Function at 0x1400dafb0
Capabilities:
Create thread
Enumerate gui resources
Log keystrokes via polling
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x728
mov rax, qword [0x1401ed1a0]
xor rax, rsp
mov qword [rsp + 0x710], rax
mov dword [rsp + 0x40], 0
mov rcx, qword [0x1402144f8]
call fcn.14002a5e0
mov rcx, qword [0x1402144f8]
call fcn.14002a640
mov dword [rsp + 0xb8], 2
lea rdx, [0x1400d9c00]
lea rcx, [0x140212110]
call fcn.1400dd770
lea rdx, str._n_n___________n__________________________________________________________________________________________________n___________________________________________________________________________________________n____________________________________________________________________________________n________________________________________________________________________________________n________________________________________________________________________________________n_______________________________________________________________________________________n__________________________________________________________________________________________n_________________________________________________________________________________________n__________________________________________________________________________________________________n__________________________________________________________________________________________________n_________________________________________________________________________________________________________n___________________________________________________________________________________________________________n
mov rcx, rax
call fcn.140063e10
mov dl, 0xa
mov rcx, rax
call fcn.1400dff70
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d9b80]
lea rcx, [0x140212110]
call fcn.1400dd770
lea rdx, [0x140193a80]
mov rcx, rax
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140193fe4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.EDEVOLEP_DB_YCDORE_AM_n
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140193fec]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140193fe8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140193ff4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140193ff0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140193ffc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140193ff8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194004]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194000]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14015504c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194008]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194010]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019400c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14015504d]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194014]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019401c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194018]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194024]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194020]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194028]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14015504e]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194030]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019402c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194038]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d9c00]
lea rcx, [0x140212110]
call fcn.1400dd770
lea rdx, [0x140194034]
mov rcx, rax
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194040]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019403c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194048]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.clmo_eotB_ca_kC_DOREV_PIH_CA_K.._nuotamitacll_yeDettcdeY_uo_rmElutaro.._natif_ros_mo_eitem..
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194050]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019404c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194058]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194054]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194060]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019405c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194068]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194064]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194070]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019406c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194078]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194074]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194080]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019407c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194088]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194084]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194090]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019408c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194098]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194094]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940a0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019409c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940a8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940a4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940b0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940ac]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940b8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940b4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940c0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940bc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940c8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d9c00]
lea rcx, [0x140212110]
call fcn.1400dd770
lea rdx, [0x1401940c4]
mov rcx, rax
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940d0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940cc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940d8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940d4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940e0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940dc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940e8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940e4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940f0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940ec]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940f8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940f4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194100]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401940fc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194108]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194104]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194110]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019410c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194118]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194114]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194120]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019411c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194128]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194124]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194130]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019412c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194138]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194134]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194140]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019413c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194148]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194144]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194150]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019414c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194158]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194154]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194160]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019415c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194168]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d9b80]
lea rcx, [0x140212110]
call fcn.1400dd770
lea rdx, [0x140194164]
mov rcx, rax
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194170]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019416c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194178]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194174]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194180]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019417c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194188]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194184]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194190]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019418c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194198]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194194]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401941a0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019419c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401941a8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401941a4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401941b0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401941ac]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401941b8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401941b4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401941d0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x88
call fcn.1400fd658
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x1400dbfc9
mov edx, 0x88
mov rcx, qword [rsp + 0xa8]
call fcn.14000a760
lea rdx, str.CODERhkdriver
lea rcx, [rsp + 0x118]
call fcn.14000f650
nop
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rdx, str.DeviceCODERhkdriver
lea rcx, [rsp + 0xf8]
call fcn.14000f650
nop
mov eax, dword [rsp + 0x40]
or eax, 2
mov dword [rsp + 0x40], eax
lea rdx, str.C:WindowsCODERhkdriver.sys
lea rcx, [rsp + 0xd8]
call fcn.14000f650
nop
mov eax, dword [rsp + 0x40]
or eax, 4
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x28], 0x2f70
lea rax, [0x140194770]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x118]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0xa8]
call fcn.1400d9340
mov qword [rsp + 0xb0], rax
jmp 0x1400dbfd5
mov qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov qword [0x140214500], rax
mov eax, dword [rsp + 0x40]
and eax, 4
test eax, eax
je 0x1400dc012
and dword [rsp + 0x40], 0xfffffffb
lea rcx, [rsp + 0xd8]
call fcn.14000f540
nop
mov eax, dword [rsp + 0x40]
and eax, 2
test eax, eax
je 0x1400dc030
and dword [rsp + 0x40], 0xfffffffd
lea rcx, [rsp + 0xf8]
call fcn.14000f540
nop
mov eax, dword [rsp + 0x40]
and eax, 1
test eax, eax
je 0x1400dc04d
and dword [rsp + 0x40], 0xfffffffe
lea rcx, [rsp + 0x118]
call fcn.14000f540
mov rcx, qword [0x140214500]
call fcn.1400d9830
lea rax, [rsp + 0x510]
lea rcx, str.aow_exe.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x528]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e8
rep stosb byte [rdi], al
lea rax, [rsp + 0x310]
lea rcx, str.AndroidProcess.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x336]
mov rdi, rax
xor eax, eax
mov ecx, 0x1da
rep stosb byte [rdi], al
lea rcx, [rsp + 0x310]
call fcn.1400e4eb0
mov dword [0x140214468], eax
cmp dword [0x140214468], 0
jle 0x1400dc0de
mov byte [0x140213b14], 1
jmp 0x1400dc101
lea rcx, [rsp + 0x510]
call fcn.1400e4eb0
mov dword [0x140214468], eax
cmp dword [0x140214468], 0
jle 0x1400dc101
mov byte [0x140213a57], 1
cmp dword [0x140214468], 0
jne 0x1400dc13a
mov r9d, 1
lea r8, [0x140194280]
lea rdx, str.Cant_Find_Game_Process
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [0x1401942f8]
call fcn.140118a04
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, dword [0x140214468]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1402144e0], rax
cmp qword [0x1402144e0], 0
jne 0x1400dc195
lea rdx, str.Cant_find_game_process__press_any_key_to_exit_hack
lea rcx, [0x140212110]
call fcn.140063e10
lea rdx, [0x1400e02d0]
mov rcx, rax
call fcn.1400dd770
lea rcx, [0x140194338]
call fcn.140118a04
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx eax, byte [0x140213b14]
cmp eax, 1
jne 0x1400dc22c
xor edx, edx
lea rcx, [0x1400dd370]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x1402144e8]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400dc1d7
mov edx, 9
mov rcx, qword [0x1402144e8]
call qword [sym.imp.USER32.dll_ShowWindow]
lea r9, [0x140194308]
lea r8, [0x140194378]
xor edx, edx
mov rcx, qword [0x1402144e8]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x1402144e8], rax
lea rdx, [0x1401943a8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
lea r9, str.SmartGaGa_RenderWindow
lea r8, [0x1401943d8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x1402144e8], rax
jmp 0x1400dc28e
movzx eax, byte [0x140213a57]
cmp eax, 1
jne 0x1400dc28e
xor edx, edx
lea rcx, [0x1400dd370]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x1402144e8]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400dc26a
mov edx, 9
mov rcx, qword [0x1402144e8]
call qword [sym.imp.USER32.dll_ShowWindow]
lea r9, str.AEngineRenderWindow
lea r8, str.AEngineRenderWindowClass
xor edx, edx
mov rcx, qword [0x1402144e8]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x1402144e8], rax
cmp qword [0x1402144e8], 0
jne 0x1400dc2c8
mov r9d, 1
lea r8, [0x140194498]
lea rdx, str.Cant_Find_Game_Window
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.pause__nul
call fcn.140118a04
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x50], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0xa0], eax
lea rdx, [rsp + 0x158]
mov rcx, qword [0x1402144e8]
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [rsp + 0x158], 0
jl 0x1400dc327
cmp dword [rsp + 0x15c], 0
jl 0x1400dc327
cmp dword [rsp + 0x160], 0
jl 0x1400dc327
cmp dword [rsp + 0x164], 0
jge 0x1400dc3aa
lea rdx, [rsp + 0x168]
mov rcx, qword [0x1402144e8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x170]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x16c]
mov ecx, dword [rsp + 0x174]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x30], 3
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x16c]
mov r8d, dword [rsp + 0x168]
mov rdx, 0xffffffffffffffff
mov rcx, qword [0x140213b08]
call qword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x140213b14]
cmp eax, 1
jne 0x1400dc3fb
mov edx, 0x90000000
mov ecx, 0x70000000
call fcn.14000a780
mov dword [0x140213a50], eax
cmp dword [0x140213a50], 0
jne 0x1400dc3f2
mov edx, 0xa0000000
mov ecx, 0x90000000
call fcn.14000a780
mov dword [0x140213a50], eax
mov byte [0x140213af4], 1
jmp 0x1400dc3f9
mov byte [0x140213af6], 1
jmp 0x1400dc44a
movzx eax, byte [0x140213a57]
cmp eax, 1
jne 0x1400dc44a
mov edx, 0x7260c6cc
mov ecx, 0x3260c6cc
call fcn.14000a780
mov dword [0x140213a50], eax
cmp dword [0x140213a50], 0
jne 0x1400dc443
mov edx, 0x30000000
mov ecx, 0x26000000
call fcn.14000a780
mov dword [0x140213a50], eax
mov byte [0x140213af5], 1
jmp 0x1400dc44a
mov byte [0x140213af7], 1
cmp dword [0x140213a50], 0
jne 0x1400dc477
mov r9d, 1
lea r8, str.CODER___HACK__Created_:_CODER_
lea rdx, [0x140194528]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x1400d9bc0]
lea rcx, [0x140212110]
call fcn.1400dd770
lea rdx, [0x140194524]
mov rcx, rax
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194558]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194554]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194560]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.nnceitgnH_ca_keSvrre.._no_woLdani_gaHkc..
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194568]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194564]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194570]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019456c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194578]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194574]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194580]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019457c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194588]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194584]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194590]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019458c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194598]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194594]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945a0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14019459c]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945a8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945a4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945b0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945ac]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945b8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d9bc0]
lea rcx, [0x140212110]
call fcn.1400dd770
lea rdx, [0x1401945b4]
mov rcx, rax
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945c0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945bc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945c8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945c4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945d0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945cc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945d8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945d4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945e0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945dc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945e8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945e4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945f0]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945ec]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945f8]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945f4]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194600]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401945fc]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140194628]
lea rcx, [0x140212110]
call fcn.140063e10
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140214500]
call fcn.1400d9570
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rdx, str.C:WindowsFonts_segoeuib.ttf
lea rcx, [rsp + 0x198]
call fcn.14000f650
nop
lea rdx, str.C:WindowsFonts_arial.ttf
lea rcx, [rsp + 0x178]
call fcn.14000f650
nop
mov eax, dword [rsp + 0x15c]
mov ecx, dword [rsp + 0x164]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x158]
mov edx, dword [rsp + 0x160]
sub edx, ecx
mov ecx, edx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x15c]
mov ecx, dword [rsp + 0x158]
call fcn.14002ca80
mov r8d, dword [0x140213ae8]
mov edx, dword [0x140213aec]
mov rcx, qword [0x140213b08]
call fcn.14002a9d0
xor ecx, ecx
call fcn.140077720
call fcn.140077880
mov qword [rsp + 0x48], rax
call fcn.1400d9ef0
mov rax, qword [rsp + 0x48]
mov byte [rax + 0x394], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x1401dc060]
lea rdx, str.C:windowsFonts_segoeuib.ttf
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.1400a6060
call fcn.1400d9ef0
lea rcx, [rsp + 0x1f0]
call fcn.1400a55e0
lea rcx, [rsp + 0x280]
call fcn.1400a55e0
mov byte [rsp + 0x28c], 0
mov byte [rsp + 0x238], 1
mov byte [rsp + 0x210], 1
mov dword [rsp + 0x208], 2
mov dword [rsp + 0x20c], 2
mov rax, qword [rsp + 0x48]
mov qword [rax + 0x18], 0
lea rax, [rsp + 0x138]
mov qword [rsp + 0xc8], rax
lea rdx, str._C:CODERHxKey.ini
mov rcx, qword [rsp + 0xc8]
call fcn.14000f650
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xd0]
call fcn.140035420
lea rcx, [rsp + 0x198]
call fcn.14002ca60
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x1401dc068]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.1400a6060
lea rax, [0x1401dbd0c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x1401dc068]
mov r8d, 0x1e695
lea rdx, [0x1401976e0]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.1400a6430
mov rcx, qword [0x140213b08]
call fcn.1400b03b0
mov rdx, qword [0x140213a88]
mov rcx, qword [0x140213ac0]
call fcn.1400b0140
lea rcx, [rsp + 0x178]
call fcn.14002ca60
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x1401dc064]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.1400a6060
mov qword [0x140213aa0], rax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x1401dc058]
mov r8d, 0x225bc
lea rdx, [0x1401b5d80]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.1400a62c0
mov qword [0x140213aa8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140007c40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402144b8], rax
mov rcx, qword [0x1402144b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14000d440]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402144b0], rax
mov rcx, qword [0x1402144b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400365f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402144c8], rax
mov rcx, qword [0x1402144c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400e2dc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402144d8], rax
mov rcx, qword [0x1402144d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14002cfb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402144d0], rax
mov rcx, qword [0x1402144d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400e3630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402144c0], rax
mov rcx, qword [0x1402144c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x1400dd320
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x140213b08]
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400dce2d
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
movzx eax, byte [0x140213ddd]
test eax, eax
je 0x1400dce4c
mov edx, 0x11
mov rcx, qword [0x140213b08]
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
jmp 0x1400dce5b
xor edx, edx
mov rcx, qword [0x140213b08]
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
movzx eax, byte [0x1401ede5f]
test eax, eax
je 0x1400dce73
mov rcx, qword [0x140213b08]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dcf57
movzx eax, byte [0x1401ede01]
cmp eax, 1
jne 0x1400dcef6
mov rdx, qword [0x140213b08]
xor ecx, ecx
call fcn.1400e57e0
movzx eax, byte [0x1401ede01]
test eax, eax
jne 0x1400dceb9
mov dword [rsp + 0x54], 1
jmp 0x1400dcec1
mov dword [rsp + 0x54], 0
movzx eax, byte [rsp + 0x54]
mov byte [0x1401ede01], al
movzx eax, byte [0x1401ede5f]
test eax, eax
jne 0x1400dcee1
mov dword [rsp + 0x58], 1
jmp 0x1400dcee9
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [0x1401ede5f], al
jmp 0x1400dcf57
mov rdx, qword [0x140213b08]
mov ecx, 1
call fcn.1400e57e0
movzx eax, byte [0x1401ede01]
test eax, eax
jne 0x1400dcf1c
mov dword [rsp + 0x5c], 1
jmp 0x1400dcf24
mov dword [rsp + 0x5c], 0
movzx eax, byte [rsp + 0x5c]
mov byte [0x1401ede01], al
movzx eax, byte [0x1401ede5f]
test eax, eax
jne 0x1400dcf44
mov dword [rsp + 0x60], 1
jmp 0x1400dcf4c
mov dword [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov byte [0x1401ede5f], al
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dcf9d
movzx eax, byte [0x14021408f]
test eax, eax
je 0x1400dcf9d
movzx eax, byte [0x1401ee097]
test eax, eax
jne 0x1400dcf8a
mov dword [rsp + 0x64], 1
jmp 0x1400dcf92
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x64]
mov byte [0x1401ee097], al
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dcfe3
movzx eax, byte [0x14021408f]
test eax, eax
je 0x1400dcfe3
movzx eax, byte [0x1402141d4]
test eax, eax
jne 0x1400dcfd0
mov dword [rsp + 0x68], 1
jmp 0x1400dcfd8
mov dword [rsp + 0x68], 0
movzx eax, byte [rsp + 0x68]
mov byte [0x1402141d4], al
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dd046
movzx eax, byte [0x1402141d5]
test eax, eax
jne 0x1400dd00b
mov dword [rsp + 0x6c], 1
jmp 0x1400dd013
mov dword [rsp + 0x6c], 0
movzx eax, byte [rsp + 0x6c]
mov byte [0x1402141d5], al
movzx eax, byte [0x1401ee09a]
test eax, eax
jne 0x1400dd033
mov dword [rsp + 0x70], 1
jmp 0x1400dd03b
mov dword [rsp + 0x70], 0
movzx eax, byte [rsp + 0x70]
mov byte [0x1401ee09a], al
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dd137
movzx eax, byte [0x1401ee098]
test eax, eax
jne 0x1400dd072
mov dword [rsp + 0x74], 1
jmp 0x1400dd07a
mov dword [rsp + 0x74], 0
movzx eax, byte [rsp + 0x74]
mov byte [0x1401ee098], al
movzx eax, byte [0x1401ee3fe]
test eax, eax
jne 0x1400dd09a
mov dword [rsp + 0x78], 1
jmp 0x1400dd0a2
mov dword [rsp + 0x78], 0
movzx eax, byte [rsp + 0x78]
mov byte [0x1401ee3fe], al
movzx eax, byte [0x1401eea4c]
test eax, eax
jne 0x1400dd0c2
mov dword [rsp + 0x7c], 1
jmp 0x1400dd0ca
mov dword [rsp + 0x7c], 0
movzx eax, byte [rsp + 0x7c]
mov byte [0x1401eea4c], al
movzx eax, byte [0x1401ee099]
test eax, eax
jne 0x1400dd0ed
mov dword [rsp + 0x80], 1
jmp 0x1400dd0f8
mov dword [rsp + 0x80], 0
movzx eax, byte [rsp + 0x80]
mov byte [0x1401ee099], al
movzx eax, byte [0x14021421d]
test eax, eax
jne 0x1400dd11e
mov dword [rsp + 0x84], 1
jmp 0x1400dd129
mov dword [rsp + 0x84], 0
movzx eax, byte [rsp + 0x84]
mov byte [0x14021421d], al
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dd1b7
movzx eax, byte [0x14021408f]
test eax, eax
je 0x1400dd1b7
movzx eax, byte [0x140214145]
test eax, eax
jne 0x1400dd16d
mov dword [rsp + 0x88], 1
jmp 0x1400dd178
mov dword [rsp + 0x88], 0
movzx eax, byte [rsp + 0x88]
mov byte [0x140214145], al
movzx eax, byte [0x140213dde]
test eax, eax
jne 0x1400dd19e
mov dword [rsp + 0x8c], 1
jmp 0x1400dd1a9
mov dword [rsp + 0x8c], 0
movzx eax, byte [rsp + 0x8c]
mov byte [0x140213dde], al
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dd215
movzx eax, byte [0x14021408f]
test eax, eax
je 0x1400dd215
movzx eax, byte [0x140213ee6]
test eax, eax
jne 0x1400dd1fc
mov dword [rsp + 0x90], 1
jmp 0x1400dd207
mov dword [rsp + 0x90], 0
movzx eax, byte [rsp + 0x90]
mov byte [0x140213ee6], al
mov ecx, 0x54
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dd256
cmp dword [0x14020e9e8], 0
jne 0x1400dd23e
mov dword [rsp + 0x94], 1
jmp 0x1400dd249
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
mov dword [0x14020e9e8], eax
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dd2d6
movzx eax, byte [0x14021408f]
test eax, eax
je 0x1400dd2d6
movzx eax, byte [0x140214145]
test eax, eax
jne 0x1400dd28c
mov dword [rsp + 0x98], 1
jmp 0x1400dd297
mov dword [rsp + 0x98], 0
movzx eax, byte [rsp + 0x98]
mov byte [0x140214145], al
movzx eax, byte [0x140213dde]
test eax, eax
jne 0x1400dd2bd
mov dword [rsp + 0x9c], 1
jmp 0x1400dd2c8
mov dword [rsp + 0x9c], 0
movzx eax, byte [rsp + 0x9c]
mov byte [0x140213dde], al
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400dd31b
movzx eax, byte [0x1402141d4]
test eax, eax
je 0x1400dd2f9
call fcn.1400e17e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140214500]
call fcn.1400d9570
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1400dcdd4
mov dword [rsp + 0xa4], 0
lea rcx, [rsp + 0x178]
call fcn.14000f540
nop
lea rcx, [rsp + 0x198]
call fcn.14000f540
mov eax, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.1400fd630
add rsp, 0x728
pop rdi
pop rsi
ret