Function at 0x140072090
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rdi
mov eax, 0x28990
call fcn.1400d9c00
sub rsp, rax
mov rax, qword [0x140134040]
xor rax, rsp
mov qword [rsp + 0x28980], rax
lea r9, [rsp + 0x1da8]
lea r8, [rsp + 0x1db0]
lea rdx, [rsp + 0x1db8]
lea rcx, [0x14011cb30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1dc0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x470], rax
cmp qword [rsp + 0x470], 0
je 0x14007214e
lea rax, [rsp + 0x1dc8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1dd0]
lea r8, [rsp + 0x1dd8]
lea rdx, [rsp + 0x1de0]
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x69e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1958], 0x10
lea rdx, [rsp + 0x1958]
lea rcx, [rsp + 0x8160]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x8180]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
jmp 0x1400721a5
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x400
jae 0x1400721ce
movsxd rax, dword [rsp + 0x40]
mov al, byte [rsp + rax + 0x8180]
inc al
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0x8180], al
jmp 0x14007219b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.4Vxwg5LX.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe58], rax
cmp qword [rsp + 0xe58], 0xffffffffffffffff
je 0x140072223
mov rcx, qword [rsp + 0xe58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x69f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x8580]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
jmp 0x140072259
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0x400
jae 0x140072282
movsxd rax, dword [rsp + 0x44]
mov al, byte [rsp + rax + 0x8580]
inc al
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0x8580], al
jmp 0x14007224f
lea rcx, [rsp + 0x6a08]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1de8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x1df0]
lea r8, [rsp + 0x1df8]
lea rdx, [rsp + 0x1e00]
lea rcx, [0x14011cb08]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x478], 0x3b6b897a
lea rdx, [0x14011cb04]
lea rcx, [rsp + 0x5478]
call fcn.1400038c4
lea rcx, [rsp + 0x5478]
call fcn.14000a750
mov r8d, dword [rsp + 0x478]
mov rdx, rax
lea rcx, [0x14011cb50]
call fcn.140015614
lea rcx, [rsp + 0x5478]
call fcn.14000389c
lea r9, [rsp + 0x1e08]
lea r8, [rsp + 0x1e10]
lea rdx, [rsp + 0x1e18]
lea rcx, [0x14011cb48]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x47c], 0x37c09c8f
lea rdx, str.MZV2z
lea rcx, [rsp + 0x5498]
call fcn.1400038c4
lea rcx, [rsp + 0x5498]
call fcn.14000a750
mov r8d, dword [rsp + 0x47c]
mov rdx, rax
lea rcx, [0x14011cb38]
call fcn.140015614
lea rcx, [rsp + 0x5498]
call fcn.14000389c
lea rcx, [rsp + 0x1e20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x480], 0x3b8ad0c6
lea rdx, [0x14011cb70]
lea rcx, [rsp + 0x54b8]
call fcn.1400038c4
lea rcx, [rsp + 0x54b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x480]
mov rdx, rax
lea rcx, [0x14011cb68]
call fcn.140015614
lea rcx, [rsp + 0x54b8]
call fcn.14000389c
lea r9, [rsp + 0x1e28]
lea r8, [rsp + 0x1e30]
lea rdx, [rsp + 0x1e38]
lea rcx, [0x14011cb60]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x8980]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
jmp 0x140072433
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x400
jae 0x14007245c
movsxd rax, dword [rsp + 0x48]
mov al, byte [rsp + rax + 0x8980]
inc al
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0x8980], al
jmp 0x140072429
lea r9, [rsp + 0x1e40]
lea r8, [rsp + 0x1e48]
lea rdx, [rsp + 0x1e50]
lea rcx, [0x14011cb58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe40], rax
cmp qword [rsp + 0xe40], 0
je 0x1400724eb
lea rax, [rsp + 0x1e58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e60]
lea r8, [rsp + 0x1e68]
lea rdx, [rsp + 0x1e70]
mov rcx, qword [rsp + 0xe40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x8d80]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 0
jmp 0x140072513
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
cmp rax, 0x400
jae 0x14007253c
movsxd rax, dword [rsp + 0x4c]
mov al, byte [rsp + rax + 0x8d80]
inc al
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x8d80], al
jmp 0x140072509
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.GcohK3ZFts.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe60], rax
cmp qword [rsp + 0xe60], 0xffffffffffffffff
je 0x140072591
mov rcx, qword [rsp + 0xe60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x484], 0x27e2a69c
lea rdx, str.0fabytjTO
lea rcx, [rsp + 0x54d8]
call fcn.1400038c4
lea rcx, [rsp + 0x54d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x484]
mov rdx, rax
lea rcx, [0x14011cb84]
call fcn.140015614
lea rcx, [rsp + 0x54d8]
call fcn.14000389c
mov dword [rsp + 0x488], 0x20f96027
lea rdx, str.bRY32HVx
lea rcx, [rsp + 0x54f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x54f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x488]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x54f8]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Cj3KGBk.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe68], rax
cmp qword [rsp + 0xe68], 0xffffffffffffffff
je 0x140072696
mov rcx, qword [rsp + 0xe68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6a18]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x48c], 0xefc36fe
lea rdx, str.zrXhnSPeS9
lea rcx, [rsp + 0x5518]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5518]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x48c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5518]
call fcn.14000389c
mov dword [rsp + 0x490], 0x27cccae2
lea rdx, str.Ns1DTnH9ZO
lea rcx, [rsp + 0x5538]
call fcn.1400038c4
lea rcx, [rsp + 0x5538]
call fcn.14000a750
mov r8d, dword [rsp + 0x490]
mov rdx, rax
lea rcx, [0x14011cbc0]
call fcn.140015614
lea rcx, [rsp + 0x5538]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe38], rax
cmp qword [rsp + 0xe38], 0
je 0x1400727be
lea rax, [rsp + 0x1e78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e80]
lea r8, [rsp + 0x1e88]
lea rdx, [rsp + 0x1e90]
mov rcx, qword [rsp + 0xe38]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x494], 0x2fe3c31b
lea rdx, str.YqBh
lea rcx, [rsp + 0x5558]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5558]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x494]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5558]
call fcn.14000389c
lea rcx, [rsp + 0x1e98]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1954], 0x10
lea rdx, [rsp + 0x1954]
lea rcx, [rsp + 0x70a0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1ea0]
lea r8, [rsp + 0x1ea8]
lea rdx, [rsp + 0x1eb0]
lea rcx, [0x14011cc10]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x9180]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x14007289a
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x1400728c3
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0x9180]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x9180], al
jmp 0x140072890
mov dword [rsp + 0x4a0], 0x292373ea
lea rdx, str.OrOoT
lea rcx, [rsp + 0x5578]
call fcn.1400038c4
lea rcx, [rsp + 0x5578]
call fcn.14000a750
mov r8d, dword [rsp + 0x4a0]
mov rdx, rax
lea rcx, [0x14011cc00]
call fcn.140015614
lea rcx, [rsp + 0x5578]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe30], rax
cmp qword [rsp + 0xe30], 0
je 0x14007297d
lea rax, [rsp + 0x1eb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ec0]
lea r8, [rsp + 0x1ec8]
lea rdx, [rsp + 0x1ed0]
mov rcx, qword [rsp + 0xe30]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.lOnE.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe70], rax
cmp qword [rsp + 0xe70], 0xffffffffffffffff
je 0x1400729d2
mov rcx, qword [rsp + 0xe70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4a4], 0x3d16fef
lea rdx, str.evg3y42oD
lea rcx, [rsp + 0x5598]
call fcn.1400038c4
lea rcx, [rsp + 0x5598]
call fcn.14000a750
mov r8d, dword [rsp + 0x4a4]
mov rdx, rax
lea rcx, [0x14011cc30]
call fcn.140015614
lea rcx, [rsp + 0x5598]
call fcn.14000389c
mov dword [rsp + 0x1950], 0x10
lea rdx, [rsp + 0x1950]
lea rcx, [rsp + 0x70c0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x1ed8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.BcU.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe78], rax
cmp qword [rsp + 0xe78], 0xffffffffffffffff
je 0x140072aa6
mov rcx, qword [rsp + 0xe78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe28], rax
cmp qword [rsp + 0xe28], 0
je 0x140072b10
lea rax, [rsp + 0x1ee0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ee8]
lea r8, [rsp + 0x1ef0]
lea rdx, [rsp + 0x1ef8]
mov rcx, qword [rsp + 0xe28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4b0], 0x1b8f762a
lea rdx, str.flBE
lea rcx, [rsp + 0x55b8]
call fcn.1400038c4
lea rcx, [rsp + 0x55b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x4b0]
mov rdx, rax
lea rcx, [0x14011cc80]
call fcn.140015614
lea rcx, [rsp + 0x55b8]
call fcn.14000389c
lea rcx, [rsp + 0x6a28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x1f00]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x9580]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x140072ba4
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x140072bcd
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0x9580]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0x9580], al
jmp 0x140072b9a
mov dword [rsp + 0x248], 1
mov edx, 8
lea rcx, [rsp + 0x1a70]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140072c25
mov eax, dword [rsp + 0x1a70]
mov dword [rsp + 0x14e8], eax
mov eax, dword [rsp + 0x1a74]
mov dword [rsp + 0x14e4], eax
mov ecx, dword [rsp + 0x248]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x248]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x1f08]
lea r8, [rsp + 0x1f10]
lea rdx, [rsp + 0x1f18]
lea rcx, [0x14011cc78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x9980]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x140072c72
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x140072c9b
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0x9980]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0x9980], al
jmp 0x140072c68
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.cDGcum.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe80], rax
cmp qword [rsp + 0xe80], 0xffffffffffffffff
je 0x140072cf0
mov rcx, qword [rsp + 0xe80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1f20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x194c], 0x10
lea rdx, [rsp + 0x194c]
lea rcx, [rsp + 0x70e0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x1f28]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x9d80]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x140072d55
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x140072d7e
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0x9d80]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0x9d80], al
jmp 0x140072d4b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe20], rax
cmp qword [rsp + 0xe20], 0
je 0x140072de8
lea rax, [rsp + 0x1f30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f38]
lea r8, [rsp + 0x1f40]
lea rdx, [rsp + 0x1f48]
mov rcx, qword [rsp + 0xe20]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1f50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.w1syIrgz.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe88], rax
cmp qword [rsp + 0xe88], 0xffffffffffffffff
je 0x140072e4b
mov rcx, qword [rsp + 0xe88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1948], 0x10
lea rdx, [rsp + 0x1948]
lea rcx, [rsp + 0x7100]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x24c], 1
mov edx, 8
lea rcx, [rsp + 0x1bd0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140072ec4
mov eax, dword [rsp + 0x1bd0]
mov dword [rsp + 0x14e0], eax
mov eax, dword [rsp + 0x1bd4]
mov dword [rsp + 0x14dc], eax
mov ecx, dword [rsp + 0x24c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x24c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1944], 0x10
lea rdx, [rsp + 0x1944]
lea rcx, [rsp + 0x7120]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.1tygaa.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe90], rax
cmp qword [rsp + 0xe90], 0xffffffffffffffff
je 0x140072f3a
mov rcx, qword [rsp + 0xe90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xa180]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x140072f62
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x140072f8b
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0xa180]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0xa180], al
jmp 0x140072f58
lea rcx, [rsp + 0x6a38]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x4d0], 0x3a4e7f77
lea rdx, str.Q9OUc5t
lea rcx, [rsp + 0x55d8]
call fcn.1400038c4
lea rcx, [rsp + 0x55d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x4d0]
mov rdx, rax
lea rcx, [0x14011cc90]
call fcn.140015614
lea rcx, [rsp + 0x55d8]
call fcn.14000389c
lea rcx, [rsp + 0x1f58]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xa580]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x14007301f
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x140073048
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0xa580]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0xa580], al
jmp 0x140073015
mov dword [rsp + 0x1940], 0x10
lea rdx, [rsp + 0x1940]
lea rcx, [rsp + 0x7140]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x1f60]
lea r8, [rsp + 0x1f68]
lea rdx, [rsp + 0x1f70]
lea rcx, [0x14011ccf0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1f78]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x1f80]
lea r8, [rsp + 0x1f88]
lea rdx, [rsp + 0x1f90]
lea rcx, [0x14011cce8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1f98]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xa980]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x1400730f7
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x140073120
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0xa980]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0xa980], al
jmp 0x1400730ed
lea rcx, [rsp + 0x6a48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x250], 1
mov edx, 8
lea rcx, [rsp + 0x1ba8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140073186
mov eax, dword [rsp + 0x1ba8]
mov dword [rsp + 0x14d8], eax
mov eax, dword [rsp + 0x1bac]
mov dword [rsp + 0x14d4], eax
mov ecx, dword [rsp + 0x250]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x250]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x1fa0]
lea r8, [rsp + 0x1fa8]
lea rdx, [rsp + 0x1fb0]
lea rcx, [0x14011cce0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1fb8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x4e0], 0x3850636a
lea rdx, str.MA0Rn
lea rcx, [rsp + 0x55f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x55f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x4e0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x55f8]
call fcn.14000389c
lea r9, [rsp + 0x1fc0]
lea r8, [rsp + 0x1fc8]
lea rdx, [rsp + 0x1fd0]
lea rcx, [0x14011cd08]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x4e4], 0x2dabbda8
lea rdx, [0x14011cd04]
lea rcx, [rsp + 0x5618]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5618]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x4e4]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5618]
call fcn.14000389c
mov dword [rsp + 0x4e8], 0x207b1403
lea rdx, [0x14011cd00]
lea rcx, [rsp + 0x5638]
call fcn.1400038c4
lea rcx, [rsp + 0x5638]
call fcn.14000a750
mov r8d, dword [rsp + 0x4e8]
mov rdx, rax
lea rcx, [0x14011ccf8]
call fcn.140015614
lea rcx, [rsp + 0x5638]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe18], rax
cmp qword [rsp + 0xe18], 0
je 0x140073358
lea rax, [rsp + 0x1fd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1fe0]
lea r8, [rsp + 0x1fe8]
lea rdx, [rsp + 0x1ff0]
mov rcx, qword [rsp + 0xe18]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe10], rax
cmp qword [rsp + 0xe10], 0
je 0x1400733c2
lea rax, [rsp + 0x1ff8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2000]
lea r8, [rsp + 0x2008]
lea rdx, [rsp + 0x2010]
mov rcx, qword [rsp + 0xe10]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x254], 1
mov edx, 8
lea rcx, [rsp + 0x1b90]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14007341a
mov eax, dword [rsp + 0x1b90]
mov dword [rsp + 0x14d0], eax
mov eax, dword [rsp + 0x1b94]
mov dword [rsp + 0x14cc], eax
mov ecx, dword [rsp + 0x254]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x254]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x2018]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x2020]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.wI1s.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe98], rax
cmp qword [rsp + 0xe98], 0xffffffffffffffff
je 0x14007348b
mov rcx, qword [rsp + 0xe98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6a58]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x193c], 0x10
lea rdx, [rsp + 0x193c]
lea rcx, [rsp + 0x7160]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x1938], 0x10
lea rdx, [rsp + 0x1938]
lea rcx, [rsp + 0x7180]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x500], 0x228fe565
lea rdx, str.YQ07kuPUsP
lea rcx, [rsp + 0x5658]
call fcn.1400038c4
lea rcx, [rsp + 0x5658]
call fcn.14000a750
mov r8d, dword [rsp + 0x500]
mov rdx, rax
lea rcx, [0x14011cd14]
call fcn.140015614
lea rcx, [rsp + 0x5658]
call fcn.14000389c
mov dword [rsp + 0x504], 0x244bcf12
lea rdx, [0x14011cd10]
lea rcx, [rsp + 0x5678]
call fcn.1400038c4
lea rcx, [rsp + 0x5678]
call fcn.14000a750
mov r8d, dword [rsp + 0x504]
mov rdx, rax
lea rcx, [0x14011cd68]
call fcn.140015614
lea rcx, [rsp + 0x5678]
call fcn.14000389c
lea r9, [rsp + 0x2028]
lea r8, [rsp + 0x2030]
lea rdx, [rsp + 0x2038]
lea rcx, [0x14011cd60]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x258], 1
mov edx, 8
lea rcx, [rsp + 0x1af0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400735f8
mov eax, dword [rsp + 0x1af0]
mov dword [rsp + 0x14c8], eax
mov eax, dword [rsp + 0x1af4]
mov dword [rsp + 0x1510], eax
mov ecx, dword [rsp + 0x258]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x258]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x508], 0x3b4ff74e
lea rdx, str.w0WGGI0k0m
lea rcx, [rsp + 0x5698]
call fcn.1400038c4
lea rcx, [rsp + 0x5698]
call fcn.14000a750
mov r8d, dword [rsp + 0x508]
mov rdx, rax
lea rcx, [0x14011cd44]
call fcn.140015614
lea rcx, [rsp + 0x5698]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe08], rax
cmp qword [rsp + 0xe08], 0
je 0x1400736b2
lea rax, [rsp + 0x2040]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2048]
lea r8, [rsp + 0x2050]
lea rdx, [rsp + 0x2058]
mov rcx, qword [rsp + 0xe08]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x50c], 0x1f4d98f7
lea rdx, [0x14011cd88]
lea rcx, [rsp + 0x56b8]
call fcn.1400038c4
lea rcx, [rsp + 0x56b8]
call fcn.14000a750
mov r8d, dword [rsp + 0x50c]
mov rdx, rax
lea rcx, [0x14011cd80]
call fcn.140015614
lea rcx, [rsp + 0x56b8]
call fcn.14000389c
lea rcx, [rsp + 0x2060]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x2068]
lea r8, [rsp + 0x2070]
lea rdx, [rsp + 0x2078]
lea rcx, [0x14011cd78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x510], 0x275ed1ef
lea rdx, [0x14011cd70]
lea rcx, [rsp + 0x56d8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x56d8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x510]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x56d8]
call fcn.14000389c
lea rcx, [rsp + 0x6a68]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x514], 0x34845401
lea rdx, str.PqiV6akeyU
lea rcx, [rsp + 0x56f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x56f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x514]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x56f8]
call fcn.14000389c
lea rcx, [rsp + 0x6a78]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xad80]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x140073839
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x140073862
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0xad80]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0xad80], al
jmp 0x14007382f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.lzdqcfn.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xea0], rax
cmp qword [rsp + 0xea0], 0xffffffffffffffff
je 0x1400738b7
mov rcx, qword [rsp + 0xea0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6a88]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe00], rax
cmp qword [rsp + 0xe00], 0
je 0x14007392f
lea rax, [rsp + 0x2080]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2088]
lea r8, [rsp + 0x2090]
lea rdx, [rsp + 0x2098]
mov rcx, qword [rsp + 0xe00]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6a98]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x518], 0xdea5a56
lea rdx, str.70NHLNw4dZ
lea rcx, [rsp + 0x5718]
call fcn.1400038c4
lea rcx, [rsp + 0x5718]
call fcn.14000a750
mov r8d, dword [rsp + 0x518]
mov rdx, rax
lea rcx, [0x14011cd8c]
call fcn.140015614
lea rcx, [rsp + 0x5718]
call fcn.14000389c
mov dword [rsp + 0x51c], 0x1bc0ad1e
lea rdx, str.ocFkGfG
lea rcx, [rsp + 0x5738]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5738]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x51c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5738]
call fcn.14000389c
lea rcx, [rsp + 0x20a0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x520], 0x27d86153
lea rdx, [0x14011cddc]
lea rcx, [rsp + 0x5758]
call fcn.1400038c4
lea rcx, [rsp + 0x5758]
call fcn.14000a750
mov r8d, dword [rsp + 0x520]
mov rdx, rax
lea rcx, [0x14011cdd4]
call fcn.140015614
lea rcx, [rsp + 0x5758]
call fcn.14000389c
mov dword [rsp + 0x524], 0x261e2081
lea rdx, str.Mryeo5
lea rcx, [rsp + 0x5778]
call fcn.1400038c4
lea rcx, [rsp + 0x5778]
call fcn.14000a750
mov r8d, dword [rsp + 0x524]
mov rdx, rax
lea rcx, [0x14011ce18]
call fcn.140015614
lea rcx, [rsp + 0x5778]
call fcn.14000389c
lea rax, [rsp + 0xb180]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x140073ac3
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x140073aec
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0xb180]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0xb180], al
jmp 0x140073ab9
lea r9, [rsp + 0x20a8]
lea r8, [rsp + 0x20b0]
lea rdx, [rsp + 0x20b8]
lea rcx, [0x14011ce10]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1934], 0x10
lea rdx, [rsp + 0x1934]
lea rcx, [rsp + 0x71a0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x6aa8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1930], 0x10
lea rdx, [rsp + 0x1930]
lea rcx, [rsp + 0x71c0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x6ab8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x6ac8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.kiYN.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xea8], rax
cmp qword [rsp + 0xea8], 0xffffffffffffffff
je 0x140073bd2
mov rcx, qword [rsp + 0xea8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x538], 0x99f8390
lea rdx, str.ZR3JLaxvz
lea rcx, [rsp + 0x5798]
call fcn.1400038c4
lea rcx, [rsp + 0x5798]
call fcn.14000a750
mov r8d, dword [rsp + 0x538]
mov rdx, rax
lea rcx, [0x14011ce60]
call fcn.140015614
lea rcx, [rsp + 0x5798]
call fcn.14000389c
lea rcx, [rsp + 0x20c0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x25c], 1
mov edx, 8
lea rcx, [rsp + 0x1b78]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140073c88
mov eax, dword [rsp + 0x1b78]
mov dword [rsp + 0x1524], eax
mov eax, dword [rsp + 0x1b7c]
mov dword [rsp + 0x1358], eax
mov ecx, dword [rsp + 0x25c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x25c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.BJmrBWaK4k.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeb0], rax
cmp qword [rsp + 0xeb0], 0xffffffffffffffff
je 0x140073cdd
mov rcx, qword [rsp + 0xeb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xde8], rax
cmp qword [rsp + 0xde8], 0
je 0x140073d47
lea rax, [rsp + 0x20c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20d0]
lea r8, [rsp + 0x20d8]
lea rdx, [rsp + 0x20e0]
mov rcx, qword [rsp + 0xde8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xde8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x20e8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x20f0]
lea r8, [rsp + 0x20f8]
lea rdx, [rsp + 0x2100]
lea rcx, [0x14011ce38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.BYYIr.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeb8], rax
cmp qword [rsp + 0xeb8], 0xffffffffffffffff
je 0x140073dcf
mov rcx, qword [rsp + 0xeb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x53c], 0x165dc6a4
lea rdx, str.iCMGWit
lea rcx, [rsp + 0x57b8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x57b8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x53c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x57b8]
call fcn.14000389c
lea r9, [rsp + 0x2108]
lea r8, [rsp + 0x2110]
lea rdx, [rsp + 0x2118]
lea rcx, [0x14011ce78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x540], 0x3e14598
lea rdx, str.u9T7KnV
lea rcx, [rsp + 0x57d8]
call fcn.1400038c4
lea rcx, [rsp + 0x57d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x540]
mov rdx, rax
lea rcx, [0x14011ce68]
call fcn.140015614
lea rcx, [rsp + 0x57d8]
call fcn.14000389c
lea rcx, [rsp + 0x6ad8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x544], 0x1d55ad9d
lea rdx, str.etzdN1
lea rcx, [rsp + 0x4278]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x4278]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x544]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x4278]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x14011ce98]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xec0], rax
cmp qword [rsp + 0xec0], 0xffffffffffffffff
je 0x140073f67
mov rcx, qword [rsp + 0xec0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x548], 0x2d0a8d9d
lea rdx, [0x14011ce90]
lea rcx, [rsp + 0x5818]
call fcn.1400038c4
lea rcx, [rsp + 0x5818]
call fcn.14000a750
mov r8d, dword [rsp + 0x548]
mov rdx, rax
lea rcx, [0x14011ce88]
call fcn.140015614
lea rcx, [rsp + 0x5818]
call fcn.14000389c
lea rcx, [rsp + 0x2120]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xb580]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x140073fed
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x140074016
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0xb580]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0xb580], al
jmp 0x140073fe3
mov dword [rsp + 0x54c], 0x1f9651e8
lea rdx, str.569fI9w
lea rcx, [rsp + 0x5838]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5838]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x54c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5838]
call fcn.14000389c
mov dword [rsp + 0x260], 1
mov edx, 8
lea rcx, [rsp + 0x1bd8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400740ce
mov eax, dword [rsp + 0x1bd8]
mov dword [rsp + 0x14ec], eax
mov eax, dword [rsp + 0x1bdc]
mov dword [rsp + 0x14f4], eax
mov ecx, dword [rsp + 0x260]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x260]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xb980]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x1400740f6
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x14007411f
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0xb980]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0xb980], al
jmp 0x1400740ec
mov dword [rsp + 0x550], 0x12b62375
lea rdx, str.xYLVsUbR5y
lea rcx, [rsp + 0x5858]
call fcn.1400038c4
lea rcx, [rsp + 0x5858]
call fcn.14000a750
mov r8d, dword [rsp + 0x550]
mov rdx, rax
lea rcx, [0x14011ceb0]
call fcn.140015614
lea rcx, [rsp + 0x5858]
call fcn.14000389c
mov dword [rsp + 0x264], 1
mov edx, 8
lea rcx, [rsp + 0x1c28]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400741c7
mov eax, dword [rsp + 0x1c28]
mov dword [rsp + 0x14f8], eax
mov eax, dword [rsp + 0x1c2c]
mov dword [rsp + 0x1500], eax
mov ecx, dword [rsp + 0x264]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x264]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x554], 0x101a74a1
lea rdx, [0x14011ceac]
lea rcx, [rsp + 0x5878]
call fcn.1400038c4
lea rcx, [rsp + 0x5878]
call fcn.14000a750
mov r8d, dword [rsp + 0x554]
mov rdx, rax
lea rcx, [0x14011cf14]
call fcn.140015614
lea rcx, [rsp + 0x5878]
call fcn.14000389c
lea rcx, [rsp + 0x6ae8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x2128]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xbd80]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x14007425b
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x140074284
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0xbd80]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0xbd80], al
jmp 0x140074251
mov dword [rsp + 0x558], 0x1a37cc9a
lea rdx, str.cOKgSV
lea rcx, [rsp + 0x5898]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5898]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x558]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5898]
call fcn.14000389c
mov dword [rsp + 0x268], 1
mov edx, 8
lea rcx, [rsp + 0x1d50]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14007433c
mov eax, dword [rsp + 0x1d50]
mov dword [rsp + 0x1504], eax
mov eax, dword [rsp + 0x1d54]
mov dword [rsp + 0x150c], eax
mov ecx, dword [rsp + 0x268]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x268]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x192c], 0x10
lea rdx, [rsp + 0x192c]
lea rcx, [rsp + 0x71e0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x2130]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x2138]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x26c], 1
mov edx, 8
lea rcx, [rsp + 0x1a10]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400743d1
mov eax, dword [rsp + 0x1a10]
mov dword [rsp + 0x151c], eax
mov eax, dword [rsp + 0x1a14]
mov dword [rsp + 0x14f0], eax
mov ecx, dword [rsp + 0x26c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x26c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.iy22FdpD.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xec8], rax
cmp qword [rsp + 0xec8], 0xffffffffffffffff
je 0x140074426
mov rcx, qword [rsp + 0xec8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdd8], rax
cmp qword [rsp + 0xdd8], 0
je 0x140074490
lea rax, [rsp + 0x2140]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2148]
lea r8, [rsp + 0x2150]
lea rdx, [rsp + 0x2158]
mov rcx, qword [rsp + 0xdd8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6af8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x270], 1
mov edx, 8
lea rcx, [rsp + 0x1ab0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400744f6
mov eax, dword [rsp + 0x1ab0]
mov dword [rsp + 0x1520], eax
mov eax, dword [rsp + 0x1ab4]
mov dword [rsp + 0x1518], eax
mov ecx, dword [rsp + 0x270]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x270]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x274], 1
mov edx, 8
lea rcx, [rsp + 0x1ad8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14007454e
mov eax, dword [rsp + 0x1ad8]
mov dword [rsp + 0x1514], eax
mov eax, dword [rsp + 0x1adc]
mov dword [rsp + 0x1508], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.6O6CDR4sBx.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xed0], rax
cmp qword [rsp + 0xed0], 0xffffffffffffffff
je 0x1400745a3
mov rcx, qword [rsp + 0xed0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x2160]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xc180]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x1400745e2
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x140074614
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0xc180]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0xc180], al
jmp 0x1400745d2
lea rax, [rsp + 0xc580]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x140074645
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x140074677
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0xc580]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0xc580], al
jmp 0x140074635
mov dword [rsp + 0x568], 0x22044c71
lea rdx, str.w3TS
lea rcx, [rsp + 0x58b8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x58b8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x568]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x58b8]
call fcn.14000389c
mov dword [rsp + 0x278], 1
mov edx, 8
lea rcx, [rsp + 0x1b48]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14007472f
mov eax, dword [rsp + 0x1b48]
mov dword [rsp + 0x14fc], eax
mov eax, dword [rsp + 0x1b4c]
mov dword [rsp + 0x1528], eax
mov ecx, dword [rsp + 0x278]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x278]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1928], 0x10
lea rdx, [rsp + 0x1928]
lea rcx, [rsp + 0x7200]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.kFzdIdwwtb.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xed8], rax
cmp qword [rsp + 0xed8], 0xffffffffffffffff
je 0x1400747a5
mov rcx, qword [rsp + 0xed8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdd0], rax
cmp qword [rsp + 0xdd0], 0
je 0x14007480f
lea rax, [rsp + 0x2168]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2170]
lea r8, [rsp + 0x2178]
lea rdx, [rsp + 0x2180]
mov rcx, qword [rsp + 0xdd0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x578], 0x2fd04092
lea rdx, str.PxMhDlvPq1
lea rcx, [rsp + 0x58d8]
call fcn.1400038c4
lea rcx, [rsp + 0x58d8]
call fcn.14000a750
mov r8d, dword [rsp + 0x578]
mov rdx, rax
lea rcx, [0x14011cf1c]
call fcn.140015614
lea rcx, [rsp + 0x58d8]
call fcn.14000389c
mov dword [rsp + 0x1924], 0x10
lea rdx, [rsp + 0x1924]
lea rcx, [rsp + 0x7220]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.y1QiJ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xee0], rax
cmp qword [rsp + 0xee0], 0xffffffffffffffff
je 0x1400748d5
mov rcx, qword [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xc980]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0
jmp 0x140074906
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
movsxd rax, dword [rsp + 0x88]
cmp rax, 0x400
jae 0x140074938
movsxd rax, dword [rsp + 0x88]
mov al, byte [rsp + rax + 0xc980]
inc al
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0xc980], al
jmp 0x1400748f6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.c4iiaLVx.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xee8], rax
cmp qword [rsp + 0xee8], 0xffffffffffffffff
je 0x14007498d
mov rcx, qword [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x588], 0x17520381
lea rdx, [0x14011cf70]
lea rcx, [rsp + 0x58f8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x58f8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x588]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x58f8]
call fcn.14000389c
mov dword [rsp + 0x1920], 0x10
lea rdx, [rsp + 0x1920]
lea rcx, [rsp + 0x7240]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.T3.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xef0], rax
cmp qword [rsp + 0xef0], 0xffffffffffffffff
je 0x140074a63
mov rcx, qword [rsp + 0xef0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.tjp62MVili.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xef8], rax
cmp qword [rsp + 0xef8], 0xffffffffffffffff
je 0x140074ab8
mov rcx, qword [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xcd80]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x8c], 0
jmp 0x140074ae9
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
movsxd rax, dword [rsp + 0x8c]
cmp rax, 0x400
jae 0x140074b1b
movsxd rax, dword [rsp + 0x8c]
mov al, byte [rsp + rax + 0xcd80]
inc al
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0xcd80], al
jmp 0x140074ad9
lea r9, [rsp + 0x2188]
lea r8, [rsp + 0x2190]
lea rdx, [rsp + 0x2198]
lea rcx, [0x14011cfc8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x6b08]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xd180]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
jmp 0x140074b7f
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 0x400
jae 0x140074bb1
movsxd rax, dword [rsp + 0x90]
mov al, byte [rsp + rax + 0xd180]
inc al
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0xd180], al
jmp 0x140074b6f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdc8], rax
cmp qword [rsp + 0xdc8], 0
je 0x140074c1b
lea rax, [rsp + 0x21a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21a8]
lea r8, [rsp + 0x21b0]
lea rdx, [rsp + 0x21b8]
mov rcx, qword [rsp + 0xdc8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xd580]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x94], 0
jmp 0x140074c4c
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
cmp rax, 0x400
jae 0x140074c7e
movsxd rax, dword [rsp + 0x94]
mov al, byte [rsp + rax + 0xd580]
inc al
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0xd580], al
jmp 0x140074c3c
mov dword [rsp + 0x27c], 1
mov edx, 8
lea rcx, [rsp + 0x1be0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140074cd6
mov eax, dword [rsp + 0x1be0]
mov dword [rsp + 0x152c], eax
mov eax, dword [rsp + 0x1be4]
mov dword [rsp + 0x1530], eax
mov ecx, dword [rsp + 0x27c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x27c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x6b18]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x21c0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x598], 0xced7bc4
lea rdx, str.GeIPVF3F
lea rcx, [rsp + 0x5918]
call fcn.1400038c4
lea rcx, [rsp + 0x5918]
call fcn.14000a750
mov r8d, dword [rsp + 0x598]
mov rdx, rax
lea rcx, [0x14011cfac]
call fcn.140015614
lea rcx, [rsp + 0x5918]
call fcn.14000389c
lea r9, [rsp + 0x21c8]
lea r8, [rsp + 0x21d0]
lea rdx, [rsp + 0x21d8]
lea rcx, [0x14011d010]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x191c], 0x10
lea rdx, [rsp + 0x191c]
lea rcx, [rsp + 0x7260]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x5a8], 0x396bef98
lea rdx, str.Bvg6Gzai
lea rcx, [rsp + 0x5938]
call fcn.1400038c4
lea rcx, [rsp + 0x5938]
call fcn.14000a750
mov r8d, dword [rsp + 0x5a8]
mov rdx, rax
lea rcx, [0x14011cff8]
call fcn.140015614
lea rcx, [rsp + 0x5938]
call fcn.14000389c
mov dword [rsp + 0x280], 1
mov edx, 8
lea rcx, [rsp + 0x1c18]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140074e30
mov eax, dword [rsp + 0x1c18]
mov dword [rsp + 0x1534], eax
mov eax, dword [rsp + 0x1c1c]
mov dword [rsp + 0x1538], eax
mov ecx, dword [rsp + 0x280]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x280]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x5ac], 0x1b5967b8
lea rdx, str.jzfLXt
lea rcx, [rsp + 0x5958]
call fcn.1400038c4
lea rcx, [rsp + 0x5958]
call fcn.14000a750
mov r8d, dword [rsp + 0x5ac]
mov rdx, rax
lea rcx, [0x14011d03c]
call fcn.140015614
lea rcx, [rsp + 0x5958]
call fcn.14000389c
lea rcx, [rsp + 0x21e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1918], 0x10
lea rdx, [rsp + 0x1918]
lea rcx, [rsp + 0x7280]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x21e8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Tlt6z.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf00], rax
cmp qword [rsp + 0xf00], 0xffffffffffffffff
je 0x140074f12
mov rcx, qword [rsp + 0xf00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdc0], rax
cmp qword [rsp + 0xdc0], 0
je 0x140074f7c
lea rax, [rsp + 0x21f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21f8]
lea r8, [rsp + 0x2200]
lea rdx, [rsp + 0x2208]
mov rcx, qword [rsp + 0xdc0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2210]
lea r8, [rsp + 0x2218]
lea rdx, [rsp + 0x2220]
lea rcx, [0x14011d020]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x6b28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xdb0], rax
cmp qword [rsp + 0xdb0], 0
je 0x140075019
lea rax, [rsp + 0x2228]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2230]
lea r8, [rsp + 0x2238]
lea rdx, [rsp + 0x2240]
mov rcx, qword [rsp + 0xdb0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xdb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x6b38]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x2248]
lea r8, [rsp + 0x2250]
lea rdx, [rsp + 0x2258]
lea rcx, [0x14011d018]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xda8], rax
cmp qword [rsp + 0xda8], 0
je 0x1400750b6
lea rax, [rsp + 0x2260]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2268]
lea r8, [rsp + 0x2270]
lea rdx, [rsp + 0x2278]
mov rcx, qword [rsp + 0xda8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xda8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5b8], 0x330f219e
lea rdx, str.8Uk93
lea rcx, [rsp + 0x5978]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x5978]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x5b8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x5978]
call fcn.14000389c
lea rcx, [rsp + 0x6b48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xda0], rax
cmp qword [rsp + 0xda0], 0
je 0x14007518e
lea rax, [rsp + 0x2280]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2288]
lea r8, [rsp + 0x2290]
lea rdx, [rsp + 0x2298]
mov rcx, qword [rsp + 0xda0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xda0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x22a0]
lea r8, [rsp + 0x22a8]
lea rdx, [rsp + 0x22b0]
lea rcx, [0x14011d060]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x22b8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x22c0]
lea r8, [rsp + 0x22c8]
lea rdx, [rsp + 0x22d0]
lea rcx, [0x14011d058]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x5bc], 0x1da3b8ba
lea rdx, str.3fpvVJuJ6
lea rcx, [rsp + 0x5998]
call fcn.1400038c4
lea rcx, [rsp + 0x5998]
call fcn.14000a750
mov r8d, dword [rsp + 0x5bc]
mov rdx, rax
lea rcx, [0x14011d0a0]
call fcn.140015614
lea rcx, [rsp + 0x5998]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd90], rax
cmp qword [rsp + 0xd90], 0
je 0x1400752a0
lea rax, [rsp + 0x22d8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x22e0]
lea r8, [rsp + 0x22e8]
lea rdx, [rsp + 0x22f0]
mov rcx, qword [rsp + 0xd90]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x22f8]
lea r8, [rsp + 0x2300]
lea rdx, [rsp + 0x2308]
lea rcx, [0x14011d098]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xd980]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0
jmp 0x1400752f6
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
movsxd rax, dword [rsp + 0x98]
cmp rax, 0x400
jae 0x140075328
movsxd rax, dword [rsp + 0x98]
mov al, byte [rsp + rax + 0xd980]
inc al
movsxd rcx, dword [rsp + 0x98]
mov byte [rsp + rcx + 0xd980], al
jmp 0x1400752e6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd88], rax
cmp qword [rsp + 0xd88], 0
je 0x140075392
lea rax, [rsp + 0x2310]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2318]
lea r8, [rsp + 0x2320]
lea rdx, [rsp + 0x2328]
mov rcx, qword [rsp + 0xd88]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x284], 1
mov edx, 8
lea rcx, [rsp + 0x1c70]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400753ea
mov eax, dword [rsp + 0x1c70]
mov dword [rsp + 0x153c], eax
mov eax, dword [rsp + 0x1c74]
mov dword [rsp + 0x1540], eax
mov ecx, dword [rsp + 0x284]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x284]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.FOK2rni.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf08], rax
cmp qword [rsp + 0xf08], 0xffffffffffffffff
je 0x14007543f
mov rcx, qword [rsp + 0xf08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd78], rax
cmp qword [rsp + 0xd78], 0
je 0x1400754a9
lea rax, [rsp + 0x2330]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2338]
lea r8, [rsp + 0x2340]
lea rdx, [rsp + 0x2348]
mov rcx, qword [rsp + 0xd78]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5c0], 0x1d6b9866
lea rdx, str.MX09TIzJ
lea rcx, [rsp + 0x59b8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x59b8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x5c0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x59b8]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd60], rax
cmp qword [rsp + 0xd60], 0
je 0x140075573
lea rax, [rsp + 0x2350]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2358]
lea r8, [rsp + 0x2360]
lea rdx, [rsp + 0x2368]
mov rcx, qword [rsp + 0xd60]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x288], 1
mov edx, 8
lea rcx, [rsp + 0x1978]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400755cb
mov eax, dword [rsp + 0x1978]
mov dword [rsp + 0x1544], eax
mov eax, dword [rsp + 0x197c]
mov dword [rsp + 0x1548], eax
mov ecx, dword [rsp + 0x288]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x288]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x2370]
lea r8, [rsp + 0x2378]
lea rdx, [rsp + 0x2380]
lea rcx, [0x14011d0d0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x2388]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xdd80]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x9c], 0
jmp 0x14007562f
mov eax, dword [rsp + 0x9c]
inc eax
mov dword [rsp + 0x9c], eax
movsxd rax, dword [rsp + 0x9c]
cmp rax, 0x400
jae 0x140075661
movsxd rax, dword [rsp + 0x9c]
mov al, byte [rsp + rax + 0xdd80]
inc al
movsxd rcx, dword [rsp + 0x9c]
mov byte [rsp + rcx + 0xdd80], al
jmp 0x14007561f
mov dword [rsp + 0x28c], 1
mov edx, 8
lea rcx, [rsp + 0x19e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400756b9
mov eax, dword [rsp + 0x19e8]
mov dword [rsp + 0x154c], eax
mov eax, dword [rsp + 0x19ec]
mov dword [rsp + 0x1550], eax
mov ecx, dword [rsp + 0x28c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x28c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x2390]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x2398]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x5c4], 0x269abb2b
lea rdx, str.Me76K4ch
lea rcx, [rsp + 0x59d8]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x59d8]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x5c4]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x59d8]
call fcn.14000389c
mov dword [rsp + 0x5c8], 0x5538f88
lea rdx, str.bq4TVNLew
lea rcx, [rsp + 0x59f8]
call fcn.1400038c4
lea rcx, [rsp + 0x59f8]
call fcn.14000a750
mov r8d, dword [rsp + 0x5c8]
mov rdx, rax
lea rcx, [0x14011d0a8]
call fcn.140015614
lea rcx, [rsp + 0x59f8]
call fcn.14000389c
mov dword [rsp + 0x290], 1
mov edx, 8
lea rcx, [rsp + 0x19f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400757dd
mov eax, dword [rsp + 0x19f0]
mov dword [rsp + 0x1554], eax
mov eax, dword [rsp + 0x19f4]
mov dword [rsp + 0x1558], eax
mov ecx, dword [rsp + 0x290]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x290]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1914], 0x10
lea rdx, [rsp + 0x1914]
lea rcx, [rsp + 0x72a0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x294], 1
mov edx, 8
lea rcx, [rsp + 0x19f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140075856
mov eax, dword [rsp + 0x19f8]
mov dword [rsp + 0x155c], eax
mov eax, dword [rsp + 0x19fc]
mov dword [rsp + 0x1560], eax
mov ecx, dword [rsp + 0x294]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x294]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xe180]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
jmp 0x140075887
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
cmp rax, 0x400
jae 0x1400758b9
movsxd rax, dword [rsp + 0xa0]
mov al, byte [rsp + rax + 0xe180]
inc al
movsxd rcx, dword [rsp + 0xa0]
mov byte [rsp + rcx + 0xe180], al
jmp 0x140075877
mov dword [rsp + 0x1910], 0x10
lea rdx, [rsp + 0x1910]
lea rcx, [rsp + 0x72c0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.GS.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf10], rax
cmp qword [rsp + 0xf10], 0xffffffffffffffff
je 0x14007592f
mov rcx, qword [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x298], 1
mov edx, 8
lea rcx, [rsp + 0x1a20]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140075987
mov eax, dword [rsp + 0x1a20]
mov dword [rsp + 0x1564], eax
mov eax, dword [rsp + 0x1a24]
mov dword [rsp + 0x1568], eax
mov ecx, dword [rsp + 0x298]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x298]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd48], rax
cmp qword [rsp + 0xd48], 0
je 0x1400759f1
lea rax, [rsp + 0x23a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x23a8]
lea r8, [rsp + 0x23b0]
lea rdx, [rsp + 0x23b8]
mov rcx, qword [rsp + 0xd48]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xe580]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa4], 0
jmp 0x140075a22
mov eax, dword [rsp + 0xa4]
inc eax
mov dword [rsp + 0xa4], eax
movsxd rax, dword [rsp + 0xa4]
cmp rax, 0x400
jae 0x140075a54
movsxd rax, dword [rsp + 0xa4]
mov al, byte [rsp + rax + 0xe580]
inc al
movsxd rcx, dword [rsp + 0xa4]
mov byte [rsp + rcx + 0xe580], al
jmp 0x140075a12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd38], rax
cmp qword [rsp + 0xd38], 0
je 0x140075abe
lea rax, [rsp + 0x23c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x23c8]
lea r8, [rsp + 0x23d0]
lea rdx, [rsp + 0x23d8]
mov rcx, qword [rsp + 0xd38]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x29c], 1
mov edx, 8
lea rcx, [rsp + 0x1a28]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140075b16
mov eax, dword [rsp + 0x1a28]
mov dword [rsp + 0x156c], eax
mov eax, dword [rsp + 0x1a2c]
mov dword [rsp + 0x1570], eax
mov ecx, dword [rsp + 0x29c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x29c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.V3fYE3X.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf18], rax
cmp qword [rsp + 0xf18], 0xffffffffffffffff
je 0x140075b6b
mov rcx, qword [rsp + 0xf18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2a0], 1
mov edx, 8
lea rcx, [rsp + 0x1a78]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140075bc3
mov eax, dword [rsp + 0x1a78]
mov dword [rsp + 0x1574], eax
mov eax, dword [rsp + 0x1a7c]
mov dword [rsp + 0x1578], eax
mov ecx, dword [rsp + 0x2a0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x2a0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x6b58]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xe980]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa8], 0
jmp 0x140075c02
mov eax, dword [rsp + 0xa8]
inc eax
mov dword [rsp + 0xa8], eax
movsxd rax, dword [rsp + 0xa8]
cmp rax, 0x400
jae 0x140075c34
movsxd rax, dword [rsp + 0xa8]
mov al, byte [rsp + rax + 0xe980]
inc al
movsxd rcx, dword [rsp + 0xa8]
mov byte [rsp + rcx + 0xe980], al
jmp 0x140075bf2
mov dword [rsp + 0x190c], 0x10
lea rdx, [rsp + 0x190c]
lea rcx, [rsp + 0x72e0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x23e0]
lea r8, [rsp + 0x23e8]
lea rdx, [rsp + 0x23f0]
lea rcx, [0x14011d0f8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1908], 0x10
lea rdx, [rsp + 0x1908]
lea rcx, [rsp + 0x7300]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd18], rax
cmp qword [rsp + 0xd18], 0
je 0x140075d05
lea rax, [rsp + 0x23f8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2400]
lea r8, [rsp + 0x2408]
lea rdx, [rsp + 0x2410]
mov rcx, qword [rsp + 0xd18]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xed80]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xac], 0
jmp 0x140075d36
movsxd rax, dword [rsp + 0xac]
cmp rax, 0x400
jae 0x140075d68