Function at 0x42a082
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45babe
mov eax, dword fs:[0]
push eax
mov eax, 0x5c80
call fcn.00438c90
mov eax, dword [0x48f0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x3a74]
push eax
call esi
push 0x47deb0
lea ecx, [ebp - 0x3bbc]
call fcn.00401c92
lea ecx, [ebp - 0x3bbc]
call fcn.00409f25
push 0x9a1ca11
push eax
push 0x47deb4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3bbc]
call fcn.004021f4
push 8
lea eax, [ebp - 0x3a7c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov edi, dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ebx, dword [sym.imp.WINMM.dll_timeEndPeriod]
test eax, eax
jne 0x42a123
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x3a84]
push eax
call esi
lea eax, [ebp - 0x3a8c]
push eax
call esi
push 0x47debc
lea ecx, [ebp - 0x3bd4]
call fcn.00401c92
lea ecx, [ebp - 0x3bd4]
call fcn.00409f25
push 0x27c7e1e4
push eax
push 0x47dec0
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3bd4]
call fcn.004021f4
push str.1ROz
lea ecx, [ebp - 0x3bec]
call fcn.00401c92
and dword [ebp - 4], 0
lea eax, [ebp - 0x3bec]
push 0x15612e77
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3bec]
call fcn.004021f4
lea eax, [ebp - 0x3a94]
push eax
call esi
lea eax, [ebp - 0x5524]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.fVLzojr
lea ecx, [ebp - 0x3c04]
call fcn.00401c92
push 0x38ad6df4
lea eax, [ebp - 0x3c04]
xor esi, esi
push eax
inc esi
push 0x490d20
mov dword [ebp - 4], esi
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3c04]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push esi
push 0x80000000
push str.XHvGV008.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x42a242
push eax
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.MkfkEnz.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42a267
push eax
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x3a9c]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a298
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x1208]
mov dword [ebp - 0x1208], 0x10
push eax
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x3aa4]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a2e7
push 1
call edi
push 1
call ebx
push 8
lea eax, [ebp - 0x3aac]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a302
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x5534]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.N7fzX
lea ecx, [ebp - 0x3c1c]
call fcn.00401c92
lea ecx, [ebp - 0x3c1c]
call fcn.00409f25
push 0x2f6d4d9d
push eax
push 0x47df60
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3c1c]
call fcn.004021f4
push str.5fIqZ6J
lea ecx, [ebp - 0x3c34]
call fcn.00401c92
push 0x1343eacc
lea eax, [ebp - 0x3c34]
mov dword [ebp - 4], 2
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3c34]
call fcn.004021f4
push 8
lea eax, [ebp - 0x3ab4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a3af
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x3abc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42a405
lea ecx, [ebp - 0x3ac4]
push ecx
lea ecx, [ebp - 0x3acc]
push ecx
lea ecx, [ebp - 0x3ad4]
push ecx
lea ecx, [ebp - 0x3adc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
lea eax, [ebp - 0x3ae4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x120c]
mov dword [ebp - 0x120c], 0x10
push eax
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42a479
lea ecx, [ebp - 0x3aec]
push ecx
lea ecx, [ebp - 0x3af4]
push ecx
lea ecx, [ebp - 0x3afc]
push ecx
lea ecx, [ebp - 0x3b04]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
push str.V0Yo3a
lea ecx, [ebp - 0x3c4c]
call fcn.00401c92
push 0x1cbe770f
lea eax, [ebp - 0x3c4c]
mov dword [ebp - 4], 3
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3c4c]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42a50e
lea ecx, [ebp - 0x3b0c]
push ecx
lea ecx, [ebp - 0x3b14]
push ecx
lea ecx, [ebp - 0x3b1c]
push ecx
lea ecx, [ebp - 0x3b24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
push 8
lea eax, [ebp - 0x3b2c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a529
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x3b34]
push eax
lea eax, [ebp - 0x3b3c]
push eax
lea eax, [ebp - 0x3b44]
push eax
push 0x47dfa4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5544]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x3b4c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a571
push 1
call edi
push 1
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.5pJ8.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42a596
push eax
call esi
lea eax, [ebp - 0x3b54]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x3b5c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a5be
push 1
call edi
push 1
call ebx
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x3b64]
push eax
lea eax, [ebp - 0x3b6c]
push eax
lea eax, [ebp - 0x3b74]
push eax
push 0x47e000
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5554]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.cz983
lea ecx, [ebp - 0x3c64]
call fcn.00401c92
push 0xcd69203
lea eax, [ebp - 0x3c64]
mov dword [ebp - 4], 4
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3c64]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42a696
lea ecx, [ebp - 0x3b7c]
push ecx
lea ecx, [ebp - 0x3b84]
push ecx
lea ecx, [ebp - 0x3b8c]
push ecx
lea ecx, [ebp - 0x3b94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
lea eax, [ebp - 0x1210]
mov dword [ebp - 0x1210], 0x10
push eax
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x3b9c]
push eax
lea eax, [ebp - 0x3ba4]
push eax
lea eax, [ebp - 0x5124]
push eax
push 0x47e020
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.jH8kP
lea ecx, [ebp - 0x3c7c]
call fcn.00401c92
lea ecx, [ebp - 0x3c7c]
call fcn.00409f25
push 0x364621e
push eax
push 0x47e040
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3c7c]
call fcn.004021f4
lea eax, [ebp - 0x1214]
mov dword [ebp - 0x1214], 0x10
push eax
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x5564]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x47e060
lea ecx, [ebp - 0x3c94]
call fcn.00401c92
push 0x3166dc56
lea eax, [ebp - 0x3c94]
mov dword [ebp - 4], 5
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3c94]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x3cac]
push 0x47e064
call fcn.00401c92
push 0x1fd9dd05
lea eax, [ebp - 0x3cac]
mov dword [ebp - 4], 6
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3cac]
call fcn.004021f4
lea eax, [ebp - 0x1218]
mov dword [ebp - 0x1218], 0x10
push eax
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x5574]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.15qEcfMu.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42a836
push eax
call esi
push 0x47e090
lea ecx, [ebp - 0x3cc4]
call fcn.00401c92
lea ecx, [ebp - 0x3cc4]
call fcn.00409f25
push 0xc87e862
push eax
push 0x47e09c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3cc4]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
mov dword [ebp - 0x121c], 0x10
lea eax, [ebp - 0x121c]
push eax
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x512c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a8be
push 1
call edi
push 1
call ebx
push 0x47e0b8
lea ecx, [ebp - 0x3cdc]
call fcn.00401c92
push 0x2214cecc
lea eax, [ebp - 0x3cdc]
mov dword [ebp - 4], 7
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3cdc]
call fcn.004021f4
lea eax, [ebp - 0x5584]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x3cf4]
push str.KNyrP
call fcn.00401c92
lea ecx, [ebp - 0x3cf4]
call fcn.00409f25
push 0xd0b56a4
push eax
push 0x47e0cc
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3cf4]
call fcn.004021f4
push 8
lea eax, [ebp - 0x5134]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42a981
push 1
call edi
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42a9ca
lea ecx, [ebp - 0x513c]
push ecx
lea ecx, [ebp - 0x5144]
push ecx
lea ecx, [ebp - 0x514c]
push ecx
lea ecx, [ebp - 0x5154]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
lea eax, [ebp - 0x1220]
mov dword [ebp - 0x1220], 0x10
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x47e0e8
lea ecx, [ebp - 0x3d0c]
call fcn.00401c92
lea ecx, [ebp - 0x3d0c]
call fcn.00409f25
push 0x2316aff9
push eax
push 0x47e0ec
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3d0c]
call fcn.004021f4
lea eax, [ebp - 0x515c]
push eax
lea eax, [ebp - 0x5164]
push eax
lea eax, [ebp - 0x516c]
push eax
push 0x47e0fc
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x3d24]
push str.V6obz
call fcn.00401c92
lea ecx, [ebp - 0x3d24]
call fcn.00409f25
push 0x14329981
push eax
push 0x47e12c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3d24]
call fcn.004021f4
lea eax, [ebp - 0x1224]
mov dword [ebp - 0x1224], 0x10
push eax
lea eax, [ebp - 0x6d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42aaf7
lea ecx, [ebp - 0x5174]
push ecx
lea ecx, [ebp - 0x517c]
push ecx
lea ecx, [ebp - 0x5184]
push ecx
lea ecx, [ebp - 0x518c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
lea eax, [ebp - 0x5194]
push eax
lea eax, [ebp - 0x519c]
push eax
lea eax, [ebp - 0x51a4]
push eax
push 0x47e13c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42ab60
lea ecx, [ebp - 0x51ac]
push ecx
lea ecx, [ebp - 0x51b4]
push ecx
lea ecx, [ebp - 0x51bc]
push ecx
lea ecx, [ebp - 0x51c4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
push 8
lea eax, [ebp - 0x51cc]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42ab7b
push 1
call edi
push 1
call ebx
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x51d4]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42abac
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x51dc]
push eax
lea eax, [ebp - 0x51e4]
push eax
lea eax, [ebp - 0x51ec]
push eax
push 0x47e14c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.Ng1t7
lea ecx, [ebp - 0x3d3c]
call fcn.00401c92
lea ecx, [ebp - 0x3d3c]
call fcn.00409f25
push 0x19279746
push eax
push 0x47e188
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3d3c]
call fcn.004021f4
push 0x47e190
lea ecx, [ebp - 0x3d54]
call fcn.00401c92
lea ecx, [ebp - 0x3d54]
call fcn.00409f25
push 0x224cd213
push eax
push 0x47e19c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3d54]
call fcn.004021f4
push 0x47e1ac
lea ecx, [ebp - 0x3d6c]
call fcn.00401c92
lea ecx, [ebp - 0x3d6c]
call fcn.00409f25
push 0x2c8b0a92
push eax
push 0x47e1b8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3d6c]
call fcn.004021f4
lea eax, [ebp - 0x51f4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x51fc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x1228]
mov dword [ebp - 0x1228], 0x10
push eax
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x5594]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x55a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.8XRw3J0ks.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42acee
push eax
call esi
lea eax, [ebp - 0x122c]
mov dword [ebp - 0x122c], 0x10
push eax
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.hswrGHTuS
lea ecx, [ebp - 0x3d84]
call fcn.00401c92
lea ecx, [ebp - 0x3d84]
call fcn.00409f25
push 0x2c92178b
push eax
push 0x47e218
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3d84]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42ad8e
lea ecx, [ebp - 0x5204]
push ecx
lea ecx, [ebp - 0x520c]
push ecx
lea ecx, [ebp - 0x5214]
push ecx
lea ecx, [ebp - 0x521c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.39zB9eQ7a.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42adb3
push eax
call esi
push 8
lea eax, [ebp - 0x5224]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42adce
push 1
call edi
push 1
call ebx
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x3d9c]
push str.6N6m
call fcn.00401c92
push 0x37fbd339
lea eax, [ebp - 0x3d9c]
mov dword [ebp - 4], 8
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3d9c]
call fcn.004021f4
lea eax, [ebp - 0x522c]
push eax
lea eax, [ebp - 0x5234]
push eax
lea eax, [ebp - 0x523c]
push eax
push 0x47e25c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.bWMmN6a
lea ecx, [ebp - 0x3db4]
call fcn.00401c92
lea ecx, [ebp - 0x3db4]
call fcn.00409f25
push 0x32dd97d8
push eax
push 0x47e274
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3db4]
call fcn.004021f4
lea eax, [ebp - 0x5244]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x524c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x55b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x5254]
push eax
lea eax, [ebp - 0x525c]
push eax
lea eax, [ebp - 0x5264]
push eax
push 0x47e27c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x526c]
push eax
lea eax, [ebp - 0x5274]
push eax
lea eax, [ebp - 0x527c]
push eax
push 0x47e28c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x5284]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42af21
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x528c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x5294]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42af5f
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x529c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x1230]
mov dword [ebp - 0x1230], 0x10
push eax
lea eax, [ebp - 0x610]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x1234]
mov dword [ebp - 0x1234], 0x10
push eax
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42aff1
lea ecx, [ebp - 0x52a4]
push ecx
lea ecx, [ebp - 0x52ac]
push ecx
lea ecx, [ebp - 0x52b4]
push ecx
lea ecx, [ebp - 0x52bc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
push str.mcQKxor
lea ecx, [ebp - 0x3dcc]
call fcn.00401c92
lea ecx, [ebp - 0x3dcc]
call fcn.00409f25
push 0x743358f
push eax
push 0x47e2b4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3dcc]
call fcn.004021f4
lea eax, [ebp - 0x1238]
mov dword [ebp - 0x1238], 0x10
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x123c]
mov dword [ebp - 0x123c], 0x10
push eax
lea eax, [ebp - 0x5f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.TV7INJq9s
lea ecx, [ebp - 0x3de4]
call fcn.00401c92
push 0x8e9fa4b
lea eax, [ebp - 0x3de4]
mov dword [ebp - 4], 9
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3de4]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.KeUTf8F.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42b0d7
push eax
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x3dfc]
push str.2s9OfbIx
call fcn.00401c92
push 0x12c38edd
lea eax, [ebp - 0x3dfc]
mov dword [ebp - 4], 0xa
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3dfc]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b182
lea ecx, [ebp - 0x52c4]
push ecx
lea ecx, [ebp - 0x52cc]
push ecx
lea ecx, [ebp - 0x52d4]
push ecx
lea ecx, [ebp - 0x52dc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
push str.83HEEgma
lea ecx, [ebp - 0x3e14]
call fcn.00401c92
lea ecx, [ebp - 0x3e14]
call fcn.00409f25
push 0x3197b7a1
push eax
push 0x47e334
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3e14]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0x18
lea eax, [ebp - 0x52e4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b23a
lea ecx, [ebp - 0x52ec]
push ecx
lea ecx, [ebp - 0x52f4]
push ecx
lea ecx, [ebp - 0x52fc]
push ecx
lea ecx, [ebp - 0x5304]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
lea eax, [ebp - 0x55c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b290
lea ecx, [ebp - 0x530c]
push ecx
lea ecx, [ebp - 0x5314]
push ecx
lea ecx, [ebp - 0x531c]
push ecx
lea ecx, [ebp - 0x5324]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b2d9
lea ecx, [ebp - 0x532c]
push ecx
lea ecx, [ebp - 0x5334]
push ecx
lea ecx, [ebp - 0x533c]
push ecx
lea ecx, [ebp - 0x5344]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
lea eax, [ebp - 0x1240]
mov dword [ebp - 0x1240], 0x10
push eax
lea eax, [ebp - 0x5d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x55d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x534c]
push eax
lea eax, [ebp - 0x5354]
push eax
lea eax, [ebp - 0x535c]
push eax
push 0x47e360
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x5364]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42b33f
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x536c]
push eax
lea eax, [ebp - 0x5374]
push eax
lea eax, [ebp - 0x537c]
push eax
push 0x47e37c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x5384]
push eax
lea eax, [ebp - 0x538c]
push eax
lea eax, [ebp - 0x5394]
push eax
push 0x47e38c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b3de
lea ecx, [ebp - 0x539c]
push ecx
lea ecx, [ebp - 0x53a4]
push ecx
lea ecx, [ebp - 0x53ac]
push ecx
lea ecx, [ebp - 0x53b4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b427
lea ecx, [ebp - 0x53bc]
push ecx
lea ecx, [ebp - 0x53c4]
push ecx
lea ecx, [ebp - 0x3a6c]
push ecx
lea ecx, [ebp - 0x53d4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
lea eax, [ebp - 0x1244]
mov dword [ebp - 0x1244], 0x10
push eax
lea eax, [ebp - 0x5b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.tBoUBx.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42b46a
push eax
call esi
push 8
lea eax, [ebp - 0x53dc]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42b485
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x55e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.4QpHnBzcn
lea ecx, [ebp - 0x3e2c]
call fcn.00401c92
lea ecx, [ebp - 0x3e2c]
call fcn.00409f25
push 0x23a7ea64
push eax
push 0x47e3f8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3e2c]
call fcn.004021f4
push 8
lea eax, [ebp - 0x53e4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42b4e6
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x53ec]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x53f4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x55f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1248]
mov dword [ebp - 0x1248], 0x10
push eax
lea eax, [ebp - 0x590]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x124c]
mov dword [ebp - 0x124c], 0x10
push eax
lea eax, [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x47e40c
lea ecx, [ebp - 0x3e44]
call fcn.00401c92
push 0xb5d8324
lea eax, [ebp - 0x3e44]
mov dword [ebp - 4], 0xb
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3e44]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b5de
lea ecx, [ebp - 0x53fc]
push ecx
lea ecx, [ebp - 0x5404]
push ecx
lea ecx, [ebp - 0x540c]
push ecx
lea ecx, [ebp - 0x5414]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b627
lea ecx, [ebp - 0x541c]
push ecx
lea ecx, [ebp - 0x5424]
push ecx
lea ecx, [ebp - 0x542c]
push ecx
lea ecx, [ebp - 0x5434]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
lea eax, [ebp - 0x543c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x5444]
push eax
lea eax, [ebp - 0x544c]
push eax
lea eax, [ebp - 0x5454]
push eax
push 0x47e42c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x545c]
push eax
lea eax, [ebp - 0x5464]
push eax
lea eax, [ebp - 0x546c]
push eax
push 0x47e434
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5474]
push eax
lea eax, [ebp - 0x547c]
push eax
lea eax, [ebp - 0x5484]
push eax
push 0x47e444
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b6dd
lea ecx, [ebp - 0x174c]
push ecx
lea ecx, [ebp - 0x1754]
push ecx
lea ecx, [ebp - 0x175c]
push ecx
lea ecx, [ebp - 0x1764]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c8c], eax
test eax, eax
je 0x42b726
lea ecx, [ebp - 0x176c]
push ecx
lea ecx, [ebp - 0x1774]
push ecx
lea ecx, [ebp - 0x177c]
push ecx
lea ecx, [ebp - 0x1784]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c8c]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.CSYIH3Z.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42b74b
push eax
call esi
lea eax, [ebp - 0x178c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x1794]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42b789
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x1250]
mov dword [ebp - 0x1250], 0x10
push eax
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x179c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x17a4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42b7cf
push 1
call edi
push 1
call ebx
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x5604]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.SRzIO
lea ecx, [ebp - 0x3e5c]
call fcn.00401c92
push 0x18c3f36
lea eax, [ebp - 0x3e5c]
mov dword [ebp - 4], 0xc
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3e5c]
call fcn.004021f4
lea eax, [ebp - 0x17ac]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x17b4]
push eax
lea eax, [ebp - 0x17bc]
push eax
lea eax, [ebp - 0x17c4]
push eax
push 0x47e4a0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
mov eax, dword [0x48f080]
add esp, 0xc
test eax, eax
je 0x430591
push 0xffffffffffffffff
push 0xff676980
push 0
push eax
call fcn.00438f20
push 0
push 1
push 0
mov dword [ebp - 0x136c], eax
mov dword [ebp - 0x1368], edx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov dword [ebp - 0x5c8c], eax
lea eax, [ebp - 0x5614]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x17cc]
push eax
lea eax, [ebp - 0x17d4]
push eax
lea eax, [ebp - 0x17dc]
push eax
push 0x47e4b0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.Podma.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42b90d
push eax
call esi
push 0x47e4e4
lea ecx, [ebp - 0x3e74]
call fcn.00401c92
push 0x3287ca0d
lea eax, [ebp - 0x3e74]
mov dword [ebp - 4], 0xd
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3e74]
call fcn.004021f4
lea eax, [ebp - 0x1254]
mov dword [ebp - 0x1254], 0x10
push eax
lea eax, [ebp - 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x17e4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x5624]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x47e4e8
lea ecx, [ebp - 0x3e8c]
call fcn.00401c92
push 0xed39eb6
lea eax, [ebp - 0x3e8c]
mov dword [ebp - 4], 0xe
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3e8c]
call fcn.004021f4
push str.hTv7yD
lea ecx, [ebp - 0x3ea4]
call fcn.00401c92
push 0x172a3694
lea eax, [ebp - 0x3ea4]
mov dword [ebp - 4], 0xf
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3ea4]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42ba72
lea ecx, [ebp - 0x17ec]
push ecx
lea ecx, [ebp - 0x17f4]
push ecx
lea ecx, [ebp - 0x17fc]
push ecx
lea ecx, [ebp - 0x1804]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x180c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42bade
lea ecx, [ebp - 0x1814]
push ecx
lea ecx, [ebp - 0x181c]
push ecx
lea ecx, [ebp - 0x1824]
push ecx
lea ecx, [ebp - 0x182c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x1834]
push eax
lea eax, [ebp - 0x183c]
push eax
lea eax, [ebp - 0x1844]
push eax
push 0x47e50c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.dXJy
lea ecx, [ebp - 0x3ebc]
call fcn.00401c92
push 0x17afec75
lea eax, [ebp - 0x3ebc]
mov dword [ebp - 4], 0x10
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3ebc]
call fcn.004021f4
lea eax, [ebp - 0x1258]
mov dword [ebp - 0x1258], 0x10
push eax
lea eax, [ebp - 0x6b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.dwF8d
lea ecx, [ebp - 0x3ed4]
call fcn.00401c92
push 0x25e3394a
lea eax, [ebp - 0x3ed4]
mov dword [ebp - 4], 0x11
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3ed4]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x3eec]
push str.1zK8sJ3
call fcn.00401c92
push 0x17b6b4a3
lea eax, [ebp - 0x3eec]
mov dword [ebp - 4], 0x12
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3eec]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x3f04]
push 0x47e540
call fcn.00401c92
lea ecx, [ebp - 0x3f04]
call fcn.00409f25
push 0x1c21e71b
push eax
push 0x47e54c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3f04]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42bcae
lea ecx, [ebp - 0x184c]
push ecx
lea ecx, [ebp - 0x1854]
push ecx
lea ecx, [ebp - 0x185c]
push ecx
lea ecx, [ebp - 0x1864]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x125c]
mov dword [ebp - 0x125c], 0x10
push eax
lea eax, [ebp - 0x6f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42bd15
lea ecx, [ebp - 0x186c]
push ecx
lea ecx, [ebp - 0x1874]
push ecx
lea ecx, [ebp - 0x187c]
push ecx
lea ecx, [ebp - 0x1884]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.exC0TMZ8Ay.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42bd3a
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42bd83
lea ecx, [ebp - 0x188c]
push ecx
lea ecx, [ebp - 0x1894]
push ecx
lea ecx, [ebp - 0x189c]
push ecx
lea ecx, [ebp - 0x18a4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push str.dWv1
lea ecx, [ebp - 0x3f1c]
call fcn.00401c92
lea ecx, [ebp - 0x3f1c]
call fcn.00409f25
push 0x2f9a957e
push eax
push 0x47e598
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3f1c]
call fcn.004021f4
push str.1whgdZuZ
lea ecx, [ebp - 0x3f34]
call fcn.00401c92
lea ecx, [ebp - 0x3f34]
call fcn.00409f25
push 0x30ecd225
push eax
push 0x47e5ac
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3f34]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42be3e
lea ecx, [ebp - 0x18ac]
push ecx
lea ecx, [ebp - 0x18b4]
push ecx
lea ecx, [ebp - 0x18bc]
push ecx
lea ecx, [ebp - 0x18c4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 8
lea eax, [ebp - 0x18cc]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42be59
push 1
call edi
push 1
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.28Nu92ri.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42be7e
push eax
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.jdCfzTZedZ.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42bea3
push eax
call esi
push 0x47e620
lea ecx, [ebp - 0x3f4c]
call fcn.00401c92
push 0x1dabcdeb
lea eax, [ebp - 0x3f4c]
mov dword [ebp - 4], 0x13
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3f4c]
call fcn.004021f4
push str.2X5kDG
lea ecx, [ebp - 0x3f64]
call fcn.00401c92
push 0x3b548e6f
lea eax, [ebp - 0x3f64]
mov dword [ebp - 4], 0x14
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3f64]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.rnLfcU4C.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42bf60
push eax
call esi
lea eax, [ebp - 0x1260]
mov dword [ebp - 0x1260], 0x10
push eax
lea eax, [ebp - 0x710]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42bfc7
lea ecx, [ebp - 0x18d4]
push ecx
lea ecx, [ebp - 0x18dc]
push ecx
lea ecx, [ebp - 0x18e4]
push ecx
lea ecx, [ebp - 0x18ec]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x47e660
lea ecx, [ebp - 0x3f7c]
call fcn.00401c92
push 0x21354d0c
lea eax, [ebp - 0x3f7c]
mov dword [ebp - 4], 0x15
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3f7c]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.r3WBlUV5.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42c038
push eax
call esi
push str.qAT1Co7ugs
lea ecx, [ebp - 0x3f94]
call fcn.00401c92
push 0x22c3b21e
lea eax, [ebp - 0x3f94]
mov dword [ebp - 4], 0x16
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3f94]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
mov dword [ebp - 0x1264], 0x10
lea eax, [ebp - 0x1264]
push eax
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x18f4]
push eax
lea eax, [ebp - 0x18fc]
push eax
lea eax, [ebp - 0x1904]
push eax
push 0x47e6a8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x190c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42c0f3
push 1
call edi
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42c13c
lea ecx, [ebp - 0x1914]
push ecx
lea ecx, [ebp - 0x191c]
push ecx
lea ecx, [ebp - 0x1924]
push ecx
lea ecx, [ebp - 0x192c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x5634]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.lVkgaOX
lea ecx, [ebp - 0x3fac]
call fcn.00401c92
push 0x21b4b45b
lea eax, [ebp - 0x3fac]
mov dword [ebp - 4], 0x17
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3fac]
call fcn.004021f4
push 8
lea eax, [ebp - 0x1934]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42c1c6
push 1
call edi
push 1
call ebx
push str.Xow2f6
lea ecx, [ebp - 0x3fc4]
call fcn.00401c92
push 0x10dafea5
lea eax, [ebp - 0x3fc4]
mov dword [ebp - 4], 0x18
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3fc4]
call fcn.004021f4
lea eax, [ebp - 0x5644]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.b.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42c244
push eax
call esi
lea eax, [ebp - 0x1268]
mov dword [ebp - 0x1268], 0x10
push eax
lea eax, [ebp - 0x750]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.Z1YKmlNJ
lea ecx, [ebp - 0x3fdc]
call fcn.00401c92
push 0x116f7bf0
lea eax, [ebp - 0x3fdc]
mov dword [ebp - 4], 0x19
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3fdc]
call fcn.004021f4
lea eax, [ebp - 0x193c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x126c]
mov dword [ebp - 0x126c], 0x10
push eax
lea eax, [ebp - 0x770]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.Su.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42c2fe
push eax
call esi
push 0x47e720
lea ecx, [ebp - 0x3ff4]
call fcn.00401c92
lea ecx, [ebp - 0x3ff4]
call fcn.00409f25
push 0x2db5c62b
push eax
push 0x47e724
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x3ff4]
call fcn.004021f4
lea eax, [ebp - 0x1944]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x194c]
push eax
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x195c]
push eax
push 0x47e72c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x1964]
push eax
lea eax, [ebp - 0x196c]
push eax
lea eax, [ebp - 0x1974]
push eax
push 0x47e740
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x197c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.w7LE766jrg
lea ecx, [ebp - 0x400c]
call fcn.00401c92
push 0x3abfdf2b
lea eax, [ebp - 0x400c]
mov dword [ebp - 4], 0x1a
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x400c]
call fcn.004021f4
push 8
lea eax, [ebp - 0x1984]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42c3f8
push 1
call edi
push 1
call ebx
push str.dZhngN6HM9
lea ecx, [ebp - 0x4024]
call fcn.00401c92
push 0x298cf137
lea eax, [ebp - 0x4024]
mov dword [ebp - 4], 0x1b
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4024]
call fcn.004021f4
lea eax, [ebp - 0x5654]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42c49a
lea ecx, [ebp - 0x198c]
push ecx
lea ecx, [ebp - 0x1994]
push ecx
lea ecx, [ebp - 0x199c]
push ecx
lea ecx, [ebp - 0x19a4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x1270]
mov dword [ebp - 0x1270], 0x10
push eax
lea eax, [ebp - 0x790]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x19ac]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42c4d3
push 1
call edi
push 1
call ebx
push str.oJm6L
lea ecx, [ebp - 0x403c]
call fcn.00401c92
lea ecx, [ebp - 0x403c]
call fcn.00409f25
push 0x864b033
push eax
push 0x47e7a0
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x403c]
call fcn.004021f4
lea eax, [ebp - 0x19b4]
push eax
lea eax, [ebp - 0x19bc]
push eax
lea eax, [ebp - 0x19c4]
push eax
push 0x47e7b0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.1QIUP.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42c551
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42c59a
lea ecx, [ebp - 0x19cc]
push ecx
lea ecx, [ebp - 0x19d4]
push ecx
lea ecx, [ebp - 0x19dc]
push ecx
lea ecx, [ebp - 0x19e4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x19ec]
push eax
lea eax, [ebp - 0x19f4]
push eax
lea eax, [ebp - 0x19fc]
push eax
push 0x47e7ec
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x1a04]
push eax
lea eax, [ebp - 0x1a0c]
push eax
lea eax, [ebp - 0x1a14]
push eax
push 0x47e800
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.Ixe9
lea ecx, [ebp - 0x4054]
call fcn.00401c92
lea ecx, [ebp - 0x4054]
call fcn.00409f25
push 0x23c7c08c
push eax
push 0x47e810
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4054]
call fcn.004021f4
lea eax, [ebp - 0x1274]
mov dword [ebp - 0x1274], 0x10
push eax
lea eax, [ebp - 0x7b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x5664]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42c687
lea ecx, [ebp - 0x1a1c]
push ecx
lea ecx, [ebp - 0x1a24]
push ecx
lea ecx, [ebp - 0x1a2c]
push ecx
lea ecx, [ebp - 0x1a34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.HBT0.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42c6ac
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42c6f5
lea ecx, [ebp - 0x1a3c]
push ecx
lea ecx, [ebp - 0x1a44]
push ecx
lea ecx, [ebp - 0x1a4c]
push ecx
lea ecx, [ebp - 0x1a54]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.to3wh.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42c71a
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42c763
lea ecx, [ebp - 0x1a5c]
push ecx
lea ecx, [ebp - 0x1a64]
push ecx
lea ecx, [ebp - 0x1a6c]
push ecx
lea ecx, [ebp - 0x1a74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x5674]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1a7c]
push eax
lea eax, [ebp - 0x1a84]
push eax
lea eax, [ebp - 0x1a8c]
push eax
push 0x47e870
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.ABw5CErm55.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42c7b5
push eax
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.s57ls91.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42c7da
push eax
call esi
lea eax, [ebp - 0x1278]
mov dword [ebp - 0x1278], 0x10
push eax
lea eax, [ebp - 0x7d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.CFsFoeo
lea ecx, [ebp - 0x406c]
call fcn.00401c92
lea ecx, [ebp - 0x406c]
call fcn.00409f25
push 0x19455daa
push eax
push 0x47e8d8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x406c]
call fcn.004021f4
lea eax, [ebp - 0x1a94]
push eax
lea eax, [ebp - 0x1a9c]
push eax
lea eax, [ebp - 0x1aa4]
push eax
push 0x47e8f0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x1aac]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x1ab4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42c879
push 1
call edi
push 1
call ebx
push str.84QFhIWjz
lea ecx, [ebp - 0x4084]
call fcn.00401c92
push 0x126c3126
lea eax, [ebp - 0x4084]
mov dword [ebp - 4], 0x1c
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4084]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0x18
lea eax, [ebp - 0x1abc]
push eax
lea eax, [ebp - 0x1ac4]
push eax
lea eax, [ebp - 0x1acc]
push eax
push 0x47e910
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5684]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1ad4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x127c]
mov dword [ebp - 0x127c], 0x10
push eax
lea eax, [ebp - 0x7f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0x18
lea eax, [ebp - 0x5694]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.mmqPgd7wAD
lea ecx, [ebp - 0x409c]
call fcn.00401c92
lea ecx, [ebp - 0x409c]
call fcn.00409f25
push 0x2276eb77
push eax
push 0x47e934
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x409c]
call fcn.004021f4
lea eax, [ebp - 0x1204]
mov dword [ebp - 0x1204], 0x10
push eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x1280]
mov dword [ebp - 0x1280], 0x10
push eax
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.jK.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42ca16
push eax
call esi
lea eax, [ebp - 0x1adc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x1284]
mov dword [ebp - 0x1284], 0x10
push eax
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x1ae4]
push eax
lea eax, [ebp - 0x1aec]
push eax
lea eax, [ebp - 0x1af4]
push eax
push 0x47e964
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42caaa
lea ecx, [ebp - 0x1afc]
push ecx
lea ecx, [ebp - 0x1b04]
push ecx
lea ecx, [ebp - 0x1b0c]
push ecx
lea ecx, [ebp - 0x1b14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47e96c
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42cacf
push eax
call esi
lea eax, [ebp - 0x1b1c]
push eax
lea eax, [ebp - 0x1b24]
push eax
lea eax, [ebp - 0x1b2c]
push eax
push 0x47e998
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.hplkrF.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42cb14
push eax
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.A.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42cb4f
push eax
call esi
lea eax, [ebp - 0x56a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.uJWmi
lea ecx, [ebp - 0x40b4]
call fcn.00401c92
lea ecx, [ebp - 0x40b4]
call fcn.00409f25
push 0x2b29b728
push eax
push 0x47e9e8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x40b4]
call fcn.004021f4
lea eax, [ebp - 0x1b34]
push eax
lea eax, [ebp - 0x1b3c]
push eax
lea eax, [ebp - 0x1b44]
push eax
push 0x47e9f8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.uC0lI8.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42cbda
push eax
call esi
push str.WLH8PWDe
lea ecx, [ebp - 0x40cc]
call fcn.00401c92
lea ecx, [ebp - 0x40cc]
call fcn.00409f25
push 0x1488c4f
push eax
push 0x47ea40
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x40cc]
call fcn.004021f4
lea eax, [ebp - 0x56b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1288]
mov dword [ebp - 0x1288], 0x10
push eax
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.S.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42cc63
push eax
call esi
lea eax, [ebp - 0x1b4c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42ccb9
lea ecx, [ebp - 0x1b54]
push ecx
lea ecx, [ebp - 0x1b5c]
push ecx
lea ecx, [ebp - 0x1b64]
push ecx
lea ecx, [ebp - 0x1b6c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x1b74]
push eax
lea eax, [ebp - 0x1b7c]
push eax
lea eax, [ebp - 0x1b84]
push eax
push 0x47ea6c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.ivgGW7ls.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42ccfe
push eax
call esi
lea eax, [ebp - 0x1b8c]
push eax
lea eax, [ebp - 0x1b94]
push eax
lea eax, [ebp - 0x1b9c]
push eax
push 0x47eaac
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.nYBoiMI
lea ecx, [ebp - 0x40e4]
call fcn.00401c92
lea ecx, [ebp - 0x40e4]
call fcn.00409f25
push 0xdc6106f
push eax
push 0x47eac4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x40e4]
call fcn.004021f4
push str.jjT9jcET
lea ecx, [ebp - 0x40fc]
call fcn.00401c92
push 0x28c17599
lea eax, [ebp - 0x40fc]
mov dword [ebp - 4], 0x1d
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x40fc]
call fcn.004021f4
lea eax, [ebp - 0x56c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1ba4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x1bac]
push eax
lea eax, [ebp - 0x1bb4]
push eax
lea eax, [ebp - 0x1bbc]
push eax
push 0x47eae0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47eaec
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42ce02
push eax
call esi
push str.FOaQGMyG
lea ecx, [ebp - 0x4114]
call fcn.00401c92
push 0x107657a6
lea eax, [ebp - 0x4114]
mov dword [ebp - 4], 0x1e
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4114]
call fcn.004021f4
push str.jNtAlqEP
lea ecx, [ebp - 0x412c]
call fcn.00401c92
push 0x373b02ca
lea eax, [ebp - 0x412c]
mov dword [ebp - 4], 0x1f
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x412c]
call fcn.004021f4
lea eax, [ebp - 0x1bc4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x1bcc]
push eax
lea eax, [ebp - 0x1bd4]
push eax
lea eax, [ebp - 0x1bdc]
push eax
push 0x47eb44
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x47eb4c
lea ecx, [ebp - 0x4144]
call fcn.00401c92
push 0xd5e41db
lea eax, [ebp - 0x4144]
mov dword [ebp - 4], 0x20
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4144]
call fcn.004021f4
lea eax, [ebp - 0x128c]
mov dword [ebp - 0x128c], 0x10
push eax
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x1be4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42cf4c
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x1bec]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x56d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x47eb5c
lea ecx, [ebp - 0x415c]
call fcn.00401c92
push 0x1bd0865
lea eax, [ebp - 0x415c]
mov dword [ebp - 4], 0x21
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x415c]
call fcn.004021f4
lea eax, [ebp - 0x1bf4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d01e
lea ecx, [ebp - 0x1bfc]
push ecx
lea ecx, [ebp - 0x1c04]
push ecx
lea ecx, [ebp - 0x1c0c]
push ecx
lea ecx, [ebp - 0x1c14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 8
lea eax, [ebp - 0x1c1c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d039
push 1
call edi
push 1
call ebx
push str.ZTB5KvK2J
lea ecx, [ebp - 0x16e4]
call fcn.00401c92
cmp dword [ebp - 0x16d0], 0xf
lea eax, [ebp - 0x16e4]
push 0x22a10473
cmova eax, dword [ebp - 0x16e4]
push eax
push 0x47eb9c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x16e4]
call fcn.004021f4
lea eax, [ebp - 0x1c24]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d0d1
lea ecx, [ebp - 0x1c2c]
push ecx
lea ecx, [ebp - 0x1c34]
push ecx
lea ecx, [ebp - 0x1c3c]
push ecx
lea ecx, [ebp - 0x1c44]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x1290]
mov dword [ebp - 0x1290], 0x10
push eax
lea eax, [ebp - 0x8b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x1c4c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x1c54]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d117
push 1
call edi
push 1
call ebx
push str.741uXW
lea ecx, [ebp - 0x4174]
call fcn.00401c92
push 0x3a091252
lea eax, [ebp - 0x4174]
mov dword [ebp - 4], 0x22
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4174]
call fcn.004021f4
push 8
lea eax, [ebp - 0x1c5c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d17e
push 1
call edi
push 1
call ebx
push str.TP5CWCbNg
lea ecx, [ebp - 0x418c]
call fcn.00401c92
push 0x8f75254
lea eax, [ebp - 0x418c]
mov dword [ebp - 4], 0x23
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x418c]
call fcn.004021f4
lea eax, [ebp - 0x1294]
mov dword [ebp - 0x1294], 0x10
push eax
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x1c64]
push eax
lea eax, [ebp - 0x1c6c]
push eax
lea eax, [ebp - 0x1c74]
push eax
push 0x47ebe8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
mov dword [ebp - 0x1298], 0x10
lea eax, [ebp - 0x1298]
push eax
lea eax, [ebp - 0x8f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.6BWp9hsxA
lea ecx, [ebp - 0x41a4]
call fcn.00401c92
push 0x1c9da092
lea eax, [ebp - 0x41a4]
mov dword [ebp - 4], 0x24
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x41a4]
call fcn.004021f4
lea eax, [ebp - 0x56e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x129c]
mov dword [ebp - 0x129c], 0x10
push eax
lea eax, [ebp - 0x910]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x1c7c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d2ce
push 1
call edi
push 1
call ebx
cmp dword [ebp - 0x5c8c], 0
je 0x430591
lea eax, [ebp - 0x12a0]
mov dword [ebp - 0x12a0], 0x10
push eax
lea eax, [ebp - 0x930]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x1c84]
push eax
lea eax, [ebp - 0x1c8c]
push eax
lea eax, [ebp - 0x1c94]
push eax
push 0x47ec34
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x56f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x5704]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x5714]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x1c9c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d35b
push 1
call edi
push 1
call ebx
push 8
lea eax, [ebp - 0x1ca4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d376
push 1
call edi
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d3bf
lea ecx, [ebp - 0x1cac]
push ecx
lea ecx, [ebp - 0x1cb4]
push ecx
lea ecx, [ebp - 0x1cbc]
push ecx
lea ecx, [ebp - 0x1cc4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push str.ary13OIA
lea ecx, [ebp - 0x41bc]
call fcn.00401c92
push 0x360b54a3
lea eax, [ebp - 0x41bc]
mov dword [ebp - 4], 0x25
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x41bc]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.1ZuJTPbAMP.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42d430
push eax
call esi
lea eax, [ebp - 0x1ccc]
push eax
lea eax, [ebp - 0x1cd4]
push eax
lea eax, [ebp - 0x1cdc]
push eax
push 0x47ec78
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.Io6CL
lea ecx, [ebp - 0x41d4]
call fcn.00401c92
lea ecx, [ebp - 0x41d4]
call fcn.00409f25
push 0x2ddf379b
push eax
push 0x47ec90
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x41d4]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d4d2
lea ecx, [ebp - 0x1ce4]
push ecx
lea ecx, [ebp - 0x1cec]
push ecx
lea ecx, [ebp - 0x1cf4]
push ecx
lea ecx, [ebp - 0x1cfc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d531
lea ecx, [ebp - 0x1d04]
push ecx
lea ecx, [ebp - 0x1d0c]
push ecx
lea ecx, [ebp - 0x1d14]
push ecx
lea ecx, [ebp - 0x1d1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d57a
lea ecx, [ebp - 0x1d24]
push ecx
lea ecx, [ebp - 0x1d2c]
push ecx
lea ecx, [ebp - 0x1d34]
push ecx
lea ecx, [ebp - 0x1d3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x1d44]
push eax
lea eax, [ebp - 0x1d4c]
push eax
lea eax, [ebp - 0x1d54]
push eax
push 0x47ecb4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x12a4]
mov dword [ebp - 0x12a4], 0x10
push eax
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x5724]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d63a
lea ecx, [ebp - 0x1d5c]
push ecx
lea ecx, [ebp - 0x1d64]
push ecx
lea ecx, [ebp - 0x1d6c]
push ecx
lea ecx, [ebp - 0x1d74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x12a8]
mov dword [ebp - 0x12a8], 0x10
push eax
lea eax, [ebp - 0x970]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.dJZq.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42d67d
push eax
call esi
push 0x47ecd0
lea ecx, [ebp - 0x41ec]
call fcn.00401c92
lea ecx, [ebp - 0x41ec]
call fcn.00409f25
push 0x1ed4e1e0
push eax
push 0x47ecd4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x41ec]
call fcn.004021f4
lea eax, [ebp - 0x1d7c]
push eax
lea eax, [ebp - 0x1d84]
push eax
lea eax, [ebp - 0x1d8c]
push eax
push 0x47ecdc
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.wCq.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42d6fb
push eax
call esi
lea eax, [ebp - 0x1d94]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x5734]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x1d9c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d730
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x1da4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.UlFZ2e.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42d762
push eax
call esi
lea eax, [ebp - 0x1dac]
push eax
lea eax, [ebp - 0x1db4]
push eax
lea eax, [ebp - 0x1dbc]
push eax
push 0x47ed28
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5744]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x16b4]
push 0x47ed44
call fcn.00401c92
cmp dword [ebp - 0x16a0], 0xf
lea eax, [ebp - 0x16b4]
push 0xa321fe6
cmova eax, dword [ebp - 0x16b4]
push eax
push 0x47ed48
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x16b4]
call fcn.004021f4
push 8
lea eax, [ebp - 0x1dc4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d802
push 1
call edi
push 1
call ebx
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.iswCqgohg.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42d83d
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d886
lea ecx, [ebp - 0x1dcc]
push ecx
lea ecx, [ebp - 0x1dd4]
push ecx
lea ecx, [ebp - 0x1ddc]
push ecx
lea ecx, [ebp - 0x1de4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x53cc]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42d8b7
push 1
call edi
push 1
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.4nm68t.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42d8dc
push eax
call esi
push 0x47edcc
lea ecx, [ebp - 0x4204]
call fcn.00401c92
lea ecx, [ebp - 0x4204]
call fcn.00409f25
push 0x34a86fd4
push eax
push 0x47edd8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4204]
call fcn.004021f4
lea eax, [ebp - 0x5754]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x47ede0
lea ecx, [ebp - 0x421c]
call fcn.00401c92
push 0x7527250
lea eax, [ebp - 0x421c]
mov dword [ebp - 4], 0x26
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x421c]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42d9b7
lea ecx, [ebp - 0x1dec]
push ecx
lea ecx, [ebp - 0x1df4]
push ecx
lea ecx, [ebp - 0x1dfc]
push ecx
lea ecx, [ebp - 0x1e04]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42da00
lea ecx, [ebp - 0x1e0c]
push ecx
lea ecx, [ebp - 0x1e14]
push ecx
lea ecx, [ebp - 0x1e1c]
push ecx
lea ecx, [ebp - 0x1e24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42da49
lea ecx, [ebp - 0x1e2c]
push ecx
lea ecx, [ebp - 0x1e34]
push ecx
lea ecx, [ebp - 0x1e3c]
push ecx
lea ecx, [ebp - 0x1e44]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 8
lea eax, [ebp - 0x1e4c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42da64
push 1
call edi
push 1
call ebx
push str.JloOd4qSU0
lea ecx, [ebp - 0x4234]
call fcn.00401c92
push 0x3614d385
lea eax, [ebp - 0x4234]
mov dword [ebp - 4], 0x27
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4234]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.fRvKaSw7W.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42dad5
push eax
call esi
push str.XoJ3m
lea ecx, [ebp - 0x424c]
call fcn.00401c92
push 0x17c922f3
lea eax, [ebp - 0x424c]
mov dword [ebp - 4], 0x28
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x424c]
call fcn.004021f4
lea eax, [ebp - 0x5764]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1e54]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x47ee60
lea ecx, [ebp - 0x4264]
call fcn.00401c92
lea ecx, [ebp - 0x4264]
call fcn.00409f25
push 0x8e87253
push eax
push 0x47ee64
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4264]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.CRDQ.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42db99
push eax
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.T.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42dbbe
push eax
call esi
lea eax, [ebp - 0x12ac]
mov dword [ebp - 0x12ac], 0x10
push eax
lea eax, [ebp - 0x990]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42dc25
lea ecx, [ebp - 0x1e5c]
push ecx
lea ecx, [ebp - 0x1e64]
push ecx
lea ecx, [ebp - 0x1e6c]
push ecx
lea ecx, [ebp - 0x1e74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push str.6DhFxaW
lea ecx, [ebp - 0x427c]
call fcn.00401c92
lea ecx, [ebp - 0x427c]
call fcn.00409f25
push 0x7b95d26
push eax
push 0x47eeb4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x427c]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.PYIGMT47.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42dc83
push eax
call esi
push 8
lea eax, [ebp - 0x1e7c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42dc9e
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x1e84]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42dcf4
lea ecx, [ebp - 0x1e8c]
push ecx
lea ecx, [ebp - 0x1e94]
push ecx
lea ecx, [ebp - 0x1e9c]
push ecx
lea ecx, [ebp - 0x1ea4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.2962.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42dd19
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x42dd62
push 8
lea eax, [ebp - 0x2574]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4305ac
push 1
call edi
push 1
call ebx
push str.XBSWr5sYqp
lea ecx, [ebp - 0x1564]
call fcn.00401c92
cmp dword [ebp - 0x1550], 0xf
lea eax, [ebp - 0x1564]
push 0x29c8c502
cmova eax, dword [ebp - 0x1564]
push eax
push 0x47acbc
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x1564]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.P.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430613
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x43065c
lea ecx, [ebp - 0x257c]
push ecx
lea ecx, [ebp - 0x2584]
push ecx
lea ecx, [ebp - 0x258c]
push ecx
lea ecx, [ebp - 0x2594]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x259c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x47acfc
lea ecx, [ebp - 0x472c]
call fcn.00401c92
push 0x2b53d020
lea eax, [ebp - 0x472c]
mov dword [ebp - 4], 0x48
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x472c]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0x18
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.Ht6J6dks.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430703
push eax
call esi
push str.lGS0nP
lea ecx, [ebp - 0x4744]
call fcn.00401c92
lea ecx, [ebp - 0x4744]
call fcn.00409f25
push 0xd8be7a0
push eax
push 0x47ad34
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4744]
call fcn.004021f4
push str.jDFMBI1
lea ecx, [ebp - 0x475c]
call fcn.00401c92
push 0x24a7e85
lea eax, [ebp - 0x475c]
mov dword [ebp - 4], 0x49
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x475c]
call fcn.004021f4
lea eax, [ebp - 0x5964]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x25a4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x12fc]
mov dword [ebp - 0x12fc], 0x10
push eax
lea eax, [ebp - 0xbf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x430809
lea ecx, [ebp - 0x25ac]
push ecx
lea ecx, [ebp - 0x25b4]
push ecx
lea ecx, [ebp - 0x25bc]
push ecx
lea ecx, [ebp - 0x25c4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x5974]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x5984]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.2t1TlugK25.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43085e
push eax
call esi
push 8
lea eax, [ebp - 0x25cc]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x430879
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x25d4]
push eax
lea eax, [ebp - 0x25dc]
push eax
lea eax, [ebp - 0x25e4]
push eax
push 0x47ad7c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x25ec]
push eax
lea eax, [ebp - 0x25f4]
push eax
lea eax, [ebp - 0x25fc]
push eax
push 0x47ad84
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x2604]
push eax
lea eax, [ebp - 0x260c]
push eax
lea eax, [ebp - 0x2614]
push eax
push 0x47ad94
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47ada0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4308fe
push eax
call esi
push str.so4pK8Miz
lea ecx, [ebp - 0x4774]
call fcn.00401c92
lea ecx, [ebp - 0x4774]
call fcn.00409f25
push 0x10797a87
push eax
push 0x47adc0
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4774]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x430980
lea ecx, [ebp - 0x261c]
push ecx
lea ecx, [ebp - 0x2624]
push ecx
lea ecx, [ebp - 0x262c]
push ecx
lea ecx, [ebp - 0x2634]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 8
lea eax, [ebp - 0x263c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x43099b
push 1
call edi
push 1
call ebx
push 0x47addc
lea ecx, [ebp - 0x478c]
call fcn.00401c92
lea ecx, [ebp - 0x478c]
call fcn.00409f25
push 0xa6b1ba2
push eax
push 0x47ade8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x478c]
call fcn.004021f4
push 8
lea eax, [ebp - 0x2644]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4309ef
push 1
call edi
push 1
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.Mg9h.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430a14
push eax
call esi
lea eax, [ebp - 0x264c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.Gvv6
lea ecx, [ebp - 0x47a4]
call fcn.00401c92
push 0x37f6f0c2
lea eax, [ebp - 0x47a4]
mov dword [ebp - 4], 0x4a
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x47a4]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.0.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430a92
push eax
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0x18
mov dword [ebp - 0x1300], 0x10
lea eax, [ebp - 0x1300]
push eax
lea eax, [ebp - 0xc10]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x5994]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1304]
mov dword [ebp - 0x1304], 0x10
push eax
lea eax, [ebp - 0xc30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x2654]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x265c]
push eax
lea eax, [ebp - 0x2664]
push eax
lea eax, [ebp - 0x266c]
push eax
push 0x47ae4c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.i5flEdlH2z
lea ecx, [ebp - 0x47bc]
call fcn.00401c92
push 0x19ee319d
lea eax, [ebp - 0x47bc]
mov dword [ebp - 4], 0x4b
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x47bc]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x430bc6
lea ecx, [ebp - 0x2674]
push ecx
lea ecx, [ebp - 0x267c]
push ecx
lea ecx, [ebp - 0x2684]
push ecx
lea ecx, [ebp - 0x268c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 8
lea eax, [ebp - 0x2694]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x430be1
push 1
call edi
push 1
call ebx
push str.gjqdc3AVy
lea ecx, [ebp - 0x47d4]
call fcn.00401c92
push 0x1d86c07f
lea eax, [ebp - 0x47d4]
mov dword [ebp - 4], 0x4c
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x47d4]
call fcn.004021f4
lea eax, [ebp - 0x269c]
push eax
lea eax, [ebp - 0x26a4]
push eax
lea eax, [ebp - 0x26ac]
push eax
push 0x47ae94
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x47aea4
lea ecx, [ebp - 0x47ec]
call fcn.00401c92
lea ecx, [ebp - 0x47ec]
call fcn.00409f25
push 0x19609daa
push eax
push 0x47aeb0
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x47ec]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.hB.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430cab
push eax
call esi
push str.I5dKTcGpM
lea ecx, [ebp - 0x4804]
call fcn.00401c92
push 0x199cfaa4
lea eax, [ebp - 0x4804]
mov dword [ebp - 4], 0x4d
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4804]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x430d40
lea ecx, [ebp - 0x26b4]
push ecx
lea ecx, [ebp - 0x26bc]
push ecx
lea ecx, [ebp - 0x26c4]
push ecx
lea ecx, [ebp - 0x26cc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x26d4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x430d96
lea ecx, [ebp - 0x26dc]
push ecx
lea ecx, [ebp - 0x26e4]
push ecx
lea ecx, [ebp - 0x26ec]
push ecx
lea ecx, [ebp - 0x26f4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x1308]
mov dword [ebp - 0x1308], 0x10
push eax
lea eax, [ebp - 0xc50]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.QDq7StO
lea ecx, [ebp - 0x481c]
call fcn.00401c92
push 0x1fb88cce
lea eax, [ebp - 0x481c]
mov dword [ebp - 4], 0x4e
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x481c]
call fcn.004021f4
push 8
lea eax, [ebp - 0x26fc]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x430e1b
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x2704]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x59a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x270c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x430e50
push 1
call edi
push 1
call ebx
push 8
lea eax, [ebp - 0x2714]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x430e6b
push 1
call edi
push 1
call ebx
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x271c]
push eax
lea eax, [ebp - 0x2724]
push eax
lea eax, [ebp - 0x272c]
push eax
push 0x47af38
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.8elxo8rh1z.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430edc
push eax
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47af60
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430f01
push eax
call esi
push 0x47af94
lea ecx, [ebp - 0x4834]
call fcn.00401c92
push 0x10389427
lea eax, [ebp - 0x4834]
mov dword [ebp - 4], 0x4f
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4834]
call fcn.004021f4
lea eax, [ebp - 0x59b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x2734]
push eax
lea eax, [ebp - 0x273c]
push eax
lea eax, [ebp - 0x2744]
push eax
push 0x47af98
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x274c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x430f95
push 1
call edi
push 1
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47afa8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430fba
push eax
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x59c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x59d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x2754]
push eax
lea eax, [ebp - 0x275c]
push eax
lea eax, [ebp - 0x2764]
push eax
push 0x47afc8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x130c]
mov dword [ebp - 0x130c], 0x10
push eax
lea eax, [ebp - 0xc70]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.r7LkHV
lea ecx, [ebp - 0x484c]
call fcn.00401c92
lea ecx, [ebp - 0x484c]
call fcn.00409f25
push 0x166ce876
push eax
push 0x47afd8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x484c]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47afe4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x431086
push eax
call esi
push str.KATM
lea ecx, [ebp - 0x4864]
call fcn.00401c92
push 0x26fdf239
lea eax, [ebp - 0x4864]
mov dword [ebp - 4], 0x50
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4864]
call fcn.004021f4
lea eax, [ebp - 0x276c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x2774]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x431135
lea ecx, [ebp - 0x277c]
push ecx
lea ecx, [ebp - 0x2784]
push ecx
lea ecx, [ebp - 0x278c]
push ecx
lea ecx, [ebp - 0x2794]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.jmMLd81W68.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43115a
push eax
call esi
lea eax, [ebp - 0x279c]
push eax
lea eax, [ebp - 0x27a4]
push eax
lea eax, [ebp - 0x27ac]
push eax
push 0x47b068
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x1310]
mov dword [ebp - 0x1310], 0x10
push eax
lea eax, [ebp - 0xc90]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x27b4]
push eax
lea eax, [ebp - 0x27bc]
push eax
lea eax, [ebp - 0x27c4]
push eax
push 0x47b074
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x27cc]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4311d3
push 1
call edi
push 1
call ebx
push 8
lea eax, [ebp - 0x27d4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4311ee
push 1
call edi
push 1
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.hMh.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x431213
push eax
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x487c]
push str.bkPmLK9EL
call fcn.00401c92
lea ecx, [ebp - 0x487c]
call fcn.00409f25
push 0x35b58c49
push eax
push 0x47b0c8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x487c]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x4312ab
lea ecx, [ebp - 0x27dc]
push ecx
lea ecx, [ebp - 0x27e4]
push ecx
lea ecx, [ebp - 0x27ec]
push ecx
lea ecx, [ebp - 0x27f4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x47b0e8
lea ecx, [ebp - 0x4894]
call fcn.00401c92
lea ecx, [ebp - 0x4894]
call fcn.00409f25
push 0x1866e91e
push eax
push 0x47b0ec
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4894]
call fcn.004021f4
lea eax, [ebp - 0x59e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x27fc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x2804]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x431354
lea ecx, [ebp - 0x280c]
push ecx
lea ecx, [ebp - 0x2814]
push ecx
lea ecx, [ebp - 0x281c]
push ecx
lea ecx, [ebp - 0x2824]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x282c]
push eax
lea eax, [ebp - 0x2834]
push eax
lea eax, [ebp - 0x283c]
push eax
push 0x47b10c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x59f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x2844]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x43139c
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x5a04]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x5a14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.xaGTqOz5ZM.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4313db
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x431424
lea ecx, [ebp - 0x284c]
push ecx
lea ecx, [ebp - 0x2854]
push ecx
lea ecx, [ebp - 0x285c]
push ecx
lea ecx, [ebp - 0x2864]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push str.wByr8s1Lm
lea ecx, [ebp - 0x48ac]
call fcn.00401c92
lea ecx, [ebp - 0x48ac]
call fcn.00409f25
push 0x2274f313
push eax
push 0x47b174
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x48ac]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x4314a6
lea ecx, [ebp - 0x286c]
push ecx
lea ecx, [ebp - 0x2874]
push ecx
lea ecx, [ebp - 0x287c]
push ecx
lea ecx, [ebp - 0x2884]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x5a24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x5a34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x288c]
push eax
lea eax, [ebp - 0x2894]
push eax
lea eax, [ebp - 0x289c]
push eax
push 0x47b184
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x28a4]
push eax
lea eax, [ebp - 0x28ac]
push eax
lea eax, [ebp - 0x28b4]
push eax
push 0x47b18c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5a44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x47b198
lea ecx, [ebp - 0x48c4]
call fcn.00401c92
push 0x32a781bf
lea eax, [ebp - 0x48c4]
mov dword [ebp - 4], 0x51
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48c4]
call fcn.004021f4
lea eax, [ebp - 0x1314]
mov dword [ebp - 0x1314], 0x10
push eax
lea eax, [ebp - 0xcb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x28bc]
push eax
lea eax, [ebp - 0x28c4]
push eax
lea eax, [ebp - 0x28cc]
push eax
push 0x47b1a4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x4315e0
lea ecx, [ebp - 0x28d4]
push ecx
lea ecx, [ebp - 0x28dc]
push ecx
lea ecx, [ebp - 0x28e4]
push ecx
lea ecx, [ebp - 0x28ec]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.u2N9zt.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43161b
push eax
call esi
lea eax, [ebp - 0x1318]
mov dword [ebp - 0x1318], 0x10
push eax
lea eax, [ebp - 0xcd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x131c]
mov dword [ebp - 0x131c], 0x10
push eax
lea eax, [ebp - 0xcf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x28f4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x28fc]
push eax
lea eax, [ebp - 0x2904]
push eax
lea eax, [ebp - 0x290c]
push eax
push 0x47b1e8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x4316cd
lea ecx, [ebp - 0x2914]
push ecx
lea ecx, [ebp - 0x291c]
push ecx
lea ecx, [ebp - 0x2924]
push ecx
lea ecx, [ebp - 0x292c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push str.bfqqu
lea ecx, [ebp - 0x48dc]
call fcn.00401c92
push 0x27c0c9e7
lea eax, [ebp - 0x48dc]
mov dword [ebp - 4], 0x52
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48dc]
call fcn.004021f4
push 8
lea eax, [ebp - 0x2934]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x431734
push 1
call edi
push 1
call ebx
push 0x47b210
lea ecx, [ebp - 0x154c]
call fcn.00401c92
cmp dword [ebp - 0x1538], 0xf
lea eax, [ebp - 0x154c]
push 0x3b7f794f
cmova eax, dword [ebp - 0x154c]
push eax
push 0x47b214
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x154c]
call fcn.004021f4
lea eax, [ebp - 0x5a54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x5a64]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x5a74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.ZgZzZEM1
lea ecx, [ebp - 0x1534]
call fcn.00401c92
cmp dword [ebp - 0x1520], 0xf
lea eax, [ebp - 0x1534]
push 0x83e22dc
cmova eax, dword [ebp - 0x1534]
push eax
push 0x47b228
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x1534]
call fcn.004021f4
push str.79SIidIQXC
lea ecx, [ebp - 0x151c]
call fcn.00401c92
cmp dword [ebp - 0x1508], 0xf
lea eax, [ebp - 0x151c]
push 0x11577b16
cmova eax, dword [ebp - 0x151c]
push eax
push 0x47b248
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x151c]
call fcn.004021f4
lea eax, [ebp - 0x293c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.ysTz0VBgYJ
lea ecx, [ebp - 0x1504]
call fcn.00401c92
cmp dword [ebp - 0x14f0], 0xf
lea eax, [ebp - 0x1504]
push 0x27ff95d7
cmova eax, dword [ebp - 0x1504]
push eax
push 0x47b268
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x1504]
call fcn.004021f4
lea eax, [ebp - 0x5a84]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
push 0
lea eax, [ebp - 0x410]
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0x30
lea ecx, [ebp - 0x15f4]
push str.VvDTrWKKmB
call fcn.00401c92
cmp dword [ebp - 0x15e0], 0xf
lea eax, [ebp - 0x15f4]
push 0x3954864d
cmova eax, dword [ebp - 0x15f4]
push eax
push 0x47b288
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x15f4]
call fcn.004021f4
lea eax, [ebp - 0x2944]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x431964
lea ecx, [ebp - 0x294c]
push ecx
lea ecx, [ebp - 0x2954]
push ecx
lea ecx, [ebp - 0x295c]
push ecx
lea ecx, [ebp - 0x2964]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x1320]
mov dword [ebp - 0x1320], 0x10
push eax
lea eax, [ebp - 0xd10]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x296c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x43199d
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x2974]
push eax
lea eax, [ebp - 0x297c]
push eax
lea eax, [ebp - 0x2984]
push eax
push 0x47b2a0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x47b2a8
lea ecx, [ebp - 0x48f4]
call fcn.00401c92
push 0x122c4ba8
lea eax, [ebp - 0x48f4]
mov dword [ebp - 4], 0x53
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x48f4]
call fcn.004021f4
lea eax, [ebp - 0x1324]
mov dword [ebp - 0x1324], 0x10
push eax
lea eax, [ebp - 0xd30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x298c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.wPBQLUY
lea ecx, [ebp - 0x490c]
call fcn.00401c92
push 0x2bd717ef
lea eax, [ebp - 0x490c]
mov dword [ebp - 4], 0x54
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x490c]
call fcn.004021f4
push str.tyclKPn
lea ecx, [ebp - 0x16fc]
call fcn.00401c92
cmp dword [ebp - 0x16e8], 0xf
lea eax, [ebp - 0x16fc]
push 0xbaa90e
cmova eax, dword [ebp - 0x16fc]
push eax
push 0x47b2d4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x16fc]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.G.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x431ae7
push eax
call esi
push 8
lea eax, [ebp - 0x2994]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x431b02
push 1
call edi
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x431b4b
lea ecx, [ebp - 0x299c]
push ecx
lea ecx, [ebp - 0x29a4]
push ecx
lea ecx, [ebp - 0x29ac]
push ecx
lea ecx, [ebp - 0x29b4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 8
lea eax, [ebp - 0x29bc]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x431b66
push 1
call edi
push 1
call ebx
push 8
lea eax, [ebp - 0x29c4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x431b81
push 1
call edi
push 1
call ebx
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0x18
lea eax, [ebp - 0x5a94]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x29cc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x29d4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x431bdf
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x5aa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.VHe.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x431c27
push eax
call esi
push str.cv28g
lea ecx, [ebp - 0x1714]
call fcn.00401c92
cmp dword [ebp - 0x1700], 0xf
lea eax, [ebp - 0x1714]
push 0x11cc8523
cmova eax, dword [ebp - 0x1714]
push eax
push 0x47b34c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x1714]
call fcn.004021f4
lea eax, [ebp - 0x29dc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.ey5lZ
lea ecx, [ebp - 0x172c]
call fcn.00401c92
cmp dword [ebp - 0x1718], 0xf
lea eax, [ebp - 0x172c]
push 0x20cf3dde
cmova eax, dword [ebp - 0x172c]
push eax
push 0x47b35c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x172c]
call fcn.004021f4
lea eax, [ebp - 0x29e4]
push eax
lea eax, [ebp - 0x29ec]
push eax
lea eax, [ebp - 0x29f4]
push eax
push 0x47b37c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.tWNCJq
lea ecx, [ebp - 0x1744]
call fcn.00401c92
cmp dword [ebp - 0x1730], 0xf
lea eax, [ebp - 0x1744]
push 0x1b8811af
cmova eax, dword [ebp - 0x1744]
push eax
push 0x47b38c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x1744]
call fcn.004021f4
push str.lsQYtxUg
lea ecx, [ebp - 0x4924]
call fcn.00401c92
push 0x26d40a6a
lea eax, [ebp - 0x4924]
mov dword [ebp - 4], 0x55
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4924]
call fcn.004021f4
push 0x47b3b8
lea ecx, [ebp - 0x1654]
call fcn.00401c92
cmp dword [ebp - 0x1640], 0xf
lea eax, [ebp - 0x1654]
push 0x67761d6
cmova eax, dword [ebp - 0x1654]
push eax
push 0x47b3c4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x1654]
call fcn.004021f4
mov eax, dword [0x48f084]
test eax, eax
je 0x431db8
push eax
call fcn.004441a3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x431e01
lea ecx, [ebp - 0x29fc]
push ecx
lea ecx, [ebp - 0x2a04]
push ecx
lea ecx, [ebp - 0x2a0c]
push ecx
lea ecx, [ebp - 0x2a14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push str.ztGYd0W4
lea ecx, [ebp - 0x493c]
call fcn.00401c92
push 0x11eb9ece
lea eax, [ebp - 0x493c]
mov dword [ebp - 4], 0x56
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x493c]
call fcn.004021f4
lea eax, [ebp - 0x5ab4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x2a1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x2a24]
push eax
lea eax, [ebp - 0x2a2c]
push eax
lea eax, [ebp - 0x2a34]
push eax
push 0x47b3e8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.lNBQFbA
lea ecx, [ebp - 0x4954]
call fcn.00401c92
push 0x299ba626
lea eax, [ebp - 0x4954]
mov dword [ebp - 4], 0x57
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4954]
call fcn.004021f4
push 8
lea eax, [ebp - 0x2a3c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x431eee
push 1
call edi
push 1
call ebx
push 8
lea eax, [ebp - 0x2a44]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x431f09
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x1328]
mov dword [ebp - 0x1328], 0x10
push eax
lea eax, [ebp - 0xd50]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x2a4c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x2a54]
push eax
lea eax, [ebp - 0x2a5c]
push eax
lea eax, [ebp - 0x2a64]
push eax
push 0x47b410
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x2a6c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.X33Vbz.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x431f86
push eax
call esi
push str.01hndE
lea ecx, [ebp - 0x496c]
call fcn.00401c92
push 0x3334b27c
lea eax, [ebp - 0x496c]
mov dword [ebp - 4], 0x58
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x496c]
call fcn.004021f4
lea eax, [ebp - 0x2a74]
push eax
lea eax, [ebp - 0x2a7c]
push eax
lea eax, [ebp - 0x2a84]
push eax
push 0x47b438
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x43203b
lea ecx, [ebp - 0x2a8c]
push ecx
lea ecx, [ebp - 0x2a94]
push ecx
lea ecx, [ebp - 0x2a9c]
push ecx
lea ecx, [ebp - 0x2aa4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x132c]
mov dword [ebp - 0x132c], 0x10
push eax
lea eax, [ebp - 0xd70]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.5vIUVckP
lea ecx, [ebp - 0x1384]
call fcn.00401c92
cmp dword [ebp - 0x1370], 0xf
lea eax, [ebp - 0x1384]
push 0xcf7ea55
cmova eax, dword [ebp - 0x1384]
push eax
push 0x47b44c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x1384]
call fcn.004021f4
lea eax, [ebp - 0x2aac]
push eax
lea eax, [ebp - 0x2ab4]
push eax
lea eax, [ebp - 0x2abc]
push eax
push 0x47b454
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5ac4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1330]
mov dword [ebp - 0x1330], 0x10
push eax
lea eax, [ebp - 0xd90]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x2ac4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.YsYaY0EX
lea ecx, [ebp - 0x4984]
call fcn.00401c92
push 0x1908731a
lea eax, [ebp - 0x4984]
mov dword [ebp - 4], 0x59
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4984]
call fcn.004021f4
push str.syebolH2FY
lea ecx, [ebp - 0x499c]
call fcn.00401c92
push 0x9e7a666
lea eax, [ebp - 0x499c]
mov dword [ebp - 4], 0x5a
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x499c]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x4321d4
lea ecx, [ebp - 0x2acc]
push ecx
lea ecx, [ebp - 0x2ad4]
push ecx
lea ecx, [ebp - 0x2adc]
push ecx
lea ecx, [ebp - 0x2ae4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x1334]
mov dword [ebp - 0x1334], 0x10
push eax
lea eax, [ebp - 0xdb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x2aec]
push eax
lea eax, [ebp - 0x2af4]
push eax
lea eax, [ebp - 0x2afc]
push eax
push 0x47b474
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x2b04]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x43222d
push 1
call edi
push 1
call ebx
push 8
lea eax, [ebp - 0x2b0c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x432248
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x5ad4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x47b47c
lea ecx, [ebp - 0x49b4]
call fcn.00401c92
push 0x15970817
lea eax, [ebp - 0x49b4]
mov dword [ebp - 4], 0x5b
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x49b4]
call fcn.004021f4
lea eax, [ebp - 0x2b14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47b480
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4322e9
push eax
call esi
push str.v5rpMX39En
lea ecx, [ebp - 0x49cc]
call fcn.00401c92
push 0x7442cf1
lea eax, [ebp - 0x49cc]
mov dword [ebp - 4], 0x5c
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x49cc]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x43237e
lea ecx, [ebp - 0x2b1c]
push ecx
lea ecx, [ebp - 0x2b24]
push ecx
lea ecx, [ebp - 0x2b2c]
push ecx
lea ecx, [ebp - 0x2b34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
lea eax, [ebp - 0x5ae4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x2b3c]
push eax
lea eax, [ebp - 0x2b44]
push eax
lea eax, [ebp - 0x2b4c]
push eax
push 0x47b4ac
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.C.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4323e6
push eax
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x139c]
push str.GSTlAknLtx
call fcn.00401c92
cmp dword [ebp - 0x1388], 0xf
lea eax, [ebp - 0x139c]
push 0x15abd939
cmova eax, dword [ebp - 0x139c]
push eax
push 0x47b4cc
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x139c]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x2b54]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x43246f
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x2b5c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.q4mCGwPo
lea ecx, [ebp - 0x49e4]
call fcn.00401c92
push 0x28bf7912
lea eax, [ebp - 0x49e4]
mov dword [ebp - 4], 0x5d
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x49e4]
call fcn.004021f4
lea eax, [ebp - 0x5af4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.RYGCWiQ.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4324fa
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x432543
lea ecx, [ebp - 0x2b64]
push ecx
lea ecx, [ebp - 0x2b6c]
push ecx
lea ecx, [ebp - 0x2b74]
push ecx
lea ecx, [ebp - 0x2b7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x43258c
lea ecx, [ebp - 0x2b84]
push ecx
lea ecx, [ebp - 0x2b8c]
push ecx
lea ecx, [ebp - 0x2b94]
push ecx
lea ecx, [ebp - 0x2b9c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 8
lea eax, [ebp - 0x2ba4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4325a7
push 1
call edi
push 1
call ebx
push 0x47b4f8
lea ecx, [ebp - 0x49fc]
call fcn.00401c92
push 0xe7a365d
lea eax, [ebp - 0x49fc]
mov dword [ebp - 4], 0x5e
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x49fc]
call fcn.004021f4
push 8
lea eax, [ebp - 0x2bac]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x43260e
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x2bb4]
push eax
lea eax, [ebp - 0x2bbc]
push eax
lea eax, [ebp - 0x2bc4]
push eax
push 0x47b4fc
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x2bcc]
push eax
lea eax, [ebp - 0x2bd4]
push eax
lea eax, [ebp - 0x2bdc]
push eax
push 0x47b504
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x432697
lea ecx, [ebp - 0x2be4]
push ecx
lea ecx, [ebp - 0x2bec]
push ecx
lea ecx, [ebp - 0x2bf4]
push ecx
lea ecx, [ebp - 0x2bfc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 8
lea eax, [ebp - 0x2c04]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4326b2
push 1
call edi
push 1
call ebx
push 0x47b50c
lea ecx, [ebp - 0x4a14]
call fcn.00401c92
push 0x1b44259b
lea eax, [ebp - 0x4a14]
mov dword [ebp - 4], 0x5f
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4a14]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0x24
lea eax, [ebp - 0x2c0c]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x432755
push 1
call edi
push 1
call ebx
push str.C7I5
lea ecx, [ebp - 0x13b4]
call fcn.00401c92
cmp dword [ebp - 0x13a0], 0xf
lea eax, [ebp - 0x13b4]
push 0x2dab069e
cmova eax, dword [ebp - 0x13b4]
push eax
push 0x47b518
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x13b4]
call fcn.004021f4
lea eax, [ebp - 0x1338]
mov dword [ebp - 0x1338], 0x10
push eax
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x47b520
lea ecx, [ebp - 0x13cc]
call fcn.00401c92
cmp dword [ebp - 0x13b8], 0xf
lea eax, [ebp - 0x13cc]
push 0xdd4979e
cmova eax, dword [ebp - 0x13cc]
push eax
push 0x47b524
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x13cc]
call fcn.004021f4
push str.ncUP
lea ecx, [ebp - 0x13e4]
call fcn.00401c92
cmp dword [ebp - 0x13d0], 0xf
lea eax, [ebp - 0x13e4]
push 0xa8a45d8
cmova eax, dword [ebp - 0x13e4]
push eax
push 0x47b534
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x13e4]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x2c14]
push eax
lea eax, [ebp - 0x2c1c]
push eax
lea eax, [ebp - 0x2c24]
push eax
push 0x47b53c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x5b04]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x4a2c]
push str.1gHsHgI
call fcn.00401c92
lea ecx, [ebp - 0x4a2c]
call fcn.00409f25
push 0x2c42c536
push eax
push 0x47b54c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4a2c]
call fcn.004021f4
push str.OJZq8I
lea ecx, [ebp - 0x4a44]
call fcn.00401c92
lea ecx, [ebp - 0x4a44]
call fcn.00409f25
push 0xa719e4b
push eax
push 0x47b55c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4a44]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x2c2c]
push eax
lea eax, [ebp - 0x2c34]
push eax
lea eax, [ebp - 0x2c3c]
push eax
push 0x47b564
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x432983
lea ecx, [ebp - 0x2c44]
push ecx
lea ecx, [ebp - 0x2c4c]
push ecx
lea ecx, [ebp - 0x2c54]
push ecx
lea ecx, [ebp - 0x2c5c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x4a5c]
push str.XCzqra
call fcn.00401c92
lea ecx, [ebp - 0x4a5c]
call fcn.00409f25
push 0x517a278
push eax
push 0x47b574
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4a5c]
call fcn.004021f4
lea eax, [ebp - 0x2c64]
push eax
lea eax, [ebp - 0x2c6c]
push eax
lea eax, [ebp - 0x2c74]
push eax
push 0x47b57c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x2c7c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x432a0d
push 1
call edi
push 1
call ebx
push str.h4SV
lea ecx, [ebp - 0x4a74]
call fcn.00401c92
push 0x1fb753a2
lea eax, [ebp - 0x4a74]
mov dword [ebp - 4], 0x60
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4a74]
call fcn.004021f4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.FQvVcKW.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x432a7e
push eax
call esi
lea eax, [ebp - 0x133c]
mov dword [ebp - 0x133c], 0x10
push eax
lea eax, [ebp - 0xdd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x47b5a4
lea ecx, [ebp - 0x4a8c]
call fcn.00401c92
push 0x4845ef2
lea eax, [ebp - 0x4a8c]
mov dword [ebp - 4], 0x61
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4a8c]
call fcn.004021f4
push 8
lea eax, [ebp - 0x2c84]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x432b03
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x1340]
mov dword [ebp - 0x1340], 0x10
push eax
lea eax, [ebp - 0xdf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47b5a8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x432b46
push eax
call esi
push str.CBSvKby
lea ecx, [ebp - 0x4aa4]
call fcn.00401c92
push 0x3ac48b1a
lea eax, [ebp - 0x4aa4]
mov dword [ebp - 4], 0x62
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x4aa4]
call fcn.004021f4
push 0x47b5c4
lea ecx, [ebp - 0x4abc]
call fcn.00401c92
lea ecx, [ebp - 0x4abc]
call fcn.00409f25
push 0x361d049e
push eax
push 0x47b5c8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4abc]
call fcn.004021f4
push 8
lea eax, [ebp - 0x2c8c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x432be6
push 1
call edi
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x432c2f
lea ecx, [ebp - 0x2c94]
push ecx
lea ecx, [ebp - 0x2c9c]
push ecx
lea ecx, [ebp - 0x2ca4]
push ecx
lea ecx, [ebp - 0x2cac]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c88], eax
test eax, eax
je 0x432c8e
lea ecx, [ebp - 0x2cb4]
push ecx
lea ecx, [ebp - 0x2cbc]
push ecx
lea ecx, [ebp - 0x2cc4]
push ecx
lea ecx, [ebp - 0x2ccc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x5c88]
call esi
push str.eUJss
lea ecx, [ebp - 0x4ad4]
call fcn.00401c92
lea ecx, [ebp - 0x4ad4]
call fcn.00409f25
push 0x238eb3ab
push eax
push 0x47b5d8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4ad4]
call fcn.004021f4
lea eax, [ebp - 0x1344]
mov dword [ebp - 0x1344], 0x10
push eax
lea eax, [ebp - 0xe10]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.UQNJve5Q
lea ecx, [ebp - 0x4aec]
call fcn.00401c92
lea ecx, [ebp - 0x4aec]
call fcn.00409f25
push 0x2c5cc77e
push eax
push 0x47b5ec
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4aec]
call fcn.004021f4
lea eax, [ebp - 0x2cd4]
push eax
lea eax, [ebp - 0x2cdc]
push eax
lea eax, [ebp - 0x2ce4]
push eax
push 0x47b5f4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x47b5fc
lea ecx, [ebp - 0x4b04]
call fcn.00401c92
lea ecx, [ebp - 0x4b04]
call fcn.00409f25
push 0x308f1173
push eax
push 0x47b600
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x4b04]
call fcn.004021f4
lea eax, [ebp - 0x1348]
mov dword [ebp - 0x1348], 0x10
push eax
lea eax, [ebp - 0xe30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.edtgIHZM7G.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x432dba