Function at 0x140014808
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x37c8]
mov eax, 0x38a0
call fcn.14002dd90
sub rsp, rax
mov rax, qword [0x14006f100]
xor rax, rsp
mov qword [rbp + 0x3790], rax
mov r12, rcx
mov qword [rbp + 0x28], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov esi, 0x400
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r13d, r13d
test rax, rax
je 0x1400148a2
lea rax, [rbp + 0x420]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x428]
lea r8, [rbp + 0x430]
lea rdx, [rbp + 0x438]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x550]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x440]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r14d, 0x10
mov dword [rbp + 0x80], r14d
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbp + 0x448]
lea r8, [rbp + 0x450]
lea rdx, [rbp + 0x458]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x790]
call fcn.1400526b0
lea r15d, [r14 - 8]
mov edx, r15d
lea rcx, [rbp + 0x460]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
lea ebx, [r14 - 0xf]
test eax, eax
jne 0x140014949
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x468]
lea r8, [rbp + 0x470]
lea rdx, [rbp + 0x478]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp + 0x84], r14d
lea rdx, [rbp + 0x84]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, qword [r12]
test rcx, rcx
je 0x140015bd4
call fcn.1400091c8
test eax, eax
je 0x140015bd4
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x80000000
lea rcx, str.vwjtd5yw.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or rdi, 0xffffffffffffffff
cmp rax, rdi
je 0x1400149df
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140014a2d
lea rax, [rbp + 0x480]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x488]
lea r8, [rbp + 0xb8]
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0xb90]
call fcn.1400526b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140014a8c
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xd0]
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0xe0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140014ada
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xf0]
lea r8, [rbp + 0xf8]
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x88], r14d
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, r15d
lea rcx, [rbp + 0x108]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140014b29
lea ebx, [rax + 1]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x110]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rbp + 0x6c]
mov rcx, qword [r12]
call fcn.140008fbc
mov r15, rax
cmp dword [rbp + 0x6c], r13d
je 0x140015bc2
lea rax, [0x140070f60]
mov qword [rbp + 0x40], rax
mov rcx, rax
call fcn.14002b7c4
test eax, eax
jne 0x140015c39
cmp dword [0x140070fac], 0x7fffffff
je 0x140015c44
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov ecx, 0x88
call fcn.14002dbd8
mov rbx, rax
mov qword [rbp - 0x18], rax
test rax, rax
je 0x140014bc2
xor edx, edx
mov r8d, 0x88
mov rcx, rax
call fcn.1400526b0
mov rcx, rbx
call fcn.14000cc50
mov r14, rax
jmp 0x140014bc5
mov r14, r13
mov qword [rbp - 0x10], r14
mov ecx, 0x18
call fcn.14002dbd8
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140014c01
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov eax, 1
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], eax
lea rax, vtable.XLBT::_LOFFVOSRN.0
mov qword [rsi], rax
mov qword [rsi + 0x10], r14
jmp 0x140014c04
mov rsi, r13
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140014c5d
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x120]
lea r8, [rbp + 0x128]
lea rdx, [rbp + 0x130]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x138]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea ebx, [r9 + 1]
mov r8d, ebx
mov edx, 0x80000000
lea rcx, str.kmKcM66p.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x140014ca9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x140]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140014ccf
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x148]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xf90]
call fcn.1400526b0
lea r9, [rbp + 0x150]
lea r8, [rbp + 0x158]
lea rdx, [rbp + 0x160]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x1390]
call fcn.1400526b0
lea r9, [rbp + 0x168]
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x178]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x180]
lea r8, [rbp + 0x188]
lea rdx, [rbp + 0x190]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r8d, dword [rbp + 0x6c]
mov rdx, r15
mov rcx, r14
call fcn.14000deac
test al, al
je 0x140015b88
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x1790]
call fcn.1400526b0
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x80000000
lea rcx, str.N.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x140014dd0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xac], 0x10
lea rdx, [rbp + 0xac]
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0x8c], 0x10
lea rdx, [rbp + 0x8c]
lea rcx, [rbp + 0x650]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x1b90]
call fcn.1400526b0
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 8
lea rcx, [rbp + 0x198]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140014e53
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x1a0]
lea r8, [rbp + 0x1a8]
lea rdx, [rbp + 0x1b0]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, 0x10
mov dword [rbp + 0xb0], ebx
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x670]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, r14
call fcn.14000d8dc
sub dword [rbp + 0x6c], eax
mov dword [rbp + 0xa8], ebx
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x690]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140014f24
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1c8]
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x1d8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x1e0]
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x1f0]
lea rbx, [0x140056e38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x200]
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x210]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x218]
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x228]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, 0x400
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x1f90]
call fcn.1400526b0
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x2390]
call fcn.1400526b0
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.s7pby5.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x140014ff5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.14000d8dc
mov eax, eax
add r15, rax
mov qword [rsp + 0x40], r15
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x2790]
call fcn.1400526b0
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001508d
lea rax, [rbp + 0x230]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x238]
lea r8, [rbp + 0x240]
lea rdx, [rbp + 0x248]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x10
mov dword [rbp + 0xa4], ebx
lea rdx, [rbp + 0xa4]
lea rcx, [rbp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0xa0], ebx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x6d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x500]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x250]
lea r8, [rbp + 0x258]
lea rdx, [rbp + 0x260]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea ebx, [r9 + 1]
mov r8d, ebx
mov edx, 0x80000000
lea rcx, str.YjDKtNlw4.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x140015134
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.14000da40
mov rcx, r14
cmp al, bl
jne 0x140015783
mov dl, bl
call fcn.14000d050
test al, al
je 0x140015b88
mov r8b, bl
lea rdx, [rbp + 8]
mov rcx, r14
call fcn.14000d79c
nop
lea rdx, [rbp + 0x68]
mov rcx, qword [rax]
call fcn.14000db0c
mov r15b, al
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x1400151a5
mov edx, edi
lock xadd dword [rbx + 8], edx
add edx, edi
jne 0x1400151a5
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x1400151a5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
test r15b, r15b
je 0x140015b88
mov al, byte [rbp + 0x68]
cmp al, 1
jne 0x140015311
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov r15d, 0xa8
mov ecx, r15d
call fcn.14002dbd8
mov rbx, rax
mov qword [rbp], rax
test rax, rax
je 0x1400151f4
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov rcx, rbx
call fcn.14000e560
mov r15, rax
jmp 0x1400151f7
mov r15, r13
mov qword [rbp + 0x30], r15
mov ecx, 0x18
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140015236
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.BXBIVGLZ::XPQITFRPELAC.0
mov qword [rbx], rax
mov qword [rbx + 0x10], r15
jmp 0x140015239
mov rbx, r13
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
test rsi, rsi
je 0x140015253
lock inc dword [rsi + 8]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rsi
lea rdx, [rsp + 0x68]
mov rcx, r15
call fcn.14000ed08
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
test rbx, rbx
je 0x14001527c
lock inc dword [rbx + 8]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x58]
call fcn.140015d6c
nop
test rbx, rbx
je 0x1400152bd
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x1400152bd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x1400152bd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov r15, qword [rsp + 0x40]
test rsi, rsi
je 0x1400152ef
mov eax, edi
lock xadd dword [rsi + 8], eax
add eax, edi
jne 0x1400152ef
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov eax, edi
lock xadd dword [rsi + 0xc], eax
add eax, edi
jne 0x1400152ef
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
nop
lea rcx, [0x140070f60]
call fcn.14002b7ec
cmp dword [rbp + 0x6c], r13d
je 0x140015bc2
lea rax, [0x140070f60]
jmp 0x140014b68
cmp al, 2
jne 0x1400152bd
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov r15d, 0xc8
mov ecx, r15d
call fcn.14002dbd8
mov rbx, rax
mov qword [rbp - 8], rax
test rax, rax
je 0x140015350
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov rcx, rbx
call fcn.140009388
mov r15, rax
jmp 0x140015353
mov r15, r13
mov qword [rbp + 0x38], r15
mov ecx, 0x18
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14001538f
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov eax, 1
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], eax
lea rax, vtable.DTNGHZ__::AVBEQDXPQM_B.0
mov qword [rbx], rax
mov qword [rbx + 0x10], r15
jmp 0x140015392
mov rbx, r13
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], rbx
lea rcx, [rbp + 0x510]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov r13d, 0x400
mov r8d, r13d
xor edx, edx
lea rcx, [rbp + 0x2b90]
call fcn.1400526b0
lea rcx, [rbp + 0x520]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
test rax, rax
je 0x140015427
lea rax, [rbp + 0x268]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x270]
lea r8, [rbp + 0x278]
lea rdx, [rbp + 0x280]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, 0x10
mov dword [rbp + 0x9c], r13d
lea rdx, [rbp + 0x9c]
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0x98], r13d
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x710]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x540]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x288]
lea r8, [rbp + 0x290]
lea rdx, [rbp + 0x298]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r13 + 1]
lea rcx, str.YjDKtNlw4.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x1400154d1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
test rsi, rsi
je 0x1400154e2
lock inc dword [rsi + 8]
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], rsi
mov rax, qword [r15]
lea rdx, [rbp - 0x58]
mov rcx, r15
call qword [rax + 8]
test al, al
je 0x140015b5b
mov rcx, r15
call fcn.1400099ac
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x48]
lea rcx, [0x140070fb0]
call fcn.140012ab0
mov rcx, qword [rax]
add rcx, 0x28
lea rdx, [rbp - 0x48]
call fcn.14000cdd8
lea r9, [rbp + 0x2a0]
lea r8, [rbp + 0x2a8]
lea rdx, [rbp + 0x2b0]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x2b8]
lea r8, [rbp + 0x2c0]
lea rdx, [rbp + 0x2c8]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x1400155c5
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2d8]
lea r8, [rbp + 0x2e0]
lea rdx, [rbp + 0x2e8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140015616
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2f8]
lea r8, [rbp + 0x300]
lea rdx, [rbp + 0x308]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140015667
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x318]
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x328]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x1400156b8
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x338]
lea r8, [rbp + 0x340]
lea rdx, [rbp + 0x348]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140015723
lea rax, [rbp + 0x350]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x358]
lea r8, [rbp + 0x360]
lea rdx, [rbp + 0x368]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140015774
lea rax, [rbp + 0x370]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x378]
lea r8, [rbp + 0x380]
lea rdx, [rbp + 0x388]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
nop
jmp 0x140015291
call fcn.14000da40
cmp al, 3
jne 0x140015894
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
movdqu xmmword [rbp - 0x68], xmm0
test rsi, rsi
je 0x1400157a5
lock add dword [rsi + 8], ebx
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], rsi
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x70]
call fcn.1400022ec
nop
mov rax, qword [rbp + 0x70]
test rax, rax
je 0x140015bce
cmp byte [rax + 0x60], r13b
jne 0x140015842
mov dl, 3
mov rcx, r14
call fcn.14000d050
test al, al
je 0x140015804
mov rbx, qword [rbp + 0x70]
mov r8b, 3
lea rdx, [rbp + 0x18]
mov rcx, r14
call fcn.14000d79c
mov r8, qword [rbx]
mov rdx, rax
mov rcx, rbx
call qword [r8 + 8]
test al, al
je 0x140015bce
mov rcx, qword [rbp + 0x70]
call fcn.1400099ac
mov dword [rsp + 0x54], eax
lea r8, [rsp + 0x54]
lea rdx, [rbp + 0x58]
lea rcx, [0x140070fb0]
call fcn.140012ab0
mov rcx, qword [rax]
add rcx, 0x28
lea rdx, [rbp + 0x70]
call fcn.14000cdd8
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140015853
lea rdx, [rbp + 0x70]
lea rcx, [0x140070f30]
call fcn.1400092d4
nop
mov rbx, qword [rbp + 0x78]
test rbx, rbx
je 0x1400152c2
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x1400152c2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x1400152c2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x1400152c2
mov rcx, r14
call fcn.14000da40
cmp al, 5
jne 0x1400159d6
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x2f90]
call fcn.1400526b0
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x80000000
lea rcx, str.Nip.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x1400158f3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x390]
lea r8, [rbp + 0x398]
lea rdx, [rbp + 0x3a0]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x3a8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x3b8]
lea r8, [rbp + 0x3c0]
lea rdx, [rbp + 0x3c8]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140015984
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rbp + 0x94], 0x10
lea rdx, [rbp + 0x94]
lea rcx, [rbp + 0x730]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
test rsi, rsi
je 0x1400159c0
lock add dword [rsi + 8], ebx
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x78]
call fcn.140013304
jmp 0x1400152c2
mov rcx, r14
call fcn.14000da40
cmp al, 0xc
jne 0x1400152c2
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rbp + 0xb4], 0x10
lea rdx, [rbp + 0xb4]
lea rcx, [rbp + 0x750]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, 8
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140015a37
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x80000000
lea rcx, str.NGYYFG0.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x140015a72
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140015ac3
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3e8]
lea r8, [rbp + 0x3f0]
lea rdx, [rbp + 0x3f8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x400]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rbp + 0x90], 0x10
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x770]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x3390]
call fcn.1400526b0
lea r9, [rbp + 0x408]
lea r8, [rbp + 0x410]
lea rdx, [rbp + 0x418]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
test rsi, rsi
je 0x140015b43
lock inc dword [rsi + 8]
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rsi
lea rcx, [rsp + 0x78]
call fcn.14000e2f0
jmp 0x1400152c2
test rbx, rbx
je 0x140015b88
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x140015b88
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x140015b88
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
test rsi, rsi
je 0x140015bb5
mov eax, edi
lock xadd dword [rsi + 8], eax
add eax, edi
jne 0x140015bb5
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov eax, edi
lock xadd dword [rsi + 0xc], eax
add eax, edi
jne 0x140015bb5
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
nop
lea rcx, [0x140070f60]
call fcn.14002b7ec
nop
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x140015c09
jmp 0x140015be2
mov rbx, qword [rbp + 0x78]
jmp 0x140015b5b
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x140015c09
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x140015c09
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x140015c09
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rbp + 0x3790]
xor rcx, rsp
call fcn.14002dcb0
lea r11, [rsp + 0x38a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 5
call fcn.14002b648
int3
mov dword [0x140070fac], 0x7ffffffe
mov ecx, 6
call fcn.14002b648
int3