Function at 0x14001b308
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a18]
mov eax, 0x3af0
call fcn.140034d80
sub rsp, rax
mov rax, qword [0x140077100]
xor rax, rsp
mov qword [rbp + 0x39e0], rax
mov rsi, rcx
mov qword [rbp + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x470], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x480], xmm1
mov r8d, 4
lea rdx, str.6IqX
lea rcx, [rbp + 0x470]
call fcn.14000192c
lea rdx, [rbp + 0x470]
cmp qword [rbp + 0x488], 0xf
cmova rdx, qword [rbp + 0x470]
mov r8d, 0x6c2d42
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x470]
call fcn.140005e28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r15d, r15d
test rax, rax
je 0x14001b403
lea rax, [rbp + 0x7d8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7e0]
lea r8, [rbp + 0x7e8]
lea rdx, [rbp + 0x7f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x7f8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov r13d, 1
test eax, eax
jne 0x14001b431
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], r15
mov edi, 0x80
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov r14d, 0x80000000
mov edx, r14d
lea rcx, str.wL.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or r12, 0xffffffffffffffff
cmp rax, r12
je 0x14001b475
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x948]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x800]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0x490], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4a0], xmm1
mov r8d, 6
lea rdx, str.Bosdl0
lea rcx, [rbp + 0x490]
call fcn.14000192c
lea rdx, [rbp + 0x490]
cmp qword [rbp + 0x4a8], 0xf
cmova rdx, qword [rbp + 0x490]
mov r8d, 0x2f88a02b
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x490]
call fcn.140005e28
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, r14d
lea rcx, str.UJkM6tjI9y.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001b527
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, r14d
lea rcx, str.r1Zbwj.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001b55c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x68], 0x10
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xa98]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x808]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x810]
lea r8, [rbp + 0x818]
lea rdx, [rbp + 0x820]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x828]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b5cb
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp + 0x4b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4c0], xmm1
mov r8d, 0xa
lea rdx, str.KYqFMjU181
lea rcx, [rbp + 0x4b0]
call fcn.14000192c
lea rdx, [rbp + 0x4b0]
cmp qword [rbp + 0x4c8], 0xf
cmova rdx, qword [rbp + 0x4b0]
mov r8d, 0x3a730f1f
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x4b0]
call fcn.140005e28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001b67f
lea rax, [rbp + 0x830]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x838]
lea r8, [rbp + 0x840]
lea rdx, [rbp + 0x848]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x6c], 0x10
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 0xab8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x850]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14001dd83
call fcn.1400081d0
test eax, eax
je 0x14001dd83
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xde0]
call fcn.140059690
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x11e0]
call fcn.140059690
lea rcx, [rbp + 0x998]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x9d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 8
lea rcx, [rbp + 0x858]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b727
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rbp + 0x9e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x860]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, r14d
lea rcx, str.SGTZMat.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001b776
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x70], 0x10
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xad8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x868]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001b7ec
lea rax, [rbp + 0x870]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x878]
lea r8, [rbp + 0x880]
lea rdx, [rbp + 0x888]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x890]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b814
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, 8
lea rcx, [rbp + 0x898]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001b83c
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp + 0x4d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4e0], xmm1
mov r8d, 2
lea rdx, [0x14005e868]
lea rcx, [rbp + 0x4d0]
call fcn.14000192c
lea rdx, [rbp + 0x4d0]
cmp qword [rbp + 0x4e8], 0xf
cmova rdx, qword [rbp + 0x4d0]
mov r8d, 0x308aced7
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x4d0]
call fcn.140005e28
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x15e0]
call fcn.140059690
lea rcx, [rbp + 0x9f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1c8], r15
mov r8d, 3
lea rdx, [0x14005e86c]
lea rcx, [rbp + 0x1b0]
call fcn.14000192c
nop
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova rdx, qword [rbp + 0x1b0]
mov r8, qword [rbp + 0x1c0]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x26c6163c
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
lea rcx, [rbp + 0x1b0]
call fcn.140005e28
lea rdx, [rbp + 0x54]
mov rcx, qword [rsi]
call fcn.140007fc4
mov r14, rax
jmp 0x14001dc99
lea rdx, [0x140078f80]
lea rcx, [rsp + 0x50]
call fcn.1400187d0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x88
call fcn.140034bc0
mov rbx, rax
mov qword [rbp + 0x18], rax
test rax, rax
je 0x14001b99c
xor edx, edx
mov r8d, 0x88
mov rcx, rax
call fcn.140059690
mov rcx, rbx
call fcn.14000ba30
jmp 0x14001b99f
mov rax, r15
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000d340
nop
lea r9, [rbp + 0x8a0]
lea r8, [rbp + 0x8a8]
lea rdx, [rbp + 0x8b0]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], r15
mov qword [rbp + 0x3a8], r15
mov r8d, 0xa
lea rdx, str.pVsw2ThIsj
lea rcx, [rbp + 0x390]
call fcn.14000192c
lea rdx, [rbp + 0x390]
cmp qword [rbp + 0x3a8], 0xf
cmova rdx, qword [rbp + 0x390]
mov r8d, 0x1b7afe37
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x390]
call fcn.140005e28
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], r15
mov qword [rbp + 0x1e8], r15
mov r8, r13
lea rdx, [0x14005e87c]
lea rcx, [rbp + 0x1d0]
call fcn.14000192c
nop
lea rdx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rdx, qword [rbp + 0x1d0]
mov r8, qword [rbp + 0x1e0]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x205b070f
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
lea rcx, [rbp + 0x1d0]
call fcn.140005e28
mov dword [rbp + 0x74], 0x10
lea rdx, [rbp + 0x74]
lea rcx, [rbp + 0xaf8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0xa08]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rbp + 0x78], 0x10
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0xb18]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r15
mov qword [rbp + 0x3c8], r15
mov r8d, 6
lea rdx, str.Z9QeoD
lea rcx, [rbp + 0x3b0]
call fcn.14000192c
lea rdx, [rbp + 0x3b0]
cmp qword [rbp + 0x3c8], 0xf
cmova rdx, qword [rbp + 0x3b0]
mov r8d, 0x1fb865e1
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x3b0]
call fcn.140005e28
lea rcx, [rbp + 0xa18]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r15
mov qword [rbp + 0x3e8], r15
mov r8d, 4
lea rdx, str.eTO8
lea rcx, [rbp + 0x3d0]
call fcn.14000192c
lea rdx, [rbp + 0x3d0]
cmp qword [rbp + 0x3e8], 0xf
cmova rdx, qword [rbp + 0x3d0]
mov r8d, 0x2615ba09
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x3d0]
call fcn.140005e28
mov dword [rbp + 0x7c], 0x10
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 0xb38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0xa28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rbp + 0x80], 0x10
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xb58]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], r15
mov qword [rbp + 0x408], r15
mov r8d, 3
lea rdx, [0x14005e890]
lea rcx, [rbp + 0x3f0]
call fcn.14000192c
lea rdx, [rbp + 0x3f0]
cmp qword [rbp + 0x408], 0xf
cmova rdx, qword [rbp + 0x3f0]
mov r8d, 0x19892f4
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x3f0]
call fcn.140005e28
mov dword [rbp + 0x84], 0x10
lea rdx, [rbp + 0x84]
lea rcx, [rbp + 0xb78]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0xac], 0x10
lea rdx, [rbp + 0xac]
lea rcx, [rbp + 0xb98]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001bcfc
lea rax, [rbp + 0x8b8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x8c0]
lea r8, [rbp + 0x8c8]
lea rdx, [rbp + 0x8d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
mov qword [rbp + 0x420], r15
mov qword [rbp + 0x428], r15
mov r8, r13
lea rdx, [0x14005e894]
lea rcx, [rbp + 0x410]
call fcn.14000192c
lea rdx, [rbp + 0x410]
cmp qword [rbp + 0x428], 0xf
cmova rdx, qword [rbp + 0x410]
mov r8d, 0xa0ea98e
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x410]
call fcn.140005e28
mov r8d, dword [rbp + 0x54]
mov rdx, r14
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.14000cc8c
test al, al
je 0x14001dd6d
lea rcx, [rbp + 0x8d8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, 0x400
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x19e0]
call fcn.140059690
mov dword [rbp + 0x88], 0x10
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xbb8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0x8c], 0x10
lea rdx, [rbp + 0x8c]
lea rcx, [rbp + 0xbd8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0xa38]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001be42
lea rax, [rbp + 0x8e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x8f0]
lea r8, [rbp + 0x8f8]
lea rdx, [rbp + 0x900]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x908]
lea r8, [rbp + 0x910]
lea rdx, [rbp + 0x918]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x920]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x928]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x930]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x938]
lea r8, [rbp + 0x940]
lea rdx, [rbp + 0x4f0]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x430], xmm0
mov qword [rbp + 0x440], r15
mov qword [rbp + 0x448], r15
mov r8d, 0xa
lea rdx, str.BnO4xk4FDb
lea rcx, [rbp + 0x430]
call fcn.14000192c
lea rdx, [rbp + 0x430]
mov ebx, 0xf
cmp qword [rbp + 0x448], rbx
cmova rdx, qword [rbp + 0x430]
mov r8d, 0x2d91adac
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x430]
call fcn.140005e28
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x1de0]
call fcn.140059690
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x208], r15
lea r8d, [rbx - 5]
lea rdx, str.RULqXpDmRr
lea rcx, [rbp + 0x1f0]
call fcn.14000192c
nop
lea rdx, [rbp + 0x1f0]
cmp qword [rbp + 0x208], rbx
cmova rdx, qword [rbp + 0x1f0]
mov r8, qword [rbp + 0x200]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x1b32c80a
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
lea rcx, [rbp + 0x1f0]
call fcn.140005e28
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], r15
mov qword [rbp + 0x228], r15
lea r8d, [rbx - 0xb]
lea rdx, str.lpUS
lea rcx, [rbp + 0x210]
call fcn.14000192c
nop
lea rdx, [rbp + 0x210]
cmp qword [rbp + 0x228], rbx
cmova rdx, qword [rbp + 0x210]
mov r8, qword [rbp + 0x220]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0xc3de131
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
lea rcx, [rbp + 0x210]
call fcn.140005e28
lea rcx, [rbp + 0xa48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rcx, rdi
call fcn.14000c6bc
sub dword [rbp + 0x54], eax
lea r9, [rbp + 0x4f8]
lea r8, [rbp + 0x500]
lea rdx, [rbp + 0x508]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x510]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x248], r15
lea r8d, [rbx - 6]
lea rdx, str.DYM1rgTlW
lea rcx, [rbp + 0x230]
call fcn.14000192c
nop
lea rdx, [rbp + 0x230]
cmp qword [rbp + 0x248], rbx
cmova rdx, qword [rbp + 0x230]
mov r8, qword [rbp + 0x240]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0xce4de3e
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
lea rcx, [rbp + 0x230]
call fcn.140005e28
lea rcx, [rbp + 0x518]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [rbx - 7]
lea rcx, [rbp + 0x520]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c116
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp + 0x450], xmm0
mov qword [rbp + 0x460], r15
mov qword [rbp + 0x468], r15
mov r8d, 8
lea rdx, str.8Le2YuFN
lea rcx, [rbp + 0x450]
call fcn.14000192c
lea rdx, [rbp + 0x450]
cmp qword [rbp + 0x468], rbx
cmova rdx, qword [rbp + 0x450]
mov r8d, 0x2bb223ad
lea rcx, str._s:__d
call fcn.1400184d4
lea rcx, [rbp + 0x450]
call fcn.140005e28
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x21e0]
call fcn.140059690
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
mov r8d, 6
lea rdx, str.IJYDmk
lea rcx, [rbp + 0xd0]
call fcn.14000192c
nop
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], rbx
cmova rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0xbf6963b
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, rbx
jbe 0x14001c240
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c23b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de09
call fcn.140034bfc
mov edx, 8
lea rcx, [rbp + 0x528]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c268
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.Zur2.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001c2a3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.1DEAGgiNi.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001c2de
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.oJ0ierl.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001c319
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], r15
mov r8d, 8
lea rdx, str.lH7RZhSv
lea rcx, [rbp + 0xf0]
call fcn.14000192c
nop
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], rbx
cmova rdx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0x100]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x1c4f1dfa
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, rbx
jbe 0x14001c3ca
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c3c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de0f
call fcn.140034bfc
mov dword [rbp + 0x90], 0x10
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xbf8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x530]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], r15
mov r8d, 4
lea rdx, str.90WU
lea rcx, [rbp + 0x250]
call fcn.14000192c
lea rdx, [rbp + 0x250]
cmp qword [rbp + 0x268], rbx
cmova rdx, qword [rbp + 0x250]
mov r8d, 0xf3bb438
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x268]
cmp rdx, rbx
jbe 0x14001c48e
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c489
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de15
call fcn.140034bfc
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], r15
mov r8d, 4
lea rdx, str.dJbJ
lea rcx, [rbp + 0x270]
call fcn.14000192c
lea rdx, [rbp + 0x270]
cmp qword [rbp + 0x288], rbx
cmova rdx, qword [rbp + 0x270]
mov r8d, 0xb8c34c
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x288]
cmp rdx, rbx
jbe 0x14001c527
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c522
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de1b
call fcn.140034bfc
mov rcx, rdi
call fcn.14000c6bc
mov eax, eax
add r14, rax
lea r9, [rbp + 0x538]
lea r8, [rbp + 0x540]
lea rdx, [rbp + 0x548]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x550]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c57e
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ebx, 0x10
mov dword [rbp + 0x94], ebx
lea rdx, [rbp + 0x94]
lea rcx, [rbp + 0xc18]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.rq6.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001c5d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x558]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c600
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rbp + 0x98], ebx
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0xc38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, 8
lea rcx, [rbp + 0x560]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c642
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ebx, 0x400
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x25e0]
call fcn.140059690
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001c6a6
lea rax, [rbp + 0x568]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x570]
lea r8, [rbp + 0x578]
lea rdx, [rbp + 0x580]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x588]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001c6ce
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rbp + 0x9c], 0x10
lea rdx, [rbp + 0x9c]
lea rcx, [rbp + 0xc58]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], r15
mov r8d, 7
lea rdx, str.WCAs8xr
lea rcx, [rbp + 0x110]
call fcn.14000192c
nop
lea rdx, [rbp + 0x110]
cmp qword [rbp + 0x128], 0xf
cmova rdx, qword [rbp + 0x110]
mov r8, qword [rbp + 0x120]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x2353826f
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x14001c79f
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c79a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de21
call fcn.140034bfc
lea rcx, [rbp + 0xa58]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001c7fd
lea rax, [rbp + 0x590]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x598]
lea r8, [rbp + 0x5a0]
lea rdx, [rbp + 0x5a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
mov qword [rbp + 0x2a0], r15
mov qword [rbp + 0x2a8], r15
mov r8d, 4
lea rdx, str.O3gp
lea rcx, [rbp + 0x290]
call fcn.14000192c
lea rdx, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 0xf
cmova rdx, qword [rbp + 0x290]
mov r8d, 0x1ba4976c
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0xf
jbe 0x14001c898
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c893
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de27
call fcn.140034bfc
lea rcx, [rbp + 0xa68]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001c8f6
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x5b8]
lea r8, [rbp + 0x6b8]
lea rdx, [rbp + 0x5c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14000c820
mov rcx, rdi
cmp al, r13b
jne 0x14001d34c
mov dl, r13b
call fcn.14000be30
test al, al
je 0x14001dce5
mov r8b, r13b
lea rdx, [rbp]
mov rcx, rdi
call fcn.14000c57c
nop
lea rdx, [rbp + 0x50]
mov rcx, qword [rax]
call fcn.14000c8ec
mov dil, al
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x14001c96d
mov ecx, r12d
lock xadd dword [rbx + 8], ecx
add ecx, r12d
jne 0x14001c96d
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001c96d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
test dil, dil
je 0x14001dce5
mov al, byte [rbp + 0x50]
cmp al, r13b
jne 0x14001ca64
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov ecx, 0xa8
call fcn.140034bc0
mov rbx, rax
mov qword [rbp + 0x28], rax
test rax, rax
je 0x14001c9b9
xor edx, edx
mov r8d, 0xa8
mov rcx, rax
call fcn.140059690
mov rcx, rbx
call fcn.14000e1bc
jmp 0x14001c9bc
mov rax, r15
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400185e4
nop
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001c9e0
lock add dword [rcx + 8], r13d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x70], xmm0
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
call fcn.1400113e4
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x14001ca11
lock add dword [rbx + 8], r13d
mov rbx, qword [rbp - 0x78]
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call fcn.14001df70
nop
test rbx, rbx
je 0x14001dc52
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
jne 0x14001dc52
mov rbx, qword [rbp - 0x78]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001dc52
mov rcx, qword [rbp - 0x78]
jmp 0x14001d344
cmp al, 2
jne 0x14001dc52
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov edi, 0xc0
mov ecx, edi
call fcn.140034bc0
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14001caa3
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.140059690
mov rcx, rbx
call fcn.1400082d8
jmp 0x14001caa6
mov rax, r15
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14001857c
nop
lea r9, [rbp + 0x5c8]
lea r8, [rbp + 0x5d0]
lea rdx, [rbp + 0x5d8]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001cafe
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ebx, 0x10
mov dword [rbp + 0xa0], ebx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xc78]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.rq6.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001cb58
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x5e8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001cb80
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rbp + 0xa4], ebx
lea rdx, [rbp + 0xa4]
lea rcx, [rbp + 0xc98]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, 8
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001cbc2
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov edi, 0x400
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x29e0]
call fcn.140059690
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001cc26
lea rax, [rbp + 0x5f8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x600]
lea r8, [rbp + 0x608]
lea rdx, [rbp + 0x610]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
lea rcx, [rbp + 0x618]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001cc4e
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rbp + 0xa8], 0x10
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xcb8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x148], r15
mov r8d, 7
lea rdx, str.WCAs8xr
lea rcx, [rbp + 0x130]
call fcn.14000192c
nop
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rdx, qword [rbp + 0x130]
mov r8, qword [rbp + 0x140]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x2353826f
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x14001cd1f
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cd1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de2d
call fcn.140034bfc
lea rcx, [rbp + 0xa78]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001cd7a
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x628]
lea r8, [rbp + 0x630]
lea rdx, [rbp + 0x638]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov qword [rbp + 0x2c0], r15
mov qword [rbp + 0x2c8], r15
mov r8d, 4
lea rdx, str.O3gp
lea rcx, [rbp + 0x2b0]
call fcn.14000192c
lea rdx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0xf
cmova rdx, qword [rbp + 0x2b0]
mov r8d, 0x1ba4976c
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0xf
jbe 0x14001ce15
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ce10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de33
call fcn.140034bfc
lea rcx, [rbp + 0xa88]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001ce70
lea rax, [rbp + 0x640]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x648]
lea r8, [rbp + 0x650]
lea rdx, [rbp + 0x658]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001ce87
lock add dword [rcx + 8], r13d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x20], xmm0
mov rbx, qword [rsp + 0x60]
mov rax, qword [rbx]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [rax + 8]
test al, al
je 0x14001dca8
mov rcx, rbx
call fcn.1400088dc
mov dword [rsp + 0x70], eax
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x40]
lea rcx, [0x140078fd0]
call fcn.1400186c0
mov rcx, qword [rax]
add rcx, 0x28
lea rdx, [rsp + 0x60]
call fcn.14000bbb8
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.M2Hcj.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001cf18
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x958]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rbp + 0xb0], 0x10
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0xcd8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x968]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.Vljkx.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001cf98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], r15
mov r8d, 9
lea rdx, str.wAoxp694f
lea rcx, [rbp + 0x150]
call fcn.14000192c
nop
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0xf
cmova rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x21b60f3e
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x14001d04b
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d046
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de39
call fcn.140034bfc
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.4tOn.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001d086
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rdi
xor edx, edx
lea rcx, [rbp + 0x2de0]
call fcn.140059690
mov edx, 8
lea rcx, [rbp + 0x660]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d0bf
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001d10d
lea rax, [rbp + 0x668]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x670]
lea r8, [rbp + 0x678]
lea rdx, [rbp + 0x680]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xcc], 0x10
lea rdx, [rbp + 0xcc]
lea rcx, [rbp + 0xcf8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
mov qword [rbp + 0x2e0], r15
mov qword [rbp + 0x2e8], r15
mov r8d, 7
lea rdx, str.rrBEHm2
lea rcx, [rbp + 0x2d0]
call fcn.14000192c
lea rdx, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 0xf
cmova rdx, qword [rbp + 0x2d0]
mov r8d, 0x126f382d
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x2e8]
cmp rdx, 0xf
jbe 0x14001d1c6
inc rdx
mov rcx, qword [rbp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d1c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de3f
call fcn.140034bfc
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov edi, 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.v3d.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001d202
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0x300], r15
mov qword [rbp + 0x308], r15
mov r8, rdi
lea rdx, [0x14005e9e8]
lea rcx, [rbp + 0x2f0]
call fcn.14000192c
lea rdx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 0xf
cmova rdx, qword [rbp + 0x2f0]
mov r8d, 0x2ddc9ffb
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x308]
cmp rdx, 0xf
jbe 0x14001d29a
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d295
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de45
call fcn.140034bfc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001d2eb
lea rax, [rbp + 0x688]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x690]
lea r8, [rbp + 0x698]
lea rdx, [rbp + 0x6a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x988]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001dc52
mov eax, r12d
lock xadd dword [rcx + 8], eax
add eax, r12d
jne 0x14001dc52
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001dc52
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
jmp 0x14001d466
call fcn.14000c820
cmp al, 3
jne 0x14001d46e
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001d379
lock add dword [rcx + 8], r13d
mov rdi, qword [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x58]
call fcn.1400020d0
nop
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x14001ddbb
cmp byte [rax + 0x5c], r15b
jne 0x14001d418
mov dl, 3
mov rcx, rdi
call fcn.14000be30
test al, al
je 0x14001d3da
mov rbx, qword [rbp + 0x58]
mov r8b, 3
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.14000c57c
mov r8, qword [rbx]
mov rdx, rax
mov rcx, rbx
call qword [r8 + 8]
test al, al
je 0x14001dd63
mov rcx, qword [rbp + 0x58]
call fcn.1400088dc
mov dword [rsp + 0x74], eax
lea r8, [rsp + 0x74]
lea rdx, [rbp + 0x30]
lea rcx, [0x140078fd0]
call fcn.1400186c0
mov rcx, qword [rax]
add rcx, 0x28
lea rdx, [rbp + 0x58]
call fcn.14000bbb8
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14001d429
lea rdx, [rbp + 0x58]
lea rcx, [0x140078f50]
call fcn.140008224
nop
mov rbx, qword [rbp + 0x60]
test rbx, rbx
je 0x14001dc52
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
jne 0x14001dc52
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001dc52
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x14001dc52
mov rcx, rdi
call fcn.14000c820
cmp al, 5
jne 0x14001d8bb
lea r9, [rbp + 0x6a8]
lea r8, [rbp + 0x6b0]
lea rdx, [rbp + 0x7d0]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 8
lea rcx, [rbp + 0x6c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d4c8
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rbp + 0xc8], 0x10
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xd18]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], r15
mov qword [rbp + 0x188], r15
mov r8d, 6
lea rdx, str.4w03CZ
lea rcx, [rbp + 0x170]
call fcn.14000192c
nop
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0xf
cmova rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x383ce73a
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x188]
mov edi, 0x1000
cmp rdx, 0xf
jbe 0x14001d59a
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, rdi
jb 0x14001d595
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de4b
call fcn.140034bfc
mov edx, 8
lea rcx, [rbp + 0x6c8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d5c2
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001d613
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6d8]
lea r8, [rbp + 0x6e0]
lea rdx, [rbp + 0x6e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xc4], 0x10
lea rdx, [rbp + 0xc4]
lea rcx, [rbp + 0xd38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
mov qword [rbp + 0x320], r15
mov qword [rbp + 0x328], r15
mov r8d, 0xa
lea rdx, str.WcoE6brfDM
lea rcx, [rbp + 0x310]
call fcn.14000192c
lea rdx, [rbp + 0x310]
cmp qword [rbp + 0x328], 0xf
cmova rdx, qword [rbp + 0x310]
mov r8d, 0x253b03a9
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x328]
cmp rdx, 0xf
jbe 0x14001d6c8
inc rdx
mov rcx, qword [rbp + 0x310]
mov rax, rcx
cmp rdx, rdi
jb 0x14001d6c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de51
call fcn.140034bfc
mov dword [rbp + 0xc0], 0x10
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xd58]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbp + 0x6f0]
lea r8, [rbp + 0x6f8]
lea rdx, [rbp + 0x700]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001d759
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
lea r8, [rbp + 0x718]
lea rdx, [rbp + 0x720]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xbc], 0x10
lea rdx, [rbp + 0xbc]
lea rcx, [rbp + 0xd78]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbp + 0x728]
lea r8, [rbp + 0x730]
lea rdx, [rbp + 0x738]
lea rcx, [0x14005dfa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x740]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movups xmmword [rbp + 0x330], xmm0
mov qword [rbp + 0x340], r15
mov qword [rbp + 0x348], r15
mov r8d, 9
lea rdx, str.sOZRctAl1
lea rcx, [rbp + 0x330]
call fcn.14000192c
lea rdx, [rbp + 0x330]
cmp qword [rbp + 0x348], 0xf
cmova rdx, qword [rbp + 0x330]
mov r8d, 0xa69d5b9
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x348]
cmp rdx, 0xf
jbe 0x14001d83d
inc rdx
mov rcx, qword [rbp + 0x330]
mov rax, rcx
cmp rdx, rdi
jb 0x14001d838
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de57
call fcn.140034bfc
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.YZM3rFoyX.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x14001d878
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x31e0]
call fcn.140059690
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001d8a3
lock add dword [rcx + 8], r13d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call fcn.140019230
jmp 0x14001dc52
mov rcx, rdi
call fcn.14000c820
cmp al, 0xc
jne 0x14001dc52
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], r15
mov qword [rbp + 0x1a8], r15
mov r8d, 2
lea rdx, [0x14005ea34]
lea rcx, [rbp + 0x190]
call fcn.14000192c
nop
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rdx, qword [rbp + 0x190]
mov r8, qword [rbp + 0x1a0]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0xfa18948
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x14001d97e
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d979
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ddfd
call fcn.140034bfc
mov edx, 8
lea rcx, [rbp + 0x748]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001d9a6
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rbp + 0x750]
lea r8, [rbp + 0x758]
lea rdx, [rbp + 0x760]
lea rdi, [0x14005dfa8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001da1c
lea rax, [rbp + 0x768]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x770]
lea r8, [rbp + 0x778]
lea rdx, [rbp + 0x780]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x788]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rbp + 0x790]
lea r8, [rbp + 0x798]
lea rdx, [rbp + 0x7a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rbp + 0xb8], 0x10
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0xd98]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, 8
lea rcx, [rbp + 0x7a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14001da8d
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xorps xmm0, xmm0
movups xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0x360], r15
mov qword [rbp + 0x368], r15
mov r8, r13
lea rdx, [0x14005ea38]
lea rcx, [rbp + 0x350]
call fcn.14000192c
lea rdx, [rbp + 0x350]
cmp qword [rbp + 0x368], 0xf
cmova rdx, qword [rbp + 0x350]
mov r8d, 0x264d6ba1
lea rcx, str._s:__d
call fcn.1400184d4
mov rdx, qword [rbp + 0x368]
cmp rdx, 0xf
jbe 0x14001db25
inc rdx
mov rcx, qword [rbp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001db20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de03
call fcn.140034bfc
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rbp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rbp + 0x9b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r9, [rbp + 0x7b8]
lea r8, [rbp + 0x7c0]
lea rdx, [rbp + 0x7c8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rbp + 0x9c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
mov qword [rbp + 0x380], r15
mov qword [rbp + 0x388], r15
mov r8d, 4
lea rdx, str.5yQt
lea rcx, [rbp + 0x370]
call fcn.14000192c
nop
lea rdx, [rbp + 0x370]
cmp qword [rbp + 0x388], 0xf
cmova rdx, qword [rbp + 0x370]
mov r8, qword [rbp + 0x380]
lea rcx, [0x140079600]
call fcn.14000d8a0
mov edx, 0x1b9e60e7
mov rcx, rax
call fcn.14000e914
mov rcx, rax
call fcn.14000de34
nop
lea rcx, [rbp + 0x370]
call fcn.140005e28
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x35e0]
call fcn.140059690
mov dword [rbp + 0xb4], 0x10
lea rdx, [rbp + 0xb4]
lea rcx, [rbp + 0xdb8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001dc3e
lock add dword [rcx + 8], r13d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call fcn.14000d0d0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001dc8f
mov eax, r12d
lock xadd dword [rcx + 8], eax
add eax, r12d
jne 0x14001dc8f
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001dc8f
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400327d4
cmp dword [rbp + 0x54], r15d
jne 0x14001b952
jmp 0x14001dd83
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001dce5
mov eax, r12d
lock xadd dword [rcx + 8], eax
add eax, r12d
jne 0x14001dce5
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001dce5
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001dd22
mov eax, r12d
lock xadd dword [rcx + 8], eax
add eax, r12d
jne 0x14001dd22
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001dd22
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400327d4
nop
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14001dd8b
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
jne 0x14001dd8b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001dd8b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x14001dd8b
lea rcx, [rbp + 0x58]
call fcn.140001380
nop
lea rcx, [rsp + 0x40]
call fcn.140001380
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400327d4
nop
mov rcx, rsi
call fcn.140001380
mov rcx, qword [rbp + 0x39e0]
xor rcx, rsp
call fcn.140034ca0
lea r11, [rsp + 0x3af0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rbx, qword [rbp + 0x60]
test rbx, rbx
je 0x14001dce5
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
jne 0x14001dce5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14001dce5
mov rax, qword [rbx]
mov rcx, rbx
jmp 0x14001dce1
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
nop
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
nop
call fcn.14003be04
int3
call fcn.14003be04
int3
call fcn.14003be04
int3