Function at 0x14001734c
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x13e8]
mov eax, 0x14c0
call fcn.140034d80
sub rsp, rax
mov rax, qword [0x140077100]
xor rax, rsp
mov qword [rbp + 0x13b0], rax
mov rdi, rcx
lea r9, [rbp - 8]
lea r8, [rbp]
lea rdx, [rbp + 8]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rbp - 0x60], 0x10
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor esi, esi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
lea r8d, [rsi + 4]
lea rdx, str.L61h
lea rcx, [rbp - 0x48]
call fcn.14000192c
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x327e36d6
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140017469
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017464
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018497
call fcn.140034bfc
mov qword [rsp + 0x30], rsi
mov r13d, 0x80
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea r14d, [r13 - 0x7f]
mov r8d, r14d
mov ebx, 0x80000000
mov edx, ebx
lea rcx, str.aFZg.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or r15, 0xffffffffffffffff
cmp rax, r15
je 0x1400174b1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, ebx
lea rcx, str.UZORTwap.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x1400174e6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, ebx
lea rcx, str.8gElt.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x14001751b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 8
lea rcx, [rbp + 0x18]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001754d
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov r12d, 0x400
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140017596
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x28]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
lea rcx, str.PGoqmTLk.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x1400175ce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x10
mov dword [rbp - 0x58], ebx
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edx, [rbx - 8]
lea rcx, [rbp + 0x40]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001760a
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.140059690
mov edx, 8
lea rcx, [rbp + 0x48]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140017640
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x70], ebx
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x14001766d
lock add dword [rax + 8], r14d
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x58], rax
mov r8, rdi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.14002d17c
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rdi + 8], rcx
mov rbx, qword [rdi + 0x10]
mov qword [rdi + 0x10], rdx
test rbx, rbx
je 0x1400176db
mov eax, r15d
lock xadd dword [rbx + 8], eax
add eax, r15d
jne 0x1400176db
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
add eax, r15d
jne 0x1400176db
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x140017710
mov eax, r15d
lock xadd dword [rbx + 8], eax
add eax, r15d
jne 0x140017710
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
add eax, r15d
jne 0x140017710
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov edx, 8
lea rcx, [rbp + 0x240]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140017738
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x7b0]
call fcn.140059690
lea r9, [rbp + 0x248]
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x258]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp - 0x68], 0x10
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, 8
lea rcx, [rbp + 0x270]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400177ab
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0xbb0]
call fcn.140059690
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
lea rcx, str.oZ3yF9Z.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x1400177f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
mov r8d, 9
lea rdx, str.ncB9FxErH
lea rcx, [rbp + 0x50]
call fcn.14000192c
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rdx, qword [rbp + 0x50]
mov r8d, 0xc8c28ee
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140017874
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001786f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001849d
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov r8d, 2
lea rdx, [0x14005e07c]
lea rcx, [rbp + 0x70]
call fcn.14000192c
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
mov r8d, 0x1607cbd5
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400178fd
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400178f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400184a3
call fcn.140034bfc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001794c
lea rax, [rbp + 0x278]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x280]
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001799b
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov ebx, 0x80000000
mov edx, ebx
lea rcx, str.PI.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x1400179d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0xd8]
lea r8, [rbp + 0xe0]
lea rdx, [rbp + 0xe8]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov r8, r14
lea rdx, [0x14005e090]
lea rcx, [rbp + 0x90]
call fcn.14000192c
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rdx, qword [rbp + 0x90]
mov r8d, 0x1b803a2b
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140017a8c
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017a87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400184a9
call fcn.140034bfc
lea rcx, [rbp + 0xf0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0xf8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, ebx
lea rcx, str.bvxnqL.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x140017adb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rdi + 8], rsi
je 0x140018461
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140017b5b
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x108]
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x118]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, 8
lea rcx, [rbp + 0x128]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140017b90
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x130]
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0x140]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
mov ebx, 3
mov r8d, ebx
lea rdx, [0x14005e0b0]
lea rcx, [rbp - 0x28]
call fcn.14000192c
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x3a63d915
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140017c56
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017c51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400184af
call fcn.140034bfc
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov ebx, 0x80000000
mov edx, ebx
lea rcx, str.n8T96.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x140017c8c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov r13d, 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r14d
mov edx, ebx
lea rcx, str.7S7U.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x140017cc4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, 0x10
mov dword [rbp - 0x64], ebx
lea rdx, [rbp - 0x64]
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp - 0x50], ebx
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0xfb0]
call fcn.140059690
lea rcx, [rbp + 0x148]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x140017d40
lock add dword [rax + 8], r14d
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 8]
call fcn.14002cbac
test al, al
je 0x140018461
mov dword [rsp + 0x70], ebx
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140017dc1
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x300], xmm1
mov r8d, 4
lea rdx, str.bjOA
lea rcx, [rbp + 0x2f0]
call fcn.14000192c
lea rdx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 0xf
cmova rdx, qword [rbp + 0x2f0]
mov r8d, 0x32c1490d
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x308]
mov r15d, 0x1000
cmp rdx, 0xf
jbe 0x140017e5b
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, r15
jb 0x140017e56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400184b5
call fcn.140034bfc
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x28]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x18]
lea rbx, [0x14005dfa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x10]
lea r8, [rbp + 8]
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.140059690
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov r8d, 8
lea rdx, str.aHqgMsw5
lea rcx, [rsp + 0x78]
call fcn.14000192c
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0xfcd07cc
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140017f3e
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, r15
jb 0x140017f39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400184bb
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov r8, r13
lea rdx, [0x14005e0fc]
lea rcx, [rsp + 0x78]
call fcn.14000192c
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x18a221f
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140017fd1
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, r15
jb 0x140017fcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400184c1
call fcn.140034bfc
mov r13d, 0x10
mov dword [rsp + 0x70], r13d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbp - 8]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x150]
lea r8, [rbp + 0x158]
lea rdx, [rbp + 0x160]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140018070
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x170]
lea r8, [rbp + 0x178]
lea rdx, [rbp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400180cc
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x190]
lea r8, [rbp + 0x198]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x1a8]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b8]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.140059690
mov rcx, qword [rdi + 8]
call fcn.14002cfec
mov edx, 8
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140018130
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
mov qword [rbp + 0x320], rsi
mov qword [rbp + 0x328], rsi
mov r8, r14
lea rdx, [0x14005e100]
lea rcx, [rbp + 0x310]
call fcn.14000192c
nop
lea rdx, [rbp + 0x310]
cmp qword [rbp + 0x328], 0xf
cmova rdx, qword [rbp + 0x310]
mov r8, qword [rbp + 0x320]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x1825a1c0
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x328]
cmp rdx, 0xf
jbe 0x1400181dc
inc rdx
mov rcx, qword [rbp + 0x310]
mov rax, rcx
cmp rdx, r15
jb 0x1400181d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400184c7
call fcn.140034bfc
mov dword [rsp + 0x70], r13d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.140059690
lea r9, [rbp + 0x1c8]
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x1d8]
lea rdi, [0x14005dfa8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x70], r13d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x300], xmm1
mov r8d, 2
lea rdx, [0x14005e104]
lea rcx, [rbp + 0x2f0]
call fcn.14000192c
lea rdx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 0xf
cmova rdx, qword [rbp + 0x2f0]
mov r8d, 0x17f5920a
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x308]
cmp rdx, 0xf
jbe 0x1400182e1
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, r15
jb 0x1400182dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400184cd
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x300], xmm1
mov r8d, 9
lea rdx, str.afXRq0K80
lea rcx, [rbp + 0x2f0]
call fcn.14000192c
lea rdx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 0xf
cmova rdx, qword [rbp + 0x2f0]
mov r8d, 0x1b1841af
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x308]
cmp rdx, 0xf
jbe 0x140018375
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, r15
jb 0x140018370
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018491
call fcn.140034bfc
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400183ce
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1e8]
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x1f8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.140059690
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.140059690
lea rcx, [rbp + 0x200]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x208]
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x218]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x220]
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x230]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x260]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140018461
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov rcx, qword [rbp + 0x13b0]
xor rcx, rsp
call fcn.140034ca0
lea r11, [rsp + 0x14c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3