Function at 0x1400b195c
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rdi
mov eax, 0x3fec0
call fcn.1400d9c00
sub rsp, rax
mov rax, qword [0x140134040]
xor rax, rsp
mov qword [rsp + 0x3feb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1700], rax
cmp qword [rsp + 0x1700], 0
je 0x1400b19e7
lea rax, [rsp + 0x3250]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3258]
lea r8, [rsp + 0x3260]
lea rdx, [rsp + 0x3268]
mov rcx, qword [rsp + 0x1700]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1700]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1708], 0x359149f3
lea rdx, str.0MNP
lea rcx, [rsp + 0x89d0]
call fcn.1400038c4
lea rcx, [rsp + 0x89d0]
call fcn.14000a750
mov r8d, dword [rsp + 0x1708]
mov rdx, rax
lea rcx, [0x1401227d8]
call fcn.140015614
lea rcx, [rsp + 0x89d0]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.q4UAPIg.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x17f0], rax
cmp qword [rsp + 0x17f0], 0xffffffffffffffff
je 0x1400b1a8c
mov rcx, qword [rsp + 0x17f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x798], 0x52d788c
lea rdx, str.77Nvh
lea rcx, [rsp + 0x89f0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x89f0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x798]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x89f0]
call fcn.14000389c
lea r9, [rsp + 0x3270]
lea r8, [rsp + 0x3278]
lea rdx, [rsp + 0x3280]
lea rcx, [0x140122810]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x3288]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.gEJX.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x17f8], rax
cmp qword [rsp + 0x17f8], 0xffffffffffffffff
je 0x1400b1b74
mov rcx, qword [rsp + 0x17f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xaf80]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xaf90]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xd2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
jmp 0x1400b1bb8
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x400
jae 0x1400b1be1
movsxd rax, dword [rsp + 0x40]
mov al, byte [rsp + rax + 0xd2b0]
inc al
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0xd2b0], al
jmp 0x1400b1bae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x16f8], rax
cmp qword [rsp + 0x16f8], 0
je 0x1400b1c4b
lea rax, [rsp + 0x3290]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3298]
lea r8, [rsp + 0x32a0]
lea rdx, [rsp + 0x32a8]
mov rcx, qword [rsp + 0x16f8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x16f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x32b0]
lea r8, [rsp + 0x32b8]
lea rdx, [rsp + 0x32c0]
lea rcx, [0x1401227f0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xafa0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x79c], 0x2f06647d
lea rdx, [0x140122844]
lea rcx, [rsp + 0x8a10]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8a10]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x79c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8a10]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.j7aP.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1800], rax
cmp qword [rsp + 0x1800], 0xffffffffffffffff
je 0x1400b1d33
mov rcx, qword [rsp + 0x1800]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x36c], 1
mov edx, 8
lea rcx, [rsp + 0x3218]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b1d8b
mov eax, dword [rsp + 0x3218]
mov dword [rsp + 0x2314], eax
mov eax, dword [rsp + 0x321c]
mov dword [rsp + 0x2318], eax
mov ecx, dword [rsp + 0x36c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x36c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x32c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x370], 1
mov edx, 8
lea rcx, [rsp + 0x3228]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b1df1
mov eax, dword [rsp + 0x3228]
mov dword [rsp + 0x231c], eax
mov eax, dword [rsp + 0x322c]
mov dword [rsp + 0x2320], eax
mov ecx, dword [rsp + 0x370]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x370]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x7a0], 0x7a9f65b
lea rdx, str.AZuuz
lea rcx, [rsp + 0x8a30]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8a30]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x7a0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8a30]
call fcn.14000389c
mov dword [rsp + 0x7a4], 0x39fcc1c4
lea rdx, str.viAgB
lea rcx, [rsp + 0x8a50]
call fcn.1400038c4
lea rcx, [rsp + 0x8a50]
call fcn.14000a750
mov r8d, dword [rsp + 0x7a4]
mov rdx, rax
lea rcx, [0x140122860]
call fcn.140015614
lea rcx, [rsp + 0x8a50]
call fcn.14000389c
lea r9, [rsp + 0x32d0]
lea r8, [rsp + 0x32d8]
lea rdx, [rsp + 0x32e0]
lea rcx, [0x140122858]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xd6b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
jmp 0x1400b1eee
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0x400
jae 0x1400b1f17
movsxd rax, dword [rsp + 0x44]
mov al, byte [rsp + rax + 0xd6b0]
inc al
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0xd6b0], al
jmp 0x1400b1ee4
lea r9, [rsp + 0x32e8]
lea r8, [rsp + 0x32f0]
lea rdx, [rsp + 0x32f8]
lea rcx, [0x140122850]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x2984], 0x10
lea rdx, [rsp + 0x2984]
lea rcx, [rsp + 0xb910]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x7b0], 0x151a94d
lea rdx, str.4tso5
lea rcx, [rsp + 0x8a70]
call fcn.1400038c4
lea rcx, [rsp + 0x8a70]
call fcn.14000a750
mov r8d, dword [rsp + 0x7b0]
mov rdx, rax
lea rcx, [0x140122898]
call fcn.140015614
lea rcx, [rsp + 0x8a70]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x16e8], rax
cmp qword [rsp + 0x16e8], 0
je 0x1400b2017
lea rax, [rsp + 0x3300]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3308]
lea r8, [rsp + 0x3310]
lea rdx, [rsp + 0x3318]
mov rcx, qword [rsp + 0x16e8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x16e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x3320]
lea r8, [rsp + 0x3328]
lea rdx, [rsp + 0x3330]
lea rcx, [0x140122890]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x374], 1
mov edx, 8
lea rcx, [rsp + 0x3238]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b2094
mov eax, dword [rsp + 0x3238]
mov dword [rsp + 0x2324], eax
mov eax, dword [rsp + 0x323c]
mov dword [rsp + 0x2328], eax
mov ecx, dword [rsp + 0x374]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x374]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x16e0], rax
cmp qword [rsp + 0x16e0], 0
je 0x1400b20fe
lea rax, [rsp + 0x3338]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3340]
lea r8, [rsp + 0x3348]
lea rdx, [rsp + 0x3350]
mov rcx, qword [rsp + 0x16e0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x16e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xdab0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
jmp 0x1400b2126
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x400
jae 0x1400b214f
movsxd rax, dword [rsp + 0x48]
mov al, byte [rsp + rax + 0xdab0]
inc al
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0xdab0], al
jmp 0x1400b211c
lea rcx, [rsp + 0x3358]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x16c8], rax
cmp qword [rsp + 0x16c8], 0
je 0x1400b21c7
lea rax, [rsp + 0x3360]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3368]
lea r8, [rsp + 0x3370]
lea rdx, [rsp + 0x3378]
mov rcx, qword [rsp + 0x16c8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x16c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x3380]
lea r8, [rsp + 0x3388]
lea rdx, [rsp + 0x3390]
lea rcx, [0x140122888]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Qv6nbYAE.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1808], rax
cmp qword [rsp + 0x1808], 0xffffffffffffffff
je 0x1400b2241
mov rcx, qword [rsp + 0x1808]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Ou3G.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1810], rax
cmp qword [rsp + 0x1810], 0xffffffffffffffff
je 0x1400b2296
mov rcx, qword [rsp + 0x1810]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xdeb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 0
jmp 0x1400b22be
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
cmp rax, 0x400
jae 0x1400b22e7
movsxd rax, dword [rsp + 0x4c]
mov al, byte [rsp + rax + 0xdeb0]
inc al
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0xdeb0], al
jmp 0x1400b22b4
lea r9, [rsp + 0x3398]
lea r8, [rsp + 0x33a0]
lea rdx, [rsp + 0x33a8]
lea rcx, [0x1401228b8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x378], 1
mov edx, 8
lea rcx, [rsp + 0x2b08]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b2364
mov eax, dword [rsp + 0x2b08]
mov dword [rsp + 0x232c], eax
mov eax, dword [rsp + 0x2b0c]
mov dword [rsp + 0x2330], eax
mov ecx, dword [rsp + 0x378]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x378]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x33b0]
lea r8, [rsp + 0x33b8]
lea rdx, [rsp + 0x33c0]
lea rcx, [0x1401228b0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x16b8], rax
cmp qword [rsp + 0x16b8], 0
je 0x1400b23f3
lea rax, [rsp + 0x33c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x33d0]
lea r8, [rsp + 0x33d8]
lea rdx, [rsp + 0x33e0]
mov rcx, qword [rsp + 0x16b8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x16b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2980], 0x10
lea rdx, [rsp + 0x2980]
lea rcx, [rsp + 0xb930]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x37c], 1
mov edx, 8
lea rcx, [rsp + 0x2b20]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b246c
mov eax, dword [rsp + 0x2b20]
mov dword [rsp + 0x2334], eax
mov eax, dword [rsp + 0x2b24]
mov dword [rsp + 0x2338], eax
mov ecx, dword [rsp + 0x37c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x37c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x380], 1
mov edx, 8
lea rcx, [rsp + 0x2b48]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b24c4
mov eax, dword [rsp + 0x2b48]
mov dword [rsp + 0x233c], eax
mov eax, dword [rsp + 0x2b4c]
mov dword [rsp + 0x2340], eax
mov ecx, dword [rsp + 0x380]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x380]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x384], 1
mov edx, 8
lea rcx, [rsp + 0x2b58]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b251c
mov eax, dword [rsp + 0x2b58]
mov dword [rsp + 0x2344], eax
mov eax, dword [rsp + 0x2b5c]
mov dword [rsp + 0x2348], eax
mov ecx, dword [rsp + 0x384]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x384]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x16b0], rax
cmp qword [rsp + 0x16b0], 0
je 0x1400b2586
lea rax, [rsp + 0x33e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x33f0]
lea r8, [rsp + 0x33f8]
lea rdx, [rsp + 0x3400]
mov rcx, qword [rsp + 0x16b0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x16b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x297c], 0x10
lea rdx, [rsp + 0x297c]
lea rcx, [rsp + 0xb950]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x3408]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xafb0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1401228a0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1818], rax
cmp qword [rsp + 0x1818], 0xffffffffffffffff
je 0x1400b2618
mov rcx, qword [rsp + 0x1818]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x7c8], 0x2bb1e3f3
lea rdx, [0x1401228e8]
lea rcx, [rsp + 0x8a90]
call fcn.1400038c4
lea rcx, [rsp + 0x8a90]
call fcn.14000a750
mov r8d, dword [rsp + 0x7c8]
mov rdx, rax
lea rcx, [0x1401228e0]
call fcn.140015614
lea rcx, [rsp + 0x8a90]
call fcn.14000389c
mov dword [rsp + 0x388], 1
mov edx, 8
lea rcx, [rsp + 0x2b68]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b26c0
mov eax, dword [rsp + 0x2b68]
mov dword [rsp + 0x234c], eax
mov eax, dword [rsp + 0x2b6c]
mov dword [rsp + 0x2350], eax
mov ecx, dword [rsp + 0x388]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x388]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xe2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x1400b26e8
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x1400b2711
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0xe2b0]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0xe2b0], al
jmp 0x1400b26de
lea rcx, [rsp + 0x3410]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1698], rax
cmp qword [rsp + 0x1698], 0
je 0x1400b2789
lea rax, [rsp + 0x3418]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3420]
lea r8, [rsp + 0x3428]
lea rdx, [rsp + 0x3430]
mov rcx, qword [rsp + 0x1698]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1698]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1678], rax
cmp qword [rsp + 0x1678], 0
je 0x1400b27f3
lea rax, [rsp + 0x3438]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3440]
lea r8, [rsp + 0x3448]
lea rdx, [rsp + 0x3450]
mov rcx, qword [rsp + 0x1678]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1678]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1668], rax
cmp qword [rsp + 0x1668], 0
je 0x1400b285d
lea rax, [rsp + 0x3458]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3460]
lea r8, [rsp + 0x3468]
lea rdx, [rsp + 0x3470]
mov rcx, qword [rsp + 0x1668]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1668]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x7cc], 0x3407dd5e
lea rdx, [0x1401228dc]
lea rcx, [rsp + 0x8ab0]
call fcn.1400038c4
lea rcx, [rsp + 0x8ab0]
call fcn.14000a750
mov r8d, dword [rsp + 0x7cc]
mov rdx, rax
lea rcx, [0x1401228d4]
call fcn.140015614
lea rcx, [rsp + 0x8ab0]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140122928]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1820], rax
cmp qword [rsp + 0x1820], 0xffffffffffffffff
je 0x1400b2902
mov rcx, qword [rsp + 0x1820]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3478]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x7d0], 0x321118de
lea rdx, str.uCw3
lea rcx, [rsp + 0x8ad0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8ad0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x7d0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8ad0]
call fcn.14000389c
lea rcx, [rsp + 0x3480]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1650], rax
cmp qword [rsp + 0x1650], 0
je 0x1400b29e8
lea rax, [rsp + 0x3488]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3490]
lea r8, [rsp + 0x3498]
lea rdx, [rsp + 0x34a0]
mov rcx, qword [rsp + 0x1650]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1650]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x7d4], 0x1b58c118
lea rdx, str.ZAedqbfHn
lea rcx, [rsp + 0x8af0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8af0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x7d4]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8af0]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.IDMZqjnn.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1828], rax
cmp qword [rsp + 0x1828], 0xffffffffffffffff
je 0x1400b2a9d
mov rcx, qword [rsp + 0x1828]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1640], rax
cmp qword [rsp + 0x1640], 0
je 0x1400b2b07
lea rax, [rsp + 0x34a8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34b0]
lea r8, [rsp + 0x34b8]
lea rdx, [rsp + 0x34c0]
mov rcx, qword [rsp + 0x1640]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1640]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xafc0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x7d8], 0x623ed85
lea rdx, str.LucaN
lea rcx, [rsp + 0x8b10]
call fcn.1400038c4
lea rcx, [rsp + 0x8b10]
call fcn.14000a750
mov r8d, dword [rsp + 0x7d8]
mov rdx, rax
lea rcx, [0x14012295c]
call fcn.140015614
lea rcx, [rsp + 0x8b10]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.L.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1830], rax
cmp qword [rsp + 0x1830], 0xffffffffffffffff
je 0x1400b2bba
mov rcx, qword [rsp + 0x1830]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.uknM.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1838], rax
cmp qword [rsp + 0x1838], 0xffffffffffffffff
je 0x1400b2c0f
mov rcx, qword [rsp + 0x1838]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x7dc], 0x141dab71
lea rdx, str.4v3f
lea rcx, [rsp + 0x8b30]
call fcn.1400038c4
lea rcx, [rsp + 0x8b30]
call fcn.14000a750
mov r8d, dword [rsp + 0x7dc]
mov rdx, rax
lea rcx, [0x140122984]
call fcn.140015614
lea rcx, [rsp + 0x8b30]
call fcn.14000389c
mov dword [rsp + 0x7e0], 0x29990791
lea rdx, str.jT8TMqxH4
lea rcx, [rsp + 0x8b50]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8b50]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x7e0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8b50]
call fcn.14000389c
lea r9, [rsp + 0x34c8]
lea r8, [rsp + 0x34d0]
lea rdx, [rsp + 0x34d8]
lea rcx, [0x140122970]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xe6b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x1400b2d0c
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x1400b2d35
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0xe6b0]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0xe6b0], al
jmp 0x1400b2d02
lea r9, [rsp + 0x34e0]
lea r8, [rsp + 0x34e8]
lea rdx, [rsp + 0x34f0]
lea rcx, [0x1401229b0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x34f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1638], rax
cmp qword [rsp + 0x1638], 0
je 0x1400b2dd2
lea rax, [rsp + 0x3500]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3508]
lea r8, [rsp + 0x3510]
lea rdx, [rsp + 0x3518]
mov rcx, qword [rsp + 0x1638]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1638]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xafd0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x3520]
lea r8, [rsp + 0x3528]
lea rdx, [rsp + 0x3530]
lea rcx, [0x1401229a8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x3538]
lea r8, [rsp + 0x3540]
lea rdx, [rsp + 0x3548]
lea rcx, [0x1401229a0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xafe0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x3550]
lea r8, [rsp + 0x3558]
lea rdx, [rsp + 0x3560]
lea rcx, [0x140122998]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.7bBX26o3b.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1840], rax
cmp qword [rsp + 0x1840], 0xffffffffffffffff
je 0x1400b2eb2
mov rcx, qword [rsp + 0x1840]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x3568]
lea r8, [rsp + 0x3570]
lea rdx, [rsp + 0x3578]
lea rcx, [0x1401229f0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.0SPUyBV8Fp.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1848], rax
cmp qword [rsp + 0x1848], 0xffffffffffffffff
je 0x1400b2f2c
mov rcx, qword [rsp + 0x1848]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x38c], 1
mov edx, 8
lea rcx, [rsp + 0x2b70]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b2f84
mov eax, dword [rsp + 0x2b70]
mov dword [rsp + 0x2354], eax
mov eax, dword [rsp + 0x2b74]
mov dword [rsp + 0x2358], eax
mov ecx, dword [rsp + 0x38c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x38c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.fVRf.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1850], rax
cmp qword [rsp + 0x1850], 0xffffffffffffffff
je 0x1400b2fd9
mov rcx, qword [rsp + 0x1850]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xaff0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x3580]
lea r8, [rsp + 0x3588]
lea rdx, [rsp + 0x3590]
lea rcx, [0x140122a40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.41.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1858], rax
cmp qword [rsp + 0x1858], 0xffffffffffffffff
je 0x1400b3061
mov rcx, qword [rsp + 0x1858]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x7e4], 0x220e1aef
lea rdx, str.VV8nftWD2Q
lea rcx, [rsp + 0x8b70]
call fcn.1400038c4
lea rcx, [rsp + 0x8b70]
call fcn.14000a750
mov r8d, dword [rsp + 0x7e4]
mov rdx, rax
lea rcx, [0x140122a14]
call fcn.140015614
lea rcx, [rsp + 0x8b70]
call fcn.14000389c
lea r9, [rsp + 0x3598]
lea r8, [rsp + 0x35a0]
lea rdx, [rsp + 0x35a8]
lea rcx, [0x140122a68]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x35b0]
lea r8, [rsp + 0x35b8]
lea rdx, [rsp + 0x35c0]
lea rcx, [0x140122a60]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xb000]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xb010]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x7e8], 0xe01cf7a
lea rdx, str.PC7EonSZ
lea rcx, [rsp + 0x8b90]
call fcn.1400038c4
lea rcx, [rsp + 0x8b90]
call fcn.14000a750
mov r8d, dword [rsp + 0x7e8]
mov rdx, rax
lea rcx, [0x140122a48]
call fcn.140015614
lea rcx, [rsp + 0x8b90]
call fcn.14000389c
lea rcx, [rsp + 0xb020]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x7ec], 0x1afafe60
lea rdx, str.qJWRT4Xmmh
lea rcx, [rsp + 0x8bb0]
call fcn.1400038c4
lea rcx, [rsp + 0x8bb0]
call fcn.14000a750
mov r8d, dword [rsp + 0x7ec]
mov rdx, rax
lea rcx, [0x140122a90]
call fcn.140015614
lea rcx, [rsp + 0x8bb0]
call fcn.14000389c
lea rcx, [rsp + 0x35c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x35d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x35d8]
lea r8, [rsp + 0x35e0]
lea rdx, [rsp + 0x35e8]
lea rcx, [0x140122a88]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xb030]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x390], 1
mov edx, 8
lea rcx, [rsp + 0x2b88]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b326c
mov eax, dword [rsp + 0x2b88]
mov dword [rsp + 0x235c], eax
mov eax, dword [rsp + 0x2b8c]
mov dword [rsp + 0x2360], eax
mov ecx, dword [rsp + 0x390]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x390]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xeab0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x1400b3294
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x1400b32bd
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0xeab0]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0xeab0], al
jmp 0x1400b328a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.jWQfeW.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1860], rax
cmp qword [rsp + 0x1860], 0xffffffffffffffff
je 0x1400b3312
mov rcx, qword [rsp + 0x1860]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x7f0], 0x2a5eccd4
lea rdx, str.f2ampsSE8
lea rcx, [rsp + 0x8bd0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8bd0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x7f0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8bd0]
call fcn.14000389c
lea rcx, [rsp + 0x35f0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x2978], 0x10
lea rdx, [rsp + 0x2978]
lea rcx, [rsp + 0xb970]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x2974], 0x10
lea rdx, [rsp + 0x2974]
lea rcx, [rsp + 0xb990]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x394], 1
mov edx, 8
lea rcx, [rsp + 0x2b90]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b341a
mov eax, dword [rsp + 0x2b90]
mov dword [rsp + 0x2364], eax
mov eax, dword [rsp + 0x2b94]
mov dword [rsp + 0x2368], eax
mov ecx, dword [rsp + 0x394]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x394]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x808], 0x35c36d3f
lea rdx, str.5B97ncX
lea rcx, [rsp + 0x8bf0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8bf0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x808]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8bf0]
call fcn.14000389c
lea rcx, [rsp + 0xb040]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x35f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x80c], 0x1f1f6065
lea rdx, str.hzhcE
lea rcx, [rsp + 0x8c10]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8c10]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x80c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8c10]
call fcn.14000389c
lea rcx, [rsp + 0xb050]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xeeb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x1400b352c
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x1400b3555
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0xeeb0]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0xeeb0], al
jmp 0x1400b3522
lea rcx, [rsp + 0xb060]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x3600]
lea r8, [rsp + 0x3608]
lea rdx, [rsp + 0x3610]
lea rcx, [0x140122aa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xb070]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xb080]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x398], 1
mov edx, 8
lea rcx, [rsp + 0x2b98]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b35fc
mov eax, dword [rsp + 0x2b98]
mov dword [rsp + 0x236c], eax
mov eax, dword [rsp + 0x2b9c]
mov dword [rsp + 0x2370], eax
mov ecx, dword [rsp + 0x398]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x398]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1628], rax
cmp qword [rsp + 0x1628], 0
je 0x1400b3666
lea rax, [rsp + 0x3618]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3620]
lea r8, [rsp + 0x3628]
lea rdx, [rsp + 0x3630]
mov rcx, qword [rsp + 0x1628]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1628]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x39c], 1
mov edx, 8
lea rcx, [rsp + 0x2bb0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b36be
mov eax, dword [rsp + 0x2bb0]
mov dword [rsp + 0x2374], eax
mov eax, dword [rsp + 0x2bb4]
mov dword [rsp + 0x2378], eax
mov ecx, dword [rsp + 0x39c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x39c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x3638]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x810], 0x10b777ac
lea rdx, str.1Kn43
lea rcx, [rsp + 0x8c30]
call fcn.1400038c4
lea rcx, [rsp + 0x8c30]
call fcn.14000a750
mov r8d, dword [rsp + 0x810]
mov rdx, rax
lea rcx, [0x140122ae8]
call fcn.140015614
lea rcx, [rsp + 0x8c30]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1618], rax
cmp qword [rsp + 0x1618], 0
je 0x1400b3786
lea rax, [rsp + 0x3640]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3648]
lea r8, [rsp + 0x3650]
lea rdx, [rsp + 0x3658]
mov rcx, qword [rsp + 0x1618]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1618]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3a0], 1
mov edx, 8
lea rcx, [rsp + 0x2bf8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b37de
mov eax, dword [rsp + 0x2bf8]
mov dword [rsp + 0x237c], eax
mov eax, dword [rsp + 0x2bfc]
mov dword [rsp + 0x2380], eax
mov ecx, dword [rsp + 0x3a0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3a0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1600], rax
cmp qword [rsp + 0x1600], 0
je 0x1400b3848
lea rax, [rsp + 0x3660]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3668]
lea r8, [rsp + 0x3670]
lea rdx, [rsp + 0x3678]
mov rcx, qword [rsp + 0x1600]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1600]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xf2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x1400b3870
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x1400b3899
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0xf2b0]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0xf2b0], al
jmp 0x1400b3866
lea rax, [rsp + 0xf6b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x1400b38c1
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x1400b38ea
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0xf6b0]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0xf6b0], al
jmp 0x1400b38b7
lea r9, [rsp + 0x3680]
lea r8, [rsp + 0x3688]
lea rdx, [rsp + 0x3690]
lea rcx, [0x140122ae0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x814], 0xd5b96f6
lea rdx, str.UCYmnBJSdR
lea rcx, [rsp + 0x8c50]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8c50]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x814]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8c50]
call fcn.14000389c
lea rcx, [rsp + 0xb090]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0xfab0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x1400b39a5
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x1400b39ce
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0xfab0]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0xfab0], al
jmp 0x1400b399b
mov dword [rsp + 0x818], 0xbec0c77
lea rdx, [0x140122b0c]
lea rcx, [rsp + 0x8c70]
call fcn.1400038c4
lea rcx, [rsp + 0x8c70]
call fcn.14000a750
mov r8d, dword [rsp + 0x818]
mov rdx, rax
lea rcx, [0x140122b04]
call fcn.140015614
lea rcx, [rsp + 0x8c70]
call fcn.14000389c
mov dword [rsp + 0x81c], 0x2779969d
lea rdx, [0x140122b00]
lea rcx, [rsp + 0x8c90]
call fcn.1400038c4
lea rcx, [rsp + 0x8c90]
call fcn.14000a750
mov r8d, dword [rsp + 0x81c]
mov rdx, rax
lea rcx, [0x140122af8]
call fcn.140015614
lea rcx, [rsp + 0x8c90]
call fcn.14000389c
lea r9, [rsp + 0x3698]
lea r8, [rsp + 0x36a0]
lea rdx, [rsp + 0x36a8]
lea rcx, [0x140122b28]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x36b0]
lea r8, [rsp + 0x36b8]
lea rdx, [rsp + 0x36c0]
lea rcx, [0x140122b20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x820], 0x3781e3eb
lea rdx, [0x140122b1c]
lea rcx, [rsp + 0x8cb0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8cb0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x820]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8cb0]
call fcn.14000389c
lea rax, [rsp + 0xfeb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x1400b3b40
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x1400b3b69
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0xfeb0]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0xfeb0], al
jmp 0x1400b3b36
mov dword [rsp + 0x824], 0x216acbe2
lea rdx, str.rmwcFJfd3J
lea rcx, [rsp + 0x8cd0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8cd0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x824]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8cd0]
call fcn.14000389c
mov dword [rsp + 0x828], 0x2701b9ad
lea rdx, str.2riFaDr
lea rcx, [rsp + 0x8cf0]
call fcn.1400038c4
lea rcx, [rsp + 0x8cf0]
call fcn.14000a750
mov r8d, dword [rsp + 0x828]
mov rdx, rax
lea rcx, [0x140122b40]
call fcn.140015614
lea rcx, [rsp + 0x8cf0]
call fcn.14000389c
lea r9, [rsp + 0x36c8]
lea r8, [rsp + 0x36d0]
lea rdx, [rsp + 0x36d8]
lea rcx, [0x140122b38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x82c], 0x15f1d1c1
lea rdx, [0x140122b30]
lea rcx, [rsp + 0x8d10]
call fcn.1400038c4
lea rcx, [rsp + 0x8d10]
call fcn.14000a750
mov r8d, dword [rsp + 0x82c]
mov rdx, rax
lea rcx, [0x140122b64]
call fcn.140015614
lea rcx, [rsp + 0x8d10]
call fcn.14000389c
mov dword [rsp + 0x2970], 0x10
lea rdx, [rsp + 0x2970]
lea rcx, [rsp + 0xb9b0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x838], 0x3857db0
lea rdx, str.XDcB
lea rcx, [rsp + 0x8d30]
call fcn.1400038c4
lea rcx, [rsp + 0x8d30]
call fcn.14000a750
mov r8d, dword [rsp + 0x838]
mov rdx, rax
lea rcx, [0x140122b54]
call fcn.140015614
lea rcx, [rsp + 0x8d30]
call fcn.14000389c
mov dword [rsp + 0x83c], 0x6ac75c9
lea rdx, [0x140122b50]
lea rcx, [rsp + 0x8d50]
call fcn.1400038c4
lea rcx, [rsp + 0x8d50]
call fcn.14000a750
mov r8d, dword [rsp + 0x83c]
mov rdx, rax
lea rcx, [0x140122b98]
call fcn.140015614
lea rcx, [rsp + 0x8d50]
call fcn.14000389c
mov dword [rsp + 0x3a4], 1
mov edx, 8
lea rcx, [rsp + 0x2c00]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b3da7
mov eax, dword [rsp + 0x2c00]
mov dword [rsp + 0x2384], eax
mov eax, dword [rsp + 0x2c04]
mov dword [rsp + 0x2388], eax
mov ecx, dword [rsp + 0x3a4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3a4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x840], 0x2780b20e
lea rdx, str.9vAQme9
lea rcx, [rsp + 0x8d70]
call fcn.1400038c4
lea rcx, [rsp + 0x8d70]
call fcn.14000a750
mov r8d, dword [rsp + 0x840]
mov rdx, rax
lea rcx, [0x140122b84]
call fcn.140015614
lea rcx, [rsp + 0x8d70]
call fcn.14000389c
lea rax, [rsp + 0x102b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x1400b3e1f
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x1400b3e48
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0x102b0]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0x102b0], al
jmp 0x1400b3e15
lea rcx, [rsp + 0x36e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.TIlb.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1868], rax
cmp qword [rsp + 0x1868], 0xffffffffffffffff
je 0x1400b3eab
mov rcx, qword [rsp + 0x1868]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x106b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x1400b3ed3
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x1400b3efc
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0x106b0]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0x106b0], al
jmp 0x1400b3ec9
lea r9, [rsp + 0x36e8]
lea r8, [rsp + 0x36f0]
lea rdx, [rsp + 0x36f8]
lea rcx, [0x140122bc0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0xb0a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x844], 0x2ff65da2
lea rdx, [0x140122bb8]
lea rcx, [rsp + 0x8d90]
call fcn.1400038c4
lea rcx, [rsp + 0x8d90]
call fcn.14000a750
mov r8d, dword [rsp + 0x844]
mov rdx, rax
lea rcx, [0x140122bb0]
call fcn.140015614
lea rcx, [rsp + 0x8d90]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.18.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1870], rax
cmp qword [rsp + 0x1870], 0xffffffffffffffff
je 0x1400b3fd4
mov rcx, qword [rsp + 0x1870]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x848], 0x2a74cedb
lea rdx, str.YFlsDYzd
lea rcx, [rsp + 0x8db0]
call fcn.1400038c4
lea rcx, [rsp + 0x8db0]
call fcn.14000a750
mov r8d, dword [rsp + 0x848]
mov rdx, rax
lea rcx, [0x140122bd8]
call fcn.140015614
lea rcx, [rsp + 0x8db0]
call fcn.14000389c
mov dword [rsp + 0x84c], 0x340c5504
lea rdx, str.EZsvc8D
lea rcx, [rsp + 0x8dd0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8dd0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x84c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8dd0]
call fcn.14000389c
lea rcx, [rsp + 0xb0b0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xb0c0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xb0d0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x3700]
lea r8, [rsp + 0x3708]
lea rdx, [rsp + 0x3710]
lea rcx, [0x140122bc8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x10ab0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x1400b40fb
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x1400b4124
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0x10ab0]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0x10ab0], al
jmp 0x1400b40f1
mov dword [rsp + 0x296c], 0x10
lea rdx, [rsp + 0x296c]
lea rcx, [rsp + 0xb9d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x10eb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x1400b416d
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x1400b4196
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0x10eb0]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0x10eb0], al
jmp 0x1400b4163
lea rcx, [rsp + 0xb0e0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xb0f0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xb100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x858], 0x182b287c
lea rdx, [0x140122c18]
lea rcx, [rsp + 0x8df0]
call fcn.1400038c4
lea rcx, [rsp + 0x8df0]
call fcn.14000a750
mov r8d, dword [rsp + 0x858]
mov rdx, rax
lea rcx, [0x140122c10]
call fcn.140015614
lea rcx, [rsp + 0x8df0]
call fcn.14000389c
mov dword [rsp + 0x85c], 0x34c5eb6e
lea rdx, str.nA3HNZc
lea rcx, [rsp + 0x8e10]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8e10]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x85c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8e10]
call fcn.14000389c
lea rax, [rsp + 0x112b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x1400b42a1
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x1400b42d3
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0x112b0]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0x112b0], al
jmp 0x1400b4291
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.ykgLSL.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1878], rax
cmp qword [rsp + 0x1878], 0xffffffffffffffff
je 0x1400b4328
mov rcx, qword [rsp + 0x1878]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x116b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x1400b4359
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x1400b438b
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0x116b0]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0x116b0], al
jmp 0x1400b4349
mov dword [rsp + 0x860], 0x17af51eb
lea rdx, [0x140122c58]
lea rcx, [rsp + 0x8e30]
call fcn.1400038c4
lea rcx, [rsp + 0x8e30]
call fcn.14000a750
mov r8d, dword [rsp + 0x860]
mov rdx, rax
lea rcx, [0x140122c50]
call fcn.140015614
lea rcx, [rsp + 0x8e30]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.X6O.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1880], rax
cmp qword [rsp + 0x1880], 0xffffffffffffffff
je 0x1400b4430
mov rcx, qword [rsp + 0x1880]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.0lm8ON81ap.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1888], rax
cmp qword [rsp + 0x1888], 0xffffffffffffffff
je 0x1400b4485
mov rcx, qword [rsp + 0x1888]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x11ab0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0
jmp 0x1400b44b6
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
movsxd rax, dword [rsp + 0x88]
cmp rax, 0x400
jae 0x1400b44e8
movsxd rax, dword [rsp + 0x88]
mov al, byte [rsp + rax + 0x11ab0]
inc al
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0x11ab0], al
jmp 0x1400b44a6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x15e8], rax
cmp qword [rsp + 0x15e8], 0
je 0x1400b4552
lea rax, [rsp + 0x3718]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3720]
lea r8, [rsp + 0x3728]
lea rdx, [rsp + 0x3730]
mov rcx, qword [rsp + 0x15e8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x15e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3738]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x11eb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x8c], 0
jmp 0x1400b4591
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
movsxd rax, dword [rsp + 0x8c]
cmp rax, 0x400
jae 0x1400b45c3
movsxd rax, dword [rsp + 0x8c]
mov al, byte [rsp + rax + 0x11eb0]
inc al
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0x11eb0], al
jmp 0x1400b4581
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x15d8], rax
cmp qword [rsp + 0x15d8], 0
je 0x1400b462d
lea rax, [rsp + 0x3740]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3748]
lea r8, [rsp + 0x3750]
lea rdx, [rsp + 0x3758]
mov rcx, qword [rsp + 0x15d8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x15d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x122b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
jmp 0x1400b465e
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 0x400
jae 0x1400b4690
movsxd rax, dword [rsp + 0x90]
mov al, byte [rsp + rax + 0x122b0]
inc al
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0x122b0], al
jmp 0x1400b464e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x15c0], rax
cmp qword [rsp + 0x15c0], 0
je 0x1400b46fa
lea rax, [rsp + 0x3760]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3768]
lea r8, [rsp + 0x3770]
lea rdx, [rsp + 0x3778]
mov rcx, qword [rsp + 0x15c0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x15c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2968], 0x10
lea rdx, [rsp + 0x2968]
lea rcx, [rsp + 0xb9f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x3780]
lea r8, [rsp + 0x3788]
lea rdx, [rsp + 0x3790]
lea rcx, [0x140122c90]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x3798]
lea r8, [rsp + 0x37a0]
lea rdx, [rsp + 0x37a8]
lea rcx, [0x140122c88]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x37b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.gD0rg.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1890], rax
cmp qword [rsp + 0x1890], 0xffffffffffffffff
je 0x1400b47c8
mov rcx, qword [rsp + 0x1890]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x870], 0x2c7a6fc7
lea rdx, str.yzO9gKyeM4
lea rcx, [rsp + 0x8e50]
call fcn.1400038c4
lea rcx, [rsp + 0x8e50]
call fcn.14000a750
mov r8d, dword [rsp + 0x870]
mov rdx, rax
lea rcx, [0x140122cc4]
call fcn.140015614
lea rcx, [rsp + 0x8e50]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x15a8], rax
cmp qword [rsp + 0x15a8], 0
je 0x1400b4882
lea rax, [rsp + 0x37b8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x37c0]
lea r8, [rsp + 0x37c8]
lea rdx, [rsp + 0x37d0]
mov rcx, qword [rsp + 0x15a8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x15a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x874], 0x15cfb2d8
lea rdx, str.YReCd2s4
lea rcx, [rsp + 0x8e70]
call fcn.1400038c4
lea rcx, [rsp + 0x8e70]
call fcn.14000a750
mov r8d, dword [rsp + 0x874]
mov rdx, rax
lea rcx, [0x140122cb0]
call fcn.140015614
lea rcx, [rsp + 0x8e70]
call fcn.14000389c
lea rax, [rsp + 0x126b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x94], 0
jmp 0x1400b4903
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
cmp rax, 0x400
jae 0x1400b4935
movsxd rax, dword [rsp + 0x94]
mov al, byte [rsp + rax + 0x126b0]
inc al
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0x126b0], al
jmp 0x1400b48f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1580], rax
cmp qword [rsp + 0x1580], 0
je 0x1400b499f
lea rax, [rsp + 0x37d8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x37e0]
lea r8, [rsp + 0x37e8]
lea rdx, [rsp + 0x37f0]
mov rcx, qword [rsp + 0x1580]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1580]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.58QPEsZ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1898], rax
cmp qword [rsp + 0x1898], 0xffffffffffffffff
je 0x1400b49f4
mov rcx, qword [rsp + 0x1898]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xb110]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.V0Fi4.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x18a0], rax
cmp qword [rsp + 0x18a0], 0xffffffffffffffff
je 0x1400b4a57
mov rcx, qword [rsp + 0x18a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2964], 0x10
lea rdx, [rsp + 0x2964]
lea rcx, [rsp + 0xba10]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x880], 0x1e95a065
lea rdx, str.DVQkG
lea rcx, [rsp + 0x8e90]
call fcn.1400038c4
lea rcx, [rsp + 0x8e90]
call fcn.14000a750
mov r8d, dword [rsp + 0x880]
mov rdx, rax
lea rcx, [0x140122cd0]
call fcn.140015614
lea rcx, [rsp + 0x8e90]
call fcn.14000389c
mov dword [rsp + 0x3a8], 1
mov edx, 8
lea rcx, [rsp + 0x2c20]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b4b20
mov eax, dword [rsp + 0x2c20]
mov dword [rsp + 0x238c], eax
mov eax, dword [rsp + 0x2c24]
mov dword [rsp + 0x2390], eax
mov ecx, dword [rsp + 0x3a8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3a8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x884], 0x1a24b773
lea rdx, [0x140122ccc]
lea rcx, [rsp + 0x8eb0]
call fcn.1400038c4
lea rcx, [rsp + 0x8eb0]
call fcn.14000a750
mov r8d, dword [rsp + 0x884]
mov rdx, rax
lea rcx, [0x140122d3c]
call fcn.140015614
lea rcx, [rsp + 0x8eb0]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.vp9Yl.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x18a8], rax
cmp qword [rsp + 0x18a8], 0xffffffffffffffff
je 0x1400b4bc5
mov rcx, qword [rsp + 0x18a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3ac], 1
mov edx, 8
lea rcx, [rsp + 0x2c28]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b4c1d
mov eax, dword [rsp + 0x2c28]
mov dword [rsp + 0x2394], eax
mov eax, dword [rsp + 0x2c2c]
mov dword [rsp + 0x2398], eax
mov ecx, dword [rsp + 0x3ac]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3ac]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x2960], 0x10
lea rdx, [rsp + 0x2960]
lea rcx, [rsp + 0xba30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.iPIBx9.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x18b0], rax
cmp qword [rsp + 0x18b0], 0xffffffffffffffff
je 0x1400b4c93
mov rcx, qword [rsp + 0x18b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.x6LoDb.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x18b8], rax
cmp qword [rsp + 0x18b8], 0xffffffffffffffff
je 0x1400b4ce8
mov rcx, qword [rsp + 0x18b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x295c], 0x10
lea rdx, [rsp + 0x295c]
lea rcx, [rsp + 0xba50]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x898], 0x29f80ab2
lea rdx, str.wAvU
lea rcx, [rsp + 0x8ed0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8ed0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x898]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8ed0]
call fcn.14000389c
lea rcx, [rsp + 0x37f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.UYlrkEj.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x18c0], rax
cmp qword [rsp + 0x18c0], 0xffffffffffffffff
je 0x1400b4dcc
mov rcx, qword [rsp + 0x18c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x89c], 0x128b0301
lea rdx, str.SLA2
lea rcx, [rsp + 0x8ef0]
call fcn.1400038c4
lea rcx, [rsp + 0x8ef0]
call fcn.14000a750
mov r8d, dword [rsp + 0x89c]
mov rdx, rax
lea rcx, [0x140122d44]
call fcn.140015614
lea rcx, [rsp + 0x8ef0]
call fcn.14000389c
lea r9, [rsp + 0x3800]
lea r8, [rsp + 0x3808]
lea rdx, [rsp + 0x3810]
lea rcx, [0x140122d98]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x12ab0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0
jmp 0x1400b4e72
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
movsxd rax, dword [rsp + 0x98]
cmp rax, 0x400
jae 0x1400b4ea4
movsxd rax, dword [rsp + 0x98]
mov al, byte [rsp + rax + 0x12ab0]
inc al
movsxd rcx, dword [rsp + 0x98]
mov byte [rsp + rcx + 0x12ab0], al
jmp 0x1400b4e62
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1570], rax
cmp qword [rsp + 0x1570], 0
je 0x1400b4f0e
lea rax, [rsp + 0x3818]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3820]
lea r8, [rsp + 0x3828]
lea rdx, [rsp + 0x3830]
mov rcx, qword [rsp + 0x1570]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1570]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x12eb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x9c], 0
jmp 0x1400b4f3f
mov eax, dword [rsp + 0x9c]
inc eax
mov dword [rsp + 0x9c], eax
movsxd rax, dword [rsp + 0x9c]
cmp rax, 0x400
jae 0x1400b4f71
movsxd rax, dword [rsp + 0x9c]
mov al, byte [rsp + rax + 0x12eb0]
inc al
movsxd rcx, dword [rsp + 0x9c]
mov byte [rsp + rcx + 0x12eb0], al
jmp 0x1400b4f2f
mov dword [rsp + 0x2958], 0x10
lea rdx, [rsp + 0x2958]
lea rcx, [rsp + 0xba70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3b0], 1
mov edx, 8
lea rcx, [rsp + 0x2c40]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b4fea
mov eax, dword [rsp + 0x2c40]
mov dword [rsp + 0x239c], eax
mov eax, dword [rsp + 0x2c44]
mov dword [rsp + 0x23a0], eax
mov ecx, dword [rsp + 0x3b0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3b0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x3838]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xb120]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x3b4], 1
mov edx, 8
lea rcx, [rsp + 0x2c60]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b505e
mov eax, dword [rsp + 0x2c60]
mov dword [rsp + 0x23a4], eax
mov eax, dword [rsp + 0x2c64]
mov dword [rsp + 0x2310], eax
mov ecx, dword [rsp + 0x3b4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3b4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x3840]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x8a8], 0x1e508080
lea rdx, str.CGxgWlf59
lea rcx, [rsp + 0x8f10]
call fcn.1400038c4
lea rcx, [rsp + 0x8f10]
call fcn.14000a750
mov r8d, dword [rsp + 0x8a8]
mov rdx, rax
lea rcx, [0x140122d80]
call fcn.140015614
lea rcx, [rsp + 0x8f10]
call fcn.14000389c
lea rcx, [rsp + 0xb130]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x3848]
lea r8, [rsp + 0x3850]
lea rdx, [rsp + 0x3858]
lea rcx, [0x140122d78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x8ac], 0x29629355
lea rdx, str.Wgfe
lea rcx, [rsp + 0x8f30]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8f30]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x8ac]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8f30]
call fcn.14000389c
lea r9, [rsp + 0x3860]
lea r8, [rsp + 0x3868]
lea rdx, [rsp + 0x3870]
lea rcx, [0x140122dc8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.60td.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x18c8], rax
cmp qword [rsp + 0x18c8], 0xffffffffffffffff
je 0x1400b51c9
mov rcx, qword [rsp + 0x18c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3878]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x2954], 0x10
lea rdx, [rsp + 0x2954]
lea rcx, [rsp + 0xba90]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3b8], 1
mov edx, 8
lea rcx, [rsp + 0x2c90]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b5250
mov eax, dword [rsp + 0x2c90]
mov dword [rsp + 0x23ac], eax
mov eax, dword [rsp + 0x2c94]
mov dword [rsp + 0x23b0], eax
mov ecx, dword [rsp + 0x3b8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3b8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x132b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
jmp 0x1400b5281
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
cmp rax, 0x400
jae 0x1400b52b3
movsxd rax, dword [rsp + 0xa0]
mov al, byte [rsp + rax + 0x132b0]
inc al
movsxd rcx, dword [rsp + 0xa0]
mov byte [rsp + rcx + 0x132b0], al
jmp 0x1400b5271
mov dword [rsp + 0x3bc], 1
mov edx, 8
lea rcx, [rsp + 0x2ca0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b530b
mov eax, dword [rsp + 0x2ca0]
mov dword [rsp + 0x23b4], eax
mov eax, dword [rsp + 0x2ca4]
mov dword [rsp + 0x23b8], eax
mov ecx, dword [rsp + 0x3bc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3bc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x8b8], 0x2f68f7a3
lea rdx, str.zdDkNicJ
lea rcx, [rsp + 0x8f50]
call fcn.1400038c4
lea rcx, [rsp + 0x8f50]
call fcn.14000a750
mov r8d, dword [rsp + 0x8b8]
mov rdx, rax
lea rcx, [0x140122df0]
call fcn.140015614
lea rcx, [rsp + 0x8f50]
call fcn.14000389c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1560], rax
cmp qword [rsp + 0x1560], 0
je 0x1400b53c5
lea rax, [rsp + 0x3880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3888]
lea r8, [rsp + 0x3890]
lea rdx, [rsp + 0x3898]
mov rcx, qword [rsp + 0x1560]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1560]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xb140]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x38a0]
lea r8, [rsp + 0x38a8]
lea rdx, [rsp + 0x38b0]
lea rcx, [0x140122de8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x2950], 0x10
lea rdx, [rsp + 0x2950]
lea rcx, [rsp + 0xbab0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x38b8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0xb150]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xb160]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x8c8], 0x33664228
lea rdx, str.ArcIk
lea rcx, [rsp + 0x8f70]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8f70]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x8c8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8f70]
call fcn.14000389c
mov dword [rsp + 0x294c], 0x10
lea rdx, [rsp + 0x294c]
lea rcx, [rsp + 0xbad0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x8d8], 0x1437f1e
lea rdx, str.LWnrul
lea rcx, [rsp + 0x8f90]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8f90]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x8d8]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8f90]
call fcn.14000389c
mov dword [rsp + 0x8dc], 0x2aabb88d
lea rdx, str.kzMBTzg
lea rcx, [rsp + 0x8fb0]
call fcn.1400038c4
lea rcx, [rsp + 0x8fb0]
call fcn.14000a750
mov r8d, dword [rsp + 0x8dc]
mov rdx, rax
lea rcx, [0x140122e1c]
call fcn.140015614
lea rcx, [rsp + 0x8fb0]
call fcn.14000389c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.4Tgvas47.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x18d0], rax
cmp qword [rsp + 0x18d0], 0xffffffffffffffff
je 0x1400b55c9
mov rcx, qword [rsp + 0x18d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x38c0]
lea r8, [rsp + 0x38c8]
lea rdx, [rsp + 0x38d0]
lea rcx, [0x140122df8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x38d8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x8e0], 0x389b5330
lea rdx, [0x140122e4c]
lea rcx, [rsp + 0x8fd0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8fd0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x8e0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8fd0]
call fcn.14000389c
lea rcx, [rsp + 0xb170]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x3c0], 1
mov edx, 8
lea rcx, [rsp + 0x2cb8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b56c2
mov eax, dword [rsp + 0x2cb8]
mov dword [rsp + 0x23bc], eax
mov eax, dword [rsp + 0x2cbc]
mov dword [rsp + 0x23c0], eax
mov ecx, dword [rsp + 0x3c0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3c0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x2948], 0x10
lea rdx, [rsp + 0x2948]
lea rcx, [rsp + 0xbaf0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3c4], 1
mov edx, 8
lea rcx, [rsp + 0x2ce8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b573b
mov eax, dword [rsp + 0x2ce8]
mov dword [rsp + 0x23c4], eax
mov eax, dword [rsp + 0x2cec]
mov dword [rsp + 0x23c8], eax
mov ecx, dword [rsp + 0x3c4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3c4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x3c8], 1
mov edx, 8
lea rcx, [rsp + 0x2cf8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b5793
mov eax, dword [rsp + 0x2cf8]
mov dword [rsp + 0x23cc], eax
mov eax, dword [rsp + 0x2cfc]
mov dword [rsp + 0x23d0], eax
mov ecx, dword [rsp + 0x3c8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3c8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x3cc], 1
mov edx, 8
lea rcx, [rsp + 0x2d18]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b57eb
mov eax, dword [rsp + 0x2d18]
mov dword [rsp + 0x23d4], eax
mov eax, dword [rsp + 0x2d1c]
mov dword [rsp + 0x23d8], eax
mov ecx, dword [rsp + 0x3cc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3cc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x8f0], 0x2bf1cc99
lea rdx, str.3UJa0NcXOX
lea rcx, [rsp + 0x8ff0]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x8ff0]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x8f0]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x8ff0]
call fcn.14000389c
lea rcx, [rsp + 0xb180]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x2940], 0x10
lea rdx, [rsp + 0x2940]
lea rcx, [rsp + 0xbb10]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x38e0]
lea r8, [rsp + 0x38e8]
lea rdx, [rsp + 0x38f0]
lea rcx, [0x140122e38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3d0], 1
mov edx, 8
lea rcx, [rsp + 0x2d20]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b58f7
mov eax, dword [rsp + 0x2d20]
mov dword [rsp + 0x23dc], eax
mov eax, dword [rsp + 0x2d24]
mov dword [rsp + 0x23e0], eax
mov ecx, dword [rsp + 0x3d0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x3d0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x293c], 0x10
lea rdx, [rsp + 0x293c]
lea rcx, [rsp + 0xbb30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x908], 0x24de69ff
lea rdx, str.cRCo
lea rcx, [rsp + 0x9010]
call fcn.1400038c4
lea rcx, [rsp + 0x9010]
call fcn.14000a750
mov r8d, dword [rsp + 0x908]
mov rdx, rax
lea rcx, [0x140122e68]
call fcn.140015614
lea rcx, [rsp + 0x9010]
call fcn.14000389c
lea rcx, [rsp + 0xb190]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x90c], 0x2f42baa2
lea rdx, [0x140122e64]
lea rcx, [rsp + 0x9030]
call fcn.1400038c4
nop
lea rdx, [rsp + 0x9030]
lea rcx, [0x1401362a0]
call fcn.14004e420
mov edx, dword [rsp + 0x90c]
mov rcx, rax
call fcn.14004b9ec
lea rdx, [0x14004e464]
mov rcx, rax
call fcn.14004bc24
nop
lea rcx, [rsp + 0x9030]
call fcn.14000389c
mov dword [rsp + 0x910], 0x2a02c754
lea rdx, str.ChBvfyb5
lea rcx, [rsp + 0x9050]
call fcn.1400038c4
lea rcx, [rsp + 0x9050]
call fcn.14000a750
mov r8d, dword [rsp + 0x910]
mov rdx, rax
lea rcx, [0x140122e50]
call fcn.140015614
lea rcx, [rsp + 0x9050]
call fcn.14000389c
lea r9, [rsp + 0x38f8]
lea r8, [rsp + 0x3900]
lea rdx, [rsp + 0x3908]
lea rcx, [0x140122eb0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3d4], 1
mov edx, 8
lea rcx, [rsp + 0x2d30]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400b5aa3