Function at 0x14001b344
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x4a480
call fcn.1400b6760
sub rsp, rax
mov rax, qword [0x14010c080]
xor rax, rsp
mov qword [rsp + 0x4a470], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x7f8], 0x1d6b32d8
lea rdx, [0x1400e5e78]
lea rcx, [rsp + 0x9628]
call fcn.140003708
nop
lea rdx, [rsp + 0x9628]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x7f8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9628]
call fcn.1400040f0
mov dword [rsp + 0x7fc], 0x6f674a1
lea rdx, [0x1400e5e84]
lea rcx, [rsp + 0x9648]
call fcn.140003708
lea rcx, [rsp + 0x9648]
call fcn.14000a93c
mov r8d, dword [rsp + 0x7fc]
mov rdx, rax
lea rcx, [0x1400e5e8c]
call fcn.140044734
lea rcx, [rsp + 0x9648]
call fcn.1400040f0
lea r9, [rsp + 0x7598]
lea r8, [rsp + 0x75a0]
lea rdx, [rsp + 0x75a8]
lea rcx, [0x1400e5e98]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x800], 0xd6369df
lea rdx, [0x1400e5ea0]
lea rcx, [rsp + 0x9668]
call fcn.140003708
nop
lea rdx, [rsp + 0x9668]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x800]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9668]
call fcn.1400040f0
lea r9, [rsp + 0x75b0]
lea r8, [rsp + 0x75b8]
lea rdx, [rsp + 0x75c0]
lea rcx, [0x1400e5ea8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x75c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xe470]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x14001b506
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x14001b52f
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0xe470]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0xe470], al
jmp 0x14001b4fc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xd18], rax
cmp qword [rsp + 0xd18], 0
je 0x14001b599
lea rax, [rsp + 0x75d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x75d8]
lea r8, [rsp + 0x75e0]
lea rdx, [rsp + 0x75e8]
mov rcx, qword [rsp + 0xd18]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xd18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xe870]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x14001b5c1
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x14001b5ea
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0xe870]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0xe870], al
jmp 0x14001b5b7
mov dword [rsp + 0x31f8], 0x10
lea rdx, [rsp + 0x31f8]
lea rcx, [rsp + 0xc628]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1908], rax
cmp qword [rsp + 0x1908], 0
je 0x14001b675
lea rax, [rsp + 0x75f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x75f8]
lea r8, [rsp + 0x7600]
lea rdx, [rsp + 0x7608]
mov rcx, qword [rsp + 0x1908]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1908]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xec70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x14001b69d
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x14001b6c6
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0xec70]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0xec70], al
jmp 0x14001b693
lea r9, [rsp + 0x7610]
lea r8, [rsp + 0x7618]
lea rdx, [rsp + 0x7620]
lea rcx, [0x1400e5eb0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xf070]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x14001b713
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x14001b73c
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0xf070]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0xf070], al
jmp 0x14001b709
mov dword [rsp + 0x414], 1
mov edx, 8
lea rcx, [rsp + 0x34d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b794
mov eax, dword [rsp + 0x34d8]
mov dword [rsp + 0x2538], eax
mov eax, dword [rsp + 0x34dc]
mov dword [rsp + 0x253c], eax
mov ecx, dword [rsp + 0x414]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x414]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x418], 1
mov edx, 8
lea rcx, [rsp + 0x34f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b7ec
mov eax, dword [rsp + 0x34f0]
mov dword [rsp + 0x2540], eax
mov eax, dword [rsp + 0x34f4]
mov dword [rsp + 0x2544], eax
mov ecx, dword [rsp + 0x418]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x418]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x810], 0x1aae0c29
lea rdx, [0x1400e5eb8]
lea rcx, [rsp + 0x9688]
call fcn.140003708
nop
lea rdx, [rsp + 0x9688]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x810]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9688]
call fcn.1400040f0
mov dword [rsp + 0x31f4], 0x10
lea rdx, [rsp + 0x31f4]
lea rcx, [rsp + 0xc648]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x31f0], 0x10
lea rdx, [rsp + 0x31f0]
lea rcx, [rsp + 0xc668]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x7628]
lea r8, [rsp + 0x7630]
lea rdx, [rsp + 0x7638]
lea rcx, [0x1400e5ec0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x41c], 1
mov edx, 8
lea rcx, [rsp + 0x34f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b90b
mov eax, dword [rsp + 0x34f8]
mov dword [rsp + 0x2548], eax
mov eax, dword [rsp + 0x34fc]
mov dword [rsp + 0x254c], eax
mov ecx, dword [rsp + 0x41c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x41c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xf470]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x14001b933
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x14001b95c
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0xf470]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0xf470], al
jmp 0x14001b929
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x18f0], rax
cmp qword [rsp + 0x18f0], 0
je 0x14001b9c6
lea rax, [rsp + 0x7640]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7648]
lea r8, [rsp + 0x7650]
lea rdx, [rsp + 0x7658]
mov rcx, qword [rsp + 0x18f0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x18f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x828], 0x3b7b9eaf
lea rdx, [0x1400e5ec8]
lea rcx, [rsp + 0x96a8]
call fcn.140003708
lea rcx, [rsp + 0x96a8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x828]
mov rdx, rax
lea rcx, [0x1400e5ecc]
call fcn.140044734
lea rcx, [rsp + 0x96a8]
call fcn.1400040f0
lea rax, [rsp + 0xf870]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x14001ba3e
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x14001ba67
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0xf870]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0xf870], al
jmp 0x14001ba34
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x18d8], rax
cmp qword [rsp + 0x18d8], 0
je 0x14001bad1
lea rax, [rsp + 0x7660]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7668]
lea r8, [rsp + 0x7670]
lea rdx, [rsp + 0x7678]
mov rcx, qword [rsp + 0x18d8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x18d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x7680]
lea r8, [rsp + 0x7688]
lea rdx, [rsp + 0x7690]
lea rcx, [0x1400e5ed8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x7698]
lea r8, [rsp + 0x76a0]
lea rdx, [rsp + 0x76a8]
lea rcx, [0x1400e5ee0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x420], 1
mov edx, 8
lea rcx, [rsp + 0x3500]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001bb73
mov eax, dword [rsp + 0x3500]
mov dword [rsp + 0x2550], eax
mov eax, dword [rsp + 0x3504]
mov dword [rsp + 0x2554], eax
mov ecx, dword [rsp + 0x420]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x420]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xfc70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x14001bb9b
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x14001bbc4
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0xfc70]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0xfc70], al
jmp 0x14001bb91
mov dword [rsp + 0x82c], 0x15fbbaa9
lea rdx, [0x1400e5e74]
lea rcx, [rsp + 0x96c8]
call fcn.140003708
nop
lea rdx, [rsp + 0x96c8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x82c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x96c8]
call fcn.1400040f0
mov dword [rsp + 0x830], 0x17d2473
lea rdx, [0x1400e5ee8]
lea rcx, [rsp + 0x96e8]
call fcn.140003708
nop
lea rdx, [rsp + 0x96e8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x830]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x96e8]
call fcn.1400040f0
lea rcx, [rsp + 0x76b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x18d0], rax
cmp qword [rsp + 0x18d0], 0
je 0x14001bcfc
lea rax, [rsp + 0x76b8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x76c0]
lea r8, [rsp + 0x76c8]
lea rdx, [rsp + 0x76d0]
mov rcx, qword [rsp + 0x18d0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x18d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x76d8]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x18c8], rax
cmp qword [rsp + 0x18c8], 0
je 0x14001bd74
lea rax, [rsp + 0x76e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x76e8]
lea r8, [rsp + 0x76f0]
lea rdx, [rsp + 0x76f8]
mov rcx, qword [rsp + 0x18c8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x18c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x10070]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x14001bd9c
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x14001bdc5
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0x10070]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0x10070], al
jmp 0x14001bd92
mov dword [rsp + 0x31ec], 0x10
lea rdx, [rsp + 0x31ec]
lea rcx, [rsp + 0xc688]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0xc0b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x840], 0x38aee2c0
lea rdx, [0x1400e5ef0]
lea rcx, [rsp + 0x9708]
call fcn.140003708
nop
lea rdx, [rsp + 0x9708]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x840]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9708]
call fcn.1400040f0
lea r9, [rsp + 0x7700]
lea r8, [rsp + 0x7708]
lea rdx, [rsp + 0x7710]
lea rcx, [0x1400e5ef8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xc0c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x18b8], rax
cmp qword [rsp + 0x18b8], 0
je 0x14001bef1
lea rax, [rsp + 0x7718]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7720]
lea r8, [rsp + 0x7728]
lea rdx, [rsp + 0x7730]
mov rcx, qword [rsp + 0x18b8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x18b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x844], 0x3b22ab85
lea rdx, [0x1400e5f00]
lea rcx, [rsp + 0x9728]
call fcn.140003708
nop
lea rdx, [rsp + 0x9728]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x844]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9728]
call fcn.1400040f0
mov dword [rsp + 0x424], 1
mov edx, 8
lea rcx, [rsp + 0x3510]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001bfa9
mov eax, dword [rsp + 0x3510]
mov dword [rsp + 0x2558], eax
mov eax, dword [rsp + 0x3514]
mov dword [rsp + 0x255c], eax
mov ecx, dword [rsp + 0x424]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x424]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x10470]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x14001bfd1
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x14001bffa
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0x10470]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0x10470], al
jmp 0x14001bfc7
lea rax, [rsp + 0x10870]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x14001c022
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x14001c04b
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0x10870]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0x10870], al
jmp 0x14001c018
lea rax, [rsp + 0x10c70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x14001c073
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x14001c09c
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0x10c70]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0x10c70], al
jmp 0x14001c069
lea rcx, [rsp + 0x7738]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x428], 1
mov edx, 8
lea rcx, [rsp + 0x3520]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c102
mov eax, dword [rsp + 0x3520]
mov dword [rsp + 0x2560], eax
mov eax, dword [rsp + 0x3524]
mov dword [rsp + 0x2564], eax
mov ecx, dword [rsp + 0x428]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x428]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x7740]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x11070]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x14001c138
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x14001c161
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0x11070]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0x11070], al
jmp 0x14001c12e
mov dword [rsp + 0x848], 0x11147feb
lea rdx, [0x1400e5f10]
lea rcx, [rsp + 0x9748]
call fcn.140003708
nop
lea rdx, [rsp + 0x9748]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x848]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9748]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x18b0], rax
cmp qword [rsp + 0x18b0], 0
je 0x14001c22b
lea rax, [rsp + 0x7748]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7750]
lea r8, [rsp + 0x7758]
lea rdx, [rsp + 0x7760]
mov rcx, qword [rsp + 0x18b0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x18b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x31e8], 0x10
lea rdx, [rsp + 0x31e8]
lea rcx, [rsp + 0xc6a8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0xc0d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x858], 0x2d28aa35
lea rdx, [0x1400e5f20]
lea rcx, [rsp + 0x9768]
call fcn.140003708
nop
lea rdx, [rsp + 0x9768]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x858]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9768]
call fcn.1400040f0
lea rcx, [rsp + 0x7768]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xc0e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x42c], 1
mov edx, 8
lea rcx, [rsp + 0x3538]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c32e
mov eax, dword [rsp + 0x3538]
mov dword [rsp + 0x2568], eax
mov eax, dword [rsp + 0x353c]
mov dword [rsp + 0x256c], eax
mov ecx, dword [rsp + 0x42c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x42c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x430], 1
mov edx, 8
lea rcx, [rsp + 0x3540]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c386
mov eax, dword [rsp + 0x3540]
mov dword [rsp + 0x2570], eax
mov eax, dword [rsp + 0x3544]
mov dword [rsp + 0x2574], eax
mov ecx, dword [rsp + 0x430]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x430]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e5f30]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1958], rax
cmp qword [rsp + 0x1958], 0xffffffffffffffff
je 0x14001c3db
mov rcx, qword [rsp + 0x1958]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x434], 1
mov edx, 8
lea rcx, [rsp + 0x3550]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c433
mov eax, dword [rsp + 0x3550]
mov dword [rsp + 0x2578], eax
mov eax, dword [rsp + 0x3554]
mov dword [rsp + 0x257c], eax
mov ecx, dword [rsp + 0x434]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x434]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x7770]
lea r8, [rsp + 0x7778]
lea rdx, [rsp + 0x7780]
lea rcx, [0x1400e5f48]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x85c], 0x21a77c08
lea rdx, [0x1400e5f50]
lea rcx, [rsp + 0x9788]
call fcn.140003708
nop
lea rdx, [rsp + 0x9788]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x85c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9788]
call fcn.1400040f0
mov dword [rsp + 0x860], 0x6a33d08
lea rdx, [0x1400e5f58]
lea rcx, [rsp + 0x97a8]
call fcn.140003708
lea rcx, [rsp + 0x97a8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x860]
mov rdx, rax
lea rcx, [0x1400e5f64]
call fcn.140044734
lea rcx, [rsp + 0x97a8]
call fcn.1400040f0
mov dword [rsp + 0x31e4], 0x10
lea rdx, [rsp + 0x31e4]
lea rcx, [rsp + 0xc6c8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x31e0], 0x10
lea rdx, [rsp + 0x31e0]
lea rcx, [rsp + 0xc6e8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x878], 0x2b541e2d
lea rdx, [0x1400e5f70]
lea rcx, [rsp + 0x97c8]
call fcn.140003708
lea rcx, [rsp + 0x97c8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x878]
mov rdx, rax
lea rcx, [0x1400e5f78]
call fcn.140044734
lea rcx, [rsp + 0x97c8]
call fcn.1400040f0
mov dword [rsp + 0x438], 1
mov edx, 8
lea rcx, [rsp + 0x3570]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c5f2
mov eax, dword [rsp + 0x3570]
mov dword [rsp + 0x2580], eax
mov eax, dword [rsp + 0x3574]
mov dword [rsp + 0x2584], eax
mov ecx, dword [rsp + 0x438]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x438]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e5f80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1960], rax
cmp qword [rsp + 0x1960], 0xffffffffffffffff
je 0x14001c647
mov rcx, qword [rsp + 0x1960]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x7788]
lea r8, [rsp + 0x7790]
lea rdx, [rsp + 0x7798]
lea rcx, [0x1400e5fa0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x87c], 0x102ff6
lea rdx, [0x1400e5fa8]
lea rcx, [rsp + 0x97e8]
call fcn.140003708
nop
lea rdx, [rsp + 0x97e8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x87c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x97e8]
call fcn.1400040f0
mov dword [rsp + 0x880], 0x13aaf27b
lea rdx, [0x1400e5fb0]
lea rcx, [rsp + 0x9808]
call fcn.140003708
lea rcx, [rsp + 0x9808]
call fcn.14000a93c
mov r8d, dword [rsp + 0x880]
mov rdx, rax
lea rcx, [0x1400e5fb8]
call fcn.140044734
lea rcx, [rsp + 0x9808]
call fcn.1400040f0
mov dword [rsp + 0x43c], 1
mov edx, 8
lea rcx, [rsp + 0x3588]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c774
mov eax, dword [rsp + 0x3588]
mov dword [rsp + 0x2588], eax
mov eax, dword [rsp + 0x358c]
mov dword [rsp + 0x258c], eax
mov ecx, dword [rsp + 0x43c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x43c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x11470]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x14001c7a5
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x14001c7d7
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0x11470]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0x11470], al
jmp 0x14001c795
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x18a0], rax
cmp qword [rsp + 0x18a0], 0
je 0x14001c841
lea rax, [rsp + 0x77a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3cd8]
lea r8, [rsp + 0x3ce0]
lea rdx, [rsp + 0x3ce8]
mov rcx, qword [rsp + 0x18a0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x18a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x31dc], 0x10
lea rdx, [rsp + 0x31dc]
lea rcx, [rsp + 0xc708]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x11870]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x14001c893
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x14001c8c5
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0x11870]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0x11870], al
jmp 0x14001c883
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1890], rax
cmp qword [rsp + 0x1890], 0
je 0x14001c92f
lea rax, [rsp + 0x3cf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3cf8]
lea r8, [rsp + 0x3d00]
lea rdx, [rsp + 0x3d08]
mov rcx, qword [rsp + 0x1890]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1890]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x890], 0xb4ddea1
lea rdx, [0x1400e5fc0]
lea rcx, [rsp + 0x9828]
call fcn.140003708
nop
lea rdx, [rsp + 0x9828]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x890]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9828]
call fcn.1400040f0
lea rcx, [rsp + 0x3d10]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x894], 0x2f60808c
lea rdx, [0x1400e5fc8]
lea rcx, [rsp + 0x9848]
call fcn.140003708
lea rcx, [rsp + 0x9848]
call fcn.14000a93c
mov r8d, dword [rsp + 0x894]
mov rdx, rax
lea rcx, [0x1400e5fd4]
call fcn.140044734
lea rcx, [rsp + 0x9848]
call fcn.1400040f0
mov dword [rsp + 0x898], 0x13a05ee3
lea rdx, [0x1400e5fe0]
lea rcx, [rsp + 0x9868]
call fcn.140003708
nop
lea rdx, [rsp + 0x9868]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x898]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9868]
call fcn.1400040f0
lea r9, [rsp + 0x3d18]
lea r8, [rsp + 0x3d20]
lea rdx, [rsp + 0x3d28]
lea rcx, [0x1400e5fe8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x440], 1
mov edx, 8
lea rcx, [rsp + 0x3590]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001caca
mov eax, dword [rsp + 0x3590]
mov dword [rsp + 0x2590], eax
mov eax, dword [rsp + 0x3594]
mov dword [rsp + 0x2594], eax
mov ecx, dword [rsp + 0x440]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x440]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x444], 1
mov edx, 8
lea rcx, [rsp + 0x35a0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001cb22
mov eax, dword [rsp + 0x35a0]
mov dword [rsp + 0x2598], eax
mov eax, dword [rsp + 0x35a4]
mov dword [rsp + 0x259c], eax
mov ecx, dword [rsp + 0x444]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x444]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x31d8], 0x10
lea rdx, [rsp + 0x31d8]
lea rcx, [rsp + 0xc728]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x31d4], 0x10
lea rdx, [rsp + 0x31d4]
lea rcx, [rsp + 0xc748]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e5ff0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1968], rax
cmp qword [rsp + 0x1968], 0xffffffffffffffff
je 0x14001cbb9
mov rcx, qword [rsp + 0x1968]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x11c70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0
jmp 0x14001cbea
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
movsxd rax, dword [rsp + 0x88]
cmp rax, 0x400
jae 0x14001cc1c
movsxd rax, dword [rsp + 0x88]
mov al, byte [rsp + rax + 0x11c70]
inc al
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0x11c70], al
jmp 0x14001cbda
mov dword [rsp + 0x8b0], 0xc82d26
lea rdx, [0x1400e6004]
lea rcx, [rsp + 0x9888]
call fcn.140003708
nop
lea rdx, [rsp + 0x9888]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x8b0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9888]
call fcn.1400040f0
lea rcx, [rsp + 0xc0f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x8b4], 0x3a023c72
lea rdx, [0x1400e6008]
lea rcx, [rsp + 0x98a8]
call fcn.140003708
nop
lea rdx, [rsp + 0x98a8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x8b4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x98a8]
call fcn.1400040f0
lea r9, [rsp + 0x3d30]
lea r8, [rsp + 0x3d38]
lea rdx, [rsp + 0x3d40]
lea rcx, [0x1400e6018]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x31d0], 0x10
lea rdx, [rsp + 0x31d0]
lea rcx, [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1880], rax
cmp qword [rsp + 0x1880], 0
je 0x14001cd9a
lea rax, [rsp + 0x3d48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3d50]
lea r8, [rsp + 0x3d58]
lea rdx, [rsp + 0x3d60]
mov rcx, qword [rsp + 0x1880]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1880]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6020]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1970], rax
cmp qword [rsp + 0x1970], 0xffffffffffffffff
je 0x14001cdef
mov rcx, qword [rsp + 0x1970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x12070]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x8c], 0
jmp 0x14001ce20
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
movsxd rax, dword [rsp + 0x8c]
cmp rax, 0x400
jae 0x14001ce52
movsxd rax, dword [rsp + 0x8c]
mov al, byte [rsp + rax + 0x12070]
inc al
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0x12070], al
jmp 0x14001ce10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1868], rax
cmp qword [rsp + 0x1868], 0
je 0x14001cebc
lea rax, [rsp + 0x3d68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3d70]
lea r8, [rsp + 0x3d78]
lea rdx, [rsp + 0x3d80]
mov rcx, qword [rsp + 0x1868]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1868]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x3d88]
lea r8, [rsp + 0x3d90]
lea rdx, [rsp + 0x3d98]
lea rcx, [0x1400e6040]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x8c0], 0x10af9deb
lea rdx, [0x1400e6048]
lea rcx, [rsp + 0x98c8]
call fcn.140003708
lea rcx, [rsp + 0x98c8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x8c0]
mov rdx, rax
lea rcx, [0x1400e604c]
call fcn.140044734
lea rcx, [rsp + 0x98c8]
call fcn.1400040f0
mov dword [rsp + 0x3388], 0x10
lea rdx, [rsp + 0x3388]
lea rcx, [rsp + 0xc788]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x12470]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
jmp 0x14001cf83
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 0x400
jae 0x14001cfb5
movsxd rax, dword [rsp + 0x90]
mov al, byte [rsp + rax + 0x12470]
inc al
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0x12470], al
jmp 0x14001cf73
mov dword [rsp + 0x448], 1
mov edx, 8
lea rcx, [rsp + 0x35d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d00d
mov eax, dword [rsp + 0x35d8]
mov dword [rsp + 0x25a0], eax
mov eax, dword [rsp + 0x35dc]
mov dword [rsp + 0x25a4], eax
mov ecx, dword [rsp + 0x448]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x448]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6058]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1978], rax
cmp qword [rsp + 0x1978], 0xffffffffffffffff
je 0x14001d062
mov rcx, qword [rsp + 0x1978]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x8d0], 0x38844612
lea rdx, [0x1400e6068]
lea rcx, [rsp + 0x98e8]
call fcn.140003708
nop
lea rdx, [rsp + 0x98e8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x8d0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x98e8]
call fcn.1400040f0
lea rcx, [rsp + 0xc108]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x8d4], 0x19c10961
lea rdx, [0x1400e6070]
lea rcx, [rsp + 0x9908]
call fcn.140003708
nop
lea rdx, [rsp + 0x9908]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x8d4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9908]
call fcn.1400040f0
mov dword [rsp + 0x44c], 1
mov edx, 8
lea rcx, [rsp + 0x3618]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d188
mov eax, dword [rsp + 0x3618]
mov dword [rsp + 0x25a8], eax
mov eax, dword [rsp + 0x361c]
mov dword [rsp + 0x25ac], eax
mov ecx, dword [rsp + 0x44c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x44c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xc118]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x3da0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x3da8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x3db0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xc128]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x450], 1
mov edx, 8
lea rcx, [rsp + 0x3628]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d226
mov eax, dword [rsp + 0x3628]
mov dword [rsp + 0x25b0], eax
mov eax, dword [rsp + 0x362c]
mov dword [rsp + 0x25b4], eax
mov ecx, dword [rsp + 0x450]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x450]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6078]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1980], rax
cmp qword [rsp + 0x1980], 0xffffffffffffffff
je 0x14001d27b
mov rcx, qword [rsp + 0x1980]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6098]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1988], rax
cmp qword [rsp + 0x1988], 0xffffffffffffffff
je 0x14001d2d0
mov rcx, qword [rsp + 0x1988]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1858], rax
cmp qword [rsp + 0x1858], 0
je 0x14001d33a
lea rax, [rsp + 0x3db8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3dc0]
lea r8, [rsp + 0x3dc8]
lea rdx, [rsp + 0x3dd0]
mov rcx, qword [rsp + 0x1858]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1858]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x454], 1
mov edx, 8
lea rcx, [rsp + 0x3640]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d392
mov eax, dword [rsp + 0x3640]
mov dword [rsp + 0x25b8], eax
mov eax, dword [rsp + 0x3644]
mov dword [rsp + 0x25bc], eax
mov ecx, dword [rsp + 0x454]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x454]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x8d8], 0x3a79e4f8
lea rdx, [0x1400e60b8]
lea rcx, [rsp + 0x9928]
call fcn.140003708
nop
lea rdx, [rsp + 0x9928]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x8d8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9928]
call fcn.1400040f0
mov dword [rsp + 0x458], 1
mov edx, 8
lea rcx, [rsp + 0x3648]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d44a
mov eax, dword [rsp + 0x3648]
mov dword [rsp + 0x25c0], eax
mov eax, dword [rsp + 0x364c]
mov dword [rsp + 0x25c4], eax
mov ecx, dword [rsp + 0x458]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x458]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x3dd8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x3de0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x3de8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x8dc], 0x35b5c6a5
lea rdx, [0x1400e60c8]
lea rcx, [rsp + 0x9948]
call fcn.140003708
lea rcx, [rsp + 0x9948]
call fcn.14000a93c
mov r8d, dword [rsp + 0x8dc]
mov rdx, rax
lea rcx, [0x1400e60d0]
call fcn.140044734
lea rcx, [rsp + 0x9948]
call fcn.1400040f0
lea r9, [rsp + 0x3df0]
lea r8, [rsp + 0x3df8]
lea rdx, [rsp + 0x3e00]
lea rcx, [0x1400e60d8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x8e0], 0x3560f776
lea rdx, [0x1400e60e0]
lea rcx, [rsp + 0x9968]
call fcn.140003708
nop
lea rdx, [rsp + 0x9968]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x8e0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9968]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e60f0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1990], rax
cmp qword [rsp + 0x1990], 0xffffffffffffffff
je 0x14001d59e
mov rcx, qword [rsp + 0x1990]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xc138]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xc338]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x8e4], 0x23745a73
lea rdx, [0x1400e6108]
lea rcx, [rsp + 0x9988]
call fcn.140003708
nop
lea rdx, [rsp + 0x9988]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x8e4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9988]
call fcn.1400040f0
lea rcx, [rsp + 0x3e08]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1850], rax
cmp qword [rsp + 0x1850], 0
je 0x14001d692
lea rax, [rsp + 0x3e10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3e18]
lea r8, [rsp + 0x3e20]
lea rdx, [rsp + 0x3e28]
mov rcx, qword [rsp + 0x1850]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1850]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xb768]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x3e30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x31c8], 0x10
lea rdx, [rsp + 0x31c8]
lea rcx, [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x45c], 1
mov edx, 8
lea rcx, [rsp + 0x3698]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d727
mov eax, dword [rsp + 0x3698]
mov dword [rsp + 0x25c8], eax
mov eax, dword [rsp + 0x369c]
mov dword [rsp + 0x25cc], eax
mov ecx, dword [rsp + 0x45c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x45c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x12870]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x94], 0
jmp 0x14001d758
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
cmp rax, 0x400
jae 0x14001d78a
movsxd rax, dword [rsp + 0x94]
mov al, byte [rsp + rax + 0x12870]
inc al
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0x12870], al
jmp 0x14001d748
lea rcx, [rsp + 0xb778]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x8f0], 0x1b2c807d
lea rdx, [0x1400e6110]
lea rcx, [rsp + 0x99a8]
call fcn.140003708
lea rcx, [rsp + 0x99a8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x8f0]
mov rdx, rax
lea rcx, [0x1400e6118]
call fcn.140044734
lea rcx, [rsp + 0x99a8]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1840], rax
cmp qword [rsp + 0x1840], 0
je 0x14001d852
lea rax, [rsp + 0x3e38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3e40]
lea r8, [rsp + 0x3e48]
lea rdx, [rsp + 0x3e50]
mov rcx, qword [rsp + 0x1840]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1840]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3e58]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x3e60]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x3e68]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x31c4], 0x10
lea rdx, [rsp + 0x31c4]
lea rcx, [rsp + 0xc7c8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x12c70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0
jmp 0x14001d8ce
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
movsxd rax, dword [rsp + 0x98]
cmp rax, 0x400
jae 0x14001d900
movsxd rax, dword [rsp + 0x98]
mov al, byte [rsp + rax + 0x12c70]
inc al
movsxd rcx, dword [rsp + 0x98]
mov byte [rsp + rcx + 0x12c70], al
jmp 0x14001d8be
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1838], rax
cmp qword [rsp + 0x1838], 0
je 0x14001d96a
lea rax, [rsp + 0x3e70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3e78]
lea r8, [rsp + 0x3e80]
lea rdx, [rsp + 0x3e88]
mov rcx, qword [rsp + 0x1838]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1838]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x13070]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x9c], 0
jmp 0x14001d99b
mov eax, dword [rsp + 0x9c]
inc eax
mov dword [rsp + 0x9c], eax
movsxd rax, dword [rsp + 0x9c]
cmp rax, 0x400
jae 0x14001d9cd
movsxd rax, dword [rsp + 0x9c]
mov al, byte [rsp + rax + 0x13070]
inc al
movsxd rcx, dword [rsp + 0x9c]
mov byte [rsp + rcx + 0x13070], al
jmp 0x14001d98b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1820], rax
cmp qword [rsp + 0x1820], 0
je 0x14001da37
lea rax, [rsp + 0x3e90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3e98]
lea r8, [rsp + 0x3ea0]
lea rdx, [rsp + 0x3ea8]
mov rcx, qword [rsp + 0x1820]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1820]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3eb0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x900], 0xdc97b98
lea rdx, [0x1400e6120]
lea rcx, [rsp + 0x99c8]
call fcn.140003708
nop
lea rdx, [rsp + 0x99c8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x900]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x99c8]
call fcn.1400040f0
lea r9, [rsp + 0x3eb8]
lea r8, [rsp + 0x3ec0]
lea rdx, [rsp + 0x3ec8]
lea rcx, [0x1400e6128]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x460], 1
mov edx, 8
lea rcx, [rsp + 0x36a0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001db22
mov eax, dword [rsp + 0x36a0]
mov dword [rsp + 0x25d0], eax
mov eax, dword [rsp + 0x36a4]
mov dword [rsp + 0x25d4], eax
mov ecx, dword [rsp + 0x460]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x460]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x464], 1
mov edx, 8
lea rcx, [rsp + 0x36a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001db7a
mov eax, dword [rsp + 0x36a8]
mov dword [rsp + 0x25d8], eax
mov eax, dword [rsp + 0x36ac]
mov dword [rsp + 0x25dc], eax
mov ecx, dword [rsp + 0x464]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x464]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x13470]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
jmp 0x14001dbab
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
cmp rax, 0x400
jae 0x14001dbdd
movsxd rax, dword [rsp + 0xa0]
mov al, byte [rsp + rax + 0x13470]
inc al
movsxd rcx, dword [rsp + 0xa0]
mov byte [rsp + rcx + 0x13470], al
jmp 0x14001db9b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6130]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1998], rax
cmp qword [rsp + 0x1998], 0xffffffffffffffff
je 0x14001dc32
mov rcx, qword [rsp + 0x1998]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1810], rax
cmp qword [rsp + 0x1810], 0
je 0x14001dc9c
lea rax, [rsp + 0x3ed0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3ed8]
lea r8, [rsp + 0x3ee0]
lea rdx, [rsp + 0x3ee8]
mov rcx, qword [rsp + 0x1810]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1810]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xb998]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6148]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19a0], rax
cmp qword [rsp + 0x19a0], 0xffffffffffffffff
je 0x14001dcff
mov rcx, qword [rsp + 0x19a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3ef0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6158]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19a8], rax
cmp qword [rsp + 0x19a8], 0xffffffffffffffff
je 0x14001dd62
mov rcx, qword [rsp + 0x19a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x468], 1
mov edx, 8
lea rcx, [rsp + 0x3c08]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001ddba
mov eax, dword [rsp + 0x3c08]
mov dword [rsp + 0x25e0], eax
mov eax, dword [rsp + 0x3c0c]
mov dword [rsp + 0x25e4], eax
mov ecx, dword [rsp + 0x468]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x468]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x3ef8]
lea r8, [rsp + 0x3f00]
lea rdx, [rsp + 0x3f08]
lea rcx, [0x1400e6170]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x904], 0x6490e23
lea rdx, [0x1400e6178]
lea rcx, [rsp + 0x99e8]
call fcn.140003708
nop
lea rdx, [rsp + 0x99e8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x904]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x99e8]
call fcn.1400040f0
mov dword [rsp + 0x31c0], 0x10
lea rdx, [rsp + 0x31c0]
lea rcx, [rsp + 0xc7e8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x910], 0x217ccbf5
lea rdx, [0x1400e6184]
lea rcx, [rsp + 0x9a08]
call fcn.140003708
nop
lea rdx, [rsp + 0x9a08]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x910]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9a08]
call fcn.1400040f0
mov dword [rsp + 0x914], 0x328f5ba
lea rdx, [0x1400e6190]
lea rcx, [rsp + 0x9a28]
call fcn.140003708
nop
lea rdx, [rsp + 0x9a28]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x914]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9a28]
call fcn.1400040f0
lea rax, [rsp + 0x13870]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa4], 0
jmp 0x14001df51
mov eax, dword [rsp + 0xa4]
inc eax
mov dword [rsp + 0xa4], eax
movsxd rax, dword [rsp + 0xa4]
cmp rax, 0x400
jae 0x14001df83
movsxd rax, dword [rsp + 0xa4]
mov al, byte [rsp + rax + 0x13870]
inc al
movsxd rcx, dword [rsp + 0xa4]
mov byte [rsp + rcx + 0x13870], al
jmp 0x14001df41
lea rax, [rsp + 0x13c70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa8], 0
jmp 0x14001dfb4
mov eax, dword [rsp + 0xa8]
inc eax
mov dword [rsp + 0xa8], eax
movsxd rax, dword [rsp + 0xa8]
cmp rax, 0x400
jae 0x14001dfe6
movsxd rax, dword [rsp + 0xa8]
mov al, byte [rsp + rax + 0x13c70]
inc al
movsxd rcx, dword [rsp + 0xa8]
mov byte [rsp + rcx + 0x13c70], al
jmp 0x14001dfa4
mov dword [rsp + 0x918], 0x24ebd234
lea rdx, [0x1400e6198]
lea rcx, [rsp + 0x9a48]
call fcn.140003708
nop
lea rdx, [rsp + 0x9a48]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x918]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9a48]
call fcn.1400040f0
lea rax, [rsp + 0x14070]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xac], 0
jmp 0x14001e077
mov eax, dword [rsp + 0xac]
inc eax
mov dword [rsp + 0xac], eax
movsxd rax, dword [rsp + 0xac]
cmp rax, 0x400
jae 0x14001e0a9
movsxd rax, dword [rsp + 0xac]
mov al, byte [rsp + rax + 0x14070]
inc al
movsxd rcx, dword [rsp + 0xac]
mov byte [rsp + rcx + 0x14070], al
jmp 0x14001e067
lea rcx, [rsp + 0x3f10]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x317c], 0x10
lea rdx, [rsp + 0x317c]
lea rcx, [rsp + 0xc808]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x14470]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xb0], 0
jmp 0x14001e109
mov eax, dword [rsp + 0xb0]
inc eax
mov dword [rsp + 0xb0], eax
movsxd rax, dword [rsp + 0xb0]
cmp rax, 0x400
jae 0x14001e13b
movsxd rax, dword [rsp + 0xb0]
mov al, byte [rsp + rax + 0x14470]
inc al
movsxd rcx, dword [rsp + 0xb0]
mov byte [rsp + rcx + 0x14470], al
jmp 0x14001e0f9
mov dword [rsp + 0x46c], 1
mov edx, 8
lea rcx, [rsp + 0x36d0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001e193
mov eax, dword [rsp + 0x36d0]
mov dword [rsp + 0x25e8], eax
mov eax, dword [rsp + 0x36d4]
mov dword [rsp + 0x25ec], eax
mov ecx, dword [rsp + 0x46c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x46c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0xb9a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x3f18]
lea r8, [rsp + 0x3f20]
lea rdx, [rsp + 0x3f28]
lea rcx, [0x1400e61a0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3104], 0x10
lea rdx, [rsp + 0x3104]
lea rcx, [rsp + 0xc828]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x3f30]
lea r8, [rsp + 0x3f38]
lea rdx, [rsp + 0x3f40]
lea rcx, [0x1400e61a8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x470], 1
mov edx, 8
lea rcx, [rsp + 0x36d8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001e264
mov eax, dword [rsp + 0x36d8]
mov dword [rsp + 0x25f0], eax
mov eax, dword [rsp + 0x36dc]
mov dword [rsp + 0x25f4], eax
mov ecx, dword [rsp + 0x470]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x470]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x930], 0x11b79772
lea rdx, [0x1400e61b0]
lea rcx, [rsp + 0x9a68]
call fcn.140003708
lea rcx, [rsp + 0x9a68]
call fcn.14000a93c
mov r8d, dword [rsp + 0x930]
mov rdx, rax
lea rcx, [0x1400e61b8]
call fcn.140044734
lea rcx, [rsp + 0x9a68]
call fcn.1400040f0
mov dword [rsp + 0x3138], 0x10
lea rdx, [rsp + 0x3138]
lea rcx, [rsp + 0xc848]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x940], 0x92e81c1
lea rdx, [0x1400e61c0]
lea rcx, [rsp + 0x9a88]
call fcn.140003708
nop
lea rdx, [rsp + 0x9a88]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x940]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9a88]
call fcn.1400040f0
mov dword [rsp + 0x944], 0x30cd5636
lea rdx, [0x1400e61c8]
lea rcx, [rsp + 0x9aa8]
call fcn.140003708
lea rcx, [rsp + 0x9aa8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x944]
mov rdx, rax
lea rcx, [0x1400e61d4]
call fcn.140044734
lea rcx, [rsp + 0x9aa8]
call fcn.1400040f0
lea r9, [rsp + 0x3f48]
lea r8, [rsp + 0x3f50]
lea rdx, [rsp + 0x3f58]
lea rcx, [0x1400e61e0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x14870]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xb4], 0
jmp 0x14001e3db
mov eax, dword [rsp + 0xb4]
inc eax
mov dword [rsp + 0xb4], eax
movsxd rax, dword [rsp + 0xb4]
cmp rax, 0x400
jae 0x14001e40d
movsxd rax, dword [rsp + 0xb4]
mov al, byte [rsp + rax + 0x14870]
inc al
movsxd rcx, dword [rsp + 0xb4]
mov byte [rsp + rcx + 0x14870], al
jmp 0x14001e3cb
mov dword [rsp + 0x474], 1
mov edx, 8
lea rcx, [rsp + 0x36e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001e465
mov eax, dword [rsp + 0x36e0]
mov dword [rsp + 0x25f8], eax
mov eax, dword [rsp + 0x36e4]
mov dword [rsp + 0x25fc], eax
mov ecx, dword [rsp + 0x474]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x474]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x478], 1
mov edx, 8
lea rcx, [rsp + 0x36e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001e4bd
mov eax, dword [rsp + 0x36e8]
mov dword [rsp + 0x2600], eax
mov eax, dword [rsp + 0x36ec]
mov dword [rsp + 0x2604], eax
mov ecx, dword [rsp + 0x478]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x478]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x948], 0x116da008
lea rdx, [0x1400e61e8]
lea rcx, [rsp + 0x9ac8]
call fcn.140003708
nop
lea rdx, [rsp + 0x9ac8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x948]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9ac8]
call fcn.1400040f0
lea rax, [rsp + 0x14c70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xb8], 0
jmp 0x14001e54e
mov eax, dword [rsp + 0xb8]
inc eax
mov dword [rsp + 0xb8], eax
movsxd rax, dword [rsp + 0xb8]
cmp rax, 0x400
jae 0x14001e580
movsxd rax, dword [rsp + 0xb8]
mov al, byte [rsp + rax + 0x14c70]
inc al
movsxd rcx, dword [rsp + 0xb8]
mov byte [rsp + rcx + 0x14c70], al
jmp 0x14001e53e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x17e8], rax
cmp qword [rsp + 0x17e8], 0
je 0x14001e5ea
lea rax, [rsp + 0x3f60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3f68]
lea r8, [rsp + 0x3f70]
lea rdx, [rsp + 0x3f78]
mov rcx, qword [rsp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x94c], 0x28f2cd
lea rdx, [0x1400e61f8]
lea rcx, [rsp + 0x9ae8]
call fcn.140003708
lea rcx, [rsp + 0x9ae8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x94c]
mov rdx, rax
lea rcx, [0x1400e6204]
call fcn.140044734
lea rcx, [rsp + 0x9ae8]
call fcn.1400040f0
mov dword [rsp + 0x950], 0x648dd42
lea rdx, [0x1400e6210]
lea rcx, [rsp + 0x9b08]
call fcn.140003708
lea rcx, [rsp + 0x9b08]
call fcn.14000a93c
mov r8d, dword [rsp + 0x950]
mov rdx, rax
lea rcx, [0x1400e621c]
call fcn.140044734
lea rcx, [rsp + 0x9b08]
call fcn.1400040f0
mov dword [rsp + 0x954], 0x15bc7177
lea rdx, [0x1400e6224]
lea rcx, [rsp + 0x9b28]
call fcn.140003708
nop
lea rdx, [rsp + 0x9b28]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x954]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9b28]
call fcn.1400040f0
mov dword [rsp + 0x47c], 1
mov edx, 8
lea rcx, [rsp + 0x36f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001e742
mov eax, dword [rsp + 0x36f0]
mov dword [rsp + 0x2608], eax
mov eax, dword [rsp + 0x36f4]
mov dword [rsp + 0x260c], eax
mov ecx, dword [rsp + 0x47c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x47c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6228]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19b8], rax
cmp qword [rsp + 0x19b8], 0xffffffffffffffff
je 0x14001e797
mov rcx, qword [rsp + 0x19b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x15070]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xbc], 0
jmp 0x14001e7c8
mov eax, dword [rsp + 0xbc]
inc eax
mov dword [rsp + 0xbc], eax
movsxd rax, dword [rsp + 0xbc]
cmp rax, 0x400
jae 0x14001e7fa
movsxd rax, dword [rsp + 0xbc]
mov al, byte [rsp + rax + 0x15070]
inc al
movsxd rcx, dword [rsp + 0xbc]
mov byte [rsp + rcx + 0x15070], al
jmp 0x14001e7b8
lea rcx, [rsp + 0xb9b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x958], 0x62afa11
lea rdx, [0x1400e6248]
lea rcx, [rsp + 0x9b48]
call fcn.140003708
nop
lea rdx, [rsp + 0x9b48]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x958]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9b48]
call fcn.1400040f0
mov dword [rsp + 0x3100], 0x10
lea rdx, [rsp + 0x3100]
lea rcx, [rsp + 0xc868]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x968], 0x3b3550be
lea rdx, [0x1400e6250]
lea rcx, [rsp + 0x9b68]
call fcn.140003708
nop
lea rdx, [rsp + 0x9b68]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x968]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9b68]
call fcn.1400040f0
mov dword [rsp + 0x96c], 0x29a6a20a
lea rdx, [0x1400e6254]
lea rcx, [rsp + 0x9b88]
call fcn.140003708
nop
lea rdx, [rsp + 0x9b88]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x96c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9b88]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6258]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19c0], rax
cmp qword [rsp + 0x19c0], 0xffffffffffffffff
je 0x14001e99e
mov rcx, qword [rsp + 0x19c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x309c], 0x10
lea rdx, [rsp + 0x309c]
lea rcx, [rsp + 0xc888]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x480], 1
mov edx, 8
lea rcx, [rsp + 0x3708]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001ea17
mov eax, dword [rsp + 0x3708]
mov dword [rsp + 0x2610], eax
mov eax, dword [rsp + 0x370c]
mov dword [rsp + 0x2614], eax
mov ecx, dword [rsp + 0x480]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x480]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x978], 0x312d92af
lea rdx, [0x1400e6274]
lea rcx, [rsp + 0x9ba8]
call fcn.140003708
nop
lea rdx, [rsp + 0x9ba8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x978]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9ba8]
call fcn.1400040f0
mov dword [rsp + 0x3370], 0x10
lea rdx, [rsp + 0x3370]
lea rcx, [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6280]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19c8], rax
cmp qword [rsp + 0x19c8], 0xffffffffffffffff
je 0x14001eaed
mov rcx, qword [rsp + 0x19c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x15470]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xc0], 0
jmp 0x14001eb1e
mov eax, dword [rsp + 0xc0]
inc eax
mov dword [rsp + 0xc0], eax
movsxd rax, dword [rsp + 0xc0]
cmp rax, 0x400
jae 0x14001eb50
movsxd rax, dword [rsp + 0xc0]
mov al, byte [rsp + rax + 0x15470]
inc al
movsxd rcx, dword [rsp + 0xc0]
mov byte [rsp + rcx + 0x15470], al
jmp 0x14001eb0e
lea rcx, [rsp + 0xb9c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x988], 0x3013c3b2
lea rdx, [0x1400e6298]
lea rcx, [rsp + 0x9bc8]
call fcn.140003708
lea rcx, [rsp + 0x9bc8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x988]
mov rdx, rax
lea rcx, [0x1400e62a0]
call fcn.140044734
lea rcx, [rsp + 0x9bc8]
call fcn.1400040f0
mov dword [rsp + 0x484], 1
mov edx, 8
lea rcx, [rsp + 0x3718]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001ec06
mov eax, dword [rsp + 0x3718]
mov dword [rsp + 0x2618], eax
mov eax, dword [rsp + 0x371c]
mov dword [rsp + 0x261c], eax
mov ecx, dword [rsp + 0x484]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x484]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x98c], 0x198c1f2a
lea rdx, [0x1400e62a8]
lea rcx, [rsp + 0x9be8]
call fcn.140003708
nop
lea rdx, [rsp + 0x9be8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x98c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9be8]
call fcn.1400040f0
mov dword [rsp + 0x990], 0x196aeb8d
lea rdx, [0x1400e62ac]
lea rcx, [rsp + 0x9c08]
call fcn.140003708
nop
lea rdx, [rsp + 0x9c08]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x990]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9c08]
call fcn.1400040f0
lea r9, [rsp + 0x3f80]
lea r8, [rsp + 0x3f88]
lea rdx, [rsp + 0x3f90]
lea rcx, [0x1400e62b0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x15870]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xc4], 0
jmp 0x14001ed1c
mov eax, dword [rsp + 0xc4]
inc eax
mov dword [rsp + 0xc4], eax
movsxd rax, dword [rsp + 0xc4]
cmp rax, 0x400
jae 0x14001ed4e
movsxd rax, dword [rsp + 0xc4]
mov al, byte [rsp + rax + 0x15870]
inc al
movsxd rcx, dword [rsp + 0xc4]
mov byte [rsp + rcx + 0x15870], al
jmp 0x14001ed0c
mov dword [rsp + 0x994], 0x2f3cb8f0
lea rdx, [0x1400e62b8]
lea rcx, [rsp + 0x9c28]
call fcn.140003708
nop
lea rdx, [rsp + 0x9c28]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x994]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9c28]
call fcn.1400040f0
lea rcx, [rsp + 0x3f98]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xb9d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e62c8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19d0], rax
cmp qword [rsp + 0x19d0], 0xffffffffffffffff
je 0x14001ee1f
mov rcx, qword [rsp + 0x19d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x998], 0x37189975
lea rdx, [0x1400e62e4]
lea rcx, [rsp + 0x9c48]
call fcn.140003708
nop
lea rdx, [rsp + 0x9c48]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x998]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9c48]
call fcn.1400040f0
mov rax, qword [rsp + 0x4a490]
mov byte [rax + 0xa0], 1
mov rcx, qword [rsp + 0x4a498]
call fcn.140001400
mov rcx, rax
call fcn.1400149fc
movzx eax, al
cmp eax, 0x21
jne 0x14002d669
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e62f0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19d8], rax
cmp qword [rsp + 0x19d8], 0xffffffffffffffff
je 0x14001ef04
mov rcx, qword [rsp + 0x19d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x3fa0]
lea r8, [rsp + 0x3fa8]
lea rdx, [rsp + 0x3fb0]
lea rcx, [0x1400e6300]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x17e0], rax
cmp qword [rsp + 0x17e0], 0
je 0x14001ef93
lea rax, [rsp + 0x3fb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3fc0]
lea r8, [rsp + 0x3fc8]
lea rdx, [rsp + 0x3fd0]
mov rcx, qword [rsp + 0x17e0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x17e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6308]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19e0], rax
cmp qword [rsp + 0x19e0], 0xffffffffffffffff
je 0x14001efe8
mov rcx, qword [rsp + 0x19e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6328]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19e8], rax
cmp qword [rsp + 0x19e8], 0xffffffffffffffff
je 0x14001f03d
mov rcx, qword [rsp + 0x19e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x99c], 0xe3bb70b
lea rdx, [0x1400e6340]
lea rcx, [rsp + 0x9c68]
call fcn.140003708
nop
lea rdx, [rsp + 0x9c68]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x99c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9c68]
call fcn.1400040f0
mov dword [rsp + 0x9a0], 0x2fd79bb4
lea rdx, [0x1400e6348]
lea rcx, [rsp + 0x9c88]
call fcn.140003708
nop
lea rdx, [rsp + 0x9c88]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x9a0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x9c88]
call fcn.1400040f0
mov dword [rsp + 0x31ac], 0x10
lea rdx, [rsp + 0x31ac]
lea rcx, [rsp + 0xc8c8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x3fd8]
lea r8, [rsp + 0x3fe0]
lea rdx, [rsp + 0x3fe8]
lea rcx, [0x1400e6358]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e6360]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19f0], rax
cmp qword [rsp + 0x19f0], 0xffffffffffffffff
je 0x14001f198
mov rcx, qword [rsp + 0x4a498]
call fcn.140001400
mov rcx, rax
call fcn.1400149fc
movzx eax, al
cmp eax, 0x22
jne 0x140043435
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x11d0], rax
cmp qword [rsp + 0x11d0], 0
je 0x14002d6f4
lea rax, [rsp + 0x5520]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5528]
lea r8, [rsp + 0x5530]
lea rdx, [rsp + 0x5538]
mov rcx, qword [rsp + 0x11d0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x11d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400e7910]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1d70], rax
cmp qword [rsp + 0x1d70], 0xffffffffffffffff
je 0x14002d749
mov rcx, qword [rsp + 0x1d70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x5540]
lea r8, [rsp + 0x5548]
lea rdx, [rsp + 0x5550]
lea rcx, [0x1400e7928]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x2ac70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x218], 0
jmp 0x14002d79f
movsxd rax, dword [rsp + 0x218]
cmp rax, 0x400
jae 0x14002d7d1
mov rcx, qword [rsp + 0x4a498]
call fcn.140001400
mov rcx, rax
call fcn.1400149fc
movzx eax, al
cmp eax, 0x23
jne 0x140043d3b
mov rcx, qword [rsp + 0x4a498]
call fcn.140001400
lea r8, [rsp + 0x3038]
lea rdx, [rsp + 0x3008]
mov rcx, rax
call fcn.1400145f4
movzx eax, al
test eax, eax
je 0x140043d3b
mov dword [rsp + 0x338], 0
mov eax, dword [rsp + 0x3038]
cmp dword [rsp + 0x338], eax
jae 0x140043d3b
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rsp + 0x3018]
call fcn.140001eb8
mov ecx, 0x88
call fcn.1400b65ac
mov qword [rsp + 0x7e0], rax
cmp qword [rsp + 0x7e0], 0
je 0x1400434fd
mov rcx, qword [rsp + 0x4a498]
call fcn.140001400
mov rcx, rax
call fcn.1400149fc
movzx eax, al
cmp eax, 0x24
jne 0x14004424c
mov rcx, qword [rsp + 0x4a498]
call fcn.140001400
mov r8b, 2
lea rdx, [rsp + 0x2df8]
mov rcx, rax
call fcn.1400147d4
mov qword [rsp + 0x2cb0], rax
mov rax, qword [rsp + 0x2cb0]
mov qword [rsp + 0x2cb8], rax
mov rcx, qword [rsp + 0x2cb8]
call fcn.140001400
lea rdx, [rsp + 0x3208]
mov rcx, rax
call fcn.140014a54
nop
lea rcx, [rsp + 0x2df8]
call fcn.140001424
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rsp + 0x3c90]
call fcn.140001eb8
mov ecx, 0x68
call fcn.1400b65ac
mov qword [rsp + 0x1930], rax
cmp qword [rsp + 0x1930], 0
je 0x140043e24
mov edx, 0x68
mov rcx, qword [rsp + 0x1930]
call fcn.140001eb8
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [0x14010de20]
mov rcx, qword [rsp + 0x1930]
call fcn.14000da74
mov qword [rsp + 0x21f8], rax
jmp 0x140043e30
mov qword [rsp + 0x21f8], 0
mov rax, qword [rsp + 0x21f8]
mov qword [rsp + 0x2cc0], rax
mov rdx, qword [rsp + 0x2cc0]
lea rcx, [rsp + 0x3c90]
call fcn.140009fcc
nop
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rsp + 0x3420]
call fcn.140001eb8
mov ecx, 0x88
call fcn.1400b65ac
mov qword [rsp + 0x1938], rax
cmp qword [rsp + 0x1938], 0
je 0x140043eb0
mov rcx, qword [rsp + 0x4a498]
call fcn.140001424
mov rcx, qword [rsp + 0x4a470]
xor rcx, rsp
call fcn.1400b6680
add rsp, 0x4a480
pop rdi
ret