Function at 0x55ad40
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x1e0
mov qword [rsp + 0x168], 0xfffffffffffffffe
mov rbx, rcx
mov dword [0x008654e0], 0x114
lea rcx, [0x008654e0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov qword [0x008669d0], rbx
call qword [sym.imp.USER32.dll_CreateMenu]
mov qword [0x00867c88], rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rbx, rax
mov qword [rsp + 0x228], rax
mov r9, qword [0x0086ebd8]
xor edx, edx
mov r8d, 0x435
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ec78]
xor edx, edx
mov r8d, 0x84
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ec28]
xor edx, edx
mov r8d, 0x594
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086edb8]
xor edx, edx
mov r8d, 0x4ba
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c468]
xor edx, edx
mov r8d, 0x27d6
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086eb88]
xor edx, edx
mov r8d, 0x4bd
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov ebp, 0x800
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ed18]
xor edx, edx
mov r8d, 0x8009
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e8b8]
xor edx, edx
mov r8d, 0x8010
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ed68]
xor edx, edx
mov r8d, 0x8007
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087e998]
xor edx, edx
mov r8d, 0x63a
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086eef8]
xor edx, edx
mov r8d, 0x8006
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086f178]
xor edx, edx
mov r8d, 0x800a
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086f0d8]
xor edx, edx
mov r8d, 0x27a7
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086f128]
xor edx, edx
mov r8d, 0x27ab
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x00883088]
xor edx, edx
mov r8d, 0x65d
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e6d8]
xor edx, edx
mov r8d, 0xe141
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e818]
mov r8, rbx
mov esi, reloc.WS2_32.dll_recv
mov edx, esi
mov rcx, qword [0x00867c88]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rbx, rax
mov qword [rsp + 0x230], rax
mov r9, qword [0x0086ecc8]
xor edx, edx
mov r8d, 0x8004
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e868]
xor edx, edx
mov r8d, 0x800e
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e778]
xor edx, edx
mov r8d, 0x800f
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e7c8]
xor edx, edx
mov r8d, 0x424
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ee58]
xor edx, edx
mov r8d, 0x8008
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e188]
xor edx, edx
mov r8d, 0x457
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086eea8]
xor edx, edx
mov r8d, 0x42e
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x008845c8]
xor edx, edx
mov r8d, 0x4f7
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x008863c8]
xor edx, edx
mov r8d, 0x406
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e278]
xor edx, edx
lea r8d, [rsi + 0x5a]
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086eb38]
xor edx, edx
mov r8d, 0x403
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e908]
xor edx, edx
mov r8d, 0x4de
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087a348]
xor edx, edx
mov r8d, 0x9e
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086efe8]
xor edx, edx
mov r8d, 0xe800
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ef98]
xor edx, edx
mov r8d, 0xe801
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086f038]
xor edx, edx
mov r8d, 0x272f
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x00878ef8]
xor edx, edx
lea r8d, [rsi + 0x7c]
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x00877468]
xor edx, edx
mov r8d, 0xa0
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086f218]
mov r8, rbx
mov edx, esi
mov rcx, qword [0x00867c88]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rbx, rax
mov qword [rsp + 0x238], rax
mov r9, qword [0x0086e638]
xor edx, edx
mov r8d, 0x40d
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086bbb8]
xor edx, edx
mov r8d, 0x43c
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e688]
xor edx, edx
mov r8d, 0x2765
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086bc58]
xor edx, edx
mov r8d, 0x45d
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086eae8]
xor edx, edx
mov r8d, 0x8cb
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086f088]
mov r8, rbx
mov edx, esi
mov rcx, qword [0x00867c88]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rbx, rax
mov qword [rsp + 0x160], rax
mov r9, qword [0x0087c0f8]
xor edx, edx
mov r8d, 0x8b6
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c148]
xor edx, edx
mov r8d, 0x8b7
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c198]
xor edx, edx
mov r8d, 0x8b8
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c1e8]
xor edx, edx
mov r8d, 0x8b9
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c238]
xor edx, edx
mov r8d, 0x8ba
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c288]
xor edx, edx
mov r8d, 0x8bb
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c2d8]
xor edx, edx
mov r8d, 0x8bc
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c328]
xor edx, edx
mov r8d, 0x8c7
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c378]
xor edx, edx
mov r8d, 0x8c8
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c0a8]
mov r8, rbx
mov edx, esi
mov rcx, qword [0x00867c88]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rdi, rax
mov qword [rsp + 0x170], rax
mov r9, qword [0x0087eb28]
xor edx, edx
mov r8d, 0x63b
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087eb78]
xor edx, edx
mov r8d, 0x63c
mov rcx, rdi
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rbx, rax
mov qword [rsp + 0x158], rax
mov r9, qword [0x0086e228]
xor edx, edx
mov r8d, 0xe132
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ea48]
xor edx, edx
mov r8d, 0xe133
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086f1c8]
xor edx, edx
mov r8d, 0xe134
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e1d8]
xor edx, edx
mov r8d, 0xe131
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ea98]
xor edx, edx
mov r8d, 0xe136
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086ee08]
xor edx, edx
mov r8d, 0xe137
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e408]
xor edx, edx
mov r8d, 0x454
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e4a8]
xor edx, edx
mov r8d, __WSAFDIsSet
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087e088]
xor edx, edx
mov r8d, 0x69e
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e4f8]
xor edx, edx
mov r8d, reloc.WS2_32.dll___WSAFDIsSet
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e548]
xor edx, edx
mov r8d, 0x98
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e368]
xor edx, edx
mov r8d, 0x58f
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e318]
xor edx, edx
mov r8d, 0x590
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e2c8]
xor edx, edx
mov r8d, 0x591
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e3b8]
xor edx, edx
mov r8d, 0x592
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087c3c8]
lea edx, [rsi - 0xf]
mov r8d, 0x639
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087f168]
xor edx, edx
mov r8d, 0x8e4
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e458]
xor edx, edx
lea r8d, [rsi + 0x7b]
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087ead8]
mov r8, rdi
mov edx, esi
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086f268]
mov r8, rbx
mov edx, esi
mov rcx, qword [0x00867c88]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rbx, rax
mov qword [rsp + 0x150], rax
mov r9, qword [0x0086e9f8]
xor edx, edx
mov r8d, 0x427
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x00877a58]
xor edx, edx
mov r8d, 0x5c1
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e9a8]
xor edx, edx
mov r8d, 0x8b3
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086e958]
mov r8, rbx
mov edx, esi
mov rcx, qword [0x00867c88]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov edi, 0xa000
mov dword [rsp + 0x30], edi
and dword [rsp + 0x28], 0
mov ebx, 0xff000000
mov dword [rsp + 0x20], ebx
lea r9d, [rsi - 0xd]
mov r8d, esi
mov edx, 0xce
mov rcx, qword [0x00861be0]
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov qword [0x00867d70], rax
mov eax, dword [0x008654d0]
mov dword [0x008669c8], eax
inc eax
mov dword [0x008669cc], eax
add eax, 2
mov dword [0x008654d0], eax
mov dword [rsp + 0x30], edi
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebx
mov edx, 0x123
lea r9d, [rsi - 8]
lea r8d, [rsi + 9]
mov rcx, qword [0x00861be0]
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov qword [0x00867d78], rax
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov dword [0x00865434], eax
and qword [rsp + 0x220], 0
lea r8, str.CustomLocations.bmp
lea rdx, [0x0085e958]
lea rcx, [rsp + 0x58]
call fcn.00402658
nop
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.00401f00
mov dword [rsp + 0x28], esi
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadImageW]
mov rbx, rax
mov qword [rsp + 0x220], rax
lea rax, [rsp + 0x98]
mov r15d, 0x100
mov rcx, qword [rsp + 0xe0]
cmp rcx, rax
je 0x55b77c
test rcx, rcx
je 0x55b77c
mov rax, qword [rsp + 0x98]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x55b776
call fcn.006a4944
jmp 0x55b77c
call fcn.006a3610
nop
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
cmp rcx, rax
je 0x55b7ac
test rcx, rcx
je 0x55b7ac
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
cmp rdx, r15
jbe 0x55b7a7
call fcn.006a4944
jmp 0x55b7ac
call fcn.006a3610
test rbx, rbx
je 0x55b7c7
mov r8d, reloc.WS2_32.dll_getsockopt
mov rdx, rbx
mov rcx, qword [0x00867d78]
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edi, 0x5c
mov edx, edi
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r11, qword [0x00862cb8]
cmp byte [r11 + 0x2f2d], 0
jne 0x55b811
mov rcx, qword [r11 + 0xb8]
test rcx, rcx
je 0x55b811
lea edx, [rdi + 0x51]
call fcn.004083bc
jmp 0x55b818
lea rax, [r11 + 0x2130]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.00401f00
nop
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.0055c414
nop
lea rax, [rsp + 0x98]
mov rcx, qword [rsp + 0xe0]
cmp rcx, rax
je 0x55b877
test rcx, rcx
je 0x55b877
mov rax, qword [rsp + 0x98]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x55b872
call fcn.006a4944
jmp 0x55b877
call fcn.006a3610
mov r13d, reloc.WS2_32.dll_inet_addr
mov ecx, r13d
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rcx, rax
lea r8, [rsp + 0x180]
mov edx, edi
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r11d, dword [rsp + 0xf0]
mov dword [rsp + 0x180], r11d
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x190], eax
mov al, byte [rsp + 0x104]
mov byte [rsp + 0x194], al
lea rcx, [rsp + 0xf0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov rdi, rax
mov qword [0x00866998], rax
mov r12, qword [0x008669d0]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDC]
mov rbp, rax
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdi, rax
lea rdx, [rsp + 0x58]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_GetTextMetricsW]
mov esi, dword [rsp + 0x58]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
mov dword [0x00866994], esi
mov dword [rsp + 0x100], 0x2bc
lea rcx, [rsp + 0xf0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [0x008669a0], rax
mov eax, dword [rsp + 0xf0]
lea ecx, [rax + rax*4]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0xf0], edx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [0x008669c0], rax
mov eax, dword [rsp + 0x180]
lea eax, [rax + rax*2]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [rsp + 0xf0], eax
lea rcx, [rsp + 0xf0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [0x008669b8], rax
lea ecx, [r13 + 6]
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [0x008669a8], rax
mov ecx, r13d
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [0x008669b0], rax
mov rdi, qword [0x00862cb8]
cmp byte [rdi + 0x314e], 0
jne 0x55b9fb
mov rcx, qword [rdi + 0xb8]
test rcx, rcx
je 0x55b9fb
mov edx, 0x2ce
call fcn.0041024c
jmp 0x55ba01
mov al, byte [rdi + 0x2d6f]
test al, al
je 0x55ba1d
call fcn.00561b28
call fcn.005622e0
mov byte [0x008668f1], 1
mov rdi, qword [0x00862cb8]
cmp byte [rdi + 0x314f], 0
jne 0x55ba3e
mov rcx, qword [rdi + 0xb8]
test rcx, rcx
je 0x55ba3e
mov edx, 0x2cf
call fcn.0041024c
jmp 0x55ba44
mov al, byte [rdi + 0x2d70]
test al, al
je 0x55ba5b
call fcn.0056286c
mov byte [0x008668f2], 1
mov rdi, qword [0x00862cb8]
cmp byte [rdi + 0x3150], 0
jne 0x55ba7c
mov rcx, qword [rdi + 0xb8]
test rcx, rcx
je 0x55ba7c
mov edx, 0x2d0
call fcn.0041024c
jmp 0x55ba82
mov al, byte [rdi + 0x2d71]
test al, al
je 0x55ba92
call fcn.00561164
mov byte [0x008668f3], 1
mov edi, reloc.WS2_32.dll_sendto
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.006aba40
mov dword [rsp + 0x40], edi
lea rcx, str.comctl32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
jne 0x55bac8
call fcn.004ae8a8
mov edi, eax
jmp 0x55baf6
lea rdx, str.DllGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x55bae4
mov edi, 0x80004001
jmp 0x55baed
lea rcx, [rsp + 0x40]
call rax
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
js 0x55bb0f
movzx edx, word [rsp + 0x44]
shl edx, 0x10
movzx eax, word [rsp + 0x48]
or edx, eax
mov dword [0x008669f4], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
xor r8d, r8d
lea rdx, [0x0055ac78]
lea ecx, [r8 + 2]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x008669e8], rax
lea rsi, [0x0079f680]
mov ebp, 0x1f
lea r12d, [rbp - 0xf]
movzx edx, word [rsi]
mov dword [rsp + 0x28], 0x8000
mov dword [rsp + 0x20], r12d
mov r9d, r12d
xor r8d, r8d
mov rcx, qword [0x00861bd8]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rdi, rax
mov rdx, rsi
lea rcx, [0x00867dd8]
call fcn.0054cc28
mov qword [rax], rdi
add rsi, 4
sub rbp, 1
jne 0x55bb43
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x00867c90], rax
mov r9, qword [0x0086bf28]
xor edx, edx
mov r8d, 0x419
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086bfc8]
xor edx, edx
mov r8d, 0x275f
mov rcx, qword [0x00867c90]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086bf78]
xor edx, edx
mov r8d, 0x2760
mov rcx, qword [0x00867c90]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0086c018]
xor edx, edx
mov r8d, 0x2761
mov rcx, qword [0x00867c90]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087af28]
xor edx, edx
mov r8d, 0x2762
mov rcx, qword [0x00867c90]
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov r12d, 0x800
mov edx, r12d
mov rcx, qword [0x00867c90]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x00871568]
xor edx, edx
mov r8d, 0x2716
mov rcx, qword [0x00867c90]
call qword [sym.imp.USER32.dll_AppendMenuW]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x00867cb0], rax
mov ecx, 0x141
lea eax, [rcx + 2]
lea esi, [rbp + 5]
cmp dword [0x008654e4], esi
cmova ecx, eax
call fcn.0055ad14
mov qword [0x008654c8], rax
mov ecx, 0x142
lea eax, [rcx + 2]
cmp dword [0x008654e4], esi
cmova ecx, eax
call fcn.0055ad14
mov qword [0x008654c0], rax
mov ecx, 0x625
call fcn.0055ad14
mov qword [0x008654b8], rax
xor ecx, ecx
cmp dword [0x008654e4], esi
seta cl
add ecx, 0x626
call fcn.0055ad14
mov qword [0x008654b0], rax
mov ecx, 0x8e1
call fcn.0055ad14
mov qword [0x008654a8], rax
mov ecx, 0x8e2
call fcn.0055ad14
mov qword [0x008654a0], rax
mov ecx, 0x13b
call fcn.0055ad14
mov qword [0x00865498], rax
mov ecx, 0x13c
lea eax, [rcx + 3]
cmp dword [0x008654e4], esi
cmova ecx, eax
call fcn.0055ad14
mov qword [0x00865490], rax
mov ecx, 0x13d
lea eax, [rcx + 3]
cmp dword [0x008654e4], esi
cmova ecx, eax
call fcn.0055ad14
mov qword [0x00865488], rax
mov rax, qword [0x00862cb8]
lea ebp, [rsi + 8]
cmp byte [rax + 0x2e8d], 0
jne 0x55bd5f
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x55bd5f
mov edx, ebp
call fcn.004083bc
jmp 0x55bd65
add rax, 0x330
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.00466a2c
lea rdx, str.russian
mov rcx, qword [rax + 0x28]
call fcn.006a8dc4
test rax, rax
setne dil
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
cmp rcx, rax
je 0x55bdb9
test rcx, rcx
je 0x55bdb9
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
cmp rdx, r15
jbe 0x55bdb4
call fcn.006a4944
jmp 0x55bdb9
call fcn.006a3610
mov al, dil
neg al
sbb edx, edx
and edx, ebp
add edx, 0x8cc
mov ecx, 0x8d5
cmp dword [0x008654e4], esi
cmova ecx, edx
call fcn.0055ad14
mov qword [0x00865480], rax
mov al, dil
neg al
sbb edx, edx
and edx, ebp
add edx, 0x8cd
mov ecx, 0x8d6
cmp dword [0x008654e4], esi
cmova ecx, edx
call fcn.0055ad14
mov qword [0x00865478], rax
mov al, dil
neg al
sbb edx, edx
and edx, ebp
add edx, 0x8ce
mov ecx, 0x8d7
cmp dword [0x008654e4], esi
cmova ecx, edx
call fcn.0055ad14
mov qword [0x00865470], rax
neg dil
sbb eax, eax
and eax, ebp
add eax, 0x8cf
mov ecx, 0x8d8
cmp dword [0x008654e4], esi
cmova ecx, eax
call fcn.0055ad14
mov qword [0x00865468], rax
mov ecx, 0x8e0
lea eax, [rcx - 3]
cmp dword [0x008654e4], esi
cmova ecx, eax
call fcn.0055ad14
mov qword [0x00865440], rax
mov ecx, 0x8d4
call fcn.00568c20
mov qword [0x00865460], rax
mov ecx, 0x8d3
call fcn.00568c20
mov qword [0x00865458], rax
mov ecx, 0x8d0
call fcn.00568c20
mov qword [0x00865450], rax
mov ecx, 0x8d1
call fcn.00568c20
mov qword [0x00865448], rax
mov ecx, 0x405
call fcn.00568c20
mov qword [0x008653b8], rax
mov ecx, 0x65f
call fcn.00568c20
mov qword [0x008653b0], rax
mov ecx, 0x43f
call fcn.00568c20
mov qword [0x008653a8], rax
and qword [0x00865438], 0
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x00867c98], rax
lea r9, str.No_limit
xor edx, edx
mov r8d, 0x2ee0
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, str.Superuser
xor edx, edx
mov r8d, 0x2ee2
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d028]
xor edx, edx
mov r8d, 0x2eed
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d040]
xor edx, edx
mov r8d, 0x2eec
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d058]
xor edx, edx
mov r8d, 0x2eeb
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d068]
xor edx, edx
mov r8d, 0x2eea
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d078]
xor edx, edx
mov r8d, 0x2ee9
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d088]
xor edx, edx
mov r8d, 0x2ee8
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d098]
xor edx, edx
mov r8d, 0x2ee7
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d0a8]
xor edx, edx
mov r8d, 0x2ee6
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d0b8]
xor edx, edx
mov r8d, 0x2ee5
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, [0x0079d0c8]
xor edx, edx
mov r8d, 0x2ee4
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r9, str.Ban_user
xor edx, edx
mov r8d, 0x2ee3
mov rcx, qword [0x00867c98]
call qword [sym.imp.USER32.dll_AppendMenuW]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x00867ca0], rax
mov r9, qword [0x00869f98]
xor edx, edx
mov r8d, 0x300c
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087b568]
xor edx, edx
mov r8d, 0x300e
mov rcx, qword [0x00867ca0]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087a4d8]
xor edx, edx
mov r8d, 0x300d
mov rcx, qword [0x00867ca0]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087b5b8]
xor edx, edx
mov r8d, 0x300f
mov rcx, qword [0x00867ca0]
call qword [sym.imp.USER32.dll_AppendMenuW]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x00867cf0], rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x00867cd0], rax
mov r9, qword [0x0087d7c8]
xor edx, edx
mov r8d, 0x661
mov rcx, rax
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087d868]
xor edx, edx
mov r8d, 0x660
mov rcx, qword [0x00867cd0]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, qword [0x0087d818]
xor edx, edx
mov r8d, 0x65b
mov rcx, qword [0x00867cd0]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [0x00867cd0]
call fcn.00568d58
mov r12, qword [0x00862c98]
mov edx, 0xd3
mov rcx, qword [0x00861be0]
call qword [sym.imp.USER32.dll_LoadBitmapW]
mov qword [0x00867d98], rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x00867ca8], rax
xor esi, esi
mov r8, qword [r12 + 0x68]
mov rcx, qword [r12 + 0x70]
sub rcx, r8
movabs r13, 0x4924924924924925
mov rax, r13
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x55c2b2
xor ebp, ebp
lea rdx, [r8 + rbp + 8]
lea rcx, [rsp + 0x98]
call fcn.00401f00
lea r8, [rsi + 0x3070]
mov r9, qword [rax + 0x48]
xor edx, edx
mov rcx, qword [0x00867ca8]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r11, [rsp + 0x98]
mov rcx, qword [rsp + 0xe0]
cmp rcx, r11
je 0x55c23b
test rcx, rcx
je 0x55c23b
mov rax, qword [rsp + 0x98]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x55c236
call fcn.006a4944
jmp 0x55c23b
call fcn.006a3610
mov rax, qword [r12 + 0x68]
cmp byte [rax + rbp], 0
je 0x55c281
mov r9, qword [0x00867d98]
mov qword [rsp + 0x20], r9
xor r8d, r8d
lea edx, [rsi + 0x3070]
mov rcx, qword [0x00867ca8]
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov r8d, 8
lea edx, [rsi + 0x3070]
mov rcx, qword [0x00867ca8]
call qword [sym.imp.USER32.dll_CheckMenuItem]
inc rsi
add rbp, 0x38
mov r8, qword [r12 + 0x68]
mov rcx, qword [r12 + 0x70]
sub rcx, r8
mov rax, r13
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x55c1d2
call fcn.0055c33c
xor edx, edx
mov r8d, 0x260
lea rcx, [0x00866670]
call fcn.006aba40
lea rsi, [0x00866678]
lea rdi, [0x00794768]
mov ecx, dword [rdi - 4]
call fcn.004778e8
mov qword [rsi - 8], rax
mov ecx, dword [rdi]
call fcn.004778e8
mov qword [rsi], rax
mov ecx, dword [rdi + 4]
call fcn.004778e8
mov qword [rsi + 8], rax
mov ecx, dword [rdi + 8]
call fcn.004778e8
mov qword [rsi + 0x10], rax
add rdi, 0x44
add rsi, 0x20
lea rax, [0x00794c74]
cmp rdi, rax
jl 0x55c2d9
test rbx, rbx
je 0x55c32a
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
add rsp, 0x1e0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret