Function at 0x1400523ec
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x5ce0
call fcn.1400b6760
sub rsp, rax
mov rax, qword [0x14010c080]
xor rax, rsp
mov qword [rsp + 0x5cd0], rax
mov dword [rsp + 0xe0], 0x708fdb4
lea rdx, str.yseuJcS
lea rcx, [rsp + 0xdc8]
call fcn.140003708
nop
lea rdx, [rsp + 0xdc8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0xe0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xdc8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.anDw66VjT.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x298], rax
cmp qword [rsp + 0x298], 0xffffffffffffffff
je 0x1400524ca
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x4c8]
lea r8, [rsp + 0x4d0]
lea rdx, [rsp + 0x4d8]
lea rcx, [0x1400ea788]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x14d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
jmp 0x140052525
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x400
jae 0x14005254e
movsxd rax, dword [rsp + 0x40]
mov al, byte [rsp + rax + 0x14d0]
inc al
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0x14d0], al
jmp 0x14005251b
mov dword [rsp + 0x3f0], 0x10
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x1288]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xf0], 0x2ab37494
lea rdx, [0x1400ea790]
lea rcx, [rsp + 0xde8]
call fcn.140003708
lea rcx, [rsp + 0xde8]
call fcn.14000a93c
mov r8d, dword [rsp + 0xf0]
mov rdx, rax
lea rcx, [0x1400ea794]
call fcn.140044734
lea rcx, [rsp + 0xde8]
call fcn.1400040f0
lea rcx, [rsp + 0x4e8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x18d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
jmp 0x1400525f5
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0x400
jae 0x14005261e
movsxd rax, dword [rsp + 0x44]
mov al, byte [rsp + rax + 0x18d0]
inc al
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0x18d0], al
jmp 0x1400525eb
lea rcx, [rsp + 0x1138]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x3f4], 0x10
lea rdx, [rsp + 0x3f4]
lea rcx, [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x260], rax
cmp qword [rsp + 0x260], 0
je 0x1400526c5
lea rax, [rsp + 0x4f8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x500]
lea r8, [rsp + 0x508]
lea rdx, [rsp + 0x510]
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3f8], 0x10
lea rdx, [rsp + 0x3f8]
lea rcx, [rsp + 0x12c8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x268], rax
cmp qword [rsp + 0x268], 0
je 0x140052750
lea rax, [rsp + 0x518]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x520]
lea r8, [rsp + 0x528]
lea rdx, [rsp + 0x530]
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x108], 0x801b996
lea rdx, [0x1400ea79c]
lea rcx, [rsp + 0xa88]
call fcn.140003708
nop
lea rdx, [rsp + 0xa88]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x108]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xa88]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x1400ea7a0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2a0], rax
cmp qword [rsp + 0x2a0], 0xffffffffffffffff
je 0x140052805
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3fc], 0x10
lea rdx, [rsp + 0x3fc]
lea rcx, [rsp + 0x12e8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x538]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
je 0x14005289e
lea rax, [rsp + 0x540]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x548]
lea r8, [rsp + 0x550]
lea rdx, [rsp + 0x558]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x1cd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
jmp 0x1400528c6
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x400
jae 0x1400528ef
movsxd rax, dword [rsp + 0x48]
mov al, byte [rsp + rax + 0x1cd0]
inc al
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0x1cd0], al
jmp 0x1400528bc
lea rcx, [rsp + 0x1148]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x20d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 0
jmp 0x140052925
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
cmp rax, 0x400
jae 0x14005294e
movsxd rax, dword [rsp + 0x4c]
mov al, byte [rsp + rax + 0x20d0]
inc al
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x20d0], al
jmp 0x14005291b
lea r9, [rsp + 0x560]
lea r8, [rsp + 0x568]
lea rdx, [rsp + 0x570]
lea rcx, [0x1400ea7b8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0
je 0x1400529dd
lea rax, [rsp + 0x578]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x580]
lea r8, [rsp + 0x588]
lea rdx, [rsp + 0x590]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x24d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
jmp 0x140052a05
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
cmp rax, 0x400
jae 0x140052a2e
movsxd rax, dword [rsp + 0x50]
mov al, byte [rsp + rax + 0x24d0]
inc al
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x24d0], al
jmp 0x1400529fb
mov dword [rsp + 0x8c], 1
mov edx, 8
lea rcx, [rsp + 0x4b8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140052a86
mov eax, dword [rsp + 0x4b8]
mov dword [rsp + 0x398], eax
mov eax, dword [rsp + 0x4bc]
mov dword [rsp + 0x39c], eax
mov ecx, dword [rsp + 0x8c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x8c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x118], 0x11395122
lea rdx, str.fTc9NCJ
lea rcx, [rsp + 0xe28]
call fcn.140003708
lea rcx, [rsp + 0xe28]
call fcn.14000a93c
mov r8d, dword [rsp + 0x118]
mov rdx, rax
lea rcx, [0x1400ea7c8]
call fcn.140044734
lea rcx, [rsp + 0xe28]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x280], 0
je 0x140052b40
lea rax, [rsp + 0x598]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5a0]
lea r8, [rsp + 0x5a8]
lea rdx, [rsp + 0x5b0]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x11c], 0x3080f071
lea rdx, [0x1400ea7d0]
lea rcx, [rsp + 0xe48]
call fcn.140003708
nop
lea rdx, [rsp + 0xe48]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x11c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xe48]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.D0QfeQ9LhA.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x288], rax
cmp qword [rsp + 0x288], 0xffffffffffffffff
je 0x140052bf5
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x5b8]
lea r8, [rsp + 0x5c0]
lea rdx, [rsp + 0x5c8]
lea rcx, [0x1400ea7f8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x120], 0x1574a9d1
lea rdx, str.rZCreSR
lea rcx, [rsp + 0xaa8]
call fcn.140003708
lea rcx, [rsp + 0xaa8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x120]
mov rdx, rax
lea rcx, [0x1400ea808]
call fcn.140044734
lea rcx, [rsp + 0xaa8]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Rcj4gr.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2a8], rax
cmp qword [rsp + 0x2a8], 0xffffffffffffffff
je 0x140052cbf
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.V5I4SjAPM.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0xffffffffffffffff
je 0x140052d14
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x90], 1
mov edx, 8
lea rcx, [rsp + 0x448]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140052d7a
mov eax, dword [rsp + 0x448]
mov dword [rsp + 0x3b0], eax
mov eax, dword [rsp + 0x44c]
mov dword [rsp + 0x358], eax
mov ecx, dword [rsp + 0x90]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x90]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x94], 1
mov edx, 8
lea rcx, [rsp + 0x450]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140052dd2
mov eax, dword [rsp + 0x450]
mov dword [rsp + 0x3a0], eax
mov eax, dword [rsp + 0x454]
mov dword [rsp + 0x3a4], eax
mov ecx, dword [rsp + 0x94]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x94]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x5d8]
lea r8, [rsp + 0x5e0]
lea rdx, [rsp + 0x5e8]
lea rcx, [0x1400ea848]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xe8], rax
cmp qword [rsp + 0xe8], 0
je 0x140052e61
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5f8]
lea r8, [rsp + 0x600]
lea rdx, [rsp + 0x608]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1158]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x98], 1
mov edx, 8
lea rcx, [rsp + 0x490]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140052ec7
mov eax, dword [rsp + 0x490]
mov dword [rsp + 0x3a8], eax
mov eax, dword [rsp + 0x494]
mov dword [rsp + 0x3ac], eax
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x1168]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x9c], 1
mov edx, 8
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140052f2d
mov eax, dword [rsp + 0x4a0]
mov dword [rsp + 0x3b4], eax
mov eax, dword [rsp + 0x4a4]
mov dword [rsp + 0x3bc], eax
mov ecx, dword [rsp + 0x9c]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x9c]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x610]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
je 0x140052fa5
lea rax, [rsp + 0x618]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x620]
lea r8, [rsp + 0x628]
lea rdx, [rsp + 0x630]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x100], rax
cmp qword [rsp + 0x100], 0
je 0x14005300f
lea rax, [rsp + 0x638]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x640]
lea r8, [rsp + 0x648]
lea rdx, [rsp + 0x650]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x658]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1178]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x400], 0x10
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x1308]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x660]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x130], 0x3059898a
lea rdx, [0x1400ea850]
lea rcx, [rsp + 0xac8]
call fcn.140003708
lea rcx, [rsp + 0xac8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x130]
mov rdx, rax
lea rcx, [0x1400ea854]
call fcn.140044734
lea rcx, [rsp + 0xac8]
call fcn.1400040f0
lea rcx, [rsp + 0x1188]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x110], rax
cmp qword [rsp + 0x110], 0
je 0x140053122
lea rax, [rsp + 0x668]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x670]
lea r8, [rsp + 0x678]
lea rdx, [rsp + 0x680]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x134], 0x2641acbe
lea rdx, str.o1KGnQWO
lea rcx, [rsp + 0xae8]
call fcn.140003708
nop
lea rdx, [rsp + 0xae8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x134]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xae8]
call fcn.1400040f0
mov dword [rsp + 0x138], 0x358caa75
lea rdx, str.tEE3Ylpn
lea rcx, [rsp + 0xb08]
call fcn.140003708
lea rcx, [rsp + 0xb08]
call fcn.14000a93c
mov r8d, dword [rsp + 0x138]
mov rdx, rax
lea rcx, [0x1400ea87c]
call fcn.140044734
lea rcx, [rsp + 0xb08]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.LXux.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2b8], rax
cmp qword [rsp + 0x2b8], 0xffffffffffffffff
je 0x140053227
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x128], 0
je 0x140053291
lea rax, [rsp + 0x688]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x690]
lea r8, [rsp + 0x698]
lea rdx, [rsp + 0x6a0]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x28d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0
jmp 0x1400532b9
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
cmp rax, 0x400
jae 0x1400532e2
movsxd rax, dword [rsp + 0x54]
mov al, byte [rsp + rax + 0x28d0]
inc al
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0x28d0], al
jmp 0x1400532af
mov dword [rsp + 0xa0], 1
mov edx, 8
lea rcx, [rsp + 0x438]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14005333a
mov eax, dword [rsp + 0x438]
mov dword [rsp + 0x3c0], eax
mov eax, dword [rsp + 0x43c]
mov dword [rsp + 0x3c4], eax
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x13c], 0x247d65f4
lea rdx, [0x1400ea89c]
lea rcx, [rsp + 0xb28]
call fcn.140003708
nop
lea rdx, [rsp + 0xb28]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x13c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xb28]
call fcn.1400040f0
mov dword [rsp + 0x140], 0x25c9ef45
lea rdx, [0x1400ea8a0]
lea rcx, [rsp + 0xb48]
call fcn.140003708
lea rcx, [rsp + 0xb48]
call fcn.14000a93c
mov r8d, dword [rsp + 0x140]
mov rdx, rax
lea rcx, [0x1400ea8a4]
call fcn.140044734
lea rcx, [rsp + 0xb48]
call fcn.1400040f0
lea rax, [rsp + 0x2cd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
jmp 0x140053412
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
cmp rax, 0x400
jae 0x14005343b
movsxd rax, dword [rsp + 0x58]
mov al, byte [rsp + rax + 0x2cd0]
inc al
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0x2cd0], al
jmp 0x140053408
lea rcx, [rsp + 0x6a8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x1198]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x11a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x11b8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x144], 0xb3d7c3e
lea rdx, str.b6bEp7WL
lea rcx, [rsp + 0xb68]
call fcn.140003708
lea rcx, [rsp + 0xb68]
call fcn.14000a93c
mov r8d, dword [rsp + 0x144]
mov rdx, rax
lea rcx, [0x1400ea8bc]
call fcn.140044734
lea rcx, [rsp + 0xb68]
call fcn.1400040f0
mov dword [rsp + 0x148], 0x13c34f15
lea rdx, str.bkJGfu
lea rcx, [rsp + 0xb88]
call fcn.140003708
nop
lea rdx, [rsp + 0xb88]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x148]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xb88]
call fcn.1400040f0
mov dword [rsp + 0xa4], 1
mov edx, 8
lea rcx, [rsp + 0x440]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14005357b
mov eax, dword [rsp + 0x440]
mov dword [rsp + 0x3c8], eax
mov eax, dword [rsp + 0x444]
mov dword [rsp + 0x33c], eax
mov ecx, dword [rsp + 0xa4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xa4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
je 0x1400535f3
lea rax, [rsp + 0x6b8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c0]
lea r8, [rsp + 0x6c8]
lea rdx, [rsp + 0x6d0]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.C5C55ICaO.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2c0], rax
cmp qword [rsp + 0x2c0], 0xffffffffffffffff
je 0x140053648
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0
je 0x1400536b2
lea rax, [rsp + 0x6d8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6e0]
lea r8, [rsp + 0x6e8]
lea rdx, [rsp + 0x6f0]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x14c], 0x1b8c5a76
lea rdx, [0x1400ea8ec]
lea rcx, [rsp + 0xba8]
call fcn.140003708
lea rcx, [rsp + 0xba8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x14c]
mov rdx, rax
lea rcx, [0x1400ea8f0]
call fcn.140044734
lea rcx, [rsp + 0xba8]
call fcn.1400040f0
mov dword [rsp + 0xa8], 1
mov edx, 8
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14005375a
mov eax, dword [rsp + 0x4c0]
mov dword [rsp + 0x38c], eax
mov eax, dword [rsp + 0x4c4]
mov dword [rsp + 0x364], eax
mov ecx, dword [rsp + 0xa8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xa8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x150], 0x1184c405
lea rdx, str.KPczT7MC
lea rcx, [rsp + 0xbc8]
call fcn.140003708
lea rcx, [rsp + 0xbc8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x150]
mov rdx, rax
lea rcx, [0x1400ea904]
call fcn.140044734
lea rcx, [rsp + 0xbc8]
call fcn.1400040f0
lea rcx, [rsp + 0x6f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x154], 0x17d375c1
lea rdx, str.pwGtOrF3
lea rcx, [rsp + 0xbe8]
call fcn.140003708
nop
lea rdx, [rsp + 0xbe8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x154]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xbe8]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x170], rax
cmp qword [rsp + 0x170], 0
je 0x140053882
lea rax, [rsp + 0x700]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x708]
lea r8, [rsp + 0x710]
lea rdx, [rsp + 0x718]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xac], 1
mov edx, 8
lea rcx, [rsp + 0x468]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400538da
mov eax, dword [rsp + 0x468]
mov dword [rsp + 0x368], eax
mov eax, dword [rsp + 0x46c]
mov dword [rsp + 0x36c], eax
mov ecx, dword [rsp + 0xac]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xac]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x11c8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x404], 0x10
lea rdx, [rsp + 0x404]
lea rcx, [rsp + 0x1328]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xb0], 1
mov edx, 8
lea rcx, [rsp + 0x480]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140053961
mov eax, dword [rsp + 0x480]
mov dword [rsp + 0x370], eax
mov eax, dword [rsp + 0x484]
mov dword [rsp + 0x374], eax
mov ecx, dword [rsp + 0xb0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xb0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x720]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.EgrCgA3mgs.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2d0], rax
cmp qword [rsp + 0x2d0], 0xffffffffffffffff
je 0x1400539c4
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x408], 0x10
lea rdx, [rsp + 0x408]
lea rcx, [rsp + 0x1348]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0xb4], 1
mov edx, 8
lea rcx, [rsp + 0x498]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140053a3d
mov eax, dword [rsp + 0x498]
mov dword [rsp + 0x378], eax
mov eax, dword [rsp + 0x49c]
mov dword [rsp + 0x37c], eax
mov ecx, dword [rsp + 0xb4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xb4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x11e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x30d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0
jmp 0x140053a81
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 0x400
jae 0x140053aaa
movsxd rax, dword [rsp + 0x5c]
mov al, byte [rsp + rax + 0x30d0]
inc al
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0x30d0], al
jmp 0x140053a77
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.cgQWK.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2d8], rax
cmp qword [rsp + 0x2d8], 0xffffffffffffffff
je 0x140053aff
mov rcx, qword [rsp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x168], 0x2384055d
lea rdx, [0x1400ea954]
lea rcx, [rsp + 0xc08]
call fcn.140003708
nop
lea rdx, [rsp + 0xc08]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x168]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xc08]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.CQDWziO1X.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2e0], rax
cmp qword [rsp + 0x2e0], 0xffffffffffffffff
je 0x140053bb4
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x178], rax
cmp qword [rsp + 0x178], 0
je 0x140053c1e
lea rax, [rsp + 0x728]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x730]
lea r8, [rsp + 0x738]
lea rdx, [rsp + 0x740]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x16c], 0x221a7197
lea rdx, str.gzv751uJy
lea rcx, [rsp + 0xc28]
call fcn.140003708
lea rcx, [rsp + 0xc28]
call fcn.14000a93c
mov r8d, dword [rsp + 0x16c]
mov rdx, rax
lea rcx, [0x1400ea984]
call fcn.140044734
lea rcx, [rsp + 0xc28]
call fcn.1400040f0
mov dword [rsp + 0xb8], 1
mov edx, 8
lea rcx, [rsp + 0x420]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140053cc6
mov eax, dword [rsp + 0x420]
mov dword [rsp + 0x380], eax
mov eax, dword [rsp + 0x424]
mov dword [rsp + 0x3cc], eax
mov ecx, dword [rsp + 0xb8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xb8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x40c], 0x10
lea rdx, [rsp + 0x40c]
lea rcx, [rsp + 0x1368]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x34d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
jmp 0x140053d0f
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
cmp rax, 0x400
jae 0x140053d38
movsxd rax, dword [rsp + 0x60]
mov al, byte [rsp + rax + 0x34d0]
inc al
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0x34d0], al
jmp 0x140053d05
lea r9, [rsp + 0x748]
lea r8, [rsp + 0x750]
lea rdx, [rsp + 0x758]
lea rcx, [0x1400ea990]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x188], rax
cmp qword [rsp + 0x188], 0
je 0x140053dc7
lea rax, [rsp + 0x760]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x768]
lea r8, [rsp + 0x770]
lea rdx, [rsp + 0x778]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x410], 0x10
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x1388]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x180], 0x1140ee1d
lea rdx, str.6H8T
lea rcx, [rsp + 0xc68]
call fcn.140003708
lea rcx, [rsp + 0xc68]
call fcn.14000a93c
mov r8d, dword [rsp + 0x180]
mov rdx, rax
lea rcx, [0x1400ea9a0]
call fcn.140044734
lea rcx, [rsp + 0xc68]
call fcn.1400040f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x198], rax
cmp qword [rsp + 0x198], 0
je 0x140053ea2
lea rax, [rsp + 0x780]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x788]
lea r8, [rsp + 0x790]
lea rdx, [rsp + 0x798]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x184], 0x173cb382
lea rdx, str.PuutiIscH
lea rcx, [rsp + 0xc88]
call fcn.140003708
lea rcx, [rsp + 0xc88]
call fcn.14000a93c
mov r8d, dword [rsp + 0x184]
mov rdx, rax
lea rcx, [0x1400ea9b4]
call fcn.140044734
lea rcx, [rsp + 0xc88]
call fcn.1400040f0
lea rcx, [rsp + 0x7a0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x414], 0x10
lea rdx, [rsp + 0x414]
lea rcx, [rsp + 0x13a8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x11f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x190], 0xa82adeb
lea rdx, [0x1400ea9bc]
lea rcx, [rsp + 0xca8]
call fcn.140003708
nop
lea rdx, [rsp + 0xca8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x190]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xca8]
call fcn.1400040f0
mov dword [rsp + 0x418], 0x10
lea rdx, [rsp + 0x418]
lea rcx, [rsp + 0x13c8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1a8], rax
cmp qword [rsp + 0x1a8], 0
je 0x14005401a
lea rax, [rsp + 0x7a8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7b0]
lea r8, [rsp + 0x7b8]
lea rdx, [rsp + 0x7c0]
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1b0], rax
cmp qword [rsp + 0x1b0], 0
je 0x140054084
lea rax, [rsp + 0x7c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7d0]
lea r8, [rsp + 0x7d8]
lea rdx, [rsp + 0x7e0]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x38d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x64], 0
jmp 0x1400540ac
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 0x400
jae 0x1400540d5
movsxd rax, dword [rsp + 0x64]
mov al, byte [rsp + rax + 0x38d0]
inc al
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0x38d0], al
jmp 0x1400540a2
lea r9, [rsp + 0x7e8]
lea r8, [rsp + 0x7f0]
lea rdx, [rsp + 0x7f8]
lea rcx, [0x1400ea9c0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x800]
lea r8, [rsp + 0x808]
lea rdx, [rsp + 0x810]
lea rcx, [0x1400ea9c8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1a0], 0x245e75f1
lea rdx, str.BEB8mIRg
lea rcx, [rsp + 0xcc8]
call fcn.140003708
nop
lea rdx, [rsp + 0xcc8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1a0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xcc8]
call fcn.1400040f0
mov dword [rsp + 0xbc], 1
mov edx, 8
lea rcx, [rsp + 0x428]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400541d7
mov eax, dword [rsp + 0x428]
mov dword [rsp + 0x3d0], eax
mov eax, dword [rsp + 0x42c]
mov dword [rsp + 0x3d4], eax
mov ecx, dword [rsp + 0xbc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xbc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x41c], 0x10
lea rdx, [rsp + 0x41c]
lea rcx, [rsp + 0x13e8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x818]
lea r8, [rsp + 0x820]
lea rdx, [rsp + 0x828]
lea rcx, [0x1400ea9e0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3ec], 0x10
lea rdx, [rsp + 0x3ec]
lea rcx, [rsp + 0x1408]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x1208]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1b8], 0xafcdc86
lea rdx, str.oIOvwuKjG
lea rcx, [rsp + 0xce8]
call fcn.140003708
lea rcx, [rsp + 0xce8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x1b8]
mov rdx, rax
lea rcx, [0x1400ea9f4]
call fcn.140044734
lea rcx, [rsp + 0xce8]
call fcn.1400040f0
lea rax, [rsp + 0x3cd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
jmp 0x1400542c4
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
movsxd rax, dword [rsp + 0x68]
cmp rax, 0x400
jae 0x1400542ed
movsxd rax, dword [rsp + 0x68]
mov al, byte [rsp + rax + 0x3cd0]
inc al
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0x3cd0], al
jmp 0x1400542ba
mov dword [rsp + 0x1bc], 0x13a52938
lea rdx, [0x1400ea9fc]
lea rcx, [rsp + 0xd08]
call fcn.140003708
lea rcx, [rsp + 0xd08]
call fcn.14000a93c
mov r8d, dword [rsp + 0x1bc]
mov rdx, rax
lea rcx, [0x1400eaa00]
call fcn.140044734
lea rcx, [rsp + 0xd08]
call fcn.1400040f0
lea rcx, [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1c0], 0x3a482651
lea rdx, str.RiFAnVw
lea rcx, [rsp + 0xd28]
call fcn.140003708
lea rcx, [rsp + 0xd28]
call fcn.14000a93c
mov r8d, dword [rsp + 0x1c0]
mov rdx, rax
lea rcx, [0x1400eaa10]
call fcn.140044734
lea rcx, [rsp + 0xd28]
call fcn.1400040f0
lea r9, [rsp + 0x830]
lea r8, [rsp + 0x838]
lea rdx, [rsp + 0x840]
lea rcx, [0x1400eaa18]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xc0], 1
mov edx, 8
lea rcx, [rsp + 0x430]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140054418
mov eax, dword [rsp + 0x430]
mov dword [rsp + 0x330], eax
mov eax, dword [rsp + 0x434]
mov dword [rsp + 0x334], eax
mov ecx, dword [rsp + 0xc0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xc0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1c4], 0x2e38b75d
lea rdx, str.TjdR5oZnK5
lea rcx, [rsp + 0xd48]
call fcn.140003708
nop
lea rdx, [rsp + 0xd48]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1c4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xd48]
call fcn.1400040f0
mov dword [rsp + 0x1c8], 0x248b50df
lea rdx, str.NVKSgabS
lea rcx, [rsp + 0xd68]
call fcn.140003708
lea rcx, [rsp + 0xd68]
call fcn.14000a93c
mov r8d, dword [rsp + 0x1c8]
mov rdx, rax
lea rcx, [0x1400eaa3c]
call fcn.140044734
lea rcx, [rsp + 0xd68]
call fcn.1400040f0
lea rax, [rsp + 0x40d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x6c], 0
jmp 0x1400544f0
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
movsxd rax, dword [rsp + 0x6c]
cmp rax, 0x400
jae 0x140054519
movsxd rax, dword [rsp + 0x6c]
mov al, byte [rsp + rax + 0x40d0]
inc al
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0x40d0], al
jmp 0x1400544e6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.lagoJza.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2e8], rax
cmp qword [rsp + 0x2e8], 0xffffffffffffffff
je 0x14005456e
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.GV3h.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2f0], rax
cmp qword [rsp + 0x2f0], 0xffffffffffffffff
je 0x1400545c3
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.G5CZxPy3o.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x290], rax
cmp qword [rsp + 0x290], 0xffffffffffffffff
je 0x140054618
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1218]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x1cc], 0x98e20f
lea rdx, [0x1400eaa94]
lea rcx, [rsp + 0xd88]
call fcn.140003708
nop
lea rdx, [rsp + 0xd88]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1cc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xd88]
call fcn.1400040f0
mov dword [rsp + 0x1d0], 0x121b4aed
lea rdx, str.Ws82ww
lea rcx, [rsp + 0xda8]
call fcn.140003708
nop
lea rdx, [rsp + 0xda8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1d0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xda8]
call fcn.1400040f0
mov dword [rsp + 0x3d8], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x1428]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x848]
lea r8, [rsp + 0x850]
lea rdx, [rsp + 0x858]
lea rcx, [0x1400eaaa0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x860]
lea r8, [rsp + 0x868]
lea rdx, [rsp + 0x870]
lea rcx, [0x1400eaaa8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rax, [rsp + 0x44d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
jmp 0x140054779
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
movsxd rax, dword [rsp + 0x70]
cmp rax, 0x400
jae 0x1400547a2
movsxd rax, dword [rsp + 0x70]
mov al, byte [rsp + rax + 0x44d0]
inc al
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0x44d0], al
jmp 0x14005476f
mov dword [rsp + 0x1e0], 0x38ac758d
lea rdx, [0x1400eaab0]
lea rcx, [rsp + 0xe08]
call fcn.140003708
nop
lea rdx, [rsp + 0xe08]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1e0]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xe08]
call fcn.1400040f0
mov dword [rsp + 0x1e4], 0x142a7fcb
lea rdx, [0x1400eaab4]
lea rcx, [rsp + 0xc48]
call fcn.140003708
nop
lea rdx, [rsp + 0xc48]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1e4]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xc48]
call fcn.1400040f0
mov dword [rsp + 0x1e8], 0x1665c40d
lea rdx, str.USjgQH
lea rcx, [rsp + 0xe68]
call fcn.140003708
nop
lea rdx, [rsp + 0xe68]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1e8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xe68]
call fcn.1400040f0
lea rcx, [rsp + 0x1228]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1d8], rax
cmp qword [rsp + 0x1d8], 0
je 0x14005493a
lea rax, [rsp + 0x878]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x880]
lea r8, [rsp + 0x888]
lea rdx, [rsp + 0x890]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x898]
lea r8, [rsp + 0x8a0]
lea rdx, [rsp + 0x8a8]
lea rcx, [0x1400eaac0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1238]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rsp + 0x48d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
jmp 0x140054995
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
movsxd rax, dword [rsp + 0x74]
cmp rax, 0x400
jae 0x1400549be
movsxd rax, dword [rsp + 0x74]
mov al, byte [rsp + rax + 0x48d0]
inc al
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0x48d0], al
jmp 0x14005498b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.xm.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2f8], rax
cmp qword [rsp + 0x2f8], 0xffffffffffffffff
je 0x140054a13
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x8b0]
lea r8, [rsp + 0x8b8]
lea rdx, [rsp + 0x8c0]
lea rcx, [0x1400eaad8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x8c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x3dc], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x3dc]
lea rcx, [rsp + 0x1448]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rsp + 0x8d0]
lea r8, [rsp + 0x8d8]
lea rdx, [rsp + 0x8e0]
lea rcx, [0x1400eaae0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x1f8], 0x38baacad
lea rdx, str.dxVmetjg3v
lea rcx, [rsp + 0xe88]
call fcn.140003708
nop
lea rdx, [rsp + 0xe88]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1f8]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xe88]
call fcn.1400040f0
mov dword [rsp + 0xc4], 1
mov edx, 8
lea rcx, [rsp + 0x458]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140054b44
mov eax, dword [rsp + 0x458]
mov dword [rsp + 0x338], eax
mov eax, dword [rsp + 0x45c]
mov dword [rsp + 0x384], eax
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x1fc], 0xcda3758
lea rdx, str.mizziGuEIt
lea rcx, [rsp + 0xea8]
call fcn.140003708
nop
lea rdx, [rsp + 0xea8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x1fc]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xea8]
call fcn.1400040f0
mov dword [rsp + 0x200], 0x1da7419e
lea rdx, str.cleQ8
lea rcx, [rsp + 0xec8]
call fcn.140003708
lea rcx, [rsp + 0xec8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x200]
mov rdx, rax
lea rcx, [0x1400eab0c]
call fcn.140044734
lea rcx, [rsp + 0xec8]
call fcn.1400040f0
lea r9, [rsp + 0x8e8]
lea r8, [rsp + 0x8f0]
lea rdx, [rsp + 0x8f8]
lea rcx, [0x1400eab18]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x204], 0x2ce2a995
lea rdx, str.Icj2WBv
lea rcx, [rsp + 0xee8]
call fcn.140003708
lea rcx, [rsp + 0xee8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x204]
mov rdx, rax
lea rcx, [0x1400eab28]
call fcn.140044734
lea rcx, [rsp + 0xee8]
call fcn.1400040f0
mov dword [rsp + 0x208], 0x32f2c902
lea rdx, str.qX9pg
lea rcx, [rsp + 0xf08]
call fcn.140003708
nop
lea rdx, [rsp + 0xf08]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x208]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xf08]
call fcn.1400040f0
lea r9, [rsp + 0x900]
lea r8, [rsp + 0x908]
lea rdx, [rsp + 0x910]
lea rcx, [0x1400eab38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea r9, [rsp + 0x918]
lea r8, [rsp + 0x920]
lea rdx, [rsp + 0x928]
lea rcx, [0x1400eab40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x930]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0x938]
lea r8, [rsp + 0x940]
lea rdx, [rsp + 0x948]
lea rcx, [0x1400eab48]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x3e0], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x3e0]
lea rcx, [rsp + 0x1468]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x1248]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xc8], 1
mov edx, 8
lea rcx, [rsp + 0x460]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140054dcd
mov eax, dword [rsp + 0x460]
mov dword [rsp + 0x340], eax
mov eax, dword [rsp + 0x464]
mov dword [rsp + 0x344], eax
mov ecx, dword [rsp + 0xc8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xc8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x950]
lea r8, [rsp + 0x958]
lea rdx, [rsp + 0x960]
lea rcx, [0x1400eab50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x140054e5c
lea rax, [rsp + 0x968]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x970]
lea r8, [rsp + 0x978]
lea rdx, [rsp + 0x980]
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.djEwSgZFqi.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x300], rax
cmp qword [rsp + 0x300], 0xffffffffffffffff
je 0x140054eb1
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
je 0x140054f1b
lea rax, [rsp + 0x988]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x990]
lea r8, [rsp + 0x998]
lea rdx, [rsp + 0x9a0]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x218], 0x2122d7a8
lea rdx, str.ZtZKogvdLe
lea rcx, [rsp + 0xf28]
call fcn.140003708
lea rcx, [rsp + 0xf28]
call fcn.14000a93c
mov r8d, dword [rsp + 0x218]
mov rdx, rax
lea rcx, [0x1400eab84]
call fcn.140044734
lea rcx, [rsp + 0xf28]
call fcn.1400040f0
mov dword [rsp + 0x21c], 0x37e3b02b
lea rdx, [0x1400eab8c]
lea rcx, [rsp + 0xf48]
call fcn.140003708
nop
lea rdx, [rsp + 0xf48]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x21c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xf48]
call fcn.1400040f0
mov dword [rsp + 0xcc], 1
mov edx, 8
lea rcx, [rsp + 0x470]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x140055023
mov eax, dword [rsp + 0x470]
mov dword [rsp + 0x348], eax
mov eax, dword [rsp + 0x474]
mov dword [rsp + 0x34c], eax
mov ecx, dword [rsp + 0xcc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xcc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x3e4], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x3e4]
lea rcx, [rsp + 0x1488]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3e8], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x3e8]
lea rcx, [rsp + 0x14a8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x230], 0x1731c58e
lea rdx, str.YAhYnKVHv
lea rcx, [rsp + 0xf68]
call fcn.140003708
lea rcx, [rsp + 0xf68]
call fcn.14000a93c
mov r8d, dword [rsp + 0x230]
mov rdx, rax
lea rcx, [0x1400eab9c]
call fcn.140044734
lea rcx, [rsp + 0xf68]
call fcn.1400040f0
lea rcx, [rsp + 0x1258]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x220], rax
cmp qword [rsp + 0x220], 0
je 0x14005512d
lea rax, [rsp + 0x9a8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9b0]
lea r8, [rsp + 0x9b8]
lea rdx, [rsp + 0x9c0]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x234], 0x29f2eefe
lea rdx, str.z4OqcGKRL8
lea rcx, [rsp + 0xf88]
call fcn.140003708
nop
lea rdx, [rsp + 0xf88]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x234]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xf88]
call fcn.1400040f0
lea rax, [rsp + 0x4cd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
jmp 0x1400551b5
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
movsxd rax, dword [rsp + 0x78]
cmp rax, 0x400
jae 0x1400551de
movsxd rax, dword [rsp + 0x78]
mov al, byte [rsp + rax + 0x4cd0]
inc al
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0x4cd0], al
jmp 0x1400551ab
lea rax, [rsp + 0x50d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
jmp 0x140055206
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
cmp rax, 0x400
jae 0x14005522f
movsxd rax, dword [rsp + 0x7c]
mov al, byte [rsp + rax + 0x50d0]
inc al
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0x50d0], al
jmp 0x1400551fc
mov dword [rsp + 0x238], 0xc157931
lea rdx, [0x1400eabb4]
lea rcx, [rsp + 0xfa8]
call fcn.140003708
lea rcx, [rsp + 0xfa8]
call fcn.14000a93c
mov r8d, dword [rsp + 0x238]
mov rdx, rax
lea rcx, [0x1400eabb8]
call fcn.140044734
lea rcx, [rsp + 0xfa8]
call fcn.1400040f0
mov dword [rsp + 0xd0], 1
mov edx, 8
lea rcx, [rsp + 0x478]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400552d7
mov eax, dword [rsp + 0x478]
mov dword [rsp + 0x350], eax
mov eax, dword [rsp + 0x47c]
mov dword [rsp + 0x354], eax
mov ecx, dword [rsp + 0xd0]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xd0]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rcx, [rsp + 0x9c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hdIpK.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x308], rax
cmp qword [rsp + 0x308], 0xffffffffffffffff
je 0x14005533a
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1268]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x23c], 0x32c297e7
lea rdx, str.k6JE
lea rcx, [rsp + 0xfc8]
call fcn.140003708
nop
lea rdx, [rsp + 0xfc8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x23c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xfc8]
call fcn.1400040f0
lea r9, [rsp + 0x9d0]
lea r8, [rsp + 0x9d8]
lea rdx, [rsp + 0x9e0]
lea rcx, [0x1400eabe0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x240], 0x49eb834
lea rdx, str.RfXr11dVX
lea rcx, [rsp + 0xfe8]
call fcn.140003708
nop
lea rdx, [rsp + 0xfe8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x240]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0xfe8]
call fcn.1400040f0
lea rax, [rsp + 0x54d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0
jmp 0x14005545e
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
movsxd rax, dword [rsp + 0x80]
cmp rax, 0x400
jae 0x140055490
movsxd rax, dword [rsp + 0x80]
mov al, byte [rsp + rax + 0x54d0]
inc al
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0x54d0], al
jmp 0x14005544e
mov dword [rsp + 0xd4], 1
mov edx, 8
lea rcx, [rsp + 0x488]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400554e8
mov eax, dword [rsp + 0x488]
mov dword [rsp + 0x3b8], eax
mov eax, dword [rsp + 0x48c]
mov dword [rsp + 0x35c], eax
mov ecx, dword [rsp + 0xd4]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xd4]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea r9, [rsp + 0x9e8]
lea r8, [rsp + 0x9f0]
lea rdx, [rsp + 0x9f8]
lea rcx, [0x1400eabf8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x244], 0x8224424
lea rdx, str.X0dmiomX
lea rcx, [rsp + 0x1008]
call fcn.140003708
nop
lea rdx, [rsp + 0x1008]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x244]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x1008]
call fcn.1400040f0
lea rcx, [rsp + 0x1278]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xa00]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x248], 0xd800f7f
lea rdx, str.ZURKmHRp8l
lea rcx, [rsp + 0x1028]
call fcn.140003708
nop
lea rdx, [rsp + 0x1028]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x248]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x1028]
call fcn.1400040f0
mov dword [rsp + 0x24c], 0x2c6e51fb
lea rdx, str.HQozVzU
lea rcx, [rsp + 0x1048]
call fcn.140003708
nop
lea rdx, [rsp + 0x1048]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x24c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x1048]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.9.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x310], 0xffffffffffffffff
je 0x14005569e
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x10e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.rc1Ym.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x318], rax
cmp qword [rsp + 0x318], 0xffffffffffffffff
je 0x140055701
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xa08]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x10f8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.3M9DiDX.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x320], rax
cmp qword [rsp + 0x320], 0xffffffffffffffff
je 0x140055772
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x250], 0x72dfa00
lea rdx, [0x1400eac68]
lea rcx, [rsp + 0x1068]
call fcn.140003708
lea rcx, [rsp + 0x1068]
call fcn.14000a93c
mov r8d, dword [rsp + 0x250]
mov rdx, rax
lea rcx, [0x1400eac6c]
call fcn.140044734
lea rcx, [rsp + 0x1068]
call fcn.1400040f0
mov dword [rsp + 0xd8], 1
mov edx, 8
lea rcx, [rsp + 0x4a8]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x14005581a
mov eax, dword [rsp + 0x4a8]
mov dword [rsp + 0x360], eax
mov eax, dword [rsp + 0x4ac]
mov dword [rsp + 0x388], eax
mov ecx, dword [rsp + 0xd8]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xd8]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rax, [rsp + 0x58d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x84], 0
jmp 0x14005584b
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
movsxd rax, dword [rsp + 0x84]
cmp rax, 0x400
jae 0x14005587d
movsxd rax, dword [rsp + 0x84]
mov al, byte [rsp + rax + 0x58d0]
inc al
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0x58d0], al
jmp 0x14005583b
lea r9, [rsp + 0xa10]
lea r8, [rsp + 0xa18]
lea rdx, [rsp + 0xa20]
lea rcx, [0x1400eac78]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0xdc], 1
mov edx, 8
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x1400558fa
mov eax, dword [rsp + 0x4b0]
mov dword [rsp + 0x390], eax
mov eax, dword [rsp + 0x4b4]
mov dword [rsp + 0x394], eax
mov ecx, dword [rsp + 0xdc]
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0xdc]
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [rsp + 0x254], 0x3b479344
lea rdx, str.EgOM
lea rcx, [rsp + 0x1088]
call fcn.140003708
lea rcx, [rsp + 0x1088]
call fcn.14000a93c
mov r8d, dword [rsp + 0x254]
mov rdx, rax
lea rcx, [0x1400eac88]
call fcn.140044734
lea rcx, [rsp + 0x1088]
call fcn.1400040f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.fEXO.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x328], rax
cmp qword [rsp + 0x328], 0xffffffffffffffff
je 0x14005599f
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x228], rax
cmp qword [rsp + 0x228], 0
je 0x140055a09
lea rax, [rsp + 0xa28]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa30]
lea r8, [rsp + 0xa38]
lea rdx, [rsp + 0xa40]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.uFm.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2c8], rax
cmp qword [rsp + 0x2c8], 0xffffffffffffffff
je 0x140055a5e
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x258], 0x1359a377
lea rdx, str.hU8TXXWTU
lea rcx, [rsp + 0x10a8]
call fcn.140003708
nop
lea rdx, [rsp + 0x10a8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x258]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x10a8]
call fcn.1400040f0
lea rcx, [rsp + 0x1108]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0xa48]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0xa50]
lea r8, [rsp + 0xa58]
lea rdx, [rsp + 0xa60]
lea rcx, [0x1400eacc8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x25c], 0x399fdb8a
lea rdx, str.jtEl
lea rcx, [rsp + 0x10c8]
call fcn.140003708
nop
lea rdx, [rsp + 0x10c8]
lea rcx, [0x14010e660]
call fcn.140015610
mov edx, dword [rsp + 0x25c]
mov rcx, rax
call fcn.140017964
lea rdx, [0x140016860]
mov rcx, rax
call fcn.140017b9c
nop
lea rcx, [rsp + 0x10c8]
call fcn.1400040f0
lea rcx, [rsp + 0xa68]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea r9, [rsp + 0xa70]
lea r8, [rsp + 0xa78]
lea rdx, [rsp + 0xa80]
lea rcx, [0x1400eacd8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea rcx, [rsp + 0x1118]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x88], 0
jmp 0x140055bbd
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x5cf8]
cmp dword [rsp + 0x88], eax
jae 0x140055be1
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x5cf0]
call qword [rcx + rax*8]
jmp 0x140055bad
mov rcx, qword [rsp + 0x5cd0]
xor rcx, rsp
call fcn.1400b6680
add rsp, 0x5ce0
pop rdi
ret