Function at 0x14000e850
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf8
lea rbp, [rsp + 0x60]
cmp word [rcx], 0
mov r14, r9
mov r15d, r8d
movzx r13d, dl
mov rdi, rcx
je 0x14000f975
mov r12, qword [0x1400ebaa8]
mov qword [rbp + 0x40], r12
test dl, dl
jne 0x14000e8bf
mov r8d, 7
lea rdx, str.Blind
call fcn.14009a7d8
test eax, eax
jne 0x14000e8bf
mov byte [0x1400f520c], 1
add rdi, 0xe
jmp 0x14000e8c6
mov byte [0x1400f520c], 0
mov eax, dword [r12 + 0x7c]
xor ecx, ecx
mov dword [rbp + 0x38], eax
mov eax, dword [r12 + 0x84]
mov dword [rbp + 0x3c], eax
lea eax, [r15 - 1]
test eax, 0xfffffffd
jne 0x14000e9c5
cmp qword [0x1400f5160], rcx
je 0x14000e97c
mov rcx, qword [0x1400f0e18]
test rcx, rcx
je 0x14000e909
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.AHK_Keybd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x1400f0e18], 0
mov esi, eax
je 0x14000e938
mov qword [0x1400f0e18], rbx
jmp 0x14000e941
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xb7
je 0x14000e97a
test r13b, r13b
jne 0x14000e96b
call fcn.140009e30
test al, al
je 0x14000e96b
lea rdx, str.Click
mov rcx, rdi
call fcn.140078ec0
test rax, rax
jne 0x14000e97a
mov r15d, 1
mov dword [rbp + 0xf0], r15d
jmp 0x14000e9c5
xor ecx, ecx
cmp r15d, 3
jne 0x14000e991
mov r15d, 2
mov dword [rbp + 0xf0], r15d
jmp 0x14000e9c5
cmp dword [r12 + 0x7c], 0
mov r15d, ecx
mov dword [rbp + 0xf0], ecx
jge 0x14000e9b2
cmp dword [r12 + 0x84], 0
jge 0x14000e9b2
or eax, 0xffffffff
jmp 0x14000e9b4
mov eax, ecx
mov dword [r12 + 0x84], eax
mov dword [r12 + 0x7c], 0xffffffff
xor ebx, ebx
mov byte [rbp + 8], 0
test r14, r14
je 0x14000ea23
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x1c], eax
mov esi, eax
test eax, eax
je 0x14000eb4b
cmp eax, dword [0x1400f4310]
je 0x14000eb4b
mov rcx, r14
call fcn.14007e4d0
test al, al
jne 0x14000eb4b
mov ecx, dword [0x1400f4310]
lea r8d, [rbx + 1]
mov edx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov ebx, esi
setne byte [rbp + 8]
jmp 0x14000eb4b
test byte [0x1400f4eee], 0xc0
je 0x14000eb1f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1400f4ee4]
cmp eax, 0x32
jae 0x14000eb1f
cmp r15d, 2
je 0x14000eb1f
cmp byte [0x1400f520c], bl
jne 0x14000eb1f
cmp byte [0x1400f5153], bl
je 0x14000eb1f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1400f4310]
jne 0x14000eb1f
lea rdx, [0x1400cfbe0]
mov rcx, rdi
call fcn.14000a680
test r13b, r13b
je 0x14000eae1
test rax, rax
setne al
test al, al
je 0x14000eb1f
mov esi, 0x8000
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x14000eac0
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14000eb1f
mov edx, 1
mov dword [0x1400ebaa0], ebx
mov ecx, 0x8000012f
call fcn.140001800
mov dword [0x1400ebaa0], 1
jmp 0x14000eaa0
test rax, rax
je 0x14000eb1f
nop word [rax + rax]
lea rcx, [rax + 2]
lea rdx, [0x1400cfbe8]
call fcn.14000a680
test rax, rax
je 0x14000ea9b
cmp word [rax], 0x7b
je 0x14000ea9b
lea rdx, [0x1400cfbe0]
mov rcx, rax
call fcn.14000a680
test rax, rax
jne 0x14000eaf0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14000eb42
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [rbp + 0xe0]
mov ebx, eax
mov dword [rbp + 0x1c], esi
jmp 0x14000eb4b
mov eax, dword [rbp + 0xe0]
mov dword [rbp + 0x1c], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
mov qword [0x1400f51f8], rax
xor edx, edx
call fcn.140012e10
mov cl, 1
mov dword [0x1400f51f4], eax
call fcn.140012870
cmp qword [0x1400eff20], 0
movzx ebx, al
je 0x14000eb9a
movzx eax, byte [0x1400f0cb3]
movzx edx, byte [0x1400f0cb1]
movzx ecx, al
and cl, dl
not al
and al, dl
mov byte [rbp + 6], al
jmp 0x14000ebc2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1400f4ee4]
cmp eax, dword [0x1400ed450]
jae 0x14000ebb9
movzx edx, byte [0x1400f4eee]
and dl, bl
jmp 0x14000ebbb
xor dl, dl
movzx ecx, dl
mov byte [rbp + 6], 0
movzx r13d, byte [0x1400f2d82]
not cl
and cl, bl
mov byte [rbp + 3], dl
and r13b, cl
cmp byte [0x1400f520c], 0
mov byte [rbp], r13b
mov byte [0x1400f2d82], r13b
je 0x14000ebfe
not r13b
mov byte [rbp], bl
and r13b, bl
mov byte [rbp + 2], bl
mov byte [rbp + 5], r13b
movzx r13d, bl
jmp 0x14000ec07
xor al, al
mov byte [rbp + 2], r13b
mov byte [rbp + 5], al
cmp byte [r12 + 0x12b], 0
je 0x14000ec2c
cmp byte [0x1400f520c], 0
jne 0x14000ec2c
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140011f50
mov dword [rbp + 0x2c], eax
jmp 0x14000ec33
mov dword [rbp + 0x2c], 0
mov dword [0x1400f2d8c], r15d
mov eax, 0x1f4
test r15d, r15d
je 0x14000ecd0
cmp r15d, 1
jne 0x14000ec5b
mov ecx, 0x4e20
mov dword [0x1400f5204], eax
jmp 0x14000ec6a
mov ecx, 0x2ee0
mov dword [0x1400f5204], 0x5dc
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14000ec7d
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400ad480
sub rsp, rax
mov byte [0x1400f51d6], bl
mov rax, qword [0x1400ed458]
xor ebx, ebx
mov byte [0x1400f51d7], 0
mov dword [0x1400f5200], ebx
lea rcx, [rsp + 0x60]
mov byte [0x1400f51ee], bl
mov qword [rax], rcx
mov dword [0x1400f5210], 0x80000000
mov dword [0x1400f5214], 0x80000000
mov byte [0x1400f51ef], 1
jmp 0x14000ecd2
xor ebx, ebx
movzx eax, byte [0x1400eff0f]
mov byte [rbp + 0x11], al
mov eax, dword [reloc.WSOCK32.dll_inet_ntoa]
add eax, 0xfffffff8
test eax, 0xfffffffd
jne 0x14000ed03
test r15d, r15d
jne 0x14000ed03
test r14, r14
jne 0x14000ed03
mov cl, 1
mov byte [rbp + 9], 1
call fcn.14002ee50
jmp 0x14000ed07
mov byte [rbp + 9], 0
xor sil, sil
mov word [rbp + 0x2a], bx
cmp word [rdi], 0
mov byte [rbp + 1], sil
je 0x14000f77a
lea r15, [0x140000000]
mov r12d, 0x7d
jmp 0x14000ed32
xor ebx, ebx
cmp dword [0x1400f2d8c], 0
mov byte [rbp + 0xe0], 0
jne 0x14000eda0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1400ebaa8]
sub eax, dword [0x1400f4f3c]
cmp eax, dword [rcx + 0x110]
jbe 0x14000eda0
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp + 0x60]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14000ed94
mov edx, 1
mov dword [0x1400ebaa0], ebx
or ecx, 0xffffffff
call fcn.140001800
mov dword [0x1400ebaa0], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1400f4f3c], eax
cmp byte [rbp + 0xe8], 0
jne 0x14000f6a9
movzx edx, word [rdi]
lea rcx, [0x1400cfbf0]
call fcn.1400963a8
test rax, rax
je 0x14000f6a9
movzx eax, word [rdi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x14000edea.38
cdqe
movzx eax, byte [r15 + rax + 0xf9a8]
mov ecx, dword [r15 + rax*4 + 0xf98c]
add rcx, r15
jmp rcx
test r13b, 3
jne case.0x14000edea.38
movzx r15d, byte [rbp + 0xe0]
or sil, 1
jmp 0x14000f749
test r13b, 0x30
jne case.0x14000edea.38
movzx r15d, byte [rbp + 0xe0]
or sil, 0x10
jmp 0x14000f749
test r13b, 0xc
jne case.0x14000edea.38
movzx r15d, byte [rbp + 0xe0]
or sil, 4
jmp 0x14000f749
test r13b, 0xc0
jne case.0x14000edea.38
movzx r15d, byte [rbp + 0xe0]
or sil, 0x40
jmp 0x14000f749
lea rbx, [rdi + 2]
mov edx, r12d
mov rcx, rbx
call fcn.1400963a8
mov qword [rbp + 0x30], rax
mov r12, rax
test rax, rax
je case.0x14000edea.38
mov rdi, rbx
nop word [rax + rax]
movzx ecx, word [rdi]
cmp cx, 0x20
je 0x14000ee8f
cmp cx, 9
jne 0x14000ee95
add rdi, 2
jmp 0x14000ee80
mov r15, rax
sub r15, rdi
sar r15, 1
jne 0x14000ef45
lea rbx, [rax + 2]
movzx eax, word [rax + 2]
cmp ax, 0x7d
jne 0x14000eec4
mov r12, rbx
mov qword [rbp + 0x30], rbx
mov r15d, 1
jmp 0x14000ef45
cmp ax, 0x20
je 0x14000eed4
cmp ax, 9
jne 0x14000f688
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14000eee3
cmp ax, 9
jne 0x14000eee9
add rbx, 2
jmp 0x14000eed4
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call fcn.14009a7d8
test eax, eax
je 0x14000ef1f
mov r8d, 2
lea rdx, [0x1400be1b8]
mov rcx, rbx
call fcn.14009a7d8
test eax, eax
jne 0x14000f688
mov edx, 0x7d
mov rcx, rbx
call fcn.1400963a8
mov qword [rbp + 0x30], rax
mov r12, rax
test rax, rax
je case.0x14000edea.38
mov r15, rax
sub r15, rdi
sar r15, 1
mov r8d, 5
lea rdx, [0x1400bc4c0]
mov rcx, rdi
call fcn.14009a7d8
test eax, eax
jne 0x14000f04d
mov word [r12], ax
lea rcx, [rdi + 0xa]
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14000ef7f
cmp ax, 9
jne 0x14000ef85
add rcx, 2
jmp 0x14000ef70
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 4]
lea rax, [rbp + 0x14]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x20]
lea rax, [rbp + 0xc]
lea rdx, [rbp + 0x24]
mov qword [rsp + 0x20], rax
call fcn.1400107e0
mov ecx, dword [rbp + 0x14]
mov eax, 0x7d
mov word [r12], ax
cmp ecx, 1
jge 0x14000effc
mov rax, qword [rbp + 0x40]
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x24]
movzx r9d, byte [rax + 0x127]
movzx eax, byte [rbp + 7]
mov byte [rsp + 0x20], al
call fcn.1400114f0
movzx r15d, byte [rbp + 0xe0]
xor sil, sil
mov rdi, qword [rbp + 0x30]
jmp 0x14000f749
movzx eax, byte [rbp + 7]
xor edx, edx
mov byte [rsp + 0x50], al
movzx r9d, r13b
mov eax, dword [rbp + 0x20]
movzx r8d, sil
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x24]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0xc]
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
movzx ecx, byte [rbp + 4]
call fcn.14000fa10
movzx r15d, byte [rbp + 0xe0]
xor sil, sil
mov rdi, qword [rbp + 0x30]
jmp 0x14000f749
mov r8d, 3
lea rdx, [0x1400cfc00]
mov rcx, rdi
call fcn.14009a7d8
test eax, eax
jne 0x14000f081
movzx r15d, byte [rbp + 0xe0]
xor sil, sil
mov rdi, qword [rbp + 0x30]
mov byte [rbp + 0xe8], 1
jmp 0x14000f749
xor r14d, r14d
mov dword [rbp + 0xc], 2
lea rdx, [0x1400cf8a0]
mov word [r12], r14w
mov rcx, rdi
mov dword [rbp + 0x14], 1
mov r13, r15
call fcn.14000a680
mov r12, rax
test rax, rax
je 0x14000f153
movzx eax, word [rax]
lea rbx, [r12 + 2]
mov r13, r12
mov word [rbp + 0x18], ax
sub r13, rdi
mov word [r12], r14w
sar r13, 1
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14000f0df
cmp ax, 9
jne 0x14000f0e5
add rbx, 2
jmp 0x14000f0d0
mov rax, qword [rbp + 0x30]
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14000f153
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call fcn.14009a7d8
test eax, eax
jne 0x14000f12c
lea rcx, [rbx + 8]
mov dword [rbp + 0xc], r14d
lea r8d, [rax + 4]
lea rdx, str.Temp
call fcn.14009a7d8
test eax, eax
setne byte [rbp + 0x10]
jmp 0x14000f153
lea rdx, [0x1400be1b8]
mov rcx, rbx
call fcn.1400981f0
test eax, eax
jne 0x14000f148
mov dword [rbp + 0xc], 1
jmp 0x14000f153
mov rcx, rbx
call fcn.14000e3e0
mov dword [rbp + 0x14], eax
mov rcx, qword [0x1400f51f8]
lea rdx, [rbp + 1]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, rdi
mov r8b, 1
call fcn.140013310
mov byte [rbp + 4], al
movzx esi, al
test al, al
jne 0x14000f1f6
mov rcx, rdi
call fcn.140013220
movzx r14d, ax
test ax, ax
jne 0x14000f1f6
movzx ecx, word [rdi]
call fcn.14000a650
cmp ax, 0x56
jne 0x14000f1f6
movzx ecx, word [rdi + 2]
call fcn.14000a650
cmp ax, 0x4b
jne 0x14000f1f6
lea rdx, [0x1400cfc14]
lea rcx, [rdi + 4]
call fcn.14000a680
mov rbx, rax
test rax, rax
je 0x14000f1e2
movzx ecx, word [rax + 2]
call fcn.14000a650
cmp ax, 0x43
jne 0x14000f1e2
xor edx, edx
lea rcx, [rbx + 4]
lea r8d, [rdx + 0x10]
call fcn.14009c230
mov r14d, eax
xor edx, edx
lea rcx, [rdi + 4]
lea r8d, [rdx + 0x10]
call fcn.14009c230
mov esi, eax
mov byte [rbp + 4], al
test r12, r12
je 0x14000f204
movzx eax, word [rbp + 0x18]
mov word [r12], ax
mov rax, qword [rbp + 0x30]
mov ecx, 0x7d
mov r12d, dword [rbp + 0x14]
mov word [rax], cx
cmp r12d, 1
jl 0x14000f67c
test sil, sil
jne 0x14000f578
test r14w, r14w
jne 0x14000f578
mov r14, qword [rbp + 0xf8]
cmp r13, 1
jne 0x14000f29f
mov r15d, dword [rbp + 0xc]
cmp r15d, r13d
je 0x14000f683
test r14, r14
je 0x14000f27b
movzx r8d, word [rdi]
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
movzx r13d, byte [rbp]
movzx r15d, byte [rbp + 0xe0]
mov rdi, qword [rbp + 0x30]
jmp 0x14000f749
movzx ecx, word [rdi]
mov edx, r12d
call fcn.14000fc70
movzx r13d, byte [rbp]
xor sil, sil
movzx r15d, byte [rbp + 0xe0]
mov rdi, qword [rbp + 0x30]
jmp 0x14000f749
test r14, r14
lea r9, [rbp + 2]
lea r8, [rbp + 0xc]
mov rdx, r15
sete al
mov rcx, rdi
mov byte [rsp + 0x20], al
call fcn.1400134d0
mov byte [rbp + 4], al
movzx esi, al
test al, al
je 0x14000f3f5
mov edi, dword [rbp + 0xc]
test r14, r14
jne 0x14000f2eb
test edi, edi
jne 0x14000f2e2
movzx r15d, al
mov byte [rbp + 0xe0], al
jmp 0x14000f2f3
movzx ecx, sil
call fcn.14000e660
movzx r15d, byte [rbp + 0xe0]
cmp dword [0x1400f2d8c], 0
je 0x14000f305
movzx eax, byte [0x1400f51d6]
jmp 0x14000f30c
xor ecx, ecx
call fcn.140012870
movzx r13d, byte [rbp + 2]
xor r9d, r9d
movzx ecx, r13b
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r14
mov byte [rsp + 0x20], 0
movzx edx, al
mov byte [rbp], r13b
call fcn.1400120a0
test r12d, r12d
jle 0x14000f690
mov rbx, r12
xor r15d, r15d
nop dword [rax]
nop word [rax + rax]
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
mov r9, r14
mov byte [rsp + 0x20], 1
movzx edx, sil
mov ecx, edi
call fcn.1400100c0
cmp dword [0x1400f2d8c], r15d
jne 0x14000f3d7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1400ebaa8]
sub eax, dword [0x1400f4f3c]
cmp eax, dword [rcx + 0x110]
jbe 0x14000f3d7
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, [rbp + 0x60]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14000f3cb
mov edx, 1
mov dword [0x1400ebaa0], r15d
or ecx, 0xffffffff
call fcn.140001800
mov dword [0x1400ebaa0], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1400f4f3c], eax
sub rbx, 1
jne 0x14000f350
movzx r15d, byte [rbp + 0xe0]
xor sil, sil
mov rdi, qword [rbp + 0x30]
jmp 0x14000f749
cmp r15, 4
jbe 0x14000f49c
mov r8d, 4
lea rdx, str.ASC
mov rcx, rdi
call fcn.14009a7d8
test eax, eax
jne 0x14000f49c
test r14, r14
jne 0x14000f49c
lea rcx, [rdi + 6]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14000f434
cmp ax, 9
jne 0x14000f43a
add rcx, 2
jmp 0x14000f425
call fcn.14000fd90
cmp dword [0x1400f2d8c], 2
mov rax, qword [0x1400ebaa8]
jne 0x14000f477
mov ecx, dword [rax + 0x80]
call fcn.140011d00
movzx r13d, byte [rbp + 2]
xor sil, sil
movzx r15d, byte [rbp + 0xe0]
mov rdi, qword [rbp + 0x30]
mov byte [rbp], r13b
jmp 0x14000f749
mov ecx, dword [rax + 0x7c]
call fcn.140011d00
movzx r13d, byte [rbp + 2]
xor sil, sil
movzx r15d, byte [rbp + 0xe0]
mov rdi, qword [rbp + 0x30]
mov byte [rbp], r13b
jmp 0x14000f749
cmp r15, 2
jbe 0x14000f47f
mov r8d, 2
lea rdx, [0x1400cfc2c]
mov rcx, rdi
call fcn.14009a7d8
test eax, eax
jne 0x14000f47f
lea rcx, [rdi + 4]
xor edx, edx
lea r8d, [rax + 0x10]
call fcn.14009c230
movzx r13d, byte [rbp + 2]
mov byte [rbp], r13b
mov ecx, eax
test r14, r14
je 0x14000f4f1
movzx r8d, cx
xor r9d, r9d
mov rcx, r14
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14000f52d
cmp dword [0x1400f2d8c], 2
je 0x14000f50b
movzx edx, byte [rbp + 1]
movzx eax, r13b
or edx, eax
call fcn.14000e6e0
jmp 0x14000f52d
mov eax, gethostbyname
movzx ecx, cx
lea rdx, [rbp + 0x52]
mov word [rbp + 0x50], ax
lea r8d, [rax - 0x26]
call fcn.1400980e8
lea rcx, [rbp + 0x50]
call fcn.14000fd90
cmp dword [0x1400f2d8c], 2
mov rax, qword [0x1400ebaa8]
jne 0x14000f55c
mov ecx, dword [rax + 0x80]
call fcn.140011d00
movzx r15d, byte [rbp + 0xe0]
xor sil, sil
mov rdi, qword [rbp + 0x30]
jmp 0x14000f749
mov ecx, dword [rax + 0x7c]
call fcn.140011d00
movzx r15d, byte [rbp + 0xe0]
xor sil, sil
mov rdi, qword [rbp + 0x30]
jmp 0x14000f749
xor r8d, r8d
movzx edx, r14w
movzx ecx, sil
call fcn.140012a80
mov rdi, qword [rbp + 0xf8]
movzx ebx, al
mov r15d, dword [rbp + 0xc]
test al, al
je 0x14000f61e
test rdi, rdi
jne 0x14000f61e
test r15d, r15d
jne 0x14000f5cd
mov byte [rbp + 0xe0], sil
cmp byte [rbp + 0x10], r15b
je 0x14000f5bb
or byte [0x1400f2d82], al
movzx r13d, byte [rbp]
or r13b, bl
mov byte [rbp], r13b
mov byte [rbp + 2], r13b
jmp 0x14000f623
cmp r15d, 1
jne 0x14000f61e
movzx ecx, sil
call fcn.14000e660
movzx r13d, byte [0x1400f2d82]
movzx eax, bl
movzx ecx, byte [rbp + 5]
not al
and r13b, al
and cl, al
mov byte [0x1400f2d82], r13b
mov byte [rbp + 5], cl
cmp sil, 0xa5
jne 0x14000f611
cmp dword [0x1400f51f4], 3
jne 0x14000f611
and cl, 0xfe
mov byte [rbp + 5], cl
or r13b, cl
mov byte [rbp], r13b
mov byte [rbp + 2], r13b
jmp 0x14000f623
movzx r13d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx r9d, r13b
mov byte [rsp + 0x50], 0
movzx edx, r14w
mov dword [rsp + 0x48], 0x80000000
movzx ecx, sil
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
call fcn.14000fa10
mov r14, qword [rbp + 0xf8]
xor sil, sil
movzx r15d, byte [rbp + 0xe0]
mov rdi, qword [rbp + 0x30]
jmp 0x14000f749
mov r14, qword [rbp + 0xf8]
movzx r13d, byte [rbp]
movzx r15d, byte [rbp + 0xe0]
mov rdi, qword [rbp + 0x30]
xor sil, sil
jmp 0x14000f749
movzx r15d, byte [rbp + 0xe0]
jmp 0x14000f74d
movzx eax, word [rdi]
lea rdx, [rbp + 1]
mov word [rbp + 0x28], ax
lea rcx, [rbp + 0x28]
mov rax, qword [0x1400f51f8]
mov r9b, 1
movzx r8d, r9b
mov qword [rsp + 0x20], rax
call fcn.140013310
mov byte [rbp + 4], al
test al, al
je 0x14000f719
movzx r8d, byte [rbp + 1]
xor edx, edx
mov byte [rsp + 0x50], dl
movzx r9d, r13b
mov dword [rsp + 0x48], 0x80000000
movzx ecx, al
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
call fcn.14000fa10
jmp 0x14000f742
test r14, r14
je 0x14000f735
movzx r8d, word [rdi]
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14000f742
movzx ecx, word [rdi]
mov edx, 1
call fcn.14000fc70
xor sil, sil
movzx r15d, sil
mov byte [rbp + 1], sil
add rdi, 2
mov byte [0x1400f2d83], r15b
lea r15, [0x140000000]
mov r12d, 0x7d
cmp word [rdi], 0
jne 0x14000ed30
mov r15d, dword [rbp + 0xf0]
mov r12, qword [rbp + 0x40]
cmp dword [0x1400f2d8c], 0
je 0x14000f835
or ebx, 0xffffffff
cmp byte [0x1400f51ee], 0
mov dword [rbp + 0xe0], ebx
jne 0x14000f7f9
cmp dword [0x1400f5200], 0
jbe 0x14000f7f9
cmp byte [0x1400f520c], 0
je 0x14000f7b1
xor eax, eax
mov ecx, eax
jmp 0x14000f7bd
movzx ecx, byte [rbp + 6]
movzx edx, byte [rbp + 3]
not ecx
and ecx, edx
movzx edx, byte [0x1400f51d6]
or r13b, cl
movzx ecx, r13b
mov dword [rsp + 0x28], 0xffc3d44d
mov r9b, 1
mov byte [rsp + 0x20], 1
xor r8d, r8d
call fcn.1400120a0
movzx edx, r13b
lea rcx, [rbp + 0xe0]
call fcn.140011b90
mov ebx, dword [rbp + 0xe0]
cmp dword [0x1400f2d8c], 1
mov eax, 0x5dc
mov ecx, 0x1f4
cmove eax, ecx
cmp dword [0x1400f5204], eax
jbe 0x14000f821
mov rcx, qword [0x1400f2d90]
call fcn.14009c290
xor edi, edi
mov ecx, ebx
mov dword [0x1400f2d8c], edi
call fcn.140011d00
jmp 0x14000f8c8
cmp qword [0x1400eff20], 0
je 0x14000f84c
movzx ecx, byte [0x1400f0cb1]
movzx edx, byte [rbp + 3]
jmp 0x14000f878
cmp dword [0x1400ed450], 0
jl 0x14000f871
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1400f4ee4]
cmp eax, dword [0x1400ed450]
jb 0x14000f871
movzx edx, byte [rbp + 3]
xor cl, cl
jmp 0x14000f878
movzx edx, byte [rbp + 3]
movzx ecx, dl
cmp byte [0x1400f520c], 0
je 0x14000f896
movzx eax, cl
xor al, dl
movzx ebx, al
and al, cl
and bl, dl
not bl
and bl, r13b
or bl, al
jmp 0x14000f8a1
movzx ebx, byte [rbp + 6]
not bl
and bl, cl
or bl, r13b
xor ecx, ecx
call fcn.140012870
movzx edx, al
mov dword [rsp + 0x28], 0xffc3d44d
mov r9b, 1
mov byte [rsp + 0x20], 1
mov r8, r14
movzx ecx, bl
call fcn.1400120a0
xor edi, edi
cmp qword [0x1400eff20], 0
je 0x14000f8ee
movzx ecx, byte [0x1400f0cb2]
movzx eax, cl
xor al, byte [0x1400f0cb3]
and al, cl
not al
and cl, al
mov byte [0x1400f0cb2], cl
cmp dword [rbp + 0x2c], 1
jne 0x14000f900
mov edx, 1
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140011f50
cmp byte [rbp + 8], 0
je 0x14000f918
mov edx, dword [rbp + 0x1c]
xor r8d, r8d
mov ecx, dword [0x1400f4310]
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rbp + 9], 0
je 0x14000f92b
cmp byte [rbp + 0x11], 0
jne 0x14000f92b
xor ecx, ecx
call fcn.14002ee50
cmp r15d, 1
jne 0x14000f962
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1400f4310]
jne 0x14000f962
mov edx, r15d
mov dword [0x1400ebaa0], edi
or ecx, 0xffffffff
call fcn.140001800
mov dword [0x1400ebaa0], r15d
mov eax, dword [rbp + 0x38]
mov dword [r12 + 0x7c], eax
mov eax, dword [rbp + 0x3c]
mov dword [r12 + 0x84], eax
lea rsp, [rbp + 0x98]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret