Function at 0x1400302a4
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2778]
mov eax, 0x2850
call fcn.140034d80
sub rsp, rax
mov rax, qword [0x140077100]
xor rax, rsp
mov qword [rbp + 0x2740], rax
lea r9, [rbp + 0x4b8]
lea r8, [rbp + 0x4c0]
lea rdx, [rbp + 0x4c8]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x78], 0x10
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x620]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov r13d, 0x400
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r14d, r14d
test rax, rax
je 0x140030382
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4d8]
lea r8, [rbp + 0x4e0]
lea rdx, [rbp + 0x4e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0x740]
call fcn.140059690
mov esi, 8
mov edx, esi
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
lea r15d, [rsi - 7]
test eax, eax
jne 0x1400303c1
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0xb40]
call fcn.140059690
lea rcx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], r14
mov ebx, 0x80
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edi, 0x80000000
mov edx, edi
lea rcx, str.9YLuEbGwC.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14003041e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, edi
lea rcx, str.0LfyHWr.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140030453
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x4f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
mov r8, rsi
lea rdx, str.T60IiXx3
lea rcx, [rbp + 0xb8]
call fcn.14000192c
lea rdx, [rbp + 0xb8]
mov r12d, 0xf
cmp qword [rbp + 0xd0], r12
cmova rdx, qword [rbp + 0xb8]
mov r8d, 0x18d01ba6
lea rcx, str._s:__d
call fcn.1400184d4
mov esi, 0x1000
mov rdx, qword [rbp + 0xd0]
cmp rdx, r12
jbe 0x140030507
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, rsi
jb 0x140030502
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cde
call fcn.140034bfc
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0xf40]
call fcn.140059690
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140030567
lea rax, [rbp + 0x500]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x508]
lea r8, [rbp + 0x510]
lea rdx, [rbp + 0x518]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400305b6
lea rax, [rbp + 0x520]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x528]
lea r8, [rbp + 0x530]
lea rdx, [rbp + 0x538]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140030605
lea rax, [rbp + 0x540]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x548]
lea r8, [rbp + 0x550]
lea rdx, [rbp + 0x558]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x68]
call fcn.14002bd8c
mov rdi, rax
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0x1340]
call fcn.140059690
lea rcx, [rbp + 0x560]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x7c], 0x10
lea rdx, [rsp + 0x7c]
lea rcx, [rbp + 0x640]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0x1740]
call fcn.140059690
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.G4GCiai047.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140030697
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400306e6
lea rax, [rbp + 0x568]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x238]
lea r8, [rbp + 0x240]
lea rdx, [rbp + 0x248]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r14
mov ebx, 0x80
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.bl.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140030723
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
mov r8d, 8
lea rdx, str.7PgBJo6z
lea rcx, [rbp + 0xd8]
call fcn.14000192c
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], r12
cmova rdx, qword [rbp + 0xd8]
mov r8d, 0xf93bb9e
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0xf0]
cmp rdx, r12
jbe 0x1400307b5
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, rsi
jb 0x1400307b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031ce4
call fcn.140034bfc
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.0zmafXrO.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400307ed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x250]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140030815
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0x1b40]
call fcn.140059690
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140030875
lea rax, [rbp + 0x258]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x260]
lea r8, [rbp + 0x268]
lea rdx, [rbp + 0x270]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.b.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400308b1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov r8d, 0xa
lea rdx, str.9X3h5PKo8Y
lea rcx, [rbp - 0x48]
call fcn.14000192c
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], r12
cmova rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x1cc4871b
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, r12
jbe 0x14003094d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, rsi
jb 0x140030948
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cea
call fcn.140034bfc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14003099c
lea rax, [rbp + 0x278]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x280]
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x290]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400309eb
lea rax, [rbp + 0x298]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2a0]
lea r8, [rbp + 0x2a8]
lea rdx, [rbp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
jne 0x1400309f7
xor al, al
jmp 0x140031ca8
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
mov r8, r15
lea rdx, [0x1400604cc]
lea rcx, [rbp + 0xf8]
call fcn.14000192c
lea rdx, [rbp + 0xf8]
cmp qword [rbp + 0x110], r12
cmova rdx, qword [rbp + 0xf8]
mov r8d, 0x1b0b6a4b
lea rbx, str._s:__d
mov rcx, rbx
call fcn.1400184d4
mov rdx, qword [rbp + 0x110]
cmp rdx, r12
jbe 0x140030a96
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, rsi
jb 0x140030a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cf0
call fcn.140034bfc
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0x1f40]
call fcn.140059690
mov edx, 8
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140030acf
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
mov r8d, 6
lea rdx, str.v4s7pZ
lea rcx, [rbp + 0x118]
call fcn.14000192c
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], r12
cmova rdx, qword [rbp + 0x118]
mov r8d, 0x23c940c8
mov rcx, rbx
call fcn.1400184d4
mov rdx, qword [rbp + 0x130]
cmp rdx, r12
jbe 0x140030b77
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, rsi
jb 0x140030b72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cf6
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov r8, r15
lea rdx, [0x1400604d8]
lea rcx, [rbp - 0x28]
call fcn.14000192c
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], r12
cmova rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x1fbeffd2
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, r12
jbe 0x140030c03
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, rsi
jb 0x140030bfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cfc
call fcn.140034bfc
lea r9, [rbp + 0x2d0]
lea r8, [rbp + 0x2d8]
lea rdx, [rbp + 0x2e0]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0x2340]
call fcn.140059690
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x148], xmm1
mov r8d, 7
lea rdx, str.bsEAwcu
lea rcx, [rbp + 0x138]
call fcn.14000192c
lea rdx, [rbp + 0x138]
cmp qword [rbp + 0x150], r12
cmova rdx, qword [rbp + 0x138]
mov r8d, 0x325be02
mov rcx, rbx
call fcn.1400184d4
mov rdx, qword [rbp + 0x150]
cmp rdx, r12
jbe 0x140030cc4
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, rsi
jb 0x140030cbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d02
call fcn.140034bfc
lea r9, [rbp + 0x2e8]
lea r8, [rbp + 0x2f0]
lea rdx, [rbp + 0x2f8]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp - 0x80], 0x10
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x660]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbp + 0x300]
lea r8, [rbp + 0x308]
lea rdx, [rbp + 0x310]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x318]
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0x328]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp - 0x7c], 0x10
lea rdx, [rbp - 0x7c]
lea rcx, [rbp + 0x680]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x168], xmm1
mov r8d, 3
lea rdx, [0x1400604e8]
lea rcx, [rbp + 0x158]
call fcn.14000192c
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], r12
cmova rdx, qword [rbp + 0x158]
mov r8d, 0x2e871abd
mov rcx, rbx
call fcn.1400184d4
mov rdx, qword [rbp + 0x170]
cmp rdx, r12
jbe 0x140030de8
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, rsi
jb 0x140030de3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d08
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov ecx, 0x68
call fcn.140034bc0
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140030e2a
xor edx, edx
lea r8d, [rdx + 0x68]
mov rcx, rax
call fcn.140059690
mov r8d, dword [rsp + 0x68]
mov rdx, rdi
mov rcx, rbx
call fcn.140007bc0
mov rdi, rax
jmp 0x140030e2d
mov rdi, r14
mov qword [rsp + 0x60], rdi
mov ecx, 0x18
call fcn.140034bc0
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140030e67
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r15d
mov dword [rax + 0xc], r15d
lea rax, vtable.QSINOROBZ::ZMWB__RZWXJ.0
mov qword [rbx], rax
mov qword [rbx + 0x10], rdi
jmp 0x140030e6a
mov rbx, r14
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
test rbx, rbx
je 0x140030e87
lock add dword [rbx + 8], r15d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
call fcn.14001b308
lea r9, [rbp + 0x330]
lea r8, [rbp + 0x338]
lea rdx, [rbp + 0x340]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp - 0x78], 0x10
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, 8
lea rcx, [rbp + 0x348]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140030efd
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0x350]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140030f25
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140030f74
lea rax, [rbp + 0x358]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x360]
lea r8, [rbp + 0x368]
lea rdx, [rbp + 0x370]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x188], xmm1
mov r8, r15
lea rdx, [0x1400602ac]
lea rcx, [rbp + 0x178]
call fcn.14000192c
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], r12
cmova rdx, qword [rbp + 0x178]
mov r8d, 0x13ccd688
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x190]
cmp rdx, r12
jbe 0x140031003
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140030ffe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d0e
call fcn.140034bfc
mov qword [rsp + 0x30], r14
mov edi, 0x80
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.s.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140031040
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x74], 0x10
lea rdx, [rbp - 0x74]
lea rcx, [rbp + 0x6c0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.2HYIhNmugv.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140031090
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400310df
lea rax, [rbp + 0x378]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x380]
lea r8, [rbp + 0x388]
lea rdx, [rbp + 0x390]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14003113b
lea rax, [rbp + 0x398]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3a0]
lea r8, [rbp + 0x3a8]
lea rdx, [rbp + 0x3b0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov edi, 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.seDiGn7.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140031178
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a8], xmm1
mov r8d, 5
lea rdx, str.YEsvS
lea rcx, [rbp + 0x198]
call fcn.14000192c
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], r12
cmova rdx, qword [rbp + 0x198]
mov r8d, 0x34a4cf98
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x1b0]
cmp rdx, r12
jbe 0x140031217
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, rsi
jb 0x140031212
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d14
call fcn.140034bfc
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.G6k.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14003124f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], r14
mov r8d, 4
lea rdx, str.mXXf
lea rcx, [rbp - 8]
call fcn.14000192c
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], r12
cmova rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x154b0de6
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, r12
jbe 0x1400312de
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, rsi
jb 0x1400312d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d1a
call fcn.140034bfc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.C6IDy.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140031329
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x3c0]
lea r8, [rbp + 0x3c8]
lea rdx, [rbp + 0x3d0]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.mx0HBm.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140031390
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400313df
lea rax, [rbp + 0x3d8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3e0]
lea r8, [rbp + 0x3e8]
lea rdx, [rbp + 0x3f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140031407
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140031456
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x408]
lea r8, [rbp + 0x410]
lea rdx, [rbp + 0x418]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x420]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r14
mov r8d, 7
lea rdx, str.5CWMx55
lea rcx, [rbp + 0x18]
call fcn.14000192c
nop
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], r12
cmova rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x28]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x54c636e
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x30]
mov edi, 0x1000
cmp rdx, r12
jbe 0x140031504
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, rdi
jb 0x1400314ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d20
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1c8], xmm1
mov r8d, 9
lea rdx, str.uswdGFQ7V
lea rcx, [rbp + 0x1b8]
call fcn.14000192c
lea rdx, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], r12
cmova rdx, qword [rbp + 0x1b8]
mov r8d, 0x1f0a8bc8
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x1d0]
cmp rdx, r12
jbe 0x140031596
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, rdi
jb 0x140031591
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d26
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
mov r8d, 9
lea rdx, str.gWbQpfbDr
lea rcx, [rbp + 0x98]
call fcn.14000192c
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], r12
cmova rdx, qword [rbp + 0x98]
mov r8d, 0x11fb1ff9
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0xb0]
cmp rdx, r12
jbe 0x140031628
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, rdi
jb 0x140031623
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d2c
call fcn.140034bfc
mov dword [rbp - 0x70], 0x10
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e8], xmm1
mov r8d, 4
lea rdx, str.jFVT
lea rcx, [rbp + 0x1d8]
call fcn.14000192c
lea rdx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], r12
cmova rdx, qword [rbp + 0x1d8]
mov r8d, 0x2d2597b5
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x1f0]
cmp rdx, r12
jbe 0x1400316d2
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, rdi
jb 0x1400316cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d32
call fcn.140034bfc
mov dword [rbp - 0x6c], 0x10
lea rdx, [rbp - 0x6c]
lea rcx, [rbp + 0x700]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x428]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
mov r8d, 2
lea rdx, [0x1400605b4]
lea rcx, [rbp + 0x38]
call fcn.14000192c
nop
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], r12
cmova rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0xbb8b831
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, r12
jbe 0x140031786
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, rdi
jb 0x140031781
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d38
call fcn.140034bfc
test rsi, rsi
je 0x140031c75
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.1g5r70lD.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400317d7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r14
mov qword [rbp + 0x70], r14
mov r8d, 2
lea rdx, [0x1400605d4]
lea rcx, [rbp + 0x58]
call fcn.14000192c
nop
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], r12
cmova rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x2850b8d4
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, r12
jbe 0x140031866
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x140031861
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d3e
call fcn.140034bfc
lea r9, [rbp + 0x430]
lea r8, [rbp + 0x438]
lea rdx, [rbp + 0x440]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400318d7
lea rax, [rbp + 0x448]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x450]
lea r8, [rbp + 0x458]
lea rdx, [rbp + 0x460]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140031926
lea rax, [rbp + 0x468]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x470]
lea r8, [rbp + 0x478]
lea rdx, [rbp + 0x480]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x208], xmm1
mov edi, 3
mov r8d, edi
lea rdx, [0x1400605d8]
lea rcx, [rbp + 0x1f8]
call fcn.14000192c
lea rdx, [rbp + 0x1f8]
cmp qword [rbp + 0x210], r12
cmova rdx, qword [rbp + 0x1f8]
mov r8d, 0x346f9f90
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x210]
mov esi, 0x1000
cmp rdx, r12
jbe 0x1400319bf
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, rsi
jb 0x1400319ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d44
call fcn.140034bfc
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x70], 0x10
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x720]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x218], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x228], xmm1
mov r8d, 2
lea rdx, [0x1400605dc]
lea rcx, [rbp + 0x218]
call fcn.14000192c
lea rdx, [rbp + 0x218]
cmp qword [rbp + 0x230], r12
cmova rdx, qword [rbp + 0x218]
mov r8d, 0x1b45113
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x230]
cmp rdx, r12
jbe 0x140031a85
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, rsi
jb 0x140031a80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d4a
call fcn.140034bfc
mov edx, 8
lea rcx, [rbp + 0x488]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140031aad
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.b.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140031ae5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], r14
mov r8, r15
lea rdx, [0x1400605e0]
lea rcx, [rbp + 0x78]
call fcn.14000192c
nop
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], r12
cmova rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x88]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0xb7706fb
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, r12
jbe 0x140031b8d
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, rsi
jb 0x140031b88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d50
call fcn.140034bfc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140031bdc
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x498]
lea r8, [rbp + 0x4a0]
lea rdx, [rbp + 0x4a8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
mov r8d, 5
lea rdx, str.fGFZZ
lea rcx, [rbp - 0x68]
call fcn.14000192c
nop
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], r12
cmova rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x35bd3693
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, r12
jbe 0x140031c67
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, rsi
jb 0x140031c62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cd8
call fcn.140034bfc
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
nop
test rbx, rbx
je 0x140031ca5
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140031ca5
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
or edx, 0xffffffff
lock xadd dword [rbx + 0xc], edx
cmp edx, 1
jne 0x140031ca5
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
mov al, r15b
mov rcx, qword [rbp + 0x2740]
xor rcx, rsp
call fcn.140034ca0
lea r11, [rsp + 0x2850]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003be04
nop
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
nop
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3