Function at 0x423c0f
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push 0x47c
mov eax, 0x45a963
call fcn.00438b84
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x488], eax
inc eax
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00438cbb
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x440]
pop ecx
push eax
call ebx
mov edi, 0x400
lea eax, [ebp - 0x430]
push edi
xor esi, esi
push esi
push eax
call fcn.00439fe0
push edi
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.00439fe0
add esp, 0x18
mov dword [ebp - 0x44c], 0x10
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.3k8qdrWK
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x154ed294
lea eax, [ebp - 0x28]
mov dword [ebp - 4], esi
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x440]
push eax
call ebx
push str.Vede
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x19af7f48
cmova eax, dword [ebp - 0x448]
push eax
push 0x478634
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test edi, edi
je 0x423d5e
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x460]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x44c]
push 0x10
pop edi
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x44c], edi
push eax
call ebx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x44c], edi
push eax
lea eax, [ebp - 0x30]
push eax
call ebx
push str.ZZNWh
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x2bcc5b69
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x478644
call ebx
push str.we1OfQ
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x16ce93e6
cmova eax, dword [ebp - 0x448]
push eax
push 0x478654
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x47865c
call ebx
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov edi, dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ebx, dword [sym.imp.WINMM.dll_timeEndPeriod]
test eax, eax
jne 0x423ea7
push 1
call edi
push 1
call ebx
push str.J6yXteK
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x3367d3e5
cmova eax, dword [ebp - 0x448]
push eax
push 0x47866c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0x18
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.9Ftj33hv8.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x423f39
push eax
call esi
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x478690
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x423f74
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x478698
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x4786a0
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x53033a0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push str.IEw4rWba79
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 3
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push 0x1dfb9b4c
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 8
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x424034
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.nXGbF
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x221e260f
cmova eax, dword [ebp - 0x448]
push eax
push 0x4786b8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 0x4786c0
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x13c04e27
cmova eax, dword [ebp - 0x448]
push eax
push 0x4786c4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push str.OUCoeFtM9B
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x11ac7252
cmova eax, dword [ebp - 0x448]
push eax
push 0x4786d8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.HGN5.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42412e
push eax
call esi
push 0x4786f4
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0xca5656f
cmova eax, dword [ebp - 0x448]
push eax
push 0x4786f8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 8
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42418b
push 1
call edi
push 1
call ebx
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x478700
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x478708
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.SUltsFeC
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x115176dd
cmova eax, dword [ebp - 0x448]
push eax
push 0x47871c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 8
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42423e
push 1
call edi
push 1
call ebx
push str.SOzKWAv
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x739b93f
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x47872c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x4242ea
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [ebp - 0x438]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
push 0x478734
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x1cfb4749
cmova eax, dword [ebp - 0x448]
push eax
push 0x478738
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.y8Uh
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x1f83d6fa
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 5
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push str.NIGpMKS0
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0xa5f5e1e
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 6
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4243e7
push 1
call edi
push 1
call ebx
push str.LvPzU
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x36804aaa
cmova eax, dword [ebp - 0x448]
push eax
push 0x47875c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478764
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.SsrchOdc73.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x424470
push eax
call esi
push str.hPKUO
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x302c097c
cmova eax, dword [ebp - 0x448]
push eax
push 0x478794
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x448]
push str.VtlLdZaPB
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0xbfa4e3e
cmova eax, dword [ebp - 0x448]
push eax
push 0x4787a8
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.HwJX.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x424531
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x42457a
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4787c4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4245c2
push 1
call edi
push 1
call ebx
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.n.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4245e9
push eax
call esi
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x28]
push str.p3gK9Xz
call fcn.00401c92
push 0xda56852
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 7
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.Znb9.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x424669
push eax
call esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4787f4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x4246d2
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4787fc
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x478804
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x6c4dbea
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 8
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x424798
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4247b3
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4247db
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478808
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x424823
push 1
call edi
push 1
call ebx
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42483e
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.zhF.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x424872
push eax
call esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478820
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x4248db
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x424924
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478828
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.4e47QcJ
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x9883d90
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 9
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.yJGlWadlqi.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4249eb
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x424a34
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x424a7d
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x478858
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x25867c78
cmova eax, dword [ebp - 0x448]
push eax
push 0x47885c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x424afd
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478864
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.KuI7d77
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x33ac0f45
cmova eax, dword [ebp - 0x448]
push eax
push 0x478874
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x47887c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478884
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.rGTMnp
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x39613ffd
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xa
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x424bfd
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478894
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x47889c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.vApfuTUK
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x270e5853
cmova eax, dword [ebp - 0x448]
push eax
push 0x4788b0
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x424cca
push 1
call edi
push 1
call ebx
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.3bI693B9D.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x424cf1
push eax
call esi
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x44c], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4788d4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x44c], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x424d85
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x424dad
push 1
call edi
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x424df6
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.F.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x424e1d
push eax
call esi
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x44c], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4788e8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4788f0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4788f8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x424f11
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x424f5a
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.cUjN.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x424f81
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x424fca
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x478914
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x3d87d19
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xb
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478918
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.7VNX.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42506e
push eax
call esi
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.3IPt
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x1912d30b
cmova eax, dword [ebp - 0x448]
push eax
push 0x47893c
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.jTaaANTDN
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x1246ac89
cmova eax, dword [ebp - 0x448]
push eax
push 0x478950
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
push str.Xijlddmy
lea ecx, [ebp - 0x448]
call fcn.00401c92
cmp dword [ebp - 0x434], 0xf
lea eax, [ebp - 0x448]
push 0x258b8009
cmova eax, dword [ebp - 0x448]
push eax
push 0x478964
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x448]
call fcn.004021f4
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x47896c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42519f
push 1
call edi
push 1
call ebx
push str.i76sf
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x2b6c4d79
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xc
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4251fd
push 1
call edi
push 1
call ebx
push 0x47897c
lea ecx, [ebp - 0x28]
call fcn.00401c92
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x323df28c
cmova eax, dword [ebp - 0x28]
push eax
push 0x478980
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x478988
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x42526b
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00439fe0
add esp, 0xc
lea ecx, [ebp - 0x28]
push str.4mXQ
call fcn.00401c92
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x7c4cbe6
cmova eax, dword [ebp - 0x28]
push eax
push 0x478998
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 0x4789a0
lea ecx, [ebp - 0x28]
call fcn.00401c92
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1de4095c
cmova eax, dword [ebp - 0x28]
push eax
push 0x4789a4
call fcn.0041cd83
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004021f4
push 0
push 0x80
push 3
pop eax
push eax
push 0
push 1
push 0x80000000
push str.gOddgeLyH.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42531b
push eax
call esi
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x425343
push 1
call edi
push 1
call ebx
push str.FeR2GyjOY
lea ecx, [ebp - 0x28]
call fcn.00401c92
push 0x2cfe2c4f
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xd
push eax
push 0x490d20
call fcn.00408802
pop ecx
pop ecx
mov ecx, eax
call fcn.004095dc
push eax
call fcn.00408ee3
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004021f4
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x44c], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 8
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x4253b8
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4789d4
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x425421
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x44c]
call esi
mov esi, dword [sym.imp.WINMM.dll_timeGetDevCaps]
lea eax, [ebp - 0x438]
push 8
push eax
call esi
test eax, eax
jne 0x42543e
push 1
call edi
push 1
call ebx
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 8
lea eax, [ebp - 0x478]
push eax
call esi
test eax, eax
jne 0x42546f
push 1
call edi
push 1
call ebx
mov ebx, dword [ebp - 0x488]
xor esi, esi
mov edi, dword [ebp - 0x484]
test ebx, ebx
je 0x4254b9
call fcn.00444182
push 3
cdq
pop ecx
idiv ecx
sub edx, 0
je 0x4254ad
sub edx, 1
je 0x4254a4
sub edx, 1
jne 0x4254b4
mov dword [edi + esi*4], 0x4224c0
jmp 0x4254b4
mov dword [edi + esi*4], 0x42248f
jmp 0x4254b4
mov dword [edi + esi*4], 0x422453
inc esi
cmp esi, ebx
jb 0x425481
mov eax, edi
call fcn.00438b33
ret