Function at 0x100198d2
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push 0x468
mov eax, 0x1003e9c5
call fcn.1001d244
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x45c], 0x10
push eax
call esi
push str.NdUfbfbN
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x59fdc84
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x10048e60
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x10019968
push eax
call edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.Fm5upiL.txt
call ebx
cmp eax, 0xffffffff
je 0x10019989
push eax
call edi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.StrDx1PuSA
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x29766240
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
push str.e7kLXOjakD
lea ecx, [ebp - 0x48]
call fcn.10001fd7
and dword [ebp - 4], 0
lea edx, [ebp - 0x48]
push 0x2642fdd8
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48]
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.1wwTFQIxuK.txt
call ebx
cmp eax, 0xffffffff
je 0x10019a37
push eax
call edi
push 8
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x10019a57
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x10
push eax
lea eax, [ebp - 0x50]
push eax
call esi
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x10
push eax
lea eax, [ebp - 0x50]
push eax
call esi
lea ecx, [ebp - 0x470]
call fcn.10017e34
push str.LkOD97U7
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x45c], eax
call fcn.10001fd7
push 0x56f6194
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 1
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x454], eax
test eax, eax
je 0x10019b1b
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call esi
push dword [ebp - 0x454]
call edi
push str.kboK
lea ecx, [ebp - 0x48]
call fcn.10001fd7
push 0x4e2ef5e
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 2
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48]
call fcn.10002037
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x454], eax
test eax, eax
je 0x10019ba4
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call esi
push dword [ebp - 0x454]
call edi
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0x10
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x400
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea ecx, [ebp - 0x48]
push str.pcPJARUrI
call fcn.10001fd7
push 0x2b78bc40
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 3
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48]
call fcn.10002037
push 0x10048ee0
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x20b4ffbd
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x454], eax
test eax, eax
je 0x10019c87
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call esi
push dword [ebp - 0x454]
call edi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.RIYrUnS3l
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x869bac4
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
cmp dword [ebp - 0x45c], 0
jne 0x10019cd4
xor al, al
jmp 0x1001a4a1
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.IPld
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x1aa4a59b
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x454], eax
test eax, eax
je 0x10019d50
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call esi
push dword [ebp - 0x454]
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x454], eax
test eax, eax
je 0x10019d8f
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call esi
push dword [ebp - 0x454]
call edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.ExhQlSZyU.txt
call ebx
cmp eax, 0xffffffff
je 0x10019dba
push eax
call edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.3gyD43.txt
call ebx
cmp eax, 0xffffffff
je 0x10019ddb
push eax
call edi
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0x10
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.Mlvg8rQYF
lea ecx, [ebp - 0x48]
call fcn.10001fd7
push 0x26fefa88
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 4
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48]
call fcn.10002037
push 0x10048f38
lea ecx, [ebp - 0x48]
call fcn.10001fd7
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push 0x7fc2ccb
cmova eax, dword [ebp - 0x48]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x454], eax
test eax, eax
je 0x10019eb2
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call esi
push dword [ebp - 0x454]
call edi
xorps xmm0, xmm0
push 0x40
movlpd qword [ebp - 0x38], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x454], esi
push 0x40
push 0
push esi
mov dword [ebp - 4], 5
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push dword [ebp - 0x470]
push dword [ebp - 0x45c]
call fcn.1000508a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
push eax
call fcn.10004281
push ecx
push ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 6
mov ecx, esp
push eax
call fcn.100014c2
call fcn.1000e18a
pop ecx
pop ecx
push str.IG8UxVb
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x2eb19352
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 7
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
push 0x10048f48
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x804015a
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x470], eax
test eax, eax
je 0x10019fed
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x458]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x470]
call edi
push 0x10048f6c
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2fbc16
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0x400
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
call esi
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x470], eax
test eax, eax
je 0x1001a078
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x458]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x470]
call edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call esi
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001a0ce
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x474]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push esi
call edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.OPf2pim.txt
call ebx
cmp eax, 0xffffffff
je 0x1001a0ef
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x20]
push eax
call esi
push 0x400
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.b9E9wOk.txt
mov dword [ebp - 0x454], eax
call ebx
cmp eax, 0xffffffff
je 0x1001a144
push eax
call edi
push str.oeFti
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x6b7ece4
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.va.txt
call ebx
cmp eax, 0xffffffff
je 0x1001a1b3
push eax
call edi
push str.mQPt
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0xa846843
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 8
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.FDYM.txt
call ebx
cmp eax, 0xffffffff
je 0x1001a211
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call esi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.34ufz
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x705c75e
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 8
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1001a274
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x1004774c
call esi
push str.Ouy73N
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1c7724c8
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
mov eax, dword [ebp - 0x454]
test eax, eax
je 0x1001a493
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x1004774c
call esi
push 8
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1001a331
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.4qzLWCD
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2127d630
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.ZxHOf
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2a49b2bf
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x1004774c
call esi
push str.5fvd
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x7c9562c
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 9
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10002037
push 8
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1001a40d
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x1004774c
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.XV.txt
call ebx
cmp eax, 0xffffffff
je 0x1001a447
push eax
call edi
push 0x10048fe4
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x39b017d7
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x1004774c
call esi
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x1001a49f
call fcn.10001270
mov al, 1
call fcn.1001d1f3
ret