Function at 0x140025f70
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ad0]
mov eax, 0x1bd0
call fcn.14004ff30
sub rsp, rax
movaps xmmword [rsp + 0x1bc0], xmm6
mov rax, qword [0x140092100]
xor rax, rsp
mov qword [rbp + 0x1ab8], rax
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov qword [rbp + 0x28], rcx
lea rcx, [rbp + 0xe28]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, 8
lea rcx, [rbp + 0xe30]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140025ff9
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0xe38]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140026023
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x1aa8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x16a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
xor r14d, r14d
mov ecx, r14d
movdqa xmm6, xmmword [0x140079df0]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026060
mov eax, 0x18680
nop dword [rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x1400260c0
mov rcx, rdx
call fcn.14004fdb0
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x128], 0x10
lea rdx, [rbp + 0x128]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea r9, [rbp + 0xe40]
lea r8, [rbp + 0xe48]
lea rdx, [rbp + 0xfb0]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x10], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x20]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x20], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026140
mov eax, 0x18680
nop dword [rax + rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x1400261a0
mov rcx, rdx
call fcn.14004fdb0
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x1400261d0
mov eax, 0x18680
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140026230
mov rcx, rdx
call fcn.14004fdb0
lea r9, [rbp + 0x1238]
lea r8, [rbp + 0x12e8]
lea rdx, [rbp + 0x1620]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x1628]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140026292
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x12c], 0x10
lea rdx, [rbp + 0x12c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026312
lea rax, [rbp + 0x1630]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1638]
lea r8, [rbp + 0x1640]
lea rdx, [rbp + 0x1648]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1650]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026370
lea rax, [rbp + 0x1658]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1660]
lea r8, [rbp + 0x1668]
lea rdx, [rbp + 0x1670]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x130], 0x10
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea r9, [rbp + 0x1678]
lea r8, [rbp + 0x1680]
lea rdx, [rbp + 0x1688]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x1690]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400263eb
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x1698]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026410
mov eax, 0x18680
nop dword [rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140026470
mov rcx, rdx
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400264b0
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400264da
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x1b8]
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x1c8]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x1d0]
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x1e0]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x16b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026550
mov eax, 0x18680
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x1400265b0
mov rcx, rdx
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400265f0
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x1f8]
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x208]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x210]
lea r8, [rbp + 0x218]
lea rdx, [rbp + 0x220]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x10], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x20]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x20], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026650
mov eax, 0x18680
nop dword [rax + rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x1400266b0
mov rcx, rdx
call fcn.14004fdb0
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x1400266e0
mov eax, 0x18680
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140026740
mov rcx, rdx
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x228]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140026780
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x230]
lea r8, [rbp + 0x238]
lea rdx, [rbp + 0x240]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x16c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x248]
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x258]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026822
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x268]
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0x278]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026832
mov eax, 0x18680
nop
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140026890
mov rcx, rdx
call fcn.14004fdb0
mov rcx, qword [rsi]
test rcx, rcx
je 0x14002d7cc
call fcn.140009780
test eax, eax
je 0x14002d7cc
lea rcx, [rbp + 0x16d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x16e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x280]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x288]
lea r8, [rbp + 0x290]
lea rdx, [rbp + 0x298]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x134], 0x10
lea rdx, [rbp + 0x134]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026988
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2a8]
lea r8, [rbp + 0x2b0]
lea rdx, [rbp + 0x2b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x138], 0x10
lea rdx, [rbp + 0x138]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea r9, [rbp + 0x2c8]
lea r8, [rbp + 0x2d0]
lea rdx, [rbp + 0x2d8]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x13c], 0x10
lea rdx, [rbp + 0x13c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea r9, [rbp + 0x2e0]
lea r8, [rbp + 0x2e8]
lea rdx, [rbp + 0x2f0]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x2f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x300]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x16f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x308]
lea r8, [rbp + 0x310]
lea rdx, [rbp + 0x318]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x10], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x20]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x20], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026a90
mov eax, 0x18680
nop dword [rax + rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140026af0
mov rcx, rdx
call fcn.14004fdb0
lea r9, [rbp + 0x320]
lea r8, [rbp + 0x328]
lea rdx, [rbp + 0x330]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x338]
lea r8, [rbp + 0x340]
lea rdx, [rbp + 0x348]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x350]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x140], 0x10
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea rcx, [rbp + 0x1708]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x144], 0x10
lea rdx, [rbp + 0x144]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026c13
lea rax, [rbp + 0x358]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x360]
lea r8, [rbp + 0x368]
lea rdx, [rbp + 0x370]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026c64
lea rax, [rbp + 0x378]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x380]
lea r8, [rbp + 0x388]
lea rdx, [rbp + 0x390]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x398]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, 8
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140026c9b
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x148], 0x10
lea rdx, [rbp + 0x148]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea r9, [rbp + 0x3a8]
lea r8, [rbp + 0x3b0]
lea rdx, [rbp + 0x3b8]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026d3d
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3c8]
lea r8, [rbp + 0x3d0]
lea rdx, [rbp + 0x3d8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140026d67
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0xec], 0x10
lea rdx, [rbp + 0xec]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026dc0
mov eax, 0x18680
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140026e20
mov rcx, rdx
call fcn.14004fdb0
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x14c], 0x10
lea rdx, [rbp + 0x14c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140026e8f
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140026ea0
mov eax, 0x18680
nop dword [rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140026f00
mov rcx, rdx
call fcn.14004fdb0
lea rcx, [rbp + 0x400]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026f74
lea rax, [rbp + 0x408]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x410]
lea r8, [rbp + 0x418]
lea rdx, [rbp + 0x420]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0xa4]
mov rcx, qword [rsi]
call fcn.140009500
mov rdi, rax
lea rcx, [rbp + 0x428]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, 8
lea rcx, [rbp + 0x430]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140026fbd
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0x438]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140026fe7
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x1718]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x1728]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140027011
mov eax, 0x18680
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140027071
mov rcx, rdx
call fcn.14004fdb0
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x150], 0x10
lea rdx, [rbp + 0x150]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea r9, [rbp + 0x440]
lea r8, [rbp + 0x448]
lea rdx, [rbp + 0x450]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x10], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x20]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x20], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x1400270f0
mov eax, 0x18680
nop dword [rax + rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140027150
mov rcx, rdx
call fcn.14004fdb0
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140027180
mov eax, 0x18680
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x1400271e0
mov rcx, rdx
call fcn.14004fdb0
lea r9, [rbp + 0x458]
lea r8, [rbp + 0x460]
lea rdx, [rbp + 0x468]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x470]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140027242
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x154], 0x10
lea rdx, [rbp + 0x154]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400272c2
lea rax, [rbp + 0x478]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x480]
lea r8, [rbp + 0x488]
lea rdx, [rbp + 0x490]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x498]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027320
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4a8]
lea r8, [rbp + 0x4b0]
lea rdx, [rbp + 0x4b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x158], 0x10
lea rdx, [rbp + 0x158]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea r9, [rbp + 0x4c0]
lea r8, [rbp + 0x4c8]
lea rdx, [rbp + 0x4d0]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x4d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002739b
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x1400273c0
mov eax, 0x18680
nop dword [rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140027420
mov rcx, rdx
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140027460
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14002748a
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x4f8]
lea r8, [rbp + 0x500]
lea rdx, [rbp + 0x508]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x510]
lea r8, [rbp + 0x518]
lea rdx, [rbp + 0x520]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x528]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x1738]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140027500
mov eax, 0x18680
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140027560
mov rcx, rdx
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x530]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400275a0
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x538]
lea r8, [rbp + 0x540]
lea rdx, [rbp + 0x548]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x550]
lea r8, [rbp + 0x558]
lea rdx, [rbp + 0x560]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x10], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x20]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x20], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140027600
mov eax, 0x18680
nop dword [rax + rax]
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140027660
mov rcx, rdx
call fcn.14004fdb0
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140027690
mov eax, 0x18680
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x1400276f0
mov rcx, rdx
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x568]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140027730
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x570]
lea r8, [rbp + 0x578]
lea rdx, [rbp + 0x580]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x1748]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x588]
lea r8, [rbp + 0x590]
lea rdx, [rbp + 0x598]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400277d2
lea rax, [rbp + 0x5a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x5a8]
lea r8, [rbp + 0x5b0]
lea rdx, [rbp + 0x5b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x186a0
call fcn.14004ff80
mov rdx, rax
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x1400277e2
mov eax, 0x18680
nop
inc byte [rdx + rax]
inc rax
cmp rax, 0x186a0
jl 0x140027840
mov rcx, rdx
call fcn.14004fdb0
mov r13d, 0xffffffff
cmp dword [rbp + 0xa4], r14d
je 0x14002b782
lea rsi, [0x140093f60]
lea rbx, vtable.WRST::MCYVMA_PKO_.0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov ecx, 0x88
call fcn.14004fd74
mov qword [rbp + 0x38], rax
test rax, rax
je 0x1400278c9
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
mov rcx, rax
call fcn.140010a20
mov r12, rax
jmp 0x1400278cc
mov r12, r14
mov qword [rbp + 0x30], r12
mov ecx, 0x18
call fcn.14004fd74
mov r15, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140027904
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rbx
mov qword [rax + 0x10], r12
jmp 0x140027907
mov r15, r14
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r15
lea rcx, [rbp + 0x1758]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 8
lea rcx, [rbp + 0x5c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140027946
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x5c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x1768]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x5d0]
lea r8, [rbp + 0x5d8]
lea rdx, [rbp + 0x5e0]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x15c], 0x10
lea rdx, [rbp + 0x15c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x160], 0x10
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x5e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140027a0a
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027a5b
lea rax, [rbp + 0x5f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x5f8]
lea r8, [rbp + 0x600]
lea rdx, [rbp + 0x608]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027aac
lea rax, [rbp + 0x610]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x618]
lea r8, [rbp + 0x620]
lea rdx, [rbp + 0x628]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x630]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x638]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, 8
lea rcx, [rbp + 0x640]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140027af0
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x648]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x650]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x1778]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027b68
lea rax, [rbp + 0x658]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x660]
lea r8, [rbp + 0x668]
lea rdx, [rbp + 0x670]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x164], 0x10
lea rdx, [rbp + 0x164]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea rcx, [rbp + 0x1788]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x10], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x20]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x20], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140027bb1
cmp rcx, 0x186a0
jge 0x140027c1f
nop dword [rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x140027c10
mov rcx, rax
call fcn.14004fdb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027c78
lea rax, [rbp + 0x678]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x680]
lea r8, [rbp + 0x688]
lea rdx, [rbp + 0x690]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x168], 0x10
lea rdx, [rbp + 0x168]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027cf8
lea rax, [rbp + 0x698]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6a0]
lea r8, [rbp + 0x6a8]
lea rdx, [rbp + 0x6b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x6b8]
lea r8, [rbp + 0x6c0]
lea rdx, [rbp + 0x6c8]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027d6b
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6d8]
lea r8, [rbp + 0x6e0]
lea rdx, [rbp + 0x6e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027dbc
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f8]
lea r8, [rbp + 0x700]
lea rdx, [rbp + 0x708]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x710]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x16c], 0x10
lea rdx, [rbp + 0x16c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea rcx, [rbp + 0x1798]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 8
lea rcx, [rbp + 0x718]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140027e2f
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x17a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x720]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027e9a
lea rax, [rbp + 0x728]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
lea r8, [rbp + 0x738]
lea rdx, [rbp + 0x740]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140027eb0
cmp rcx, 0x186a0
jge 0x140027f2f
nop dword [rax]
nop dword [rax + rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x140027f20
mov rcx, rax
call fcn.14004fdb0
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x170], 0x10
lea rdx, [rbp + 0x170]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea rcx, [rbp + 0x748]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140027fc4
lea rax, [rbp + 0x750]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x758]
lea r8, [rbp + 0x760]
lea rdx, [rbp + 0x768]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x770]
lea r8, [rbp + 0x778]
lea rdx, [rbp + 0x780]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x788]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140028010
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8d, dword [rbp + 0xa4]
mov rdx, rdi
mov rcx, r12
call fcn.140011d50
test al, al
je 0x14002d75f
mov edx, 8
lea rcx, [rbp + 0x790]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140028054
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x798]
lea r8, [rbp + 0x7a0]
lea rdx, [rbp + 0x7a8]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400280c7
lea rax, [rbp + 0x7b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7b8]
lea r8, [rbp + 0x7c0]
lea rdx, [rbp + 0x7c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x7d0]
lea r8, [rbp + 0x7d8]
lea rdx, [rbp + 0x7e0]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140028100
cmp rcx, 0x186a0
jge 0x14002816f
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x140028160
mov rcx, rax
call fcn.14004fdb0
mov edx, 8
lea rcx, [rbp + 0x7e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400281a1
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400281cb
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x17b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x1400281f0
cmp rcx, 0x186a0
jge 0x14002826f
nop dword [rax]
nop dword [rax + rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x140028260
mov rcx, rax
call fcn.14004fdb0
lea r9, [rbp + 0x7f8]
lea r8, [rbp + 0x800]
lea rdx, [rbp + 0x808]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400282ea
lea rax, [rbp + 0x810]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x818]
lea r8, [rbp + 0x820]
lea rdx, [rbp + 0x828]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x830]
lea r8, [rbp + 0x838]
lea rdx, [rbp + 0x840]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x17c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002836a
lea rax, [rbp + 0x848]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x850]
lea r8, [rbp + 0x858]
lea rdx, [rbp + 0x860]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x10], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x20]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x20], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140028380
cmp rcx, 0x186a0
jge 0x1400283ef
nop dword [rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x1400283e0
mov rcx, rax
call fcn.14004fdb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140028448
lea rax, [rbp + 0x868]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x870]
lea r8, [rbp + 0x878]
lea rdx, [rbp + 0x880]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x888]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x890]
lea r8, [rbp + 0x898]
lea rdx, [rbp + 0x8a0]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x178], 0x10
lea rdx, [rbp + 0x178]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea rcx, [rbp + 0x8a8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x1400284c0
cmp rcx, 0x186a0
jge 0x14002853f
nop dword [rax]
nop dword [rax + rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x140028530
mov rcx, rax
call fcn.14004fdb0
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x17c], 0x10
lea rdx, [rbp + 0x17c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140028583
cmp rcx, 0x186a0
jge 0x1400285ff
nop dword [rax]
nop word [rax + rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x1400285f0
mov rcx, rax
call fcn.14004fdb0
lea rcx, [rbp + 0x8b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x8b8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x17d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 8
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140028658
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140028670
cmp rcx, 0x186a0
jge 0x1400286ef
nop dword [rax]
nop dword [rax + rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x1400286e0
mov rcx, rax
call fcn.14004fdb0
lea rcx, [rbp + 0x8c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x17f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002876f
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x8d8]
lea r8, [rbp + 0x8e0]
lea rdx, [rbp + 0x8e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x8f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140028799
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x10], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x20]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x20], xmm0
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x1400287b0
cmp rcx, 0x186a0
jge 0x14002881f
nop dword [rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x140028810
mov rcx, rax
call fcn.14004fdb0
lea rcx, [rbp + 0x1808]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x8f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x900]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x908]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x1818]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rcx, r12
call fcn.140011750
sub dword [rbp + 0xa4], eax
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x30], xmm1
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140028883
cmp rcx, 0x186a0
jge 0x1400288ff
nop word [rax + rax]
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x1400288f0
mov rcx, rax
call fcn.14004fdb0
lea rcx, [rbp + 0x910]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x1828]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140028972
lea rax, [rbp + 0x918]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x920]
lea r8, [rbp + 0x928]
lea rdx, [rbp + 0x930]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x186a0
call fcn.14004ff80
mov rcx, r14
nop
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x10]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x20]
movdqa xmm1, xmm6
paddb xmm1, xmm0
movdqu xmmword [rax + rcx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rcx + 0x30]
paddb xmm0, xmm6
movdqu xmmword [rax + rcx + 0x30], xmm0
add rcx, 0x40
cmp rcx, 0x18680
jl 0x140028980
cmp rcx, 0x186a0
jge 0x1400289ef
inc byte [rax + rcx]
inc rcx
cmp rcx, 0x186a0
jl 0x1400289e0
mov rcx, rax
call fcn.14004fdb0
lea r9, [rbp + 0x938]
lea r8, [rbp + 0x940]
lea rdx, [rbp + 0x948]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140028a6a
lea rax, [rbp + 0x950]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x958]
lea r8, [rbp + 0x960]
lea rdx, [rbp + 0x968]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x970]
lea r8, [rbp + 0x978]
lea rdx, [rbp + 0x980]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x988]
lea r8, [rbp + 0x990]
lea rdx, [rbp + 0x998]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140028aff
lea rax, [rbp + 0x9a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x9a8]
lea r8, [rbp + 0x9b0]
lea rdx, [rbp + 0x9b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x9c0]
lea r8, [rbp + 0x9c8]
lea rdx, [rbp + 0x9d0]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x1838]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 8
lea rcx, [rbp + 0x9d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140028b58
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140028b82
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140028bd3
lea rax, [rbp + 0x9e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x9f0]
lea r8, [rbp + 0x9f8]
lea rdx, [rbp + 0xa00]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xa08]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140028c31
lea rax, [rbp + 0xa10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xa18]
lea r8, [rbp + 0xa20]
lea rdx, [rbp + 0xa28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x180], 0x10
lea rdx, [rbp + 0x180]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea rcx, [rbp + 0xa30]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0xa38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x20
call fcn.14004ff80
mov rbx, rax
mov dword [rbp + 0x184], 0x10
lea rdx, [rbp + 0x184]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call fcn.14004fdb0
lea r9, [rbp + 0xa40]
lea r8, [rbp + 0xa48]
lea rdx, [rbp + 0xa50]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0xa58]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140028cf5
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0xa60]
lea r8, [rbp + 0xa68]
lea rdx, [rbp + 0xa70]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0xa78]
lea r8, [rbp + 0xa80]
lea rdx, [rbp + 0xa88]
lea rcx, [0x140079da0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x1848]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 8
lea rcx, [rbp + 0xa90]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140028d70
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14002d7d4
mov eax, r13d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14002d7d4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r13d
cmp r13d, 1
jne 0x14002d7d4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x14002d7d4
test r15, r15
je 0x14002d792
mov eax, r13d
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x14002d792
mov rax, qword [r15]
mov rcx, r15
call qword [rax]
mov eax, r13d
lock xadd dword [r15 + 0xc], eax
cmp eax, 1
jne 0x14002d792
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 8]
nop
mov rbx, qword [rsp + 0x40]
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x14002d7d4
mov eax, r13d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14002d7d4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r13d
cmp r13d, 1
jne 0x14002d7d4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x14002d7d4
mov rcx, rsi
call fcn.1400013e0
mov rcx, qword [rbp + 0x1ab8]
xor rcx, rsp
call fcn.14004fe50
lea r11, [rsp + 0x1bd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret