Function at 0x140001b10
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x23b8]
mov eax, 0x24b8
call fcn.1400f3640
sub rsp, rax
movaps xmmword [rsp + 0x24a0], xmm6
mov ebx, edx
mov byte [rsp + 0x4c], 0
mov r12d, ecx
mov esi, 1
cmp edx, 2
jne 0x140001b70
cmp byte [0x14014258f], 0
mov ebx, esi
mov dword [rbp + 0x2408], ebx
jne 0x140001b70
mov byte [0x14014258f], bl
mov byte [rsp + 0x4c], bl
xor edi, edi
cmp dword [0x140146984], edi
je 0x140001baa
cmp qword [0x140146968], rdi
je 0x140001b97
mov rcx, qword [0x140146958]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140146968], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140146984], edi
mov qword [0x140146958], rdi
cmp r12d, 0x8000012f
jne 0x140001bcc
mov r12d, 0xa
mov byte [rbp + 0x2418], sil
mov dword [rbp + 0x2400], r12d
mov dword [rbp - 0x54], edi
jmp 0x140001be9
cmp r12d, 5
setle al
mov byte [rbp + 0x2418], al
jg 0x140001be0
mov dword [rbp - 0x54], edi
jmp 0x140001be9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x54], eax
cmp dword [0x140143794], edi
je 0x140001bf6
call fcn.1400049e0
xor r15b, r15b
cmp dword [0x14014685c], edi
mov dword [rbp - 0x58], r15d
je 0x140001c18
call fcn.140004730
test al, al
movzx r15d, r15b
cmovne r15d, esi
mov dword [rbp - 0x58], r15d
test r12d, r12d
jle 0x140001c59
cmp ebx, esi
jne 0x140001c59
inc dword [0x140142778]
cmp byte [0x14014258e], dil
mov byte [rsp + 0x4d], sil
jne 0x140001c5e
mov rcx, qword [0x140142770]
xor r9d, r9d
lea edx, [r9 + 9]
lea r8d, [r9 + 0xa]
call qword [sym.imp.USER32.dll_SetTimer]
test rax, rax
setne byte [0x14014258e]
jmp 0x140001c5e
mov byte [rsp + 0x4d], dil
mov r9d, dword [rbp + 0x2400]
mov r13d, edi
mov r15d, dword [rbp + 0x2400]
xor bl, bl
mov byte [rbp + 0x2410], bl
xorps xmm6, xmm6
mov r14, qword [rbp + 0x2410]
mov rcx, qword [rbp + 0x2410]
movsxd rax, r12d
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x38], rax
mov eax, dword [rbp + 0x2400]
mov dword [rbp - 0x10], eax
movzx eax, byte [rbp + 0x2400]
mov byte [rsp + 0x44], al
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x2410]
mov byte [rsp + 0x68], dil
mov rdi, qword [rbp + 0x2410]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x2410]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], r14
movzx r14d, byte [rbp + 0x2418]
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x6c], r9d
mov dword [rsp + 0x58], r15d
mov qword [rbp], rcx
movsxd rdi, r12d
jmp 0x140001d8c
mov r12d, dword [rbp + 0x2400]
mov rdi, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x40]
jmp 0x140001d90
mov r12d, dword [rbp + 0x2400]
mov rdi, qword [rsp + 0x50]
jmp 0x140001d90
mov r12d, dword [rbp + 0x2400]
mov r13d, dword [rsp + 0x40]
jmp 0x140001d90
mov r12d, dword [rbp + 0x2400]
movzx ebx, byte [rbp + 0x2410]
jmp 0x140001d90
movzx ebx, byte [rbp + 0x2410]
jmp 0x140001d80
movzx ebx, byte [rbp + 0x2410]
jmp 0x140001d7b
movzx r14d, byte [rbp + 0x2418]
mov rdi, qword [rsp + 0x50]
mov r12d, dword [rbp + 0x2400]
mov r13d, dword [rsp + 0x40]
xor r15d, r15d
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test rdi, rdi
jle 0x140001ded
test bl, bl
jne 0x140001ded
cmp byte [0x14014258f], bl
jne 0x140001dfa
call fcn.140005270
test eax, eax
lea rcx, [rsp + 0x78]
mov r9d, 0x311
cmovne r9d, r15d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x140001d90
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
jbe 0x1400020e5
mov dword [0x1401468d0], eax
jmp 0x1400020e5
cmp byte [0x14014258f], 0
je 0x140001faf
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140001faf
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140145ca0]
jne 0x140001faf
cmp dword [0x14014276c], 0
je 0x140001e77
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rcx, r15
lea rdx, [rbp + 0x1a0]
lea r8, str.32770
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140001e77
cmp rcx, 7
jne 0x140001e60
jmp 0x140001ece
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x140001faf
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysTreeView32
lea rcx, [rbp + 0x1a0]
call fcn.1400da910
test eax, eax
je 0x140001ece
lea rdx, str.SysListView32
lea rcx, [rbp + 0x1a0]
call fcn.1400da910
test eax, eax
jne 0x140001faf
call fcn.140005270
test eax, eax
mov dword [rsp + 0x20], r15d
mov eax, 0xffffffff
lea rcx, [rsp + 0x78]
mov ebx, 0x311
mov r9d, 0x1ff
cmovne ebx, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edx, edx
lea rcx, [rsp + 0x78]
mov r9d, ebx
mov r8d, 0x20e
test eax, eax
jne 0x140001f29
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, 1
jmp 0x140002036
mov edi, dword [rbp - 0x68]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edx, edx
lea rcx, [rsp + 0x78]
test eax, eax
jne 0x140001f62
mov ebx, 1
mov r9d, 0x1ff
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
movsxd rdi, r12d
jmp 0x140002036
mov eax, dword [rbp - 0x68]
sub eax, edi
test eax, eax
jle 0x140001f8b
mov ebx, 1
mov r9d, 0x1ff
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
movsxd rdi, r12d
jmp 0x140002036
mov r9d, ebx
mov dword [rsp + 0x20], 1
mov r8d, 0x20e
call qword [sym.imp.USER32.dll_PeekMessageW]
movsxd rdi, r12d
mov ebx, 1
jmp 0x140002036
cmp dword [0x14013dbe4], 0
je 0x14000200e
cmp dword [0x1401425cc], 0
jne 0x14000200e
mov rcx, qword [0x14013dbf0]
cmp byte [rcx + 0x12c], 0
jne 0x140002005
cmp byte [rcx + 0x12e], 0
jne 0x140002005
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140002005
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14013dbf0]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140002005
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140002011
mov eax, r15d
test eax, eax
lea rcx, [rsp + 0x78]
mov r9d, 0x311
mov ebx, 1
cmovne r9d, r15d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400020de
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x1401468d0]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
cmova edx, eax
mov dword [0x1401468d0], edx
test rdi, rdi
jne 0x14000207f
cmp byte [rsp + 0x68], dil
jne 0x14000207f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x68], 1
movzx ebx, byte [rbp + 0x2410]
jmp 0x140001d90
test r13d, r13d
jne 0x1400020a7
test r14b, r14b
je 0x1400020a7
test rdi, rdi
jle 0x140002098
lea ecx, [r13 + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r13d, ebx
movzx ebx, byte [rbp + 0x2410]
jmp 0x140001d90
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x140004574
mov ecx, dword [rbp - 0x54]
sub ecx, eax
add ecx, r12d
cmp ecx, 5
jle 0x140004574
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ebx, byte [rbp + 0x2410]
jmp 0x140001d90
movzx ebx, byte [rbp + 0x2410]
inc r13d
cmp dword [0x140145cc0], 0
mov dword [rsp + 0x40], r13d
je 0x140002129
mov r9, qword [rbp - 0x70]
lea rax, [rbp + 0x190]
mov r8, qword [rbp - 0x78]
mov edx, dword [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call fcn.140004af0
test al, al
jne 0x140001d90
mov r9d, dword [0x140142768]
mov r11, qword [rsp + 0x78]
mov r13d, dword [rbp - 0x80]
test r9d, r9d
je 0x140002802
test r11, r11
je 0x140002802
cmp r11, qword [0x140142770]
je 0x140002802
cmp r13d, 0x414
je 0x140002802
cmp r13d, 0x402
je 0x140002802
lea eax, [r13 - 0x100]
cmp eax, 9
ja 0x1400025e3
call qword [sym.imp.USER32.dll_GetFocus]
mov rsi, rax
test rax, rax
je 0x1400025d3
mov rcx, rax
call fcn.1400c0be0
mov rbx, rax
test rax, rax
je 0x1400025d3
mov rcx, rsi
call fcn.140090e80
mov qword [rsp + 0x70], rax
mov r15, rax
test rax, rax
je 0x1400025d0
mov rdx, qword [rax + 0xb8]
test rdx, rdx
je 0x1400021ef
lea r8, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
test eax, eax
jne 0x140001d8c
mov r13d, dword [rbp - 0x80]
mov rbx, qword [rbp - 0x78]
cmp r13d, 0x100
jne 0x140002540
cmp byte [r15 + 0x108], 0
je 0x140002258
cmp rbx, 0x27
ja 0x140002258
movabs rax, 0xa600000200
bt rax, rbx
jae 0x140002258
mov rdx, rsi
mov rcx, r15
call fcn.1400019c0
mov ecx, 0x2af8
cmp eax, ecx
jne 0x1400022c5
xor r8d, r8d
mov qword [rbp - 0x38], r8
mov rbx, qword [rbp - 0x78]
mov r13d, dword [rbp - 0x80]
cmp r13d, 0x100
jne 0x140002540
cmp rbx, 0x1b
je 0x140002299
cmp rbx, 9
je 0x140002299
cmp rbx, 0x41
jne 0x140002540
lea ecx, [rbx - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0x8000
test bx, ax
je 0x140002538
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
jne 0x140002538
mov rdx, rsi
mov rcx, r15
call fcn.1400019c0
mov ecx, 0x2af8
cmp eax, ecx
jne 0x140002447
mov rbx, qword [rbp - 0x78]
xor r15d, r15d
mov r13d, dword [rbp - 0x80]
mov qword [rbp - 0x38], r15
jmp 0x140002543
mov eax, eax
imul r14, rax, 0x58
add r14, qword [r15 + 0x28]
mov qword [rbp - 0x38], r14
je 0x140002243
movzx eax, byte [r14 + 8]
cmp al, 0xf
je 0x140002243
mov rbx, qword [rbp - 0x78]
xor r13d, r13d
mov edi, r13d
cmp al, 0x13
jne 0x14000233a
lea rax, [rbx - 0x25]
mov rdi, r14
test rax, 0xfffffffffffffffd
jne 0x14000233a
cmp rbx, 0x27
mov byte [rsp + 0x20], r13b
mov rdx, r14
sete r8b
xor r9d, r9d
mov rcx, r15
call fcn.1400a2d60
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d8c
lea rax, [rbx - 0x25]
test rax, 0xfffffffffffffffd
je 0x140002247
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140002243
mov rbx, qword [rbp - 0x78]
cmp rbx, 9
jne 0x14000238c
cmp byte [r14 + 8], 0xc
jne 0x14000238c
mov rcx, qword [r14]
lea edx, [rbx - 0x19]
call qword [sym.imp.USER32.dll_GetWindowLongW]
test al, 4
jne 0x140002243
mov rbx, qword [rbp - 0x78]
test rdi, rdi
jne 0x1400023ec
movzx edx, byte [r14 + 0xa]
mov rcx, r15
call fcn.1400a2a90
mov rdi, rax
test rax, rax
jne 0x1400023ec
mov r9d, dword [r15 + 0x20]
xor r8b, r8b
mov edx, r13d
test r9d, r9d
je 0x140002247
mov r10, qword [r15 + 0x28]
nop dword [rax]
mov eax, edx
imul rdi, rax, 0x58
add rdi, r10
cmp byte [rdi + 8], 0x13
jne 0x1400023d7
test r8b, r8b
je 0x1400023e3
inc r8b
inc edx
cmp edx, r9d
jb 0x1400023c0
jmp 0x140002247
test rdi, rdi
je 0x140002247
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140002243
mov rax, qword [rbp - 0x78]
cmp rax, 0x22
je 0x140002433
cmp rax, 9
jne 0x140002420
lea ecx, [rax + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140002433
xor r8d, r8d
mov byte [rsp + 0x20], 1
mov r9b, 1
mov rdx, rdi
jmp 0x140002316
mov r8b, 1
mov rdx, rdi
mov byte [rsp + 0x20], r8b
movzx r9d, r8b
jmp 0x140002316
mov eax, eax
imul r14, rax, 0x58
add r14, qword [r15 + 0x28]
mov qword [rbp - 0x38], r14
je 0x140002538
cmp byte [r14 + 8], 0xc
jne 0x140002538
mov rbx, qword [rbp - 0x78]
cmp rbx, 0x1b
je 0x1400024f6
movzx eax, byte [r14 + 9]
cmp rbx, 0x41
je 0x1400024be
test al, al
jns 0x14000253c
mov rcx, qword [r14]
lea r9, [0x1401035f4]
mov edx, 0xc2
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d8c
test al, 2
jne 0x14000253c
mov rcx, qword [r14]
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d8c
cmp qword [r15 + 0x40], 0
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
je 0x140001d8c
mov rcx, qword [r15 + 8]
xor r9d, r9d
mov edx, 0x414
mov r8d, 0x2af80007
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rdi, r12d
jmp 0x140001d8c
mov rbx, qword [rbp - 0x78]
mov r13d, dword [rbp - 0x80]
xor r15d, r15d
mov rcx, qword [0x140143808]
test rcx, rcx
je 0x1400025bf
cmp r13d, 0x100
jne 0x1400025bf
cmp rbx, 0xd
jne 0x14000258b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1116
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d90
cmp rbx, 0x1b
jne 0x1400025bf
xor r9d, r9d
lea r8d, [rbx - 0x1a]
mov edx, 0x1116
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d90
mov r11, qword [rsp + 0x78]
mov r9d, dword [0x140142768]
jmp 0x140002786
xor r15d, r15d
mov r13d, dword [rbp - 0x80]
mov r11, qword [rsp + 0x78]
mov r9d, dword [0x140142768]
lea eax, [r13 - 0x20a]
test eax, 0xfffffffb
jne 0x140002782
mov rcx, qword [rbp - 0x64]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
mov edx, 0xfffffff0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140090e40
test rax, rax
je 0x14000268d
cmp rbx, qword [rsp + 0x78]
jne 0x14000264f
mov r9, qword [rbp - 0x78]
mov r8d, edi
mov edx, dword [rbp - 0x80]
mov rcx, rbx
call fcn.140001a30
test eax, eax
jne 0x14000268d
mov rcx, qword [rsp + 0x78]
cmp rbx, rcx
je 0x140002692
mov r9, qword [rbp - 0x78]
mov r8d, edi
mov edx, dword [rbp - 0x80]
mov rcx, rbx
call fcn.140001a30
test eax, eax
je 0x14000268d
mov r9, qword [rbp - 0x70]
mov rcx, rbx
mov r8, qword [rbp - 0x78]
mov edx, dword [rbp - 0x80]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d90
mov rcx, qword [rsp + 0x78]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9, qword [rbp - 0x78]
mov r8d, eax
mov edx, dword [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.140001a30
test eax, eax
jne 0x14000276f
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140090e40
mov qword [rsp + 0x70], rax
mov r15, rax
test rax, rax
je 0x14000276f
nop dword [rax]
mov r9, qword [rbp - 0x78]
mov r8d, dword [r15 + 0x64]
mov edx, dword [rbp - 0x80]
mov rcx, qword [r15 + 8]
call fcn.140001a30
mov rcx, qword [r15 + 8]
test eax, eax
jne 0x14000274a
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140142768]
xor r15d, r15d
mov edx, r15d
test r9d, r9d
jle 0x14000273c
mov rcx, qword [0x140142760]
nop dword [rax + rax]
mov r15, qword [rcx]
mov qword [rsp + 0x70], r15
cmp qword [r15 + 8], rax
je 0x140002743
inc edx
add rcx, 8
cmp edx, r9d
jl 0x140002720
xor r15d, r15d
mov qword [rsp + 0x70], r15
jmp 0x140002779
test r15, r15
jne 0x1400026e0
jmp 0x140002776
mov r9, qword [rbp - 0x70]
mov r8, qword [rbp - 0x78]
mov edx, dword [rbp - 0x80]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d8c
mov r9d, dword [0x140142768]
xor r15d, r15d
mov r13d, dword [rbp - 0x80]
mov r11, qword [rsp + 0x78]
mov rbx, qword [rbp - 0x78]
mov edi, r15d
test r9d, r9d
jle 0x140002806
mov rbx, r15
mov rdx, qword [0x140142760]
mov rax, qword [rbx + rdx]
cmp dword [rax + 0x20], 0
jne 0x1400027ab
cmp r13d, 0x106
je 0x1400027f2
mov rcx, qword [0x14013dbf0]
mov byte [rcx + 0x128], 1
mov eax, dword [rbp - 0x80]
mov dword [rcx + 0x124], eax
mov rcx, qword [rbx + rdx]
lea rdx, [rsp + 0x78]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
mov rax, qword [0x14013dbf0]
mov byte [rax + 0x128], 0
jne 0x140002855
mov r13d, dword [rbp - 0x80]
mov r9d, dword [0x140142768]
inc edi
add rbx, 8
cmp edi, r9d
jl 0x140002791
mov r11, qword [rsp + 0x78]
mov rbx, qword [rbp - 0x78]
cmp r13d, 0x401
ja 0x1400029a6
cmp r13d, 0x400
jae 0x1400029d2
mov eax, r13d
sub eax, 0x12
je 0x140002977
sub eax, 0x39
je 0x140002953
sub eax, 0xb5
je 0x140002911
sub eax, 0x13
je 0x140002871
cmp eax, 0x1ff
je 0x1400029e4
jmp 0x140002d12
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d90
cmp qword [rbp - 0x70], 0
jne 0x140002d12
cmp r11, qword [0x140142770]
jne 0x140002d12
cmp dword [0x140143794], 0
je 0x140002897
call fcn.1400049e0
cmp dword [0x14014685c], 0
je 0x1400028b8
call fcn.140004730
movzx ebx, byte [rbp - 0x58]
test al, al
mov eax, 1
cmovne ebx, eax
mov dword [rbp - 0x58], ebx
jmp 0x1400028bb
mov ebx, dword [rbp - 0x58]
cmp dword [rbp + 0x2408], 0
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movsxd rdi, r12d
je 0x140002073
movsxd rdi, r12d
cmp rdi, 1
jl 0x140002073
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x140004605
mov ecx, dword [rbp - 0x54]
sub ecx, eax
add ecx, r12d
cmp ecx, 5
jle 0x140004605
movzx ebx, byte [rbp + 0x2410]
jmp 0x140001d90
cmp r11, qword [0x140142738]
jne 0x140002d12
cmp rbx, 0x1b
jne 0x140002d12
mov rcx, qword [0x140142770]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d90
movzx r14d, byte [rbp + 0x2418]
mov bl, 1
mov r13d, dword [rsp + 0x40]
mov byte [rbp + 0x2410], bl
mov qword [0x140142740], r15
movsxd rdi, r12d
jmp 0x140001d90
xor r8d, r8d
lea rcx, [0x140145cd0]
lea edx, [r8 + 4]
call fcn.140035bf0
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
movsxd rdi, r12d
jmp 0x140001d90
cmp r13d, 0x402
je 0x1400029e4
cmp r13d, 0x414
je 0x1400029e4
cmp r13d, 0x415
je 0x1400029d2
lea eax, [r13 - 0x41b]
cmp eax, 3
jbe 0x1400029e4
jmp 0x140002d12
test r11, r11
je 0x1400029e4
cmp r11, qword [0x140142770]
jne 0x140002d12
lea eax, [r13 - 0x401]
mov r12, r15
cmp eax, 0x1d
ja case.0x140002a10.1031
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x46c8]
mov ecx, dword [rdx + rax*4 + 0x46ac]
add rcx, rdx
jmp rcx
mov ecx, r15d
test r9d, r9d
jle 0x140002a40
mov rax, qword [0x140142760]
mov r15, qword [rax]
mov qword [rsp + 0x70], r15
mov r8, qword [r15 + 8]
cmp r8, r11
je 0x140002a4a
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002a21
xor r15d, r15d
mov qword [rsp + 0x70], r15
jmp 0x140002d12
test r15, r15
je 0x140002d12
mov rcx, qword [rbp - 0x70]
mov eax, 0x2af8
movzx r9d, bx
shr rbx, 0x10
movzx r11d, bx
xor ebx, ebx
cmp r9d, 8
mov dword [rsp + 0x6c], r9d
mov edi, r11d
mov dword [rsp + 0x48], ebx
cmove r11d, eax
cmovne rdi, rcx
mov eax, ecx
mov dword [rbp - 0x10], r11d
cmovne eax, dword [rsp + 0x58]
mov r10d, eax
mov dword [rsp + 0x58], eax
mov esi, eax
cmp r11d, dword [r15 + 0x20]
jae 0x140002aa9
mov eax, r11d
imul r14, rax, 0x58
add r14, qword [r15 + 0x28]
jmp 0x140002aac
mov r14, rbx
mov eax, r9d
mov qword [rbp - 0x38], r14
mov qword [rbp], rbx
mov byte [rsp + 0x44], bl
mov qword [rsp + 0x60], rdi
sub eax, 5
je 0x140002c4f
sub eax, 1
je 0x140002bf0
sub eax, 1
je 0x140002bcf
sub eax, 1
je 0x140002bae
cmp eax, 1
je 0x140002b80
movzx ebx, byte [rbp + 0x2410]
test r14, r14
je 0x140001d73
mov rbx, qword [r14 + 0x18]
test rbx, rbx
jne 0x140002b4b
test byte [r14 + 9], 1
je 0x140002b1d
test r8, r8
je 0x140002b1d
xor edx, edx
mov rcx, r8
call qword [sym.imp.USER32.dll_ShowWindow]
mov r12d, dword [rbp + 0x2400]
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x50]
mov dword [rsp + 0x58], esi
jmp 0x140001d8c
test byte [r14 + 9], 4
movzx r14d, byte [rbp + 0x2418]
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], esi
jne 0x140001d6a
xor r8d, r8d
mov byte [rsp + 0x44], 1
mov r14d, r8d
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], esi
jmp 0x14000330b
mov rbx, qword [r15 + 0x58]
movzx r14d, byte [rbp + 0x2418]
mov dword [rsp + 0x58], r10d
test rbx, rbx
je 0x140001d6a
xor r8d, r8d
mov qword [rsp + 0x60], rdi
mov r14d, r8d
mov dword [rsp + 0x58], esi
jmp 0x14000330b
mov rbx, qword [r15 + 0x48]
movzx r14d, byte [rbp + 0x2418]
mov dword [rsp + 0x58], r10d
test rbx, rbx
je 0x140001d6a
mov eax, WSAAsyncSelect
jmp 0x140002c0f
mov rbx, qword [r15 + 0x40]
movzx r14d, byte [rbp + 0x2418]
mov dword [rsp + 0x58], r10d
test rbx, rbx
je 0x140001d6a
mov eax, WSAAsyncSelect
jmp 0x140002c0f
mov rbx, qword [r15 + 0x38]
movzx r14d, byte [rbp + 0x2418]
mov dword [rsp + 0x58], r10d
test rbx, rbx
je 0x140001d6a
mov eax, 0x60
add rax, r15
mov qword [rsp + 0x60], rdi
mov qword [rbp], rax
je 0x140002c8d
cmp byte [rax], 0
movzx r14d, byte [rbp + 0x2418]
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x50]
mov dword [rsp + 0x58], esi
mov qword [rbp], rax
jne 0x140001d61
xor r8d, r8d
mov dword [rsp + 0x58], esi
mov r14d, r8d
jmp 0x14000330b
mov rbx, qword [r15 + 0x50]
mov r12, qword [r15 + 0xa0]
test rbx, rbx
je 0x140002c9c
mov qword [rsp + 0x60], rdi
test r12, r12
je 0x140002cb4
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r14d, eax
mov qword [rsp + 0x60], r14
test eax, eax
je 0x140002c9c
mov r13d, dword [rbp - 0x80]
xor r8d, r8d
mov dword [rsp + 0x58], esi
mov r14d, r8d
jmp 0x14000330b
test r12, r12
je 0x140002cb4
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor r8d, r8d
mov qword [r15 + 0xa0], r8
mov r12d, dword [rbp + 0x2400]
movzx r14d, byte [rbp + 0x2418]
mov rdi, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
mov dword [rsp + 0x58], esi
jmp 0x140001d8c
test rbx, rbx
je 0x140002eaf
mov rcx, rbx
call fcn.140090e40
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140002eb4
test r11, r11
je 0x140002eb4
cmp r11, qword [0x140142770]
je 0x140002eb4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140002e21
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140145ca0]
jne 0x140002e21
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
xor r15d, r15d
lea rdx, [rbp + 0x1a0]
mov ecx, r15d
lea r8, str.32770
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140002e24
cmp rcx, 7
jne 0x140002d70
mov rcx, qword [0x14013dbf0]
lea rdx, [rsp + 0x78]
mov byte [rcx + 0x128], 1
mov eax, dword [rbp - 0x80]
mov dword [rcx + 0x124], eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x140002e11
cmp dword [0x14014276c], r15d
je 0x140002dde
mov rax, qword [0x140140400]
lea rcx, [0x140103574]
test rax, rax
je 0x140002dd8
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, qword [0x14013dbf0]
mov byte [rax + 0x128], r15b
movzx r14d, byte [rbp + 0x2418]
mov rdi, qword [rsp + 0x50]
mov r12d, dword [rbp + 0x2400]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
jmp 0x140001d90
mov rcx, qword [0x14013dbf0]
mov byte [rcx + 0x128], r15b
jmp 0x140002e2b
xor r15d, r15d
mov rcx, qword [0x14013dbf0]
mov rdx, qword [0x140142730]
test rdx, rdx
je 0x140002e76
mov rcx, qword [0x140142770]
lea r8, [rsp + 0x78]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
movsxd r12, dword [rbp + 0x2400]
movzx r14d, byte [rbp + 0x2418]
mov rdi, r12
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
test eax, eax
jne 0x140001d90
mov rcx, qword [0x14013dbf0]
mov byte [rcx + 0x128], 1
mov eax, dword [rbp - 0x80]
mov dword [rcx + 0x124], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rax, qword [0x14013dbf0]
mov byte [rax + 0x128], 0
jmp 0x140002dec
mov qword [rsp + 0x70], r15
mov rcx, qword [0x140146860]
test rcx, rcx
je 0x140002efb
mov rax, qword [rbp - 0x70]
nop dword [rax]
nop dword [rax + rax]
mov rdi, qword [rcx + 8]
mov qword [rbp - 0x48], rdi
test rdi, rdi
je 0x140002ef2
nop dword [rax]
cmp dword [rdi + 0x28], eax
je 0x140002f04
mov rdi, qword [rdi + 0x38]
mov qword [rbp - 0x48], rdi
test rdi, rdi
jne 0x140002ee0
mov rcx, qword [rcx + 0x30]
test rcx, rcx
jne 0x140002ed0
mov qword [rbp - 0x48], r15
jmp 0x140002dec
mov rbx, qword [rdi + 0x10]
movzx r14d, byte [rbp + 0x2418]
test rbx, rbx
je 0x140002df4
mov r14d, dword [rdi + 0x2c]
jmp 0x14000330f
mov eax, dword [0x140143790]
movzx r14d, byte [rbp + 0x2418]
mov rdi, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x40]
cmp rbx, rax
jae 0x140001d51
mov rax, qword [0x140143788]
mov rdi, qword [rax + rbx*8]
mov qword [rbp + 8], rdi
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140002f89
mov rdx, qword [rdi + 8]
call fcn.140016770
mov qword [rbp - 0x50], rax
mov rbx, rax
movzx ebx, byte [rbp + 0x2410]
test rax, rax
je 0x140001d35
mov rcx, qword [rdi + 0x20]
movzx edx, byte [rcx]
dec dl
test dl, 0xfd
je 0x140002f8d
mov qword [rbp - 0x50], r15
mov rdx, qword [rbp - 0x70]
mov rcx, rdi
call fcn.140019b60
cmp qword [rdi + 0x18], 0
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
jne 0x140001d35
cmp byte [rdi + 0x3e], 0
je 0x140002fd9
movzx eax, word [rbp - 0x70]
mov r13d, dword [rbp - 0x80]
mov word [0x14014687c], ax
mov rbx, qword [rdi]
mov r14d, dword [rdi + 0x28]
jmp 0x14000330b
mov r13d, dword [rbp - 0x80]
mov word [0x14014687c], r15w
mov rbx, qword [rdi]
mov r14d, dword [rdi + 0x28]
jmp 0x14000330b
cmp byte [0x140146840], 0
movzx r14d, byte [rbp + 0x2418]
mov rdi, qword [rsp + 0x50]
movzx ebx, byte [rbp + 0x2410]
jne 0x140001d43
mov rbx, qword [0x140146828]
mov r14d, r15d
test rbx, rbx
cmove rbx, qword [0x1401463a8]
jmp 0x14000330b
mov rcx, rbx
call fcn.14005cde0
movzx r14d, byte [rbp + 0x2418]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140001d35
mov rbx, qword [rax + 0x10]
mov r14d, r15d
mov r13d, dword [rbp - 0x80]
mov rbx, qword [rbx + 0x388]
jmp 0x14000330b
mov rdi, qword [0x140142758]
movzx r14d, byte [rbp + 0x2418]
mov qword [rbp - 0x40], rdi
test rdi, rdi
je 0x140002df4
cmp rdi, rbx
je 0x14000309f
mov rdi, qword [rdi + 8]
mov qword [rbp - 0x40], rdi
test rdi, rdi
jne 0x140003088
jmp 0x140002dec
movzx r14d, byte [rbp + 0x2418]
movzx ebx, byte [rbp + 0x2410]
test rdi, rdi
je 0x140001d22
mov rbx, qword [rdi + 0x10]
cmp r13d, 0x41c
jne 0x1400030cd
mov rbx, qword [rbx + 0x390]
jmp 0x1400030e6
cmp r13d, 0x41e
jne 0x1400030df
mov rbx, qword [rbx + 0x3a0]
jmp 0x1400030e6
mov rbx, qword [rbx + 0x398]
movzx r14d, byte [rbp + 0x2418]
mov rdi, qword [rsp + 0x50]
test rbx, rbx
je 0x140002df9
mov r14d, r15d
jmp 0x14000330b
movzx r14d, byte [rbp + 0x2418]
movzx eax, bx
mov rdi, qword [rsp + 0x50]
mov ecx, 0x7fff
and ax, cx
cmp ax, word [0x1401437ac]
jae 0x140002df9
movzx ecx, ax
mov rax, qword [0x140143798]
shr rbx, 0x10
mov r14, qword [rax + rcx*8]
mov qword [rbp - 0x28], r14
test bx, bx
je 0x14000316c
mov r15, qword [r14 + 0x28]
mov eax, 0xffff
mov qword [rbp - 0x30], r15
add bx, ax
je 0x140003163
mov r15, qword [r15 + 0x10]
add bx, ax
jne 0x140003156
mov qword [rbp - 0x30], r15
test r15, r15
jne 0x140003253
cmp r13d, 0x400
jne 0x14000318f
mov rax, qword [rbp - 0x70]
mov edi, WSAAsyncSelect
shr rax, 0x10
movzx ecx, ax
sub edi, ecx
lea esi, [rcx + 0x3c2bb3]
jmp 0x140003197
mov esi, r15d
mov edi, 0x3c2c17
cmp byte [r14 + 0x19], 0
jne 0x1400031a7
mov qword [rbp - 0x30], r15
jmp 0x140002dec
mov qword [rbp - 0x50], r15
mov rbx, r15
mov r15, qword [r14 + 0x28]
mov qword [rbp - 0x30], r15
test r15, r15
je 0x14000322f
nop dword [rax + rax]
cmp byte [r15 + 0x28], 0
je 0x14000321e
cmp byte [0x140142850], 0
je 0x1400031dc
mov rcx, r15
call fcn.1400aac50
test al, al
je 0x14000321e
lea ecx, [rsi - 0x3c2bb3]
cmp edi, 0x66
jbe 0x1400031ec
mov ecx, reloc.WSOCK32.dll_WSAAsyncSelect
movzx eax, byte [r15 + 0x24]
cmp ecx, eax
jle 0x14000321e
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140003214
mov rdx, qword [r14 + 0x20]
call fcn.140016770
mov r14, qword [rbp - 0x28]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14000321e
cmp qword [r15 + 8], 0
jne 0x140003275
mov rbx, r15
mov r15, qword [r15 + 0x10]
mov qword [rbp - 0x30], r15
test r15, r15
jne 0x1400031c0
mov r13d, dword [rbp - 0x80]
mov r15, rbx
mov qword [rbp - 0x30], rbx
movzx r14d, byte [rbp + 0x2418]
mov rdi, qword [rsp + 0x50]
movzx ebx, byte [rbp + 0x2410]
test r15, r15
je 0x140001d80
mov r9, qword [r15]
mov rcx, r9
call fcn.1400aaba0
test eax, eax
je 0x140003267
cmp eax, 1
jne 0x14000327b
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x14000327b
movzx ecx, byte [rax]
jmp 0x14000327d
mov r13d, dword [rbp - 0x80]
jmp 0x140003236
xor cl, cl
movzx eax, byte [r15 + 0x23]
cmp byte [r15 + 0x22], al
jb 0x1400032d8
add cl, 0x32
cmp cl, 0x14
ja 0x14000329d
movzx eax, cl
mov ecx, 0x10fc01
bt ecx, eax
jb 0x1400032d8
cmp byte [r15 + 0x26], 0
je 0x1400032a9
mov byte [r15 + 0x27], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, dword [rbp + 0x2400]
movzx r14d, byte [rbp + 0x2418]
mov rdi, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
mov dword [r15 + 0x18], eax
jmp 0x140001d8c
mov rax, qword [r15 + 8]
test rax, rax
je 0x1400032fd
movzx ecx, byte [rax]
lea eax, [rcx - 2]
test al, 0xfd
je 0x1400032fd
cmp cl, 5
jb 0x140003304
mov rax, qword [0x140142750]
mov qword [rbp - 0x50], rax
jmp 0x140003304
xor r8d, r8d
mov qword [rbp - 0x50], r8
mov rbx, qword [r15]
mov r14d, dword [r15 + 0x1c]
mov rdi, qword [rbp - 0x48]
mov r15, qword [rsp + 0x60]
mov rcx, rbx
call fcn.1400aaba0
test eax, eax
je 0x140003325
cmp eax, 1
jne 0x140003333
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140003333
movzx esi, byte [rax]
jmp 0x140003336
xor sil, sil
mov ecx, dword [0x1401425dc]
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
cmp ecx, eax
jl 0x1400033d2
add eax, 2
cmp ecx, eax
jge 0x140003362
lea eax, [rsi + 0x32]
cmp al, 0x14
ja 0x140003362
mov ecx, 0x10fc01
bt ecx, eax
jb 0x1400033d2
test r12, r12
je 0x140003385
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rdi, qword [rsp + 0x70]
xor r15d, r15d
mov qword [rdi + 0xa0], r15
mov r13d, dword [rbp - 0x80]
jmp 0x140003388
xor r15d, r15d
movsxd r12, dword [rbp + 0x2400]
cmp r13d, 0x41b
movzx r14d, byte [rbp + 0x2418]
mov rdi, r12
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
jne 0x140001d90
mov rax, qword [rbp - 0x40]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r12d, dword [rbp + 0x2400]
mov rdi, qword [rsp + 0x50]
jmp 0x140001d90
mov rax, qword [0x14013dbf0]
cmp r14d, dword [rax + 0x3c]
jl 0x140003362
mov byte [rbp - 0x58], 1
cmp r13d, 0x402
je 0x140003497
cmp r13d, 0x413
jbe 0x14000340e
cmp r13d, 0x415
jbe 0x140003456
lea eax, [r13 - 0x41b]
cmp eax, 3
jbe 0x140003456
mov rax, qword [0x1401467d0]
mov qword [0x1401467d8], rax
mov eax, dword [0x140146874]
mov dword [0x140146878], eax
cmp r13d, 0x401
jne 0x14000343b
mov rax, qword [rbp + 8]
mov rax, qword [rax + 8]
jmp 0x140003443
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 0x20]
mov qword [0x1401467d0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140146874], eax
xor r13d, r13d
mov rdi, qword [0x140142748]
cmp byte [rdi + 0x23], 0
jne 0x14000346a
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x140003478
mov rcx, rdi
call fcn.140001670
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x1400034e7
test byte [rdi + 0x21], 4
je 0x14000348e
mov rdx, rdi
call fcn.140057bc0
mov rdx, qword [rdi + 8]
jmp 0x14000354a
mov rdx, qword [rdi]
lea rcx, [0x1401463b8]
mov r8d, 0x104
call fcn.1400e5080
xor r13d, r13d
lea rax, [0x1401465c2]
mov word [0x1401465c0], r13w
mov r8d, 0x104
mov rdx, qword [rdi + 0x20]
mov rcx, rax
mov rdx, qword [rdx]
call fcn.1400e5080
mov word [0x1401467ca], r13w
mov qword [0x1401463b0], rdi
jmp 0x140003459
cmp al, 2
jne 0x140003543
mov rdx, qword [0x140146970]
test rdx, rdx
jne 0x14000354a
lea ecx, [rdx + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140003523
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rdx, [0x140103574]
lea rax, [0x140103568]
cmovne rdx, rax
jmp 0x14000354a
xor edx, edx
call fcn.140006d10
mov ecx, 0xffffffff
lea rdx, [0x140103574]
cmp rax, rcx
cmovne rdx, qword [0x140146968]
jmp 0x14000354a
lea rdx, [0x140144c40]
mov r8d, 0x7f
lea rcx, [rbp + 0x1e0]
call fcn.1400e5080
movzx r9d, sil
mov word [rbp + 0x2de], r13w
mov r8b, 1
xor edx, edx
mov ecx, r14d
call fcn.140004fa0
mov r14, qword [0x14013dbf0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401468d4], eax
mov dword [0x1401468d0], eax
mov eax, dword [rbp - 0x80]
add eax, 0xfffffbff
cmp eax, 0x1d
ja case.0x1400035ba.1032
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0x4708]
mov ecx, dword [r8 + rax*4 + 0x46e8]
add rcx, r8
jmp rcx
cmp byte [rsp + 0x44], 0
mov word [rbp + 0x70], r13w
mov r13, qword [rbp - 0x38]
je 0x1400035d2
mov rcx, qword [r13]
jmp 0x1400035db
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
movsxd rdi, dword [rsp + 0x48]
mov r10d, 1
mov edx, dword [rsp + 0x6c]
mov rax, rdi
shl rax, 5
inc edi
mov dword [rsp + 0x48], edi
mov dword [rbp + rax + 0xe0], r10d
mov qword [rbp + rax + 0xd0], rcx
cmp edx, 5
je 0x140003afa
jbe 0x1400039b1
cmp edx, 8
jbe 0x1400038e7
cmp edx, 9
jne 0x1400039b1
cmp qword [rsp + 0x60], 0
mov edx, 3
cmovne edx, r10d
xor r8d, r8d
mov dword [r14 + 0x44], edx
mov esi, r8d
mov rax, qword [rbp - 0x64]
mov qword [r14 + 0x50], rax
mov qword [rsp + 0x60], r8
test r13, r13
je 0x1400037f7
test r15, r15
je 0x140003768
movzx ecx, byte [r13 + 8]
mov dword [rbp - 0x20], 0x80000000
sub ecx, 9
je 0x1400036e7
sub ecx, r10d
je 0x1400036b7
sub ecx, r10d
je 0x14000368b
cmp ecx, 6
jne 0x140003715
mov edx, 0x419
jmp 0x140003707
mov rcx, qword [r13]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140003715
mov qword [rbp - 0x20], rax
mov edx, 0x1104
mov r8d, 1
jmp 0x140003707
mov rcx, qword [r13]
mov r9, r10
mov edx, 0x100c
mov r8, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, eax
cmp r8, 0xffffffffffffffff
je 0x140003715
mov dword [rbp - 0x20], 2
mov edx, 0x100e
jmp 0x140003707
mov rcx, qword [r13]
xor r9d, r9d
mov edx, OleCreatePictureIndirect
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
je 0x140003715
mov r8, rax
mov edx, 0x198
mov rcx, qword [r13]
lea r9, [rbp - 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rbp - 0x20], 0x80000000
mov rcx, qword [r13]
jne 0x14000372e
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x140003740
mov r9d, 2
lea r8, [rbp - 0x20]
xor edx, edx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rbp - 0x20]
mov ecx, dword [rbp - 0x1c]
mov dword [r14 + 0x50], eax
mov eax, dword [rbp - 0x14]
sub eax, ecx
jns 0x140003753
inc eax
sar eax, 1
mov r10d, 1
add eax, 2
add eax, ecx
mov dword [r14 + 0x54], eax
mov edx, dword [r14 + 0x44]
movzx ecx, byte [r13 + 8]
sub ecx, 9
je 0x1400037d8
sub ecx, 1
je 0x1400037c7
cmp ecx, 1
jne 0x1400037f7
mov rcx, qword [r13]
cmp edx, 1
jne 0x14000379b
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
jmp 0x1400037f2
mov rax, qword [rbp - 0x64]
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, qword [r13]
lea r9, [rbp + 0x10]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
jmp 0x1400037f2
mov r9, r10
mov edx, 0x100c
mov r8, 0xffffffffffffffff
jmp 0x1400037e3
xor r9d, r9d
mov edx, OleCreatePictureIndirect
xor r8d, r8d
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_SendMessageW]
inc eax
movsxd rsi, eax
mov qword [rsp + 0x60], rsi
mov r15, qword [rsp + 0x70]
lea rdx, [rbp + 0x98]
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x98]
lea r8d, [rdi + 1]
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0x9c]
sub dword [r14 + 0x54], eax
movsxd rdx, edi
shl rdx, 5
test r13, r13
je 0x140003837
mov rcx, qword [r13]
jmp 0x14000383e
lea rcx, [0x140103574]
xor r9d, r9d
lea edi, [r8 + 1]
mov r10d, 1
test r13, r13
mov eax, r9d
setne al
mov dword [rbp + rdx + 0xe0], eax
mov qword [rbp + rdx + 0xd0], rcx
mov ecx, r9d
movsxd rdx, edi
inc edi
shl rdx, 5
movsxd rax, r8d
shl rax, 5
mov dword [rbp + rax + 0xe0], r10d
mov qword [rbp + rax + 0xd0], rsi
mov eax, dword [r14 + 0x44]
cmp eax, 3
mov dword [rbp + rdx + 0xe0], r10d
sete cl
mov qword [rbp + rdx + 0xd0], rcx
movsxd rax, dword [r14 + 0x50]
mov edx, dword [rsp + 0x6c]
movsxd rcx, edi
inc edi
shl rcx, 5
mov dword [rbp + rcx + 0xe0], r10d
mov qword [rbp + rcx + 0xd0], rax
movsxd rax, dword [r14 + 0x54]
movsxd rcx, edi
shl rcx, 5
inc edi
mov dword [rsp + 0x48], edi
mov dword [rbp + rcx + 0xe0], r10d
mov qword [rbp + rcx + 0xd0], rax
jmp 0x140003c4e
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov dword [r14 + 0x44], r10d
jne 0x140003c4b
mov edx, dword [rsp + 0x58]
movsxd rax, edi
inc edi
mov dword [rsp + 0x48], edi
mov ecx, dword [rsp + 0x48]
shl rax, 5
inc ecx
mov dword [r14 + 0x50], edx
movsxd rdi, edi
shl rdi, 5
mov dword [rbp + rax + 0xe0], r10d
mov qword [rbp + rax + 0xd0], rsi
cmp byte [r15 + 0x110], 0
mov dword [rsp + 0x48], ecx
movzx eax, dx
je 0x140003960
mov r8d, dword [0x140145ca4]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [rsp + 0x48]
mov r10d, 1
mov edx, dword [rsp + 0x58]
cdqe
mov qword [rbp + rdi + 0xd0], rax
mov eax, edx
mov dword [rbp + rdi + 0xe0], r10d
movsxd rdi, ecx
inc ecx
shl rdi, 5
shr eax, 0x10
cmp byte [r15 + 0x110], 0
mov dword [rsp + 0x48], ecx
je 0x140003c31
mov r8d, dword [0x140145ca4]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
jmp 0x140003c31
movzx eax, byte [r13 + 8]
cmp al, 0xa
je 0x140003a0a
mov r15, qword [rsp + 0x70]
cmp al, 0x19
jne 0x140003a8d
mov rax, qword [rbp - 0x64]
lea rdx, [rbp + 0xa8]
mov qword [r14 + 0x50], rax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0xa8]
lea r8, [0x140000000]
sub dword [r14 + 0x50], eax
mov r10d, 1
mov eax, dword [rbp + 0xac]
sub dword [r14 + 0x54], eax
mov edx, dword [rsp + 0x6c]
jmp 0x140003a8d
cmp dl, 0x49
jne 0x140003a88
lea rax, [rbp + 0x70]
bt edx, 8
jae 0x140003a20
mov eax, 0x53
jmp 0x140003a2b
bt edx, 9
jae 0x140003a33
mov eax, reloc.WSOCK32.dll_WSAStartup
mov word [rbp + 0x70], ax
lea rax, [rbp + 0x72]
bt edx, 0xa
jae 0x140003a40
mov ecx, 0x46
jmp 0x140003a4b
bt edx, 0xb
jae 0x140003a52
mov ecx, 0x66
mov word [rax], cx
add rax, 2
bt edx, 0xc
jae 0x140003a5f
mov ecx, 0x43
jmp 0x140003a6a
bt edx, 0xd
jae 0x140003a71
mov ecx, WSAAsyncSelect
mov word [rax], cx
add rax, 2
mov r15, qword [rsp + 0x70]
xor r9d, r9d
mov edx, 0x49
mov word [rax], r9w
mov dword [rsp + 0x6c], edx
jmp 0x140003a90
mov r15, qword [rsp + 0x70]
xor r9d, r9d
movsxd rcx, edi
inc edi
shl rcx, 5
mov dword [r14 + 0x44], edx
cmp edx, 5
jae 0x140003aae
mov eax, edx
mov rdx, qword [r8 + rax*8 + 0x125bb8]
jmp 0x140003abf
movzx eax, dl
lea rdx, [0x1401483b4]
mov word [0x1401483b4], ax
mov rsi, qword [rsp + 0x60]
mov qword [rbp + rcx + 0xd0], rdx
mov edx, dword [rsp + 0x6c]
movsxd rax, edi
shl rax, 5
mov dword [rbp + rcx + 0xe0], r9d
inc edi
mov dword [rsp + 0x48], edi
mov dword [rbp + rax + 0xe0], r10d
mov qword [rbp + rax + 0xd0], rsi
jmp 0x140003c4e
mov r15, qword [rsp + 0x70]
lea rdx, [rbp + 0xb8]
mov dword [r14 + 0x44], 5
mov rax, qword [rbp - 0x64]
mov qword [r14 + 0x50], rax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0xb8]
mov edx, 0xffffffec
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0xbc]
sub dword [r14 + 0x54], eax
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffec
and eax, 0xffffffef
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [rsp + 0x48]
mov rcx, r12
movsxd rdi, edi
inc esi
shl rdi, 5
call fcn.140093ac0
movsxd rdx, esi
shl rdx, 5
inc esi
mov dword [rbp + rdi + 0xe0], 6
mov qword [rbp + rdi + 0xd0], rax
test r13, r13
je 0x140003b94
mov rcx, qword [r13]
jmp 0x140003b9b
lea rcx, [0x140103574]
xor r8d, r8d
movsxd rdi, esi
test r13, r13
mov eax, r8d
setne al
shl rdi, 5
mov dword [rbp + rdx + 0xe0], eax
inc esi
mov qword [rbp + rdx + 0xd0], rcx
mov eax, dword [r14 + 0x50]
cmp byte [r15 + 0x110], r8b
je 0x140003be0
mov r8d, dword [0x140145ca4]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
cdqe
mov r10d, 1
mov dword [rbp + rdi + 0xe0], r10d
mov qword [rbp + rdi + 0xd0], rax
mov eax, dword [r14 + 0x54]
movsxd rdi, esi
inc esi
shl rdi, 5
cmp byte [r15 + 0x110], 0
mov dword [rsp + 0x48], esi
je 0x140003c2c
mov r8d, dword [0x140145ca4]
lea edx, [r10 + 0x5f]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
mov rsi, qword [rsp + 0x60]
mov edx, dword [rsp + 0x6c]
mov dword [rbp + rdi + 0xe0], r10d
cdqe
mov qword [rbp + rdi + 0xd0], rax
mov edi, dword [rsp + 0x48]
xor r9d, r9d
cmp byte [rsp + 0x44], 0
je 0x140003d12
cmp byte [r13 + 8], 0x17
jne 0x140003d12
xor edx, edx
lea rcx, [rbp + 0x2e8]
mov r8d, 0x10b0
call fcn.1400d8190
mov rcx, qword [r13]
lea eax, [rsi - 1]
lea r9, [rbp + 0x2e0]
mov dword [rbp + 0x2e4], eax
xor r8d, r8d
mov dword [rbp + 0x2e0], ntohs
mov edx, 0x703
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140003d74
cmp word [rbp + 0x350], 0
lea rax, [rbp + 0x2f0]
mov rcx, qword [0x140142748]
lea rdx, [rbp + 0x350]
cmove rdx, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [r9 - 1]
call fcn.1400be640
mov rcx, qword [0x140142748]
xor r8d, r8d
inc dword [rsp + 0x48]
movsxd rdi, edi
shl rdi, 5
lea edx, [r8 + 1]
call fcn.1400017c0
xor r8d, r8d
mov qword [rbp + rdi + 0xd0], rax
mov dword [rbp + rdi + 0xe0], r8d
jmp 0x140003d74
cmp word [rbp + 0x70], 0
je 0x140003d3a
movsxd rax, edi
lea rcx, [rbp + 0x70]
shl rax, 5
inc edi
mov dword [rsp + 0x48], edi
mov dword [rbp + rax + 0xe0], r9d
mov qword [rbp + rax + 0xd0], rcx
cmp edx, 8
je 0x140003d62
cmp edx, 5
je 0x140003d62
mov rcx, qword [0x140142748]
lea rdx, [rbp + 0x70]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400be640
jmp 0x140003d74
mov rcx, qword [0x140142748]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rsi
call fcn.1400015d0
mov rax, qword [r15 + 8]
mov rdi, qword [rbp]
mov qword [r14 + 0xf8], rax
add dword [r15 + 0x34], 2
mov eax, dword [rbp - 0x10]
mov qword [r14 + 0x48], rsi
movzx esi, byte [rsp + 0x44]
mov qword [r14 + 0x60], r15
mov qword [r14 + 0x58], r15
mov dword [r14 + 0x70], eax
test rdi, rdi
je 0x140003daa
mov byte [rdi], 1
jmp 0x140003db4
test sil, sil
je 0x140003db4
or byte [r13 + 9], 4
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140360]
jne 0x140003dd0
call fcn.140007570
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140350]
jb 0x140003dea
mov rax, qword [0x1401463a0]
mov qword [rcx], rax
mov rcx, qword [0x140140358]
add rcx, 0x18
lea rax, [0x140103588]
mov qword [0x140140358], rcx
lea r9, [rbp + 0xd0]
xor r14d, r14d
lea r8, str.call
mov dword [rsp + 0x30], r14d
mov rdx, rbx
mov qword [rcx + 8], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x48]
mov qword [rcx], r14
mov dword [rcx + 0x10], r14d
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.1400a6d80
sub qword [0x140140358], 0x18
cmp qword [r15 + 8], r14
je 0x140003eee
mov r9d, dword [rsp + 0x6c]
test rdi, rdi
je 0x140003e9d
mov byte [rdi], r14b
cmp r9d, 6
jne 0x140003ea7
cmp qword [rbp + 0x90], r14
jne 0x140003eee
mov rcx, rbx
call fcn.1400aaba0
test eax, eax
jne 0x140003e7f
test rbx, rbx
jne 0x140003eee
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140003eee
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r15
call fcn.140093a20
jmp 0x1400044d3
test sil, sil
je 0x140003ea7
and byte [r13 + 9], 0xfb
cmp r9d, 5
jne 0x140003eee
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffec
mov qword [r15 + 0xa0], r14
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffec
or eax, 0x10
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, r15
call fcn.140093a20
jmp 0x1400044d3
mov r15, qword [rsp + 0x70]
mov esi, 1
test r15, r15
je 0x140003f26
mov rax, qword [r15 + 8]
mov qword [r14 + 0xf8], rax
mov dword [r14 + 0x44], esi
add dword [r15 + 0x34], 2
mov qword [r14 + 0x60], r15
mov qword [r14 + 0x58], r15
lea rax, [0x1401463b8]
mov dword [rbp + 0x20], r13d
lea rcx, [0x140145cd0]
mov qword [rbp + 0x10], rax
call fcn.140071660
mov dword [rbp + 0x40], esi
mov dword [rbp + 0x60], r13d
lea ecx, [rax + 1]
mov qword [rbp + 0x30], rcx
lea rax, [0x1401465c2]
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140360]
mov qword [rbp + 0x50], rax
jne 0x140003f76
call fcn.140007570
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140350]
jb 0x140003f90
mov rax, qword [0x1401463a0]
mov qword [rcx], rax
mov rcx, qword [0x140140358]
add rcx, 0x18
mov dword [rsp + 0x30], r13d
mov qword [0x140140358], rcx
lea rax, str.Menu
mov qword [rsp + 0x28], r13
lea r9, [rbp + 0x10]
lea r8, str.call
mov dword [rsp + 0x20], 3
mov qword [rcx], r13
mov rdx, rbx
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], r13d
mov rcx, rbx
call fcn.1400a6d80
sub qword [0x140140358], 0x18
test r15, r15
je 0x1400044d3
mov rcx, r15
call fcn.140093a20
jmp 0x1400044d3
mov rax, qword [rbp - 0x50]
mov rdi, qword [rbp + 8]
mov qword [r14 + 0xf8], rax
movzx eax, byte [rdi + 0x35]
mov byte [r14 + 0x136], al
mov r9, qword [rdi]
mov rcx, r9
call fcn.1400aaba0
test eax, eax
je 0x140004021
cmp eax, 1
jne 0x14000402f
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x14000402f
movzx ecx, byte [rax]
jmp 0x140004031
xor cl, cl
movzx eax, byte [rdi + 0x39]
cmp byte [rdi + 0x38], al
jb 0x140004054
add cl, 0x32
cmp cl, 0x14
ja 0x1400044d3
mov eax, 0x10fc01
bt eax, ecx
jae 0x1400044d3
mov byte [0x14014687e], 0
xor r15d, r15d
inc byte [rdi + 0x38]
xor r9d, r9d
mov rdx, qword [0x1401467d0]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.1400aaae0
dec byte [rdi + 0x38]
jmp 0x1400044d6
call qword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x1400040b8
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400040ae
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov edx, 2
test eax, eax
je 0x1400040b3
mov edx, 1
xor r15d, r15d
jmp 0x1400040be
xor r15d, r15d
mov edx, r15d
mov rcx, qword [0x140142748]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [r14 + 0x48], rdx
call fcn.1400015d0
mov rax, qword [r14 + 0x48]
lea rdx, [0x1401035f8]
mov esi, 1
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], esi
mov byte [0x140146840], sil
call fcn.14000daa0
mov rax, qword [0x140146828]
test rax, rax
je 0x14000410f
mov rcx, rax
call fcn.1400018c0
mov rax, qword [0x140146828]
cmp qword [rbp - 0x78], 0
jne 0x140004133
test rax, rax
lea rdx, [rbp + 0x10]
mov r9d, r15d
lea rcx, [0x1401467f8]
sete r9b
mov r8d, esi
call fcn.1400aad00
sub qword [0x140140358], 0x18
mov byte [0x140146840], 0
jmp 0x1400044d6
mov rdi, qword [rbp - 0x40]
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140360]
mov dword [rbp + 0x20], 6
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x10], rax
jne 0x140004176
call fcn.140007570
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140350]
jb 0x140004190
mov rax, qword [0x1401463a0]
mov qword [rcx], rax
mov rcx, qword [0x140140358]
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x140140358], rcx
lea r9, [rbp + 0x10]
xor r15d, r15d
lea r8, str.call
mov dword [rsp + 0x30], r15d
mov rdx, rbx
mov qword [rcx + 8], rax
mov eax, 1
mov qword [rcx], r15
mov dword [rcx + 0x10], r15d
mov rcx, rbx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
call fcn.1400a6d80
sub qword [0x140140358], 0x18
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x1400044d6
mov rcx, qword [rbp - 0x70]
mov esi, 1
mov rax, qword [rbp - 0x40]
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], esi
mov dword [rbp + 0x60], esi
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
movzx eax, cl
sar rcx, 0x10
mov qword [rbp + 0x30], rax
movzx eax, cx
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140360]
mov qword [rbp + 0x50], rax
jne 0x140004240
call fcn.140007570
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140350]
jb 0x14000425a
mov rax, qword [0x1401463a0]
mov qword [rcx], rax
mov rcx, qword [0x140140358]
add rcx, 0x18
lea r9, [rbp + 0x10]
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 3
mov qword [0x140140358], rcx
lea rax, str.InputHook
mov dword [rcx + 0x10], r15d
lea r8, str.call
mov qword [rcx + 8], rax
mov rdx, rbx
mov qword [rcx], r15
mov rcx, rbx
call fcn.1400a6d80
sub qword [0x140140358], 0x18
jmp 0x1400044d6
mov rax, qword [rbp - 0x70]
xor r15d, r15d
mov rcx, qword [0x140140358]
mov word [rbp - 0xc], ax
sar rax, 0x10
cmp rcx, qword [0x140140360]
mov word [rbp - 0xa], ax
mov rax, qword [rbp - 0x40]
mov word [rbp - 8], r15w
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], r15d
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0xc]
mov qword [rbp + 0x30], rax
jne 0x140004302
call fcn.140007570
mov rcx, qword [0x140140358]
cmp rcx, qword [0x140140350]
jb 0x14000431c
mov rax, qword [0x1401463a0]
mov qword [rcx], rax
mov rcx, qword [0x140140358]
mov dword [rsp + 0x30], r15d
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], r15
add rcx, 0x18
mov dword [rsp + 0x20], 2
jmp 0x140004277
mov rax, qword [rbp - 0x28]
movzx eax, byte [rax + 0x10]
add al, 0x64
cmp al, 3
ja 0x140004350
mov eax, dword [rbp - 0x70]
mov qword [r14 + 0x48], rax
cmp byte [0x1401482dc], 0
mov rax, qword [rbp - 0x50]
mov r15, qword [rbp - 0x30]
mov qword [r14 + 0xf8], rax
movzx eax, byte [r15 + 0x24]
mov byte [r14 + 0x136], al
jne 0x1400044d3
cmp dword [0x1401437b4], 0
jne 0x14000438d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401437b4], eax
inc dword [0x1401482d8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [0x1401482d8]
mov ecx, eax
sub ecx, dword [0x1401437b4]
cmp r9d, dword [0x14013f624]
mov edx, dword [0x14013f620]
mov dword [0x1401437b0], eax
jbe 0x1400043ca
cmp ecx, edx
jae 0x1400043ca
mov esi, 1
mov ebx, esi
jmp 0x1400043d2
mov ebx, r13d
mov esi, 1
test ebx, ebx
je 0x14000444c
mov dword [rsp + 0x20], ecx
lea r8, str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea rcx, [rbp + 0x13a0]
mov edx, 0x800
call fcn.1400b9a60
call fcn.14000eb00
xor r8d, r8d
mov byte [0x1401482dc], 1
movaps xmm3, xmm6
mov dword [0x14013dbe4], r13d
lea rcx, [rbp + 0x13a0]
mov qword [rsp + 0x20], r13
lea edx, [r8 + 4]
call fcn.1400c0900
cmp eax, 7
jne 0x140004437
xor r8d, r8d
lea edx, [rax - 3]
lea rcx, [0x140145cd0]
call fcn.140035bf0
mov eax, dword [0x1401437b0]
mov dword [0x14013dbe4], esi
mov byte [0x1401482dc], 0
jmp 0x140004450
cmp ecx, edx
jbe 0x140004461
mov dword [0x1401482d8], r13d
mov dword [0x1401437b4], eax
test ebx, ebx
jne 0x1400044d3
mov r14, qword [rbp - 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, r15
movzx eax, byte [r14 + 0xf]
mov byte [0x14014687e], al
inc byte [r15 + 0x22]
mov rdx, qword [0x1401467d0]
call fcn.1400aaae0
dec byte [r15 + 0x22]
test eax, eax
jne 0x14000449c
mov byte [r15 + 0x27], al
jmp 0x1400044d3
cmp byte [r15 + 0x27], 0
je 0x1400044d3
mov byte [r15 + 0x27], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [r15 + 0x18]
cmp eax, 0x3e8
ja 0x1400044d3
movzx r8d, word [r14 + 4]
xor r9d, r9d
mov rcx, qword [0x140142770]
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
xor r15d, r15d
lea rcx, [rbp + 0x1e0]
call fcn.140005150
cmp dword [rbp + 0x2408], 0
movsxd r12, dword [rbp + 0x2400]
movzx r14d, byte [rbp + 0x2418]
mov rdi, r12
mov r13d, dword [rsp + 0x40]
movzx ebx, byte [rbp + 0x2410]
je 0x140001d90
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x140004535
movsxd r12, dword [rbp + 0x2400]
mov ecx, dword [rbp - 0x54]
mov rdi, r12
sub ecx, eax
add ecx, r12d
cmp ecx, 5
jg 0x140001d90
jmp 0x14000453c
mov r12d, dword [rbp + 0x2400]
movsxd rdi, r12d
cmp rdi, 0xffffffffffffffff
jle 0x140004552
mov qword [0x1401468c0], r15
mov dword [0x1401468d0], eax
mov r13d, dword [rsp + 0x40]
mov bl, 1
mov byte [rbp + 0x2410], bl
movzx r14d, bl
mov byte [rbp + 0x2418], bl
mov dword [0x1401468d4], eax
jmp 0x140001d90
cmp rdi, 0xffffffffffffffff
jle 0x140004587
mov qword [0x1401468c0], r15
mov dword [0x1401468d0], eax
cmp byte [rsp + 0x4c], 0
mov dword [0x1401468d4], eax
movzx eax, byte [0x14014258f]
cmovne eax, r15d
cmp byte [rsp + 0x4d], 0
mov byte [0x14014258f], al
je 0x1400045fc
mov eax, dword [0x140142778]
dec eax
mov dword [0x140142778], eax
test r12d, r12d
jle 0x1400045fc
test eax, eax
jne 0x1400045fc
cmp dword [0x14014685c], eax
jne 0x1400045fc
cmp dword [0x140143794], eax
jne 0x1400045fc
cmp byte [0x14014258e], al
je 0x1400045fc
mov rcx, qword [0x140142770]
lea edx, [rax + 9]
call qword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x14014258e]
test eax, eax
cmovne ecx, r15d
mov byte [0x14014258e], cl
movzx eax, byte [rbp - 0x58]
jmp 0x140004690
cmp rdi, 0xffffffffffffffff
jle 0x140004618
mov qword [0x1401468c0], r15
mov dword [0x1401468d0], eax
cmp byte [rsp + 0x4c], 0
mov dword [0x1401468d4], eax
movzx eax, byte [0x14014258f]
cmovne eax, r15d
cmp byte [rsp + 0x4d], 0
mov byte [0x14014258f], al
je 0x14000468d
mov eax, dword [0x140142778]
dec eax
mov dword [0x140142778], eax
test r12d, r12d
jle 0x14000468d
test eax, eax
jne 0x14000468d
cmp dword [0x14014685c], eax
jne 0x14000468d
cmp dword [0x140143794], eax
jne 0x14000468d
cmp byte [0x14014258e], al
je 0x14000468d
mov rcx, qword [0x140142770]
lea edx, [rax + 9]
call qword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x14014258e]
test eax, eax
cmovne ecx, r15d
mov byte [0x14014258e], cl
movzx eax, bl
movaps xmm6, xmmword [rsp + 0x24a0]
add rsp, 0x24b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret