Function at 0x14003b450
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xb78
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x2c6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb98]
mov rax, qword [0x14031eae8]
xor rax, rbp
mov qword [rbp + 0xb08], rax
mov qword [rbp + 0xaa8], 0
mov byte [rbp + 0xa99], 0
mov byte [rbp + 0xa98], 0
mov rax, qword [rbp + 0xb30]
movzx eax, word [rax]
test eax, eax
jne 0x14003b4c7
jmp 0x14003ce75
mov rax, qword [0x14031a1e8]
mov qword [rbp], rax
mov eax, dword [0x140322198]
mov dword [rbp + 8], eax
mov byte [rbp + 0xc], 0
cmp dword [rbp + 0xb38], 0
jne 0x14003b511
mov r8d, 6
lea rdx, str.Blind
mov rcx, qword [rbp + 0xb30]
call fcn.1401a82a0
test eax, eax
jne 0x14003b511
mov dword [rbp + 0xab4], 1
jmp 0x14003b51b
mov dword [rbp + 0xab4], 0
movzx eax, byte [rbp + 0xab4]
mov byte [0x1403223d8], al
movzx eax, byte [0x1403223d8]
test eax, eax
je 0x14003b5e7
mov rax, qword [rbp + 0xb30]
add rax, 0xc
mov qword [rbp + 0xb30], rax
jmp 0x14003b55d
mov rax, qword [rbp + 0xb30]
add rax, 2
mov qword [rbp + 0xb30], rax
mov rax, qword [rbp + 0xb30]
movzx eax, word [rax]
cmp eax, 0x7d
je 0x14003b5e7
mov rax, qword [rbp + 0xb30]
movzx eax, word [rax]
mov dword [rbp + 0xab8], eax
cmp dword [rbp + 0xab8], 0
je 0x14003b5dd
cmp dword [rbp + 0xab8], 0x21
je 0x14003b5c3
cmp dword [rbp + 0xab8], 0x23
je 0x14003b5cf
cmp dword [rbp + 0xab8], 0x2b
je 0x14003b5b7
cmp dword [rbp + 0xab8], 0x5e
je 0x14003b5ab
jmp 0x14003b5e2
movzx eax, byte [rbp + 0xc]
or eax, 3
mov byte [rbp + 0xc], al
jmp 0x14003b5e2
movzx eax, byte [rbp + 0xc]
or eax, 0x30
mov byte [rbp + 0xc], al
jmp 0x14003b5e2
movzx eax, byte [rbp + 0xc]
or eax, 0xc
mov byte [rbp + 0xc], al
jmp 0x14003b5e2
movzx eax, byte [rbp + 0xc]
or eax, 0xc0
mov byte [rbp + 0xc], al
jmp 0x14003b5e2
jmp 0x14003ce75
jmp 0x14003b54b
cmp dword [rbp + 0xb38], 0
jne 0x14003b629
mov r8d, 6
lea rdx, [0x140273220]
mov rcx, qword [rbp + 0xb30]
call fcn.1401a82a0
test eax, eax
jne 0x14003b629
mov dword [rbp + 0xb38], 2
mov rax, qword [rbp + 0xb30]
add rax, 0xc
mov qword [rbp + 0xb30], rax
mov rax, qword [rbp]
mov eax, dword [rax + 0x98]
mov dword [rbp + 0x10], eax
mov rax, qword [rbp]
mov eax, dword [rax + 0xa0]
mov dword [rbp + 0x14], eax
cmp dword [rbp + 0xb40], 1
je 0x14003b659
cmp dword [rbp + 0xb40], 3
jne 0x14003b713
call fcn.14002cef0
movzx eax, al
test eax, eax
jne 0x14003b69a
cmp dword [rbp + 0xb38], 0
jne 0x14003b709
call fcn.14002cf80
movzx eax, al
test eax, eax
je 0x14003b709
lea rdx, [0x140273230]
mov rcx, qword [rbp + 0xb30]
call fcn.1400fed30
test rax, rax
je 0x14003b709
cmp dword [rbp + 0xb40], 3
jne 0x14003b6af
mov dword [rbp + 0xb40], 2
jmp 0x14003b707
mov dword [rbp + 0xb40], 0
mov rax, qword [rbp]
cmp dword [rax + 0x98], 0
jge 0x14003b6df
mov rax, qword [rbp]
cmp dword [rax + 0xa0], 0
jge 0x14003b6df
mov dword [rbp + 0xabc], 0xffffffff
jmp 0x14003b6e9
mov dword [rbp + 0xabc], 0
mov rax, qword [rbp]
mov ecx, dword [rbp + 0xabc]
mov dword [rax + 0xa0], ecx
mov rax, qword [rbp]
mov dword [rax + 0x98], 0xffffffff
jmp 0x14003b713
mov dword [rbp + 0xb40], 1
mov byte [rbp + 0x18], 0
mov dword [rbp + 0x1c], 0
cmp qword [rbp + 0xb48], 0
je 0x14003b805
xor edx, edx
mov rcx, qword [rbp + 0xb48]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov byte [rbp + 0xa98], 1
mov dword [rbp + 0x20], eax
cmp byte [rbp + 0xa98], 0
jne 0x14003b75a
lea rcx, [0x140273540]
call fcn.1401352a0
cmp dword [rbp + 0x20], 0
je 0x14003b800
cmp byte [rbp + 0xa98], 0
jne 0x14003b779
lea rcx, [0x140273540]
call fcn.1401352a0
mov eax, dword [0x1403219e8]
cmp dword [rbp + 0x20], eax
je 0x14003b800
mov rcx, qword [rbp + 0xb48]
call fcn.140103830
movzx eax, al
test eax, eax
jne 0x14003b800
cmp byte [rbp + 0xa98], 0
jne 0x14003b7ac
lea rcx, [0x140273540]
call fcn.1401352a0
mov r8d, 1
mov edx, dword [rbp + 0x20]
mov ecx, dword [0x1403219e8]
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x14003b7d1
mov dword [rbp + 0xac0], 1
jmp 0x14003b7db
mov dword [rbp + 0xac0], 0
movzx eax, byte [rbp + 0xac0]
mov byte [rbp + 0x18], al
cmp byte [rbp + 0xa98], 0
jne 0x14003b7fa
lea rcx, [0x140273540]
call fcn.1401352a0
mov eax, dword [rbp + 0x20]
mov dword [rbp + 0x1c], eax
jmp 0x14003b976
movzx eax, byte [0x14032213e]
and eax, 0xc0
test eax, eax
je 0x14003b963
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140322134]
cmp eax, 0x32
jae 0x14003b963
cmp dword [rbp + 0xb40], 2
je 0x14003b963
movzx eax, byte [0x1403223d8]
test eax, eax
jne 0x14003b963
cmp dword [rbp + 0xb38], 2
je 0x14003b963
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1403219e8]
jne 0x14003b963
cmp dword [rbp + 0xb38], 0
je 0x14003b8ac
lea rdx, [0x140273240]
mov rcx, qword [rbp + 0xb30]
call fcn.140036380
test rax, rax
je 0x14003b896
mov dword [rbp + 0xac4], 1
jmp 0x14003b8a0
mov dword [rbp + 0xac4], 0
movzx eax, byte [rbp + 0xac4]
mov byte [rbp + 0x24], al
jmp 0x14003b90c
mov byte [rbp + 0x24], 0
mov rax, qword [rbp + 0xb30]
mov qword [rbp + 0x30], rax
lea rdx, [0x140273248]
mov rcx, qword [rbp + 0x30]
call fcn.140036380
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14003b90c
mov rax, qword [rbp + 0x28]
add rax, 2
lea rdx, [0x140273250]
mov rcx, rax
call fcn.140036380
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x14003b904
mov rax, qword [rbp + 0x30]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x14003b90a
mov byte [rbp + 0x24], 1
jmp 0x14003b90c
jmp 0x14003b8bb
movzx eax, byte [rbp + 0x24]
test eax, eax
je 0x14003b963
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x14003b93e
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14003b963
mov dword [0x140319840], 0
mov edx, 1
mov ecx, 0x8000012f
call fcn.1400070b0
mov dword [0x140319840], 1
jmp 0x14003b914
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
xor ecx, ecx
call fcn.140037200
mov dword [rbp + 0x1c], eax
mov ecx, dword [rbp + 0x1c]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [0x140322318], rax
mov rcx, qword [0x140322318]
call fcn.1400382a0
mov dword [0x140322314], eax
mov cl, 1
call fcn.140037440
mov byte [rbp + 0x38], al
movzx eax, byte [rbp + 0x38]
movzx ecx, byte [0x140322313]
and ecx, eax
mov eax, ecx
mov byte [0x140322313], al
cmp qword [0x140321418], 0
je 0x14003b9f5
movzx eax, byte [0x1403213bf]
mov byte [rbp + 0x39], al
movzx eax, byte [0x1403213bf]
movzx ecx, byte [0x1403213bd]
and eax, ecx
mov byte [rbp + 0x3a], al
movzx eax, byte [0x1403213bf]
movzx ecx, byte [0x1403213bd]
not ecx
and eax, ecx
mov byte [rbp + 0x3b], al
jmp 0x14003ba2a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140322134]
cmp eax, dword [0x14031982c]
jae 0x14003ba1b
movzx eax, byte [rbp + 0x38]
movzx ecx, byte [0x14032213e]
and eax, ecx
mov byte [rbp + 0x39], al
jmp 0x14003ba1f
mov byte [rbp + 0x39], 0
movzx eax, byte [rbp + 0x39]
mov byte [rbp + 0x3a], al
mov byte [rbp + 0x3b], 0
movzx eax, byte [rbp + 0x38]
movzx ecx, byte [rbp + 0x3a]
not ecx
and eax, ecx
movzx ecx, byte [0x140322312]
and ecx, eax
mov eax, ecx
mov byte [0x140322312], al
mov byte [rbp + 0x54], 0
movzx eax, byte [0x1403223d8]
test eax, eax
je 0x14003ba85
movzx eax, byte [rbp + 0x38]
mov byte [rbp + 0x44], al
movzx eax, byte [rbp + 0xc]
test eax, eax
je 0x14003ba83
movzx eax, byte [rbp + 0xc]
not eax
movzx ecx, byte [rbp + 0x44]
and ecx, eax
mov eax, ecx
mov byte [rbp + 0x44], al
movzx eax, byte [rbp + 0x38]
movzx ecx, byte [rbp + 0x44]
xor eax, ecx
mov byte [rbp + 0x54], al
jmp 0x14003ba8f
movzx eax, byte [0x140322312]
mov byte [rbp + 0x44], al
mov rax, qword [rbp]
movzx eax, byte [rax + 0xc4]
test eax, eax
je 0x14003bac6
movzx eax, byte [0x1403223d8]
test eax, eax
jne 0x14003bac6
cmp dword [rbp + 0xb38], 2
je 0x14003bac6
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.14003e6d0
mov dword [rbp + 0xac8], eax
jmp 0x14003bad0
mov dword [rbp + 0xac8], 0
mov eax, dword [rbp + 0xac8]
mov dword [rbp + 0x58], eax
mov eax, dword [rbp + 0xb40]
mov dword [0x140322308], eax
cmp dword [0x140322308], 0
je 0x14003bb9f
cmp dword [0x140322308], 1
jne 0x14003bb0f
mov qword [rbp + 0x60], 0x4e20
mov dword [0x1403223c4], 0x1f4
jmp 0x14003bb21
mov qword [rbp + 0x60], 0x2ee0
mov dword [0x1403223c4], 0x5dc
mov rax, qword [rbp + 0x60]
add rax, 0x24
mov qword [rbp + 0xad0], rax
mov rax, qword [rbp + 0xad0]
add rax, 0xf
cmp rax, qword [rbp + 0xad0]
ja 0x14003bb4e
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1401354c0
sub rsp, rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0xad8], rax
lea r8, [rbp + 0xaa8]
mov rdx, qword [rbp + 0xad0]
mov rcx, qword [rbp + 0xad8]
call fcn.1401349c0
add qword [rbp + 0xad8], 0x20
movzx r8d, byte [rbp + 0x38]
mov edx, dword [0x1403223c4]
mov rcx, qword [rbp + 0xad8]
call fcn.140037640
movzx eax, byte [0x140321722]
mov byte [rbp + 0x68], al
cmp dword [reloc.WSOCK32.dll_inet_addr], 7
je 0x14003bbbb
cmp dword [reloc.WSOCK32.dll_inet_addr], 9
jne 0x14003bbda
cmp dword [0x140322308], 0
jne 0x14003bbda
cmp qword [rbp + 0xb48], 0
jne 0x14003bbda
mov dword [rbp + 0xae0], 1
jmp 0x14003bbe4
mov dword [rbp + 0xae0], 0
movzx eax, byte [rbp + 0xae0]
mov byte [rbp + 0x69], al
movzx eax, byte [rbp + 0x69]
test eax, eax
je 0x14003bbfd
mov cl, 1
call fcn.140039740
mov byte [rbp + 0xa4], 0
mov byte [rbp + 0xb4], 0
jmp 0x14003bc2c
mov rax, qword [rbp + 0xb30]
add rax, 2
mov qword [rbp + 0xb30], rax
movzx eax, byte [rbp + 0xc4]
mov byte [0x140322311], al
mov rax, qword [rbp + 0xb30]
movzx eax, word [rax]
test eax, eax
je 0x14003cb58
mov byte [rbp + 0xc4], 0
cmp dword [0x140322308], 0
jne 0x14003bcd9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0xa14], eax
mov eax, dword [0x140322198]
mov ecx, dword [rbp + 0xa14]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14031a1e8]
cmp eax, dword [rcx + 0x88]
jbe 0x14003bcd9
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x9d8]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14003bcc1
mov dword [0x140319840], 0
mov edx, 1
mov ecx, 0xffffffff
call fcn.1400070b0
mov dword [0x140319840], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0xa14], eax
mov eax, dword [rbp + 0xa14]
mov dword [0x140322198], eax
cmp dword [rbp + 0xb38], 0
jne 0x14003c9cd
mov rax, qword [rbp + 0xb30]
movzx edx, word [rax]
lea rcx, [0x140273258]
call fcn.14018b180
test rax, rax
je 0x14003c9cd
mov rax, qword [rbp + 0xb30]
movzx eax, word [rax]
mov dword [rbp + 0xae4], eax
mov eax, dword [rbp + 0xae4]
sub eax, 0x21
mov dword [rbp + 0xae4], eax
cmp dword [rbp + 0xae4], 0x5c
ja case.0x14003bd51.1
movsxd rax, dword [rbp + 0xae4]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x3cec4]
mov eax, dword [rcx + rax*4 + 0x3cea8]
add rax, rcx
jmp rax
movzx eax, byte [rbp + 0x44]
and eax, 3
test eax, eax
jne 0x14003bd6e
movzx eax, byte [rbp + 0xb4]
or eax, 1
mov byte [rbp + 0xb4], al
jmp 0x14003bc0d
movzx eax, byte [rbp + 0x44]
and eax, 0x30
test eax, eax
jne 0x14003bd8e
movzx eax, byte [rbp + 0xb4]
or eax, 0x10
mov byte [rbp + 0xb4], al
jmp 0x14003bc0d
movzx eax, byte [rbp + 0x44]
and eax, 0xc
test eax, eax
jne 0x14003bdae
movzx eax, byte [rbp + 0xb4]
or eax, 4
mov byte [rbp + 0xb4], al
jmp 0x14003bc0d
movzx eax, byte [rbp + 0x44]
and eax, 0xc0
test eax, eax
jne 0x14003bdd0
movzx eax, byte [rbp + 0xb4]
or eax, 0x40
mov byte [rbp + 0xb4], al
jmp 0x14003bc0d
jmp 0x14003bc0d
mov rax, qword [rbp + 0xb30]
add rax, 2
mov dx, 0x7d
mov rcx, rax
call fcn.14018b180
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x14003be07
jmp 0x14003bc0d
mov rax, qword [rbp + 0xb30]
add rax, 2
mov rcx, rax
call fcn.140034a80
mov qword [rbp + 0xb30], rax
mov rax, qword [rbp + 0xb30]
mov rcx, qword [rbp + 0xd8]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x14003bf6e
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rbp + 0xd8]
movzx eax, word [rcx + rax]
cmp eax, 0x7d
jne 0x14003be88
mov rax, qword [rbp + 0xd8]
add rax, 2
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xc8], 1
jmp 0x14003bf6e
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rbp + 0xd8]
movzx eax, word [rcx + rax]
cmp eax, 0x20
je 0x14003bebe
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rbp + 0xd8]
movzx eax, word [rcx + rax]
cmp eax, 9
jne 0x14003bf64
mov rax, qword [rbp + 0xd8]
add rax, 2
mov rcx, rax
call fcn.140034a80
mov qword [rbp + 0xe0], rax
mov r8d, 4
lea rdx, [0x140273268]
mov rcx, qword [rbp + 0xe0]
call fcn.1401a82a0
test eax, eax
je 0x14003bf12
mov r8d, 2
lea rdx, [0x140273274]
mov rcx, qword [rbp + 0xe0]
call fcn.1401a82a0
test eax, eax
jne 0x14003bf58
mov dx, 0x7d
mov rcx, qword [rbp + 0xe0]
call fcn.14018b180
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x14003bf38
jmp 0x14003bc0d
mov rax, qword [rbp + 0xb30]
mov rcx, qword [rbp + 0xd8]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rbp + 0xc8], rax
jmp 0x14003bf62
jmp 0x14003c9ae
jmp 0x14003bf6e
jmp 0x14003c9ae
cmp qword [rbp + 0xc8], 0x400
jb 0x14003bf85
jmp 0x14003c9ae
mov r8, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xb30]
lea rcx, [rbp + 0x100]
call fcn.14001e9a0
mov rax, qword [rbp + 0xc8]
shl rax, 1
mov qword [rbp + 0xa90], rax
cmp qword [rbp + 0xa90], 0x800
jae 0x14003bfbf
jmp 0x14003bfc4
call fcn.1401357e0
xor eax, eax
mov rcx, qword [rbp + 0xa90]
mov word [rbp + rcx + 0x100], ax
mov r8d, 5
lea rdx, [0x140273280]
lea rcx, [rbp + 0x100]
call fcn.1401a82a0
test eax, eax
jne 0x14003c0e9
lea rax, [rbp + 0x10a]
mov rcx, rax
call fcn.140034a60
lea rcx, [rbp + 0x994]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x934]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x914]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x74]
lea r8, [rbp + 0x974]
lea rdx, [rbp + 0x954]
mov rcx, rax
call fcn.140039780
cmp dword [rbp + 0x934], 1
jge 0x14003c081
mov rax, qword [rbp]
movzx eax, byte [rax + 0xc3]
movzx ecx, byte [rbp + 0x994]
mov byte [rsp + 0x20], cl
mov r9d, eax
lea r8, [rbp + 0x9b4]
lea rdx, [rbp + 0x974]
lea rcx, [rbp + 0x954]
call fcn.1400393b0
jmp 0x14003c0dd
movzx eax, byte [rbp + 0x994]
mov byte [rsp + 0x50], al
mov eax, dword [rbp + 0x974]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x954]
mov dword [rsp + 0x40], eax
mov rax, qword [rbp + 0xb48]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 0
mov eax, dword [rbp + 0x914]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x934]
mov dword [rsp + 0x20], eax
movzx r9d, byte [rbp + 0x44]
movzx r8d, byte [rbp + 0xb4]
xor edx, edx
movzx ecx, byte [rbp + 0x74]
call fcn.14003aed0
jmp 0x14003c9ae
lea rdx, [0x140273290]
lea rcx, [rbp + 0x100]
call fcn.1401a7920
test eax, eax
jne 0x14003c116
mov dword [rbp + 0xb38], 1
jmp 0x14003c9ae
lea rdx, [0x140273298]
lea rcx, [rbp + 0x100]
call fcn.1401a7920
test eax, eax
jne 0x14003c141
mov dword [rbp + 0xb38], 2
jmp 0x14003c9ae
mov dword [rbp + 0x914], 2
mov dword [rbp + 0x934], 1
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0xd0], rax
lea rdx, [0x1402732a4]
lea rcx, [rbp + 0x100]
call fcn.140013110
mov qword [rbp + 0xa18], rax
cmp qword [rbp + 0xa18], 0
je 0x14003c2f4
xor eax, eax
mov rcx, qword [rbp + 0xa18]
mov word [rcx], ax
lea rax, [rbp + 0x100]
mov rcx, qword [rbp + 0xa18]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xa18]
add rax, 2
mov rcx, rax
call fcn.140034a60
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rbp + 0xd8]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov dword [rbp + 0xa20], eax
cmp dword [rbp + 0xa20], 0
jbe 0x14003c2f4
mov r8d, 4
lea rdx, str.Down
mov rcx, qword [rbp + 0xe0]
call fcn.1401a82a0
test eax, eax
jne 0x14003c2bf
mov dword [rbp + 0x914], 0
mov rax, qword [rbp + 0xe0]
add rax, 8
mov r8d, 4
lea rdx, [0x1402732c0]
mov rcx, rax
call fcn.1401a82a0
test eax, eax
jne 0x14003c25b
mov byte [rbp + 0xa99], 1
mov dword [rbp + 0x9a4], 0
jmp 0x14003c2bd
mov eax, 2
imul rax, rax, 4
mov rcx, qword [rbp + 0xe0]
movzx eax, word [rcx + rax]
cmp eax, 0x52
jne 0x14003c280
mov dword [rbp + 0xae8], 1
jmp 0x14003c28a
mov dword [rbp + 0xae8], 0
mov ecx, dword [rbp + 0xae8]
call fcn.1401f8170
test eax, eax
je 0x14003c2ac
mov byte [rbp + 0xa99], 1
mov dword [rbp + 0x9a4], 2
jmp 0x14003c2bd
mov byte [rbp + 0xa99], 1
mov dword [rbp + 0x9a4], 1
jmp 0x14003c2f4
lea rdx, [0x1402732cc]
mov rcx, qword [rbp + 0xe0]
call fcn.1401a7920
test eax, eax
jne 0x14003c2e2
mov dword [rbp + 0x914], 1
jmp 0x14003c2f4
mov rcx, qword [rbp + 0xe0]
call fcn.1400364b0
mov dword [rbp + 0x934], eax
mov rax, qword [0x140322318]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb4]
lea r8, [rbp + 0x94]
lea rdx, [rbp + 0x74]
lea rcx, [rbp + 0x100]
call fcn.14003e560
cmp dword [rbp + 0x934], 1
jge 0x14003c331
jmp 0x14003c9ae
movzx eax, byte [rbp + 0x74]
test eax, eax
jne 0x14003c348
movzx eax, word [rbp + 0x94]
test eax, eax
je 0x14003c4f1
xor r8d, r8d
movzx edx, word [rbp + 0x94]
movzx ecx, byte [rbp + 0x74]
call fcn.140037fc0
mov byte [rbp + 0xa4], al
movzx eax, byte [rbp + 0xa4]
test eax, eax
je 0x14003c48f
cmp qword [rbp + 0xb48], 0
jne 0x14003c48f
cmp dword [rbp + 0x914], 0
jne 0x14003c417
movzx eax, byte [rbp + 0x74]
mov byte [rbp + 0xc4], al
cmp byte [rbp + 0xa99], 0
jne 0x14003c3aa
lea rcx, str.key_down_type
call fcn.1401352a0
cmp dword [rbp + 0x9a4], 1
jne 0x14003c3cd
movzx eax, byte [rbp + 0xa4]
movzx ecx, byte [0x140322312]
or ecx, eax
mov eax, ecx
mov byte [0x140322312], al
jmp 0x14003c403
cmp byte [rbp + 0xa99], 0
jne 0x14003c3e2
lea rcx, str.key_down_type
call fcn.1401352a0
cmp dword [rbp + 0x9a4], 2
jne 0x14003c403
movzx eax, byte [rbp + 0xa4]
movzx ecx, byte [0x140322313]
or ecx, eax
mov eax, ecx
mov byte [0x140322313], al
movzx eax, byte [rbp + 0xa4]
movzx ecx, byte [rbp + 0x44]
or ecx, eax
mov eax, ecx
mov byte [rbp + 0x44], al
jmp 0x14003c48f
cmp dword [rbp + 0x914], 1
jne 0x14003c48f
movzx ecx, byte [rbp + 0x74]
call fcn.140036f20
movzx eax, byte [rbp + 0xa4]
not eax
movzx ecx, byte [0x140322312]
and ecx, eax
mov eax, ecx
mov byte [0x140322312], al
movzx eax, byte [rbp + 0xa4]
not eax
movzx ecx, byte [0x140322313]
and ecx, eax
mov eax, ecx
mov byte [0x140322313], al
movzx eax, byte [rbp + 0xa4]
not eax
movzx ecx, byte [rbp + 0x44]
and ecx, eax
mov eax, ecx
mov byte [rbp + 0x44], al
movzx eax, byte [rbp + 0x74]
cmp eax, 0xa5
jne 0x14003c48f
cmp dword [0x140322314], 3
jne 0x14003c48f
movzx eax, byte [rbp + 0x44]
and eax, 0xfffffffe
mov byte [rbp + 0x44], al
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x48], 0x80000000
mov dword [rsp + 0x40], 0x80000000
mov rax, qword [rbp + 0xb48]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0xa4]
mov byte [rsp + 0x30], al
mov eax, dword [rbp + 0x914]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x934]
mov dword [rsp + 0x20], eax
movzx r9d, byte [rbp + 0x44]
movzx r8d, byte [rbp + 0xb4]
movzx edx, word [rbp + 0x94]
movzx ecx, byte [rbp + 0x74]
call fcn.14003aed0
jmp 0x14003c9ae
cmp qword [rbp + 0xd0], 1
jne 0x14003c59d
cmp dword [rbp + 0x914], 1
je 0x14003c598
cmp qword [rbp + 0xb48], 0
je 0x14003c56b
mov dword [rbp + 0xa24], 0
jmp 0x14003c530
mov eax, dword [rbp + 0xa24]
inc eax
mov dword [rbp + 0xa24], eax
mov eax, dword [rbp + 0x934]
cmp dword [rbp + 0xa24], eax
jge 0x14003c569
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x100]
xor r9d, r9d
mov r8d, eax
mov edx, 0x102
mov rcx, qword [rbp + 0xb48]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14003c522
jmp 0x14003c598
movzx eax, byte [rbp + 0xb4]
movzx ecx, byte [rbp + 0x44]
or eax, ecx
mov ecx, 2
imul rcx, rcx, 0
movzx r8d, al
mov edx, dword [rbp + 0x934]
movzx ecx, word [rbp + rcx + 0x100]
call fcn.14003b1f0
jmp 0x14003c9ae
cmp qword [rbp + 0xb48], 0
jne 0x14003c5b0
mov byte [rbp + 0xaec], 1
jmp 0x14003c5b7
mov byte [rbp + 0xaec], 0
movzx eax, byte [rbp + 0xaec]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x44]
lea r8, [rbp + 0x914]
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x100]
call fcn.14003dff0
mov byte [rbp + 0x74], al
movzx eax, byte [rbp + 0x74]
test eax, eax
je 0x14003c753
cmp qword [rbp + 0xb48], 0
jne 0x14003c617
cmp dword [rbp + 0x914], 0
jne 0x14003c60e
movzx eax, byte [rbp + 0x74]
mov byte [rbp + 0xc4], al
jmp 0x14003c617
movzx ecx, byte [rbp + 0x74]
call fcn.140036f20
cmp dword [0x140322308], 0
je 0x14003c62f
movzx eax, byte [0x1403223cc]
mov byte [rbp + 0xaed], al
jmp 0x14003c63c
xor ecx, ecx
call fcn.140037440
mov byte [rbp + 0xaed], al
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xb48]
movzx edx, byte [rbp + 0xaed]
movzx ecx, byte [rbp + 0x44]
call fcn.14003d290
mov dword [rbp + 0xa28], 0
jmp 0x14003c67d
mov eax, dword [rbp + 0xa28]
inc eax
mov dword [rbp + 0xa28], eax
mov eax, dword [rbp + 0x934]
cmp dword [rbp + 0xa28], eax
jge 0x14003c74e
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 1
mov r9, qword [rbp + 0xb48]
xor r8d, r8d
movzx edx, byte [rbp + 0x74]
mov ecx, dword [rbp + 0x914]
call fcn.1400376b0
cmp dword [0x140322308], 0
jne 0x14003c749
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0xa14], eax
mov eax, dword [0x140322198]
mov ecx, dword [rbp + 0xa14]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14031a1e8]
cmp eax, dword [rcx + 0x88]
jbe 0x14003c749
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x9d8]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14003c731
mov dword [0x140319840], 0
mov edx, 1
mov ecx, 0xffffffff
call fcn.1400070b0
mov dword [0x140319840], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0xa14], eax
mov eax, dword [rbp + 0xa14]
mov dword [0x140322198], eax
jmp 0x14003c66f
jmp 0x14003c9ae
cmp qword [rbp + 0xc8], 4
jbe 0x14003c7dc
mov r8d, 4
lea rdx, str.ASC
lea rcx, [rbp + 0x100]
call fcn.1401a82a0
test eax, eax
jne 0x14003c7dc
cmp qword [rbp + 0xb48], 0
jne 0x14003c7dc
lea rax, [rbp + 0x106]
mov rcx, rax
call fcn.140034a60
mov rcx, rax
call fcn.14003abb0
cmp dword [0x140322308], 2
jne 0x14003c7b9
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0x9c]
mov dword [rbp + 0xaf0], eax
jmp 0x14003c7cc
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0x98]
mov dword [rbp + 0xaf0], eax
mov ecx, dword [rbp + 0xaf0]
call fcn.140036fe0
jmp 0x14003c9ae
cmp qword [rbp + 0xc8], 2
jbe 0x14003c9ae
mov r8d, 2
lea rdx, [0x1402732e4]
lea rcx, [rbp + 0x100]
call fcn.1401a82a0
test eax, eax
jne 0x14003c9ae
lea rax, [rbp + 0x104]
mov r8d, reloc.WSOCK32.dll_recv
xor edx, edx
mov rcx, rax
call fcn.1401f4a40
mov dword [rbp + 0xa2c], eax
cmp dword [rbp + 0xa2c], 0x10000
jb 0x14003c878
mov eax, dword [rbp + 0xa2c]
sub eax, 0x10000
mov dword [rbp + 0xa2c], eax
mov eax, dword [rbp + 0xa2c]
shr eax, 0xa
and eax, 0x3ff
add eax, 0xd800
mov word [rbp + 0xa30], ax
mov eax, dword [rbp + 0xa2c]
and eax, 0x3ff
add eax, 0xdc00
mov word [rbp + 0xa34], ax
jmp 0x14003c88f
movzx eax, word [rbp + 0xa2c]
mov word [rbp + 0xa30], ax
xor eax, eax
mov word [rbp + 0xa34], ax
cmp qword [rbp + 0xb48], 0
je 0x14003c8e7
movzx eax, word [rbp + 0xa30]
xor r9d, r9d
mov r8d, eax
mov edx, 0x102
mov rcx, qword [rbp + 0xb48]
call qword [sym.imp.USER32.dll_PostMessageW]
movzx eax, word [rbp + 0xa34]
test eax, eax
je 0x14003c8e2
movzx eax, word [rbp + 0xa34]
xor r9d, r9d
mov r8d, eax
mov edx, 0x102
mov rcx, qword [rbp + 0xb48]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14003c972
cmp dword [0x140322308], 2
je 0x14003c935
movzx eax, byte [rbp + 0xb4]
movzx ecx, byte [rbp + 0x44]
or eax, ecx
movzx edx, al
movzx ecx, word [rbp + 0xa30]
call fcn.14003cf90
movzx eax, word [rbp + 0xa34]
test eax, eax
je 0x14003c933
movzx eax, byte [rbp + 0xb4]
movzx ecx, byte [rbp + 0x44]
or eax, ecx
movzx edx, al
movzx ecx, word [rbp + 0xa34]
call fcn.14003cf90
jmp 0x14003c972
mov eax, 2
imul rax, rax, 0
mov ecx, gethostbyaddr
mov word [rbp + rax + 0xa48], cx
lea rax, [rbp + 0xa4a]
mov r8d, 0xa
mov rdx, rax
mov ecx, dword [rbp + 0xa2c]
call fcn.1401ebb60
lea rcx, [rbp + 0xa48]
call fcn.14003abb0
cmp dword [0x140322308], 2
jne 0x14003c990
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0x9c]
mov dword [rbp + 0xaf4], eax
jmp 0x14003c9a3
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0x98]
mov dword [rbp + 0xaf4], eax
mov ecx, dword [rbp + 0xaf4]
call fcn.140036fe0
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0xb30], rax
mov byte [rbp + 0xb4], 0
jmp 0x14003bc0d
jmp 0x14003cb53
cmp dword [rbp + 0xb38], 2
jne 0x14003ca4f
mov rax, qword [rbp + 0xb30]
movzx eax, word [rax]
mov dword [rbp + 0xaf8], eax
cmp dword [rbp + 0xaf8], 8
je 0x14003ca3d
cmp dword [rbp + 0xaf8], 9
je 0x14003ca43
cmp dword [rbp + 0xaf8], 0xa
je 0x14003ca37
cmp dword [rbp + 0xaf8], 0xd
je 0x14003ca0c
jmp 0x14003ca49
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rbp + 0xb30]
movzx eax, word [rcx + rax]
cmp eax, 0xa
jne 0x14003ca37
mov rax, qword [rbp + 0xb30]
add rax, 2
mov qword [rbp + 0xb30], rax
mov byte [rbp + 0x74], recv
jmp 0x14003ca4d
mov byte [rbp + 0x74], 8
jmp 0x14003ca4d
mov byte [rbp + 0x74], 9
jmp 0x14003ca4d
mov byte [rbp + 0x74], 0
jmp 0x14003caa1
movzx eax, byte [rbp + 0xb4]
movzx ecx, byte [rbp + 0x44]
or eax, ecx
test eax, eax
je 0x14003ca72
cmp dword [rbp + 0xb38], 0
jne 0x14003ca72
mov byte [rbp + 0xafc], 1
jmp 0x14003ca79
mov byte [rbp + 0xafc], 0
movzx r9d, byte [rbp + 0xafc]
mov r8, qword [0x140322318]
lea rdx, [rbp + 0xb4]
mov rax, qword [rbp + 0xb30]
movzx ecx, word [rax]
call fcn.140036980
mov byte [rbp + 0x74], al
movzx eax, byte [rbp + 0x74]
test eax, eax
je 0x14003caf9
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x48], 0x80000000
mov dword [rsp + 0x40], 0x80000000
mov rax, qword [rbp + 0xb48]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
movzx r9d, byte [rbp + 0x44]
movzx r8d, byte [rbp + 0xb4]
xor edx, edx
movzx ecx, byte [rbp + 0x74]
call fcn.14003aed0
jmp 0x14003cb4c
cmp qword [rbp + 0xb48], 0
je 0x14003cb27
mov rax, qword [rbp + 0xb30]
movzx eax, word [rax]
xor r9d, r9d
mov r8d, eax
mov edx, 0x102
mov rcx, qword [rbp + 0xb48]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14003cb4c
movzx eax, byte [rbp + 0xb4]
movzx ecx, byte [rbp + 0x44]
or eax, ecx
movzx r8d, al
mov edx, 1
mov rax, qword [rbp + 0xb30]
movzx ecx, word [rax]
call fcn.14003b1f0
mov byte [rbp + 0xb4], 0
jmp 0x14003bc0d
cmp dword [0x140322308], 0
je 0x14003cc12
mov dword [rbp + 0xa74], 0xffffffff
movzx eax, byte [0x1403223ce]
test eax, eax
jne 0x14003cc02
cmp dword [0x1403223c0], 0
jbe 0x14003cc02
movzx eax, byte [0x1403223d8]
test eax, eax
je 0x14003cb9e
movzx eax, byte [rbp + 0x54]
mov dword [rbp + 0xb00], eax
jmp 0x14003cbb0
movzx eax, byte [rbp + 0x39]
movzx ecx, byte [rbp + 0x3b]
not ecx
and eax, ecx
mov dword [rbp + 0xb00], eax
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [0x140322313]
or eax, ecx
or eax, dword [rbp + 0xb00]
mov byte [rbp + 0xa64], al
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 1
mov r9b, 1
xor r8d, r8d
movzx edx, byte [0x1403223cc]
movzx ecx, byte [rbp + 0xa64]
call fcn.14003d290
movzx edx, byte [rbp + 0xa64]
lea rcx, [rbp + 0xa74]
call fcn.14003acd0
mov ecx, dword [rbp + 0xa74]
call fcn.140036b20
jmp 0x14003cd5c
cmp qword [0x140321418], 0
je 0x14003cc2b
movzx eax, byte [0x1403213bf]
mov byte [rbp + 0xa84], al
jmp 0x14003cc6b
cmp dword [0x14031982c], 0
jl 0x14003cc54
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140322134]
cmp eax, dword [0x14031982c]
jb 0x14003cc54
mov dword [rbp + 0xb04], 0
jmp 0x14003cc5e
movzx eax, byte [rbp + 0x39]
mov dword [rbp + 0xb04], eax
movzx eax, byte [rbp + 0xb04]
mov byte [rbp + 0xa84], al
movzx eax, byte [0x140322313]
movzx ecx, byte [rbp + 0xa84]
or ecx, eax
mov eax, ecx
mov byte [rbp + 0xa84], al
movzx eax, byte [rbp + 0x44]
mov byte [rbp + 0xa64], al
movzx eax, byte [0x1403223d8]
test eax, eax
je 0x14003cd03
movzx eax, byte [rbp + 0x54]
movzx ecx, byte [rbp + 0xa64]
or ecx, eax
mov eax, ecx
mov byte [rbp + 0xa64], al
movzx eax, byte [rbp + 0x39]
movzx ecx, byte [rbp + 0xa84]
xor eax, ecx
mov byte [rbp + 0xa85], al
movzx eax, byte [rbp + 0xa85]
movzx ecx, byte [rbp + 0x39]
and eax, ecx
not eax
movzx ecx, byte [rbp + 0xa64]
and ecx, eax
mov eax, ecx
mov byte [rbp + 0xa64], al
movzx eax, byte [rbp + 0xa85]
movzx ecx, byte [rbp + 0xa84]
and eax, ecx
movzx ecx, byte [rbp + 0xa64]
or ecx, eax
mov eax, ecx
mov byte [rbp + 0xa64], al
jmp 0x14003cd23
movzx eax, byte [rbp + 0xa84]
movzx ecx, byte [rbp + 0x3b]
not ecx
and eax, ecx
movzx ecx, byte [rbp + 0xa64]
or ecx, eax
mov eax, ecx
mov byte [rbp + 0xa64], al
xor ecx, ecx
call fcn.140037440
movzx eax, al
movzx ecx, byte [0x140321410]
or eax, ecx
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, qword [rbp + 0xb48]
movzx edx, al
movzx ecx, byte [rbp + 0xa64]
call fcn.14003d290
cmp qword [0x140321418], 0
je 0x14003cd92
movzx eax, byte [0x1403213bd]
movzx ecx, byte [0x1403213be]
xor eax, ecx
movzx ecx, byte [0x1403213be]
and eax, ecx
not eax
movzx ecx, byte [0x1403213be]
and ecx, eax
mov eax, ecx
mov byte [0x1403213be], al
cmp dword [rbp + 0x58], 1
jne 0x14003cda4
mov edx, 1
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.14003e6d0
movzx eax, byte [rbp + 0x18]
test eax, eax
je 0x14003cdd3
cmp byte [rbp + 0xa98], 0
jne 0x14003cdc1
lea rcx, [0x140273540]
call fcn.1401352a0
xor r8d, r8d
mov edx, dword [rbp + 0x20]
mov ecx, dword [0x1403219e8]
call qword [sym.imp.USER32.dll_AttachThreadInput]
movzx eax, byte [rbp + 0x69]
test eax, eax
je 0x14003cdea
movzx eax, byte [rbp + 0x68]
test eax, eax
jne 0x14003cdea
xor ecx, ecx
call fcn.140039740
cmp dword [rbp + 0xb40], 0
jne 0x14003ce16
mov eax, dword [rbp + 8]
cmp dword [0x140322198], eax
je 0x14003ce16
call fcn.140006ad0
test eax, eax
je 0x14003ce16
mov edx, 1
mov ecx, 0xffffffff
call fcn.1400070b0
cmp dword [rbp + 0xb40], 1
jne 0x14003ce5b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1403219e8]
jne 0x14003ce5b
mov dword [0x140319840], 0
mov edx, 1
mov ecx, 0xffffffff
call fcn.1400070b0
mov dword [0x140319840], 1
mov rax, qword [rbp]
mov ecx, dword [rbp + 0x10]
mov dword [rax + 0x98], ecx
mov rax, qword [rbp]
mov ecx, dword [rbp + 0x14]
mov dword [rax + 0xa0], ecx
lea rcx, [rbp - 0x60]
lea rdx, reloc.WSOCK32.dll_ntohs
mov r8, qword [rbp + 0xaa8]
call fcn.140134a90
mov rcx, qword [rbp + 0xb08]
xor rcx, rbp
call fcn.140135520
lea rsp, [rbp + 0xb18]
pop rdi
pop rbp
ret