax, dword [rsp + 0x88]
cmp rax, 0x400
jae 0x14008aa97
movsxd rax, dword [rsp + 0x88]
mov al, byte [rsp + rax + 0xc3f0]
inc al
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0xc3f0], al
jmp 0x14008aa55
lea rcx, [rsp + 0x6a98]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x6aa8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5b4], 0x1519b67e
lea rdx, str.zc82R9mR
lea rcx, [rsp + 0x57b8]
call fcn.1400038c4
lea rcx, [rsp + 0x57b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x5b4]
mov rdx, rax
lea rcx, [0x14011ef60]
call fcn.140015614
lea rcx, [rsp + 0x57b8]
call fcn.14000389c
lea rcx, [rsp + 0x6ab8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xc7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x8c], 0
jmp 0x14008ab42
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
movsxd rax, dword [rsp + 0x8c]
cmp rax, 0x400
jae 0x14008ab74
movsxd rax, dword [rsp + 0x8c]
mov al, byte [rsp + rax + 0xc7f0]
inc al
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0xc7f0], al
jmp 0x14008ab32
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdd0], rax
cmp qword [rsp + 0xdd0], 0
je 0x14008abde
lea rax, [rsp + 0x2258]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2260]
lea r8, [rsp + 0x2268]
lea rdx, [rsp + 0x2270]
mov rcx, qword [rsp + 0xdd0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x19dc], 0x10
lea rdx, [rsp + 0x19dc]
lea rcx, [rsp + 0x6fe8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdc0], rax
cmp qword [rsp + 0xdc0], 0
je 0x14008ac69
lea rax, [rsp + 0x2278]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2280]
lea r8, [rsp + 0x2288]
lea rdx, [rsp + 0x2290]
mov rcx, qword [rsp + 0xdc0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2298]
lea r8, [rsp + 0x22a0]
lea rdx, [rsp + 0x22a8]
lea rcx, [0x14011ef58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x5c0], 0xfe6e75c
lea rdx, str.f6fIefRfF
lea rcx, [rsp + 0x57d8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x57d8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x5c0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x57d8]
call fcn.14000389c
lea rcx, [rsp + 0x22b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x6ac8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x6ad8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x14011ef88]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xed8], rax
cmp qword [rsp + 0xed8], 0xffffffffffffffff
je 0x14008ad6d
mov rcx, qword [rsp + 0xed8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xcbf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
jmp 0x14008ad9e
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 0x400
jae 0x14008add0
movsxd rax, dword [rsp + 0x90]
mov al, byte [rsp + rax + 0xcbf0]
inc al
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0xcbf0], al
jmp 0x14008ad8e
lea rcx, [rsp + 0x6ae8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5c4], 0x297814f
lea rdx, [0x14011ef80]
lea rcx, [rsp + 0x57f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x57f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x5c4]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x57f8]
call fcn.14000389c
mov dword [rsp + 0x5c8], 0x26ed2f94
lea rdx, [0x14011ef7c]
lea rcx, [rsp + 0x5818]
call fcn.1400038c4
lea rcx, [rsp + 0x5818]
call fcn.14000a750
mov r8d, dword [rsp + 0x5c8]
mov rdx, rax
lea rcx, [0x14011ef74]
call fcn.140015614
lea rcx, [rsp + 0x5818]
call fcn.14000389c
lea rcx, [rsp + 0x6af8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x19d4], 0x10
lea rdx, [rsp + 0x19d4]
lea rcx, [rsp + 0x7008]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x6b08]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5d8], 0x1ac95a60
lea rdx, str.eBjUA
lea rcx, [rsp + 0x5838]
call fcn.1400038c4
lea rcx, [rsp + 0x5838]
call fcn.14000a750
mov r8d, dword [rsp + 0x5d8]
mov rdx, rax
lea rcx, [0x14011efac]
call fcn.140015614
lea rcx, [rsp + 0x5838]
call fcn.14000389c
lea rcx, [rsp + 0x6b18]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5dc], 0x1fc5c25e
lea rdx, str.SyYWV1G4m
lea rcx, [rsp + 0x5858]
call fcn.1400038c4
lea rcx, [rsp + 0x5858]
call fcn.14000a750
mov r8d, dword [rsp + 0x5dc]
mov rdx, rax
lea rcx, [0x14011ef94]
call fcn.140015614
lea rcx, [rsp + 0x5858]
call fcn.14000389c
mov dword [rsp + 0x19d0], 0x10
lea rdx, [rsp + 0x19d0]
lea rcx, [rsp + 0x7028]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x6b28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x2dc], 1
mov edx, 8
lea rcx, [rsp + 0x1a78]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008b000
mov eax, dword [rsp + 0x1a78]
mov dword [rsp + 0x1614], eax
mov eax, dword [rsp + 0x1a7c]
mov dword [rsp + 0x1618], eax
mov ecx, dword [rsp + 0x2dc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2dc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x19cc], 0x10
lea rdx, [rsp + 0x19cc]
lea rcx, [rsp + 0x7048]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0xcff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x94], 0
jmp 0x14008b052
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
cmp rax, 0x400
jae 0x14008b084
movsxd rax, dword [rsp + 0x94]
mov al, byte [rsp + rax + 0xcff0]
inc al
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0xcff0], al
jmp 0x14008b042
mov dword [rsp + 0x5f0], 0x2fd5e23c
lea rdx, str.WXxW69
lea rcx, [rsp + 0x5878]
call fcn.1400038c4
lea rcx, [rsp + 0x5878]
call fcn.14000a750
mov r8d, dword [rsp + 0x5f0]
mov rdx, rax
lea rcx, [0x14011efd0]
call fcn.140015614
lea rcx, [rsp + 0x5878]
call fcn.14000389c
mov dword [rsp + 0x2e0], 1
mov edx, 8
lea rcx, [rsp + 0x1a80]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008b12c
mov eax, dword [rsp + 0x1a80]
mov dword [rsp + 0x161c], eax
mov eax, dword [rsp + 0x1a84]
mov dword [rsp + 0x1620], eax
mov ecx, dword [rsp + 0x2e0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2e0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x22b8]
lea r8, [rsp + 0x22c0]
lea rdx, [rsp + 0x22c8]
lea rcx, [0x14011efc8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x5f4], 0xceafd5f
lea rdx, str.1p9A
lea rcx, [rsp + 0x5898]
call fcn.1400038c4
lea rcx, [rsp + 0x5898]
call fcn.14000a750
mov r8d, dword [rsp + 0x5f4]
mov rdx, rax
lea rcx, [0x14011f00c]
call fcn.140015614
lea rcx, [rsp + 0x5898]
call fcn.14000389c
lea rcx, [rsp + 0x6b38]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x2e4], 1
mov edx, 8
lea rcx, [rsp + 0x1a88]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008b207
mov eax, dword [rsp + 0x1a88]
mov dword [rsp + 0x1624], eax
mov eax, dword [rsp + 0x1a8c]
mov dword [rsp + 0x1628], eax
mov ecx, dword [rsp + 0x2e4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2e4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x6b48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5f8], 0x1775f14c
lea rdx, [0x14011f008]
lea rcx, [rsp + 0x58b8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x58b8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x5f8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x58b8]
call fcn.14000389c
lea r9, [rsp + 0x22d0]
lea r8, [rsp + 0x22d8]
lea rdx, [rsp + 0x22e0]
lea rcx, [0x14011f000]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.3i7hOzHS.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xee0], rax
cmp qword [rsp + 0xee0], 0xffffffffffffffff
je 0x14008b2ef
mov rcx, qword [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xd3f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0
jmp 0x14008b320
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
movsxd rax, dword [rsp + 0x98]
cmp rax, 0x400
jae 0x14008b352
movsxd rax, dword [rsp + 0x98]
mov al, byte [rsp + rax + 0xd3f0]
inc al
movsxd rcx, dword [rsp + 0x98]
mov byte [rsp + rcx + 0xd3f0], al
jmp 0x14008b310
lea rcx, [rsp + 0x22e8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x5fc], 0x3132b74b
lea rdx, str.hQ4wD3
lea rcx, [rsp + 0x58d8]
call fcn.1400038c4
lea rcx, [rsp + 0x58d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x5fc]
mov rdx, rax
lea rcx, [0x14011f030]
call fcn.140015614
lea rcx, [rsp + 0x58d8]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xda0], rax
cmp qword [rsp + 0xda0], 0
je 0x14008b41a
lea rax, [rsp + 0x22f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x22f8]
lea r8, [rsp + 0x2300]
lea rdx, [rsp + 0x2308]
mov rcx, qword [rsp + 0xda0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xda0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xd7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x9c], 0
jmp 0x14008b44b
mov eax, dword [rsp + 0x9c]
inc eax
mov dword [rsp + 0x9c], eax
movsxd rax, dword [rsp + 0x9c]
cmp rax, 0x400
jae 0x14008b47d
movsxd rax, dword [rsp + 0x9c]
mov al, byte [rsp + rax + 0xd7f0]
inc al
movsxd rcx, dword [rsp + 0x9c]
mov byte [rsp + rcx + 0xd7f0], al
jmp 0x14008b43b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd88], rax
cmp qword [rsp + 0xd88], 0
je 0x14008b4e7
lea rax, [rsp + 0x2310]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2318]
lea r8, [rsp + 0x2320]
lea rdx, [rsp + 0x2328]
mov rcx, qword [rsp + 0xd88]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2330]
lea r8, [rsp + 0x2338]
lea rdx, [rsp + 0x2340]
lea rcx, [0x14011f028]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x6b58]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x2e8], 1
mov edx, 8
lea rcx, [rsp + 0x1a90]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008b572
mov eax, dword [rsp + 0x1a90]
mov dword [rsp + 0x162c], eax
mov eax, dword [rsp + 0x1a94]
mov dword [rsp + 0x1630], eax
mov ecx, dword [rsp + 0x2e8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2e8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x14011f018]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xee8], rax
cmp qword [rsp + 0xee8], 0xffffffffffffffff
je 0x14008b5c7
mov rcx, qword [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x600], 0x3b1470f1
lea rdx, str.jFd2uuPvtz
lea rcx, [rsp + 0x58f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x58f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x600]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x58f8]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.UP2PE.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xef0], rax
cmp qword [rsp + 0xef0], 0xffffffffffffffff
je 0x14008b67c
mov rcx, qword [rsp + 0xef0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6b68]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.FpDMyAvs.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xef8], rax
cmp qword [rsp + 0xef8], 0xffffffffffffffff
je 0x14008b6df
mov rcx, qword [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x604], 0x168c7b78
lea rdx, str.C65Ydwkrt
lea rcx, [rsp + 0x5918]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5918]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x604]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5918]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd78], rax
cmp qword [rsp + 0xd78], 0
je 0x14008b7a9
lea rax, [rsp + 0x2348]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2350]
lea r8, [rsp + 0x2358]
lea rdx, [rsp + 0x2360]
mov rcx, qword [rsp + 0xd78]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x608], 0x26563f8a
lea rdx, str.snMRp4YAmP
lea rcx, [rsp + 0x5938]
call fcn.1400038c4
lea rcx, [rsp + 0x5938]
call fcn.14000a750
mov r8d, dword [rsp + 0x608]
mov rdx, rax
lea rcx, [0x14011f0b0]
call fcn.140015614
lea rcx, [rsp + 0x5938]
call fcn.14000389c
lea rcx, [rsp + 0x6b78]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x2368]
lea r8, [rsp + 0x2370]
lea rdx, [rsp + 0x2378]
lea rcx, [0x14011f0a8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x2380]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x60c], 0x1b64bf0b
lea rdx, str.9CSZWutJ3r
lea rcx, [rsp + 0x5958]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5958]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x60c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5958]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd70], rax
cmp qword [rsp + 0xd70], 0
je 0x14008b904
lea rax, [rsp + 0x2388]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2390]
lea r8, [rsp + 0x2398]
lea rdx, [rsp + 0x23a0]
mov rcx, qword [rsp + 0xd70]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x610], 0x9a8d064
lea rdx, str.IKzkRT8jIH
lea rcx, [rsp + 0x5978]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5978]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x610]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5978]
call fcn.14000389c
mov dword [rsp + 0x614], 0x16b01195
lea rdx, [0x14011f0d0]
lea rcx, [rsp + 0x5998]
call fcn.1400038c4
lea rcx, [rsp + 0x5998]
call fcn.14000a750
mov r8d, dword [rsp + 0x614]
mov rdx, rax
lea rcx, [0x14011f0c8]
call fcn.140015614
lea rcx, [rsp + 0x5998]
call fcn.14000389c
mov dword [rsp + 0x2ec], 1
mov edx, 8
lea rcx, [rsp + 0x1a98]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008ba0c
mov eax, dword [rsp + 0x1a98]
mov dword [rsp + 0x1634], eax
mov eax, dword [rsp + 0x1a9c]
mov dword [rsp + 0x1638], eax
mov ecx, dword [rsp + 0x2ec]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2ec]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x2f0], 1
mov edx, 8
lea rcx, [rsp + 0x1aa0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008ba64
mov eax, dword [rsp + 0x1aa0]
mov dword [rsp + 0x163c], eax
mov eax, dword [rsp + 0x1aa4]
mov dword [rsp + 0x1640], eax
mov ecx, dword [rsp + 0x2f0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2f0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x23a8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x6b88]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xdbf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
jmp 0x14008bab1
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
cmp rax, 0x400
jae 0x14008bae3
movsxd rax, dword [rsp + 0xa0]
mov al, byte [rsp + rax + 0xdbf0]
inc al
movsxd rcx, dword [rsp + 0xa0]
mov byte [rsp + rcx + 0xdbf0], al
jmp 0x14008baa1
mov dword [rsp + 0x2f4], 1
mov edx, 8
lea rcx, [rsp + 0x1aa8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008bb3b
mov eax, dword [rsp + 0x1aa8]
mov dword [rsp + 0x1644], eax
mov eax, dword [rsp + 0x1aac]
mov dword [rsp + 0x1648], eax
mov ecx, dword [rsp + 0x2f4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2f4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd68], rax
cmp qword [rsp + 0xd68], 0
je 0x14008bba5
lea rax, [rsp + 0x23b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x23b8]
lea r8, [rsp + 0x23c0]
lea rdx, [rsp + 0x23c8]
mov rcx, qword [rsp + 0xd68]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6b98]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x23d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xdff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa4], 0
jmp 0x14008bbf2
mov eax, dword [rsp + 0xa4]
inc eax
mov dword [rsp + 0xa4], eax
movsxd rax, dword [rsp + 0xa4]
cmp rax, 0x400
jae 0x14008bc24
movsxd rax, dword [rsp + 0xa4]
mov al, byte [rsp + rax + 0xdff0]
inc al
movsxd rcx, dword [rsp + 0xa4]
mov byte [rsp + rcx + 0xdff0], al
jmp 0x14008bbe2
mov dword [rsp + 0x618], 0x161242f0
lea rdx, [0x14011f0c4]
lea rcx, [rsp + 0x59b8]
call fcn.1400038c4
lea rcx, [rsp + 0x59b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x618]
mov rdx, rax
lea rcx, [0x14011f118]
call fcn.140015614
lea rcx, [rsp + 0x59b8]
call fcn.14000389c
mov dword [rsp + 0x2f8], 1
mov edx, 8
lea rcx, [rsp + 0x1ab0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008bccc
mov eax, dword [rsp + 0x1ab0]
mov dword [rsp + 0x164c], eax
mov eax, dword [rsp + 0x1ab4]
mov dword [rsp + 0x1650], eax
mov ecx, dword [rsp + 0x2f8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2f8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x2fc], 1
mov edx, 8
lea rcx, [rsp + 0x1ab8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008bd24
mov eax, dword [rsp + 0x1ab8]
mov dword [rsp + 0x1654], eax
mov eax, dword [rsp + 0x1abc]
mov dword [rsp + 0x1658], eax
mov ecx, dword [rsp + 0x2fc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2fc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xe3f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa8], 0
jmp 0x14008bd55
mov eax, dword [rsp + 0xa8]
inc eax
mov dword [rsp + 0xa8], eax
movsxd rax, dword [rsp + 0xa8]
cmp rax, 0x400
jae 0x14008bd87
movsxd rax, dword [rsp + 0xa8]
mov al, byte [rsp + rax + 0xe3f0]
inc al
movsxd rcx, dword [rsp + 0xa8]
mov byte [rsp + rcx + 0xe3f0], al
jmp 0x14008bd45
mov dword [rsp + 0x300], 1
mov edx, 8
lea rcx, [rsp + 0x1ac0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008bddf
mov eax, dword [rsp + 0x1ac0]
mov dword [rsp + 0x165c], eax
mov eax, dword [rsp + 0x1ac4]
mov dword [rsp + 0x1660], eax
mov ecx, dword [rsp + 0x300]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x300]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x6ba8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x6bb8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x23d8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xe7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xac], 0
jmp 0x14008be3a
mov eax, dword [rsp + 0xac]
inc eax
mov dword [rsp + 0xac], eax
movsxd rax, dword [rsp + 0xac]
cmp rax, 0x400
jae 0x14008be6c
movsxd rax, dword [rsp + 0xac]
mov al, byte [rsp + rax + 0xe7f0]
inc al
movsxd rcx, dword [rsp + 0xac]
mov byte [rsp + rcx + 0xe7f0], al
jmp 0x14008be2a
lea rax, [rsp + 0xebf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xb0], 0
jmp 0x14008be9d
mov eax, dword [rsp + 0xb0]
inc eax
mov dword [rsp + 0xb0], eax
movsxd rax, dword [rsp + 0xb0]
cmp rax, 0x400
jae 0x14008becf
movsxd rax, dword [rsp + 0xb0]
mov al, byte [rsp + rax + 0xebf0]
inc al
movsxd rcx, dword [rsp + 0xb0]
mov byte [rsp + rcx + 0xebf0], al
jmp 0x14008be8d
lea r9, [rsp + 0x23e0]
lea r8, [rsp + 0x23e8]
lea rdx, [rsp + 0x23f0]
lea rcx, [0x14011f110]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Eyjg5YD9.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf00], rax
cmp qword [rsp + 0xf00], 0xffffffffffffffff
je 0x14008bf49
mov rcx, qword [rsp + 0xf00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x23f8]
lea r8, [rsp + 0x2400]
lea rdx, [rsp + 0x2408]
lea rcx, [0x14011f0e8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x19c8], 0x10
lea rdx, [rsp + 0x19c8]
lea rcx, [rsp + 0x7068]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x628], 0x28436e9f
lea rdx, str.Dsy3VbO2
lea rcx, [rsp + 0x59d8]
call fcn.1400038c4
lea rcx, [rsp + 0x59d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x628]
mov rdx, rax
lea rcx, [0x14011f130]
call fcn.140015614
lea rcx, [rsp + 0x59d8]
call fcn.14000389c
mov dword [rsp + 0x62c], 0xcf5bb66
lea rdx, str.RQg3WF
lea rcx, [rsp + 0x59f8]
call fcn.1400038c4
lea rcx, [rsp + 0x59f8]
call fcn.14000a750
mov r8d, dword [rsp + 0x62c]
mov rdx, rax
lea rcx, [0x14011f120]
call fcn.140015614
lea rcx, [rsp + 0x59f8]
call fcn.14000389c
mov dword [rsp + 0x304], 1
mov edx, 8
lea rcx, [rsp + 0x1ac8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008c087
mov eax, dword [rsp + 0x1ac8]
mov dword [rsp + 0x1664], eax
mov eax, dword [rsp + 0x1acc]
mov dword [rsp + 0x1668], eax
mov ecx, dword [rsp + 0x304]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x304]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x630], 0x229a1ab4
lea rdx, str.8wxNmx04SF
lea rcx, [rsp + 0x5a18]
call fcn.1400038c4
lea rcx, [rsp + 0x5a18]
call fcn.14000a750
mov r8d, dword [rsp + 0x630]
mov rdx, rax
lea rcx, [0x14011f15c]
call fcn.140015614
lea rcx, [rsp + 0x5a18]
call fcn.14000389c
mov dword [rsp + 0x634], 0x13d7fbb5
lea rdx, str.LAawn1XTme
lea rcx, [rsp + 0x5a38]
call fcn.1400038c4
lea rcx, [rsp + 0x5a38]
call fcn.14000a750
mov r8d, dword [rsp + 0x634]
mov rdx, rax
lea rcx, [0x14011f144]
call fcn.140015614
lea rcx, [rsp + 0x5a38]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.mR8cY.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf08], rax
cmp qword [rsp + 0xf08], 0xffffffffffffffff
je 0x14008c17c
mov rcx, qword [rsp + 0xf08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd58], rax
cmp qword [rsp + 0xd58], 0
je 0x14008c1e6
lea rax, [rsp + 0x2410]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2418]
lea r8, [rsp + 0x2420]
lea rdx, [rsp + 0x2428]
mov rcx, qword [rsp + 0xd58]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x638], 0x2a6af5c6
lea rdx, str.BoKl2
lea rcx, [rsp + 0x5a58]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5a58]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x638]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5a58]
call fcn.14000389c
lea rcx, [rsp + 0x6bc8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x19c0], 0x10
lea rdx, [rsp + 0x19c0]
lea rcx, [rsp + 0x7088]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x308], 1
mov edx, 8
lea rcx, [rsp + 0x1ad0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008c2cd
mov eax, dword [rsp + 0x1ad0]
mov dword [rsp + 0x166c], eax
mov eax, dword [rsp + 0x1ad4]
mov dword [rsp + 0x1670], eax
mov ecx, dword [rsp + 0x308]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x308]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x648], 0x2eb9a88
lea rdx, str.KGebie
lea rcx, [rsp + 0x40b8]
call fcn.1400038c4
lea rcx, [rsp + 0x40b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x648]
mov rdx, rax
lea rcx, [0x14011f174]
call fcn.140015614
lea rcx, [rsp + 0x40b8]
call fcn.14000389c
mov dword [rsp + 0x64c], 0x3eec276
lea rdx, str.SMv1wvl5
lea rcx, [rsp + 0x40d8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x40d8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x64c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x40d8]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.1E.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf10], rax
cmp qword [rsp + 0xf10], 0xffffffffffffffff
je 0x14008c3d2
mov rcx, qword [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2430]
lea r8, [rsp + 0x2438]
lea rdx, [rsp + 0x2440]
lea rcx, [0x14011f1b0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x650], 0x1c867c05
lea rdx, str.jYUo
lea rcx, [rsp + 0x40f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x40f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x650]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x40f8]
call fcn.14000389c
mov dword [rsp + 0x19b0], 0x10
lea rdx, [rsp + 0x19b0]
lea rcx, [rsp + 0x70a8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0xeff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xb4], 0
jmp 0x14008c4a9