Function at 0x1001a4a7
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push 0x5c
mov eax, 0x1003e9fc
call fcn.1001d244
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, dword [sym.imp.WINMM.dll_timeGetDevCaps]
lea eax, [ebp - 0x50]
push 8
push eax
call ebx
mov esi, dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov edi, dword [sym.imp.WINMM.dll_timeEndPeriod]
test eax, eax
jne 0x1001a4f0
push 1
call esi
push 1
call edi
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x58]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x50]
push eax
call ebx
test eax, eax
jne 0x1001a51b
push 1
call esi
push 1
call edi
push str.6j2IYZ8P3E
lea ecx, [ebp - 0x48]
call fcn.10001fd7
and dword [ebp - 4], 0
lea edx, [ebp - 0x48]
push 0x34ea38c2
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48]
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.aSQH.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1001a581
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x58]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.8BtNzS
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x2fe4644a
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
push 8
lea eax, [ebp - 0x50]
push eax
call ebx
test eax, eax
jne 0x1001a5df
push 1
call esi
push 1
call edi
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x54], eax
test eax, eax
je 0x1001a624
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.1001907c
test al, al
je 0x1001a928
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x38]
push eax
call ebx
test eax, eax
jne 0x1001a659
push 1
call esi
push 1
call edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.CoAkPHPNH9.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1001a682
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.kgOEWIGQg.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1001a6ab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x54], eax
test eax, eax
je 0x1001a6e6
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
lea eax, [ebp - 0x38]
push eax
call ebx
test eax, eax
jne 0x1001a6fa
push 1
call esi
push 1
call edi
push str.Amwqo6M
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x2121930c
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.GcTHJrzB
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x14676cc7
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x38]
push eax
call ebx
test eax, eax
jne 0x1001a793
push 1
call esi
push 1
call edi
push 8
lea eax, [ebp - 0x38]
push eax
call ebx
test eax, eax
jne 0x1001a7a7
push 1
call esi
push 1
call edi
call fcn.100198d2
test al, al
je 0x1001a928
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x38]
push eax
call ebx
test eax, eax
jne 0x1001a80b
push 1
call esi
push 1
call edi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x10049064
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x295c90d3
cmova eax, dword [ebp - 0x48]
mov edi, str._s:__d
push eax
push edi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor ebx, ebx
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001a899
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.w8ap5s.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1001a8c0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.TLbMLw59
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x24d2b933
cmova eax, dword [ebp - 0x48]
push eax
push edi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
push 0x10049098
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x306a9fc9
cmova eax, dword [ebp - 0x48]
push eax
push edi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.1001d1f3
ret