Function at 0x14001e3e0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x108
lea rbp, [rsp + 0x60]
cmp word [rcx], 0
mov r12, r9
mov esi, r8d
mov r14d, edx
mov r15, rcx
je 0x14001fcf7
mov r13, qword [0x140124200]
mov eax, dword [0x14012bbc0]
mov edi, dword gs:[0x48]
mov qword [rbp + 0x50], r13
mov dword [rbp + 0x40], eax
mov dword [rbp + 0x14], edi
test edx, edx
jne 0x14001e461
lea r8d, [rdx + 7]
lea rdx, str.Blind
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001e461
mov byte [0x14012bf30], 1
add r15, 0xe
jmp 0x14001e46d
mov byte [0x14012bf30], 0
test r14d, r14d
jne 0x14001e498
mov r8d, 6
lea rdx, [0x140106950]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001e498
mov r14d, 2
add r15, 0xc
mov dword [rbp + 0xf8], r14d
mov eax, dword [r13 + 0x7c]
mov dword [rbp + 0x44], eax
mov eax, dword [r13 + 0x84]
mov dword [rbp + 0x48], eax
lea eax, [rsi - 1]
test eax, 0xfffffffd
jne 0x14001e57f
mov rcx, qword [0x14012be20]
test rcx, rcx
je 0x14001e4c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.AHK_Keybd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x14012be20], 0
mov edi, eax
je 0x14001e4f8
mov qword [0x14012be20], rbx
jmp 0x14001e506
test rbx, rbx
je 0x14001e506
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xb7
je 0x14001e53d
test r14d, r14d
jne 0x14001e530
call fcn.140016900
test al, al
je 0x14001e530
lea rdx, str.Click
mov rcx, r15
call fcn.1400ce7b0
test rax, rax
jne 0x14001e53d
mov esi, 1
mov dword [rbp + 0x100], esi
jmp 0x14001e57c
cmp esi, 3
jne 0x14001e54f
mov esi, 2
mov dword [rbp + 0x100], esi
jmp 0x14001e57c
xor eax, eax
mov esi, eax
mov dword [rbp + 0x100], eax
cmp dword [r13 + 0x7c], eax
jge 0x14001e56d
cmp dword [r13 + 0x84], eax
jge 0x14001e56d
mov eax, 0xffffffff
mov dword [r13 + 0x84], eax
mov dword [r13 + 0x7c], 0xffffffff
mov edi, dword [rbp + 0x14]
xor r13d, r13d
mov byte [rbp + 0xd], 0
mov ebx, r13d
test r12, r12
je 0x14001e5e1
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x28], eax
mov esi, eax
test eax, eax
je 0x14001e6a5
cmp eax, dword [0x14012af90]
je 0x14001e6a5
mov rcx, r12
call fcn.1400d5bd0
test al, al
jne 0x14001e6a5
mov ecx, dword [0x14012af90]
lea r8d, [r13 + 1]
mov edx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov ebx, esi
setne byte [rbp + 0xd]
jmp 0x14001e6a5
test byte [0x14012bb6e], 0xc0
je 0x14001e68c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14012bb64]
cmp eax, 0x32
jae 0x14001e68c
cmp esi, 2
je 0x14001e68c
cmp byte [0x14012bf30], bl
jne 0x14001e68c
cmp r14d, 2
je 0x14001e68c
cmp byte [0x14012bde3], bl
je 0x14001e68c
cmp edi, dword [0x14012af90]
jne 0x14001e68c
test r14d, r14d
je 0x14001e744
mov r8, r15
test r15, r15
je 0x14001e680
movzx edx, word [r15]
test dx, dx
je 0x14001e680
mov r9d, 0x4c
nop word [rax + rax]
lea rcx, [0x140106e58]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x14001e683
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e660
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14001e650
mov r8, r13
test r8, r8
jne 0x14001e7d0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
call fcn.140023830
mov ebx, eax
mov eax, dword [rbp + 0xf0]
mov dword [rbp + 0x28], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r9, [0x14012be70]
mov qword [0x14012be68], rax
mov rdx, r9
mov ecx, r13d
mov rdi, rax
mov r8, qword [rdx]
test r8, r8
je 0x14001e6e0
cmp r8, rdi
je 0x14001e81a
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x14001e6c4
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, rdi
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.1400238a0
mov dword [rbx + 8], eax
mov qword [rbx], rdi
mov cl, 1
mov dword [0x14012bf10], eax
call fcn.1400232c0
and byte [0x14012be67], al
movzx ebx, al
cmp qword [0x140127a90], r13
je 0x14001e82a
movzx eax, byte [0x1401289d2]
movzx ecx, byte [0x1401289d0]
movzx r13d, al
and r13b, cl
not al
and al, cl
jmp 0x14001e851
mov r9d, 0x4c
mov rdx, r15
lea r10d, [r9 + 0x2f]
test rdx, rdx
je 0x14001e68c
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001e68c
lea rcx, [0x140106e58]
movzx eax, r9w
cmp r8w, ax
je 0x14001e78c
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e773
add rdx, 2
jmp 0x14001e75a
add rdx, 2
je 0x14001e7d0
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001e7d0
lea rcx, [0x140106e60]
movzx eax, r10w
cmp r8w, ax
je 0x14001e7c0
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e7a7
add rdx, 2
jmp 0x14001e792
cmp word [rdx], r10w
jne 0x14001e751
nop word [rax + rax]
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x14001e7f8
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14001e68c
mov edx, 1
mov dword [0x1401241f4], r13d
mov ecx, 0x8000012f
call fcn.140001a20
mov dword [0x1401241f4], 1
jmp 0x14001e7d0
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x14001e703
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14012bb64]
cmp eax, dword [0x140125c44]
jae 0x14001e849
movzx ecx, byte [0x14012bb6e]
and cl, bl
jmp 0x14001e84b
xor cl, cl
movzx r13d, cl
xor al, al
not r13b
mov byte [rbp + 4], cl
and r13b, byte [0x14012be66]
and r13b, bl
mov byte [rbp + 0xc], al
cmp byte [0x14012bf30], 0
mov byte [rbp], r13b
mov byte [0x14012be66], r13b
je 0x14001e88e
not r13b
mov byte [rbp], bl
and r13b, bl
mov byte [rbp + 2], bl
mov byte [rbp + 5], r13b
movzx r13d, bl
jmp 0x14001e897
xor al, al
mov byte [rbp + 2], r13b
mov byte [rbp + 5], al
mov rax, qword [rbp + 0x50]
cmp byte [rax + 0x133], 0
je 0x14001e8c4
cmp byte [0x14012bf30], 0
jne 0x14001e8c4
cmp r14d, 2
je 0x14001e8c4
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.1400228e0
mov dword [rbp + 0x24], eax
jmp 0x14001e8cb
xor r8d, r8d
mov dword [rbp + 0x24], r8d
mov ecx, dword [rbp + 0x100]
mov eax, 0x1f4
mov dword [0x14012bf24], ecx
mov edi, 0x5dc
test ecx, ecx
je 0x14001e971
cmp ecx, 1
mov edx, 0x2ee0
cmovne eax, edi
mov dword [0x14012bf18], eax
mov eax, 0x4e20
cmovne eax, edx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001e915
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ecec0
mov rax, qword [0x140126a20]
sub rsp, rcx
mov byte [0x14012bf20], bl
xor ebx, ebx
mov byte [0x14012bf21], 0
mov dword [0x14012bf14], ebx
lea rcx, [rsp + 0x60]
mov byte [0x14012bf22], bl
mov qword [rax], rcx
mov ecx, dword [rbp + 0x100]
mov dword [0x14012bf28], 0x80000000
mov dword [0x14012bf2c], 0x80000000
mov byte [0x14012bf23], 1
jmp 0x14001e973
xor ebx, ebx
mov eax, dword [reloc.WSOCK32.dll_inet_ntoa]
movzx r14d, byte [0x140127b42]
add eax, 0xfffffff8
mov byte [rbp + 0xf], r14b
test eax, 0xfffffffd
jne 0x14001e9b0
test ecx, ecx
jne 0x14001e9b0
test r12, r12
jne 0x14001e9b0
lea ecx, [r12 + 1]
mov byte [rbp + 0xe], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140127b42], 1
jmp 0x14001e9b4
mov byte [rbp + 0xe], 0
xor sil, sil
cmp word [r15], 0
mov byte [rbp + 3], sil
mov byte [rbp + 1], sil
je 0x14001fa55
lea rdi, [0x140000000]
jmp 0x14001e9e2
xor ebx, ebx
cmp dword [0x14012bf24], 0
mov byte [rbp + 0xf0], 0
jne 0x14001ea50
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [0x14012bbc4]
cmp eax, dword [rcx + 0x118]
jbe 0x14001ea50
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp + 0x70]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001ea44
mov edx, 1
mov dword [0x1401241f4], ebx
lea ecx, [rdx - 2]
call fcn.140001a20
mov dword [0x1401241f4], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012bbc4], eax
mov r14d, dword [rbp + 0xf8]
test r14d, r14d
jne 0x14001f93d
movzx edx, word [r15]
lea rcx, [0x140106e68]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x14001f979
movzx eax, word [r15]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x14001ea9e.38
cdqe
movzx eax, byte [rdi + rax + 0x1fd28]
mov ecx, dword [rdi + rax*4 + 0x1fd0c]
add rcx, rdi
jmp rcx
test r13b, 3
jne case.0x14001ea9e.38
movzx r12d, byte [rbp + 0xf0]
or sil, 1
jmp 0x14001fa1f
test r13b, 0x30
jne case.0x14001ea9e.38
movzx r12d, byte [rbp + 0xf0]
or sil, 0x10
jmp 0x14001fa1f
test r13b, 0xc
jne case.0x14001ea9e.38
movzx r12d, byte [rbp + 0xf0]
or sil, 4
jmp 0x14001fa1f
test r13b, 0xc0
jne case.0x14001ea9e.38
movzx r12d, byte [rbp + 0xf0]
or sil, 0x40
jmp 0x14001fa1f
mov r14d, 0x7d
lea rcx, [r15 + 2]
mov edx, r14d
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov qword [rbp + 0x30], rax
mov rdi, rax
test rax, rax
je case.0x14001ea9e.38
movzx ecx, word [r15 + 2]
add r15, 2
cmp cx, 0x20
je 0x14001eb2f
cmp cx, 9
je 0x14001eb2f
mov r12, rax
sub r12, r15
sar r12, 1
jne 0x14001ebf6
lea rbx, [rax + 2]
movzx eax, word [rax + 2]
cmp ax, r14w
jne 0x14001eb73
mov rdi, rbx
mov qword [rbp + 0x30], rbx
mov r12d, 1
jmp 0x14001ebf6
cmp ax, 0x20
je 0x14001eb8f
cmp ax, 9
jne 0x14001ee3e
cmp ax, 0x20
je 0x14001eb8f
cmp ax, 9
jne 0x14001eb99
movzx eax, word [rbx + 2]
add rbx, 2
jmp 0x14001eb83
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14001ebd1
mov r8d, 2
lea rdx, [0x140105858]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001ee3e
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov qword [rbp + 0x30], rax
mov rdi, rax
test rax, rax
je case.0x14001ea9e.38
mov r12, rax
sub r12, r15
sar r12, 1
mov r8d, 5
lea rdx, [0x140103ae0]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001eea5
xor r8d, r8d
lea rbx, [r15 + 0xa]
mov word [rdi], r8w
nop
movzx edi, word [rbx]
cmp di, 0x20
je 0x14001ec2f
cmp di, 9
jne 0x14001ec35
add rbx, 2
jmp 0x14001ec20
mov r14d, 0x80000000
mov ecx, 1
xor r13b, r13b
mov dword [rbp + 0x10], r14d
mov dword [rbp + 0x1c], r14d
mov al, 0x9a
mov byte [rbp + 1], al
mov r15d, r14d
mov dword [rbp + 8], ecx
lea r12d, [rcx + 1]
test di, di
je 0x14001ee04
jmp 0x14001ec68
xor r8d, r8d
cmp di, 0x2c
jne 0x14001ec93
nop
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x20
je 0x14001ec70
cmp ax, 9
je 0x14001ec70
test ax, ax
je 0x14001edd5
cmp ax, 0x2c
je 0x14001ec70
mov rsi, rbx
test rbx, rbx
je 0x14001ecdf
movzx edx, word [rbx]
test dx, dx
je 0x14001ecdf
nop dword [rax]
nop word [rax + rax]
lea rcx, [0x140106ea8]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14001ed00
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001ecc0
movzx edx, word [rsi + 2]
add rsi, 2
test dx, dx
jne 0x14001ecb0
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14001ecf0
lea rsi, [rbx + rax*2]
movzx edi, word [rsi]
mov r9d, 1
mov word [rsi], r8w
mov edx, r9d
mov dword [rsp + 0x20], r8d
mov rcx, rbx
xor r8d, r8d
call fcn.1400ce0c0
mov rcx, rbx
test eax, eax
je 0x14001ed4f
call fcn.14001de50
cmp r14d, 0x80000000
jne 0x14001ed3a
mov r14d, eax
jmp 0x14001edab
cmp r15d, 0x80000000
jne 0x14001ed48
mov r15d, eax
jmp 0x14001edab
mov ecx, eax
mov dword [rbp + 8], eax
jmp 0x14001edae
mov r8b, 1
movzx edx, r8b
call fcn.14001dee0
test al, al
je 0x14001ed64
mov byte [rbp + 1], al
jmp 0x14001edab
movzx ebx, word [rbx]
test ebx, 0xffffff80
je 0x14001ed75
xor edx, edx
mov eax, edx
jmp 0x14001ed84
mov edx, 2
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
xor edx, edx
mov ecx, ebx
and ecx, 0xffffffdf
test eax, eax
cmove ecx, ebx
cmp ecx, 0x44
je 0x14001eda8
cmp ecx, 0x52
je 0x14001eda3
cmp ecx, 0x55
jne 0x14001edab
lea r12d, [rcx - 0x54]
jmp 0x14001edab
mov r13b, 1
jmp 0x14001edab
mov r12d, edx
mov ecx, dword [rbp + 8]
mov word [rsi], di
mov rbx, rsi
cmp di, 0x20
je 0x14001edc0
cmp di, 9
jne 0x14001edca
movzx edi, word [rbx + 2]
add rbx, 2
jmp 0x14001edb4
test di, di
jne 0x14001ec65
jmp 0x14001edd8
mov ecx, dword [rbp + 8]
movzx eax, byte [rbp + 1]
movzx esi, byte [rbp + 3]
mov dword [rbp + 0x10], r14d
mov dword [rbp + 0x1c], r15d
cmp r14d, 0x80000000
je 0x14001ee04
cmp r15d, 0x80000000
jne 0x14001ee04
mov ecx, r14d
mov dword [rbp + 0x10], r15d
mov r14d, r15d
mov rdx, qword [rbp + 0x30]
mov r8d, 0x7d
mov word [rdx], r8w
cmp ecx, 1
jge 0x14001ee52
mov rax, qword [rbp + 0x50]
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x1c]
mov byte [rsp + 0x20], r13b
lea rcx, [rbp + 0x10]
movzx r9d, byte [rax + 0x12f]
call fcn.140021b50
movzx r13d, byte [rbp]
movzx r12d, byte [rbp + 0xf0]
mov r15, qword [rbp + 0x30]
xor sil, sil
jmp 0x14001fa1f
mov byte [rsp + 0x50], r13b
xor edx, edx
movzx r13d, byte [rbp]
movzx r8d, sil
mov dword [rsp + 0x48], r15d
movzx r9d, r13b
mov r15, qword [rbp + 0x108]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ecx
movzx ecx, al
call fcn.14001fd90
movzx r12d, byte [rbp + 0xf0]
xor sil, sil
mov r15, qword [rbp + 0x30]
jmp 0x14001fa1f
mov r8d, 3
lea rdx, [0x140106e78]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001eee0
movzx r12d, byte [rbp + 0xf0]
mov r14d, 1
mov r15, qword [rbp + 0x30]
xor sil, sil
mov dword [rbp + 0xf8], r14d
jmp 0x14001fa1f
mov r8d, 4
lea rdx, str.Text
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001ef3f
lea rcx, [r15 + 8]
nop
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001ef0f
cmp ax, 9
jne 0x14001ef15
add rcx, 2
jmp 0x14001ef00
cmp rcx, rdi
jne 0x14001ee3e
movzx r12d, byte [rbp + 0xf0]
mov r14d, 2
mov r15, qword [rbp + 0x30]
xor sil, sil
mov dword [rbp + 0xf8], r14d
jmp 0x14001fa1f
xor esi, esi
mov dword [rbp + 8], 2
mov word [rdi], si
mov r13, r12
movzx edx, word [r15]
mov r14, r15
mov dword [rbp + 0x10], 1
test dx, dx
je 0x14001ef94
lea rcx, [0x140106720]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14001f11f
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001ef70
movzx edx, word [r14 + 2]
add r14, 2
test dx, dx
jne 0x14001ef61
mov r14, rsi
mov rax, qword [0x14012be68]
lea rdx, [rbp + 1]
mov r8b, 1
mov qword [rsp + 0x20], rax
mov rcx, r15
call fcn.140024050
movzx edi, al
test al, al
jne 0x14001f03d
xor edx, edx
mov rcx, r15
call fcn.140023f30
movzx esi, ax
test ax, ax
jne 0x14001f03d
mov r8d, 2
lea rdx, [0x14010677c]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001f03d
lea rcx, [r15 + 4]
lea r8d, [rax + 0x10]
lea rdx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov rcx, qword [rbp + 0x38]
lea rdx, [0x140106fe8]
mov r8d, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001f03d
mov rcx, qword [rbp + 0x38]
lea r8d, [rax + 0x10]
add rcx, 4
lea rdx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov rcx, qword [rbp + 0x38]
cmp word [rcx], si
jne 0x14001f03d
movzx edi, bl
movzx esi, ax
test r14, r14
je 0x14001f04a
movzx eax, word [rbp + 0x18]
mov word [r14], ax
mov rax, qword [rbp + 0x30]
mov r8d, 0x7d
mov ebx, dword [rbp + 0x10]
mov word [rax], r8w
cmp ebx, 1
jl 0x14001ee39
test dil, dil
jne 0x14001f78c
test si, si
jne 0x14001f78c
movzx ecx, byte [r15]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
je 0x14001f2ba
cmp r13, 1
jbe 0x14001f2be
cmp dword [0x14012bf24], 0
je 0x14001f22f
mov rcx, r15
call fcn.14001de50
mov ecx, dword [0x14012bf18]
cmp dword [0x14012bf14], ecx
mov ebx, eax
jne 0x14001f0c4
call fcn.140022200
test eax, eax
je 0x14001ee39
cmp dword [0x14012bf24], 1
jne 0x14001f1f5
mov rax, qword [0x140128aa8]
mov ecx, dword [0x14012bf14]
or byte [0x14012bf21], 1
inc dword [0x14012bf14]
movzx r13d, byte [rbp]
movzx r12d, byte [rbp + 0xf0]
lea rdx, [rcx + rcx*4]
mov r15, qword [rbp + 0x30]
lea rcx, [rax + rdx*8]
xor edx, edx
mov dword [rcx], 1
mov qword [rcx + 8], rdx
xor sil, sil
mov dword [rcx + 0x10], edx
mov qword [rcx + 0x18], rbx
jmp 0x14001fa1f
movzx eax, word [r14]
lea rbx, [r14 + 2]
mov r13, r14
mov word [rbp + 0x18], ax
sub r13, r15
mov word [r14], si
sar r13, 1
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14001f14f
cmp ax, 9
jne 0x14001f155
add rbx, 2
jmp 0x14001f140
mov rax, rdi
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14001ef97
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001f1c5
lea r8d, [rax + 4]
mov dword [rbp + 8], esi
lea rdx, str.Temp
lea rcx, [rbx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001f1a4
mov dword [rbp + 0x20], esi
jmp 0x14001ef97
cmp word [rbx + 8], 0x52
mov ecx, esi
sete cl
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
test eax, eax
mov ebx, esi
setne bl
inc ebx
mov dword [rbp + 0x20], ebx
jmp 0x14001ef97
lea rdx, [0x140105858]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14001f1e5
mov dword [rbp + 8], 1
jmp 0x14001ef97
mov rcx, rbx
call fcn.14001de50
mov dword [rbp + 0x10], eax
jmp 0x14001ef97
mov edx, dword [0x14012bf14]
xor r8d, r8d
mov rax, qword [0x140126a20]
inc dword [0x14012bf14]
movzx r13d, byte [rbp]
xor sil, sil
movzx r12d, byte [rbp + 0xf0]
mov rcx, qword [rax]
mov r15, qword [rbp + 0x30]
mov dword [rcx + rdx*8], r8d
mov dword [rcx + rdx*8 + 4], ebx
jmp 0x14001fa1f
mov eax, dword [rbp + 0x14]
xor r8d, r8d
cmp dword [0x14012af90], eax
mov dword [0x1401241f4], r8d
je 0x14001f283
mov rcx, r15
call fcn.14001de50
test eax, eax
js 0x14001f283
mov rcx, r15
call fcn.14001de50
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r13d, byte [rbp]
xor sil, sil
movzx r12d, byte [rbp + 0xf0]
mov r15, qword [rbp + 0x30]
mov dword [0x1401241f4], 1
jmp 0x14001fa1f
mov rcx, r15
call fcn.14001de50
mov ecx, eax
mov edx, 1
call fcn.140001a20
movzx r13d, byte [rbp]
xor sil, sil
movzx r12d, byte [rbp + 0xf0]
mov r15, qword [rbp + 0x30]
mov dword [0x1401241f4], 1
jmp 0x14001fa1f
cmp r13, 1
jne 0x14001f340
cmp dword [rbp + 8], 1
je 0x14001ee39
mov r14, qword [rbp + 0x108]
test r14, r14
je 0x14001f314
nop word [rax + rax]
movzx r8d, word [r15]
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
sub rbx, 1
jne 0x14001f2e0
movzx r13d, byte [rbp]
xor sil, sil
movzx r12d, byte [rbp + 0xf0]
mov r15, qword [rbp + 0x30]
jmp 0x14001fa1f
movzx r8d, byte [rbp + 1]
mov edx, ebx
movzx r13d, byte [rbp]
movzx ecx, word [r15]
or r8b, r13b
call fcn.14001fff0
movzx r12d, byte [rbp + 0xf0]
xor sil, sil
mov r15, qword [rbp + 0x30]
jmp 0x14001fa1f
mov r14, qword [rbp + 0x108]
lea r9, [rbp + 2]
test r14, r14
lea r8, [rbp + 8]
mov rdx, r12
mov rcx, r15
sete al
mov byte [rsp + 0x20], al
call fcn.1400243d0
movzx edi, al
test al, al
je 0x14001f4f5
mov esi, dword [rbp + 8]
test r14, r14
jne 0x14001f405
test esi, esi
jne 0x14001f387
mov byte [rbp + 0xf0], al
jmp 0x14001f405
cmp dword [0x14012be60], 0
jne 0x14001f405
cmp byte [0x14012be65], dil
je 0x14001f405
cmp byte [0x14012bf30], 0
jne 0x14001f405
movzx ecx, byte [0x14012be64]
lea eax, [rdi - 0x5b]
cmp al, 1
ja 0x14001f3c0
lea eax, [rcx - 0x5b]
cmp al, 1
ja 0x14001f3c0
cmp dword [0x14012bf24], 2
jne 0x14001f3dd
cmp dil, 0xa4
je 0x14001f3d5
cmp dil, 0xa5
jne 0x14001f405
cmp dword [0x14012bf10], 3
je 0x14001f405
add cl, 0x5c
cmp cl, 1
ja 0x14001f405
movzx r8d, word [0x140125c48]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.140020500
cmp dword [0x14012bf24], 0
je 0x14001f417
movzx edx, byte [0x14012bf20]
jmp 0x14001f421
xor ecx, ecx
call fcn.1400232c0
movzx edx, al
movzx r13d, byte [rbp + 2]
xor r9d, r9d
movzx ecx, r13b
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r14
mov byte [rbp], r13b
mov byte [rsp + 0x20], 0
call fcn.140022a30
xor r12d, r12d
nop dword [rax]
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
mov r9, r14
mov byte [rsp + 0x20], 1
movzx edx, dil
mov ecx, esi
call fcn.140020500
cmp dword [0x14012bf24], r12d
jne 0x14001f4d7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [0x14012bbc4]
cmp eax, dword [rcx + 0x118]
jbe 0x14001f4d7
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, [rbp + 0x70]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001f4cb
mov edx, 1
mov dword [0x1401241f4], r12d
lea ecx, [rdx - 2]
call fcn.140001a20
mov dword [0x1401241f4], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012bbc4], eax
sub rbx, 1
jne 0x14001f450
movzx r12d, byte [rbp + 0xf0]
xor sil, sil
mov r15, qword [rbp + 0x30]
jmp 0x14001fa1f
cmp r12, 4
jbe 0x14001f5a7
mov r8d, 4
lea rdx, str.ASC
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001f5ad
test r14, r14
jne 0x14001f5ad
lea rcx, [r15 + 6]
nop word [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001f53f
cmp ax, 9
jne 0x14001f545
add rcx, 2
jmp 0x14001f530
call fcn.1400201d0
cmp dword [0x14012bf24], 2
mov rax, qword [0x140124200]
jne 0x14001f582
mov ecx, dword [rax + 0x80]
call fcn.140022540
movzx r13d, byte [rbp + 2]
xor sil, sil
movzx r12d, byte [rbp + 0xf0]
mov r15, qword [rbp + 0x30]
mov byte [rbp], r13b
jmp 0x14001fa1f
mov ecx, dword [rax + 0x7c]
call fcn.140022540
movzx r13d, byte [rbp + 2]
xor sil, sil
movzx r12d, byte [rbp + 0xf0]
mov r15, qword [rbp + 0x30]
mov byte [rbp], r13b
jmp 0x14001fa1f
cmp r12, 2
jbe 0x14001f58a
mov r8d, 2
lea rdx, [0x140106e9c]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001f58a
lea rcx, [r15 + 4]
xor edx, edx
lea r8d, [rax + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
cmp eax, 0x10000
jb 0x14001f60a
add eax, 0xffff0000
mov edx, 0x3ff
mov ecx, eax
movzx ebx, ax
shr ecx, 0xa
and bx, dx
and cx, dx
mov r8d, 0x2800
sub cx, r8w
mov edx, 0x2400
sub bx, dx
jmp 0x14001f613
xor r8d, r8d
movzx ecx, ax
mov ebx, r8d
movzx r13d, byte [rbp + 2]
mov byte [rbp], r13b
test r14, r14
je 0x14001f659
movzx r8d, cx
xor r9d, r9d
mov rcx, r14
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
test bx, bx
je 0x14001f741
movzx r8d, bx
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001f741
cmp dword [0x14012bf24], 2
je 0x14001f68c
movzx edi, byte [rbp + 1]
or dil, r13b
movzx edx, dil
call fcn.14001e140
test bx, bx
je 0x14001f741
movzx edx, dil
movzx ecx, bx
call fcn.14001e140
jmp 0x14001f741
mov ecx, gethostbyname
lea rdx, [rbp + 0x62]
mov word [rbp + 0x60], cx
lea r8d, [rcx - 0x26]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
cmp dword [0x14012bf24], 0
je 0x14001f6b7
movzx eax, byte [0x14012bf20]
jmp 0x14001f6be
xor ecx, ecx
call fcn.1400232c0
movzx ecx, al
mov dword [rsp + 0x28], 0xffc3d44f
and cl, 0xc4
mov byte [rsp + 0x20], 1
or cl, 4
xor r9d, r9d
xor r8d, r8d
movzx edx, al
call fcn.140022a30
movzx eax, word [rbp + 0x60]
lea rbx, [rbp + 0x60]
cmp ax, 0x30
jb 0x14001f723
cmp ax, 0x39
ja 0x14001f723
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
lea edx, [rax + 0x30]
mov byte [rsp + 0x20], r8b
xor r9d, r9d
lea ecx, [r8 + 2]
call fcn.140020500
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x30
jae 0x14001f6f0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 1]
call fcn.140020500
cmp dword [0x14012bf24], 2
mov rax, qword [0x140124200]
jne 0x14001f770
mov ecx, dword [rax + 0x80]
call fcn.140022540
movzx r12d, byte [rbp + 0xf0]
xor sil, sil
mov r15, qword [rbp + 0x30]
jmp 0x14001fa1f
mov ecx, dword [rax + 0x7c]
call fcn.140022540
movzx r12d, byte [rbp + 0xf0]
xor sil, sil
mov r15, qword [rbp + 0x30]
jmp 0x14001fa1f
xor r8d, r8d
movzx edx, si
movzx ecx, dil
call fcn.140023520
mov r15, qword [rbp + 0x108]
movzx ebx, al
mov r14d, dword [rbp + 8]
test al, al
je 0x14001f8d8
test r15, r15
jne 0x14001f8d8
test r14d, r14d
jne 0x14001f806
mov eax, dword [rbp + 0x20]
movzx r12d, dil
cmp eax, 1
jne 0x14001f7e6
movzx r13d, byte [rbp]
or byte [0x14012be66], bl
or r13b, bl
mov byte [rbp], r13b
mov byte [rbp + 2], r13b
jmp 0x14001f8e5
cmp eax, 2
jne 0x14001f7f1
or byte [0x14012be67], bl
movzx r13d, byte [rbp]
or r13b, bl
mov byte [rbp], r13b
mov byte [rbp + 2], r13b
jmp 0x14001f8e5
cmp r14d, 1
jne 0x14001f8d8
cmp dword [0x14012be60], 0
jne 0x14001f890
cmp byte [0x14012be65], dil
je 0x14001f890
cmp byte [0x14012bf30], 0
jne 0x14001f890
movzx ecx, byte [0x14012be64]
lea eax, [rdi - 0x5b]
cmp al, r14b
ja 0x14001f84b
lea eax, [rcx - 0x5b]
cmp al, r14b
ja 0x14001f84b
cmp dword [0x14012bf24], 2
jne 0x14001f868
cmp dil, 0xa4
je 0x14001f860
cmp dil, 0xa5
jne 0x14001f890
cmp dword [0x14012bf10], 3
je 0x14001f890
add cl, 0x5c
cmp cl, 1
ja 0x14001f890
movzx r8d, word [0x140125c48]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.140020500
movzx ecx, byte [rbp + 5]
movzx eax, bl
not al
and byte [0x14012be67], al
and cl, al
movzx r13d, al
mov byte [rbp + 5], cl
and r13b, byte [0x14012be66]
mov byte [0x14012be66], r13b
cmp dil, 0xa5
jne 0x14001f8cb
cmp dword [0x14012bf10], 3
jne 0x14001f8cb
and cl, 0xfe
mov byte [rbp + 5], cl
or r13b, cl
mov byte [rbp], r13b
mov byte [rbp + 2], r13b
jmp 0x14001f8dd
movzx r13d, byte [rbp]
movzx r12d, byte [rbp + 0xf0]
mov eax, dword [rbp + 0x10]
movzx r9d, r13b
movzx r8d, byte [rbp + 1]
movzx edx, si
mov byte [rsp + 0x50], 0
movzx ecx, dil
mov dword [rsp + 0x48], 0x80000000
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call fcn.14001fd90
mov r15, qword [rbp + 0x30]
xor sil, sil
jmp 0x14001fa1f
movzx r12d, byte [rbp + 0xf0]
jmp 0x14001fa27
cmp r14d, 2
jne 0x14001f979
movzx ecx, word [r15]
sub ecx, 8
je 0x14001f975
sub ecx, 1
je 0x14001f971
sub ecx, 1
je 0x14001f96d
cmp ecx, 3
jne 0x14001f9e8
cmp word [r15 + 2], 0xa
lea rax, [r15 + 2]
cmove r15, rax
mov al, 0xd
jmp 0x14001f9a7
mov al, 9
jmp 0x14001f9a7
mov al, 8
jmp 0x14001f9a7
or sil, r13b
je 0x14001f988
test r14d, r14d
jne 0x14001f988
mov r9b, 1
jmp 0x14001f98b
xor r9d, r9d
mov r8, qword [0x14012be68]
lea rdx, [rbp + 1]
movzx ecx, word [r15]
call fcn.1400241b0
movzx esi, byte [rbp + 1]
test al, al
je 0x14001f9e8
xor edx, edx
movzx r9d, r13b
mov byte [rsp + 0x50], dl
movzx r8d, sil
mov dword [rsp + 0x48], 0x80000000
movzx ecx, al
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
call fcn.14001fd90
jmp 0x14001fa18
movzx ecx, word [r15]
test r12, r12
je 0x14001fa07
mov r8d, ecx
xor r9d, r9d
mov rcx, r12
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001fa18
or sil, r13b
mov edx, 1
movzx r8d, sil
call fcn.14001fff0
xor sil, sil
movzx r12d, sil
mov byte [rbp + 1], sil
mov byte [rbp + 3], sil
add r15, 2
mov byte [0x14012be65], r12b
mov r12, qword [rbp + 0x108]
lea rdi, [0x140000000]
cmp word [r15], 0
jne 0x14001e9e0
movzx r14d, byte [rbp + 0xf]
mov edi, 0x5dc
cmp dword [0x14012bf24], 0
je 0x14001fb0d
cmp byte [0x14012bf22], 0
mov ebx, 0xffffffff
mov dword [rbp + 0xf0], ebx
jne 0x14001fad5
cmp dword [0x14012bf14], 0
jbe 0x14001fad5
cmp byte [0x14012bf30], 0
je 0x14001fa8c
xor bl, bl
jmp 0x14001fa95
movzx ebx, byte [rbp + 0xc]
not bl
and bl, byte [rbp + 4]
or bl, byte [0x14012be67]
mov r9b, 1
movzx edx, byte [0x14012bf20]
or bl, r13b
movzx ecx, bl
mov dword [rsp + 0x28], 0xffc3d44d
xor r8d, r8d
mov byte [rsp + 0x20], 1
call fcn.140022a30
movzx edx, bl
lea rcx, [rbp + 0xf0]
call fcn.1400222e0
mov ebx, dword [rbp + 0xf0]
cmp dword [0x14012bf24], 1
mov eax, 0x1f4
cmove edi, eax
cmp dword [0x14012bf18], edi
jbe 0x14001faf9
mov rcx, qword [0x140128aa8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edi, edi
mov ecx, ebx
mov dword [0x14012bf24], edi
call fcn.140022540
jmp 0x14001fbac
cmp qword [0x140127a90], 0
je 0x14001fb24
movzx ecx, byte [0x1401289d0]
movzx edx, byte [rbp + 4]
jmp 0x14001fb50
cmp dword [0x140125c44], 0
jl 0x14001fb49
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14012bb64]
cmp eax, dword [0x140125c44]
jb 0x14001fb49
movzx edx, byte [rbp + 4]
xor cl, cl
jmp 0x14001fb50
movzx edx, byte [rbp + 4]
movzx ecx, dl
or cl, byte [0x14012be67]
cmp byte [0x14012bf30], 0
je 0x14001fb74
movzx eax, cl
xor al, dl
movzx ebx, al
and al, cl
and bl, dl
not bl
and bl, r13b
or bl, al
jmp 0x14001fb7f
movzx ebx, byte [rbp + 0xc]
not bl
and bl, cl
or bl, r13b
xor ecx, ecx
call fcn.1400232c0
or al, byte [0x140127b7b]
mov r9b, 1
movzx edx, al
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r12
mov byte [rsp + 0x20], 1
movzx ecx, bl
call fcn.140022a30
xor edi, edi
cmp qword [0x140127a90], 0
je 0x14001fbd2
movzx ecx, byte [0x1401289d1]
movzx eax, cl
xor al, byte [0x1401289d2]
and al, cl
not al
and cl, al
mov byte [0x1401289d1], cl
cmp dword [rbp + 0x24], 1
jne 0x14001fbe4
mov edx, 1
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.1400228e0
cmp byte [rbp + 0xd], 0
je 0x14001fbfc
mov edx, dword [rbp + 0x28]
xor r8d, r8d
mov ecx, dword [0x14012af90]
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rbp + 0xe], 0
je 0x14001fc16
test r14b, r14b
jne 0x14001fc16
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140127b42], r14b
mov eax, dword [rbp + 0x100]
test eax, eax
jne 0x14001fca9
mov eax, dword [rbp + 0x40]
cmp dword [0x14012bbc0], eax
je 0x14001fce4
cmp dword [0x1401241f4], 0
je 0x14001fce4
cmp dword [0x1401278bc], 0
jne 0x14001fce4
mov rcx, qword [0x140124200]
cmp byte [rcx + 0x12c], 0
jne 0x14001fc9a
cmp byte [rcx + 0x12e], 0
jne 0x14001fc91
cmp dword [rcx + 0x120], 0xffffffff
jle 0x14001fc91
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x14001fc91
mov byte [rcx + 0x12c], 1
cmp byte [rcx + 0x12c], 0
je 0x14001fce4
mov edx, 1
lea ecx, [rdx - 2]
call fcn.140001a20
jmp 0x14001fce4
cmp eax, 1
jne 0x14001fce4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x14012af90]
jne 0x14001fce4
mov edx, 1
mov dword [0x1401241f4], edi
lea ecx, [rdx - 2]
call fcn.140001a20
mov dword [0x1401241f4], 1
mov rax, qword [rbp + 0x50]
mov ecx, dword [rbp + 0x44]
mov dword [rax + 0x7c], ecx
mov ecx, dword [rbp + 0x48]
mov dword [rax + 0x84], ecx
lea rsp, [rbp + 0xa8]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret