Function at 0x140064dc4
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rdi
mov eax, 0x1f000
call fcn.1400b6760
sub rsp, rax
mov rax, qword [0x14010c080]
xor rax, rsp
mov qword [rsp + 0x1eff0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.s.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xac8], rax
cmp qword [rsp + 0xac8], 0xffffffffffffffff
je 0x140064e3a
mov rcx, qword [rsp + 0xac8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1710]
lea r8, [rsp + 0x1718]
lea rdx, [rsp + 0x1720]
lea rcx, [0x1400ef118]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xab8], rax
cmp qword [rsp + 0xab8], 0
je 0x140064ec9
lea rax, [rsp + 0x1728]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1730]
lea r8, [rsp + 0x1738]
lea rdx, [rsp + 0x1740]
mov rcx, qword [rsp + 0xab8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xab8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.DmIBVK2l.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xad0], rax
cmp qword [rsp + 0xad0], 0xffffffffffffffff
je 0x140064f1e
mov rcx, qword [rsp + 0xad0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.5gMkdv.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xad8], rax
cmp qword [rsp + 0xad8], 0xffffffffffffffff
je 0x140064f73
mov rcx, qword [rsp + 0xad8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x374], 0xe3bb70b
lea rdx, [0x1400ef1a0]
lea rcx, [rsp + 0x4168]
call fcn.140003708
nop
lea rdx, [rsp + 0x4168]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x374]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4168]
call fcn.1400040f0
mov dword [rsp + 0x378], 0x2fd79bb4
lea rdx, str.TDQpLpb4xq
lea rcx, [rsp + 0x4188]
call fcn.140003708
nop
lea rdx, [rsp + 0x4188]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x378]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4188]
call fcn.1400040f0
mov dword [rsp + 0x1364], 0x10
lea rdx, [rsp + 0x1364]
lea rcx, [rsp + 0x63d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1748]
lea r8, [rsp + 0x1750]
lea rdx, [rsp + 0x1758]
lea rcx, [0x1400ef1b8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400ef1c8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xae0], rax
cmp qword [rsp + 0xae0], 0xffffffffffffffff
je 0x1400650ce
mov rcx, qword [rsp + 0xae0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x388], 0x2c6ee3d2
lea rdx, str.TWZtb
lea rcx, [rsp + 0x41a8]
call fcn.140003708
nop
lea rdx, [rsp + 0x41a8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x388]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x41a8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.3oR.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xae8], rax
cmp qword [rsp + 0xae8], 0xffffffffffffffff
je 0x140065183
mov rcx, qword [rsp + 0xae8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1cc], 1
mov edx, 8
lea rcx, [rsp + 0x15a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400651db
mov eax, dword [rsp + 0x15a8]
mov dword [rsp + 0x101c], eax
mov eax, dword [rsp + 0x15ac]
mov dword [rsp + 0x1020], eax
mov ecx, dword [rsp + 0x1cc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1cc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1360], 0x10
lea rdx, [rsp + 0x1360]
lea rcx, [rsp + 0x56d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x50e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.jTx.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaf0], rax
cmp qword [rsp + 0xaf0], 0xffffffffffffffff
je 0x14006525f
mov rcx, qword [rsp + 0xaf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x135c], 0x10
lea rdx, [rsp + 0x135c]
lea rcx, [rsp + 0x56f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1760]
lea r8, [rsp + 0x1768]
lea rdx, [rsp + 0x1770]
lea rcx, [0x1400ef240]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3a0], 0x1116f9ab
lea rdx, str.4R7X
lea rcx, [rsp + 0x41c8]
call fcn.140003708
nop
lea rdx, [rsp + 0x41c8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3a0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x41c8]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xaa8], rax
cmp qword [rsp + 0xaa8], 0
je 0x14006536f
lea rax, [rsp + 0x1778]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1780]
lea r8, [rsp + 0x1788]
lea rdx, [rsp + 0x1790]
mov rcx, qword [rsp + 0xaa8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xaa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.IGe0eCvf.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaf8], rax
cmp qword [rsp + 0xaf8], 0xffffffffffffffff
je 0x1400653c4
mov rcx, qword [rsp + 0xaf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x63f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
jmp 0x1400653ec
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x400
jae 0x140065415
movsxd rax, dword [rsp + 0x40]
mov al, byte [rsp + rax + 0x63f0]
inc al
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0x63f0], al
jmp 0x1400653e2
lea rax, [rsp + 0x67f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
jmp 0x14006543d
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0x400
jae 0x140065466
movsxd rax, dword [rsp + 0x44]
mov al, byte [rsp + rax + 0x67f0]
inc al
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0x67f0], al
jmp 0x140065433
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ANfbjBJ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb00], rax
cmp qword [rsp + 0xb00], 0xffffffffffffffff
je 0x1400654bb
mov rcx, qword [rsp + 0xb00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1798]
lea r8, [rsp + 0x17a0]
lea rdx, [rsp + 0x17a8]
lea rcx, [0x1400ef2b0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3a4], 0x327ae6e4
lea rdx, str.FIU2W
lea rcx, [rsp + 0x41e8]
call fcn.140003708
nop
lea rdx, [rsp + 0x41e8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3a4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x41e8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.XZM4u.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb08], rax
cmp qword [rsp + 0xb08], 0xffffffffffffffff
je 0x140065595
mov rcx, qword [rsp + 0xb08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.x.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb10], rax
cmp qword [rsp + 0xb10], 0xffffffffffffffff
je 0x1400655ea
mov rcx, qword [rsp + 0xb10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.vyDJpq5zk4.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb18], rax
cmp qword [rsp + 0xb18], 0xffffffffffffffff
je 0x14006563f
mov rcx, qword [rsp + 0xb18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1358], 0x10
lea rdx, [rsp + 0x1358]
lea rcx, [rsp + 0x5710]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x17b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x17b8]
lea r8, [rsp + 0x17c0]
lea rdx, [rsp + 0x17c8]
lea rcx, [0x1400ef348]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1354], 0x10
lea rdx, [rsp + 0x1354]
lea rcx, [rsp + 0x5730]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.j2WGQrm.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb20], rax
cmp qword [rsp + 0xb20], 0xffffffffffffffff
je 0x140065717
mov rcx, qword [rsp + 0xb20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.g2OXGI.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb28], rax
cmp qword [rsp + 0xb28], 0xffffffffffffffff
je 0x14006576c
mov rcx, qword [rsp + 0xb28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1350], 0x10
lea rdx, [rsp + 0x1350]
lea rcx, [rsp + 0x5750]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa98], rax
cmp qword [rsp + 0xa98], 0
je 0x1400657f7
lea rax, [rsp + 0x17d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x17d8]
lea r8, [rsp + 0x17e0]
lea rdx, [rsp + 0x17e8]
mov rcx, qword [rsp + 0xa98]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3c0], 0x18b208cb
lea rdx, str.b9NHl
lea rcx, [rsp + 0x4208]
call fcn.140003708
nop
lea rdx, [rsp + 0x4208]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3c0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4208]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.zdEk.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb30], rax
cmp qword [rsp + 0xb30], 0xffffffffffffffff
je 0x1400658ac
mov rcx, qword [rsp + 0xb30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5108]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.KXx.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb38], rax
cmp qword [rsp + 0xb38], 0xffffffffffffffff
je 0x14006590f
mov rcx, qword [rsp + 0xb38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x17f0]
lea r8, [rsp + 0x17f8]
lea rdx, [rsp + 0x1800]
lea rcx, [0x1400ef410]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Hb0T.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb40], rax
cmp qword [rsp + 0xb40], 0xffffffffffffffff
je 0x140065989
mov rcx, qword [rsp + 0xb40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1808]
lea r8, [rsp + 0x1810]
lea rdx, [rsp + 0x1818]
lea rcx, [0x1400ef438]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3c4], 0x16fb0f3a
lea rdx, str.tgKSH0n
lea rcx, [rsp + 0x4228]
call fcn.140003708
lea rcx, [rsp + 0x4228]
call fcn.14000a93c
mov r8d, dword [rsp + 0x3c4]
mov rdx, rax
lea rcx, [0x1400ef460]
call fcn.140044734
lea rcx, [rsp + 0x4228]
call fcn.1400040f0
mov dword [rsp + 0x3c8], 0x1fd777ab
lea rdx, str.49SnP3
lea rcx, [rsp + 0x4248]
call fcn.140003708
lea rcx, [rsp + 0x4248]
call fcn.14000a93c
mov r8d, dword [rsp + 0x3c8]
mov rdx, rax
lea rcx, [0x1400ef47c]
call fcn.140044734
lea rcx, [rsp + 0x4248]
call fcn.1400040f0
lea rax, [rsp + 0x6bf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
jmp 0x140065a76
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x400
jae 0x140065a9f
movsxd rax, dword [rsp + 0x48]
mov al, byte [rsp + rax + 0x6bf0]
inc al
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0x6bf0], al
jmp 0x140065a6c
mov dword [rsp + 0x3cc], 0x1ded5c65
lea rdx, [0x1400ef490]
lea rcx, [rsp + 0x4268]
call fcn.140003708
nop
lea rdx, [rsp + 0x4268]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3cc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4268]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa88], rax
cmp qword [rsp + 0xa88], 0
je 0x140065b69
lea rax, [rsp + 0x1820]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1828]
lea r8, [rsp + 0x1830]
lea rdx, [rsp + 0x1838]
mov rcx, qword [rsp + 0xa88]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3d0], 0x1300ad6e
lea rdx, [0x1400ef4a4]
lea rcx, [rsp + 0x4288]
call fcn.140003708
nop
lea rdx, [rsp + 0x4288]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3d0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4288]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.HOb6NZJw3E.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb48], rax
cmp qword [rsp + 0xb48], 0xffffffffffffffff
je 0x140065c1e
mov rcx, qword [rsp + 0xb48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3d4], 0x2114f20a
lea rdx, str.ge2k0l
lea rcx, [rsp + 0x42a8]
call fcn.140003708
nop
lea rdx, [rsp + 0x42a8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3d4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x42a8]
call fcn.1400040f0
lea rcx, [rsp + 0x5118]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x5128]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x3d8], 0x2b80850e
lea rdx, str.xqeuNvfh
lea rcx, [rsp + 0x42c8]
call fcn.140003708
lea rcx, [rsp + 0x42c8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x3d8]
mov rdx, rax
lea rcx, [0x1400ef504]
call fcn.140044734
lea rcx, [rsp + 0x42c8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.5.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb50], rax
cmp qword [rsp + 0xb50], 0xffffffffffffffff
je 0x140065d3f
mov rcx, qword [rsp + 0xb50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5138]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x3dc], 0x289113e0
lea rdx, str.rk3r
lea rcx, [rsp + 0x42e8]
call fcn.140003708
lea rcx, [rsp + 0x42e8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x3dc]
mov rdx, rax
lea rcx, [0x1400ef544]
call fcn.140044734
lea rcx, [rsp + 0x42e8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.K4fTXPInCz.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb58], rax
cmp qword [rsp + 0xb58], 0xffffffffffffffff
je 0x140065df2
mov rcx, qword [rsp + 0xb58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1840]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa80], rax
cmp qword [rsp + 0xa80], 0
je 0x140065e6a
lea rax, [rsp + 0x1848]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1850]
lea r8, [rsp + 0x1858]
lea rdx, [rsp + 0x1860]
mov rcx, qword [rsp + 0xa80]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1868]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa68], rax
cmp qword [rsp + 0xa68], 0
je 0x140065ee2
lea rax, [rsp + 0x1870]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1878]
lea r8, [rsp + 0x1880]
lea rdx, [rsp + 0x1888]
mov rcx, qword [rsp + 0xa68]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3e0], 0x33e89583
lea rdx, str.ki3m
lea rcx, [rsp + 0x4308]
call fcn.140003708
nop
lea rdx, [rsp + 0x4308]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3e0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4308]
call fcn.1400040f0
lea r9, [rsp + 0x1890]
lea r8, [rsp + 0x1898]
lea rdx, [rsp + 0x18a0]
lea rcx, [0x1400ef5a8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3e4], 0x330b703a
lea rdx, [0x1400ef5c8]
lea rcx, [rsp + 0x3228]
call fcn.140003708
nop
lea rdx, [rsp + 0x3228]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3e4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3228]
call fcn.1400040f0
mov dword [rsp + 0x3e8], 0x16360270
lea rdx, [0x1400ef5cc]
lea rcx, [rsp + 0x4348]
call fcn.140003708
lea rcx, [rsp + 0x4348]
call fcn.14000a93c
mov r8d, dword [rsp + 0x3e8]
mov rdx, rax
lea rcx, [0x1400ef5d8]
call fcn.140044734
lea rcx, [rsp + 0x4348]
call fcn.1400040f0
mov dword [rsp + 0x3ec], 0x31664d0d
lea rdx, str.vhfFhpoAw8
lea rcx, [rsp + 0x4368]
call fcn.140003708
lea rcx, [rsp + 0x4368]
call fcn.14000a93c
mov r8d, dword [rsp + 0x3ec]
mov rdx, rax
lea rcx, [0x1400ef600]
call fcn.140044734
lea rcx, [rsp + 0x4368]
call fcn.1400040f0
mov dword [rsp + 0x3f0], 0x1927818e
lea rdx, str.I8PNPz70H
lea rcx, [rsp + 0x4388]
call fcn.140003708
nop
lea rdx, [rsp + 0x4388]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x3f0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4388]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Sc0CVvB.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb60], rax
cmp qword [rsp + 0xb60], 0xffffffffffffffff
je 0x14006611c
mov rcx, qword [rsp + 0xb60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x134c], 0x10
lea rdx, [rsp + 0x134c]
lea rcx, [rsp + 0x5770]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x5148]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x6ff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 0
jmp 0x140066173
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
cmp rax, 0x400
jae 0x14006619c
movsxd rax, dword [rsp + 0x4c]
mov al, byte [rsp + rax + 0x6ff0]
inc al
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x6ff0], al
jmp 0x140066169
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa48], rax
cmp qword [rsp + 0xa48], 0
je 0x140066206
lea rax, [rsp + 0x18a8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x18b0]
lea r8, [rsp + 0x18b8]
lea rdx, [rsp + 0x18c0]
mov rcx, qword [rsp + 0xa48]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x400], 0x1f07b46b
lea rdx, [0x1400ef648]
lea rcx, [rsp + 0x43a8]
call fcn.140003708
nop
lea rdx, [rsp + 0x43a8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x400]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x43a8]
call fcn.1400040f0
lea rcx, [rsp + 0x5158]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x73f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x14006629c
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x1400662c5
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0x73f0]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x73f0], al
jmp 0x140066292
lea rcx, [rsp + 0x5168]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400ef650]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb68], rax
cmp qword [rsp + 0xb68], 0xffffffffffffffff
je 0x140066328
mov rcx, qword [rsp + 0xb68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa28], rax
cmp qword [rsp + 0xa28], 0
je 0x140066392
lea rax, [rsp + 0x18c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x18d0]
lea r8, [rsp + 0x18d8]
lea rdx, [rsp + 0x18e0]
mov rcx, qword [rsp + 0xa28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x18e8]
lea r8, [rsp + 0x18f0]
lea rdx, [rsp + 0x18f8]
lea rcx, [0x1400ef680]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x404], 0x1f5245ef
lea rdx, [0x1400ef698]
lea rcx, [rsp + 0x43c8]
call fcn.140003708
lea rcx, [rsp + 0x43c8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x404]
mov rdx, rax
lea rcx, [0x1400ef69c]
call fcn.140044734
lea rcx, [rsp + 0x43c8]
call fcn.1400040f0
mov dword [rsp + 0x408], 0x19a188c2
lea rdx, [0x1400ef6a8]
lea rcx, [rsp + 0x43e8]
call fcn.140003708
nop
lea rdx, [rsp + 0x43e8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x408]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x43e8]
call fcn.1400040f0
lea rcx, [rsp + 0x5178]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x77f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x14006649d
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x1400664c6
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0x77f0]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0x77f0], al
jmp 0x140066493
mov dword [rsp + 0x1d0], 1
mov edx, 8
lea rcx, [rsp + 0x16e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14006651e
mov eax, dword [rsp + 0x16e8]
mov dword [rsp + 0x1024], eax
mov eax, dword [rsp + 0x16ec]
mov dword [rsp + 0x1028], eax
mov ecx, dword [rsp + 0x1d0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1d0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa08], rax
cmp qword [rsp + 0xa08], 0
je 0x140066588
lea rax, [rsp + 0x1900]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1908]
lea r8, [rsp + 0x1910]
lea rdx, [rsp + 0x1918]
mov rcx, qword [rsp + 0xa08]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40c], 0x3f91f21
lea rdx, str.2CIH1j
lea rcx, [rsp + 0x4408]
call fcn.140003708
nop
lea rdx, [rsp + 0x4408]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x40c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4408]
call fcn.1400040f0
mov dword [rsp + 0x410], 0x354a8996
lea rdx, str.HhQRq
lea rcx, [rsp + 0x4428]
call fcn.140003708
nop
lea rdx, [rsp + 0x4428]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x410]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4428]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.c.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb70], rax
cmp qword [rsp + 0xb70], 0xffffffffffffffff
je 0x14006669d
mov rcx, qword [rsp + 0xb70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x414], 0x400dba3
lea rdx, str.uLLR5
lea rcx, [rsp + 0x4448]
call fcn.140003708
lea rcx, [rsp + 0x4448]
call fcn.14000a93c
mov r8d, dword [rsp + 0x414]
mov rdx, rax
lea rcx, [0x1400ef6ec]
call fcn.140044734
lea rcx, [rsp + 0x4448]
call fcn.1400040f0
lea rax, [rsp + 0x7bf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x140066715
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x14006673e
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0x7bf0]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0x7bf0], al
jmp 0x14006670b
mov dword [rsp + 0x1348], 0x10
lea rdx, [rsp + 0x1348]
lea rcx, [rsp + 0x5790]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x420], 0x266fae81
lea rdx, str.0VrB
lea rcx, [rsp + 0x4468]
call fcn.140003708
lea rcx, [rsp + 0x4468]
call fcn.14000a93c
mov r8d, dword [rsp + 0x420]
mov rdx, rax
lea rcx, [0x1400ef718]
call fcn.140044734
lea rcx, [rsp + 0x4468]
call fcn.1400040f0
lea r9, [rsp + 0x1920]
lea r8, [rsp + 0x1928]
lea rdx, [rsp + 0x1930]
lea rcx, [0x1400ef720]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1938]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x7ff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x14006680a
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x140066833
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0x7ff0]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0x7ff0], al
jmp 0x140066800
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9f8], rax
cmp qword [rsp + 0x9f8], 0
je 0x14006689d
lea rax, [rsp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1948]
lea r8, [rsp + 0x1950]
lea rdx, [rsp + 0x1958]
mov rcx, qword [rsp + 0x9f8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hHzOG5bUM.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb78], rax
cmp qword [rsp + 0xb78], 0xffffffffffffffff
je 0x1400668f2
mov rcx, qword [rsp + 0xb78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x424], 0x1e3aa75d
lea rdx, [0x1400ef774]
lea rcx, [rsp + 0x4488]
call fcn.140003708
lea rcx, [rsp + 0x4488]
call fcn.14000a93c
mov r8d, dword [rsp + 0x424]
mov rdx, rax
lea rcx, [0x1400ef790]
call fcn.140044734
lea rcx, [rsp + 0x4488]
call fcn.1400040f0
lea rcx, [rsp + 0x1960]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x83f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x140066978
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x1400669a1
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0x83f0]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0x83f0], al
jmp 0x14006696e
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.aBu.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb80], rax
cmp qword [rsp + 0xb80], 0xffffffffffffffff
je 0x1400669f6
mov rcx, qword [rsp + 0xb80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x428], 0x15a4ed6a
lea rdx, str.zxwubUgvgs
lea rcx, [rsp + 0x44a8]
call fcn.140003708
lea rcx, [rsp + 0x44a8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x428]
mov rdx, rax
lea rcx, [0x1400ef7d4]
call fcn.140044734
lea rcx, [rsp + 0x44a8]
call fcn.1400040f0
lea rcx, [rsp + 0x5188]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1968]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.qWacs7.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb88], rax
cmp qword [rsp + 0xb88], 0xffffffffffffffff
je 0x140066ab7
mov rcx, qword [rsp + 0xb88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x42c], 0x8a9deb6
lea rdx, [0x1400ef810]
lea rcx, [rsp + 0x44c8]
call fcn.140003708
lea rcx, [rsp + 0x44c8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x42c]
mov rdx, rax
lea rcx, [0x1400ef814]
call fcn.140044734
lea rcx, [rsp + 0x44c8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.QqN7mw2u.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb90], rax
cmp qword [rsp + 0xb90], 0xffffffffffffffff
je 0x140066b5c
mov rcx, qword [rsp + 0xb90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x430], 0x2ed6ac3e
lea rdx, str.FIyctH
lea rcx, [rsp + 0x44e8]
call fcn.140003708
lea rcx, [rsp + 0x44e8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x430]
mov rdx, rax
lea rcx, [0x1400ef860]
call fcn.140044734
lea rcx, [rsp + 0x44e8]
call fcn.1400040f0
lea rcx, [rsp + 0x5198]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x434], 0x10e36f18
lea rdx, [0x1400ef870]
lea rcx, [rsp + 0x4508]
call fcn.140003708
lea rcx, [rsp + 0x4508]
call fcn.14000a93c
mov r8d, dword [rsp + 0x434]
mov rdx, rax
lea rcx, [0x1400ef874]
call fcn.140044734
lea rcx, [rsp + 0x4508]
call fcn.1400040f0
mov dword [rsp + 0x1d4], 1
mov edx, 8
lea rcx, [rsp + 0x13c8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140066c62
mov eax, dword [rsp + 0x13c8]
mov dword [rsp + 0x102c], eax
mov eax, dword [rsp + 0x13cc]
mov dword [rsp + 0x1030], eax
mov ecx, dword [rsp + 0x1d4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1d4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x1970]
lea r8, [rsp + 0x1978]
lea rdx, [rsp + 0x1980]
lea rcx, [0x1400ef880]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1988]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1d8], 1
mov edx, 8
lea rcx, [rsp + 0x13d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140066ced
mov eax, dword [rsp + 0x13d8]
mov dword [rsp + 0x1034], eax
mov eax, dword [rsp + 0x13dc]
mov dword [rsp + 0x1038], eax
mov ecx, dword [rsp + 0x1d8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1d8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ns.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb98], rax
cmp qword [rsp + 0xb98], 0xffffffffffffffff
je 0x140066d42
mov rcx, qword [rsp + 0xb98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x87f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x140066d6a
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x140066d93
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0x87f0]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0x87f0], al
jmp 0x140066d60
mov dword [rsp + 0x438], 0x147b3748
lea rdx, str.x9zT8z2vq
lea rcx, [rsp + 0x3248]
call fcn.140003708
lea rcx, [rsp + 0x3248]
call fcn.14000a93c
mov r8d, dword [rsp + 0x438]
mov rdx, rax
lea rcx, [0x1400ef8c4]
call fcn.140044734
lea rcx, [rsp + 0x3248]
call fcn.1400040f0
lea rcx, [rsp + 0x1990]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1998]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x43c], 0x2c1f3789
lea rdx, str.4VrQgiV
lea rcx, [rsp + 0x3268]
call fcn.140003708
nop
lea rdx, [rsp + 0x3268]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x43c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3268]
call fcn.1400040f0
lea r9, [rsp + 0x19a0]
lea r8, [rsp + 0x19a8]
lea rdx, [rsp + 0x19b0]
lea rcx, [0x1400ef8e8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x8bf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x140066eac
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x140066ed5
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0x8bf0]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0x8bf0], al
jmp 0x140066ea2
lea rcx, [rsp + 0x51a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x8ff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x140066f0b
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x140066f34
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0x8ff0]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0x8ff0], al
jmp 0x140066f01
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.a7UvZKXUL.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xba0], rax
cmp qword [rsp + 0xba0], 0xffffffffffffffff
je 0x140066f89
mov rcx, qword [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x19b8]
lea r8, [rsp + 0x19c0]
lea rdx, [rsp + 0x19c8]
lea rcx, [0x1400ef910]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x19d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1344], 0x10
lea rdx, [rsp + 0x1344]
lea rcx, [rsp + 0x57b0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x19d8]
lea r8, [rsp + 0x19e0]
lea rdx, [rsp + 0x19e8]
lea rcx, [0x1400ef920]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x448], 0x3b879258
lea rdx, str.n1cfp3vbm4
lea rcx, [rsp + 0x3288]
call fcn.140003708
lea rcx, [rsp + 0x3288]
call fcn.14000a93c
mov r8d, dword [rsp + 0x448]
mov rdx, rax
lea rcx, [0x1400ef948]
call fcn.140044734
lea rcx, [rsp + 0x3288]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.SHz8YHq.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xba8], rax
cmp qword [rsp + 0xba8], 0xffffffffffffffff
je 0x1400670a7
mov rcx, qword [rsp + 0xba8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x19f0]
lea r8, [rsp + 0x19f8]
lea rdx, [rsp + 0x1a00]
lea rcx, [0x1400ef978]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x44c], 0x2349baee
lea rdx, [0x1400ef988]
lea rcx, [rsp + 0x32a8]
call fcn.140003708
nop
lea rdx, [rsp + 0x32a8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x44c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x32a8]
call fcn.1400040f0
lea rcx, [rsp + 0x51b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.lMbSZu7yV.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbb0], rax
cmp qword [rsp + 0xbb0], 0xffffffffffffffff
je 0x14006718f
mov rcx, qword [rsp + 0xbb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.K.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbb8], rax
cmp qword [rsp + 0xbb8], 0xffffffffffffffff
je 0x1400671e4
mov rcx, qword [rsp + 0xbb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1dc], 1
mov edx, 8
lea rcx, [rsp + 0x13e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14006723c
mov eax, dword [rsp + 0x13e0]
mov dword [rsp + 0x103c], eax
mov eax, dword [rsp + 0x13e4]
mov dword [rsp + 0x1040], eax
mov ecx, dword [rsp + 0x1dc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1dc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1340], 0x10
lea rdx, [rsp + 0x1340]
lea rcx, [rsp + 0x57d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1a08]
lea r8, [rsp + 0x1a10]
lea rdx, [rsp + 0x1a18]
lea rcx, [0x1400ef9d8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x458], 0x15876a39
lea rdx, str.3N50DDor
lea rcx, [rsp + 0x32c8]
call fcn.140003708
nop
lea rdx, [rsp + 0x32c8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x458]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x32c8]
call fcn.1400040f0
mov dword [rsp + 0x1e0], 1
mov edx, 8
lea rcx, [rsp + 0x13e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14006733a
mov eax, dword [rsp + 0x13e8]
mov dword [rsp + 0x1044], eax
mov eax, dword [rsp + 0x13ec]
mov dword [rsp + 0x1048], eax
mov ecx, dword [rsp + 0x1e0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1e0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.0vZLhx.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbc0], rax
cmp qword [rsp + 0xbc0], 0xffffffffffffffff
je 0x14006738f
mov rcx, qword [rsp + 0xbc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x45c], 0x16452d10
lea rdx, [0x1400efa24]
lea rcx, [rsp + 0x32e8]
call fcn.140003708
lea rcx, [rsp + 0x32e8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x45c]
mov rdx, rax
lea rcx, [0x1400efa40]
call fcn.140044734
lea rcx, [rsp + 0x32e8]
call fcn.1400040f0
lea rcx, [rsp + 0x51c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.WrXiLQ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbc8], rax
cmp qword [rsp + 0xbc8], 0xffffffffffffffff
je 0x140067442
mov rcx, qword [rsp + 0xbc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1a20]
lea r8, [rsp + 0x1a28]
lea rdx, [rsp + 0x1a30]
lea rcx, [0x1400efa80]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9e8], rax
cmp qword [rsp + 0x9e8], 0
je 0x1400674d1
lea rax, [rsp + 0x1a38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a40]
lea r8, [rsp + 0x1a48]
lea rdx, [rsp + 0x1a50]
mov rcx, qword [rsp + 0x9e8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1a58]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x51d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x1a60]
lea r8, [rsp + 0x1a68]
lea rdx, [rsp + 0x1a70]
lea rcx, [0x1400efaa0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x133c], 0x10
lea rdx, [rsp + 0x133c]
lea rcx, [rsp + 0x57f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x1a78]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x93f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x140067569
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x140067592
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0x93f0]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0x93f0], al
jmp 0x14006755f
mov dword [rsp + 0x468], 0x198838c3
lea rdx, [0x1400efab4]
lea rcx, [rsp + 0x3308]
call fcn.140003708
nop
lea rdx, [rsp + 0x3308]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x468]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3308]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.PouofQZ2ny.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbd0], rax
cmp qword [rsp + 0xbd0], 0xffffffffffffffff
je 0x140067647
mov rcx, qword [rsp + 0xbd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1a80]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9d0], rax
cmp qword [rsp + 0x9d0], 0
je 0x1400676bf
lea rax, [rsp + 0x1a88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a90]
lea r8, [rsp + 0x1a98]
lea rdx, [rsp + 0x1aa0]
mov rcx, qword [rsp + 0x9d0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1e4], 1
mov edx, 8
lea rcx, [rsp + 0x13f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140067717
mov eax, dword [rsp + 0x13f0]
mov dword [rsp + 0x104c], eax
mov eax, dword [rsp + 0x13f4]
mov dword [rsp + 0x1050], eax
mov ecx, dword [rsp + 0x1e4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1e4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x51e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x46c], 0x332ce081
lea rdx, str.0rc4bsWn
lea rcx, [rsp + 0x3328]
call fcn.140003708
lea rcx, [rsp + 0x3328]
call fcn.14000a93c
mov r8d, dword [rsp + 0x46c]
mov rdx, rax
lea rcx, [0x1400efb2c]
call fcn.140044734
lea rcx, [rsp + 0x3328]
call fcn.1400040f0
lea rcx, [rsp + 0x1aa8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1338], 0x10
lea rdx, [rsp + 0x1338]
lea rcx, [rsp + 0x5810]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x478], 0xfecbf7e
lea rdx, str.RDxLjNG
lea rcx, [rsp + 0x3348]
call fcn.140003708
nop
lea rdx, [rsp + 0x3348]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x478]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3348]
call fcn.1400040f0
lea rcx, [rsp + 0x1ab0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Lo1bVRd.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbd8], rax
cmp qword [rsp + 0xbd8], 0xffffffffffffffff
je 0x140067867
mov rcx, qword [rsp + 0xbd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9c0], rax
cmp qword [rsp + 0x9c0], 0
je 0x1400678d1
lea rax, [rsp + 0x1ab8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ac0]
lea r8, [rsp + 0x1ac8]
lea rdx, [rsp + 0x1ad0]
mov rcx, qword [rsp + 0x9c0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1e8], 1
mov edx, 8
lea rcx, [rsp + 0x1400]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140067929
mov eax, dword [rsp + 0x1400]
mov dword [rsp + 0x1054], eax
mov eax, dword [rsp + 0x1404]
mov dword [rsp + 0x1058], eax
mov ecx, dword [rsp + 0x1e8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1e8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x47c], 0x20d6e005
lea rdx, str.LjPc
lea rcx, [rsp + 0x3368]
call fcn.140003708
nop
lea rdx, [rsp + 0x3368]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x47c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3368]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9a8], rax
cmp qword [rsp + 0x9a8], 0
je 0x1400679f3
lea rax, [rsp + 0x1ad8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ae0]
lea r8, [rsp + 0x1ae8]
lea rdx, [rsp + 0x1af0]
mov rcx, qword [rsp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x51f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1ec], 1
mov edx, 8
lea rcx, [rsp + 0x1410]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140067a59
mov eax, dword [rsp + 0x1410]
mov dword [rsp + 0x105c], eax
mov eax, dword [rsp + 0x1414]
mov dword [rsp + 0x1060], eax
mov ecx, dword [rsp + 0x1ec]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1ec]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x5208]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x1af8]
lea r8, [rsp + 0x1b00]
lea rdx, [rsp + 0x1b08]
lea rcx, [0x1400efbb0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1f0], 1
mov edx, 8
lea rcx, [rsp + 0x1420]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140067ae4
mov eax, dword [rsp + 0x1420]
mov dword [rsp + 0x1064], eax
mov eax, dword [rsp + 0x1424]
mov dword [rsp + 0x1068], eax
mov ecx, dword [rsp + 0x1f0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1f0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.14ZeomJ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbe0], rax
cmp qword [rsp + 0xbe0], 0xffffffffffffffff
je 0x140067b39
mov rcx, qword [rsp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x480], 0x29578dfd
lea rdx, str.xWH6yRXg
lea rcx, [rsp + 0x3388]
call fcn.140003708
lea rcx, [rsp + 0x3388]
call fcn.14000a93c
mov r8d, dword [rsp + 0x480]
mov rdx, rax
lea rcx, [0x1400efbf4]
call fcn.140044734
lea rcx, [rsp + 0x3388]
call fcn.1400040f0
mov dword [rsp + 0x1334], 0x10
lea rdx, [rsp + 0x1334]
lea rcx, [rsp + 0x5830]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x97f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x140067bd2
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x140067bfb
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0x97f0]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0x97f0], al
jmp 0x140067bc8
mov dword [rsp + 0x490], 0x1bc80408
lea rdx, [0x1400efc04]
lea rcx, [rsp + 0x33a8]
call fcn.140003708
nop
lea rdx, [rsp + 0x33a8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x490]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x33a8]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9a0], rax
cmp qword [rsp + 0x9a0], 0
je 0x140067cc5
lea rax, [rsp + 0x1b10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1b18]
lea r8, [rsp + 0x1b20]
lea rdx, [rsp + 0x1b28]
mov rcx, qword [rsp + 0x9a0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x494], 0x385e56ec
lea rdx, str.N0q2R
lea rcx, [rsp + 0x33c8]
call fcn.140003708
nop
lea rdx, [rsp + 0x33c8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x494]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x33c8]
call fcn.1400040f0
lea r9, [rsp + 0x1b30]
lea r8, [rsp + 0x1b38]
lea rdx, [rsp + 0x1b40]
lea rcx, [0x1400efc20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x498], 0x34606d57
lea rdx, str.PgVSD00gPU
lea rcx, [rsp + 0x33e8]
call fcn.140003708
nop
lea rdx, [rsp + 0x33e8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x498]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x33e8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hk2Xp6iY6.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbe8], rax
cmp qword [rsp + 0xbe8], 0xffffffffffffffff
je 0x140067dff
mov rcx, qword [rsp + 0xbe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x998], rax
cmp qword [rsp + 0x998], 0
je 0x140067e69
lea rax, [rsp + 0x1b48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1b50]
lea r8, [rsp + 0x1b58]
lea rdx, [rsp + 0x1b60]
mov rcx, qword [rsp + 0x998]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x998]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x9bf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x140067e91
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x140067eba
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0x9bf0]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0x9bf0], al
jmp 0x140067e87
lea rax, [rsp + 0x9ff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x140067ee2
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x140067f0b
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0x9ff0]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0x9ff0], al
jmp 0x140067ed8
mov dword [rsp + 0x1f4], 1
mov edx, 8
lea rcx, [rsp + 0x1438]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140067f63
mov eax, dword [rsp + 0x1438]
mov dword [rsp + 0x106c], eax
mov eax, dword [rsp + 0x143c]
mov dword [rsp + 0x1070], eax
mov ecx, dword [rsp + 0x1f4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1f4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x5218]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x49c], 0x37256d4c
lea rdx, str.5LntsJoje
lea rcx, [rsp + 0x3408]
call fcn.140003708
lea rcx, [rsp + 0x3408]
call fcn.14000a93c
mov r8d, dword [rsp + 0x49c]
mov rdx, rax
lea rcx, [0x1400efc84]
call fcn.140044734
lea rcx, [rsp + 0x3408]
call fcn.1400040f0
mov dword [rsp + 0x1f8], 1
mov edx, 8
lea rcx, [rsp + 0x1450]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140068019
mov eax, dword [rsp + 0x1450]
mov dword [rsp + 0x1074], eax
mov eax, dword [rsp + 0x1454]
mov dword [rsp + 0x1078], eax
mov ecx, dword [rsp + 0x1f8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1f8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x4a0], 0x28daedae
lea rdx, str.MKp3
lea rcx, [rsp + 0x3428]
call fcn.140003708
nop
lea rdx, [rsp + 0x3428]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4a0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3428]
call fcn.1400040f0
mov dword [rsp + 0x4a4], 0xbccb2c3
lea rdx, [0x1400efcbc]
lea rcx, [rsp + 0x3448]
call fcn.140003708
nop
lea rdx, [rsp + 0x3448]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4a4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3448]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400efcc8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbf0], rax
cmp qword [rsp + 0xbf0], 0xffffffffffffffff
je 0x14006812e
mov rcx, qword [rsp + 0xbf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1b68]
lea r8, [rsp + 0x1b70]
lea rdx, [rsp + 0x1b78]
lea rcx, [0x1400efcf0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.tqJvKD.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbf8], rax
cmp qword [rsp + 0xbf8], 0xffffffffffffffff
je 0x1400681a8
mov rcx, qword [rsp + 0xbf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1b80]
lea r8, [rsp + 0x1b88]
lea rdx, [rsp + 0x1b90]
lea rcx, [0x1400efd20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xa3f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x1400681fe
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x140068230
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0xa3f0]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0xa3f0], al
jmp 0x1400681ee
mov dword [rsp + 0x4a8], 0x61cef1a
lea rdx, str.xVXWN7iA3y
lea rcx, [rsp + 0x3468]
call fcn.140003708
lea rcx, [rsp + 0x3468]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4a8]
mov rdx, rax
lea rcx, [0x1400efd44]
call fcn.140044734
lea rcx, [rsp + 0x3468]
call fcn.1400040f0
mov dword [rsp + 0x4ac], 0x1209c2bb
lea rdx, str.neds3
lea rcx, [rsp + 0x3488]
call fcn.140003708
lea rcx, [rsp + 0x3488]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4ac]
mov rdx, rax
lea rcx, [0x1400efd78]
call fcn.140044734
lea rcx, [rsp + 0x3488]
call fcn.1400040f0
mov dword [rsp + 0x1330], 0x10
lea rdx, [rsp + 0x1330]
lea rcx, [rsp + 0x5850]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1b98]
lea r8, [rsp + 0x1ba0]
lea rdx, [rsp + 0x1ba8]
lea rcx, [0x1400efd80]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1bb0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x4b8], 0x2d92e84
lea rdx, str.0RrnTvvFgY
lea rcx, [rsp + 0x34a8]
call fcn.140003708
lea rcx, [rsp + 0x34a8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4b8]
mov rdx, rax
lea rcx, [0x1400efd94]
call fcn.140044734
lea rcx, [rsp + 0x34a8]
call fcn.1400040f0
lea rcx, [rsp + 0x1bb8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x5228]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1bc0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x4bc], 0x352ff2ed
lea rdx, [0x1400efd9c]
lea rcx, [rsp + 0x34c8]
call fcn.140003708
nop
lea rdx, [rsp + 0x34c8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4bc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x34c8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400efda0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc00], rax
cmp qword [rsp + 0xc00], 0xffffffffffffffff
je 0x140068453
mov rcx, qword [rsp + 0xc00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4c0], 0x18945233
lea rdx, [0x1400efdb8]
lea rcx, [rsp + 0x34e8]
call fcn.140003708
lea rcx, [rsp + 0x34e8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4c0]
mov rdx, rax
lea rcx, [0x1400efdc0]
call fcn.140044734
lea rcx, [rsp + 0x34e8]
call fcn.1400040f0
lea r9, [rsp + 0x1bc8]
lea r8, [rsp + 0x1bd0]
lea rdx, [rsp + 0x1bd8]
lea rcx, [0x1400efdd0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x5238]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x4c4], 0xd8657fa
lea rdx, str.2Fo0rKQ
lea rcx, [rsp + 0x3508]
call fcn.140003708
nop
lea rdx, [rsp + 0x3508]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4c4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3508]
call fcn.1400040f0
lea rcx, [rsp + 0x1be0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x132c], 0x10
lea rdx, [rsp + 0x132c]
lea rcx, [rsp + 0x5870]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x1fc], 1
mov edx, 8
lea rcx, [rsp + 0x1480]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400685bd
mov eax, dword [rsp + 0x1480]
mov dword [rsp + 0x107c], eax
mov eax, dword [rsp + 0x1484]
mov dword [rsp + 0x1080], eax
mov ecx, dword [rsp + 0x1fc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x1fc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x200], 1
mov edx, 8
lea rcx, [rsp + 0x14a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140068615
mov eax, dword [rsp + 0x14a8]
mov dword [rsp + 0x1084], eax
mov eax, dword [rsp + 0x14ac]
mov dword [rsp + 0x1088], eax
mov ecx, dword [rsp + 0x200]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x200]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x988], rax
cmp qword [rsp + 0x988], 0
je 0x14006867f
lea rax, [rsp + 0x1be8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1bf0]
lea r8, [rsp + 0x1bf8]
lea rdx, [rsp + 0x1c00]
mov rcx, qword [rsp + 0x988]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x988]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xa7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x1400686b0
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x1400686e2
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0xa7f0]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0xa7f0], al
jmp 0x1400686a0
call fcn.140061128
mov dword [rsp + 0x4d0], 0xd888a10
lea rdx, str.5IhjpPOUV5
lea rcx, [rsp + 0x3528]
call fcn.140003708
lea rcx, [rsp + 0x3528]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4d0]
mov rdx, rax
lea rcx, [0x1400efdfc]
call fcn.140044734
lea rcx, [rsp + 0x3528]
call fcn.1400040f0
lea rax, [rsp + 0xabf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0
jmp 0x140068768
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
movsxd rax, dword [rsp + 0x88]
cmp rax, 0x400
jae 0x14006879a
movsxd rax, dword [rsp + 0x88]
mov al, byte [rsp + rax + 0xabf0]
inc al
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0xabf0], al
jmp 0x140068758
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x980], rax
cmp qword [rsp + 0x980], 0
je 0x140068804
lea rax, [rsp + 0x1c08]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1c10]
lea r8, [rsp + 0x1c18]
lea rdx, [rsp + 0x1c20]
mov rcx, qword [rsp + 0x980]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x980]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4d4], 0x33b3b9c
lea rdx, str.SFBoPHYvh
lea rcx, [rsp + 0x3548]
call fcn.140003708
lea rcx, [rsp + 0x3548]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4d4]
mov rdx, rax
lea rcx, [0x1400efe1c]
call fcn.140044734
lea rcx, [rsp + 0x3548]
call fcn.1400040f0
lea rcx, [rsp + 0x5248]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x968], rax
cmp qword [rsp + 0x968], 0
je 0x1400688cc
lea rax, [rsp + 0x1c28]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1c30]
lea r8, [rsp + 0x1c38]
lea rdx, [rsp + 0x1c40]
mov rcx, qword [rsp + 0x968]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x968]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x204], 1
mov edx, 8
lea rcx, [rsp + 0x14b0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140068924
mov eax, dword [rsp + 0x14b0]
mov dword [rsp + 0x108c], eax
mov eax, dword [rsp + 0x14b4]
mov dword [rsp + 0x1090], eax
mov ecx, dword [rsp + 0x204]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x204]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x1c48]
lea r8, [rsp + 0x1c50]
lea rdx, [rsp + 0x1c58]
lea rcx, [0x1400efe58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x958], rax
cmp qword [rsp + 0x958], 0
je 0x1400689b3
lea rax, [rsp + 0x1c60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1c68]
lea r8, [rsp + 0x1c70]
lea rdx, [rsp + 0x1c78]
mov rcx, qword [rsp + 0x958]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x958]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5258]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x1c80]
lea r8, [rsp + 0x1c88]
lea rdx, [rsp + 0x1c90]
lea rcx, [0x1400efe68]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x4d8], 0x11f126b2
lea rdx, str.AMwSTYtAF
lea rcx, [rsp + 0x3568]
call fcn.140003708
lea rcx, [rsp + 0x3568]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4d8]
mov rdx, rax
lea rcx, [0x1400efe8c]
call fcn.140044734
lea rcx, [rsp + 0x3568]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x950], rax
cmp qword [rsp + 0x950], 0
je 0x140068aa0
lea rax, [rsp + 0x1c98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [rsp + 0x1ca8]
lea rdx, [rsp + 0x1cb0]
mov rcx, qword [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4dc], 0x1caa13db
lea rdx, str.1Wcn
lea rcx, [rsp + 0x3588]
call fcn.140003708
lea rcx, [rsp + 0x3588]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4dc]
mov rdx, rax
lea rcx, [0x1400efeb4]
call fcn.140044734
lea rcx, [rsp + 0x3588]
call fcn.1400040f0
mov dword [rsp + 0x208], 1
mov edx, 8
lea rcx, [rsp + 0x14c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140068b48
mov eax, dword [rsp + 0x14c0]
mov dword [rsp + 0x1094], eax
mov eax, dword [rsp + 0x14c4]
mov dword [rsp + 0x1098], eax
mov ecx, dword [rsp + 0x208]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x208]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x5268]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x1cb8]
lea r8, [rsp + 0x1cc0]
lea rdx, [rsp + 0x1cc8]
lea rcx, [0x1400efec0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1cd0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1328], 0x10
lea rdx, [rsp + 0x1328]
lea rcx, [rsp + 0x5890]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x5278]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x4e8], 0x2937731b
lea rdx, [0x1400efee4]
lea rcx, [rsp + 0x35a8]
call fcn.140003708
nop
lea rdx, [rsp + 0x35a8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4e8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x35a8]
call fcn.1400040f0
mov dword [rsp + 0x4ec], 0x387b4a68
lea rdx, str.bkU4
lea rcx, [rsp + 0x35c8]
call fcn.140003708
nop
lea rdx, [rsp + 0x35c8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4ec]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x35c8]
call fcn.1400040f0
mov dword [rsp + 0x12d8], 0x10
lea rdx, [rsp + 0x12d8]
lea rcx, [rsp + 0x58b0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0xaff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x8c], 0
jmp 0x140068cca
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
movsxd rax, dword [rsp + 0x8c]
cmp rax, 0x400
jae 0x140068cfc
movsxd rax, dword [rsp + 0x8c]
mov al, byte [rsp + rax + 0xaff0]
inc al
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0xaff0], al
jmp 0x140068cba
mov dword [rsp + 0x4f8], 0x30d79b81
lea rdx, str.DotV0jgyAb
lea rcx, [rsp + 0x35e8]
call fcn.140003708
nop
lea rdx, [rsp + 0x35e8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4f8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x35e8]
call fcn.1400040f0
lea rcx, [rsp + 0x1cd8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x1ce0]
lea r8, [rsp + 0x1ce8]
lea rdx, [rsp + 0x1cf0]
lea rcx, [0x1400eff10]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1cf8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x4fc], 0x206b6a63
lea rdx, [0x1400eff20]
lea rcx, [rsp + 0x3608]
call fcn.140003708
nop
lea rdx, [rsp + 0x3608]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4fc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x3608]
call fcn.1400040f0
mov dword [rsp + 0x500], 0x4678cc6
lea rdx, [0x1400eff24]
lea rcx, [rsp + 0x3628]
call fcn.140003708
lea rcx, [rsp + 0x3628]
call fcn.14000a93c
mov r8d, dword [rsp + 0x500]
mov rdx, rax
lea rcx, [0x1400eff38]
call fcn.140044734
lea rcx, [rsp + 0x3628]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x930], rax
cmp qword [rsp + 0x930], 0
je 0x140068eb7
lea rax, [rsp + 0x1d00]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1d08]
lea r8, [rsp + 0x1d10]
lea rdx, [rsp + 0x1d18]
mov rcx, qword [rsp + 0x930]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x930]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.meFrR6.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc08], rax
cmp qword [rsp + 0xc08], 0xffffffffffffffff
je 0x140068f0c
mov rcx, qword [rsp + 0xc08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x20c], 1
mov edx, 8
lea rcx, [rsp + 0x14c8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140068f64
mov eax, dword [rsp + 0x14c8]
mov dword [rsp + 0x109c], eax
mov eax, dword [rsp + 0x14cc]
mov dword [rsp + 0x10a0], eax
mov ecx, dword [rsp + 0x20c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x20c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x210], 1
mov edx, 8
lea rcx, [rsp + 0x14d0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140068fbc
mov eax, dword [rsp + 0x14d0]
mov dword [rsp + 0x10a4], eax
mov eax, dword [rsp + 0x14d4]
mov dword [rsp + 0x10a8], eax
mov ecx, dword [rsp + 0x210]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x210]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x5288]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.UTWrrp.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc10], rax
cmp qword [rsp + 0xc10], 0xffffffffffffffff
je 0x14006901f
mov rcx, qword [rsp + 0xc10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xb3f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
jmp 0x140069050
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 0x400
jae 0x140069082
movsxd rax, dword [rsp + 0x90]
mov al, byte [rsp + rax + 0xb3f0]
inc al
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0xb3f0], al
jmp 0x140069040
lea rax, [rsp + 0xb7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x94], 0
jmp 0x1400690b3
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
cmp rax, 0x400
jae 0x1400690e5
movsxd rax, dword [rsp + 0x94]
mov al, byte [rsp + rax + 0xb7f0]
inc al
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0xb7f0], al
jmp 0x1400690a3
mov dword [rsp + 0x214], 1
mov edx, 8
lea rcx, [rsp + 0x14d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14006913d
mov eax, dword [rsp + 0x14d8]
mov dword [rsp + 0x10ac], eax
mov eax, dword [rsp + 0x14dc]
mov dword [rsp + 0x10b0], eax
mov ecx, dword [rsp + 0x214]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x214]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1324], 0x10
lea rdx, [rsp + 0x1324]
lea rcx, [rsp + 0x58d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1d20]
lea r8, [rsp + 0x1d28]
lea rdx, [rsp + 0x1d30]
lea rcx, [0x1400effa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x928], rax
cmp qword [rsp + 0x928], 0
je 0x1400691ed
lea rax, [rsp + 0x1d38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1d40]
lea r8, [rsp + 0x1d48]
lea rdx, [rsp + 0x1d50]
mov rcx, qword [rsp + 0x928]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x928]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.gxGml7Wz1E.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc18], rax
cmp qword [rsp + 0xc18], 0xffffffffffffffff
je 0x140069242