Function at 0x140043200
Capabilities:
Contain obfuscated stackstrings
Create thread
Enumerate processes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
movabs r15, 0xd06deb4e512259f3
mov qword [rbp - 0x30], r15
movabs r12, 0xc22fa8fba0044820
mov qword [rbp - 0x28], r12
movabs r13, 0xc72dacc4af6ec96d
mov qword [rbp - 0x20], r13
movabs r14, 0xdef8b47980ba712a
mov qword [rbp - 0x18], r14
movabs rax, 0x9121b32735652dbd
mov qword [rsp + 0x60], rax
movabs rax, 0x9a46f7b1e24b0d74
mov qword [rsp + 0x68], rax
movabs rax, 0xc72dacc4ca1aa801
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r14
movdqa xmm0, xmmword [rbp - 0x30]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x20]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x40], 0x72657375
mov dword [rbp - 0x3c], 0x642e3233
mov word [rbp - 0x38], 0x6c6c
mov byte [rbp - 0x36], 0
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [rbp - 0x50], 0x336e6977
mov dword [rbp - 0x4c], 0x642e7532
mov word [rbp - 0x48], 0x6c6c
mov byte [rbp - 0x46], 0
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
mov qword [rbp - 0x40], rcx
mov word [rbp - 0x38], cx
mov byte [rbp - 0x36], cl
xor esi, esi
test rax, rax
jne 0x140043307
mov eax, esi
jmp 0x14004333e
mov qword [rbp - 0x50], rcx
mov word [rbp - 0x48], cx
mov byte [rbp - 0x46], cl
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140043330
mov eax, esi
mov ecx, esi
jmp 0x14004333e
mov qword [0x1400ea6d8], rax
mov eax, 1
mov ecx, eax
mov dword [0x1400ea0f8], eax
movabs rbx, 0xdc0c111a1986d017
movabs rdi, 0xa94c5c2771903664
test ecx, ecx
jne 0x140043480
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rdi
movabs rax, 0xbc048a08717f72a8
mov qword [rsp + 0x60], rax
movabs rax, 0xac468894d4242c45
mov qword [rsp + 0x68], rax
movabs rax, 0xa257c5a8ce07bd04
mov qword [rsp + 0x70], rax
movabs rax, 0xb796c114edd5120a
mov qword [rsp + 0x78], rax
movabs rax, 0xd62d7f7570f2b174
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdi
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x20]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x10]
pxor xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rsp + 0x60]
call fcn.1400388a0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
movabs rax, 0xa4048a19717f72a8
mov qword [rsp + 0x60], rax
movabs rax, 0xb04b889fc16b2400
mov qword [rsp + 0x68], rax
movabs rax, 0xcd0382eadd0bbf04
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r14
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x20]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
call fcn.1400388a0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400ea0f8]
test eax, eax
jne 0x140043489
call fcn.140042d60
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rdi
movabs rax, 0xaa23ed90d306be71
mov qword [rbp], rax
movabs rax, 0x27cf42851d904d8e
mov qword [rbp + 8], rax
movabs rax, 0xfcb4ec26b5aac29b
mov qword [rbp + 0x10], rax
movabs rcx, 0xc0d5c97367ce20c8
mov qword [rbp + 0x18], rcx
movabs rax, 0xd02eeb19517859b4
mov qword [rsp + 0x60], rax
movabs rax, 0xc241a89ea06d484c
mov qword [rsp + 0x68], rax
movabs rax, 0xc748acb0af3dc919
mov qword [rsp + 0x70], rax
movabs rax, 0xdeafb45480d7714b
mov qword [rsp + 0x78], rax
movabs rax, 0xdc38112c19e8d07e
mov qword [rbp - 0x80], rax
movabs rax, 0xa9255c4f71c33649
mov qword [rbp - 0x78], rax
movabs rax, 0xaa4dedf9d376be01
mov qword [rbp - 0x70], rax
movabs rax, 0x27b742e01dbe4de9
mov qword [rbp - 0x68], rax
movabs rax, 0xfcb4ec26b5aac2fe
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
pxor xmm1, xmmword [rbp]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
pxor xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x60], xmm0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov edi, esi
cmp rax, 0xffffffffffffffff
je 0x140043651
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x74]
call fcn.140051830
mov dword [rbp + 0x70], 0x238
lea rdx, [rbp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140043648
lea rdx, [rbp + 0x9c]
lea rcx, [rsp + 0x60]
call fcn.140061840
test eax, eax
jne 0x14004360b
mov edi, dword [rbp + 0x78]
jmp 0x140043648
lea rdx, [rbp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140043648
nop dword [rax]
lea rdx, [rbp + 0x9c]
lea rcx, [rsp + 0x60]
call fcn.140061840
test eax, eax
cmove edi, dword [rbp + 0x78]
lea rdx, [rbp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140043620
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1400ea6e4], edi
movabs rbx, 0x8d1f8e3e214334a8
test edi, edi
jne 0x1400436e4
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
mov qword [rsp + 0x60], rbx
movabs rax, 0xb15ccd98cf763800
mov qword [rsp + 0x68], rax
movabs rax, 0xb242cae4db01a74d
mov qword [rsp + 0x70], rax
movabs rax, 0xdef8b4798a9b1544
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
call fcn.1400388a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [0x1400ea6e4]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
movabs rax, 0xf01e982b324d2ba3
mov qword [rsp + 0x60], rax
movabs rax, 0xa60a88c58d240c69
mov qword [rsp + 0x68], rax
movabs rax, 0xc72dacc4af6ec967
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r14
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x70], xmm1
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.1400388a0
mov dword [rsp + 0x6c], esi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x68], 0xdeadbeef
mov eax, dword [0x1400ea6e4]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x70], rsi
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [0x1400ea6d8]
mov rdx, qword [rsp + 0x70]
mov qword [0x1400ea6d0], rdx
test rdx, rdx
jne 0x1400438ba
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
movabs rax, 0xdc0c111a1986d017
mov qword [rbp - 0x10], rax
movabs rax, 0xa94c5c2771903664
mov qword [rbp - 8], rax
movabs rax, 0xaa23ed90d306be71
mov qword [rbp], rax
movabs rcx, 0x27cf42851d904d8e
mov qword [rbp + 8], rcx
mov qword [rsp + 0x60], rbx
movabs rax, 0xe24bcd97c9652e00
mov qword [rsp + 0x68], rax
movabs rax, 0xa50dd8a1c84ea619
mov qword [rsp + 0x70], rax
movabs rax, 0xac9cd018a0df024b
mov qword [rsp + 0x78], rax
movabs rax, 0xac2c777539f5a372
mov qword [rbp - 0x80], rax
movabs rax, 0xc06c2f5414f35916
mov qword [rbp - 0x78], rax
movabs rax, 0xa047c8b0ed2b9e15
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rcx
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
pxor xmm1, xmmword [rbp]
movdqa xmmword [rbp - 0x70], xmm1
mov edx, dword [0x1400ea6e4]
lea rcx, [rsp + 0x60]
call fcn.1400388a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [0x1400ea6d0]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
movabs rax, 0xb12fcb2b364334ba
mov qword [rsp + 0x60], rax
movabs rax, 0xba1f88c58d242d53
mov qword [rsp + 0x68], rax
movabs rax, 0xc72daccef702a548
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r14
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
call fcn.1400388a0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r14, str.0123456789____ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
movzx edi, byte [rbp + 0x2f0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140041e80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
xor ecx, ecx
call fcn.140062610
mov rcx, rax
call fcn.1400605e4
mov ebx, 0x14
call fcn.1400605b8
mov r8d, eax
mov eax, 0xea0ea0eb
imul r8d
add edx, r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x46
sub r8d, ecx
movsxd rax, r8d
movzx r9d, byte [rax + r14]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
cmp rcx, rdx
jae 0x1400439f5
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x60]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140043a08
movzx r8d, dil
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.14004b3c0
sub rbx, 1
jne 0x140043998
mov qword [rbp + 0x20], 0x50
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x40], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp + 0x48], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, qword [rsp + 0x60]
mov qword [rbp + 0x60], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x68], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0x20]
call qword [sym.imp.USER32.dll_RegisterClassExA]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
setae dl
cmovae r8, qword [rsp + 0x60]
lea r10, [rsp + 0x60]
test dl, dl
cmovne r10, qword [rsp + 0x60]
mov qword [rsp + 0x58], rsi
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x38]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
mov rdx, r10
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400ea0b8], rax
lea edx, [rbx - 0x14]
mov r8d, 0x800a0
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea r9d, [rbx + 2]
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x1400ea0b8]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x1400b3720]
movdqu xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
mov rcx, qword [0x1400ea0b8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
lea edx, [rbx + 5]
mov rcx, qword [0x1400ea0b8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400ea0b8]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140043ba4
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043b9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043ec1
call fcn.14004dc4c
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rcx, qword [0x1400ea0b8]
call fcn.140041970
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14003c420]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [0x1400ea088], xmm0
movups xmmword [0x1400ea098], xmm0
movups xmmword [0x1400ea0a8], xmm0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1400ea0b8]
lea rcx, [0x1400ea088]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140043c41
lea rcx, [0x1400ea088]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x1400ea088]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140043ec7
mov rcx, qword [0x1400ea078]
cmp rbx, rcx
jne 0x140043ca4
mov edx, 3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [0x1400ea0b8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x1400ea078]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp + 0x2f0], rsi
lea rdx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rbp + 0x2f0]
mov rcx, qword [0x1400ea078]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x2f0]
mov dword [rbp - 0x50], eax
mov eax, dword [rbp + 0x2f4]
mov dword [rbp - 0x4c], eax
mov rbx, qword [0x1400ea020]
mov rax, qword [0x1400ea078]
mov qword [rbx + 0x108], rax
mov dword [rbx + 0x18], 0x3c888889
lea rcx, [rbp + 0x2f8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x2f8]
sub eax, dword [rbp + 0x2f0]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x118], xmm0
mov eax, dword [rbp + 0x2fc]
sub eax, dword [rbp + 0x2f4]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x11c], xmm0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140043d6d
mov byte [rbx + 0x120], 1
mov byte [rbx + 0x430], 1
mov eax, dword [rbx + 0x11c]
mov dword [rbx + 0x3dc], eax
jmp 0x140043d74
mov byte [rbx + 0x120], 0
mov ecx, dword [rbp - 0x44]
mov edx, dword [rbp - 0x48]
mov eax, dword [0x1400eab48]
cmp dword [rbp - 0x50], eax
jne 0x140043da0
cmp edx, dword [0x1400eab50]
jne 0x140043da0
mov eax, dword [0x1400eab4c]
cmp dword [rbp - 0x4c], eax
jne 0x140043da0
cmp ecx, dword [0x1400eab54]
je 0x140043e07
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [0x1400eab48], xmm0
mov dword [0x1400ea604], edx
mov dword [0x1400ea600], ecx
mov dword [0x1400ea100], edx
mov dword [0x1400ea104], ecx
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, dword [rbp + 0x2f4]
mov r8d, dword [rbp + 0x2f0]
xor edx, edx
mov rcx, qword [0x1400ea0b8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x1400ea148]
mov rax, qword [rcx]
lea rdx, [0x1400ea100]
call qword [rax + 0x80]
call fcn.1400410c0
cmp dword [0x1400ea090], 0x12
jne 0x140043c01
call fcn.140024ee0
mov qword [0x1400ea6b8], rsi
mov rbx, qword [0x1400ea020]
mov rcx, rbx
call fcn.1400070b0
mov rax, qword [0x1400ea020]
cmp rax, rbx
cmove rax, rsi
mov qword [0x1400ea020], rax
test rbx, rbx
je 0x140043e70
mov rcx, rbx
call fcn.140014a10
mov rax, qword [0x1400ea020]
test rax, rax
je 0x140043e68
dec dword [rax + 0x3c8]
mov rcx, rbx
call fcn.14005acd4
mov rcx, qword [0x1400ea148]
test rcx, rcx
je 0x140043e92
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x1400ea148]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400ea0c0]
test rcx, rcx
je 0x140043ea4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400ea0b8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140043941
call fcn.140062cd0
int3
mov ecx, 8
call fcn.1400615d4
int3