Function at 0x14001c370
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x168
lea rbp, [rsp + 0x60]
cmp word [rcx], 0
mov r13, r9
mov r14d, r8d
mov r15d, edx
mov rsi, rcx
je 0x14001dbc3
mov r12, qword [0x14012fc08]
mov eax, dword [0x140137220]
mov qword [rbp + 0x58], r12
mov dword [rbp + 0x48], eax
test edx, edx
jne 0x14001c3e9
lea r8d, [rdx + 7]
lea rdx, str.Blind
call fcn.1400d2a10
test eax, eax
jne 0x14001c3e9
add rsi, 0xe
mov byte [0x1401374b4], 1
mov qword [rbp + 0x10], rsi
jmp 0x14001c3f9
mov byte [0x1401374b4], 0
mov qword [rbp + 0x10], rsi
test r15d, r15d
jne 0x14001c427
mov r8d, 6
lea rdx, [0x140110ad0]
mov rcx, rsi
call fcn.1400d2a10
test eax, eax
jne 0x14001c427
mov r15d, 2
add rsi, 0xc
mov dword [rbp + 0x158], r15d
mov qword [rbp + 0x10], rsi
mov eax, dword [r12 + 0x7c]
mov dword [rbp + 0x4c], eax
mov eax, dword [r12 + 0x84]
mov dword [rbp + 0x50], eax
lea eax, [r14 - 1]
test eax, 0xfffffffd
jne 0x14001c51c
call fcn.14000f650
mov rcx, qword [0x140137470]
mov rbx, rax
test rcx, rcx
je 0x14001c463
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x140137470], 0
mov edi, eax
je 0x14001c48e
mov qword [0x140137470], rbx
jmp 0x14001c49c
test rbx, rbx
je 0x14001c49c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xb7
je 0x14001c4d5
test r15d, r15d
jne 0x14001c4c6
call fcn.140014820
test al, al
je 0x14001c4c6
lea rdx, str.Click
mov rcx, rsi
call fcn.1400ad2f0
test rax, rax
jne 0x14001c4d5
mov r14d, 1
mov dword [rbp + 0x160], r14d
jmp 0x14001c51c
cmp r14d, 3
jne 0x14001c4ea
mov r14d, 2
mov dword [rbp + 0x160], r14d
jmp 0x14001c51c
xor eax, eax
mov r14d, eax
mov dword [rbp + 0x160], eax
cmp dword [r12 + 0x7c], eax
jge 0x14001c50b
cmp dword [r12 + 0x84], eax
jge 0x14001c50b
mov eax, 0xffffffff
mov dword [r12 + 0x84], eax
mov dword [r12 + 0x7c], 0xffffffff
xor r12d, r12d
mov byte [rbp + 8], 0
mov ebx, r12d
test r13, r13
je 0x14001c582
xor edx, edx
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x34], eax
mov r14d, eax
test eax, eax
je 0x14001c690
cmp eax, dword [0x140136620]
je 0x14001c690
mov rcx, r13
call fcn.1400b3190
test al, al
jne 0x14001c690
mov ecx, dword [0x140136620]
lea r8d, [r12 + 1]
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov ebx, r14d
setne byte [rbp + 8]
jmp 0x14001c690
test byte [0x1401371be], 0xc0
je 0x14001c63c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1401371b4]
cmp eax, 0x32
jae 0x14001c63c
cmp r14d, 2
je 0x14001c63c
cmp byte [0x1401374b4], bl
jne 0x14001c63c
cmp r15d, 2
je 0x14001c63c
cmp byte [0x140137443], bl
je 0x14001c63c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x140136620]
jne 0x14001c63c
test r15d, r15d
je 0x14001c730
mov r8, rsi
test rsi, rsi
je 0x14001c630
movzx edx, word [rsi]
test dx, dx
je 0x14001c630
mov r9d, 0x4c
nop dword [rax]
lea rcx, [0x140111040]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x14001c633
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001c610
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14001c600
mov r8, r12
test r8, r8
jne 0x14001c7b5
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14001c687
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x80]
mov dword [rbp + 0x80], 0x48
mov ecx, eax
mov ebx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14001c687
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x14001c687
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov eax, dword [rbp + 0x150]
mov dword [rbp + 0x34], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r9, [0x1401374c0]
mov qword [0x140137560], rax
mov rdx, r9
mov ecx, r12d
mov rdi, rax
nop
mov r8, qword [rdx]
test r8, r8
je 0x14001c6cc
cmp r8, rdi
je 0x14001c7fb
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x14001c6b0
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, rdi
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.1400219e0
mov dword [rbx + 8], eax
mov qword [rbx], rdi
mov cl, 1
mov dword [0x140137568], eax
call fcn.140021430
and byte [0x1401372df], al
movzx ebx, al
cmp qword [0x140134268], r12
je 0x14001c80b
movzx eax, byte [0x1401343f4]
movzx ecx, byte [0x14013429e]
movzx r12d, al
and r12b, cl
not al
and al, cl
jmp 0x14001c832
mov r9d, 0x4c
mov rdx, rsi
lea r10d, [r9 + 0x2f]
nop dword [rax]
test rdx, rdx
je 0x14001c63c
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001c63c
lea rcx, [0x140111040]
movzx eax, r9w
cmp r8w, ax
je 0x14001c77b
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001c762
add rdx, 2
jmp 0x14001c749
add rdx, 2
je 0x14001c7b5
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001c7b5
lea rcx, [0x140111048]
movzx eax, r10w
cmp r8w, ax
je 0x14001c7af
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001c796
add rdx, 2
jmp 0x14001c781
cmp word [rdx], r10w
jne 0x14001c740
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001c7d9
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001c63c
mov edx, 1
mov dword [0x14012fc00], r12d
mov ecx, 0x80000539
call fcn.140001940
mov dword [0x14012fc00], 1
jmp 0x14001c7b5
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x14001c6ef
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1401371b4]
cmp eax, dword [0x1401315c8]
jae 0x14001c82a
movzx ecx, byte [0x1401371be]
and cl, bl
jmp 0x14001c82c
xor cl, cl
movzx r12d, cl
xor al, al
not r12b
mov byte [rbp + 4], cl
and r12b, byte [0x1401372de]
and r12b, bl
mov byte [rbp + 6], al
cmp byte [0x1401374b4], 0
mov byte [rbp], r12b
mov byte [0x1401372de], r12b
je 0x14001c86f
not r12b
mov byte [rbp], bl
and r12b, bl
mov byte [rbp + 3], bl
mov byte [rbp + 5], r12b
movzx r12d, bl
jmp 0x14001c878
xor al, al
mov byte [rbp + 3], r12b
mov byte [rbp + 5], al
mov rax, qword [rbp + 0x58]
cmp byte [rax + 0x133], 0
je 0x14001c8a8
cmp byte [0x1401374b4], 0
jne 0x14001c8a8
cmp r15d, 2
je 0x14001c8a8
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140020a70
mov dword [rbp + 0x30], eax
xor r8d, r8d
jmp 0x14001c8af
xor r8d, r8d
mov dword [rbp + 0x30], r8d
mov ecx, dword [rbp + 0x160]
mov eax, 0x1f4
mov dword [0x140137580], ecx
mov edi, 0x5dc
test ecx, ecx
je 0x14001c953
cmp ecx, 1
mov edx, 0x2ee0
cmovne eax, edi
mov dword [0x140137570], eax
mov eax, 0x4e20
cmovne eax, edx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001c8f9
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400eb380
mov rax, qword [0x140132100]
sub rsp, rcx
mov byte [0x14013746c], bl
mov byte [0x14013746d], 0
mov dword [0x14013756c], r8d
lea rcx, [rsp + 0x60]
mov byte [0x14013746e], 0
mov qword [rax], rcx
mov ecx, dword [rbp + 0x160]
mov dword [0x140137578], 0x80000000
mov dword [0x14013757c], 0x80000000
mov byte [0x14013746f], 1
mov eax, dword [str._v_a_a_a_]
movzx r15d, byte [0x14013408f]
add eax, 0xfffffff8
mov byte [rbp + 0xa], r15b
test eax, 0xfffffffd
jne 0x14001c98f
test ecx, ecx
jne 0x14001c98f
test r13, r13
jne 0x14001c98f
lea ecx, [r13 + 1]
mov byte [rbp + 9], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14013408f], 1
jmp 0x14001c993
mov byte [rbp + 9], 0
xor r14b, r14b
cmp word [rsi], 0
mov byte [rbp + 1], r14b
je 0x14001d8e3
lea rbx, [0x140000000]
mov r15d, 0x7d
nop dword [rax]
nop word [rax + rax]
cmp dword [0x140137580], 0
mov byte [rbp + 0x150], 0
jne 0x14001ca33
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fc08]
xor edi, edi
sub eax, dword [0x140137224]
cmp eax, dword [rcx + 0x118]
jbe 0x14001ca35
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, [rbp + 0xd0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001ca25
lea edx, [rdi + 1]
mov dword [0x14012fc00], edi
lea ecx, [rdi - 1]
call fcn.140001940
mov dword [0x14012fc00], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140137224], eax
jmp 0x14001ca35
xor edi, edi
mov eax, dword [rbp + 0x158]
test eax, eax
jne 0x14001d68f
movzx edx, word [rsi]
lea rcx, [0x140111050]
call fcn.1400cbb24
test rax, rax
je 0x14001d6dc
movzx eax, word [rsi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x14001ca7e.38
cdqe
movzx eax, byte [rbx + rax + 0x1dbf4]
mov ecx, dword [rbx + rax*4 + 0x1dbd8]
add rcx, rbx
jmp rcx
test r12b, 3
jne case.0x14001ca7e.38
movzx r15d, byte [rbp + 0x150]
or r14b, 1
jmp 0x14001d8af
test r12b, 0x30
jne case.0x14001ca7e.38
movzx r15d, byte [rbp + 0x150]
or r14b, 0x10
jmp 0x14001d8af
test r12b, 0xc
jne case.0x14001ca7e.38
movzx r15d, byte [rbp + 0x150]
or r14b, 4
jmp 0x14001d8af
test r12b, 0xc0
jne case.0x14001ca7e.38
movzx r15d, byte [rbp + 0x150]
or r14b, 0x40
jmp 0x14001d8af
mov edx, r15d
lea rcx, [rsi + 2]
call fcn.1400cbb24
mov qword [rbp + 0x40], rax
mov rdi, rax
test rax, rax
je case.0x14001ca7e.38
movzx ecx, word [rsi + 2]
add rsi, 2
cmp cx, 0x20
je 0x14001cb08
cmp cx, 9
je 0x14001cb08
mov r15, rax
mov qword [rbp + 0x10], rsi
sub r15, rsi
sar r15, 1
jne 0x14001cbd2
lea rbx, [rax + 2]
movzx eax, word [rax + 2]
cmp ax, 0x7d
jne 0x14001cb4f
mov rdi, rbx
mov qword [rbp + 0x40], rbx
mov r15d, 1
jmp 0x14001cbd2
cmp ax, 0x20
je 0x14001cb6c
cmp ax, 9
jne 0x14001d000
nop
cmp ax, 0x20
je 0x14001cb6c
cmp ax, 9
jne 0x14001cb76
movzx eax, word [rbx + 2]
add rbx, 2
jmp 0x14001cb60
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call fcn.1400d2a10
test eax, eax
je 0x14001cbac
mov r8d, 2
lea rdx, [0x14010f960]
mov rcx, rbx
call fcn.1400d2a10
test eax, eax
jne 0x14001d000
mov edx, 0x7d
mov rcx, rbx
call fcn.1400cbb24
mov qword [rbp + 0x40], rax
mov rdi, rax
test rax, rax
je case.0x14001ca7e.38
mov r15, rax
sub r15, rsi
sar r15, 1
mov r8d, 5
lea rdx, [0x14010dc48]
mov rcx, rsi
call fcn.1400d2a10
test eax, eax
jne 0x14001ccde
xor ebx, ebx
lea rcx, [rsi + 0xa]
mov word [rdi], bx
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001cc0f
cmp ax, 9
jne 0x14001cc15
add rcx, 2
jmp 0x14001cc00
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 2]
lea rax, [rbp + 0x1c]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x24]
lea rax, [rbp + 0x18]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.14001ecb0
mov ecx, dword [rbp + 0x1c]
mov word [rdi], 0x7d
cmp ecx, 1
jge 0x14001cc8a
mov rax, qword [rbp + 0x58]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x24]
lea rcx, [rbp + 0x28]
movzx r9d, byte [rax + 0x12f]
movzx eax, byte [rbp + 7]
mov byte [rsp + 0x20], al
call fcn.14001fe00
mov rsi, qword [rbp + 0x40]
xor r14b, r14b
mov r13, qword [rbp + 0x168]
movzx r15d, bl
jmp 0x14001d8af
movzx eax, byte [rbp + 7]
xor edx, edx
mov byte [rsp + 0x50], al
movzx r9d, r12b
mov eax, dword [rbp + 0x24]
movzx r8d, r14b
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x28]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0x18]
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
movzx ecx, byte [rbp + 2]
call fcn.14001dc60
mov rsi, qword [rbp + 0x40]
xor r14b, r14b
mov r13, qword [rbp + 0x168]
movzx r15d, bl
jmp 0x14001d8af
mov r8d, 3
lea rdx, [0x140111060]
mov rcx, rsi
call fcn.1400d2a10
test eax, eax
jne 0x14001cd1f
mov rsi, qword [rbp + 0x40]
mov r15d, 1
mov r13, qword [rbp + 0x168]
xor r14b, r14b
mov dword [rbp + 0x158], r15d
movzx r15d, byte [rbp + 0x150]
jmp 0x14001d8af
mov r8d, 4
lea rdx, str.Text
mov rcx, rsi
call fcn.1400d2a10
test eax, eax
jne 0x14001cd86
lea rcx, [rsi + 8]
nop dword [rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001cd4f
cmp ax, 9
jne 0x14001cd55
add rcx, 2
jmp 0x14001cd40
cmp rcx, rdi
jne 0x14001d000
mov rsi, qword [rbp + 0x40]
mov r15d, 2
mov r13, qword [rbp + 0x168]
xor r14b, r14b
mov dword [rbp + 0x158], r15d
movzx r15d, byte [rbp + 0x150]
jmp 0x14001d8af
xor ebx, ebx
mov dword [rbp + 0x1c], 1
mov word [rdi], bx
mov r13d, 2
movzx edx, word [rsi]
mov r12, r15
mov dword [rbp + 0x18], r13d
mov r14, rsi
test dx, dx
je 0x14001cddc
nop word [rax + rax]
lea rcx, [0x1401108a0]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14001cde4
add rcx, r13
movzx eax, word [rcx]
test ax, ax
jne 0x14001cdc0
add r14, r13
movzx edx, word [r14]
test dx, dx
jne 0x14001cdb0
mov r14, rbx
jmp 0x14001cec7
movzx eax, word [r14]
mov r12, r14
sub r12, rsi
mov word [r14], bx
sar r12, 1
lea rbx, [r14 + 2]
mov word [rbp + 0x20], ax
nop dword [rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14001ce0f
cmp ax, 9
jne 0x14001ce14
add rbx, r13
jmp 0x14001ce00
mov rax, rdi
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14001cec5
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call fcn.1400d2a10
test eax, eax
jne 0x14001ce82
xor edi, edi
lea r8d, [rax + 4]
lea rdx, str.Temp
mov dword [rbp + 0x18], edi
lea rcx, [rbx + 8]
mov r13d, edi
call fcn.1400d2a10
test eax, eax
jne 0x14001ce65
xor ebx, ebx
mov dword [rbp + 0x2c], ebx
jmp 0x14001cec7
cmp word [rbx + 8], 0x52
mov ecx, edi
sete cl
call fcn.1400dce68
test eax, eax
mov ebx, edi
setne bl
inc ebx
mov dword [rbp + 0x2c], ebx
jmp 0x14001cec5
lea rdx, [0x14010f960]
mov rcx, rbx
call fcn.1400d0944
test eax, eax
jne 0x14001cea1
mov r13d, 1
mov dword [rbp + 0x18], r13d
jmp 0x14001cec5
mov rcx, rbx
call fcn.140005a80
mov rcx, rbx
test al, al
je 0x14001cebd
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400d2570
jmp 0x14001cec2
call fcn.1400d278c
mov dword [rbp + 0x1c], eax
xor ebx, ebx
mov rax, qword [0x140137560]
lea rdx, [rbp + 1]
mov r8b, 1
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.140022190
mov byte [rbp + 2], al
movzx edi, al
test al, al
je 0x14001cef4
movzx esi, bx
jmp 0x14001cf77
xor edx, edx
mov rcx, rsi
call fcn.140022070
mov rbx, qword [rbp + 0x10]
movzx esi, ax
test ax, ax
jne 0x14001cf7b
mov r8d, 2
lea rdx, [0x1401108fc]
mov rcx, rbx
call fcn.1400d2a10
test eax, eax
jne 0x14001cf7b
lea rcx, [rbx + 4]
lea r8d, [rax + 0x10]
lea rdx, [rbp + 0x38]
call fcn.1400d2624
mov rcx, qword [rbp + 0x38]
lea rdx, [0x1401111d8]
mov r8d, 2
mov ebx, eax
call fcn.1400d2a10
test eax, eax
jne 0x14001cf77
mov rcx, qword [rbp + 0x38]
lea r8d, [rax + 0x10]
add rcx, 4
lea rdx, [rbp + 0x38]
call fcn.1400d2624
mov rcx, qword [rbp + 0x38]
cmp word [rcx], si
jne 0x14001cf77
movzx edi, bl
mov byte [rbp + 2], bl
movzx esi, ax
mov rbx, qword [rbp + 0x10]
test r14, r14
je 0x14001cf88
movzx eax, word [rbp + 0x20]
mov word [r14], ax
mov rax, qword [rbp + 0x40]
mov r14d, dword [rbp + 0x1c]
mov word [rax], 0x7d
cmp r14d, 1
jl 0x14001cffb
test dil, dil
jne 0x14001d4da
test si, si
jne 0x14001d4da
cmp r12, 1
jne 0x14001d04e
cmp r13d, r12d
je 0x14001cffb
mov r13, qword [rbp + 0x168]
test r13, r13
je 0x14001d01b
test r14d, r14d
jle 0x14001cffb
mov rdi, qword [rbp + 0x10]
mov ebx, r14d
nop dword [rax]
nop dword [rax + rax]
movzx r8d, word [rdi]
xor r9d, r9d
mov edx, 0x102
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
sub rbx, 1
jne 0x14001cfe0
movzx r12d, byte [rbp]
movzx r15d, byte [rbp + 0x150]
mov rsi, qword [rbp + 0x40]
xor r14b, r14b
mov r13, qword [rbp + 0x168]
jmp 0x14001d8af
movzx r8d, byte [rbp + 1]
mov edx, r14d
movzx r12d, byte [rbp]
movzx ecx, word [rbx]
or r8b, r12b
call fcn.14001dec0
movzx r15d, byte [rbp + 0x150]
xor r14b, r14b
mov rsi, qword [rbp + 0x40]
mov r13, qword [rbp + 0x168]
jmp 0x14001d8af
mov r13, qword [rbp + 0x168]
lea r9, [rbp + 3]
test r13, r13
lea r8, [rbp + 0x18]
mov rdx, r15
mov rcx, rbx
sete al
mov byte [rsp + 0x20], al
call fcn.1400224f0
mov byte [rbp + 2], al
movzx edi, al
test al, al
je 0x14001d22f
mov esi, dword [rbp + 0x18]
test r13, r13
jne 0x14001d11d
test esi, esi
jne 0x14001d09f
movzx r15d, al
mov byte [rbp + 0x150], al
jmp 0x14001d125
cmp dword [0x1401374b0], 0
jne 0x14001d11d
cmp byte [0x1401372dd], dil
je 0x14001d11d
cmp byte [0x1401374b4], 0
jne 0x14001d11d
movzx ecx, byte [0x1401372dc]
lea eax, [rdi - 0x5b]
cmp al, 1
ja 0x14001d0d8
lea eax, [rcx - 0x5b]
cmp al, 1
ja 0x14001d0d8
cmp dword [0x140137580], 2
jne 0x14001d0f5
cmp dil, 0xa4
je 0x14001d0ed
cmp dil, 0xa5
jne 0x14001d11d
cmp dword [0x140137568], 3
je 0x14001d11d
add cl, 0x5c
cmp cl, 1
ja 0x14001d11d
movzx r8d, word [0x1401315cc]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.14001e3e0
movzx r15d, byte [rbp + 0x150]
cmp dword [0x140137580], 0
je 0x14001d137
movzx eax, byte [0x14013746c]
jmp 0x14001d13e
xor ecx, ecx
call fcn.140021430
movzx r12d, byte [rbp + 3]
xor r9d, r9d
movzx ecx, r12b
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r13
mov byte [rsp + 0x20], 0
movzx edx, al
mov byte [rbp], r12b
call fcn.140020bc0
test r14d, r14d
jle 0x14001d008
mov rbx, r14
xor r15d, r15d
nop word [rax + rax]
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
mov r9, r13
mov byte [rsp + 0x20], 1
movzx edx, dil
mov ecx, esi
call fcn.14001e3e0
cmp dword [0x140137580], r15d
jne 0x14001d20a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fc08]
sub eax, dword [0x140137224]
cmp eax, dword [rcx + 0x118]
jbe 0x14001d20a
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, [rbp + 0xd0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001d1fe
mov edx, 1
mov dword [0x14012fc00], r15d
lea ecx, [rdx - 2]
call fcn.140001940
mov dword [0x14012fc00], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140137224], eax
sub rbx, 1
jne 0x14001d180
movzx r15d, byte [rbp + 0x150]
xor r14b, r14b
mov rsi, qword [rbp + 0x40]
mov r13, qword [rbp + 0x168]
jmp 0x14001d8af
cmp r15, 4
jbe 0x14001d2e8
mov r8d, 4
lea rdx, str.ASC
mov rcx, rbx
call fcn.1400d2a10
test eax, eax
jne 0x14001d2ee
test r13, r13
jne 0x14001d2ee
lea rcx, [rbx + 6]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001d272
cmp ax, 9
jne 0x14001d278
add rcx, 2
jmp 0x14001d263
call fcn.14001e0b0
cmp dword [0x140137580], 2
mov rax, qword [0x14012fc08]
jne 0x14001d2bc
mov ecx, dword [rax + 0x80]
call fcn.140020720
movzx r12d, byte [rbp + 3]
xor r14b, r14b
movzx r15d, byte [rbp + 0x150]
mov rsi, qword [rbp + 0x40]
mov r13, qword [rbp + 0x168]
mov byte [rbp], r12b
jmp 0x14001d8af
mov ecx, dword [rax + 0x7c]
call fcn.140020720
movzx r12d, byte [rbp + 3]
xor r14b, r14b
movzx r15d, byte [rbp + 0x150]
mov rsi, qword [rbp + 0x40]
mov r13, qword [rbp + 0x168]
mov byte [rbp], r12b
jmp 0x14001d8af
cmp r15, 2
jbe 0x14001d2c4
mov r8d, 2
lea rdx, [0x140111084]
mov rcx, rbx
call fcn.1400d2a10
test eax, eax
jne 0x14001d2c4
lea rcx, [rbx + 4]
xor edx, edx
lea r8d, [rax + 0x10]
call fcn.1400d2570
cmp eax, 0x10000
jb 0x14001d349
add eax, 0xffff0000
mov edx, 0x3ff
mov ecx, eax
movzx ebx, ax
shr ecx, 0xa
and bx, dx
and cx, dx
mov r8d, 0x2800
sub cx, r8w
mov edx, 0x2400
sub bx, dx
jmp 0x14001d34e
movzx ecx, ax
xor ebx, ebx
movzx r12d, byte [rbp + 3]
mov byte [rbp], r12b
test r13, r13
je 0x14001d394
movzx r8d, cx
xor r9d, r9d
mov rcx, r13
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
test bx, bx
je 0x14001d481
movzx r8d, bx
xor r9d, r9d
mov edx, 0x102
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001d481
cmp dword [0x140137580], 2
je 0x14001d3c7
movzx edi, byte [rbp + 1]
or dil, r12b
movzx edx, dil
call fcn.14001c0d0
test bx, bx
je 0x14001d481
movzx edx, dil
movzx ecx, bx
call fcn.14001c0d0
jmp 0x14001d481
mov ecx, gethostbyname
lea rdx, [rbp + 0x6a]
mov word [rbp + 0x68], cx
lea r8d, [rcx - 0x26]
mov ecx, eax
call fcn.1400d07a8
cmp dword [0x140137580], 0
je 0x14001d3f1
movzx eax, byte [0x14013746c]
jmp 0x14001d3f8
xor ecx, ecx
call fcn.140021430
movzx ecx, al
mov dword [rsp + 0x28], 0xffc3d44f
and cl, 0xc4
mov byte [rsp + 0x20], 1
or cl, 4
xor r9d, r9d
xor r8d, r8d
movzx edx, al
call fcn.140020bc0
movzx eax, word [rbp + 0x68]
lea rbx, [rbp + 0x68]
cmp ax, 0x30
jb 0x14001d463
nop word [rax + rax]
cmp ax, 0x39
ja 0x14001d463
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
lea edx, [rax + 0x30]
mov byte [rsp + 0x20], r8b
xor r9d, r9d
lea ecx, [r8 + 2]
call fcn.14001e3e0
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x30
jae 0x14001d430
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 1]
call fcn.14001e3e0
cmp dword [0x140137580], 2
mov rax, qword [0x14012fc08]
jne 0x14001d4b7
mov ecx, dword [rax + 0x80]
call fcn.140020720
movzx r15d, byte [rbp + 0x150]
xor r14b, r14b
mov rsi, qword [rbp + 0x40]
mov r13, qword [rbp + 0x168]
jmp 0x14001d8af
mov ecx, dword [rax + 0x7c]
call fcn.140020720
movzx r15d, byte [rbp + 0x150]
xor r14b, r14b
mov rsi, qword [rbp + 0x40]
mov r13, qword [rbp + 0x168]
jmp 0x14001d8af
xor r8d, r8d
movzx edx, si
movzx ecx, dil
call fcn.1400216b0
mov r15, qword [rbp + 0x168]
movzx ebx, al
test al, al
je 0x14001d625
test r15, r15
jne 0x14001d625
test r13d, r13d
jne 0x14001d553
mov eax, dword [rbp + 0x2c]
mov byte [rbp + 0x150], dil
cmp eax, 1
jne 0x14001d533
movzx r12d, byte [rbp]
or byte [0x1401372de], bl
or r12b, bl
mov byte [rbp], r12b
mov byte [rbp + 3], r12b
jmp 0x14001d62a
cmp eax, 2
jne 0x14001d53e
or byte [0x1401372df], bl
movzx r12d, byte [rbp]
or r12b, bl
mov byte [rbp], r12b
mov byte [rbp + 3], r12b
jmp 0x14001d62a
cmp r13d, 1
jne 0x14001d625
cmp dword [0x1401374b0], 0
jne 0x14001d5dd
cmp byte [0x1401372dd], dil
je 0x14001d5dd
cmp byte [0x1401374b4], 0
jne 0x14001d5dd
movzx ecx, byte [0x1401372dc]
lea eax, [rdi - 0x5b]
cmp al, r13b
ja 0x14001d598
lea eax, [rcx - 0x5b]
cmp al, r13b
ja 0x14001d598
cmp dword [0x140137580], 2
jne 0x14001d5b5
cmp dil, 0xa4
je 0x14001d5ad
cmp dil, 0xa5
jne 0x14001d5dd
cmp dword [0x140137568], 3
je 0x14001d5dd
add cl, 0x5c
cmp cl, 1
ja 0x14001d5dd
movzx r8d, word [0x1401315cc]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.14001e3e0
movzx ecx, byte [rbp + 5]
movzx eax, bl
not al
and byte [0x1401372df], al
and cl, al
movzx r12d, al
mov byte [rbp + 5], cl
and r12b, byte [0x1401372de]
mov byte [0x1401372de], r12b
cmp dil, 0xa5
jne 0x14001d618
cmp dword [0x140137568], 3
jne 0x14001d618
and cl, 0xfe
mov byte [rbp + 5], cl
or r12b, cl
mov byte [rbp], r12b
mov byte [rbp + 3], r12b
jmp 0x14001d62a
movzx r12d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx r9d, r12b
mov byte [rsp + 0x50], 0
movzx edx, si
mov dword [rsp + 0x48], 0x80000000
movzx ecx, dil
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
call fcn.14001dc60
movzx r15d, byte [rbp + 0x150]
xor r14b, r14b
mov rsi, qword [rbp + 0x40]
mov r13, qword [rbp + 0x168]
jmp 0x14001d8af
movzx r15d, byte [rbp + 0x150]
jmp 0x14001d8b3
cmp eax, 2
jne 0x14001d6e2
movzx ecx, word [rsi]
sub ecx, 8
je 0x14001d6d4
sub ecx, 1
je 0x14001d6cc
sub ecx, 1
je 0x14001d6c4
cmp ecx, 3
je 0x14001d6b3
mov byte [rbp + 2], 0
xor bl, bl
jmp 0x14001d711
cmp word [rsi + 2], 0xa
lea rax, [rsi + 2]
cmove rsi, rax
mov qword [rbp + 0x10], rsi
mov byte [rbp + 2], ntohs
mov bl, 0xd
jmp 0x14001d711
mov byte [rbp + 2], 9
mov bl, 9
jmp 0x14001d711
mov byte [rbp + 2], 8
mov bl, 8
jmp 0x14001d711
mov eax, dword [rbp + 0x158]
or r14b, r12b
je 0x14001d6f0
test eax, eax
jne 0x14001d6f0
mov r9b, 1
jmp 0x14001d6f3
xor r9d, r9d
mov r8, qword [0x140137560]
lea rdx, [rbp + 1]
movzx ecx, word [rsi]
call fcn.1400222e0
movzx r14d, byte [rbp + 1]
movzx ebx, al
mov byte [rbp + 2], al
test bl, bl
je 0x14001d922
or r14b, r12b
lea eax, [rbx - 1]
cmp al, 5
ja 0x14001d728
cmp bl, 3
jne 0x14001d72f
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x14001d734
mov sil, 1
jmp 0x14001d737
xor sil, sil
cmp dword [0x140137580], 0
jne 0x14001d7a1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fc08]
sub eax, dword [0x140137224]
cmp eax, dword [rcx + 0x118]
jbe 0x14001d7a1
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, [rbp + 0x80]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001d795
mov edx, 1
mov dword [0x14012fc00], edi
lea ecx, [rdx - 2]
call fcn.140001940
mov dword [0x14012fc00], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140137224], eax
mov rax, qword [0x14012fc08]
movzx ecx, byte [rax + 0x136]
test cl, cl
je 0x14001d7bc
mov edi, 0xffc3d44d
sub edi, ecx
jmp 0x14001d7c1
mov edi, 0xffc3d44f
cmp dword [0x140137580], 0
je 0x14001d7d3
movzx eax, byte [0x14013746c]
jmp 0x14001d7da
xor ecx, ecx
call fcn.140021430
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov r8, r13
mov byte [rsp + 0x20], 1
movzx edx, al
movzx ecx, r14b
call fcn.140020bc0
test sil, sil
je 0x14001d834
test r13, r13
jne 0x14001d834
mov rax, qword [0x14012fc08]
lea r9d, [r13 + 1]
mov byte [rsp + 0x30], r13b
movzx ecx, bl
mov dword [rsp + 0x28], 2
movzx edx, byte [rax + 0x12f]
mov dword [rsp + 0x20], edx
mov edx, 0x80000000
mov r8d, edx
call fcn.14001f910
jmp 0x14001d864
mov rax, qword [0x14012fc08]
xor r8d, r8d
mov r9, r13
movzx edx, bl
movzx ecx, byte [rax + 0x136]
mov eax, 0xffc3d44d
sub eax, ecx
lea ecx, [r8 + 2]
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], 1
call fcn.14001e3e0
cmp dword [0x140137580], 0
je 0x14001d876
movzx eax, byte [0x14013746c]
jmp 0x14001d87d
xor ecx, ecx
call fcn.140021430
movzx edx, r12b
not dl
and dl, al
and dl, 0xcc
je 0x14001d8a4
mov dword [rsp + 0x28], 0xffc3d44d
mov r9b, 1
mov r8, r13
mov byte [rsp + 0x20], 0
xor ecx, ecx
call fcn.140020bc0
mov rsi, qword [rbp + 0x10]
xor r14b, r14b
movzx r15d, r14b
mov byte [rbp + 1], r14b
add rsi, 2
mov byte [0x1401372dd], r15b
mov qword [rbp + 0x10], rsi
lea rbx, [0x140000000]
mov r15d, 0x7d
cmp word [rsi], 0
jne 0x14001c9c0
movzx r15d, byte [rbp + 0xa]
mov edi, 0x5dc
cmp dword [0x140137580], 0
je 0x14001d9d9
cmp byte [0x14013746e], 0
mov ebx, 0xffffffff
mov dword [rbp + 0x150], ebx
jne 0x14001d9a2
cmp dword [0x14013756c], 0
jbe 0x14001d9a2
cmp byte [0x1401374b4], 0
je 0x14001d959
xor bl, bl
jmp 0x14001d962
movzx ecx, word [rsi]
test r13, r13
je 0x14001d943
mov r8d, ecx
xor r9d, r9d
mov rcx, r13
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001d8a8
or r14b, r12b
mov edx, 1
movzx r8d, r14b
call fcn.14001dec0
jmp 0x14001d8a8
movzx ebx, byte [rbp + 6]
not bl
and bl, byte [rbp + 4]
or bl, byte [0x1401372df]
mov r9b, 1
movzx edx, byte [0x14013746c]
or bl, r12b
movzx ecx, bl
mov dword [rsp + 0x28], 0xffc3d44d
xor r8d, r8d
mov byte [rsp + 0x20], 1
call fcn.140020bc0
movzx edx, bl
lea rcx, [rbp + 0x150]
call fcn.140020580
mov ebx, dword [rbp + 0x150]
cmp dword [0x140137580], 1
mov eax, 0x1f4
cmove edi, eax
cmp dword [0x140137570], edi
jbe 0x14001d9c5
mov rcx, qword [0x1401351a0]
call fcn.1400d29a8
xor edi, edi
mov ecx, ebx
mov dword [0x140137580], edi
call fcn.140020720
jmp 0x14001da78
cmp qword [0x140134268], 0
je 0x14001d9f0
movzx ecx, byte [0x14013429e]
movzx edx, byte [rbp + 4]
jmp 0x14001da1c
cmp dword [0x1401315c8], 0
jl 0x14001da15
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1401371b4]
cmp eax, dword [0x1401315c8]
jb 0x14001da15
movzx edx, byte [rbp + 4]
xor cl, cl
jmp 0x14001da1c
movzx edx, byte [rbp + 4]
movzx ecx, dl
or cl, byte [0x1401372df]
cmp byte [0x1401374b4], 0
je 0x14001da40
movzx eax, cl
xor al, dl
movzx ebx, al
and al, cl
and bl, dl
not bl
and bl, r12b
or bl, al
jmp 0x14001da4b
movzx ebx, byte [rbp + 6]
not bl
and bl, cl
or bl, r12b
xor ecx, ecx
call fcn.140021430
or al, byte [0x14013429d]
mov r9b, 1
movzx edx, al
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r13
mov byte [rsp + 0x20], 1
movzx ecx, bl
call fcn.140020bc0
xor edi, edi
cmp qword [0x140134268], 0
je 0x14001da9e
movzx ecx, byte [0x14013429f]
movzx eax, cl
xor al, byte [0x1401343f4]
and al, cl
not al
and cl, al
mov byte [0x14013429f], cl
cmp dword [rbp + 0x30], 1
jne 0x14001dab0
mov edx, 1
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140020a70
cmp byte [rbp + 8], 0
je 0x14001dac8
mov edx, dword [rbp + 0x34]
xor r8d, r8d
mov ecx, dword [0x140136620]
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rbp + 9], 0
je 0x14001dae2
test r15b, r15b
jne 0x14001dae2
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14013408f], r15b
mov eax, dword [rbp + 0x160]
test eax, eax
jne 0x14001db75
mov eax, dword [rbp + 0x48]
cmp dword [0x140137220], eax
je 0x14001dbb0
cmp dword [0x14012fc00], 0
je 0x14001dbb0
cmp dword [0x1401341f0], 0
jne 0x14001dbb0
mov rcx, qword [0x14012fc08]
cmp byte [rcx + 0x12c], 0
jne 0x14001db66
cmp byte [rcx + 0x12e], 0
jne 0x14001db5d
cmp dword [rcx + 0x120], 0xffffffff
jle 0x14001db5d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fc08]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x14001db5d
mov byte [rcx + 0x12c], 1
cmp byte [rcx + 0x12c], 0
je 0x14001dbb0
mov edx, 1
lea ecx, [rdx - 2]
call fcn.140001940
jmp 0x14001dbb0
cmp eax, 1
jne 0x14001dbb0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140136620]
jne 0x14001dbb0
mov edx, 1
mov dword [0x14012fc00], edi
lea ecx, [rdx - 2]
call fcn.140001940
mov dword [0x14012fc00], 1
mov rax, qword [rbp + 0x58]
mov ecx, dword [rbp + 0x4c]
mov dword [rax + 0x7c], ecx
mov ecx, dword [rbp + 0x50]
mov dword [rax + 0x84], ecx
lea rsp, [rbp + 0x108]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret