Function at 0x14000eef4
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5f50]
mov eax, 0x6050
call fcn.14002dd90
sub rsp, rax
mov rax, qword [0x14006f100]
xor rax, rsp
mov qword [rbp + 0x5f40], rax
mov r13, rdx
mov qword [rbp - 0x70], rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rbp + 0x260], rdx
and dword [rsp + 0x48], 0
mov esi, 1
mov byte [rcx + 0xa0], sil
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.G6mbB61jv4.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or r14, 0xffffffffffffffff
cmp rax, r14
je 0x14000ef91
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xb90]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, 0x10
mov dword [rbp + 0x3f0], ebx
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0xd20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0x458], ebx
lea rdx, [rbp + 0x458]
lea rcx, [rbp + 0xd40]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x770]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0xba0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov r15d, 0x400
mov r8d, r15d
xor edx, edx
lea rcx, [rbp + 0xf40]
call fcn.1400526b0
lea rcx, [rbp + 0xbb0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [rbx - 8]
lea rcx, [rbp + 0x958]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000f039
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.NGWfN.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x14000f075
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r13]
call fcn.14000da40
mov r12d, 0x88
cmp al, 0x21
jne 0x14000f7b8
mov r8b, 2
lea rdx, [rbp + 0x278]
mov rcx, qword [r13]
call fcn.14000d79c
nop
lea rdx, [rbp + 0x450]
mov rcx, qword [rax]
call fcn.14000da94
nop
lea rcx, [rbp + 0x278]
call fcn.140001380
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
lea rcx, [rbp + 0x400]
call fcn.14000af80
nop
lea edx, [r12 - 0x80]
lea rcx, [rbp + 0x960]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000f0f9
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rbp + 0x454], ebx
lea rdx, [rbp + 0x454]
lea rcx, [rbp + 0xd60]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1340]
call fcn.1400526b0
lea rcx, [rbp + 0x968]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000f180
lea rax, [rbp + 0x970]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x978]
lea r8, [rbp + 0x980]
lea rdx, [rbp + 0x988]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 8
mov edx, ebx
lea rcx, [rbp + 0x990]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000f1a8
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, ebx
lea rcx, [rbp + 0x998]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000f1cb
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x9a0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000f227
lea rax, [rbp + 0x9a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x9b0]
lea r8, [rbp + 0x9b8]
lea rdx, [rbp + 0x9c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x9c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [0x140070ed0], 0
je 0x14000f409
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rbp + 0x3c8], rax
test rax, rax
je 0x14000f277
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov dl, 0x12
mov rcx, rbx
call fcn.14000c780
nop
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14000e4f8
nop
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rbp + 0x3c8], rax
test rax, rax
je 0x14000f2be
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, esi
lea r8, [0x140056ec8]
mov dl, sil
mov rcx, rbx
call fcn.14000c89c
nop
mov rdx, rax
lea rcx, [rbp + 0x288]
call fcn.14000e4f8
mov rdx, rax
mov rdi, qword [rbp + 0x30]
mov rcx, rdi
call fcn.14000ce44
cmp qword [0x140070f20], 0
je 0x14000f33c
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rbp + 0x3c8], rax
test rax, rax
je 0x14000f322
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, 0x10
mov r8, qword [0x140070f20]
mov dl, 2
mov rcx, rbx
call fcn.14000c89c
nop
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14000e4f8
mov rdx, rax
mov rcx, rdi
call fcn.14000ce44
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rbp + 0x3c8], rax
test rax, rax
je 0x14000f3b6
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x140], xmm0
mov rax, qword [rbp + 0x408]
test rax, rax
je 0x14000f37f
lock add dword [rax + 8], esi
mov rdi, qword [rbp + 0x30]
movaps xmm0, xmmword [rbp + 0x400]
movdqa xmmword [rbp + 0x140], xmm0
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x2a8]
lea rcx, [0x140070ed0]
call fcn.1400248d8
mov r8, rax
mov dl, 0x10
mov rcx, rbx
call fcn.14000cb78
nop
mov rdx, rax
lea rcx, [rbp + 0x2b8]
call fcn.14000e4f8
mov rdx, rax
mov rcx, rdi
call fcn.14000ce44
lea rdx, [rbp + 0x2c8]
mov rcx, rdi
call fcn.14000d20c
mov rdx, rax
lea rcx, [rbp + 0x400]
call fcn.14000e608
lea rcx, [rbp + 0x2c8]
call fcn.140001380
nop
lea rcx, [rbp + 0x30]
call fcn.140001380
mov rdi, qword [rsp + 0x60]
mov edx, 8
lea rcx, [rbp + 0x9d0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000f42f
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000f47e
lea rax, [rbp + 0x9d8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x9e0]
lea r8, [rbp + 0x9e8]
lea rdx, [rbp + 0x9f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x9f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0xbc0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000f4e7
lea rax, [rbp + 0xa00]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xa08]
lea r8, [rbp + 0xa10]
lea rdx, [rbp + 0xa18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1740]
call fcn.1400526b0
lea rcx, [rbp + 0xbd0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, 8
mov edx, ebx
lea rcx, [rbp + 0xa20]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000f52d
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0xa28]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, ebx
lea rcx, [rbp + 0xa30]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000f55d
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000f591
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov dl, 0x21
mov rcx, rbx
call fcn.14000c780
nop
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14000e4f8
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000f5dd
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, esi
lea r8, [0x140056f1c]
mov dl, sil
mov rcx, rbx
call fcn.14000c89c
nop
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14000e4f8
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000f62b
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, 4
lea r8, [rbp + 0x450]
mov dl, 2
mov rcx, rbx
call fcn.14000c89c
nop
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14000e4f8
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000f69d
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
mov rax, qword [rbp + 0x408]
test rax, rax
je 0x14000f67c
lock add dword [rax + 8], esi
movaps xmm0, xmmword [rbp + 0x400]
movdqa xmmword [rbp + 0xe0], xmm0
lea r8, [rbp + 0xe0]
mov dl, 4
mov rcx, rbx
call fcn.14000cb78
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14000e4f8
nop
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x150], xmm0
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x14000f6c2
lock add dword [rax + 8], esi
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x150]
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.14000ce44
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x14000f6fd
lock add dword [rax + 8], esi
mov rbx, qword [rbp - 0x40]
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x130], xmm0
lea rdx, [rbp + 0x130]
mov rcx, rbx
call fcn.14000ce44
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x14000f734
lock add dword [rax + 8], esi
mov rbx, qword [rbp - 0x40]
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0xf0], xmm0
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call fcn.14000ce44
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x14000f767
lock add dword [rax + 8], esi
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x160], xmm0
lea rdx, [rbp + 0x160]
mov rcx, qword [rdi + 8]
call fcn.140028bb8
nop
lea rcx, [rbp + 0x40]
call fcn.140001380
nop
lea rcx, [rbp + 0x50]
call fcn.140001380
nop
lea rcx, [rbp + 0x20]
call fcn.140001380
nop
lea rcx, [rbp - 0x40]
call fcn.140001380
nop
lea rcx, [rbp + 0x400]
call fcn.140001380
lea rcx, [rbp + 0xa38]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.kspJbvCyyR.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x14000f80e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0xa40]
lea r8, [rbp + 0xa48]
lea rdx, [rbp + 0xa50]
lea rbx, [0x140056e38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0xa58]
lea r8, [rbp + 0xa60]
lea rdx, [rbp + 0xa68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0xa70]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0xbf0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1b40]
call fcn.1400526b0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.Zmxh.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x14000f8b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xa78]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [r13]
call fcn.14000da40
cmp al, 0x22
jne 0x1400104e5
lea rcx, [rbp + 0xa80]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0xa88]
lea r8, [rbp + 0xa90]
lea rdx, [rbp + 0xa98]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000f927
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0xaa8]
lea r8, [rbp + 0xab0]
lea rdx, [rbp + 0xab8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.xWwIty.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x14000f981
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0xac0]
lea r8, [rbp + 0xac8]
lea rdx, [rbp + 0xad0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp + 0x44c], 0x10
lea rdx, [rbp + 0x44c]
lea rcx, [rbp + 0xd80]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0xc00]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000fa19
lea rax, [rbp + 0xad8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xae0]
lea r8, [rbp + 0xae8]
lea rdx, [rbp + 0xaf0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1f40]
call fcn.1400526b0
mov r8b, 2
lea rdx, [rbp + 0x2d8]
mov rcx, qword [r13]
call fcn.14000d79c
nop
lea rdx, [rbp + 0x444]
mov rcx, qword [rax]
call fcn.14000da94
nop
lea rcx, [rbp + 0x2d8]
call fcn.140001380
xorps xmm0, xmm0
movups xmmword [rbp + 0x3e0], xmm0
lea rcx, [rbp + 0x3e0]
call fcn.1400137a8
nop
lea rcx, [rbp + 0xc10]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rbp + 0x448], 0x10
lea rdx, [rbp + 0x448]
lea rcx, [rbp + 0xda0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2340]
call fcn.1400526b0
mov ebx, 8
mov edx, ebx
lea rcx, [rbp + 0xaf8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000fad5
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0xb00]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0xb08]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, ebx
lea rcx, [rbp + 0xb10]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000fb12
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000fb61
lea rax, [rbp + 0xb18]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb20]
lea r8, [rbp + 0xb28]
lea rdx, [rbp + 0xb30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0xb38]
lea r8, [rbp + 0xb40]
lea rdx, [rbp + 0xb48]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2740]
call fcn.1400526b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000fbc8
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov dl, 0x22
mov rcx, rbx
call fcn.14000c780
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14000e4f8
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000fc14
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, esi
lea r8, [0x140056f1c]
mov dl, sil
mov rcx, rbx
call fcn.14000c89c
nop
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14000e4f8
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000fc62
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, 4
lea r8, [rbp + 0x444]
mov dl, 2
mov rcx, rbx
call fcn.14000c89c
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14000e4f8
nop
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000fc87
lock add dword [rcx + 8], esi
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x110], xmm0
lea rdx, [rbp + 0x110]
mov rcx, qword [rbp - 0x60]
call fcn.14000ce44
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14000fcbb
lock add dword [rcx + 8], esi
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x120], xmm0
lea rdx, [rbp + 0x120]
mov rcx, qword [rbp - 0x60]
call fcn.14000ce44
mov ebx, 0x10
mov dword [rbp + 0x440], ebx
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0xdc0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0x43c], ebx
lea rdx, [rbp + 0x43c]
lea rcx, [rbp + 0xde0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0xc20]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0xb50]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [rbx - 8]
lea rcx, [rbp + 0xb58]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000fd4e
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000fd9d
lea rax, [rbp + 0xb60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb68]
lea r8, [rbp + 0xb70]
lea rdx, [rbp + 0xb78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xb80]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rbp + 0x410], 0x10
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0xe00]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov ebx, 8
mov edx, ebx
lea rcx, [rbp + 0xb88]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000fdf0
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, ebx
lea rcx, [rbp + 0x478]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14000fe13
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov rcx, qword [rbp + 0x3e0]
test rcx, rcx
je 0x1400103cb
lea rdx, [rbp + 0x470]
call fcn.140008fbc
mov r14, rax
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2b40]
call fcn.1400526b0
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_GetCursorPos]
and qword [rsp + 0x30], 0
mov edi, 0x80
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.EjL.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or rsi, 0xffffffffffffffff
cmp rax, rsi
je 0x14000fe91
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000fee0
lea rax, [rbp + 0x488]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x490]
lea r8, [rbp + 0x498]
lea rdx, [rbp + 0x4a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x4a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov r15d, 1
test eax, eax
jne 0x14000ff0e
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ebx, 0x400
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x2f40]
call fcn.1400526b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000ff72
lea rax, [rbp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4b8]
lea r8, [rbp + 0x4c0]
lea rdx, [rbp + 0x4c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x438], 0x10
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0xe20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, str.DQC.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rsi
je 0x14000ffc8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [0x140070ed0], 0
je 0x14001029c
xorps xmm0, xmm0
movups xmmword [rbp + 0x460], xmm0
lea rdx, [rbp + 0x460]
lea rcx, [0x140070ed0]
call fcn.140024b78
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140010034
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov dl, 0x13
mov rcx, rbx
call fcn.14000c780
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14000e4f8
nop
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140010079
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, r15d
lea r8, [0x140056ec8]
mov dl, r15b
mov rcx, rbx
call fcn.14000c89c
nop
mov rdx, rax
lea rcx, [rbp + 0x2e8]
call fcn.14000e4f8
mov rdx, rax
mov rbx, qword [rbp - 0x50]
mov rcx, rbx
call fcn.14000ce44
mov rcx, r12
call fcn.14002dbd8
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400100fa
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x180], xmm0
mov rax, qword [rbp + 0x468]
test rax, rax
je 0x1400100d9
lock add dword [rax + 8], r15d
mov rbx, qword [rbp - 0x50]
movaps xmm0, xmmword [rbp + 0x460]
movdqa xmmword [rbp + 0x180], xmm0
lea r8, [rbp + 0x180]
mov dl, 4
mov rcx, rdi
call fcn.14000cb78
nop
mov rdx, rax
lea rcx, [rbp + 0x248]
call fcn.14000e4f8
mov rdx, rax
mov rcx, rbx
call fcn.14000ce44
mov rcx, r12
call fcn.14002dbd8
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400101c7
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x190], xmm0
mov rax, qword [rbp + 0x468]
test rax, rax
je 0x14001015a
lock add dword [rax + 8], r15d
mov rbx, qword [rbp - 0x50]
movaps xmm0, xmmword [rbp + 0x460]
movdqa xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
mov rax, qword [rbp + 0x3e8]
test rax, rax
je 0x140010189
lock add dword [rax + 8], r15d
mov rbx, qword [rbp - 0x50]
movaps xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rbp + 0x1a0], xmm0
lea r9, [rbp + 0x190]
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x2f8]
lea rcx, [0x140070ed0]
call fcn.140024598
mov r8, rax
mov dl, 0x10
mov rcx, rdi
call fcn.14000cb78
nop
mov rdx, rax
lea rcx, [rbp + 0x308]
call fcn.14000e4f8
mov rdx, rax
mov rcx, rbx
call fcn.14000ce44
lea rdx, [rbp + 0x318]
mov rcx, rbx
call fcn.14000d20c
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.14000e608
mov rbx, qword [rbp + 0x320]
test rbx, rbx
je 0x140010233
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x140010233
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140010233
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140010269
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x140010269
mov rbx, qword [rbp - 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140010269
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rbx, qword [rbp + 0x468]
test rbx, rbx
je 0x14001029c
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x14001029c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x14001029c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140010309
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
mov rax, qword [rbp + 0x3e8]
test rax, rax
je 0x1400102e4
lock add dword [rax + 8], r15d
movaps xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov dl, 4
mov rcx, rbx
call fcn.14000cb78
mov rsi, rax
jmp 0x14001030b
xor esi, esi
mov qword [rbp + 0x268], rsi
mov ecx, 0x18
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140010347
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r15d
mov dword [rax + 0xc], r15d
lea rax, vtable.XLBT::_LOFFVOSRN.0
mov qword [rbx], rax
mov qword [rbx + 0x10], rsi
jmp 0x140010349
xor ebx, ebx
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
test rbx, rbx
je 0x140010369
lock add dword [rbx + 8], r15d
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rbx
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp - 0x60]
call fcn.14000ce44
mov rcx, r14
call fcn.14002dc14
nop
or r14, 0xffffffffffffffff
test rbx, rbx
je 0x1400103bb
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1400103bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1400103bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov r15d, 0x400
mov esi, 1
mov rdi, qword [rsp + 0x60]
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400103e3
lock add dword [rcx + 8], esi
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0xc0], xmm0
lea rdx, [rbp + 0xc0]
mov rcx, qword [rdi + 8]
call fcn.140028bb8
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001043a
mov eax, r14d
lock xadd dword [rcx + 8], eax
add eax, r14d
jne 0x14001043a
mov rbx, qword [rbp - 0x18]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x14001043a
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140010474
mov eax, r14d
lock xadd dword [rcx + 8], eax
add eax, r14d
jne 0x140010474
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140010474
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400104ae
mov eax, r14d
lock xadd dword [rcx + 8], eax
add eax, r14d
jne 0x1400104ae
mov rbx, qword [rbp - 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1400104ae
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rbx, qword [rbp + 0x3e8]
test rbx, rbx
je 0x1400104e5
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1400104e5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1400104e5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lea rcx, [rbp + 0xc30]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x4d8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edi, 8
mov edx, edi
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140010527
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0xc40]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, edi
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140010557
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.DFY7.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x140010593
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400105e2
lea rax, [rbp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4f8]
lea r8, [rbp + 0x500]
lea rdx, [rbp + 0x508]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xc50]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001063e
lea rax, [rbp + 0x510]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x518]
lea r8, [rbp + 0x520]
lea rdx, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.Krh7Q2Q.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x14001067a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r13]
call fcn.14000da40
cmp al, 0x23
jne 0x140011724
mov edx, edi
lea rcx, [rbp + 0x530]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400106ae
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0xc60]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.HYMOYMOxIJ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x1400106f7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x3340]
call fcn.1400526b0
lea rcx, [rbp + 0x538]
call qword [sym.imp.USER32.dll_GetCursorPos]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.YLyqC.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x140010751
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
lea rcx, [rbp + 0x540]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140010774
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x548]
lea r8, [rbp + 0x550]
lea rdx, [rbp + 0x558]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp + 0x434], 0x10
lea rdx, [rbp + 0x434]
lea rcx, [rbp + 0xe40]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbp + 0x560]
lea r8, [rbp + 0x568]
lea rdx, [rbp + 0x570]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r8, [rbp + 0x3d4]
lea rdx, [rbp + 0x3c8]
mov rcx, qword [r13]
call fcn.14000d5f0
test al, al
je 0x140011724
xor r12d, r12d
cmp dword [rbp + 0x3d4], r12d
jbe 0x14001171e
mov edx, edi
lea rcx, [rbp + 0x578]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140010828
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140010877
lea rax, [rbp + 0x580]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x588]
lea r8, [rbp + 0x590]
lea rdx, [rbp + 0x598]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x30], 0
mov ebx, 0x80
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.xxEwolcl.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x1400108b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xc70]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.gzSp.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x1400108f9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x3740]
call fcn.1400526b0
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, edi
lea rcx, [rbp + 0x5a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001093a
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140010989
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x5b8]
lea r8, [rbp + 0x5c0]
lea rdx, [rbp + 0x5c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x5d0]
lea r8, [rbp + 0x5d8]
lea rdx, [rbp + 0x5e0]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov edi, 0x88
mov ecx, edi
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400109e8
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov rcx, rbx
call fcn.14000cc50
mov r15, rax
jmp 0x1400109eb
xor r15d, r15d
mov qword [rbp + 0x220], r15
mov ecx, 0x18
call fcn.14002dbd8
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140010a25
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], esi
mov dword [rax + 0xc], esi
lea rax, vtable.XLBT::_LOFFVOSRN.0
mov qword [rdi], rax
mov qword [rdi + 0x10], r15
jmp 0x140010a27
xor edi, edi
mov qword [rbp + 0x1d0], r15
mov qword [rbp + 0x1d8], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov r14d, 0x68
mov ecx, r14d
call fcn.14002dbd8
mov rbx, rax
mov qword [rbp + 0x100], rax
test rax, rax
je 0x140010a74
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov rcx, rbx
call fcn.140008c24
mov r14, rax
jmp 0x140010a77
xor r14d, r14d
mov qword [rbp + 0x270], r14
mov ecx, 0x18
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140010ab1
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], esi
mov dword [rax + 0xc], esi
lea rax, vtable.JNZGFSYD_Y::_ELSHUNJATAD.0
mov qword [rbx], rax
mov qword [rbx + 0x10], r14
jmp 0x140010ab3
xor ebx, ebx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
mov r8d, dword [rbp + 0x3d4]
sub r8d, r12d
mov edx, r12d
add rdx, qword [rbp + 0x3c8]
mov rcx, r14
call fcn.140009148
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010b2a
lea rax, [rbp + 0x5e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x5f0]
lea r8, [rbp + 0x5f8]
lea rdx, [rbp + 0x600]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xc80]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010b88
lea rax, [rbp + 0x608]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x610]
lea r8, [rbp + 0x618]
lea rdx, [rbp + 0x620]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x628]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
xor esi, esi
test eax, eax
jne 0x140010bb2
lea ecx, [rsi + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea ecx, [rsi + 1]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x630]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, 8
lea rcx, [rbp + 0x638]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140010be9
lea ecx, [rax + 1]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.0khXOu9.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140010c26
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x3b40]
call fcn.1400526b0
lea rcx, [rbp + 0xc90]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.w2e54.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140010c84
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140070ed0], sil
je 0x140011927
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.3OkVJS.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140010cce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x640]
lea r8, [rbp + 0x648]
lea rdx, [rbp + 0x650]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x658]
lea r8, [rbp + 0x660]
lea rdx, [rbp + 0x668]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x670]
lea r8, [rbp + 0x678]
lea rdx, [rbp + 0x680]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x688]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140010d5d
lea esi, [rax + 1]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010dae
lea rax, [rbp + 0x690]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x698]
lea r8, [rbp + 0x6a0]
lea rdx, [rbp + 0x6a8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x6b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010e0c
lea rax, [rbp + 0x6b8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6c0]
lea r8, [rbp + 0x6c8]
lea rdx, [rbp + 0x6d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x430], 0x10
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0xe60]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010e7b
lea rax, [rbp + 0x6d8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6e0]
lea r8, [rbp + 0x6e8]
lea rdx, [rbp + 0x6f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
test rbx, rbx
je 0x140010e8f
lock inc dword [rbx + 8]
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], rbx
lea rdx, [rbp + 0xa0]
mov rcx, r15
call fcn.14000e208
xor r14d, r14d
test al, al
je 0x140011e24
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010f08
lea rax, [rbp + 0x6f8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x700]
lea r8, [rbp + 0x708]
lea rdx, [rbp + 0x710]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x42c], 0x10
lea rdx, [rbp + 0x42c]
lea rcx, [rbp + 0xe80]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.vcJh74l.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140010f63
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010fb4
lea rax, [rbp + 0x718]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x720]
lea r8, [rbp + 0x728]
lea rdx, [rbp + 0x730]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x428], 0x10
lea rdx, [rbp + 0x428]
lea rcx, [rbp + 0xea0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov esi, 0x400
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x3f40]
call fcn.1400526b0
lea r9, [rbp + 0x738]
lea r8, [rbp + 0x740]
lea rdx, [rbp + 0x748]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140011058
lea rax, [rbp + 0x750]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x758]
lea r8, [rbp + 0x760]
lea rdx, [rbp + 0x768]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.nU.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or rsi, 0xffffffffffffffff
cmp rax, rsi
je 0x140011098
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x424], 0x10
lea rdx, [rbp + 0x424]
lea rcx, [rbp + 0xec0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, r15
call fcn.14000da40
cmp al, 0x13
jne 0x140011d98
mov dl, 1
mov rcx, r15
call fcn.14000d050
test al, al
je 0x140011d98
mov dl, 0x10
mov rcx, r15
call fcn.14000d050
test al, al
je 0x140011d98
mov r8b, 1
lea rdx, [rbp + 0x328]
mov rcx, r15
call fcn.14000d79c
nop
or dword [rsp + 0x48], 1
lea rdx, [rbp + 0x3d1]
mov rcx, qword [rax]
call fcn.14000db0c
test al, al
je 0x14001111e
cmp byte [rbp + 0x3d1], r14b
jne 0x140011121
mov r14b, 1
mov eax, dword [rsp + 0x48]
test al, 1
je 0x140011169
and dword [rsp + 0x48], 0xfffffffe
mov rsi, qword [rbp + 0x330]
test rsi, rsi
je 0x140011165
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x140011165
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
or eax, 0xffffffff
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x140011165
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
or rsi, 0xffffffffffffffff
test r14b, r14b
jne 0x140011d98
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x80], xmm1
mov dl, 4
mov rcx, r15
call fcn.14000d050
xor r14d, r14d
test al, al
je 0x140011238
mov r8b, 4
lea rdx, [rbp + 0x348]
mov rcx, r15
call fcn.14000d79c
nop
lea rdx, [rbp + 0x338]
mov rcx, qword [rax]
call fcn.14000d68c
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x78], rcx
mov rsi, qword [rbp + 0x340]
test rsi, rsi
je 0x1400111ff
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1400111ff
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
or eax, 0xffffffff
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x1400111ff
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
nop
mov rsi, qword [rbp + 0x350]
test rsi, rsi
je 0x140011247
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x140011247
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
or eax, 0xffffffff
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x140011247
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
jmp 0x140011247
movdqa xmm0, xmmword [rbp - 0x80]
psrldq xmm0, 8
movq qword [rbp - 0x78], xmm0
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14001126b
lock inc dword [rcx + 8]
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0xb0], xmm0
mov r8b, 0x10
lea rdx, [rbp + 0x378]
mov rcx, r15
call fcn.14000d79c
nop
lea rdx, [rbp + 0x358]
mov rcx, qword [rax]
call fcn.14000d68c
nop
lea r9, [rbp + 0xb0]
mov r8, rax
lea rdx, [rbp + 0x368]
lea rcx, [0x140070ed0]
call fcn.14002424c
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rcx
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x1400112ff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1400112ff
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x1400112ff
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rbx, qword [rbp + 0x370]
test rbx, rbx
je 0x140011333
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x140011333
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140011333
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rbx, qword [rbp + 0x380]
test rbx, rbx
je 0x140011367
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x140011367
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140011367
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14001139c
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x14001139c
mov rbx, qword [rbp - 0x78]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x14001139c
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 8]
or r14, 0xffffffffffffffff
mov edx, 8
lea rcx, [rbp + 0x840]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov esi, 1
test eax, eax
jne 0x1400113cb
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ebx, 0x400
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x4f40]
call fcn.1400526b0
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x5340]
call fcn.1400526b0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.K.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x14001142e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x848]
lea r8, [rbp + 0x850]
lea rdx, [rbp + 0x858]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0xcc0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x860]
lea r8, [rbp + 0x868]
lea rdx, [rbp + 0x870]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp + 0x420], 0x10
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0xee0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0x41c], 0x10
lea rdx, [rbp + 0x41c]
lea rcx, [rbp + 0xf00]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140011509
lea rax, [rbp + 0x878]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x880]
lea r8, [rbp + 0x888]
lea rdx, [rbp + 0x890]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.14000d8dc
add r12d, eax
mov r15d, 0x400
mov r8d, r15d
xor edx, edx
lea rcx, [rbp + 0x5740]
call fcn.1400526b0
lea r9, [rbp + 0x898]
lea r8, [rbp + 0x8a0]
lea rdx, [rbp + 0x8a8]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0xcd0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x8b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x8b8]
lea r8, [rbp + 0x8c0]
lea rdx, [rbp + 0x8c8]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400115d8
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x8d8]
lea r8, [rbp + 0x8e0]
lea rdx, [rbp + 0x8e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xce0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, 8
mov edx, ebx
lea rcx, [rbp + 0x8f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001160d
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, ebx
lea rcx, [rbp + 0x8f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140011630
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.uARJ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x14001166c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x170], xmm0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140011685
lock add dword [rcx + 8], esi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x170], xmm0
lea rcx, [rbp + 0x170]
call fcn.140014808
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400116dc
mov eax, r14d
lock xadd dword [rcx + 8], eax
add eax, r14d
jne 0x1400116dc
mov rbx, qword [rsp + 0x78]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1400116dc
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 8]
nop
test rdi, rdi
je 0x14001170c
mov eax, r14d
lock xadd dword [rdi + 8], eax
add eax, r14d
jne 0x14001170c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, r14d
lock xadd dword [rdi + 0xc], eax
add eax, r14d
jne 0x14001170c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov edi, 8
cmp r12d, dword [rbp + 0x3d4]
jb 0x140010805
mov r12d, 0x88
lea rcx, [rbp + 0xcf0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x900]
lea r8, [rbp + 0x908]
lea rdx, [rbp + 0x910]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0xd00]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x918]
lea r8, [rbp + 0x920]
lea rdx, [rbp + 0x928]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x5b40]
call fcn.1400526b0
mov edx, edi
lea rcx, [rbp + 0x930]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400117b6
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.6IW.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x1400117f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x418], 0x10
lea rdx, [rbp + 0x418]
lea rcx, [rbp + 0xf20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001185f
lea rax, [rbp + 0x938]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x940]
lea r8, [rbp + 0x948]
lea rdx, [rbp + 0x950]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xd10]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rcx, qword [r13]
call fcn.14000da40
cmp al, 0x24
jne 0x140012329
mov r8b, 2
lea rdx, [rbp + 0x3b8]
mov rcx, qword [r13]
call fcn.14000d79c
nop
lea rdx, [rbp + 0x414]
mov rcx, qword [rax]
call fcn.14000da94
nop
mov rbx, qword [rbp + 0x3c0]
test rbx, rbx
je 0x1400118d8
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1400118d8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1400118d8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov edi, 0x68
mov ecx, edi
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140011e9f
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.1400526b0
lea r8d, [rdi - 0x58]
lea rdx, [0x140070e60]
mov rcx, rbx
call fcn.140008bb8
mov r13, rax
jmp 0x140011ea2
lea r9, [rbp + 0x778]
lea r8, [rbp + 0x780]
lea rdx, [rbp + 0x788]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14001199a
lea rax, [rbp + 0x790]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x798]
lea r8, [rbp + 0x7a0]
lea rdx, [rbp + 0x7a8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, 8
lea rcx, [rbp + 0x7b8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov esi, 1
test eax, eax
jne 0x1400119d2
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0x7c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400119f8
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, esi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x7c8]
lea r8, [rbp + 0x7d0]
lea rdx, [rbp + 0x7d8]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.wgpW020j.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or rsi, 0xffffffffffffffff
cmp rax, rsi
je 0x140011a5a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x4340]
call fcn.1400526b0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x4740]
call fcn.1400526b0
lea rcx, [rbp + 0x7e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
test rbx, rbx
je 0x140011aa0
lock inc dword [rbx + 8]
mov qword [rbp], r14
mov qword [rbp + 8], rbx
lea rdx, [rbp]
mov rcx, r15
call fcn.14000e208
test al, al
je 0x140011d98
lea r9, [rbp + 0x7e8]
lea r8, [rbp + 0x7f0]
lea rdx, [rbp + 0x7f8]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rbp + 0x800]
lea r8, [rbp + 0x808]
lea rdx, [rbp + 0x810]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x818]
call qword [sym.imp.USER32.dll_GetCursorPos]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea esi, [r9 + 1]
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.gYXWqndQxw.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or r14, 0xffffffffffffffff
cmp rax, r14
je 0x140011b51
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
lea rcx, str.Chyxq0wD.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
je 0x140011b8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x4b40]
call fcn.1400526b0
lea rcx, [rbp + 0xca0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x820]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x828]
lea r8, [rbp + 0x830]
lea rdx, [rbp + 0x838]
lea rcx, [0x140056e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rcx, r15
call fcn.14000da40
cmp al, 0x13
jne 0x1400113a0
mov dl, sil
mov rcx, r15
call fcn.14000d050
test al, al
je 0x140011e2d
mov dl, 0x10
mov rcx, r15
call fcn.14000d050
test al, al
je 0x140011e2d
mov r8b, sil
lea rdx, [rbp + 0x388]
mov rcx, r15
call fcn.14000d79c
nop
or dword [rsp + 0x48], 2
lea rdx, [rbp + 0x3d0]
mov rcx, qword [rax]
call fcn.14000db0c
test al, al
je 0x140011c58
cmp byte [rbp + 0x3d0], 0
jne 0x140011c58
xor r14b, r14b
jmp 0x140011c5b
mov r14b, sil
mov eax, dword [rsp + 0x48]
test al, 2
je 0x140011c9f
and dword [rsp + 0x48], 0xfffffffd
mov rsi, qword [rbp + 0x390]
test rsi, rsi
je 0x140011c9f
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x140011c9f
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
or eax, 0xffffffff
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x140011c9f
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
test r14b, r14b
jne 0x140011e24
mov r8b, 0x10
lea rdx, [rbp + 0x3a8]
mov rcx, r15
call fcn.14000d79c
nop
lea rdx, [rbp + 0x398]
mov rcx, qword [rax]
call fcn.14000d68c
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
and qword [rax], 0
and qword [rax + 8], 0
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rcx
or r14, 0xffffffffffffffff
test rbx, rbx
je 0x140011d18
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x140011d18
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140011d18
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rbx, qword [rbp + 0x3a0]
test rbx, rbx
je 0x140011d50
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x140011d50
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140011d50
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rbx, qword [rbp + 0x3b0]
test rbx, rbx
je 0x1400113a0
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1400113a0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1400113a0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x1400113a0
test rbx, rbx
je 0x140011dc5
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x140011dc5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140011dc5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
test rdi, rdi
je 0x140011df2
mov eax, esi
lock xadd dword [rdi + 8], eax
add eax, esi
jne 0x140011df2
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, esi
lock xadd dword [rdi + 0xc], eax
add eax, esi
jne 0x140011df2
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
nop
mov rbx, qword [r13 + 8]
test rbx, rbx
je 0x14001235d
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x14001235d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jmp 0x140012352
or rsi, 0xffffffffffffffff
jmp 0x140011d98
test rbx, rbx
je 0x140011e5e
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x140011e5e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140011e5e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
test rdi, rdi
je 0x140012329
mov eax, r14d
lock xadd dword [rdi + 8], eax
add eax, r14d
jne 0x140012329
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, r14d
lock xadd dword [rdi + 0xc], eax
add eax, r14d
jne 0x140012329
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
jmp 0x140012329
xor r13d, r13d
mov qword [rbp + 0x228], r13
mov edi, 0x18
mov ecx, edi
call fcn.14002dbd8
mov r15, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140011ede
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], esi
mov dword [rax + 0xc], esi
lea rax, vtable.JNZGFSYD_Y::_ELSHUNJATAD.0
mov qword [r15], rax
mov qword [r15 + 0x10], r13
jmp 0x140011ee1
xor r15d, r15d
mov qword [rbp + 0x1c0], r13
mov qword [rbp + 0x1c8], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov rcx, r12
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140011f2a
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov dl, 0x21
mov rcx, rbx
call fcn.14000c780
mov r12, rax
jmp 0x140011f2d
xor r12d, r12d
mov qword [rbp + 0x230], r12
mov rcx, rdi
call fcn.14002dbd8
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140011f65
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], esi
mov dword [rax + 0xc], esi
lea rax, vtable.XLBT::_LOFFVOSRN.0
mov qword [rdi], rax
mov qword [rdi + 0x10], r12
jmp 0x140011f67
xor edi, edi
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov r14d, 0x88
mov ecx, r14d
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140011fc1
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, esi
lea r8, [0x140056f1c]
mov dl, sil
mov rcx, rbx
call fcn.14000c89c
mov rbx, rax
jmp 0x140011fc3
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rbp + 0x238], rbx
mov ecx, 0x18
call fcn.14002dbd8
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140012007
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov eax, 1
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], eax
lea rax, vtable.XLBT::_LOFFVOSRN.0
mov qword [rsi], rax
mov qword [rsi + 0x10], rbx
jmp 0x140012009
xor esi, esi
mov qword [rbp + 0x1f0], rbx
mov qword [rbp + 0x1f8], rsi
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov rcx, r14
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001205f
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.1400526b0
mov r9d, 4
lea r8, [rbp + 0x414]
mov dl, 2
mov rcx, rbx
call fcn.14000c89c
mov rbx, rax
jmp 0x140012061
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x240], rbx
mov ecx, 0x18
call fcn.14002dbd8
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400120a7
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov eax, 1
mov dword [r14 + 8], eax
mov dword [r14 + 0xc], eax
lea rax, vtable.XLBT::_LOFFVOSRN.0
mov qword [r14], rax
mov qword [r14 + 0x10], rbx
jmp 0x1400120aa
xor r14d, r14d
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x208], r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov ecx, 0x88
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140012116
xor edx, edx
mov r8d, 0x88
mov rcx, rax
call fcn.1400526b0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
test r15, r15
je 0x1400120fb
lock inc dword [r15 + 8]
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r15
lea r8, [rbp - 0x10]
mov dl, 4
mov rcx, rbx
call fcn.14000cb78
mov r13, rax
jmp 0x140012119
xor r13d, r13d
mov qword [rbp + 0x258], r13
mov ecx, 0x18
call fcn.14002dbd8
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001215b
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.XLBT::_LOFFVOSRN.0
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
jmp 0x14001215d
xor ebx, ebx
mov qword [rbp + 0x210], r13
mov qword [rbp + 0x218], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
test rsi, rsi
je 0x14001217c
lock inc dword [rsi + 8]
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rsi
lea rdx, [rbp + 0x60]
mov rcx, r12
call fcn.14000ce44
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x90], xmm0
test r14, r14
je 0x1400121aa
lock inc dword [r14 + 8]
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], r14
lea rdx, [rbp + 0x90]
mov rcx, r12
call fcn.14000ce44
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
test rbx, rbx
je 0x1400121e0
lock inc dword [rbx + 8]
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], rbx
lea rdx, [rbp + 0x80]
mov rcx, r12
call fcn.14000ce44
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
test rdi, rdi
je 0x14001220e
lock inc dword [rdi + 8]
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], rdi
lea rdx, [rbp + 0x70]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call fcn.140028bb8
nop
test rbx, rbx
je 0x14001225a
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14001225a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
or eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14001225a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
test r14, r14
je 0x14001228d
or eax, 0xffffffff
lock xadd dword [r14 + 8], eax
cmp eax, 1
jne 0x14001228d
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
or eax, 0xffffffff
lock xadd dword [r14 + 0xc], eax
cmp eax, 1
jne 0x14001228d
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 8]
nop
or r14, 0xffffffffffffffff
test rsi, rsi
je 0x1400122c2
mov eax, r14d
lock xadd dword [rsi + 8], eax
add eax, r14d
jne 0x1400122c2
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov eax, r14d
lock xadd dword [rsi + 0xc], eax
add eax, r14d
jne 0x1400122c2
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
nop
test rdi, rdi
je 0x1400122f3
mov eax, r14d
lock xadd dword [rdi + 8], eax
add eax, r14d
jne 0x1400122f3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, r14d
lock xadd dword [rdi + 0xc], eax
add eax, r14d
jne 0x1400122f3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
nop
test r15, r15
je 0x140012325
mov eax, r14d
lock xadd dword [r15 + 8], eax
add eax, r14d
jne 0x140012325
mov rax, qword [r15]
mov rcx, r15
call qword [rax]
mov eax, r14d
lock xadd dword [r15 + 0xc], eax
add eax, r14d
jne 0x140012325
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 8]
mov r13, qword [rbp - 0x70]
mov rbx, qword [r13 + 8]
test rbx, rbx
je 0x14001235d
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x14001235d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x14001235d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rbp + 0x5f40]
xor rcx, rsp
call fcn.14002dcb0
mov rbx, qword [rsp + 0x60a0]
add rsp, 0x6050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret