Function at 0x14001727c
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x64450
call fcn.1400d9c00
sub rsp, rax
mov rax, qword [0x140134040]
xor rax, rsp
mov qword [rsp + 0x64440], rax
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x9be0]
lea r8, [rsp + 0x9be8]
lea rdx, [rsp + 0x9bf0]
lea rcx, [0x140115820]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa78], rax
cmp qword [rsp + 0xa78], 0
je 0x14001733d
lea rax, [rsp + 0x9bf8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c00]
lea r8, [rsp + 0x9c08]
lea rdx, [rsp + 0x9c10]
mov rcx, qword [rsp + 0xa78]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x9c18]
lea r8, [rsp + 0x9c20]
lea rdx, [rsp + 0x9c28]
lea rcx, [0x140115830]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x574], 1
mov edx, 8
lea rcx, [rsp + 0x4518]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400173ba
mov eax, dword [rsp + 0x4518]
mov dword [rsp + 0x2fb4], eax
mov eax, dword [rsp + 0x451c]
mov dword [rsp + 0x2fb8], eax
mov ecx, dword [rsp + 0x574]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x574]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xfa50]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x3e90], 0x10
lea rdx, [rsp + 0x3e90]
lea rcx, [rsp + 0xfdc0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1fc8], rax
cmp qword [rsp + 0x1fc8], 0
je 0x140017453
lea rax, [rsp + 0x9c30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c38]
lea r8, [rsp + 0x9c40]
lea rdx, [rsp + 0x9c48]
mov rcx, qword [rsp + 0x1fc8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1fc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3e8c], 0x10
lea rdx, [rsp + 0x3e8c]
lea rcx, [rsp + 0xfde0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xa98], 0x28029f30
lea rdx, [0x14011582c]
lea rcx, [rsp + 0xc490]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc490]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xa98]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc490]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115840]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2110], rax
cmp qword [rsp + 0x2110], 0xffffffffffffffff
je 0x140017529
mov rcx, qword [rsp + 0x2110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xa9c], 0x2cc931cd
lea rdx, [0x140115838]
lea rcx, [rsp + 0xc4b0]
call fcn.1400038c4
lea rcx, [rsp + 0xc4b0]
call fcn.14000a750
mov r8d, dword [rsp + 0xa9c]
mov rdx, rax
lea rcx, [0x140115858]
call fcn.140015614
lea rcx, [rsp + 0xc4b0]
call fcn.14000389c
lea rax, [rsp + 0x12440]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x1400175a1
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x1400175ca
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0x12440]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x12440], al
jmp 0x140017597
lea rax, [rsp + 0x12840]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x1400175f2
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x14001761b
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0x12840]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0x12840], al
jmp 0x1400175e8
lea rcx, [rsp + 0xfa60]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x9c50]
lea r8, [rsp + 0x9c58]
lea rdx, [rsp + 0x9c60]
lea rcx, [0x140115850]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3e88], 0x10
lea rdx, [rsp + 0x3e88]
lea rcx, [rsp + 0xfe00]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xaa8], 0x166396b0
lea rdx, [0x140115874]
lea rcx, [rsp + 0xc4d0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc4d0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xaa8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc4d0]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115860]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2118], rax
cmp qword [rsp + 0x2118], 0xffffffffffffffff
je 0x140017724
mov rcx, qword [rsp + 0x2118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1fb8], rax
cmp qword [rsp + 0x1fb8], 0
je 0x14001778e
lea rax, [rsp + 0x9c68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c70]
lea r8, [rsp + 0x9c78]
lea rdx, [rsp + 0x9c80]
mov rcx, qword [rsp + 0x1fb8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1fb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115880]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2120], rax
cmp qword [rsp + 0x2120], 0xffffffffffffffff
je 0x1400177e3
mov rcx, qword [rsp + 0x2120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x12c40]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x14001780b
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x140017834
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0x12c40]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0x12c40], al
jmp 0x140017801
lea rcx, [rsp + 0xfa70]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x9c88]
lea r8, [rsp + 0x9c90]
lea rdx, [rsp + 0x9c98]
lea rcx, [0x140115878]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x13040]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x14001788f
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x1400178b8
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0x13040]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0x13040], al
jmp 0x140017885
lea rax, [rsp + 0x13440]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x1400178e0
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x140017909
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0x13440]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0x13440], al
jmp 0x1400178d6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1fa8], rax
cmp qword [rsp + 0x1fa8], 0
je 0x140017973
lea rax, [rsp + 0x9ca0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9ca8]
lea r8, [rsp + 0x9cb0]
lea rdx, [rsp + 0x9cb8]
mov rcx, qword [rsp + 0x1fa8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1fa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x578], 1
mov edx, 8
lea rcx, [rsp + 0x4538]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400179cb
mov eax, dword [rsp + 0x4538]
mov dword [rsp + 0x2fbc], eax
mov eax, dword [rsp + 0x453c]
mov dword [rsp + 0x2fc0], eax
mov ecx, dword [rsp + 0x578]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x578]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1401158a0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2128], rax
cmp qword [rsp + 0x2128], 0xffffffffffffffff
je 0x140017a20
mov rcx, qword [rsp + 0x2128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x9cc0]
lea r8, [rsp + 0x9cc8]
lea rdx, [rsp + 0x9cd0]
lea rcx, [0x140115898]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x57c], 1
mov edx, 8
lea rcx, [rsp + 0x4548]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140017a9d
mov eax, dword [rsp + 0x4548]
mov dword [rsp + 0x2fc4], eax
mov eax, dword [rsp + 0x454c]
mov dword [rsp + 0x2fc8], eax
mov ecx, dword [rsp + 0x57c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x57c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x9cd8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x580], 1
mov edx, 8
lea rcx, [rsp + 0x4560]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140017b03
mov eax, dword [rsp + 0x4560]
mov dword [rsp + 0x2fcc], eax
mov eax, dword [rsp + 0x4564]
mov dword [rsp + 0x2fd0], eax
mov ecx, dword [rsp + 0x580]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x580]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x13840]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x140017b2b
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x140017b54
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0x13840]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0x13840], al
jmp 0x140017b21
mov dword [rsp + 0x3e84], 0x10
lea rdx, [rsp + 0x3e84]
lea rcx, [rsp + 0xfe20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f90], rax
cmp qword [rsp + 0x1f90], 0
je 0x140017bdf
lea rax, [rsp + 0x9ce0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9ce8]
lea r8, [rsp + 0x9cf0]
lea rdx, [rsp + 0x9cf8]
mov rcx, qword [rsp + 0x1f90]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xfa80]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f88], rax
cmp qword [rsp + 0x1f88], 0
je 0x140017c57
lea rax, [rsp + 0x9d00]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9d08]
lea r8, [rsp + 0x9d10]
lea rdx, [rsp + 0x9d18]
mov rcx, qword [rsp + 0x1f88]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f80], rax
cmp qword [rsp + 0x1f80], 0
je 0x140017cc1
lea rax, [rsp + 0x9d20]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9d28]
lea r8, [rsp + 0x9d30]
lea rdx, [rsp + 0x9d38]
mov rcx, qword [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xab8], 0x6d4484
lea rdx, [0x1401158b8]
lea rcx, [rsp + 0xc4f0]
call fcn.1400038c4
lea rcx, [rsp + 0xc4f0]
call fcn.14000a750
mov r8d, dword [rsp + 0xab8]
mov rdx, rax
lea rcx, [0x1401158b0]
call fcn.140015614
lea rcx, [rsp + 0xc4f0]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f58], rax
cmp qword [rsp + 0x1f58], 0
je 0x140017d7b
lea rax, [rsp + 0x9d40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9d48]
lea r8, [rsp + 0x9d50]
lea rdx, [rsp + 0x9d58]
mov rcx, qword [rsp + 0x1f58]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x13c40]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x140017da3
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x140017dcc
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0x13c40]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0x13c40], al
jmp 0x140017d99
lea r9, [rsp + 0x9d60]
lea r8, [rsp + 0x9d68]
lea rdx, [rsp + 0x9d70]
lea rcx, [0x1401158c8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xfa90]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x9d78]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x9d80]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x9d88]
lea r8, [rsp + 0x9d90]
lea rdx, [rsp + 0x9d98]
lea rcx, [0x1401158c0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x9da0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x14040]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x140017e76
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x140017e9f
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0x14040]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0x14040], al
jmp 0x140017e6c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1401158d8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2130], rax
cmp qword [rsp + 0x2130], 0xffffffffffffffff
je 0x140017ef4
mov rcx, qword [rsp + 0x2130]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3e80], 0x10
lea rdx, [rsp + 0x3e80]
lea rcx, [rsp + 0xfe40]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3e7c], 0x10
lea rdx, [rsp + 0x3e7c]
lea rcx, [rsp + 0xfe60]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x9da8]
lea r8, [rsp + 0x9db0]
lea rdx, [rsp + 0x9db8]
lea rcx, [0x1401158d0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xad0], 0x127ebfb7
lea rdx, [0x1401158f4]
lea rcx, [rsp + 0xc510]
call fcn.1400038c4
lea rcx, [rsp + 0xc510]
call fcn.14000a750
mov r8d, dword [rsp + 0xad0]
mov rdx, rax
lea rcx, [0x1401158ec]
call fcn.140015614
lea rcx, [rsp + 0xc510]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f50], rax
cmp qword [rsp + 0x1f50], 0
je 0x140018015
lea rax, [rsp + 0x9dc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9dc8]
lea r8, [rsp + 0x9dd0]
lea rdx, [rsp + 0x9dd8]
mov rcx, qword [rsp + 0x1f50]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x584], 1
mov edx, 8
lea rcx, [rsp + 0x4578]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001806d
mov eax, dword [rsp + 0x4578]
mov dword [rsp + 0x2fd4], eax
mov eax, dword [rsp + 0x457c]
mov dword [rsp + 0x2fd8], eax
mov ecx, dword [rsp + 0x584]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x584]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xfaa0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x14440]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x1400180a3
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x1400180cc
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0x14440]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0x14440], al
jmp 0x140018099
mov dword [rsp + 0x3e78], 0x10
lea rdx, [rsp + 0x3e78]
lea rcx, [rsp + 0xfe80]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x588], 1
mov edx, 8
lea rcx, [rsp + 0x4588]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140018145
mov eax, dword [rsp + 0x4588]
mov dword [rsp + 0x2fdc], eax
mov eax, dword [rsp + 0x458c]
mov dword [rsp + 0x2fe0], eax
mov ecx, dword [rsp + 0x588]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x588]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x58c], 1
mov edx, 8
lea rcx, [rsp + 0x4590]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001819d
mov eax, dword [rsp + 0x4590]
mov dword [rsp + 0x2fe4], eax
mov eax, dword [rsp + 0x4594]
mov dword [rsp + 0x2fe8], eax
mov ecx, dword [rsp + 0x58c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x58c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xfab0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xae0], 0x39aa8814
lea rdx, [0x140115910]
lea rcx, [rsp + 0xc530]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc530]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xae0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc530]
call fcn.14000389c
mov dword [rsp + 0xae4], 0x1fd827ed
lea rdx, [0x140115900]
lea rcx, [rsp + 0xc550]
call fcn.1400038c4
lea rcx, [rsp + 0xc550]
call fcn.14000a750
mov r8d, dword [rsp + 0xae4]
mov rdx, rax
lea rcx, [0x14011591c]
call fcn.140015614
lea rcx, [rsp + 0xc550]
call fcn.14000389c
lea rax, [rsp + 0x14840]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x140018283
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x1400182ac
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0x14840]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0x14840], al
jmp 0x140018279
lea rax, [rsp + 0x14c40]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x1400182d4
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x1400182fd
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0x14c40]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0x14c40], al
jmp 0x1400182ca
lea rcx, [rsp + 0x9de0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xfac0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xfad0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xae8], 0x13462f64
lea rdx, [0x1401158bc]
lea rcx, [rsp + 0xc570]
call fcn.1400038c4
lea rcx, [rsp + 0xc570]
call fcn.14000a750
mov r8d, dword [rsp + 0xae8]
mov rdx, rax
lea rcx, [0x140115938]
call fcn.140015614
lea rcx, [rsp + 0xc570]
call fcn.14000389c
lea rax, [rsp + 0x15040]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x14001839f
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x1400183c8
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0x15040]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0x15040], al
jmp 0x140018395
lea rcx, [rsp + 0xfcd0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.qt.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2138], rax
cmp qword [rsp + 0x2138], 0xffffffffffffffff
je 0x14001842b
mov rcx, qword [rsp + 0x2138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xaec], 0x2826713e
lea rdx, [0x140115948]
lea rcx, [rsp + 0xc590]
call fcn.1400038c4
lea rcx, [rsp + 0xc590]
call fcn.14000a750
mov r8d, dword [rsp + 0xaec]
mov rdx, rax
lea rcx, [0x140115940]
call fcn.140015614
lea rcx, [rsp + 0xc590]
call fcn.14000389c
mov dword [rsp + 0xaf0], 0x29633f6d
lea rdx, [0x140115958]
lea rcx, [rsp + 0xc5b0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc5b0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xaf0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc5b0]
call fcn.14000389c
lea rcx, [rsp + 0xed30]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x9de8]
lea r8, [rsp + 0x4c28]
lea rdx, [rsp + 0x4c30]
lea rcx, [0x140115950]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x590], 1
mov edx, 8
lea rcx, [rsp + 0x45b0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140018566
mov eax, dword [rsp + 0x45b0]
mov dword [rsp + 0x2fec], eax
mov eax, dword [rsp + 0x45b4]
mov dword [rsp + 0x2ff0], eax
mov ecx, dword [rsp + 0x590]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x590]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x3e74], 0x10
lea rdx, [rsp + 0x3e74]
lea rcx, [rsp + 0xfea0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x4c38]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xed40]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xb00], 0xd65406a
lea rdx, [0x140115978]
lea rcx, [rsp + 0xc5d0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc5d0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xb00]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc5d0]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115960]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2140], rax
cmp qword [rsp + 0x2140], 0xffffffffffffffff
je 0x140018658
mov rcx, qword [rsp + 0x2140]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115988]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2148], rax
cmp qword [rsp + 0x2148], 0xffffffffffffffff
je 0x1400186ad
mov rcx, qword [rsp + 0x2148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xb04], 0x133bec43
lea rdx, [0x140115980]
lea rcx, [rsp + 0xc5f0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc5f0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xb04]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc5f0]
call fcn.14000389c
lea rcx, [rsp + 0xf020]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x3e70], 0x10
lea rdx, [rsp + 0x3e70]
lea rcx, [rsp + 0xfec0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1401159a8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2150], rax
cmp qword [rsp + 0x2150], 0xffffffffffffffff
je 0x140018791
mov rcx, qword [rsp + 0x2150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x4c40]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0xb10], 0xa212e8d
lea rdx, [0x1401159a4]
lea rcx, [rsp + 0xc610]
call fcn.1400038c4
lea rcx, [rsp + 0xc610]
call fcn.14000a750
mov r8d, dword [rsp + 0xb10]
mov rdx, rax
lea rcx, [0x1401159c4]
call fcn.140015614
lea rcx, [rsp + 0xc610]
call fcn.14000389c
lea rcx, [rsp + 0xf030]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xb14], 0x33ca14c9
lea rdx, [0x1401159b8]
lea rcx, [rsp + 0xc630]
call fcn.1400038c4
lea rcx, [rsp + 0xc630]
call fcn.14000a750
mov r8d, dword [rsp + 0xb14]
mov rdx, rax
lea rcx, [0x1401159dc]
call fcn.140015614
lea rcx, [rsp + 0xc630]
call fcn.14000389c
lea rax, [rsp + 0x15440]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x14001887e
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x1400188b0
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0x15440]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0x15440], al
jmp 0x14001886e
mov dword [rsp + 0xb18], 0x10fc870b
lea rdx, [0x1401159d0]
lea rcx, [rsp + 0xc650]
call fcn.1400038c4
lea rcx, [rsp + 0xc650]
call fcn.14000a750
mov r8d, dword [rsp + 0xb18]
mov rdx, rax
lea rcx, [0x1401159f0]
call fcn.140015614
lea rcx, [rsp + 0xc650]
call fcn.14000389c
lea r9, [rsp + 0x4c48]
lea r8, [rsp + 0x4c50]
lea rdx, [rsp + 0x4c58]
lea rcx, [0x1401159e8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xb1c], 0x216dcda1
lea rdx, [0x140115a04]
lea rcx, [rsp + 0xc670]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc670]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xb1c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc670]
call fcn.14000389c
mov dword [rsp + 0x594], 1
mov edx, 8
lea rcx, [rsp + 0x45e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400189dd
mov eax, dword [rsp + 0x45e0]
mov dword [rsp + 0x2ff4], eax
mov eax, dword [rsp + 0x45e4]
mov dword [rsp + 0x2ff8], eax
mov ecx, dword [rsp + 0x594]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x594]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f28], rax
cmp qword [rsp + 0x1f28], 0
je 0x140018a47
lea rax, [rsp + 0x4c60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c68]
lea r8, [rsp + 0x4c70]
lea rdx, [rsp + 0x4c78]
mov rcx, qword [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x598], 1
mov edx, 8
lea rcx, [rsp + 0x45e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140018a9f
mov eax, dword [rsp + 0x45e8]
mov dword [rsp + 0x2ffc], eax
mov eax, dword [rsp + 0x45ec]
mov dword [rsp + 0x3000], eax
mov ecx, dword [rsp + 0x598]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x598]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0xb20], 0x236a96c2
lea rdx, [0x1401159f8]
lea rcx, [rsp + 0xc690]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc690]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xb20]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc690]
call fcn.14000389c
mov dword [rsp + 0x59c], 1
mov edx, 8
lea rcx, [rsp + 0x45f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140018b57
mov eax, dword [rsp + 0x45f0]
mov dword [rsp + 0x3004], eax
mov eax, dword [rsp + 0x45f4]
mov dword [rsp + 0x3008], eax
mov ecx, dword [rsp + 0x59c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x59c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f18], rax
cmp qword [rsp + 0x1f18], 0
je 0x140018bc1
lea rax, [rsp + 0x4c80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c88]
lea r8, [rsp + 0x4c90]
lea rdx, [rsp + 0x4c98]
mov rcx, qword [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f10], rax
cmp qword [rsp + 0x1f10], 0
je 0x140018c2b
lea rax, [rsp + 0x4ca0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4ca8]
lea r8, [rsp + 0x4cb0]
lea rdx, [rsp + 0x4cb8]
mov rcx, qword [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5a0], 1
mov edx, 8
lea rcx, [rsp + 0x45f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140018c83
mov eax, dword [rsp + 0x45f8]
mov dword [rsp + 0x300c], eax
mov eax, dword [rsp + 0x45fc]
mov dword [rsp + 0x3010], eax
mov ecx, dword [rsp + 0x5a0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5a0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x4cc0]
lea r8, [rsp + 0x4cc8]
lea rdx, [rsp + 0x4cd0]
lea rcx, [0x140115a18]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xb24], 0x1e739f1e
lea rdx, [0x140115a0c]
lea rcx, [rsp + 0xc6b0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc6b0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xb24]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc6b0]
call fcn.14000389c
mov dword [rsp + 0xb28], 0x482e3cc
lea rdx, [0x140115a28]
lea rcx, [rsp + 0xc6d0]
call fcn.1400038c4
lea rcx, [rsp + 0xc6d0]
call fcn.14000a750
mov r8d, dword [rsp + 0xb28]
mov rdx, rax
lea rcx, [0x140115a20]
call fcn.140015614
lea rcx, [rsp + 0xc6d0]
call fcn.14000389c
lea rcx, [rsp + 0xf040]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xb2c], 0x17f64cba
lea rdx, [0x140115a38]
lea rcx, [rsp + 0xc6f0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc6f0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xb2c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc6f0]
call fcn.14000389c
lea r9, [rsp + 0x4cd8]
lea r8, [rsp + 0x4ce0]
lea rdx, [rsp + 0x4ce8]
lea rcx, [0x140115a30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115a48]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2158], rax
cmp qword [rsp + 0x2158], 0xffffffffffffffff
je 0x140018e40
mov rcx, qword [rsp + 0x2158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xb30], 0x6018efc
lea rdx, [0x140115a40]
lea rcx, [rsp + 0xc710]
call fcn.1400038c4
lea rcx, [rsp + 0xc710]
call fcn.14000a750
mov r8d, dword [rsp + 0xb30]
mov rdx, rax
lea rcx, [0x140115a80]
call fcn.140015614
lea rcx, [rsp + 0xc710]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115a68]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2160], rax
cmp qword [rsp + 0x2160], 0xffffffffffffffff
je 0x140018ee5
mov rcx, qword [rsp + 0x2160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x4cf0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0xb34], 0x35cda01f
lea rdx, [0x140115a90]
lea rcx, [rsp + 0xc730]
call fcn.1400038c4
lea rcx, [rsp + 0xc730]
call fcn.14000a750
mov r8d, dword [rsp + 0xb34]
mov rdx, rax
lea rcx, [0x140115a88]
call fcn.140015614
lea rcx, [rsp + 0xc730]
call fcn.14000389c
mov dword [rsp + 0xb38], 0x337bec2a
lea rdx, [0x140115aa8]
lea rcx, [rsp + 0xc750]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc750]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xb38]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc750]
call fcn.14000389c
lea rcx, [rsp + 0x4cf8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0xb3c], 0x3701fdb7
lea rdx, [0x140115a98]
lea rcx, [rsp + 0xc770]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc770]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xb3c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc770]
call fcn.14000389c
mov dword [rsp + 0xb40], 0xc852266
lea rdx, [0x140115abc]
lea rcx, [rsp + 0xc790]
call fcn.1400038c4
lea rcx, [rsp + 0xc790]
call fcn.14000a750
mov r8d, dword [rsp + 0xb40]
mov rdx, rax
lea rcx, [0x140115ab4]
call fcn.140015614
lea rcx, [rsp + 0xc790]
call fcn.14000389c
lea r9, [rsp + 0x4d00]
lea r8, [rsp + 0x4d08]
lea rdx, [rsp + 0x4d10]
lea rcx, [0x140115ac8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x4d18]
lea r8, [rsp + 0x4d20]
lea rdx, [rsp + 0x4d28]
lea rcx, [0x140115ac0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3e6c], 0x10
lea rdx, [rsp + 0x3e6c]
lea rcx, [rsp + 0xfee0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f08], rax
cmp qword [rsp + 0x1f08], 0
je 0x140019136
lea rax, [rsp + 0x4d30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4d38]
lea r8, [rsp + 0x4d40]
lea rdx, [rsp + 0x4d48]
mov rcx, qword [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115ad8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2168], rax
cmp qword [rsp + 0x2168], 0xffffffffffffffff
je 0x14001918b
mov rcx, qword [rsp + 0x2168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5a4], 1
mov edx, 8
lea rcx, [rsp + 0x4618]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400191e3
mov eax, dword [rsp + 0x4618]
mov dword [rsp + 0x3014], eax
mov eax, dword [rsp + 0x461c]
mov dword [rsp + 0x3018], eax
mov ecx, dword [rsp + 0x5a4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5a4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0xb50], 0x3a506b2a
lea rdx, [0x140115ad0]
lea rcx, [rsp + 0xc7b0]
call fcn.1400038c4
lea rcx, [rsp + 0xc7b0]
call fcn.14000a750
mov r8d, dword [rsp + 0xb50]
mov rdx, rax
lea rcx, [0x140115af8]
call fcn.140015614
lea rcx, [rsp + 0xc7b0]
call fcn.14000389c
lea r9, [rsp + 0x4d50]
lea r8, [rsp + 0x4d58]
lea rdx, [rsp + 0x4d60]
lea rcx, [0x140115af0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x4d68]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xf050]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x4d70]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0xb54], 0x2c792b79
lea rdx, [0x140115b08]
lea rcx, [rsp + 0xc7d0]
call fcn.1400038c4
lea rcx, [rsp + 0xc7d0]
call fcn.14000a750
mov r8d, dword [rsp + 0xb54]
mov rdx, rax
lea rcx, [0x140115b00]
call fcn.140015614
lea rcx, [rsp + 0xc7d0]
call fcn.14000389c
lea rax, [rsp + 0x15840]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x140019303
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x140019335
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0x15840]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0x15840], al
jmp 0x1400192f3
mov dword [rsp + 0x5a8], 1
mov edx, 8
lea rcx, [rsp + 0x4620]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001938d
mov eax, dword [rsp + 0x4620]
mov dword [rsp + 0x301c], eax
mov eax, dword [rsp + 0x4624]
mov dword [rsp + 0x3020], eax
mov ecx, dword [rsp + 0x5a8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5a8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x3e68], 0x10
lea rdx, [rsp + 0x3e68]
lea rcx, [rsp + 0xff00]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x4d78]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115b20]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2170], rax
cmp qword [rsp + 0x2170], 0xffffffffffffffff
je 0x140019411
mov rcx, qword [rsp + 0x2170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3e64], 0x10
lea rdx, [rsp + 0x3e64]
lea rcx, [rsp + 0xff20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3e60], 0x10
lea rdx, [rsp + 0x3e60]
lea rcx, [rsp + 0xff40]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f00], rax
cmp qword [rsp + 0x1f00], 0
je 0x1400194bd
lea rax, [rsp + 0x4d80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4d88]
lea r8, [rsp + 0x4d90]
lea rdx, [rsp + 0x4d98]
mov rcx, qword [rsp + 0x1f00]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xb70], 0x2a8fcb2
lea rdx, [0x140115b14]
lea rcx, [rsp + 0xc7f0]
call fcn.1400038c4
lea rcx, [rsp + 0xc7f0]
call fcn.14000a750
mov r8d, dword [rsp + 0xb70]
mov rdx, rax
lea rcx, [0x140115b40]
call fcn.140015614
lea rcx, [rsp + 0xc7f0]
call fcn.14000389c
lea rax, [rsp + 0x15c40]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0
jmp 0x14001953e
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
movsxd rax, dword [rsp + 0x88]
cmp rax, 0x400
jae 0x140019570
movsxd rax, dword [rsp + 0x88]
mov al, byte [rsp + rax + 0x15c40]
inc al
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0x15c40], al
jmp 0x14001952e
lea r9, [rsp + 0x4da0]
lea r8, [rsp + 0x4da8]
lea rdx, [rsp + 0x4db0]
lea rcx, [0x140115b38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x16040]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x8c], 0
jmp 0x1400195c6
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
movsxd rax, dword [rsp + 0x8c]
cmp rax, 0x400
jae 0x1400195f8
movsxd rax, dword [rsp + 0x8c]
mov al, byte [rsp + rax + 0x16040]
inc al
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0x16040], al
jmp 0x1400195b6
mov dword [rsp + 0x3e5c], 0x10
lea rdx, [rsp + 0x3e5c]
lea rcx, [rsp + 0xff60]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xb80], 0xe29767f
lea rdx, [0x140115b50]
lea rcx, [rsp + 0xc810]
call fcn.1400038c4
lea rcx, [rsp + 0xc810]
call fcn.14000a750
mov r8d, dword [rsp + 0xb80]
mov rdx, rax
lea rcx, [0x140115b48]
call fcn.140015614
lea rcx, [rsp + 0xc810]
call fcn.14000389c
mov dword [rsp + 0xb84], 0x4fb0579
lea rdx, [0x140115b64]
lea rcx, [rsp + 0xc830]
call fcn.1400038c4
lea rcx, [rsp + 0xc830]
call fcn.14000a750
mov r8d, dword [rsp + 0xb84]
mov rdx, rax
lea rcx, [0x140115b5c]
call fcn.140015614
lea rcx, [rsp + 0xc830]
call fcn.14000389c
lea rcx, [rsp + 0x4db8]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1ef8], rax
cmp qword [rsp + 0x1ef8], 0
je 0x140019731
lea rax, [rsp + 0x4dc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4dc8]
lea r8, [rsp + 0x4dd0]
lea rdx, [rsp + 0x4dd8]
mov rcx, qword [rsp + 0x1ef8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1ef8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x4de0]
lea r8, [rsp + 0x4de8]
lea rdx, [rsp + 0x4df0]
lea rcx, [0x140115b78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xb88], 0x1bbcb9b0
lea rdx, [0x140115b6c]
lea rcx, [rsp + 0xc850]
call fcn.1400038c4
lea rcx, [rsp + 0xc850]
call fcn.14000a750
mov r8d, dword [rsp + 0xb88]
mov rdx, rax
lea rcx, [0x140115b88]
call fcn.140015614
lea rcx, [rsp + 0xc850]
call fcn.14000389c
mov dword [rsp + 0x3e58], 0x10
lea rdx, [rsp + 0x3e58]
lea rcx, [rsp + 0xff80]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x5ac], 1
mov edx, 8
lea rcx, [rsp + 0x4630]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001981f
mov eax, dword [rsp + 0x4630]
mov dword [rsp + 0x3024], eax
mov eax, dword [rsp + 0x4634]
mov dword [rsp + 0x3028], eax
mov ecx, dword [rsp + 0x5ac]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5ac]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0xb98], 0x2246cdf2
lea rdx, [0x140115b80]
lea rcx, [rsp + 0xc870]
call fcn.1400038c4
lea rcx, [rsp + 0xc870]
call fcn.14000a750
mov r8d, dword [rsp + 0xb98]
mov rdx, rax
lea rcx, [0x140115b9c]
call fcn.140015614
lea rcx, [rsp + 0xc870]
call fcn.14000389c
mov dword [rsp + 0xb9c], 0x1fed0ef3
lea rdx, [0x140115b90]
lea rcx, [rsp + 0xc890]
call fcn.1400038c4
lea rcx, [rsp + 0xc890]
call fcn.14000a750
mov r8d, dword [rsp + 0xb9c]
mov rdx, rax
lea rcx, [0x140115bb0]
call fcn.140015614
lea rcx, [rsp + 0xc890]
call fcn.14000389c
lea rax, [rsp + 0x16440]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
jmp 0x1400198f0
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 0x400
jae 0x140019922
movsxd rax, dword [rsp + 0x90]
mov al, byte [rsp + rax + 0x16440]
inc al
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0x16440], al
jmp 0x1400198e0
lea rax, [rsp + 0x16840]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x94], 0
jmp 0x140019953
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
cmp rax, 0x400
jae 0x140019985
movsxd rax, dword [rsp + 0x94]
mov al, byte [rsp + rax + 0x16840]
inc al
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0x16840], al
jmp 0x140019943
lea r9, [rsp + 0x4df8]
lea r8, [rsp + 0x4e00]
lea rdx, [rsp + 0x4e08]
lea rcx, [0x140115ba8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x5b0], 1
mov edx, 8
lea rcx, [rsp + 0x4638]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140019a02
mov eax, dword [rsp + 0x4638]
mov dword [rsp + 0x302c], eax
mov eax, dword [rsp + 0x463c]
mov dword [rsp + 0x3030], eax
mov ecx, dword [rsp + 0x5b0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5b0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xf060]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5b4], 1
mov edx, 8
lea rcx, [rsp + 0x4640]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140019a68
mov eax, dword [rsp + 0x4640]
mov dword [rsp + 0x3034], eax
mov eax, dword [rsp + 0x4644]
mov dword [rsp + 0x3038], eax
mov ecx, dword [rsp + 0x5b4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5b4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x4e10]
lea r8, [rsp + 0x4e18]
lea rdx, [rsp + 0x4e20]
lea rcx, [0x140115bc0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xba0], 0x309d1f52
lea rdx, [0x140115bb8]
lea rcx, [rsp + 0xc8b0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc8b0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xba0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc8b0]
call fcn.14000389c
lea rcx, [rsp + 0x4e28]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xf070]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1ee8], rax
cmp qword [rsp + 0x1ee8], 0
je 0x140019b73
lea rax, [rsp + 0x4e30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4e38]
lea r8, [rsp + 0x4e40]
lea rdx, [rsp + 0x4e48]
mov rcx, qword [rsp + 0x1ee8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1ee8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xba4], 0x1c8fe0e5
lea rdx, [0x140115bcc]
lea rcx, [rsp + 0xc8d0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc8d0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xba4]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc8d0]
call fcn.14000389c
lea rcx, [rsp + 0x4e50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0xba8], 0x310fa6df
lea rdx, [0x140115bc8]
lea rcx, [rsp + 0xc8f0]
call fcn.1400038c4
lea rcx, [rsp + 0xc8f0]
call fcn.14000a750
mov r8d, dword [rsp + 0xba8]
mov rdx, rax
lea rcx, [0x140115bd8]
call fcn.140015614
lea rcx, [rsp + 0xc8f0]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1ed0], rax
cmp qword [rsp + 0x1ed0], 0
je 0x140019c9b
lea rax, [rsp + 0x4e58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4e60]
lea r8, [rsp + 0x4e68]
lea rdx, [rsp + 0x4e70]
mov rcx, qword [rsp + 0x1ed0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1ed0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xbac], 0x1b7faa91
lea rdx, [0x140115bd4]
lea rcx, [rsp + 0xc910]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc910]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xbac]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc910]
call fcn.14000389c
lea rcx, [rsp + 0xf080]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1ec8], rax
cmp qword [rsp + 0x1ec8], 0
je 0x140019d73
lea rax, [rsp + 0x4e78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4e80]
lea r8, [rsp + 0x4e88]
lea rdx, [rsp + 0x4e90]
mov rcx, qword [rsp + 0x1ec8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1ec8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xf230]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x3e54], 0x10
lea rdx, [rsp + 0x3e54]
lea rcx, [rsp + 0xffa0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xbb8], 0x2ebf6e62
lea rdx, [0x140115be4]
lea rcx, [rsp + 0xc930]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc930]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xbb8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc930]
call fcn.14000389c
mov dword [rsp + 0x3e50], 0x10
lea rdx, [rsp + 0x3e50]
lea rcx, [rsp + 0xffc0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3e4c], 0x10
lea rdx, [rsp + 0x3e4c]
lea rcx, [rsp + 0xffe0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0xf240]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5b8], 1
mov edx, 8
lea rcx, [rsp + 0x4648]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140019eaa
mov eax, dword [rsp + 0x4648]
mov dword [rsp + 0x303c], eax
mov eax, dword [rsp + 0x464c]
mov dword [rsp + 0x3040], eax
mov ecx, dword [rsp + 0x5b8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5b8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x3e48], 0x10
lea rdx, [rsp + 0x3e48]
lea rcx, [rsp + 0x10000]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1eb8], rax
cmp qword [rsp + 0x1eb8], 0
je 0x140019f35
lea rax, [rsp + 0x4e98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4ea0]
lea r8, [rsp + 0x4ea8]
lea rdx, [rsp + 0x4eb0]
mov rcx, qword [rsp + 0x1eb8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1eb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5bc], 1
mov edx, 8
lea rcx, [rsp + 0x4650]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140019f8d
mov eax, dword [rsp + 0x4650]
mov dword [rsp + 0x3044], eax
mov eax, dword [rsp + 0x4654]
mov dword [rsp + 0x3048], eax
mov ecx, dword [rsp + 0x5bc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5bc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x16c40]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0
jmp 0x140019fbe
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
movsxd rax, dword [rsp + 0x98]
cmp rax, 0x400
jae 0x140019ff0
movsxd rax, dword [rsp + 0x98]
mov al, byte [rsp + rax + 0x16c40]
inc al
movsxd rcx, dword [rsp + 0x98]
mov byte [rsp + rcx + 0x16c40], al
jmp 0x140019fae
mov dword [rsp + 0xbd8], 0x62ba9eb
lea rdx, [0x140115be0]
lea rcx, [rsp + 0xc950]
call fcn.1400038c4
lea rcx, [rsp + 0xc950]
call fcn.14000a750
mov r8d, dword [rsp + 0xbd8]
mov rdx, rax
lea rcx, [0x140115bfc]
call fcn.140015614
lea rcx, [rsp + 0xc950]
call fcn.14000389c
mov dword [rsp + 0xbdc], 0x2ab80ab9
lea rdx, [0x140115bf0]
lea rcx, [rsp + 0xc970]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc970]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xbdc]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc970]
call fcn.14000389c
mov dword [rsp + 0xbe0], 0x24850c91
lea rdx, [0x140115c10]
lea rcx, [rsp + 0xc990]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xc990]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xbe0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xc990]
call fcn.14000389c
lea r9, [rsp + 0x4eb8]
lea r8, [rsp + 0x4ec0]
lea rdx, [rsp + 0x4ec8]
lea rcx, [0x140115c08]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x4ed0]
lea r8, [rsp + 0x4ed8]
lea rdx, [rsp + 0x4ee0]
lea rcx, [0x140115c30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x5c0], 1
mov edx, 8
lea rcx, [rsp + 0x4658]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001a1a2
mov eax, dword [rsp + 0x4658]
mov dword [rsp + 0x304c], eax
mov eax, dword [rsp + 0x465c]
mov dword [rsp + 0x3050], eax
mov ecx, dword [rsp + 0x5c0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5c0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0xbe4], 0x51c7b0
lea rdx, [0x140115c20]
lea rcx, [rsp + 0xc9b0]
call fcn.1400038c4
lea rcx, [rsp + 0xc9b0]
call fcn.14000a750
mov r8d, dword [rsp + 0xbe4]
mov rdx, rax
lea rcx, [0x140115c40]
call fcn.140015614
lea rcx, [rsp + 0xc9b0]
call fcn.14000389c
mov dword [rsp + 0x3e44], 0x10
lea rdx, [rsp + 0x3e44]
lea rcx, [rsp + 0x10020]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x17040]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x9c], 0
jmp 0x14001a244
mov eax, dword [rsp + 0x9c]
inc eax
mov dword [rsp + 0x9c], eax
movsxd rax, dword [rsp + 0x9c]
cmp rax, 0x400
jae 0x14001a276
movsxd rax, dword [rsp + 0x9c]
mov al, byte [rsp + rax + 0x17040]
inc al
movsxd rcx, dword [rsp + 0x9c]
mov byte [rsp + rcx + 0x17040], al
jmp 0x14001a234
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1eb0], rax
cmp qword [rsp + 0x1eb0], 0
je 0x14001a2e0
lea rax, [rsp + 0x4ee8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4ef0]
lea r8, [rsp + 0x4ef8]
lea rdx, [rsp + 0x4f00]
mov rcx, qword [rsp + 0x1eb0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1eb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x4f08]
lea r8, [rsp + 0x4f10]
lea rdx, [rsp + 0x4f18]
lea rcx, [0x140115c38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3e40], 0x10
lea rdx, [rsp + 0x3e40]
lea rcx, [rsp + 0x10040]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xbf8], 0x2fa0c1cb
lea rdx, [0x140115c50]
lea rcx, [rsp + 0xc9d0]
call fcn.1400038c4
lea rcx, [rsp + 0xc9d0]
call fcn.14000a750
mov r8d, dword [rsp + 0xbf8]
mov rdx, rax
lea rcx, [0x140115c48]
call fcn.140015614
lea rcx, [rsp + 0xc9d0]
call fcn.14000389c
lea r9, [rsp + 0x4f20]
lea r8, [rsp + 0x4f28]
lea rdx, [rsp + 0x4f30]
lea rcx, [0x140115c78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115c58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2178], rax
cmp qword [rsp + 0x2178], 0xffffffffffffffff
je 0x14001a3f0
mov rcx, qword [rsp + 0x2178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5c4], 1
mov edx, 8
lea rcx, [rsp + 0x4668]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001a448
mov eax, dword [rsp + 0x4668]
mov dword [rsp + 0x3054], eax
mov eax, dword [rsp + 0x466c]
mov dword [rsp + 0x3058], eax
mov ecx, dword [rsp + 0x5c4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5c4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115c90]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2180], rax
cmp qword [rsp + 0x2180], 0xffffffffffffffff
je 0x14001a49d
mov rcx, qword [rsp + 0x2180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x4f38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x3e3c], 0x10
lea rdx, [rsp + 0x3e3c]
lea rcx, [rsp + 0x10060]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1ea8], rax
cmp qword [rsp + 0x1ea8], 0
je 0x14001a536
lea rax, [rsp + 0x4f40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4f48]
lea r8, [rsp + 0x4f50]
lea rdx, [rsp + 0x4f58]
mov rcx, qword [rsp + 0x1ea8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1ea8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5c8], 1
mov edx, 8
lea rcx, [rsp + 0x4678]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001a58e
mov eax, dword [rsp + 0x4678]
mov dword [rsp + 0x305c], eax
mov eax, dword [rsp + 0x467c]
mov dword [rsp + 0x3060], eax
mov ecx, dword [rsp + 0x5c8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5c8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115c80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2188], rax
cmp qword [rsp + 0x2188], 0xffffffffffffffff
je 0x14001a5e3
mov rcx, qword [rsp + 0x2188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xc08], 0x39df9a54
lea rdx, [0x140115ca8]
lea rcx, [rsp + 0xc9f0]
call fcn.1400038c4
lea rcx, [rsp + 0xc9f0]
call fcn.14000a750
mov r8d, dword [rsp + 0xc08]
mov rdx, rax
lea rcx, [0x140115ca0]
call fcn.140015614
lea rcx, [rsp + 0xc9f0]
call fcn.14000389c
lea rcx, [rsp + 0x4f60]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x3e38], 0x10
lea rdx, [rsp + 0x3e38]
lea rcx, [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x17440]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
jmp 0x14001a693
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
cmp rax, 0x400
jae 0x14001a6c5
movsxd rax, dword [rsp + 0xa0]
mov al, byte [rsp + rax + 0x17440]
inc al
movsxd rcx, dword [rsp + 0xa0]
mov byte [rsp + rcx + 0x17440], al
jmp 0x14001a683
mov dword [rsp + 0x3e34], 0x10
lea rdx, [rsp + 0x3e34]
lea rcx, [rsp + 0x100a0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0xf410]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1e90], rax
cmp qword [rsp + 0x1e90], 0
je 0x14001a75e
lea rax, [rsp + 0x4f68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4f70]
lea r8, [rsp + 0x4f78]
lea rdx, [rsp + 0x4f80]
mov rcx, qword [rsp + 0x1e90]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1e90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115cb8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2190], rax
cmp qword [rsp + 0x2190], 0xffffffffffffffff
je 0x14001a7b3
mov rcx, qword [rsp + 0x2190]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3e30], 0x10
lea rdx, [rsp + 0x3e30]
lea rcx, [rsp + 0x100c0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xc28], 0x2453ed53
lea rdx, [0x140115cac]
lea rcx, [rsp + 0xca10]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xca10]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xc28]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xca10]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115cd8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2198], rax
cmp qword [rsp + 0x2198], 0xffffffffffffffff
je 0x14001a889
mov rcx, qword [rsp + 0x2198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x17840]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa4], 0
jmp 0x14001a8ba
mov eax, dword [rsp + 0xa4]
inc eax
mov dword [rsp + 0xa4], eax
movsxd rax, dword [rsp + 0xa4]
cmp rax, 0x400
jae 0x14001a8ec
movsxd rax, dword [rsp + 0xa4]
mov al, byte [rsp + rax + 0x17840]
inc al
movsxd rcx, dword [rsp + 0xa4]
mov byte [rsp + rcx + 0x17840], al
jmp 0x14001a8aa
mov dword [rsp + 0x3e2c], 0x10
lea rdx, [rsp + 0x3e2c]
lea rcx, [rsp + 0x100e0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xc38], 0x2cb0d040
lea rdx, [0x140115ccc]
lea rcx, [rsp + 0xca30]
call fcn.1400038c4
lea rcx, [rsp + 0xca30]
call fcn.14000a750
mov r8d, dword [rsp + 0xc38]
mov rdx, rax
lea rcx, [0x140115cf8]
call fcn.140015614
lea rcx, [rsp + 0xca30]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115ce8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x21a0], rax
cmp qword [rsp + 0x21a0], 0xffffffffffffffff
je 0x14001a9b2
mov rcx, qword [rsp + 0x21a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1e80], rax
cmp qword [rsp + 0x1e80], 0
je 0x14001aa1c
lea rax, [rsp + 0x4f88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4f90]
lea r8, [rsp + 0x4f98]
lea rdx, [rsp + 0x4fa0]
mov rcx, qword [rsp + 0x1e80]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1e80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x4fa8]
lea r8, [rsp + 0x4fb0]
lea rdx, [rsp + 0x4fb8]
lea rcx, [0x140115d08]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x4fc0]
lea r8, [rsp + 0x4fc8]
lea rdx, [rsp + 0x4fd0]
lea rcx, [0x140115d00]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xc3c], 0x28944eac
lea rdx, [0x140115d18]
lea rcx, [rsp + 0xca50]
call fcn.1400038c4
lea rcx, [rsp + 0xca50]
call fcn.14000a750
mov r8d, dword [rsp + 0xc3c]
mov rdx, rax
lea rcx, [0x140115d10]
call fcn.140015614
lea rcx, [rsp + 0xca50]
call fcn.14000389c
mov dword [rsp + 0x5cc], 1
mov edx, 8
lea rcx, [rsp + 0x46a0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001ab0e
mov eax, dword [rsp + 0x46a0]
mov dword [rsp + 0x3064], eax
mov eax, dword [rsp + 0x46a4]
mov dword [rsp + 0x3068], eax
mov ecx, dword [rsp + 0x5cc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5cc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xf420]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x4fd8]
lea r8, [rsp + 0x4fe0]
lea rdx, [rsp + 0x4fe8]
lea rcx, [0x140115d28]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x5d0], 1
mov edx, 8
lea rcx, [rsp + 0x46a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001ab99
mov eax, dword [rsp + 0x46a8]
mov dword [rsp + 0x306c], eax
mov eax, dword [rsp + 0x46ac]
mov dword [rsp + 0x3070], eax
mov ecx, dword [rsp + 0x5d0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5d0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x4ff0]
lea r8, [rsp + 0x4ff8]
lea rdx, [rsp + 0x5000]
lea rcx, [0x140115d20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xc40], 0xb5a4afd
lea rdx, [0x140115d48]
lea rcx, [rsp + 0xca70]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xca70]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xc40]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xca70]
call fcn.14000389c
lea rax, [rsp + 0x17c40]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa8], 0
jmp 0x14001ac4f
mov eax, dword [rsp + 0xa8]
inc eax
mov dword [rsp + 0xa8], eax
movsxd rax, dword [rsp + 0xa8]
cmp rax, 0x400
jae 0x14001ac81
movsxd rax, dword [rsp + 0xa8]
mov al, byte [rsp + rax + 0x17c40]
inc al
movsxd rcx, dword [rsp + 0xa8]
mov byte [rsp + rcx + 0x17c40], al
jmp 0x14001ac3f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115d30]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x21a8], rax
cmp qword [rsp + 0x21a8], 0xffffffffffffffff
je 0x14001acd6
mov rcx, qword [rsp + 0x21a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xc44], 0x2e05ebd5
lea rdx, [0x140115d58]
lea rcx, [rsp + 0xca90]
call fcn.1400038c4
lea rcx, [rsp + 0xca90]
call fcn.14000a750
mov r8d, dword [rsp + 0xc44]
mov rdx, rax
lea rcx, [0x140115d50]
call fcn.140015614
lea rcx, [rsp + 0xca90]
call fcn.14000389c
mov dword [rsp + 0xc48], 0x3a380586
lea rdx, [0x140115d64]
lea rcx, [rsp + 0xcab0]
call fcn.1400038c4
lea rcx, [rsp + 0xcab0]
call fcn.14000a750
mov r8d, dword [rsp + 0xc48]
mov rdx, rax
lea rcx, [0x140115d5c]
call fcn.140015614
lea rcx, [rsp + 0xcab0]
call fcn.14000389c
lea rcx, [rsp + 0xf430]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5d4], 1
mov edx, 8
lea rcx, [rsp + 0x46b8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001addc
mov eax, dword [rsp + 0x46b8]
mov dword [rsp + 0x3074], eax
mov eax, dword [rsp + 0x46bc]
mov dword [rsp + 0x3078], eax
mov ecx, dword [rsp + 0x5d4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5d4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x3e28], 0x10
lea rdx, [rsp + 0x3e28]
lea rcx, [rsp + 0x10100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x18040]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xac], 0
jmp 0x14001ae2e
mov eax, dword [rsp + 0xac]
inc eax
mov dword [rsp + 0xac], eax
movsxd rax, dword [rsp + 0xac]
cmp rax, 0x400
jae 0x14001ae60
movsxd rax, dword [rsp + 0xac]
mov al, byte [rsp + rax + 0x18040]
inc al
movsxd rcx, dword [rsp + 0xac]
mov byte [rsp + rcx + 0x18040], al
jmp 0x14001ae1e
lea rcx, [rsp + 0x5008]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x3e24], 0x10
lea rdx, [rsp + 0x3e24]
lea rcx, [rsp + 0x10120]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x18440]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xb0], 0
jmp 0x14001aec0
mov eax, dword [rsp + 0xb0]
inc eax
mov dword [rsp + 0xb0], eax
movsxd rax, dword [rsp + 0xb0]
cmp rax, 0x400
jae 0x14001aef2
movsxd rax, dword [rsp + 0xb0]
mov al, byte [rsp + rax + 0x18440]
inc al
movsxd rcx, dword [rsp + 0xb0]
mov byte [rsp + rcx + 0x18440], al
jmp 0x14001aeb0
lea rcx, [rsp + 0xf440]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xf450]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1e78], rax
cmp qword [rsp + 0x1e78], 0
je 0x14001af78
lea rax, [rsp + 0x5010]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5018]
lea r8, [rsp + 0x5020]
lea rdx, [rsp + 0x5028]
mov rcx, qword [rsp + 0x1e78]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1e78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5030]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x5038]
lea r8, [rsp + 0x5040]
lea rdx, [rsp + 0x5048]
lea rcx, [0x140115d78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xf460]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x5d8], 1
mov edx, 8
lea rcx, [rsp + 0x46c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b011
mov eax, dword [rsp + 0x46c0]
mov dword [rsp + 0x307c], eax
mov eax, dword [rsp + 0x46c4]
mov dword [rsp + 0x3080], eax
mov ecx, dword [rsp + 0x5d8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5d8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x5050]
lea r8, [rsp + 0x5058]
lea rdx, [rsp + 0x5060]
lea rcx, [0x140115d70]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xc60], 0x851a062
lea rdx, [0x140115d88]
lea rcx, [rsp + 0xcad0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xcad0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xc60]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xcad0]
call fcn.14000389c
lea r9, [rsp + 0x5068]
lea r8, [rsp + 0x5070]
lea rdx, [rsp + 0x5078]
lea rcx, [0x140115d80]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xc64], 0x2b9c2c3f
lea rdx, [0x140115d98]
lea rcx, [rsp + 0xcaf0]
call fcn.1400038c4
lea rcx, [rsp + 0xcaf0]
call fcn.14000a750
mov r8d, dword [rsp + 0xc64]
mov rdx, rax
lea rcx, [0x140115d90]
call fcn.140015614
lea rcx, [rsp + 0xcaf0]
call fcn.14000389c
mov dword [rsp + 0x5dc], 1
mov edx, 8
lea rcx, [rsp + 0x46c8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b163
mov eax, dword [rsp + 0x46c8]
mov dword [rsp + 0x3084], eax
mov eax, dword [rsp + 0x46cc]
mov dword [rsp + 0x3088], eax
mov ecx, dword [rsp + 0x5dc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5dc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xf470]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xc68], 0x18ea4fe0
lea rdx, [0x140115dc0]
lea rcx, [rsp + 0xcb10]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xcb10]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xc68]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xcb10]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115da0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x21b0], rax
cmp qword [rsp + 0x21b0], 0xffffffffffffffff
je 0x14001b226
mov rcx, qword [rsp + 0x21b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115de0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x21b8], rax
cmp qword [rsp + 0x21b8], 0xffffffffffffffff
je 0x14001b27b
mov rcx, qword [rsp + 0x21b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5080]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x5e0], 1
mov edx, 8
lea rcx, [rsp + 0x46e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b2e1
mov eax, dword [rsp + 0x46e0]
mov dword [rsp + 0x308c], eax
mov eax, dword [rsp + 0x46e4]
mov dword [rsp + 0x3090], eax
mov ecx, dword [rsp + 0x5e0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5e0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115dd0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x21c0], rax
cmp qword [rsp + 0x21c0], 0xffffffffffffffff
je 0x14001b336
mov rcx, qword [rsp + 0x21c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5088]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1e70], rax
cmp qword [rsp + 0x1e70], 0
je 0x14001b3ae
lea rax, [rsp + 0x5090]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5098]
lea r8, [rsp + 0x50a0]
lea rdx, [rsp + 0x50a8]
mov rcx, qword [rsp + 0x1e70]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1e70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xf480]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x3e20], 0x10
lea rdx, [rsp + 0x3e20]
lea rcx, [rsp + 0x10140]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x50b0]
lea r8, [rsp + 0x50b8]
lea rdx, [rsp + 0x50c0]
lea rcx, [0x140115e00]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x50c8]
lea r8, [rsp + 0x50d0]
lea rdx, [rsp + 0x50d8]
lea rcx, [0x140115df8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115e10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x21c8], rax
cmp qword [rsp + 0x21c8], 0xffffffffffffffff
je 0x14001b47c
mov rcx, qword [rsp + 0x21c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3c48], 0x10
lea rdx, [rsp + 0x3c48]
lea rcx, [rsp + 0x10160]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xc80], 0x8aaab41
lea rdx, [0x140115e08]
lea rcx, [rsp + 0xcb30]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xcb30]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xc80]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xcb30]
call fcn.14000389c
mov dword [rsp + 0x5e4], 1
mov edx, 8
lea rcx, [rsp + 0x46f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b555
mov eax, dword [rsp + 0x46f8]
mov dword [rsp + 0x3094], eax
mov eax, dword [rsp + 0x46fc]
mov dword [rsp + 0x3098], eax
mov ecx, dword [rsp + 0x5e4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x5e4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xf490]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xc84], 0x160acea6
lea rdx, [0x140115e3c]
lea rcx, [rsp + 0xcb50]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xcb50]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0xc84]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xcb50]
call fcn.14000389c
mov dword [rsp + 0x3d50], 0x10
lea rdx, [rsp + 0x3d50]
lea rcx, [rsp + 0x10180]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140115e20]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x21d0], rax
cmp qword [rsp + 0x21d0], 0xffffffffffffffff
je 0x14001b639