Function at 0x140084a5c
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rdi
mov eax, 0x27780
call fcn.1400b6760
sub rsp, rax
mov rax, qword [0x14010c080]
xor rax, rsp
mov qword [rsp + 0x27770], rax
lea rcx, [rsp + 0x3440]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x12ec], 0x10
lea rdx, [rsp + 0x12ec]
lea rcx, [rsp + 0x55d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x450], 0x8fd4368
lea rdx, str.5nvNfCK
lea rcx, [rsp + 0x4190]
call fcn.140003708
nop
lea rdx, [rsp + 0x4190]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x450]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4190]
call fcn.1400040f0
mov dword [rsp + 0x12e8], 0x10
lea rdx, [rsp + 0x12e8]
lea rcx, [rsp + 0x55f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x3448]
lea r8, [rsp + 0x1860]
lea rdx, [rsp + 0x1868]
lea rcx, [0x1400ec5e0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.6pOdcMl5C.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbf0], rax
cmp qword [rsp + 0xbf0], 0xffffffffffffffff
je 0x140084ba7
mov rcx, qword [rsp + 0xbf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1870]
lea r8, [rsp + 0x1878]
lea rdx, [rsp + 0x1880]
lea rcx, [0x1400ec608]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x258], 1
mov edx, 8
lea rcx, [rsp + 0x14b0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140084c24
mov eax, dword [rsp + 0x14b0]
mov dword [rsp + 0x1120], eax
mov eax, dword [rsp + 0x14b4]
mov dword [rsp + 0x1124], eax
mov ecx, dword [rsp + 0x258]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x258]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x460], 0x1f820b7d
lea rdx, [0x1400ec610]
lea rcx, [rsp + 0x41b0]
call fcn.140003708
nop
lea rdx, [rsp + 0x41b0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x460]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x41b0]
call fcn.1400040f0
lea rcx, [rsp + 0x1888]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x1890]
lea r8, [rsp + 0x1898]
lea rdx, [rsp + 0x18a0]
lea rcx, [0x1400ec618]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.dpzZE6.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbf8], rax
cmp qword [rsp + 0xbf8], 0xffffffffffffffff
je 0x140084d0c
mov rcx, qword [rsp + 0xbf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x18a8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x50b0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.AizUBri.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc00], rax
cmp qword [rsp + 0xc00], 0xffffffffffffffff
je 0x140084d7d
mov rcx, qword [rsp + 0xc00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xba0], rax
cmp qword [rsp + 0xba0], 0
je 0x140084de7
lea rax, [rsp + 0x18b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x18b8]
lea r8, [rsp + 0x18c0]
lea rdx, [rsp + 0x18c8]
mov rcx, qword [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Ym.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc08], rax
cmp qword [rsp + 0xc08], 0xffffffffffffffff
je 0x140084e3c
mov rcx, qword [rsp + 0xc08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5350]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x5360]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ggvRUIzEx6.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc10], rax
cmp qword [rsp + 0xc10], 0xffffffffffffffff
je 0x140084ead
mov rcx, qword [rsp + 0xc10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x464], 0x212069fe
lea rdx, str.cbrZeUOWrZ
lea rcx, [rsp + 0x41d0]
call fcn.140003708
nop
lea rdx, [rsp + 0x41d0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x464]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x41d0]
call fcn.1400040f0
lea rcx, [rsp + 0x18d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x12e4], 0x10
lea rdx, [rsp + 0x12e4]
lea rcx, [rsp + 0x5610]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x6370]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
jmp 0x140084f64
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0x400
jae 0x140084f8d
movsxd rax, dword [rsp + 0x44]
mov al, byte [rsp + rax + 0x6370]
inc al
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0x6370], al
jmp 0x140084f5a
mov dword [rsp + 0x470], 0xe82179c
lea rdx, str.lYMHp2
lea rcx, [rsp + 0x41f0]
call fcn.140003708
lea rcx, [rsp + 0x41f0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x470]
mov rdx, rax
lea rcx, [0x1400ec694]
call fcn.140044734
lea rcx, [rsp + 0x41f0]
call fcn.1400040f0
lea r9, [rsp + 0x18d8]
lea r8, [rsp + 0x18e0]
lea rdx, [rsp + 0x18e8]
lea rcx, [0x1400ec6a0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb78], rax
cmp qword [rsp + 0xb78], 0
je 0x14008506c
lea rax, [rsp + 0x18f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x18f8]
lea r8, [rsp + 0x1900]
lea rdx, [rsp + 0x1908]
mov rcx, qword [rsp + 0xb78]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xb78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x25c], 1
mov edx, 8
lea rcx, [rsp + 0x14b8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400850c4
mov eax, dword [rsp + 0x14b8]
mov dword [rsp + 0x1128], eax
mov eax, dword [rsp + 0x14bc]
mov dword [rsp + 0x112c], eax
mov ecx, dword [rsp + 0x25c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x25c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.EeYB.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc18], rax
cmp qword [rsp + 0xc18], 0xffffffffffffffff
je 0x140085119
mov rcx, qword [rsp + 0xc18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1910]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x6770]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
jmp 0x14008514f
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x400
jae 0x140085178
movsxd rax, dword [rsp + 0x48]
mov al, byte [rsp + rax + 0x6770]
inc al
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0x6770], al
jmp 0x140085145
lea rcx, [rsp + 0x5370]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1918]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x474], 0x1e84da73
lea rdx, str.7tYXqZ30
lea rcx, [rsp + 0x4210]
call fcn.140003708
lea rcx, [rsp + 0x4210]
call fcn.14000a93c
mov r8d, dword [rsp + 0x474]
mov rdx, rax
lea rcx, [0x1400ec6cc]
call fcn.140044734
lea rcx, [rsp + 0x4210]
call fcn.1400040f0
lea r9, [rsp + 0x1920]
lea r8, [rsp + 0x1928]
lea rdx, [rsp + 0x1930]
lea rcx, [0x1400ec6d8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x6b70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 0
jmp 0x140085231
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
cmp rax, 0x400
jae 0x14008525a
movsxd rax, dword [rsp + 0x4c]
mov al, byte [rsp + rax + 0x6b70]
inc al
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x6b70], al
jmp 0x140085227
mov dword [rsp + 0x12e0], 0x10
lea rdx, [rsp + 0x12e0]
lea rcx, [rsp + 0x5630]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x260], 1
mov edx, 8
lea rcx, [rsp + 0x14c8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400852d3
mov eax, dword [rsp + 0x14c8]
mov dword [rsp + 0x1130], eax
mov eax, dword [rsp + 0x14cc]
mov dword [rsp + 0x1134], eax
mov ecx, dword [rsp + 0x260]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x260]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x6f70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x1400852fb
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x140085324
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0x6f70]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x6f70], al
jmp 0x1400852f1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.qTKNVrjd.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc20], rax
cmp qword [rsp + 0xc20], 0xffffffffffffffff
je 0x140085379
mov rcx, qword [rsp + 0xc20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1938]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x480], 0x29ed5884
lea rdx, str.Z048N
lea rcx, [rsp + 0x4230]
call fcn.140003708
lea rcx, [rsp + 0x4230]
call fcn.14000a93c
mov r8d, dword [rsp + 0x480]
mov rdx, rax
lea rcx, [0x1400ec704]
call fcn.140044734
lea rcx, [rsp + 0x4230]
call fcn.1400040f0
mov dword [rsp + 0x12dc], 0x10
lea rdx, [rsp + 0x12dc]
lea rcx, [rsp + 0x5650]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x490], 0x1d165c37
lea rdx, str.OPEl
lea rcx, [rsp + 0x4250]
call fcn.140003708
nop
lea rdx, [rsp + 0x4250]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x490]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4250]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400ec718]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc28], rax
cmp qword [rsp + 0xc28], 0xffffffffffffffff
je 0x1400854ad
mov rcx, qword [rsp + 0xc28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x494], 0x20db8378
lea rdx, str.v1mCL
lea rcx, [rsp + 0x4270]
call fcn.140003708
lea rcx, [rsp + 0x4270]
call fcn.14000a93c
mov r8d, dword [rsp + 0x494]
mov rdx, rax
lea rcx, [0x1400ec72c]
call fcn.140044734
lea rcx, [rsp + 0x4270]
call fcn.1400040f0
lea rcx, [rsp + 0x1940]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x12d8], 0x10
lea rdx, [rsp + 0x12d8]
lea rcx, [rsp + 0x5670]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x264], 1
mov edx, 8
lea rcx, [rsp + 0x14d0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140085584
mov eax, dword [rsp + 0x14d0]
mov dword [rsp + 0x1138], eax
mov eax, dword [rsp + 0x14d4]
mov dword [rsp + 0x113c], eax
mov ecx, dword [rsp + 0x264]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x264]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb68], rax
cmp qword [rsp + 0xb68], 0
je 0x1400855ee
lea rax, [rsp + 0x1948]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1950]
lea r8, [rsp + 0x1958]
lea rdx, [rsp + 0x1960]
mov rcx, qword [rsp + 0xb68]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xb68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb60], rax
cmp qword [rsp + 0xb60], 0
je 0x140085658
lea rax, [rsp + 0x1968]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1970]
lea r8, [rsp + 0x1978]
lea rdx, [rsp + 0x1980]
mov rcx, qword [rsp + 0xb60]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xb60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x268], 1
mov edx, 8
lea rcx, [rsp + 0x14d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400856b0
mov eax, dword [rsp + 0x14d8]
mov dword [rsp + 0x1140], eax
mov eax, dword [rsp + 0x14dc]
mov dword [rsp + 0x1144], eax
mov ecx, dword [rsp + 0x268]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x268]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x1988]
lea r8, [rsp + 0x1990]
lea rdx, [rsp + 0x1998]
lea rcx, [0x1400ec738]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x26c], 1
mov edx, 8
lea rcx, [rsp + 0x14f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008572d
mov eax, dword [rsp + 0x14f0]
mov dword [rsp + 0x1148], eax
mov eax, dword [rsp + 0x14f4]
mov dword [rsp + 0x114c], eax
mov ecx, dword [rsp + 0x26c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x26c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x12d4], 0x10
lea rdx, [rsp + 0x12d4]
lea rcx, [rsp + 0x5690]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x19a0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x5380]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x19a8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x4a8], 0x2ee4cdc3
lea rdx, str.mYafbjKK0F
lea rcx, [rsp + 0x4290]
call fcn.140003708
lea rcx, [rsp + 0x4290]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4a8]
mov rdx, rax
lea rcx, [0x1400ec74c]
call fcn.140044734
lea rcx, [rsp + 0x4290]
call fcn.1400040f0
mov dword [rsp + 0x4ac], 0x86db09
lea rdx, [0x1400ec754]
lea rcx, [rsp + 0x42b0]
call fcn.140003708
nop
lea rdx, [rsp + 0x42b0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4ac]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x42b0]
call fcn.1400040f0
lea r9, [rsp + 0x19b0]
lea r8, [rsp + 0x19b8]
lea rdx, [rsp + 0x19c0]
lea rcx, [0x1400ec758]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x7370]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x140085875
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x14008589e
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0x7370]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0x7370], al
jmp 0x14008586b
lea rcx, [rsp + 0x19c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x19d0]
lea r8, [rsp + 0x19d8]
lea rdx, [rsp + 0x19e0]
lea rcx, [0x1400ec760]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x4b0], 0x13f95e67
lea rdx, str.j42sD
lea rcx, [rsp + 0x42d0]
call fcn.140003708
nop
lea rdx, [rsp + 0x42d0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4b0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x42d0]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Sa1WLgs.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc30], rax
cmp qword [rsp + 0xc30], 0xffffffffffffffff
je 0x140085986
mov rcx, qword [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4b4], 0x3720fbc9
lea rdx, [0x1400ec788]
lea rcx, [rsp + 0x42f0]
call fcn.140003708
nop
lea rdx, [rsp + 0x42f0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4b4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x42f0]
call fcn.1400040f0
lea rax, [rsp + 0x7770]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x140085a0e
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x140085a37
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0x7770]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0x7770], al
jmp 0x140085a04
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.SGyFCYA.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc38], rax
cmp qword [rsp + 0xc38], 0xffffffffffffffff
je 0x140085a8c
mov rcx, qword [rsp + 0xc38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4b8], 0x2993829d
lea rdx, str.SI0sIg
lea rcx, [rsp + 0x4310]
call fcn.140003708
nop
lea rdx, [rsp + 0x4310]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4b8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4310]
call fcn.1400040f0
lea rcx, [rsp + 0x5390]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x4bc], 0x34ff408
lea rdx, str.cxFU6
lea rcx, [rsp + 0x4330]
call fcn.140003708
nop
lea rdx, [rsp + 0x4330]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4bc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4330]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb48], rax
cmp qword [rsp + 0xb48], 0
je 0x140085bc4
lea rax, [rsp + 0x19e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x19f0]
lea r8, [rsp + 0x19f8]
lea rdx, [rsp + 0x1a00]
mov rcx, qword [rsp + 0xb48]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xb48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x270], 1
mov edx, 8
lea rcx, [rsp + 0x1510]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140085c1c
mov eax, dword [rsp + 0x1510]
mov dword [rsp + 0x1150], eax
mov eax, dword [rsp + 0x1514]
mov dword [rsp + 0x1154], eax
mov ecx, dword [rsp + 0x270]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x270]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x4c0], 0xfdd2c39
lea rdx, [0x1400ec7b8]
lea rcx, [rsp + 0x4350]
call fcn.140003708
nop
lea rdx, [rsp + 0x4350]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4c0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4350]
call fcn.1400040f0
lea rcx, [rsp + 0x53a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1a08]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.jDtfg.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc40], rax
cmp qword [rsp + 0xc40], 0xffffffffffffffff
je 0x140085ced
mov rcx, qword [rsp + 0xc40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1a10]
lea r8, [rsp + 0x1a18]
lea rdx, [rsp + 0x1a20]
lea rcx, [0x1400ec7d8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb38], rax
cmp qword [rsp + 0xb38], 0
je 0x140085d7c
lea rax, [rsp + 0x1a28]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a30]
lea r8, [rsp + 0x1a38]
lea rdx, [rsp + 0x1a40]
mov rcx, qword [rsp + 0xb38]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xb38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x53b0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x12d0], 0x10
lea rdx, [rsp + 0x12d0]
lea rcx, [rsp + 0x56b0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x1a48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x12cc], 0x10
lea rdx, [rsp + 0x12cc]
lea rcx, [rsp + 0x56d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x4d8], 0x27f5f77e
lea rdx, [0x1400ec7e0]
lea rcx, [rsp + 0x4370]
call fcn.140003708
nop
lea rdx, [rsp + 0x4370]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4d8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4370]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb28], rax
cmp qword [rsp + 0xb28], 0
je 0x140085ea4
lea rax, [rsp + 0x1a50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a58]
lea r8, [rsp + 0x1a60]
lea rdx, [rsp + 0x1a68]
mov rcx, qword [rsp + 0xb28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xb28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4dc], 0x275a65d1
lea rdx, [0x1400ec7e4]
lea rcx, [rsp + 0x4390]
call fcn.140003708
nop
lea rdx, [rsp + 0x4390]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4dc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4390]
call fcn.1400040f0
lea rcx, [rsp + 0x53c0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x4e0], 0x18c3289c
lea rdx, str.weF3Ys
lea rcx, [rsp + 0x43b0]
call fcn.140003708
lea rcx, [rsp + 0x43b0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4e0]
mov rdx, rax
lea rcx, [0x1400ec7f0]
call fcn.140044734
lea rcx, [rsp + 0x43b0]
call fcn.1400040f0
mov dword [rsp + 0x12c8], 0x10
lea rdx, [rsp + 0x12c8]
lea rcx, [rsp + 0x56f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x274], 1
mov edx, 8
lea rcx, [rsp + 0x1528]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140085fdb
mov eax, dword [rsp + 0x1528]
mov dword [rsp + 0x1158], eax
mov eax, dword [rsp + 0x152c]
mov dword [rsp + 0x115c], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x4f0], 0x2d7fdf73
lea rdx, str.Wz2RtT6kD
lea rcx, [rsp + 0x43d0]
call fcn.140003708
nop
lea rdx, [rsp + 0x43d0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x4f0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x43d0]
call fcn.1400040f0
mov dword [rsp + 0x4f4], 0x1b391f7
lea rdx, str.YRa38b0m4
lea rcx, [rsp + 0x43f0]
call fcn.140003708
lea rcx, [rsp + 0x43f0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4f4]
mov rdx, rax
lea rcx, [0x1400ec814]
call fcn.140044734
lea rcx, [rsp + 0x43f0]
call fcn.1400040f0
lea rax, [rsp + 0x7b70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x1400860b3
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x1400860dc
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0x7b70]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0x7b70], al
jmp 0x1400860a9
lea r9, [rsp + 0x1a70]
lea r8, [rsp + 0x1a78]
lea rdx, [rsp + 0x1a80]
lea rcx, [0x1400ec820]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x4f8], 0x20887512
lea rdx, str.kO3b2kX
lea rcx, [rsp + 0x4410]
call fcn.140003708
lea rcx, [rsp + 0x4410]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4f8]
mov rdx, rax
lea rcx, [0x1400ec830]
call fcn.140044734
lea rcx, [rsp + 0x4410]
call fcn.1400040f0
lea rcx, [rsp + 0x1a88]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x7f70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x140086187
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x1400861b0
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0x7f70]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0x7f70], al
jmp 0x14008617d
lea rax, [rsp + 0x8370]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x1400861d8
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x140086201
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0x8370]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0x8370], al
jmp 0x1400861ce
lea r9, [rsp + 0x1a90]
lea r8, [rsp + 0x1a98]
lea rdx, [rsp + 0x1aa0]
lea rcx, [0x1400ec838]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x4fc], 0x12f3e9ee
lea rdx, str.Dtcsvgh
lea rcx, [rsp + 0x4430]
call fcn.140003708
lea rcx, [rsp + 0x4430]
call fcn.14000a93c
mov r8d, dword [rsp + 0x4fc]
mov rdx, rax
lea rcx, [0x1400ec848]
call fcn.140044734
lea rcx, [rsp + 0x4430]
call fcn.1400040f0
mov dword [rsp + 0x500], 0xbeeb931
lea rdx, str.74mN04
lea rcx, [rsp + 0x4450]
call fcn.140003708
nop
lea rdx, [rsp + 0x4450]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x500]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4450]
call fcn.1400040f0
lea rcx, [rsp + 0x1aa8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1ab0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x8770]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x14008631a
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x140086343
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0x8770]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0x8770], al
jmp 0x140086310
lea r9, [rsp + 0x1ab8]
lea r8, [rsp + 0x1ac0]
lea rdx, [rsp + 0x1ac8]
lea rcx, [0x1400ec858]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x504], 0x3584adb6
lea rdx, str.8A7BCfuu
lea rcx, [rsp + 0x4470]
call fcn.140003708
nop
lea rdx, [rsp + 0x4470]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x504]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4470]
call fcn.1400040f0
lea r9, [rsp + 0x1ad0]
lea r8, [rsp + 0x1ad8]
lea rdx, [rsp + 0x1ae0]
lea rcx, [0x1400ec870]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.FX.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc48], rax
cmp qword [rsp + 0xc48], 0xffffffffffffffff
je 0x140086442
mov rcx, qword [rsp + 0xc48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x12c4], 0x10
lea rdx, [rsp + 0x12c4]
lea rcx, [rsp + 0x5710]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.zJgV.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc50], rax
cmp qword [rsp + 0xc50], 0xffffffffffffffff
je 0x1400864b8
mov rcx, qword [rsp + 0xc50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Bmp.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc58], rax
cmp qword [rsp + 0xc58], 0xffffffffffffffff
je 0x14008650d
mov rcx, qword [rsp + 0xc58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb08], rax
cmp qword [rsp + 0xb08], 0
je 0x140086577
lea rax, [rsp + 0x1ae8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1af0]
lea r8, [rsp + 0x1af8]
lea rdx, [rsp + 0x1b00]
mov rcx, qword [rsp + 0xb08]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xb08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x8b70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x14008659f
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x1400865c8
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0x8b70]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0x8b70], al
jmp 0x140086595
mov dword [rsp + 0x510], 0x2550c7cd
lea rdx, [0x1400ec8b0]
lea rcx, [rsp + 0x4490]
call fcn.140003708
lea rcx, [rsp + 0x4490]
call fcn.14000a93c
mov r8d, dword [rsp + 0x510]
mov rdx, rax
lea rcx, [0x1400ec8b4]
call fcn.140044734
lea rcx, [rsp + 0x4490]
call fcn.1400040f0
mov dword [rsp + 0x514], 0x160a4744
lea rdx, [0x1400ec8bc]
lea rcx, [rsp + 0x44b0]
call fcn.140003708
lea rcx, [rsp + 0x44b0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x514]
mov rdx, rax
lea rcx, [0x1400ec8c0]
call fcn.140044734
lea rcx, [rsp + 0x44b0]
call fcn.1400040f0
mov dword [rsp + 0x13fc], 0x10
lea rdx, [rsp + 0x13fc]
lea rcx, [rsp + 0x5730]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x1474], 0x10
lea rdx, [rsp + 0x1474]
lea rcx, [rsp + 0x5750]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x8f70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x1400866d2
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x1400866fb
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0x8f70]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0x8f70], al
jmp 0x1400866c8
mov dword [rsp + 0x528], 0x9b34246
lea rdx, str.sSOqB2VI
lea rcx, [rsp + 0x44d0]
call fcn.140003708
lea rcx, [rsp + 0x44d0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x528]
mov rdx, rax
lea rcx, [0x1400ec8d4]
call fcn.140044734
lea rcx, [rsp + 0x44d0]
call fcn.1400040f0
lea rcx, [rsp + 0x53d0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x278], 1
mov edx, 8
lea rcx, [rsp + 0x1530]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400867b1
mov eax, dword [rsp + 0x1530]
mov dword [rsp + 0x1160], eax
mov eax, dword [rsp + 0x1534]
mov dword [rsp + 0x1164], eax
mov ecx, dword [rsp + 0x278]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x278]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x9370]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x1400867d9
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x140086802
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0x9370]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0x9370], al
jmp 0x1400867cf
lea rax, [rsp + 0x9770]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x14008682a
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x140086853
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0x9770]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0x9770], al
jmp 0x140086820
mov dword [rsp + 0x52c], 0x130014a6
lea rdx, str.PZe5
lea rcx, [rsp + 0x44f0]
call fcn.140003708
nop
lea rdx, [rsp + 0x44f0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x52c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x44f0]
call fcn.1400040f0
mov dword [rsp + 0x1470], 0x10
lea rdx, [rsp + 0x1470]
lea rcx, [rsp + 0x5770]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x146c], 0x10
lea rdx, [rsp + 0x146c]
lea rcx, [rsp + 0x5790]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x9b70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x14008691d
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x140086946
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0x9b70]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0x9b70], al
jmp 0x140086913
lea rcx, [rsp + 0x1b08]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.XZlf.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc60], rax
cmp qword [rsp + 0xc60], 0xffffffffffffffff
je 0x1400869a9
mov rcx, qword [rsp + 0xc60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x540], 0x2aed76b
lea rdx, [0x1400ec8fc]
lea rcx, [rsp + 0x4510]
call fcn.140003708
lea rcx, [rsp + 0x4510]
call fcn.14000a93c
mov r8d, dword [rsp + 0x540]
mov rdx, rax
lea rcx, [0x1400ec900]
call fcn.140044734
lea rcx, [rsp + 0x4510]
call fcn.1400040f0
lea rcx, [rsp + 0x53e0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x53f0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x544], 0x34cacdb5
lea rdx, [0x1400ec908]
lea rcx, [rsp + 0x4530]
call fcn.140003708
nop
lea rdx, [rsp + 0x4530]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x544]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4530]
call fcn.1400040f0
lea rcx, [rsp + 0x5400]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x1b10]
lea r8, [rsp + 0x1b18]
lea rdx, [rsp + 0x1b20]
lea rcx, [0x1400ec910]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xaf8], rax
cmp qword [rsp + 0xaf8], 0
je 0x140086b12
lea rax, [rsp + 0x1b28]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1b30]
lea r8, [rsp + 0x1b38]
lea rdx, [rsp + 0x1b40]
mov rcx, qword [rsp + 0xaf8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xaf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1b48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x548], 0x64e2c25
lea rdx, str.od4QMPIh
lea rcx, [rsp + 0x4550]
call fcn.140003708
lea rcx, [rsp + 0x4550]
call fcn.14000a93c
mov r8d, dword [rsp + 0x548]
mov rdx, rax
lea rcx, [0x1400ec924]
call fcn.140044734
lea rcx, [rsp + 0x4550]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xae8], rax
cmp qword [rsp + 0xae8], 0
je 0x140086bda
lea rax, [rsp + 0x1b50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1b58]
lea r8, [rsp + 0x1b60]
lea rdx, [rsp + 0x1b68]
mov rcx, qword [rsp + 0xae8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xae8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1468], 0x10
lea rdx, [rsp + 0x1468]
lea rcx, [rsp + 0x57b0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1b70]
lea r8, [rsp + 0x1b78]
lea rdx, [rsp + 0x1b80]
lea rcx, [0x1400ec930]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1464], 0x10
lea rdx, [rsp + 0x1464]
lea rcx, [rsp + 0x57d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x5410]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x1b88]
lea r8, [rsp + 0x1b90]
lea rdx, [rsp + 0x1b98]
lea rcx, [0x1400ec938]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xae0], rax
cmp qword [rsp + 0xae0], 0
je 0x140086cde
lea rax, [rsp + 0x1ba0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ba8]
lea r8, [rsp + 0x1bb0]
lea rdx, [rsp + 0x1bb8]
mov rcx, qword [rsp + 0xae0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xae0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1bc0]
lea r8, [rsp + 0x1bc8]
lea rdx, [rsp + 0x1bd0]
lea rcx, [0x1400ec940]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.qjfYKwfqX.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc68], rax
cmp qword [rsp + 0xc68], 0xffffffffffffffff
je 0x140086d58
mov rcx, qword [rsp + 0xc68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xac8], rax
cmp qword [rsp + 0xac8], 0
je 0x140086dc2
lea rax, [rsp + 0x1bd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1be0]
lea r8, [rsp + 0x1be8]
lea rdx, [rsp + 0x1bf0]
mov rcx, qword [rsp + 0xac8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xac8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1bf8]
lea r8, [rsp + 0x1c00]
lea rdx, [rsp + 0x1c08]
lea rcx, [0x1400ec968]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x560], 0x9467aef
lea rdx, str.DTDXdIDn3c
lea rcx, [rsp + 0x4570]
call fcn.140003708
lea rcx, [rsp + 0x4570]
call fcn.14000a93c
mov r8d, dword [rsp + 0x560]
mov rdx, rax
lea rcx, [0x1400ec97c]
call fcn.140044734
lea rcx, [rsp + 0x4570]
call fcn.1400040f0
mov dword [rsp + 0x27c], 1
mov edx, 8
lea rcx, [rsp + 0x1548]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140086e8f
mov eax, dword [rsp + 0x1548]
mov dword [rsp + 0x1168], eax
mov eax, dword [rsp + 0x154c]
mov dword [rsp + 0x116c], eax
mov ecx, dword [rsp + 0x27c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x27c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1460], 0x10
lea rdx, [rsp + 0x1460]
lea rcx, [rsp + 0x57f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x570], 0x17417948
lea rdx, [0x1400ec984]
lea rcx, [rsp + 0x4590]
call fcn.140003708
lea rcx, [rsp + 0x4590]
call fcn.14000a93c
mov r8d, dword [rsp + 0x570]
mov rdx, rax
lea rcx, [0x1400ec988]
call fcn.140044734
lea rcx, [rsp + 0x4590]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xab0], rax
cmp qword [rsp + 0xab0], 0
je 0x140086f6a
lea rax, [rsp + 0x1c10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1c18]
lea r8, [rsp + 0x1c20]
lea rdx, [rsp + 0x1c28]
mov rcx, qword [rsp + 0xab0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xab0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x9f70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x140086f9b
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x140086fcd
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0x9f70]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0x9f70], al
jmp 0x140086f8b
lea r9, [rsp + 0x1c30]
lea r8, [rsp + 0x1c38]
lea rdx, [rsp + 0x1c40]
lea rcx, [0x1400ec990]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x574], 0x1f4fecd1
lea rdx, str.KaV6NKTJP9
lea rcx, [rsp + 0x45b0]
call fcn.140003708
lea rcx, [rsp + 0x45b0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x574]
mov rdx, rax
lea rcx, [0x1400ec9a4]
call fcn.140044734
lea rcx, [rsp + 0x45b0]
call fcn.1400040f0
mov dword [rsp + 0x145c], 0x10
lea rdx, [rsp + 0x145c]
lea rcx, [rsp + 0x5810]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1c48]
lea r8, [rsp + 0x1c50]
lea rdx, [rsp + 0x1c58]
lea rcx, [0x1400ec9b0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xaa8], rax
cmp qword [rsp + 0xaa8], 0
je 0x1400870f2
lea rax, [rsp + 0x1c60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1c68]
lea r8, [rsp + 0x1c70]
lea rdx, [rsp + 0x1c78]
mov rcx, qword [rsp + 0xaa8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xaa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x280], 1
mov edx, 8
lea rcx, [rsp + 0x1550]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008714a
mov eax, dword [rsp + 0x1550]
mov dword [rsp + 0x1170], eax
mov eax, dword [rsp + 0x1554]
mov dword [rsp + 0x1174], eax
mov ecx, dword [rsp + 0x280]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x280]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xa370]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x14008717b
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x1400871ad
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0xa370]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0xa370], al
jmp 0x14008716b
mov dword [rsp + 0x580], 0xe51dc42
lea rdx, str.nJVC5pCn
lea rcx, [rsp + 0x3450]
call fcn.140003708
lea rcx, [rsp + 0x3450]
call fcn.14000a93c
mov r8d, dword [rsp + 0x580]
mov rdx, rax
lea rcx, [0x1400ec9c4]
call fcn.140044734
lea rcx, [rsp + 0x3450]
call fcn.1400040f0
lea r9, [rsp + 0x1c80]
lea r8, [rsp + 0x1c88]
lea rdx, [rsp + 0x1c90]
lea rcx, [0x1400ec9d0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x284], 1
mov edx, 8
lea rcx, [rsp + 0x1558]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008727a
mov eax, dword [rsp + 0x1558]
mov dword [rsp + 0x1178], eax
mov eax, dword [rsp + 0x155c]
mov dword [rsp + 0x117c], eax
mov ecx, dword [rsp + 0x284]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x284]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x1c98]
lea r8, [rsp + 0x1ca0]
lea rdx, [rsp + 0x1ca8]
lea rcx, [0x1400ec9d8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa90], rax
cmp qword [rsp + 0xa90], 0
je 0x140087309
lea rax, [rsp + 0x1cb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1cb8]
lea r8, [rsp + 0x1cc0]
lea rdx, [rsp + 0x1cc8]
mov rcx, qword [rsp + 0xa90]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5420]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xa770]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0
jmp 0x140087348
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
movsxd rax, dword [rsp + 0x88]
cmp rax, 0x400
jae 0x14008737a
movsxd rax, dword [rsp + 0x88]
mov al, byte [rsp + rax + 0xa770]
inc al
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0xa770], al
jmp 0x140087338
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa78], rax
cmp qword [rsp + 0xa78], 0
je 0x1400873e4
lea rax, [rsp + 0x1cd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1cd8]
lea r8, [rsp + 0x1ce0]
lea rdx, [rsp + 0x1ce8]
mov rcx, qword [rsp + 0xa78]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1cf0]
lea r8, [rsp + 0x1cf8]
lea rdx, [rsp + 0x1d00]
lea rcx, [0x1400ec9e0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1458], 0x10
lea rdx, [rsp + 0x1458]
lea rcx, [rsp + 0x5830]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x590], 0x18d4c823
lea rdx, str.KHKzg
lea rcx, [rsp + 0x45f0]
call fcn.140003708
lea rcx, [rsp + 0x45f0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x590]
mov rdx, rax
lea rcx, [0x1400ec9f0]
call fcn.140044734
lea rcx, [rsp + 0x45f0]
call fcn.1400040f0
lea rcx, [rsp + 0x1d08]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x594], 0x5d9c291
lea rdx, [0x1400ec9f8]
lea rcx, [rsp + 0x4610]
call fcn.140003708
nop
lea rdx, [rsp + 0x4610]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x594]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4610]
call fcn.1400040f0
mov dword [rsp + 0x288], 1
mov edx, 8
lea rcx, [rsp + 0x1560]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140087540
mov eax, dword [rsp + 0x1560]
mov dword [rsp + 0x1180], eax
mov eax, dword [rsp + 0x1564]
mov dword [rsp + 0x1184], eax
mov ecx, dword [rsp + 0x288]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x288]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x5430]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ajPmDY0SBE.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc70], rax
cmp qword [rsp + 0xc70], 0xffffffffffffffff
je 0x1400875a3
mov rcx, qword [rsp + 0xc70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x598], 0x1797f39c
lea rdx, str.vgNaf
lea rcx, [rsp + 0x4630]
call fcn.140003708
nop
lea rdx, [rsp + 0x4630]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x598]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4630]
call fcn.1400040f0
lea r9, [rsp + 0x1d10]
lea r8, [rsp + 0x1d18]
lea rdx, [rsp + 0x1d20]
lea rcx, [0x1400eca28]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x1d28]
lea r8, [rsp + 0x1d30]
lea rdx, [rsp + 0x1d38]
lea rcx, [0x1400eca30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x5440]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1d40]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1d48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x28c], 1
mov edx, 8
lea rcx, [rsp + 0x1568]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400876cf
mov eax, dword [rsp + 0x1568]
mov dword [rsp + 0x1188], eax
mov eax, dword [rsp + 0x156c]
mov dword [rsp + 0x118c], eax
mov ecx, dword [rsp + 0x28c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x28c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1d50]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1d58]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x1d60]
lea r8, [rsp + 0x1d68]
lea rdx, [rsp + 0x1d70]
lea rcx, [0x1400eca38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xab70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x8c], 0
jmp 0x140087741
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
movsxd rax, dword [rsp + 0x8c]
cmp rax, 0x400
jae 0x140087773
movsxd rax, dword [rsp + 0x8c]
mov al, byte [rsp + rax + 0xab70]
inc al
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0xab70], al
jmp 0x140087731
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa60], rax
cmp qword [rsp + 0xa60], 0
je 0x1400877dd
lea rax, [rsp + 0x1d78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1d80]
lea r8, [rsp + 0x1d88]
lea rdx, [rsp + 0x1d90]
mov rcx, qword [rsp + 0xa60]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa58], rax
cmp qword [rsp + 0xa58], 0
je 0x140087847
lea rax, [rsp + 0x1d98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1da0]
lea r8, [rsp + 0x1da8]
lea rdx, [rsp + 0x1db0]
mov rcx, qword [rsp + 0xa58]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa48], rax
cmp qword [rsp + 0xa48], 0
je 0x1400878b1
lea rax, [rsp + 0x1db8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1dc0]
lea r8, [rsp + 0x1dc8]
lea rdx, [rsp + 0x1dd0]
mov rcx, qword [rsp + 0xa48]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x59c], 0x39d7fe32
lea rdx, str.6Z912h4Zi
lea rcx, [rsp + 0x4650]
call fcn.140003708
nop
lea rdx, [rsp + 0x4650]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x59c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4650]
call fcn.1400040f0
lea rcx, [rsp + 0x5450]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa30], rax
cmp qword [rsp + 0xa30], 0
je 0x140087989
lea rax, [rsp + 0x1dd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1de0]
lea r8, [rsp + 0x1de8]
lea rdx, [rsp + 0x1df0]
mov rcx, qword [rsp + 0xa30]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.mlycy.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc78], rax
cmp qword [rsp + 0xc78], 0xffffffffffffffff
je 0x1400879de
mov rcx, qword [rsp + 0xc78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ahn.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc80], rax
cmp qword [rsp + 0xc80], 0xffffffffffffffff
je 0x140087a33
mov rcx, qword [rsp + 0xc80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1df8]
lea r8, [rsp + 0x1e00]
lea rdx, [rsp + 0x1e08]
lea rcx, [0x1400eca78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x1e10]
lea r8, [rsp + 0x1e18]
lea rdx, [rsp + 0x1e20]
lea rcx, [0x1400eca80]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x5a0], 0xc04be9b
lea rdx, [0x1400eca88]
lea rcx, [rsp + 0x4670]
call fcn.140003708
lea rcx, [rsp + 0x4670]
call fcn.14000a93c
mov r8d, dword [rsp + 0x5a0]
mov rdx, rax
lea rcx, [0x1400eca8c]
call fcn.140044734
lea rcx, [rsp + 0x4670]
call fcn.1400040f0
mov dword [rsp + 0x5a4], 0x39933714
lea rdx, [0x1400eca94]
lea rcx, [rsp + 0x4690]
call fcn.140003708
nop
lea rdx, [rsp + 0x4690]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x5a4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4690]
call fcn.1400040f0
mov dword [rsp + 0x1454], 0x10
lea rdx, [rsp + 0x1454]
lea rcx, [rsp + 0x5850]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1e28]
lea r8, [rsp + 0x1e30]
lea rdx, [rsp + 0x1e38]
lea rcx, [0x1400eca98]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x290], 1
mov edx, 8
lea rcx, [rsp + 0x1580]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140087bcb
mov eax, dword [rsp + 0x1580]
mov dword [rsp + 0x1190], eax
mov eax, dword [rsp + 0x1584]
mov dword [rsp + 0x1194], eax
mov ecx, dword [rsp + 0x290]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x290]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa28], rax
cmp qword [rsp + 0xa28], 0
je 0x140087c35
lea rax, [rsp + 0x1e40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e48]
lea r8, [rsp + 0x1e50]
lea rdx, [rsp + 0x1e58]
mov rcx, qword [rsp + 0xa28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1e60]
lea r8, [rsp + 0x1e68]
lea rdx, [rsp + 0x1e70]
lea rcx, [0x1400ecaa0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ZbrDtnf.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc88], rax
cmp qword [rsp + 0xc88], 0xffffffffffffffff
je 0x140087caf
mov rcx, qword [rsp + 0xc88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5b0], 0x38ab925a
lea rdx, str.mD7dH
lea rcx, [rsp + 0x46b0]
call fcn.140003708
nop
lea rdx, [rsp + 0x46b0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x5b0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x46b0]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa18], rax
cmp qword [rsp + 0xa18], 0
je 0x140087d79
lea rax, [rsp + 0x1e78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e80]
lea r8, [rsp + 0x1e88]
lea rdx, [rsp + 0x1e90]
mov rcx, qword [rsp + 0xa18]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e98]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1ea0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x294], 1
mov edx, 8
lea rcx, [rsp + 0x15b0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140087ded
mov eax, dword [rsp + 0x15b0]
mov dword [rsp + 0x1198], eax
mov eax, dword [rsp + 0x15b4]
mov dword [rsp + 0x119c], eax
mov ecx, dword [rsp + 0x294]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x294]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1ea8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x5460]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x298], 1
mov edx, 8
lea rcx, [rsp + 0x15d0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140087e61
mov eax, dword [rsp + 0x15d0]
mov dword [rsp + 0x11a0], eax
mov eax, dword [rsp + 0x15d4]
mov dword [rsp + 0x11a4], eax
mov ecx, dword [rsp + 0x298]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x298]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa10], rax
cmp qword [rsp + 0xa10], 0
je 0x140087ecb
lea rax, [rsp + 0x1eb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1eb8]
lea r8, [rsp + 0x1ec0]
lea rdx, [rsp + 0x1ec8]
mov rcx, qword [rsp + 0xa10]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1450], 0x10
lea rdx, [rsp + 0x1450]
lea rcx, [rsp + 0x5870]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x5470]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1ed0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x29c], 1
mov edx, 8
lea rcx, [rsp + 0x15d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140087f60
mov eax, dword [rsp + 0x15d8]
mov dword [rsp + 0x11a8], eax
mov eax, dword [rsp + 0x15dc]
mov dword [rsp + 0x11ac], eax
mov ecx, dword [rsp + 0x29c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x29c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xaf70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
jmp 0x140087f91
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 0x400
jae 0x140087fc3
movsxd rax, dword [rsp + 0x90]
mov al, byte [rsp + rax + 0xaf70]
inc al
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0xaf70], al
jmp 0x140087f81
lea rcx, [rsp + 0x12c0]
call fcn.140061b8c
mov qword [rsp + 0xd08], rax
mov dword [rsp + 0x5c0], 0x32d9707f
lea rdx, str.a5sP
lea rcx, [rsp + 0x46d0]
call fcn.140003708
lea rcx, [rsp + 0x46d0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x5c0]
mov rdx, rax
lea rcx, [0x1400ecad0]
call fcn.140044734
lea rcx, [rsp + 0x46d0]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xa00], rax
cmp qword [rsp + 0xa00], 0
je 0x140088092
lea rax, [rsp + 0x1ed8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ee0]
lea r8, [rsp + 0x1ee8]
lea rdx, [rsp + 0x1ef0]
mov rcx, qword [rsp + 0xa00]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xa00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5c4], 0x80882bd
lea rdx, str.YxDedEEn
lea rcx, [rsp + 0x46f0]
call fcn.140003708
lea rcx, [rsp + 0x46f0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x5c4]
mov rdx, rax
lea rcx, [0x1400ecae4]
call fcn.140044734
lea rcx, [rsp + 0x46f0]
call fcn.1400040f0
mov dword [rsp + 0x5c8], 0x398ffc65
lea rdx, [0x1400ecaec]
lea rcx, [rsp + 0x4710]
call fcn.140003708
nop
lea rdx, [rsp + 0x4710]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x5c8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4710]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9f8], rax
cmp qword [rsp + 0x9f8], 0
je 0x1400881ac
lea rax, [rsp + 0x1ef8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f00]
lea r8, [rsp + 0x1f08]
lea rdx, [rsp + 0x1f10]
mov rcx, qword [rsp + 0x9f8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400ecaf0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc90], rax
cmp qword [rsp + 0xc90], 0xffffffffffffffff
je 0x140088201
mov rcx, qword [rsp + 0xc90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5cc], 0x3afc28e8
lea rdx, str.7UaiacLry1
lea rcx, [rsp + 0x4730]
call fcn.140003708
nop
lea rdx, [rsp + 0x4730]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x5cc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4730]
call fcn.1400040f0
lea rax, [rsp + 0xb370]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x94], 0
jmp 0x140088292
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
cmp rax, 0x400
jae 0x1400882c4
movsxd rax, dword [rsp + 0x94]
mov al, byte [rsp + rax + 0xb370]
inc al
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0xb370], al
jmp 0x140088282
mov dword [rsp + 0x5d0], 0x828b730
lea rdx, [0x1400ecb0c]
lea rcx, [rsp + 0x4750]
call fcn.140003708
nop
lea rdx, [rsp + 0x4750]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x5d0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4750]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400ecb10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc98], rax
cmp qword [rsp + 0xc98], 0xffffffffffffffff
je 0x140088379
mov rcx, qword [rsp + 0xc98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x1f18]
lea r8, [rsp + 0x1f20]
lea rdx, [rsp + 0x1f28]
lea rcx, [0x1400ecb20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xb770]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0
jmp 0x1400883cf
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
movsxd rax, dword [rsp + 0x98]
cmp rax, 0x400
jae 0x140088401
movsxd rax, dword [rsp + 0x98]
mov al, byte [rsp + rax + 0xb770]
inc al
movsxd rcx, dword [rsp + 0x98]
mov byte [rsp + rcx + 0xb770], al
jmp 0x1400883bf
lea rcx, [rsp + 0x1f30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x5d4], 0x2722c419
lea rdx, str.kuC5ssv
lea rcx, [rsp + 0x4770]
call fcn.140003708
lea rcx, [rsp + 0x4770]
call fcn.14000a93c
mov r8d, dword [rsp + 0x5d4]
mov rdx, rax
lea rcx, [0x1400ecb30]
call fcn.140044734
lea rcx, [rsp + 0x4770]
call fcn.1400040f0
mov dword [rsp + 0x2a0], 1
mov edx, 8
lea rcx, [rsp + 0x1600]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400884b7
mov eax, dword [rsp + 0x1600]
mov dword [rsp + 0x11b0], eax
mov eax, dword [rsp + 0x1604]
mov dword [rsp + 0x11b4], eax
mov ecx, dword [rsp + 0x2a0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2a0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x144c], 0x10
lea rdx, [rsp + 0x144c]
lea rcx, [rsp + 0x5890]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x1f38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x5e0], 0x112e1efb
lea rdx, str.d54DasTzK
lea rcx, [rsp + 0x4790]
call fcn.140003708
lea rcx, [rsp + 0x4790]
call fcn.14000a93c
mov r8d, dword [rsp + 0x5e0]
mov rdx, rax
lea rcx, [0x1400ecb44]
call fcn.140044734
lea rcx, [rsp + 0x4790]
call fcn.1400040f0
mov dword [rsp + 0x5e4], 0x1fbcc893
lea rdx, str.9zK0r
lea rcx, [rsp + 0x47b0]
call fcn.140003708
lea rcx, [rsp + 0x47b0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x5e4]
mov rdx, rax
lea rcx, [0x1400ecb54]
call fcn.140044734
lea rcx, [rsp + 0x47b0]
call fcn.1400040f0
mov dword [rsp + 0x5e8], 0xc08d8c8
lea rdx, str.j4efCPQLjT
lea rcx, [rsp + 0x47d0]
call fcn.140003708
lea rcx, [rsp + 0x47d0]
call fcn.14000a93c
mov r8d, dword [rsp + 0x5e8]
mov rdx, rax
lea rcx, [0x1400ecb6c]
call fcn.140044734
lea rcx, [rsp + 0x47d0]
call fcn.1400040f0
mov dword [rsp + 0x2a4], 1
mov edx, 8
lea rcx, [rsp + 0x1608]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14008862e
mov eax, dword [rsp + 0x1608]
mov dword [rsp + 0x11b8], eax
mov eax, dword [rsp + 0x160c]
mov dword [rsp + 0x11bc], eax
mov ecx, dword [rsp + 0x2a4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2a4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x2a8], 1
mov edx, 8
lea rcx, [rsp + 0x1610]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140088686
mov eax, dword [rsp + 0x1610]
mov dword [rsp + 0x11c0], eax
mov eax, dword [rsp + 0x1614]
mov dword [rsp + 0x11c4], eax
mov ecx, dword [rsp + 0x2a8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2a8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xbb70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x9c], 0
jmp 0x1400886b7
mov eax, dword [rsp + 0x9c]
inc eax
mov dword [rsp + 0x9c], eax
movsxd rax, dword [rsp + 0x9c]
cmp rax, 0x400
jae 0x1400886e9
movsxd rax, dword [rsp + 0x9c]
mov al, byte [rsp + rax + 0xbb70]
inc al
movsxd rcx, dword [rsp + 0x9c]
mov byte [rsp + rcx + 0xbb70], al
jmp 0x1400886a7
lea rax, [rsp + 0xbf70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
jmp 0x14008871a
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
cmp rax, 0x400
jae 0x14008874c
movsxd rax, dword [rsp + 0xa0]
mov al, byte [rsp + rax + 0xbf70]
inc al
movsxd rcx, dword [rsp + 0xa0]
mov byte [rsp + rcx + 0xbf70], al
jmp 0x14008870a
lea rcx, [rsp + 0x5480]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1f40]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x5490]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.3kIq4QSVW8.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xca0], rax
cmp qword [rsp + 0xca0], 0xffffffffffffffff
je 0x1400887cb
mov rcx, qword [rsp + 0xca0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1f48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x2ac], 1
mov edx, 8
lea rcx, [rsp + 0x1620]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140088831
mov eax, dword [rsp + 0x1620]
mov dword [rsp + 0x11c8], eax
mov eax, dword [rsp + 0x1624]
mov dword [rsp + 0x11cc], eax
mov ecx, dword [rsp + 0x2ac]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2ac]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x5ec], 0x6f43a61
lea rdx, [0x1400ecb98]
lea rcx, [rsp + 0x47f0]
call fcn.140003708
nop
lea rdx, [rsp + 0x47f0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x5ec]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x47f0]
call fcn.1400040f0
mov dword [rsp + 0x2b0], 1
mov edx, 8
lea rcx, [rsp + 0x1648]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400888e9
mov eax, dword [rsp + 0x1648]
mov dword [rsp + 0x11d0], eax
mov eax, dword [rsp + 0x164c]
mov dword [rsp + 0x11d4], eax
mov ecx, dword [rsp + 0x2b0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2b0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400ecba0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xca8], rax
cmp qword [rsp + 0xca8], 0xffffffffffffffff
je 0x14008893e
mov rcx, qword [rsp + 0xca8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2b4], 1
mov edx, 8
lea rcx, [rsp + 0x1650]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140088996
mov eax, dword [rsp + 0x1650]
mov dword [rsp + 0x11d8], eax
mov eax, dword [rsp + 0x1654]
mov dword [rsp + 0x11dc], eax
mov ecx, dword [rsp + 0x2b4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2b4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1f50]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x1f58]
lea r8, [rsp + 0x1f60]
lea rdx, [rsp + 0x1f68]
lea rcx, [0x1400ecbb0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1448], 0x10
lea rdx, [rsp + 0x1448]
lea rcx, [rsp + 0x58b0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x5f8], 0x303c74df
lea rdx, [0x1400ecbb8]
lea rcx, [rsp + 0x4810]
call fcn.140003708
nop
lea rdx, [rsp + 0x4810]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x5f8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4810]
call fcn.1400040f0
mov dword [rsp + 0x5fc], 0x3b1326ac
lea rdx, [0x1400ecbbc]
lea rcx, [rsp + 0x4830]
call fcn.140003708
lea rcx, [rsp + 0x4830]
call fcn.14000a93c
mov r8d, dword [rsp + 0x5fc]
mov rdx, rax
lea rcx, [0x1400ecbc0]
call fcn.140044734
lea rcx, [rsp + 0x4830]
call fcn.1400040f0
mov dword [rsp + 0x1444], 0x10
lea rdx, [rsp + 0x1444]
lea rcx, [rsp + 0x58d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x2b8], 1
mov edx, 8
lea rcx, [rsp + 0x1660]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140088b13
mov eax, dword [rsp + 0x1660]
mov dword [rsp + 0x11e0], eax
mov eax, dword [rsp + 0x1664]
mov dword [rsp + 0x11e4], eax
mov ecx, dword [rsp + 0x2b8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2b8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x608], 0x3514daf3
lea rdx, str.Xt78
lea rcx, [rsp + 0x4850]
call fcn.140003708
nop
lea rdx, [rsp + 0x4850]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x608]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4850]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9e8], rax
cmp qword [rsp + 0x9e8], 0
je 0x140088bdd
lea rax, [rsp + 0x1f70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f78]
lea r8, [rsp + 0x1f80]
lea rdx, [rsp + 0x1f88]
mov rcx, qword [rsp + 0x9e8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x60c], 0x1c11ef5c
lea rdx, [0x1400ecbd0]
lea rcx, [rsp + 0x4870]
call fcn.140003708
nop
lea rdx, [rsp + 0x4870]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x60c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x4870]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9d0], rax
cmp qword [rsp + 0x9d0], 0
je 0x140088ca7
lea rax, [rsp + 0x1f90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f98]
lea r8, [rsp + 0x1fa0]
lea rdx, [rsp + 0x1fa8]
mov rcx, qword [rsp + 0x9d0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1440], 0x10
lea rdx, [rsp + 0x1440]
lea rcx, [rsp + 0x58f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x618], 0x1c3e83ff
lea rdx, [0x1400ecbd4]
lea rcx, [rsp + 0x4890]
call fcn.140003708
lea rcx, [rsp + 0x4890]
call fcn.14000a93c
mov r8d, dword [rsp + 0x618]
mov rdx, rax
lea rcx, [0x1400ecbd8]
call fcn.140044734
lea rcx, [rsp + 0x4890]
call fcn.1400040f0
lea rcx, [rsp + 0x54a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9c0], rax
cmp qword [rsp + 0x9c0], 0
je 0x140088d90
lea rax, [rsp + 0x1fb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1fb8]
lea r8, [rsp + 0x1fc0]
lea rdx, [rsp + 0x1fc8]
mov rcx, qword [rsp + 0x9c0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x9c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xc370]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa4], 0
jmp 0x140088dc1
mov eax, dword [rsp + 0xa4]
inc eax
mov dword [rsp + 0xa4], eax
movsxd rax, dword [rsp + 0xa4]
cmp rax, 0x400
jae 0x140088df3
movsxd rax, dword [rsp + 0xa4]
mov al, byte [rsp + rax + 0xc370]
inc al
movsxd rcx, dword [rsp + 0xa4]
mov byte [rsp + rcx + 0xc370], al
jmp 0x140088db1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.g7vsuzf.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcb0], rax
cmp qword [rsp + 0xcb0], 0xffffffffffffffff
je 0x140088e48
mov rcx, qword [rsp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x61c], 0x13835dfa
lea rdx, str.9hhZc
lea rcx, [rsp + 0x48b0]
call fcn.140003708
nop
lea rdx, [rsp + 0x48b0]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x61c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x48b0]
call fcn.1400040f0
lea rcx, [rsp + 0x1fd0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x143c], 0x10
lea rdx, [rsp + 0x143c]
lea rcx, [rsp + 0x5910]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1fd8]
lea r8, [rsp + 0x1fe0]
lea rdx, [rsp + 0x1fe8]
lea rcx, [0x1400ecc00]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1ff0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x9b0], rax
cmp qword [rsp + 0x9b0], 0
je 0x140088f74