Function at 0x1000e18a
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push 0x7b0
mov eax, 0x1003d34b
call fcn.1001d244
and dword [ebp - 4], 0
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1000e212
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x450]
push eax
push esi
call edi
push esi
call ebx
push str.PswpnMrW
lea ecx, [ebp - 0x470]
call fcn.10001fd7
cmp dword [ebp - 0x45c], 0xf
lea eax, [ebp - 0x470]
push 0x1905c21
cmova eax, dword [ebp - 0x470]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x470]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000e290
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x450]
push eax
push esi
call edi
push esi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x440], 0x10
push eax
call esi
push str.TlnSPe
lea ecx, [ebp - 0x470]
call fcn.10001fd7
cmp dword [ebp - 0x45c], 0xf
lea eax, [ebp - 0x470]
push 0x4a61886
cmova eax, dword [ebp - 0x470]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x470]
call fcn.10002037
push 8
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000e312
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x440]
mov dword [ebp - 0x440], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x10047780
lea ecx, [ebp - 0x470]
call fcn.10001fd7
cmp dword [ebp - 0x45c], 0xf
lea eax, [ebp - 0x470]
push 0x393dd4e7
cmova eax, dword [ebp - 0x470]
mov esi, str._s:__d
push eax
push esi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x470]
call fcn.10002037
push 0x10047784
lea ecx, [ebp - 0x470]
call fcn.10001fd7
cmp dword [ebp - 0x45c], 0xf
lea eax, [ebp - 0x470]
push 0x214fed86
cmova eax, dword [ebp - 0x470]
push eax
push esi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x470]
call fcn.10002037
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1000f79d
call fcn.1000527e
test eax, eax
je 0x1000f79d
push str.NC54Us6O0V
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x30040d15
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10002037
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0x1004774c
call esi
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0x1004774c
call esi
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0x1004774c
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.luRf.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000e4a1
push eax
call ebx
push str.kAkDsGQyqW
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x223d96f6
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 2
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10002037
push str.p92xf2
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x3c28509
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10002037
push str.TMlZn8
lea ecx, [ebp - 0x470]
call fcn.10001fd7
cmp dword [ebp - 0x45c], 0xf
lea eax, [ebp - 0x470]
push 0x1b182ba7
cmova eax, dword [ebp - 0x470]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x470]
call fcn.10002037
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0x1004774c
call esi
push 0x100477c4
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x139e9819
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 4
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10002037
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x798]
push eax
call fcn.10005296
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x798], eax
test eax, eax
je 0x1000f79d
mov dword [ebp - 0x7ac], 0x100528e8
mov ecx, 0x100528e8
call fcn.1000500f
xorps xmm0, xmm0
mov byte [ebp - 4], 5
push 0x50
movlpd qword [ebp - 0x43c], xmm0
call fcn.1001c8f6
push 0x50
mov esi, eax
push 0
push esi
mov dword [ebp - 0x434], esi
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
call fcn.10006ec1
push eax
lea ecx, [ebp - 0x43c]
call fcn.100014e7
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x100477c8
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000e667
push eax
call ebx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000e6cb
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x4c8]
push eax
push esi
call edi
push esi
call ebx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.pKf63JptB
lea ecx, [ebp - 0x28]
call fcn.10001fd7
mov esi, 0x10051b50
mov byte [ebp - 4], 7
push 0x111b51dd
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
lea eax, [ebp - 0x710]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.oxkRT
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x2ebf2477
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 8
mov ecx, esi
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.39QsZiU7DS.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000e791
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000e7cd
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x4d8]
push eax
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x4e8]
push eax
push esi
call edi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000e809
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x4f8]
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x508]
push eax
push esi
call edi
push esi
call ebx
push 0x10047538
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x10abb30e
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push dword [ebp - 0x798]
mov edi, dword [ebp - 0x43c]
mov ecx, edi
push dword [ebp - 0x440]
call fcn.10007242
test al, al
je 0x1000f783
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x720]
push eax
call esi
lea eax, [ebp - 0x730]
push eax
call esi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.GrI5dqe.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000e8b5
push eax
call ebx
lea eax, [ebp - 0x740]
push eax
call esi
mov esi, 0x400
lea eax, [ebp - 0x430]
push esi
push 0
push eax
call fcn.1001e5b0
push esi
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0x18
lea ecx, [ebp - 0x28]
push str.Gx6NUF
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x3811a8d4
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x5e8]
push eax
call esi
push 0x1004782c
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x325bd872
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.rY7ZDA
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0xcc033e9
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 9
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
lea eax, [ebp - 0x510]
push eax
call esi
mov ecx, edi
call fcn.1000748a
sub dword [ebp - 0x798], eax
lea ecx, [ebp - 0x28]
push str.Uzgn6iS3U
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x14e328af
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x528]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.I4zs.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000ea24
push eax
call ebx
push 8
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov esi, dword [sym.imp.WINMM.dll_timeBeginPeriod]
test eax, eax
jne 0x1000ea49
push 1
call esi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.2mkT
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x394e5bb4
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 8
lea eax, [ebp - 0x538]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000ea9b
push 1
call esi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 0x10047860
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x35104732
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 8
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000eaed
push 1
call esi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.zFX4
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x11295f3b
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.52FM8HCodp
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x2e74b157
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xa
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.n.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000eb82
push eax
call ebx
push str.24mrfy
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2ae699dc
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
mov ecx, edi
call fcn.1000748a
add dword [ebp - 0x440], eax
lea ecx, [ebp - 0x28]
push str.eClNMY
call fcn.10001fd7
push 0x18b19c73
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x750]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0x18
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x558]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x560]
push eax
lea eax, [ebp - 0x568]
push eax
lea eax, [ebp - 0x570]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x580]
push eax
lea eax, [ebp - 0x588]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.97ZY
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x1e76f25c
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.WHHd8h5V.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000ed0d
push eax
call ebx
push 8
lea eax, [ebp - 0x590]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000ed2c
push 1
call esi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 8
lea eax, [ebp - 0x598]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000ed4b
push 1
call esi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, edi
call fcn.100073ad
mov ecx, edi
cmp al, 1
jne 0x1000f2b7
push 1
call fcn.10007507
test al, al
je 0x1000f783
push 1
lea eax, [ebp - 0x458]
mov ecx, edi
push eax
call fcn.10007581
lea ecx, [ebp - 0x791]
mov byte [ebp - 4], 0xd
push ecx
mov ecx, dword [eax]
call fcn.1000761b
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x454]
mov byte [ebp - 0x792], al
test ecx, ecx
je 0x1000edac
call fcn.10001270
mov al, byte [ebp - 0x792]
test al, al
je 0x1000f783
mov al, byte [ebp - 0x791]
cmp al, 1
jne 0x1000eeae
xorps xmm0, xmm0
push 0x5c
movlpd qword [ebp - 0x448], xmm0
call fcn.1001c8f6
mov ebx, eax
mov dword [ebp - 0x79c], ebx
push 0x5c
push 0
push ebx
call fcn.1001e5b0
xor eax, eax
mov dword [ebx], vtable.UXZVSYO_.0
add esp, 0x10
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
lea ecx, [ebx + 0x14]
mov byte [ebp - 4], 0x10
call fcn.1000547e
lea ecx, [ebx + 0x28]
push 0x100
call fcn.10004fda
mov byte [ebx + 0x58], 0
mov dword [ebp - 0x434], ebx
push 0x10
mov byte [ebp - 4], 0x11
call fcn.1001c8f6
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x434], ebx
mov edi, ebx
mov dword [ebp - 0x444], ebx
lea esi, [ebx + 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, dword [ebp - 0x79c]
inc eax
mov dword [esi], eax
mov dword [ebx + 8], eax
mov dword [ebx], vtable.PDCUILCKD::JGV_PKYMAWPF.0
mov dword [ebx + 0xc], edi
mov dword [ebp - 0x448], edi
push ecx
lea eax, [ebp - 0x43c]
mov byte [ebp - 4], 0x12
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, edi
call fcn.10008551
push ecx
push ecx
mov eax, esp
and dword [eax], 0
and dword [eax + 4], 0
lock inc dword [esi]
mov dword [eax], edi
mov dword [eax + 4], ebx
call fcn.10010f4a
pop ecx
pop ecx
mov ecx, ebx
call fcn.10001270
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f73a
cmp al, 2
jne 0x1000f73a
xorps xmm0, xmm0
push 0x6c
movlpd qword [ebp - 0x448], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x7a8], esi
push 0x6c
push 0
push esi
mov byte [ebp - 4], 0x13
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
call fcn.1000538a
push eax
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 6
call fcn.10002075
push str.eClNMY
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.10001fd7
push 0x18b19c73
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x15
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.10002037
mov edi, 0x400
lea eax, [ebp - 0x430]
push edi
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x760]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push edi
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
push edi
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5a0]
add esp, 0x18
push eax
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x5b0]
push eax
push 0x1004774c
call esi
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x5c8]
push eax
push 0x1004774c
call esi
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x5e0]
push eax
push 0x1004774c
call esi
push str.97ZY
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x1e76f25c
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x16
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.WHHd8h5V.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000f03a
push eax
call ebx
mov esi, dword [sym.imp.WINMM.dll_timeGetDevCaps]
lea eax, [ebp - 0x4a0]
push 8
push eax
call esi
test eax, eax
jne 0x1000f05f
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 8
lea eax, [ebp - 0x5f0]
push eax
call esi
test eax, eax
jne 0x1000f07e
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push ecx
push ecx
lea eax, [ebp - 0x43c]
mov ecx, esp
push eax
call fcn.100014c2
mov esi, dword [ebp - 0x448]
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 4]
test al, al
je 0x1000f76c
mov ecx, esi
call fcn.100055e0
mov dword [ebp - 0x7a0], eax
lea eax, [ebp - 0x7a0]
push eax
lea eax, [ebp - 0x7b4]
push eax
call fcn.10010bdf
lea ecx, [ebp - 0x448]
push ecx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.10007a4a
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000f12b
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x610]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push edi
call ebx
mov edi, 0x400
lea eax, [ebp - 0x430]
push edi
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000f17e
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x630]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push edi
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.YT4wR.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000f1a3
push eax
call ebx
push 0x100478c0
lea ecx, [ebp - 0x28]
call fcn.10001fd7
mov edi, 0x10051b50
mov byte [ebp - 4], 0x17
push 0x2e48f9e7
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.10002037
push 0x100478c4
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x2a6eba17
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x18
mov ecx, edi
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.10002037
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000f25a
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x770]
push eax
call edi
lea eax, [ebp - 0x780]
push eax
call edi
push str.2W1hlM
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1948ef17
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp - 0x444]
jmp 0x1000f388
call fcn.100073ad
cmp al, 3
jne 0x1000f39a
push ecx
push ecx
lea eax, [ebp - 0x43c]
mov ecx, esp
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x450], xmm0
call fcn.100014c2
lea ecx, [ebp - 0x450]
call fcn.100016d8
pop ecx
pop ecx
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x1000f774
cmp byte [eax + 0x38], 0
jne 0x1000f376
push 3
mov ecx, edi
call fcn.10007507
test al, al
je 0x1000f334
mov esi, dword [ebp - 0x450]
push ecx
push ecx
mov eax, esp
mov ecx, edi
push 3
push eax
call fcn.10007581
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test al, al
je 0x1000f774
mov ecx, dword [ebp - 0x450]
call fcn.100055e0
mov dword [ebp - 0x7a4], eax
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x7bc]
push eax
call fcn.10010bdf
lea ecx, [ebp - 0x450]
push ecx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.10007a4a
mov ecx, dword [ebp - 0x450]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x1000f382
lea eax, [ebp - 0x450]
push eax
call fcn.10010ced
mov ecx, dword [ebp - 0x44c]
test ecx, ecx
je 0x1000f73a
call fcn.10001270
jmp 0x1000f73a
mov ecx, edi
call fcn.100073ad
cmp al, 5
jne 0x1000f551
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.e962hd.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000f3ce
push eax
call ebx
mov edi, 0x400
lea eax, [ebp - 0x430]
push edi
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x650]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.dNvcU
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x37313f06
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
lea eax, [ebp - 0x790]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000f48b
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x670]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push edi
call ebx
push 8
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000f4aa
push 1
call esi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.kEkUHmD28z
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x5ed257b
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x698]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
pop ecx
lea eax, [ebp - 0x43c]
mov ecx, esp
push eax
call fcn.100014c2
call fcn.100107a6
jmp 0x1000f738
mov ecx, edi
call fcn.100073ad
cmp al, 0xc
jne 0x1000f73a
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000f5ad
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x6b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push edi
call ebx
lea eax, [ebp - 0x6b8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x6c8]
push eax
lea eax, [ebp - 0x6d0]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x6d8]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000f5fd
push 1
call esi
mov edi, dword [sym.imp.WINMM.dll_timeEndPeriod]
push 1
call edi
jmp 0x1000f603
mov edi, dword [sym.imp.WINMM.dll_timeEndPeriod]
push 8
lea eax, [ebp - 0x6e0]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000f61e
push 1
call esi
push 1
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000f667
lea ecx, [ebp - 0x6e8]
push ecx
lea ecx, [ebp - 0x6f0]
push ecx
lea ecx, [ebp - 0x488]
push ecx
lea ecx, [ebp - 0x490]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call ebx
push str.KDCIauNc7
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1b5ff56c
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0x10047908
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x1b098b56
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x498]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000f708
push 1
call esi
push 1
call edi
push 8
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000f723
push 1
call esi
push 1
call edi
push ecx
push ecx
lea eax, [ebp - 0x43c]
mov ecx, esp
push eax
call fcn.100014c2
call fcn.10007ba1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x438]
test ecx, ecx
je 0x1000f749
call fcn.10001270
push 0x100528e8
mov byte [ebp - 4], 0
call fcn.1001ad7b
cmp dword [ebp - 0x798], 0
pop ecx
je 0x1000f79d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
jmp 0x1000e5f6
mov ecx, dword [ebp - 0x444]
jmp 0x1000f77a
mov ecx, dword [ebp - 0x44c]
test ecx, ecx
je 0x1000f783
call fcn.10001270
mov ecx, dword [ebp - 0x438]
test ecx, ecx
je 0x1000f792
call fcn.10001270
push 0x100528e8
call fcn.1001ad7b
pop ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1000f7a9
call fcn.10001270
call fcn.1001d1f3
ret