Function at 0x1400968b4
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rdi
mov eax, 0x37da0
call fcn.1400b6760
sub rsp, rax
mov rax, qword [0x14010c080]
xor rax, rsp
mov qword [rsp + 0x37d90], rax
lea r9, [rsp + 0x26f8]
lea r8, [rsp + 0x2700]
lea rdx, [rsp + 0x2708]
lea rcx, [0x1400edc08]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x123c], 0x2269728e
lea rdx, str.E0jzNdx5Q
lea rcx, [rsp + 0x6638]
call fcn.140003708
lea rcx, [rsp + 0x6638]
call fcn.14000a93c
mov r8d, dword [rsp + 0x123c]
mov rdx, rax
lea rcx, [0x1400edc1c]
call fcn.140044734
lea rcx, [rsp + 0x6638]
call fcn.1400040f0
lea rax, [rsp + 0xa190]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
jmp 0x140096972
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x400
jae 0x14009699b
movsxd rax, dword [rsp + 0x40]
mov al, byte [rsp + rax + 0xa190]
inc al
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0xa190], al
jmp 0x140096968
mov dword [rsp + 0x201c], 0x10
lea rdx, [rsp + 0x201c]
lea rcx, [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x86b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x620], 0x684071b
lea rdx, [0x1400edc24]
lea rcx, [rsp + 0x6658]
call fcn.140003708
lea rcx, [rsp + 0x6658]
call fcn.14000a93c
mov r8d, dword [rsp + 0x620]
mov rdx, rax
lea rcx, [0x1400edc28]
call fcn.140044734
lea rcx, [rsp + 0x6658]
call fcn.1400040f0
lea rax, [rsp + 0xa590]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
jmp 0x140096a42
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0x400
jae 0x140096a6b
movsxd rax, dword [rsp + 0x44]
mov al, byte [rsp + rax + 0xa590]
inc al
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0xa590], al
jmp 0x140096a38
lea rax, [rsp + 0xa990]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
jmp 0x140096a93
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x400
jae 0x140096abc
movsxd rax, dword [rsp + 0x48]
mov al, byte [rsp + rax + 0xa990]
inc al
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0xa990], al
jmp 0x140096a89
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.weSjZns.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1300], rax
cmp qword [rsp + 0x1300], 0xffffffffffffffff
je 0x140096b11
mov rcx, qword [rsp + 0x1300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1230], rax
cmp qword [rsp + 0x1230], 0
je 0x140096b7b
lea rax, [rsp + 0x2710]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2718]
lea r8, [rsp + 0x2720]
lea rdx, [rsp + 0x2728]
mov rcx, qword [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xad90]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 0
jmp 0x140096ba3
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
cmp rax, 0x400
jae 0x140096bcc
movsxd rax, dword [rsp + 0x4c]
mov al, byte [rsp + rax + 0xad90]
inc al
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0xad90], al
jmp 0x140096b99
mov dword [rsp + 0x624], 0x34887a6b
lea rdx, str.RAICx
lea rcx, [rsp + 0x6678]
call fcn.140003708
lea rcx, [rsp + 0x6678]
call fcn.14000a93c
mov r8d, dword [rsp + 0x624]
mov rdx, rax
lea rcx, [0x1400edc50]
call fcn.140044734
lea rcx, [rsp + 0x6678]
call fcn.1400040f0
mov dword [rsp + 0x628], 0x1553e5ab
lea rdx, str.Emhf
lea rcx, [rsp + 0x6698]
call fcn.140003708
nop
lea rdx, [rsp + 0x6698]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x628]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6698]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1218], rax
cmp qword [rsp + 0x1218], 0
je 0x140096ce6
lea rax, [rsp + 0x2730]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2738]
lea r8, [rsp + 0x2740]
lea rdx, [rsp + 0x2748]
mov rcx, qword [rsp + 0x1218]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1218]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x62c], 0x2217ccbf
lea rdx, str.rhHCgG8s
lea rcx, [rsp + 0x66b8]
call fcn.140003708
nop
lea rdx, [rsp + 0x66b8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x62c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x66b8]
call fcn.1400040f0
lea rcx, [rsp + 0x86c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x2750]
lea r8, [rsp + 0x2758]
lea rdx, [rsp + 0x2760]
lea rcx, [0x1400edc70]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x31c], 1
mov edx, 8
lea rcx, [rsp + 0x2620]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140096dd1
mov eax, dword [rsp + 0x2620]
mov dword [rsp + 0x1b60], eax
mov eax, dword [rsp + 0x2624]
mov dword [rsp + 0x1b64], eax
mov ecx, dword [rsp + 0x31c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x31c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x630], 0xe1248e2
lea rdx, str.IGie
lea rcx, [rsp + 0x66d8]
call fcn.140003708
lea rcx, [rsp + 0x66d8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x630]
mov rdx, rax
lea rcx, [0x1400edc80]
call fcn.140044734
lea rcx, [rsp + 0x66d8]
call fcn.1400040f0
lea r9, [rsp + 0x2768]
lea r8, [rsp + 0x2770]
lea rdx, [rsp + 0x2778]
lea rcx, [0x1400edc88]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x2780]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.cD.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1308], rax
cmp qword [rsp + 0x1308], 0xffffffffffffffff
je 0x140096ea9
mov rcx, qword [rsp + 0x1308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x634], 0x28661174
lea rdx, [0x1400edca0]
lea rcx, [rsp + 0x66f8]
call fcn.140003708
lea rcx, [rsp + 0x66f8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x634]
mov rdx, rax
lea rcx, [0x1400edca4]
call fcn.140044734
lea rcx, [rsp + 0x66f8]
call fcn.1400040f0
mov dword [rsp + 0x638], 0x2979f802
lea rdx, str.kvqkLR
lea rcx, [rsp + 0x6718]
call fcn.140003708
lea rcx, [rsp + 0x6718]
call fcn.14000a93c
mov r8d, dword [rsp + 0x638]
mov rdx, rax
lea rcx, [0x1400edcb4]
call fcn.140044734
lea rcx, [rsp + 0x6718]
call fcn.1400040f0
lea r9, [rsp + 0x2788]
lea r8, [rsp + 0x2790]
lea rdx, [rsp + 0x2798]
lea rcx, [0x1400edcc0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1208], rax
cmp qword [rsp + 0x1208], 0
je 0x140096fd8
lea rax, [rsp + 0x27a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x27a8]
lea r8, [rsp + 0x27b0]
lea rdx, [rsp + 0x27b8]
mov rcx, qword [rsp + 0x1208]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1208]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x86d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x27c0]
lea r8, [rsp + 0x27c8]
lea rdx, [rsp + 0x27d0]
lea rcx, [0x1400edcc8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x63c], 0x1e3f8c4a
lea rdx, str.sLbQ9d
lea rcx, [rsp + 0x6738]
call fcn.140003708
lea rcx, [rsp + 0x6738]
call fcn.14000a93c
mov r8d, dword [rsp + 0x63c]
mov rdx, rax
lea rcx, [0x1400edcd8]
call fcn.140044734
lea rcx, [rsp + 0x6738]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.S6NVen2.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1310], rax
cmp qword [rsp + 0x1310], 0xffffffffffffffff
je 0x1400970b0
mov rcx, qword [rsp + 0x1310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.zLC9z60U2.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1318], rax
cmp qword [rsp + 0x1318], 0xffffffffffffffff
je 0x140097105
mov rcx, qword [rsp + 0x1318]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xb190]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x14009712d
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x140097156
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0xb190]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0xb190], al
jmp 0x140097123
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x11f8], rax
cmp qword [rsp + 0x11f8], 0
je 0x1400971c0
lea rax, [rsp + 0x27d8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x27e0]
lea r8, [rsp + 0x27e8]
lea rdx, [rsp + 0x27f0]
mov rcx, qword [rsp + 0x11f8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x11f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2018], 0x10
lea rdx, [rsp + 0x2018]
lea rcx, [rsp + 0x8d28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x648], 0x10e3283
lea rdx, str.odFJJ
lea rcx, [rsp + 0x6758]
call fcn.140003708
lea rcx, [rsp + 0x6758]
call fcn.14000a93c
mov r8d, dword [rsp + 0x648]
mov rdx, rax
lea rcx, [0x1400edd1c]
call fcn.140044734
lea rcx, [rsp + 0x6758]
call fcn.1400040f0
mov dword [rsp + 0x2014], 0x10
lea rdx, [rsp + 0x2014]
lea rcx, [rsp + 0x8d48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hlmecMq.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1320], rax
cmp qword [rsp + 0x1320], 0xffffffffffffffff
je 0x1400972a7
mov rcx, qword [rsp + 0x1320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x658], 0x1003792c
lea rdx, str.CT04v
lea rcx, [rsp + 0x6778]
call fcn.140003708
lea rcx, [rsp + 0x6778]
call fcn.14000a93c
mov r8d, dword [rsp + 0x658]
mov rdx, rax
lea rcx, [0x1400edd48]
call fcn.140044734
lea rcx, [rsp + 0x6778]
call fcn.1400040f0
lea r9, [rsp + 0x27f8]
lea r8, [rsp + 0x2800]
lea rdx, [rsp + 0x2808]
lea rcx, [0x1400edd50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.xbnX.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1328], rax
cmp qword [rsp + 0x1328], 0xffffffffffffffff
je 0x140097371
mov rcx, qword [rsp + 0x1328]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2810]
lea r8, [rsp + 0x2818]
lea rdx, [rsp + 0x2820]
lea rcx, [0x1400edd70]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x2828]
lea r8, [rsp + 0x2830]
lea rdx, [rsp + 0x2838]
lea rcx, [0x1400edd78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x2840]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xb590]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x1400973f1
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x14009741a
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0xb590]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0xb590], al
jmp 0x1400973e7
lea rax, [rsp + 0xb990]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x140097442
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x14009746b
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0xb990]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0xb990], al
jmp 0x140097438
mov dword [rsp + 0x65c], 0x37454a3d
lea rdx, str.ZdtWDXZ
lea rcx, [rsp + 0x6798]
call fcn.140003708
lea rcx, [rsp + 0x6798]
call fcn.14000a93c
mov r8d, dword [rsp + 0x65c]
mov rdx, rax
lea rcx, [0x1400edd88]
call fcn.140044734
lea rcx, [rsp + 0x6798]
call fcn.1400040f0
mov dword [rsp + 0x320], 1
mov edx, 8
lea rcx, [rsp + 0x2680]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140097513
mov eax, dword [rsp + 0x2680]
mov dword [rsp + 0x1b5c], eax
mov eax, dword [rsp + 0x2684]
mov dword [rsp + 0x1b6c], eax
mov ecx, dword [rsp + 0x320]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x320]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x2848]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.n0GoUc.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1330], rax
cmp qword [rsp + 0x1330], 0xffffffffffffffff
je 0x140097576
mov rcx, qword [rsp + 0x1330]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.CnJ6z6nS1.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1338], rax
cmp qword [rsp + 0x1338], 0xffffffffffffffff
je 0x1400975cb
mov rcx, qword [rsp + 0x1338]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2850]
lea r8, [rsp + 0x2858]
lea rdx, [rsp + 0x2860]
lea rcx, [0x1400eddc8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xbd90]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x140097618
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x140097641
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0xbd90]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0xbd90], al
jmp 0x14009760e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x11e0], rax
cmp qword [rsp + 0x11e0], 0
je 0x1400976ab
lea rax, [rsp + 0x2868]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2870]
lea r8, [rsp + 0x2878]
lea rdx, [rsp + 0x2880]
mov rcx, qword [rsp + 0x11e0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x11e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xc190]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x1400976d3
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x1400976fc
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0xc190]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0xc190], al
jmp 0x1400976c9
mov dword [rsp + 0x324], 1
mov edx, 8
lea rcx, [rsp + 0x26a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140097754
mov eax, dword [rsp + 0x26a8]
mov dword [rsp + 0x1b70], eax
mov eax, dword [rsp + 0x26ac]
mov dword [rsp + 0x1b74], eax
mov ecx, dword [rsp + 0x324]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x324]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x660], 0x132ea6bc
lea rdx, str.GtwlxPlTvS
lea rcx, [rsp + 0x67b8]
call fcn.140003708
lea rcx, [rsp + 0x67b8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x660]
mov rdx, rax
lea rcx, [0x1400edddc]
call fcn.140044734
lea rcx, [rsp + 0x67b8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.2IBi4Qbc63.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1340], rax
cmp qword [rsp + 0x1340], 0xffffffffffffffff
je 0x1400977f9
mov rcx, qword [rsp + 0x1340]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x664], 0x379ea18d
lea rdx, str.dOhgU
lea rcx, [rsp + 0x67d8]
call fcn.140003708
nop
lea rdx, [rsp + 0x67d8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x664]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x67d8]
call fcn.1400040f0
lea rax, [rsp + 0xc590]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x140097881
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x1400978aa
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0xc590]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0xc590], al
jmp 0x140097877
lea r9, [rsp + 0x2888]
lea r8, [rsp + 0x2890]
lea rdx, [rsp + 0x2898]
lea rcx, [0x1400ede10]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.gII.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1348], rax
cmp qword [rsp + 0x1348], 0xffffffffffffffff
je 0x140097924
mov rcx, qword [rsp + 0x1348]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x11c8], rax
cmp qword [rsp + 0x11c8], 0
je 0x14009798e
lea rax, [rsp + 0x28a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x28a8]
lea r8, [rsp + 0x28b0]
lea rdx, [rsp + 0x28b8]
mov rcx, qword [rsp + 0x11c8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x11c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x668], 0x18c26348
lea rdx, str.Hl2SvlvE
lea rcx, [rsp + 0x67f8]
call fcn.140003708
lea rcx, [rsp + 0x67f8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x668]
mov rdx, rax
lea rcx, [0x1400ede34]
call fcn.140044734
lea rcx, [rsp + 0x67f8]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x11b8], rax
cmp qword [rsp + 0x11b8], 0
je 0x140097a48
lea rax, [rsp + 0x28c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x28c8]
lea r8, [rsp + 0x28d0]
lea rdx, [rsp + 0x28d8]
mov rcx, qword [rsp + 0x11b8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x11b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x28e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x66c], 0x3dad8a0
lea rdx, str.rZFvQN6iJ
lea rcx, [rsp + 0x6818]
call fcn.140003708
lea rcx, [rsp + 0x6818]
call fcn.14000a93c
mov r8d, dword [rsp + 0x66c]
mov rdx, rax
lea rcx, [0x1400ede4c]
call fcn.140044734
lea rcx, [rsp + 0x6818]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x11a8], rax
cmp qword [rsp + 0x11a8], 0
je 0x140097b10
lea rax, [rsp + 0x28e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x28f0]
lea r8, [rsp + 0x28f8]
lea rdx, [rsp + 0x2900]
mov rcx, qword [rsp + 0x11a8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x11a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x2908]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x86e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x2910]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x328], 1
mov edx, 8
lea rcx, [rsp + 0x26c8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140097b92
mov eax, dword [rsp + 0x26c8]
mov dword [rsp + 0x1b78], eax
mov eax, dword [rsp + 0x26cc]
mov dword [rsp + 0x1b7c], eax
mov ecx, dword [rsp + 0x328]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x328]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x200c], 0x10
lea rdx, [rsp + 0x200c]
lea rcx, [rsp + 0x8d68]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x2918]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0xc990]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x140097be9
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x140097c12
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0xc990]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0xc990], al
jmp 0x140097bdf
mov dword [rsp + 0x678], 0x133f5230
lea rdx, [0x1400ede54]
lea rcx, [rsp + 0x6838]
call fcn.140003708
nop
lea rdx, [rsp + 0x6838]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x678]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6838]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400ede58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1350], rax
cmp qword [rsp + 0x1350], 0xffffffffffffffff
je 0x140097cc7
mov rcx, qword [rsp + 0x1350]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x32c], 1
mov edx, 8
lea rcx, [rsp + 0x26e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140097d1f
mov eax, dword [rsp + 0x26e8]
mov dword [rsp + 0x1b80], eax
mov eax, dword [rsp + 0x26ec]
mov dword [rsp + 0x1b84], eax
mov ecx, dword [rsp + 0x32c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x32c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x2920]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.uLjad.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1358], rax
cmp qword [rsp + 0x1358], 0xffffffffffffffff
je 0x140097d82
mov rcx, qword [rsp + 0x1358]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xcd90]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x140097daa
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x140097dd3
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0xcd90]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0xcd90], al
jmp 0x140097da0
mov dword [rsp + 0x330], 1
mov edx, 8
lea rcx, [rsp + 0x2110]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140097e2b
mov eax, dword [rsp + 0x2110]
mov dword [rsp + 0x1b88], eax
mov eax, dword [rsp + 0x2114]
mov dword [rsp + 0x1b8c], eax
mov ecx, dword [rsp + 0x330]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x330]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x2004], 0x10
lea rdx, [rsp + 0x2004]
lea rcx, [rsp + 0x8d88]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1190], rax
cmp qword [rsp + 0x1190], 0
je 0x140097eb6
lea rax, [rsp + 0x2928]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2930]
lea r8, [rsp + 0x2938]
lea rdx, [rsp + 0x2940]
mov rcx, qword [rsp + 0x1190]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1190]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xd190]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x140097ede
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x140097f07
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0xd190]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0xd190], al
jmp 0x140097ed4
mov dword [rsp + 0x688], 0x2861bf55
lea rdx, str.G9I3Ng
lea rcx, [rsp + 0x6858]
call fcn.140003708
lea rcx, [rsp + 0x6858]
call fcn.14000a93c
mov r8d, dword [rsp + 0x688]
mov rdx, rax
lea rcx, [0x1400ede94]
call fcn.140044734
lea rcx, [rsp + 0x6858]
call fcn.1400040f0
mov dword [rsp + 0x68c], 0x196d4dfb
lea rdx, str.2gwbr0
lea rcx, [rsp + 0x6878]
call fcn.140003708
nop
lea rdx, [rsp + 0x6878]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x68c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6878]
call fcn.1400040f0
mov dword [rsp + 0x334], 1
mov edx, 8
lea rcx, [rsp + 0x2118]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14009800f
mov eax, dword [rsp + 0x2118]
mov dword [rsp + 0x1b90], eax
mov eax, dword [rsp + 0x211c]
mov dword [rsp + 0x1b94], eax
mov ecx, dword [rsp + 0x334]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x334]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x2948]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x2950]
lea r8, [rsp + 0x2958]
lea rdx, [rsp + 0x2960]
lea rcx, [0x1400edea8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.RXLDZSJZ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1360], rax
cmp qword [rsp + 0x1360], 0xffffffffffffffff
je 0x140098097
mov rcx, qword [rsp + 0x1360]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x86f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x690], 0x35d43ff
lea rdx, str.4gOxfLee1d
lea rcx, [rsp + 0x6898]
call fcn.140003708
nop
lea rdx, [rsp + 0x6898]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x690]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6898]
call fcn.1400040f0
lea rax, [rsp + 0xd590]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x14009812d
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x140098156
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0xd590]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0xd590], al
jmp 0x140098123
mov dword [rsp + 0x2000], 0x10
lea rdx, [rsp + 0x2000]
lea rcx, [rsp + 0x8da8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x2968]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x6a0], 0x17532cb4
lea rdx, str.8uOi1FQEU
lea rcx, [rsp + 0x68b8]
call fcn.140003708
lea rcx, [rsp + 0x68b8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x6a0]
mov rdx, rax
lea rcx, [0x1400edeec]
call fcn.140044734
lea rcx, [rsp + 0x68b8]
call fcn.1400040f0
mov dword [rsp + 0x6a4], 0x973296d
lea rdx, str.EuClC4k
lea rcx, [rsp + 0x68d8]
call fcn.140003708
nop
lea rdx, [rsp + 0x68d8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x6a4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x68d8]
call fcn.1400040f0
lea rax, [rsp + 0xd990]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x14009825d
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x140098286
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0xd990]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0xd990], al
jmp 0x140098253
lea rax, [rsp + 0xdd90]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x1400982ae
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x1400982d7
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0xdd90]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0xdd90], al
jmp 0x1400982a4
lea rcx, [rsp + 0x2970]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.jKxMbzmfXQ.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1368], rax
cmp qword [rsp + 0x1368], 0xffffffffffffffff
je 0x14009833a
mov rcx, qword [rsp + 0x1368]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xe190]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x14009836b
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x14009839d
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0xe190]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0xe190], al
jmp 0x14009835b
lea rax, [rsp + 0xe590]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x1400983ce
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x140098400
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0xe590]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0xe590], al
jmp 0x1400983be
lea rcx, [rsp + 0x2978]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1188], rax
cmp qword [rsp + 0x1188], 0
je 0x140098478
lea rax, [rsp + 0x2980]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2988]
lea r8, [rsp + 0x2990]
lea rdx, [rsp + 0x2998]
mov rcx, qword [rsp + 0x1188]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x6a8], 0xe04d701
lea rdx, [0x1400edf20]
lea rcx, [rsp + 0x68f8]
call fcn.140003708
nop
lea rdx, [rsp + 0x68f8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x6a8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x68f8]
call fcn.1400040f0
lea rcx, [rsp + 0x29a0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1180], rax
cmp qword [rsp + 0x1180], 0
je 0x140098550
lea rax, [rsp + 0x29a8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x29b0]
lea r8, [rsp + 0x29b8]
lea rdx, [rsp + 0x29c0]
mov rcx, qword [rsp + 0x1180]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x6ac], 0x26cc752
lea rdx, [0x1400edf24]
lea rcx, [rsp + 0x6918]
call fcn.140003708
nop
lea rdx, [rsp + 0x6918]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x6ac]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6918]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400edf28]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1370], rax
cmp qword [rsp + 0x1370], 0xffffffffffffffff
je 0x140098605
mov rcx, qword [rsp + 0x1370]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xe990]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0
jmp 0x140098636
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
movsxd rax, dword [rsp + 0x88]
cmp rax, 0x400
jae 0x140098668
movsxd rax, dword [rsp + 0x88]
mov al, byte [rsp + rax + 0xe990]
inc al
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0xe990], al
jmp 0x140098626
mov dword [rsp + 0x1ffc], 0x10
lea rdx, [rsp + 0x1ffc]
lea rcx, [rsp + 0x8dc8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x29c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x6b8], 0x1ad26bbe
lea rdx, str.QoioB
lea rcx, [rsp + 0x6938]
call fcn.140003708
lea rcx, [rsp + 0x6938]
call fcn.14000a93c
mov r8d, dword [rsp + 0x6b8]
mov rdx, rax
lea rcx, [0x1400edf40]
call fcn.140044734
lea rcx, [rsp + 0x6938]
call fcn.1400040f0
lea r9, [rsp + 0x29d0]
lea r8, [rsp + 0x29d8]
lea rdx, [rsp + 0x29e0]
lea rcx, [0x1400edf48]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x6bc], 0x2ec32116
lea rdx, [0x1400edf50]
lea rcx, [rsp + 0x6958]
call fcn.140003708
nop
lea rdx, [rsp + 0x6958]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x6bc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6958]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1178], rax
cmp qword [rsp + 0x1178], 0
je 0x1400987d6
lea rax, [rsp + 0x29e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x29f0]
lea r8, [rsp + 0x29f8]
lea rdx, [rsp + 0x2a00]
mov rcx, qword [rsp + 0x1178]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x6c0], 0x3885d25c
lea rdx, str.Rc5zJg
lea rcx, [rsp + 0x6978]
call fcn.140003708
lea rcx, [rsp + 0x6978]
call fcn.14000a93c
mov r8d, dword [rsp + 0x6c0]
mov rdx, rax
lea rcx, [0x1400edf5c]
call fcn.140044734
lea rcx, [rsp + 0x6978]
call fcn.1400040f0
mov dword [rsp + 0x1ff4], 0x10
lea rdx, [rsp + 0x1ff4]
lea rcx, [rsp + 0x8de8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x8708]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Ov.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1378], rax
cmp qword [rsp + 0x1378], 0xffffffffffffffff
je 0x1400988aa
mov rcx, qword [rsp + 0x1378]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1ff0], 0x10
lea rdx, [rsp + 0x1ff0]
lea rcx, [rsp + 0x8e08]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x338], 1
mov edx, 8
lea rcx, [rsp + 0x2120]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140098923
mov eax, dword [rsp + 0x2120]
mov dword [rsp + 0x1b98], eax
mov eax, dword [rsp + 0x2124]
mov dword [rsp + 0x1b9c], eax
mov ecx, dword [rsp + 0x338]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x338]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x33c], 1
mov edx, 8
lea rcx, [rsp + 0x2128]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14009897b
mov eax, dword [rsp + 0x2128]
mov dword [rsp + 0x1ba0], eax
mov eax, dword [rsp + 0x212c]
mov dword [rsp + 0x1ba4], eax
mov ecx, dword [rsp + 0x33c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x33c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x340], 1
mov edx, 8
lea rcx, [rsp + 0x2130]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400989d3
mov eax, dword [rsp + 0x2130]
mov dword [rsp + 0x1ba8], eax
mov eax, dword [rsp + 0x2134]
mov dword [rsp + 0x1bac], eax
mov ecx, dword [rsp + 0x340]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x340]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x344], 1
mov edx, 8
lea rcx, [rsp + 0x2138]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140098a2b
mov eax, dword [rsp + 0x2138]
mov dword [rsp + 0x1bb0], eax
mov eax, dword [rsp + 0x213c]
mov dword [rsp + 0x1bb4], eax
mov ecx, dword [rsp + 0x344]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x344]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x8718]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1170], rax
cmp qword [rsp + 0x1170], 0
je 0x140098aa3
lea rax, [rsp + 0x2a08]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2a10]
lea r8, [rsp + 0x2a18]
lea rdx, [rsp + 0x2a20]
mov rcx, qword [rsp + 0x1170]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x6d8], 0x22b8d10
lea rdx, str.7w9pp5zR
lea rcx, [rsp + 0x6998]
call fcn.140003708
lea rcx, [rsp + 0x6998]
call fcn.14000a93c
mov r8d, dword [rsp + 0x6d8]
mov rdx, rax
lea rcx, [0x1400edf84]
call fcn.140044734
lea rcx, [rsp + 0x6998]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1168], rax
cmp qword [rsp + 0x1168], 0
je 0x140098b5d
lea rax, [rsp + 0x2a28]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2a30]
lea r8, [rsp + 0x2a38]
lea rdx, [rsp + 0x2a40]
mov rcx, qword [rsp + 0x1168]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1150], rax
cmp qword [rsp + 0x1150], 0
je 0x140098bc7
lea rax, [rsp + 0x2a48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2a50]
lea r8, [rsp + 0x2a58]
lea rdx, [rsp + 0x2a60]
mov rcx, qword [rsp + 0x1150]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.U5JmSXlae.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1380], rax
cmp qword [rsp + 0x1380], 0xffffffffffffffff
je 0x140098c1c
mov rcx, qword [rsp + 0x1380]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x6dc], 0x281355b2
lea rdx, str.7QMf3y
lea rcx, [rsp + 0x69b8]
call fcn.140003708
nop
lea rdx, [rsp + 0x69b8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x6dc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x69b8]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1138], rax
cmp qword [rsp + 0x1138], 0
je 0x140098ce6
lea rax, [rsp + 0x2a68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2a70]
lea r8, [rsp + 0x2a78]
lea rdx, [rsp + 0x2a80]
mov rcx, qword [rsp + 0x1138]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1128], rax
cmp qword [rsp + 0x1128], 0
je 0x140098d50
lea rax, [rsp + 0x2a88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2a90]
lea r8, [rsp + 0x2a98]
lea rdx, [rsp + 0x2aa0]
mov rcx, qword [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2aa8]
lea r8, [rsp + 0x2ab0]
lea rdx, [rsp + 0x2ab8]
lea rcx, [0x1400edfb8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0xed90]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x8c], 0
jmp 0x140098da6
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
movsxd rax, dword [rsp + 0x8c]
cmp rax, 0x400
jae 0x140098dd8
movsxd rax, dword [rsp + 0x8c]
mov al, byte [rsp + rax + 0xed90]
inc al
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0xed90], al
jmp 0x140098d96
mov dword [rsp + 0x348], 1
mov edx, 8
lea rcx, [rsp + 0x2140]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140098e30
mov eax, dword [rsp + 0x2140]
mov dword [rsp + 0x1bb8], eax
mov eax, dword [rsp + 0x2144]
mov dword [rsp + 0x1bbc], eax
mov ecx, dword [rsp + 0x348]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x348]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x2ac0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1120], rax
cmp qword [rsp + 0x1120], 0
je 0x140098ea8
lea rax, [rsp + 0x2ac8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2ad0]
lea r8, [rsp + 0x2ad8]
lea rdx, [rsp + 0x2ae0]
mov rcx, qword [rsp + 0x1120]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1fec], 0x10
lea rdx, [rsp + 0x1fec]
lea rcx, [rsp + 0x8e28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x2ae8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x2af0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x8728]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x34c], 1
mov edx, 8
lea rcx, [rsp + 0x2148]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140098f4b
mov eax, dword [rsp + 0x2148]
mov dword [rsp + 0x1bc0], eax
mov eax, dword [rsp + 0x214c]
mov dword [rsp + 0x1bc4], eax
mov ecx, dword [rsp + 0x34c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x34c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1fe8], 0x10
lea rdx, [rsp + 0x1fe8]
lea rcx, [rsp + 0x8e48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x6f0], 0x90e4ad4
lea rdx, str.pSlzHqq2Qd
lea rcx, [rsp + 0x69d8]
call fcn.140003708
lea rcx, [rsp + 0x69d8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x6f0]
mov rdx, rax
lea rcx, [0x1400edfcc]
call fcn.140044734
lea rcx, [rsp + 0x69d8]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1118], rax
cmp qword [rsp + 0x1118], 0
je 0x140099026
lea rax, [rsp + 0x2af8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b00]
lea r8, [rsp + 0x2b08]
lea rdx, [rsp + 0x2b10]
mov rcx, qword [rsp + 0x1118]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xf190]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
jmp 0x140099057
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 0x400
jae 0x140099089
movsxd rax, dword [rsp + 0x90]
mov al, byte [rsp + rax + 0xf190]
inc al
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0xf190], al
jmp 0x140099047
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1108], rax
cmp qword [rsp + 0x1108], 0
je 0x1400990f3
lea rax, [rsp + 0x2b18]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b20]
lea r8, [rsp + 0x2b28]
lea rdx, [rsp + 0x2b30]
mov rcx, qword [rsp + 0x1108]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x6f4], 0x283a44d
lea rdx, str.KSXXVlM05
lea rcx, [rsp + 0x69f8]
call fcn.140003708
nop
lea rdx, [rsp + 0x69f8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x6f4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x69f8]
call fcn.1400040f0
mov dword [rsp + 0x6f8], 0x3b37183f
lea rdx, [0x1400edfe4]
lea rcx, [rsp + 0x6a18]
call fcn.140003708
nop
lea rdx, [rsp + 0x6a18]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x6f8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6a18]
call fcn.1400040f0
lea rax, [rsp + 0xf590]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x94], 0
jmp 0x1400991e4
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
cmp rax, 0x400
jae 0x140099216
movsxd rax, dword [rsp + 0x94]
mov al, byte [rsp + rax + 0xf590]
inc al
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0xf590], al
jmp 0x1400991d4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x10e8], rax
cmp qword [rsp + 0x10e8], 0
je 0x140099280
lea rax, [rsp + 0x2b38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b40]
lea r8, [rsp + 0x2b48]
lea rdx, [rsp + 0x2b50]
mov rcx, qword [rsp + 0x10e8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x10e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400edfe8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1388], rax
cmp qword [rsp + 0x1388], 0xffffffffffffffff
je 0x1400992d5
mov rcx, qword [rsp + 0x1388]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x2b58]
lea r8, [rsp + 0x2b60]
lea rdx, [rsp + 0x2b68]
lea rcx, [0x1400ee000]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x10e0], rax
cmp qword [rsp + 0x10e0], 0
je 0x140099364
lea rax, [rsp + 0x2b70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b78]
lea r8, [rsp + 0x2b80]
lea rdx, [rsp + 0x2b88]
mov rcx, qword [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x10d0], rax
cmp qword [rsp + 0x10d0], 0
je 0x1400993ce
lea rax, [rsp + 0x2b90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b98]
lea r8, [rsp + 0x2ba0]
lea rdx, [rsp + 0x2ba8]
mov rcx, qword [rsp + 0x10d0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x10d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1098], rax
cmp qword [rsp + 0x1098], 0
je 0x140099438
lea rax, [rsp + 0x2bb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2bb8]
lea r8, [rsp + 0x2bc0]
lea rdx, [rsp + 0x2bc8]
mov rcx, qword [rsp + 0x1098]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1098]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.W9hGIL5X.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1390], rax
cmp qword [rsp + 0x1390], 0xffffffffffffffff
je 0x14009948d
mov rcx, qword [rsp + 0x1390]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x6fc], 0x9251e95
lea rdx, str.OtGzyI1P
lea rcx, [rsp + 0x6a38]
call fcn.140003708
lea rcx, [rsp + 0x6a38]
call fcn.14000a93c
mov r8d, dword [rsp + 0x6fc]
mov rdx, rax
lea rcx, [0x1400ee034]
call fcn.140044734
lea rcx, [rsp + 0x6a38]
call fcn.1400040f0
mov dword [rsp + 0x350], 1
mov edx, 8
lea rcx, [rsp + 0x2150]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140099535
mov eax, dword [rsp + 0x2150]
mov dword [rsp + 0x1bc8], eax
mov eax, dword [rsp + 0x2154]
mov dword [rsp + 0x1bcc], eax
mov ecx, dword [rsp + 0x350]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x350]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x2bd0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1fe4], 0x10
lea rdx, [rsp + 0x1fe4]
lea rcx, [rsp + 0x8e68]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x354], 1
mov edx, 8
lea rcx, [rsp + 0x2158]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400995bc
mov eax, dword [rsp + 0x2158]
mov dword [rsp + 0x1bd0], eax
mov eax, dword [rsp + 0x215c]
mov dword [rsp + 0x1bd4], eax
mov ecx, dword [rsp + 0x354]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x354]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x708], 0x2ca231c8
lea rdx, str.N6gwq2Rr
lea rcx, [rsp + 0x6a58]
call fcn.140003708
lea rcx, [rsp + 0x6a58]
call fcn.14000a93c
mov r8d, dword [rsp + 0x708]
mov rdx, rax
lea rcx, [0x1400ee04c]
call fcn.140044734
lea rcx, [rsp + 0x6a58]
call fcn.1400040f0
mov dword [rsp + 0x70c], 0x1802e4e0
lea rdx, [0x1400ee054]
lea rcx, [rsp + 0x6a78]
call fcn.140003708
nop
lea rdx, [rsp + 0x6a78]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x70c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6a78]
call fcn.1400040f0
mov dword [rsp + 0x710], 0x44ab419
lea rdx, str.7Hkl
lea rcx, [rsp + 0x6a98]
call fcn.140003708
nop
lea rdx, [rsp + 0x6a98]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x710]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6a98]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1088], rax
cmp qword [rsp + 0x1088], 0
je 0x140099736
lea rax, [rsp + 0x2bd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2be0]
lea r8, [rsp + 0x2be8]
lea rdx, [rsp + 0x2bf0]
mov rcx, qword [rsp + 0x1088]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1088]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x358], 1
mov edx, 8
lea rcx, [rsp + 0x2160]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14009978e
mov eax, dword [rsp + 0x2160]
mov dword [rsp + 0x1bd8], eax
mov eax, dword [rsp + 0x2164]
mov dword [rsp + 0x1bdc], eax
mov ecx, dword [rsp + 0x358]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x358]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x8738]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x714], 0x2b9c81c7
lea rdx, str.C0eNz1
lea rcx, [rsp + 0x6ab8]
call fcn.140003708
nop
lea rdx, [rsp + 0x6ab8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x714]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6ab8]
call fcn.1400040f0
mov dword [rsp + 0x35c], 1
mov edx, 8
lea rcx, [rsp + 0x2168]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140099854
mov eax, dword [rsp + 0x2168]
mov dword [rsp + 0x1be0], eax
mov eax, dword [rsp + 0x216c]
mov dword [rsp + 0x1be4], eax
mov ecx, dword [rsp + 0x35c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x35c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Zb.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1398], rax
cmp qword [rsp + 0x1398], 0xffffffffffffffff
je 0x1400998a9
mov rcx, qword [rsp + 0x1398]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x718], 0x6967768
lea rdx, str.UTT0ibnd
lea rcx, [rsp + 0x6ad8]
call fcn.140003708
nop
lea rdx, [rsp + 0x6ad8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x718]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6ad8]
call fcn.1400040f0
lea r9, [rsp + 0x2bf8]
lea r8, [rsp + 0x2c00]
lea rdx, [rsp + 0x2c08]
lea rcx, [0x1400ee088]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x8748]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x360], 1
mov edx, 8
lea rcx, [rsp + 0x2170]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140099994
mov eax, dword [rsp + 0x2170]
mov dword [rsp + 0x1be8], eax
mov eax, dword [rsp + 0x2174]
mov dword [rsp + 0x1bec], eax
mov ecx, dword [rsp + 0x360]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x360]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x2c10]
lea r8, [rsp + 0x2c18]
lea rdx, [rsp + 0x2c20]
lea rcx, [0x1400ee090]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x2c28]
lea r8, [rsp + 0x2c30]
lea rdx, [rsp + 0x2c38]
lea rcx, [0x1400ee098]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x364], 1
mov edx, 8
lea rcx, [rsp + 0x2178]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140099a36
mov eax, dword [rsp + 0x2178]
mov dword [rsp + 0x1bf0], eax
mov eax, dword [rsp + 0x217c]
mov dword [rsp + 0x1bf4], eax
mov ecx, dword [rsp + 0x364]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x364]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x2c40]
lea r8, [rsp + 0x2c48]
lea rdx, [rsp + 0x2c50]
lea rcx, [0x1400ee0a0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x71c], 0x11f67efb
lea rdx, str.yid0DbCmm
lea rcx, [rsp + 0x6af8]
call fcn.140003708
lea rcx, [rsp + 0x6af8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x71c]
mov rdx, rax
lea rcx, [0x1400ee0b4]
call fcn.140044734
lea rcx, [rsp + 0x6af8]
call fcn.1400040f0
mov dword [rsp + 0x368], 1
mov edx, 8
lea rcx, [rsp + 0x2180]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140099b03
mov eax, dword [rsp + 0x2180]
mov dword [rsp + 0x1bf8], eax
mov eax, dword [rsp + 0x2184]
mov dword [rsp + 0x1bfc], eax
mov ecx, dword [rsp + 0x368]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x368]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x36c], 1
mov edx, 8
lea rcx, [rsp + 0x2188]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140099b5b
mov eax, dword [rsp + 0x2188]
mov dword [rsp + 0x1c00], eax
mov eax, dword [rsp + 0x218c]
mov dword [rsp + 0x1c04], eax
mov ecx, dword [rsp + 0x36c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x36c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x370], 1
mov edx, 8
lea rcx, [rsp + 0x2190]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140099bb3
mov eax, dword [rsp + 0x2190]
mov dword [rsp + 0x1c08], eax
mov eax, dword [rsp + 0x2194]
mov dword [rsp + 0x1c0c], eax
mov ecx, dword [rsp + 0x370]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x370]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x720], 0x2607f058
lea rdx, str.A8OF2r
lea rcx, [rsp + 0x6b18]
call fcn.140003708
nop
lea rdx, [rsp + 0x6b18]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x720]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6b18]
call fcn.1400040f0
mov dword [rsp + 0x374], 1
mov edx, 8
lea rcx, [rsp + 0x2198]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140099c6b
mov eax, dword [rsp + 0x2198]
mov dword [rsp + 0x1c10], eax
mov eax, dword [rsp + 0x219c]
mov dword [rsp + 0x1c14], eax
mov ecx, dword [rsp + 0x374]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x374]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0xf990]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0
jmp 0x140099c9c
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
movsxd rax, dword [rsp + 0x98]
cmp rax, 0x400
jae 0x140099cce
movsxd rax, dword [rsp + 0x98]
mov al, byte [rsp + rax + 0xf990]
inc al
movsxd rcx, dword [rsp + 0x98]
mov byte [rsp + rcx + 0xf990], al
jmp 0x140099c8c
lea rcx, [rsp + 0x8758]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x724], 0x121559dd
lea rdx, str.2qHJ92
lea rcx, [rsp + 0x6b38]
call fcn.140003708
nop
lea rdx, [rsp + 0x6b38]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x724]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6b38]
call fcn.1400040f0
mov dword [rsp + 0x728], 0x3b0505db
lea rdx, str.fLQsC1WYu4
lea rcx, [rsp + 0x6b58]
call fcn.140003708
lea rcx, [rsp + 0x6b58]
call fcn.14000a93c
mov r8d, dword [rsp + 0x728]
mov rdx, rax
lea rcx, [0x1400ee0dc]
call fcn.140044734
lea rcx, [rsp + 0x6b58]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1078], rax
cmp qword [rsp + 0x1078], 0
je 0x140099df6
lea rax, [rsp + 0x2c58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c60]
lea r8, [rsp + 0x2c68]
lea rdx, [rsp + 0x2c70]
mov rcx, qword [rsp + 0x1078]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1078]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x72c], 0xf3d149c
lea rdx, [0x1400ee0e4]
lea rcx, [rsp + 0x6b78]
call fcn.140003708
lea rcx, [rsp + 0x6b78]
call fcn.14000a93c
mov r8d, dword [rsp + 0x72c]
mov rdx, rax
lea rcx, [0x1400ee0e8]
call fcn.140044734
lea rcx, [rsp + 0x6b78]
call fcn.1400040f0
lea rax, [rsp + 0xfd90]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x9c], 0
jmp 0x140099e77
mov eax, dword [rsp + 0x9c]
inc eax
mov dword [rsp + 0x9c], eax
movsxd rax, dword [rsp + 0x9c]
cmp rax, 0x400
jae 0x140099ea9
movsxd rax, dword [rsp + 0x9c]
mov al, byte [rsp + rax + 0xfd90]
inc al
movsxd rcx, dword [rsp + 0x9c]
mov byte [rsp + rcx + 0xfd90], al
jmp 0x140099e67
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.JE0m0Tqd5.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x13a0], rax
cmp qword [rsp + 0x13a0], 0xffffffffffffffff
je 0x140099efe
mov rcx, qword [rsp + 0x13a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x730], 0x380df130
lea rdx, str.nI1HHBcug
lea rcx, [rsp + 0x6b98]
call fcn.140003708
nop
lea rdx, [rsp + 0x6b98]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x730]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6b98]
call fcn.1400040f0
mov dword [rsp + 0x1fe0], 0x10
lea rdx, [rsp + 0x1fe0]
lea rcx, [rsp + 0x8e88]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x740], 0x362a8a21
lea rdx, [0x1400ee11c]
lea rcx, [rsp + 0x6bb8]
call fcn.140003708
lea rcx, [rsp + 0x6bb8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x740]
mov rdx, rax
lea rcx, [0x1400ee120]
call fcn.140044734
lea rcx, [rsp + 0x6bb8]
call fcn.1400040f0
lea r9, [rsp + 0x2c78]
lea r8, [rsp + 0x2c80]
lea rdx, [rsp + 0x2c88]
lea rcx, [0x1400ee128]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x8768]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1fdc], 0x10
lea rdx, [rsp + 0x1fdc]
lea rcx, [rsp + 0x8ea8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x750], 0x31f8539a
lea rdx, str.yCtVjqVzzT
lea rcx, [rsp + 0x6bd8]
call fcn.140003708
nop
lea rdx, [rsp + 0x6bd8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x750]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6bd8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.cKvGItwG.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x13a8], rax
cmp qword [rsp + 0x13a8], 0xffffffffffffffff
je 0x14009a0d8
mov rcx, qword [rsp + 0x13a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x10190]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
jmp 0x14009a109
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
cmp rax, 0x400
jae 0x14009a13b
movsxd rax, dword [rsp + 0xa0]
mov al, byte [rsp + rax + 0x10190]
inc al
movsxd rcx, dword [rsp + 0xa0]
mov byte [rsp + rcx + 0x10190], al
jmp 0x14009a0f9
mov dword [rsp + 0x754], 0x1d0358a
lea rdx, str.xacoEGOZWR
lea rcx, [rsp + 0x6bf8]
call fcn.140003708
lea rcx, [rsp + 0x6bf8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x754]
mov rdx, rax
lea rcx, [0x1400ee16c]
call fcn.140044734
lea rcx, [rsp + 0x6bf8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.mM1nw.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x13b0], rax
cmp qword [rsp + 0x13b0], 0xffffffffffffffff
je 0x14009a1e0
mov rcx, qword [rsp + 0x13b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x2c90]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1070], rax
cmp qword [rsp + 0x1070], 0
je 0x14009a258
lea rax, [rsp + 0x2c98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2ca0]
lea r8, [rsp + 0x2ca8]
lea rdx, [rsp + 0x2cb0]
mov rcx, qword [rsp + 0x1070]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1070]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1fd4], 0x10
lea rdx, [rsp + 0x1fd4]
lea rcx, [rsp + 0x8ec8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1060], rax
cmp qword [rsp + 0x1060], 0
je 0x14009a2e3
lea rax, [rsp + 0x2cb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2cc0]
lea r8, [rsp + 0x2cc8]
lea rdx, [rsp + 0x2cd0]
mov rcx, qword [rsp + 0x1060]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1060]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x1fc4], 0x10
lea rdx, [rsp + 0x1fc4]
lea rcx, [rsp + 0x8ee8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x768], 0x39245bc4
lea rdx, str.15RusQ0R
lea rcx, [rsp + 0x6c18]
call fcn.140003708
nop
lea rdx, [rsp + 0x6c18]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x768]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6c18]
call fcn.1400040f0
lea rcx, [rsp + 0x8778]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rsp + 0x2cd8]
lea r8, [rsp + 0x2ce0]
lea rdx, [rsp + 0x2ce8]
lea rcx, [0x1400ee1a0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x76c], 0x25f4acb5
lea rdx, str.LJIE
lea rcx, [rsp + 0x6c38]
call fcn.140003708
nop
lea rdx, [rsp + 0x6c38]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x76c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6c38]
call fcn.1400040f0
lea rcx, [rsp + 0x2cf0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x770], 0x22aadad6
lea rdx, str.CRYbCj
lea rcx, [rsp + 0x6c58]
call fcn.140003708
lea rcx, [rsp + 0x6c58]
call fcn.14000a93c
mov r8d, dword [rsp + 0x770]
mov rdx, rax
lea rcx, [0x1400ee1b8]
call fcn.140044734
lea rcx, [rsp + 0x6c58]
call fcn.1400040f0
mov dword [rsp + 0x1fbc], 0x10
lea rdx, [rsp + 0x1fbc]
lea rcx, [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x1fb8], 0x10
lea rdx, [rsp + 0x1fb8]
lea rcx, [rsp + 0x8f28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x788], 0x12176754
lea rdx, [0x1400ee1c0]
lea rcx, [rsp + 0x6c78]
call fcn.140003708
lea rcx, [rsp + 0x6c78]
call fcn.14000a93c
mov r8d, dword [rsp + 0x788]
mov rdx, rax
lea rcx, [0x1400ee1c4]
call fcn.140044734
lea rcx, [rsp + 0x6c78]
call fcn.1400040f0
lea rcx, [rsp + 0x2cf8]
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [0x14010c008], 0
je 0x1400a54d5
mov qword [rsp + 0x610], 0
mov eax, dword [0x14010c008]
imul rax, rax, 0xffffffffff676980
mov qword [rsp + 0x26f0], rax
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov qword [rsp + 0x610], rax
lea rax, [rsp + 0x10590]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0xa4], 0
jmp 0x14009a56c
mov eax, dword [rsp + 0xa4]
inc eax
mov dword [rsp + 0xa4], eax
movsxd rax, dword [rsp + 0xa4]
cmp rax, 0x400
jae 0x14009a59e
movsxd rax, dword [rsp + 0xa4]
mov al, byte [rsp + rax + 0x10590]
inc al
movsxd rcx, dword [rsp + 0xa4]
mov byte [rsp + rcx + 0x10590], al
jmp 0x14009a55c
lea rcx, [rsp + 0x2d00]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x78c], 0x3abeb93f
lea rdx, [0x1400ee1cc]
lea rcx, [rsp + 0x6c98]
call fcn.140003708
lea rcx, [rsp + 0x6c98]
call fcn.14000a93c
mov r8d, dword [rsp + 0x78c]
mov rdx, rax
lea rcx, [0x1400ee1d0]
call fcn.140044734
lea rcx, [rsp + 0x6c98]
call fcn.1400040f0
mov dword [rsp + 0x790], 0x24b1904f
lea rdx, str.BTJgG
lea rcx, [rsp + 0x6cb8]
call fcn.140003708
nop
lea rdx, [rsp + 0x6cb8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x790]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x6cb8]
call fcn.1400040f0
lea r9, [rsp + 0x2d08]
lea r8, [rsp + 0x2d10]
lea rdx, [rsp + 0x2d18]
lea rcx, [0x1400ee1e0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1fac], 0x10
lea rdx, [rsp + 0x1fac]
lea rcx, [rsp + 0x8f48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x378], 1
mov edx, 8
lea rcx, [rsp + 0x21a0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14009a6fa
mov eax, dword [rsp + 0x21a0]
mov dword [rsp + 0x1c18], eax
mov eax, dword [rsp + 0x21a4]
mov dword [rsp + 0x1c1c], eax
mov ecx, dword [rsp + 0x378]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x378]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1040], rax
cmp qword [rsp + 0x1040], 0
je 0x14009a764
lea rcx, [rsp + 0x8ad8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb70], rax
cmp qword [rsp + 0xb70], 0
je 0x1400a554d
lea rax, [rsp + 0x3cb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3cb8]
lea r8, [rsp + 0x3cc0]
lea rdx, [rsp + 0x3cc8]
mov rcx, qword [rsp + 0xb70]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xb70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xc40], 0x2c6b352
lea rdx, str.wYUK74i2kZ
lea rcx, [rsp + 0x5af8]
call fcn.140003708
lea rcx, [rsp + 0x5af8]
call fcn.14000a93c
mov r8d, dword [rsp + 0xc40]
mov rdx, rax
lea rcx, [0x1400ef338]
call fcn.140044734
lea rcx, [rsp + 0x5af8]
call fcn.1400040f0
lea r9, [rsp + 0x3cd0]
lea r8, [rsp + 0x3cd8]
lea rdx, [rsp + 0x3ce0]
lea rcx, [0x1400ef340]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x3ce8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0xc44], 0x3499db3b
lea rdx, str.GQPq
lea rcx, [rsp + 0x5b18]
call fcn.140003708
lea rcx, [rsp + 0x5b18]
call fcn.14000a93c
mov r8d, dword [rsp + 0xc44]
mov rdx, rax
lea rcx, [0x1400ef370]
call fcn.140044734
lea rcx, [rsp + 0x5b18]
call fcn.1400040f0
lea rcx, [rsp + 0x3cf0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x21990]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x1b8], 0
jmp 0x1400a565f
movsxd rax, dword [rsp + 0x1b8]
cmp rax, 0x400
jae 0x1400a5691
movsxd rax, dword [rsp + 0x1b8]
mov al, byte [rsp + rax + 0x21990]
inc al
movsxd rcx, dword [rsp + 0x1b8]
mov byte [rsp + rcx + 0x21990], al
jmp 0x1400a564f
mov dword [rsp + 0xc48], 0x34958c94
lea rdx, str.DglHAj6tm
lea rcx, [rsp + 0x5b38]
call fcn.140003708
nop
lea rdx, [rsp + 0x5b38]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0xc48]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x5b38]
call fcn.1400040f0
mov dword [rsp + 0x498], 1
mov edx, 8
lea rcx, [rsp + 0x23e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400a5749