Function at 0x100095a5
Capabilities:
Check for unmoving mouse cursor
Contain obfuscated stackstrings
Get disk size
Get hostname

Disassembly:
push 0x7e8
mov eax, 0x1003ced6
call fcn.1001d244
mov dword [ebp - 0x7ec], ecx
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0x7e4], eax
mov dword [ebp - 0x434], eax
push 8
lea eax, [ebp - 0x45c]
mov dword [ebp - 4], ebx
push eax
mov byte [ecx + 0x58], 1
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov edi, dword [sym.imp.WINMM.dll_timeBeginPeriod]
test eax, eax
jne 0x100095f6
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.x7DC
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x1c87ce5b
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push ebx
push eax
call fcn.1001e5b0
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x434]
add esp, 0xc
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push str.ZLk3gDcw4
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x217a5e9f
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.A.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x10009702
push eax
call ebx
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
mov dword [ebp - 0x434], 0x10
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x10009785
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0x49c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call ebx
mov ecx, dword [ebp + 8]
call fcn.100073ad
cmp al, 0x21
jne 0x10009f0a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x46c]
push 2
push eax
call fcn.10007581
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 1
push ecx
mov ecx, dword [eax]
call fcn.1000764d
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x100097cb
call fcn.10001270
xorps xmm0, xmm0
lea ecx, [ebp - 0x474]
movlpd qword [ebp - 0x474], xmm0
call fcn.100066b3
lea eax, [ebp - 0x434]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x434], 0x10
push eax
call esi
mov esi, 0x400
lea eax, [ebp - 0x430]
push esi
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.Z6UfG2DB
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x187b441a
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.g5.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10009887
push eax
call ebx
push esi
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100098d5
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x49c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push esi
call ebx
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.poBDF8JoN4.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10009910
push eax
call ebx
push 8
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000992f
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.5og1Z
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0xd10f838
cmova eax, dword [ebp - 0x454]
mov esi, str._s:__d
push eax
push esi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
cmp byte [0x1005285c], 0
je 0x10009b08
push 0x50
xorps xmm0, xmm0
pop edi
push edi
movlpd qword [ebp - 0x464], xmm0
call fcn.1001c8f6
push edi
mov esi, eax
push 0
push esi
mov dword [ebp - 0x43c], esi
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 0x12
call fcn.10006eec
push eax
lea ecx, [ebp - 0x464]
call fcn.100014e7
push edi
mov byte [ebp - 4], 3
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push edi
push 0
push esi
mov byte [ebp - 4], 4
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 1
push 0x10047254
push 1
call fcn.10006f1e
push ecx
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push eax
call fcn.100014e7
mov ecx, dword [ebp - 0x464]
call fcn.10007868
cmp dword [0x1005288c], 0
je 0x10009a65
push edi
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push edi
push 0
push esi
mov byte [ebp - 4], 5
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 0x10
push dword [0x1005288c]
push 2
call fcn.10006f1e
push ecx
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push eax
call fcn.100014e7
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push edi
call fcn.1001c8f6
mov edi, eax
mov dword [ebp - 0x43c], edi
push 0x50
push 0
push edi
mov byte [ebp - 4], 6
call fcn.1001e5b0
pop ecx
pop ecx
mov esi, esp
lea eax, [ebp - 0x474]
push ecx
push ecx
mov ecx, esp
push eax
call fcn.100014c2
push esi
call fcn.10016618
push 0x10
mov ecx, edi
call fcn.1000710b
push ecx
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push eax
call fcn.100014e7
mov ecx, dword [ebp - 0x464]
call fcn.10007868
mov ecx, dword [ebp - 0x464]
lea eax, [ebp - 0x46c]
push eax
call fcn.100078ed
push eax
lea ecx, [ebp - 0x474]
call fcn.10001fa1
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x10009aea
call fcn.10001270
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x460]
test ecx, ecx
je 0x10009afd
call fcn.10001270
mov edi, dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov esi, str._s:__d
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x10009b34
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.pOSGA8
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x2ef1bbcd
cmova eax, dword [ebp - 0x454]
push eax
push esi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push str.DvbzX4JU
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x353b8038
cmova eax, dword [ebp - 0x454]
push eax
push esi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.n.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10009bd5
push eax
call ebx
push str.cL7YqhhTWM
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x2bc38822
cmova eax, dword [ebp - 0x454]
push eax
push esi
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10009c53
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x49c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push esi
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.SQ.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10009c78
push eax
call ebx
push str.FbDupE
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x623a144
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x10047320
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0xaebec75
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 7
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10002037
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
push 0x50
movlpd qword [ebp - 0x464], xmm0
call fcn.1001c8f6
push 0x50
mov esi, eax
push 0
push esi
mov dword [ebp - 0x43c], esi
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 0x21
call fcn.10006eec
push eax
lea ecx, [ebp - 0x464]
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 8
push 0x50
movlpd qword [ebp - 0x4a4], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push 0x50
push 0
push esi
mov byte [ebp - 4], 9
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 1
push 0x10047010
push 1
call fcn.10006f1e
push eax
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 8
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 0xa
movlpd qword [ebp - 0x48c], xmm0
push 0x50
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push 0x50
push 0
push esi
mov byte [ebp - 4], 0xb
call fcn.1001e5b0
add esp, 0x10
lea eax, [ebp - 0x490]
mov ecx, esi
push 4
push eax
push 2
call fcn.10006f1e
push eax
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0xa
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 0xc
push 0x50
movlpd qword [ebp - 0x46c], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push 0x50
push 0
push esi
mov byte [ebp - 4], 0xd
call fcn.1001e5b0
pop ecx
pop ecx
lea eax, [ebp - 0x474]
mov ecx, esp
push eax
call fcn.100014c2
push 4
mov ecx, esi
call fcn.1000710b
push eax
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 0xc
call fcn.100014e7
push ecx
push ecx
lea eax, [ebp - 0x4a4]
mov byte [ebp - 4], 0xe
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push ecx
push ecx
lea eax, [ebp - 0x48c]
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push ecx
push ecx
lea eax, [ebp - 0x46c]
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push ecx
push ecx
lea eax, [ebp - 0x464]
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x7ec]
mov ecx, dword [ecx + 4]
call fcn.10018754
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x10009ec4
call fcn.10001270
mov ecx, dword [ebp - 0x488]
test ecx, ecx
je 0x10009ed3
call fcn.10001270
mov ecx, dword [ebp - 0x4a0]
test ecx, ecx
je 0x10009ee2
call fcn.10001270
mov ecx, dword [ebp - 0x460]
test ecx, ecx
je 0x10009ef1
call fcn.10001270
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x470]
test ecx, ecx
je 0x10009f04
call fcn.10001270
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x10047324
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x2715f48a
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push 0x10047328
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0xfa2b0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10002037
push str.ONOg30ARD
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x2a92f51e
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000a03c
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0x49c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call ebx
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
mov dword [ebp - 0x434], 0x10
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x10047338
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x1c916761
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
mov ecx, dword [ebp + 8]
call fcn.100073ad
cmp al, 0x22
jne 0x1000ac67
push 8
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000a127
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000a153
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 0x1004733c
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x1cb0c651
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.2J6pXe1m
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x2b01cb44
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000a23a
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0x49c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call ebx
push str.qdJcc5yc
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x16a79d6b
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push str.X2tIN6
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0xae96123
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push 8
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000a2dd
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000a326
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0x49c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push dword [ebp - 0x434]
call ebx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x46c]
push 2
push eax
call fcn.10007581
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 0x11
push ecx
mov ecx, dword [eax]
call fcn.1000764d
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x1000a35c
call fcn.10001270
xorps xmm0, xmm0
lea ecx, [ebp - 0x474]
movlpd qword [ebp - 0x474], xmm0
call fcn.1000fc6d
lea eax, [ebp - 0x45c]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x45c]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000a3eb
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.BKo08.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000a410
push eax
call ebx
push 0x10047374
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x3295801f
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x13
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x12
call fcn.10002037
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push str.it32
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x218ab52e
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000a4d2
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000a512
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x49c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push esi
call ebx
push str.FqNQIHytV6
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x8cff361
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
xorps xmm0, xmm0
push 0x50
movlpd qword [ebp - 0x464], xmm0
call fcn.1001c8f6
push 0x50
mov esi, eax
push 0
push esi
mov dword [ebp - 0x43c], esi
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 0x22
call fcn.10006eec
push eax
lea ecx, [ebp - 0x464]
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 0x14
push 0x50
movlpd qword [ebp - 0x4ac], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push 0x50
push 0
push esi
mov byte [ebp - 4], 0x15
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 1
push 0x10047010
push 1
call fcn.10006f1e
push eax
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 0x14
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 0x16
push 0x50
movlpd qword [ebp - 0x4a4], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push 0x50
push 0
push esi
mov byte [ebp - 4], 0x17
call fcn.1001e5b0
add esp, 0x10
lea eax, [ebp - 0x490]
mov ecx, esi
push 4
push eax
push 2
call fcn.10006f1e
push eax
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 0x16
call fcn.100014e7
mov byte [ebp - 4], 0x18
push ecx
push ecx
lea eax, [ebp - 0x4ac]
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push ecx
push ecx
lea eax, [ebp - 0x4a4]
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push str.NPJhE
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x2e6dde1c
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x19
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x18
call fcn.10002037
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x434], 0x10
push eax
call esi
push str.Komku
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x3aebc9b9
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.XXJLZcAjEB
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x282d4eb0
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.8.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000a79a
push eax
call ebx
push 0x100473b4
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x27ff45db
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x4d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.ed6FT6
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x36c69b88
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 0x474]
test ecx, ecx
je 0x1000ac09
lea eax, [ebp - 0x43c]
push eax
call fcn.10005296
push str.nk9wM28Yv9
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x490], eax
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea ecx, [ebp - 0x454]
push 0x3681b23d
cmova ecx, dword [ebp - 0x454]
push ecx
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0x18
mov dword [ebp - 0x434], 0x10
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x4bc]
push eax
call esi
lea eax, [ebp - 0x4d4]
push eax
call esi
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.T3i2sIuI0U
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x12282c85
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x18
call fcn.10002037
lea eax, [ebp - 0x4fc]
push eax
call esi
push 8
lea eax, [ebp - 0x47c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000a987
push 1
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.YnGD0
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0xb5091b7
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x18
call fcn.10002037
cmp byte [0x1005285c], 0
je 0x1000ab74
lea eax, [ebp - 0x46c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x46c], xmm0
call fcn.10016b5f
push 0x50
xorps xmm0, xmm0
mov byte [ebp - 4], 0x1c
pop edi
push edi
movlpd qword [ebp - 0x48c], xmm0
call fcn.1001c8f6
push edi
mov esi, eax
push 0
push esi
mov dword [ebp - 0x43c], esi
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 0x13
call fcn.10006eec
push eax
lea ecx, [ebp - 0x48c]
call fcn.100014e7
push edi
mov byte [ebp - 4], 0x1d
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push edi
push 0
push esi
mov byte [ebp - 4], 0x1e
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 1
push 0x10047254
push 1
call fcn.10006f1e
push ecx
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1d
push eax
call fcn.100014e7
mov ebx, dword [ebp - 0x48c]
mov ecx, ebx
call fcn.10007868
push edi
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push edi
push 0
push esi
mov byte [ebp - 4], 0x1f
call fcn.1001e5b0
pop ecx
pop ecx
lea eax, [ebp - 0x46c]
mov ecx, esp
push eax
call fcn.100014c2
push 4
mov ecx, esi
call fcn.1000710b
push ecx
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1d
push eax
call fcn.100014e7
mov ecx, ebx
call fcn.10007868
push edi
call fcn.1001c8f6
mov edi, eax
mov dword [ebp - 0x43c], edi
push 0x50
push 0
push edi
mov byte [ebp - 4], 0x20
call fcn.1001e5b0
pop ecx
pop ecx
mov esi, esp
lea eax, [ebp - 0x46c]
push ecx
push ecx
mov ecx, esp
push eax
call fcn.100014c2
push ecx
push ecx
lea eax, [ebp - 0x474]
mov ecx, esp
push eax
call fcn.100014c2
push esi
call fcn.1001678a
push 0x10
mov ecx, edi
call fcn.1000710b
push ecx
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1d
push eax
call fcn.100014e7
mov ecx, ebx
call fcn.10007868
lea eax, [ebp - 0x7f4]
mov ecx, ebx
push eax
call fcn.100078ed
push eax
lea ecx, [ebp - 0x474]
call fcn.10001fa1
mov ecx, dword [ebp - 0x7f0]
test ecx, ecx
je 0x1000ab4c
call fcn.10001270
mov ecx, dword [ebp - 0x488]
test ecx, ecx
je 0x1000ab5b
call fcn.10001270
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x1000ab6e
call fcn.10001270
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
push 0x50
movlpd qword [ebp - 0x46c], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x43c], esi
push 0x50
push 0
push esi
mov byte [ebp - 4], 0x21
call fcn.1001e5b0
pop ecx
pop ecx
lea eax, [ebp - 0x474]
mov ecx, esp
push eax
call fcn.100014c2
push 4
mov ecx, esi
call fcn.1000710b
push eax
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 0x18
call fcn.100014e7
push ecx
push ecx
lea eax, [ebp - 0x46c]
mov byte [ebp - 4], 0x22
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push dword [ebp - 0x490]
call fcn.1001c957
pop ecx
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x1000ac03
call fcn.10001270
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ecx
push ecx
lea eax, [ebp - 0x464]
mov ecx, esp
push eax
call fcn.100014c2
mov eax, dword [ebp - 0x7ec]
mov ecx, dword [eax + 4]
call fcn.10018754
mov ecx, dword [ebp - 0x4a0]
test ecx, ecx
je 0x1000ac36
call fcn.10001270
mov ecx, dword [ebp - 0x4a8]
test ecx, ecx
je 0x1000ac45
call fcn.10001270
mov ecx, dword [ebp - 0x460]
test ecx, ecx
je 0x1000ac54
call fcn.10001270
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x470]
test ecx, ecx
je 0x1000ac67
call fcn.10001270
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.IRpHbX.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000ac8c
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000acd7
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0x49c]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
push 0x100473f8
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x37f30ed8
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.FkEgIV3FU
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x21bf892f
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea ecx, [ebp - 0x454]
push str.zRJN3e4Ma7
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0x1e663ebc
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x4e4]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
mov ecx, dword [ebp + 8]
call fcn.100073ad
cmp al, 0x23
jne 0x1000c249
push 8
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000ae6e
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000aebe
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 8
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000aee1
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0x10047414
call fcn.10001fd7
push 0x1de3c95b
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x23
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000afc6
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0x49c]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
push str.pvkS1
lea ecx, [ebp - 0x454]
call fcn.10001fd7
cmp dword [ebp - 0x440], 0xf
lea eax, [ebp - 0x454]
push 0xbac7236
cmova eax, dword [ebp - 0x454]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x454]
call fcn.10002037
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.10007791
test al, al
je 0x1000c249
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x490], 0
jbe 0x1000c249
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push 8
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000b074
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x51c]
push eax
push 0x1004774c
call esi
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x754]
push eax
push 0x1004774c
call esi
push str.9eT609dXt
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x39713db5
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000b12c
lea ecx, [ebp - 0x534]
push ecx
lea ecx, [ebp - 0x53c]
push ecx
lea ecx, [ebp - 0x544]
push ecx
lea ecx, [ebp - 0x54c]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
lea eax, [ebp - 0x76c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call esi
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000b171
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x55c]
push eax
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x56c]
push eax
push esi
call edi
push esi
call ebx
lea eax, [ebp - 0x77c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.K7RiYYUOVO
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1719d971
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0x10047438
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x1fe4f2c8
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x24
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.n.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000b213
push eax
call ebx
xorps xmm0, xmm0
push 0x50
movlpd qword [ebp - 0x46c], xmm0
call fcn.1001c8f6
push 0x50
mov esi, eax
push 0
push esi
mov dword [ebp - 0x434], esi
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
call fcn.10006ec1
push eax
lea ecx, [ebp - 0x46c]
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 0x25
push 0x40
movlpd qword [ebp - 0x464], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x4a0], esi
push 0x40
push 0
push esi
mov byte [ebp - 4], 0x26
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 0xfa0
call fcn.1000503b
push esi
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], 0x25
call fcn.10004281
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x490]
sub eax, dword [ebp - 0x4a8]
mov ecx, dword [ebp - 0x464]
push eax
mov eax, dword [ebp - 0x43c]
add eax, dword [ebp - 0x4a8]
push eax
call fcn.10005176
push 0x1004743c
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x12ba259b
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x78c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.4ZnCqOi.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000b326
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000b36d
lea ecx, [ebp - 0x574]
push ecx
lea ecx, [ebp - 0x57c]
push ecx
lea ecx, [ebp - 0x584]
push ecx
lea ecx, [ebp - 0x58c]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.tOYq7EwJl.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000b3a8
push eax
call ebx
call esi
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000b3e0
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x59c]
push eax
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x5ac]
push eax
push esi
call edi
push esi
call ebx
push str.kjCMdZB
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x297f6641
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.xY7a7S5rC2
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x21c26aa7
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x28
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.10002037
lea eax, [ebp - 0x79c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x434], 0x10
push eax
call esi
lea eax, [ebp - 0x7ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp byte [0x1005285c], 0
je 0x1000b9df
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push 0x10047488
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1c7ad8c
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x5b4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push str.CPbQxVLmw7
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0xc7e69e6
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.cP4Klb
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x31f704ad
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000b5bb
lea eax, [ebp - 0x5bc]
push eax
lea eax, [ebp - 0x5c4]
push eax
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x5d4]
push eax
push esi
call edi
push esi
call ebx
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x5dc]
add esp, 0xc
push eax
call esi
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x5e4]
push eax
call esi
push ecx
push ecx
lea eax, [ebp - 0x464]
mov ecx, esp
push eax
call fcn.100014c2
mov esi, dword [ebp - 0x46c]
mov ecx, esi
call fcn.100071e5
test al, al
je 0x1000c66c
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x5fc]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000b6a4
lea ecx, [ebp - 0x604]
push ecx
lea ecx, [ebp - 0x60c]
push ecx
lea ecx, [ebp - 0x614]
push ecx
lea ecx, [ebp - 0x61c]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
push 8
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000b6c7
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x7bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.QIAaHJrtkv
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x38b70ebe
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.v8ozR
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x28cf9c19
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x29
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000b7b5
lea ecx, [ebp - 0x62c]
push ecx
lea ecx, [ebp - 0x634]
push ecx
lea ecx, [ebp - 0x63c]
push ecx
lea ecx, [ebp - 0x644]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
push 0x100474b4
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x30cdd044
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x2a
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.10002037
push str.1jkoUmWTq
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x37d93444
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x2b
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.10002037
mov ecx, esi
call fcn.100073ad
cmp al, 0x13
jne 0x1000c66c
push 1
mov ecx, esi
call fcn.10007507
test al, al
je 0x1000c66c
push 0x10
mov ecx, esi
call fcn.10007507
test al, al
je 0x1000c66c
push 1
lea eax, [ebp - 0x7f4]
mov ecx, esi
push eax
call fcn.10007581
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x7e4]
or ecx, 1
mov dword [ebp - 0x7e4], ecx
mov dword [ebp - 0x434], ecx
lea ecx, [ebp - 0x7e6]
push ecx
mov ecx, dword [eax]
call fcn.1000761b
test al, al
je 0x1000b8ab
cmp byte [ebp - 0x7e6], 0
mov byte [ebp - 0x7dd], 0
jne 0x1000b8b2
mov byte [ebp - 0x7dd], 1
mov dword [ebp - 4], 0x27
mov eax, dword [ebp - 0x7e4]
test al, 1
je 0x1000b8db
mov ecx, dword [ebp - 0x7f0]
and eax, 0xfffffffe
mov dword [ebp - 0x7e4], eax
test ecx, ecx
je 0x1000b8db
call fcn.10001270
cmp byte [ebp - 0x7dd], 0
jne 0x1000c66c
xorps xmm0, xmm0
movlpd qword [ebp - 0x48c], xmm0
and dword [ebp - 0x48c], 0
and dword [ebp - 0x488], 0
push 4
mov ecx, esi
mov byte [ebp - 4], 0x2d
call fcn.10007507
test al, al
je 0x1000b95e
push 4
lea eax, [ebp - 0x4ec]
mov ecx, esi
push eax
call fcn.10007581
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0x2e
push ecx
mov ecx, dword [eax]
call fcn.100077ea
push eax
lea ecx, [ebp - 0x48c]
call fcn.10001fa1
mov ecx, dword [ebp - 0x4e0]
test ecx, ecx
je 0x1000b94f
call fcn.10001270
mov ecx, dword [ebp - 0x4e8]
test ecx, ecx
je 0x1000b95e
call fcn.10001270
push ecx
push ecx
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x434], esp
mov ecx, esp
push eax
call fcn.100014c2
push 0x10
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 0x2f
push eax
mov ecx, esi
call fcn.10007581
push ecx
push ecx
mov byte [ebp - 4], 0x30
mov ecx, dword [eax]
push esp
call fcn.100077ea
lea eax, [ebp - 0x4c4]
mov byte [ebp - 4], 0x31
push eax
call fcn.10016926
push eax
lea ecx, [ebp - 0x464]
call fcn.10001fa1
mov ecx, dword [ebp - 0x4c0]
test ecx, ecx
je 0x1000b9c1
call fcn.10001270
mov ecx, dword [ebp - 0x498]
test ecx, ecx
je 0x1000b9d0
call fcn.10001270
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x488]
jmp 0x1000be89
push str.QmQDTW
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2fcef18
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push str.Qxeg9X
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2332de71
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0x100474b4
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x91b725
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 8
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000bab1
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.J.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000bad6
push eax
call ebx
push 8
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000baf9
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push str.I49HXeSCBZ
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x101acbe
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x32
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.OlBYC0Gp.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000bb5b
push eax
call ebx
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x66c]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000bbce
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x68c]
push eax
push esi
call edi
push esi
call ebx
push ecx
push ecx
lea eax, [ebp - 0x464]
mov ecx, esp
push eax
call fcn.100014c2
mov esi, dword [ebp - 0x46c]
mov ecx, esi
call fcn.100071e5
test al, al
je 0x1000c66c
lea eax, [ebp - 0x7cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.dlsuxMSK7D
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x3b3595e8
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.dpDzCT42.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000bc58
push eax
call ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a4]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x10047530
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x37bf7848
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x6ac]
push eax
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x6bc]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000bd10
lea ecx, [ebp - 0x6c4]
push ecx
lea ecx, [ebp - 0x6cc]
push ecx
lea ecx, [ebp - 0x6d4]
push ecx
lea ecx, [ebp - 0x6dc]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
lea eax, [ebp - 0x7dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x10047534
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x27053925
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
mov ecx, esi
call fcn.100073ad
cmp al, 0x13
jne 0x1000be92
push 1
mov ecx, esi
call fcn.10007507
test al, al
je 0x1000c66c
push 0x10
mov ecx, esi
call fcn.10007507
test al, al
je 0x1000c66c
push 1
lea eax, [ebp - 0x484]
mov ecx, esi
push eax
call fcn.10007581
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x7e4]
or ecx, 2
mov dword [ebp - 0x7e4], ecx
mov dword [ebp - 0x434], ecx
lea ecx, [ebp - 0x7e5]
push ecx
mov ecx, dword [eax]
call fcn.1000761b
test al, al
je 0x1000be05
cmp byte [ebp - 0x7e5], 0
mov byte [ebp - 0x7dd], 0
je 0x1000be0c
mov byte [ebp - 0x7dd], 1
mov dword [ebp - 4], 0x27
mov eax, dword [ebp - 0x7e4]
test al, 2
je 0x1000be35
mov ecx, dword [ebp - 0x480]
and eax, 0xfffffffd
mov dword [ebp - 0x7e4], eax
test ecx, ecx
je 0x1000be35
call fcn.10001270
cmp byte [ebp - 0x7dd], 0
jne 0x1000c66c
push 0x10
lea eax, [ebp - 0x45c]
mov ecx, esi
push eax
call fcn.10007581
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 0x34
push ecx
mov ecx, dword [eax]
call fcn.100077ea
push eax
lea ecx, [ebp - 0x464]
call fcn.10001fa1
mov ecx, dword [ebp - 0x478]
test ecx, ecx
je 0x1000be7f
call fcn.10001270
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x458]
test ecx, ecx
je 0x1000be92
call fcn.10001270
push 0x10047538
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x1cf94f31
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0x1004753c
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x3b37c169
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.LJk86V.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000bf1d
push eax
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.bNOSRuGF.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000bf42
push eax
call ebx
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x6ec]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x10047574
lea ecx, [ebp - 0x28]
call fcn.10001fd7
push 0x25d006a8
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x35
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.10002037
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000bffa
lea ecx, [ebp - 0x6f4]
push ecx
lea ecx, [ebp - 0x6fc]
push ecx
lea ecx, [ebp - 0x704]
push ecx
lea ecx, [ebp - 0x70c]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x10047578
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000c01f
push eax
call ebx
push 8
lea eax, [ebp - 0x714]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000c042
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov ecx, esi
call fcn.1000748a
add dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x724]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x434]
add esp, 0xc
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x73c]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 8
lea eax, [ebp - 0x744]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000c111
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x1000c156
lea ecx, [ebp - 0x74c]
push ecx
lea ecx, [ebp - 0x4dc]
push ecx
lea ecx, [ebp - 0x4f4]
push ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
call edi
push dword [ebp - 0x434]
call ebx
push str.DDwA
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x2e0f9a1b
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
push 8
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1000c1ac
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.0JF1Mkr1.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000c1fe
push eax
call ebx
push ecx
push ecx
lea eax, [ebp - 0x464]
mov ecx, esp
push eax
call fcn.100014c2
call fcn.1000e18a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x460]
test ecx, ecx
je 0x1000c224
call fcn.10001270
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x1000c237
call fcn.10001270
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x4a8], eax
jb 0x1000b03a
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.VShjYHB0e.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000c26e
push eax
call ebx
push 0x100475c4
lea ecx, [ebp - 0x28]
call fcn.10001fd7
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0x17ac89aa
cmova eax, dword [ebp - 0x28]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10002037
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x100475c8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000c2f4
push eax
call ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.8tX.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000c319
push eax
call ebx
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x4f4]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x4dc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, 0x400
lea eax, [ebp - 0x430]
push esi
push 0
push eax
call fcn.1001e5b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000c3ac
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x4dc]
push eax
push esi
call edi
push esi
call ebx
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x4f4]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp + 8]
call fcn.100073ad
cmp al, 0x24
jne 0x1000c658
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x45c]
push 2
push eax
call fcn.10007581
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 0x36
push ecx
mov ecx, dword [eax]
call fcn.1000764d
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x458]
test ecx, ecx
je 0x1000c412
call fcn.10001270
xorps xmm0, xmm0
push 0x40
movlpd qword [ebp - 0x494], xmm0
call fcn.1001c8f6
mov ebx, eax
mov dword [ebp - 0x470], ebx
push 0x40
push 0
push ebx
mov byte [ebp - 4], 0x37
call fcn.1001e5b0
add esp, 0x10
mov ecx, ebx
push 0xfa0
call fcn.1000503b
mov edi, dword [ebx + 0x30]
lea ecx, [ebp - 0x494]
mov esi, 0x10052844
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x34], 0x10
mov byte [ebp - 4], 0
call fcn.10004281
push 0x50
xorps xmm0, xmm0
mov byte [ebp - 4], 0x38
pop edi
push edi
movlpd qword [ebp - 0x464], xmm0
call fcn.1001c8f6
push edi
mov esi, eax
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 0x470], esi
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 0x21
call fcn.10006eec
push eax
lea ecx, [ebp - 0x464]
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 0x39
push edi
movlpd qword [ebp - 0x438], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x470], esi
push edi
push ebx
push esi
mov byte [ebp - 4], 0x3a
call fcn.1001e5b0
add esp, 0x10
mov ecx, esi
push 1
push 0x10047010
push 1
call fcn.10006f1e
push eax
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x39
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 0x3b
push edi
movlpd qword [ebp - 0x48c], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x470], esi
push edi
push ebx
push esi
mov byte [ebp - 4], 0x3c
call fcn.1001e5b0
add esp, 0x10
lea eax, [ebp - 0x43c]
mov ecx, esi
push 4
push eax
push 2
call fcn.10006f1e
push eax
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0x3b
call fcn.100014e7
xorps xmm0, xmm0
mov byte [ebp - 4], 0x3d
push edi
movlpd qword [ebp - 0x46c], xmm0
call fcn.1001c8f6
mov esi, eax
mov dword [ebp - 0x470], esi
push edi
push ebx
push esi
mov byte [ebp - 4], 0x3e
call fcn.1001e5b0
pop ecx
pop ecx
lea eax, [ebp - 0x494]
mov ecx, esp
push eax
call fcn.100014c2
push 4
mov ecx, esi
call fcn.1000710b
push eax
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 0x3d
call fcn.100014e7
push ecx
push ecx
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 0x3f
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push ecx
push ecx
lea eax, [ebp - 0x48c]
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push ecx
push ecx
lea eax, [ebp - 0x46c]
mov ecx, esp
push eax
call fcn.100014c2
mov ecx, dword [ebp - 0x464]
call fcn.10007868
push ecx
push ecx
lea eax, [ebp - 0x464]
mov ecx, esp
push eax
call fcn.100014c2
mov eax, dword [ebp - 0x7ec]
mov ecx, dword [eax + 4]
call fcn.10018754
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x1000c61c
call fcn.10001270
mov ecx, dword [ebp - 0x488]
test ecx, ecx
je 0x1000c62b
call fcn.10001270
mov ecx, dword [ebp - 0x434]
test ecx, ecx
je 0x1000c63a
call fcn.10001270
mov ecx, dword [ebp - 0x460]
test ecx, ecx
je 0x1000c649
call fcn.10001270
mov ecx, dword [ebp - 0x490]
test ecx, ecx
je 0x1000c658
call fcn.10001270
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1000c664
call fcn.10001270
call fcn.1001d1f3
ret 8
mov ecx, dword [ebp - 0x460]
test ecx, ecx
je 0x1000c67b
call fcn.10001270
mov ecx, dword [ebp - 0x468]
jmp 0x1000c64f