Function at 0x14001e410
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x958
lea rbp, [rsp + 0x60]
cmp word [rcx], 0
mov r12, r9
mov r15d, r8d
mov edi, edx
mov r14, rcx
je case.0x14001e4c3.0
mov rbx, qword [0x140129398]
lea r13, [0x140000000]
mov eax, dword [0x140132168]
xor sil, sil
mov qword [rbp + 0x50], rbx
mov dword [rbp + 0x38], eax
test edx, edx
jne 0x14001e4fb
mov r8d, 6
lea rdx, str.Blind
call fcn.1400c8430
test eax, eax
jne 0x14001e4fb
movzx eax, word [r14 + 0xc]
add r14, 0xc
mov byte [0x1401324ac], 1
mov dl, 0xff
cmp ax, 0x7d
je 0x14001e506
movzx r8d, byte [rbp + 0x940]
movzx ecx, ax
cmp ecx, 0x5e
ja case.0x14001e4c3.7
movzx eax, byte [rcx + r13 + 0x1fda0]
mov ecx, dword [r13 + rax*4 + 0x1fd80]
add rcx, r13
jmp rcx
mov dl, 0x55
jmp 0x14001e4ea
mov dl, 0xaa
jmp 0x14001e4ea
mov r8b, 3
jmp case.0x14001e4c3.7
mov r8b, 0x30
jmp case.0x14001e4c3.7
mov r8b, reloc.WSOCK32.dll_ioctlsocket
jmp case.0x14001e4c3.7
mov r8b, 0xc0
movzx eax, r8b
and al, dl
mov dl, 0xff
or sil, al
movzx eax, word [r14 + 2]
add r14, 2
cmp ax, 0x7d
jne 0x14001e4a7
jmp 0x14001e506
mov byte [0x1401324ac], sil
test edi, edi
jne 0x14001e52e
mov r8d, 6
lea rdx, [0x14010a8e8]
mov rcx, r14
call fcn.1400c8430
test eax, eax
jne 0x14001e52e
mov edi, 2
add r14, 0xc
mov dword [rbp + 0x948], edi
mov eax, dword [rbx + 0x98]
xor r13d, r13d
mov dword [rbp + 0x3c], eax
mov eax, dword [rbx + 0xa0]
mov dword [rbp + 0x40], eax
lea eax, [r15 - 1]
test eax, 0xfffffffd
jne 0x14001e5d4
call fcn.1400179f0
test al, al
jne 0x14001e58b
test edi, edi
jne 0x14001e57c
call fcn.140017a60
test al, al
je 0x14001e57c
lea rdx, [0x14010ad40]
mov rcx, r14
call fcn.1400a5030
test rax, rax
jne 0x14001e58b
mov r15d, 1
mov dword [rbp + 0x950], r15d
jmp 0x14001e5d4
cmp r15d, 3
jne 0x14001e5a0
mov r15d, 2
mov dword [rbp + 0x950], r15d
jmp 0x14001e5d4
mov r15d, r13d
mov dword [rbp + 0x950], r13d
cmp dword [rbx + 0x98], r13d
jge 0x14001e5c1
mov eax, 0xffffffff
cmp dword [rbx + 0xa0], r13d
jl 0x14001e5c4
mov eax, r13d
mov dword [rbx + 0xa0], eax
mov dword [rbx + 0x98], 0xffffffff
mov byte [rbp + 8], r13b
mov ebx, r13d
test r12, r12
je 0x14001e638
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x24], eax
mov r15d, eax
test eax, eax
je 0x14001e72a
cmp eax, dword [0x1401319a0]
je 0x14001e72a
mov rcx, r12
call fcn.1400abed0
test al, al
jne 0x14001e72a
mov ecx, dword [0x1401319a0]
mov r8d, 1
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov ebx, r15d
setne byte [rbp + 8]
jmp 0x14001e72a
test byte [0x14013210e], 0xc0
je 0x14001e6dc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140132104]
cmp eax, 0x32
jae 0x14001e6dc
cmp r15d, 2
je 0x14001e6dc
cmp byte [0x1401324ac], bl
jne 0x14001e6dc
cmp edi, 2
je 0x14001e6dc
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1401319a0]
jne 0x14001e6dc
test edi, edi
je 0x14001e7cf
mov r8, r14
test r14, r14
je 0x14001e6d0
movzx edx, word [r14]
test dx, dx
je 0x14001e6d0
mov r9d, 0x4c
nop word [rax + rax]
lea rcx, [0x14010ad50]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x14001e6d3
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e6b0
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14001e6a0
mov r8, r13
test r8, r8
jne 0x14001e893
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14001e721
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x70]
mov dword [rbp + 0x70], 0x48
mov ecx, eax
mov ebx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14001e721
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14001e721
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov eax, dword [rbp + 0x940]
mov dword [rbp + 0x24], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r9, [0x1401323f0]
mov qword [0x140132490], rax
mov rdx, r9
mov ecx, r13d
mov rdi, rax
nop dword [rax]
mov r8, qword [rdx]
test r8, r8
je 0x14001e76c
cmp r8, rdi
je 0x14001e8d9
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x14001e750
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, rdi
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.1400239b0
mov dword [rbx + 8], eax
mov qword [rbx], rdi
mov cl, 1
mov dword [0x140132498], eax
call fcn.1400233e0
and byte [0x1401323ef], al
movzx ebx, al
cmp qword [0x1401301a8], r13
je 0x14001e8e9
movzx ecx, byte [0x1401300c5]
movzx eax, byte [0x1401300c7]
not al
mov byte [rbp + 3], cl
and al, cl
mov byte [rbp + 6], al
jmp 0x14001e913
mov rdx, r14
mov r9d, 0x4c
mov r10d, 0x7b
nop
test rdx, rdx
je 0x14001e6dc
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001e6dc
nop word [rax + rax]
lea rcx, [0x14010ad50]
movzx eax, r9w
nop dword [rax + rax]
cmp r8w, ax
je 0x14001e837
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e810
movzx r8d, word [rdx + 2]
add rdx, 2
test r8w, r8w
jne 0x14001e800
jmp 0x14001e6dc
test rdx, rdx
je 0x14001e6dc
add rdx, 2
je 0x14001e893
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001e893
lea rcx, [0x14010ad58]
movzx eax, r10w
nop dword [rax + rax]
cmp r8w, ax
je 0x14001e884
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e860
movzx r8d, word [rdx + 2]
add rdx, 2
test r8w, r8w
jne 0x14001e850
jmp 0x14001e893
test rdx, rdx
je 0x14001e893
cmp word [rdx], r10w
jne 0x14001e7e0
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001e8b7
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001e6dc
mov edx, 1
mov dword [0x140129390], r13d
mov ecx, 0x8000012f
call fcn.140001800
mov dword [0x140129390], 1
jmp 0x14001e893
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x14001e78f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140132104]
cmp eax, dword [0x140129d60]
jae 0x14001e90b
movzx ecx, byte [0x14013210e]
and cl, bl
mov byte [rbp + 3], cl
jmp 0x14001e90f
mov byte [rbp + 3], r13b
mov byte [rbp + 6], r13b
movzx r13d, byte [0x1401323ee]
and r13b, bl
mov byte [rbp + 5], 0
cmp byte [0x1401324ac], 0
mov byte [rbp + 0x940], r13b
mov byte [0x1401323ee], r13b
je 0x14001e967
mov byte [rbp + 0x940], bl
movzx r13d, bl
mov byte [rbp], bl
test sil, sil
je 0x14001e96b
movzx eax, sil
not al
and al, bl
movzx r13d, al
mov byte [rbp + 0x940], al
mov byte [rbp], al
xor al, bl
mov byte [rbp + 5], al
jmp 0x14001e96b
mov byte [rbp], r13b
mov rax, qword [rbp + 0x50]
cmp byte [rax + 0xc4], 0
je 0x14001e99b
cmp byte [0x1401324ac], 0
jne 0x14001e99b
cmp dword [rbp + 0x948], 2
je 0x14001e99b
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140022a10
mov dword [rbp + 0x20], eax
jmp 0x14001e9a0
xor edx, edx
mov dword [rbp + 0x20], edx
mov ecx, dword [rbp + 0x950]
mov eax, 0x1f4
mov dword [0x1401324b8], ecx
mov edi, 0x5dc
test ecx, ecx
je 0x14001ea46
cmp ecx, 1
mov edx, 0x2ee0
cmovne eax, edi
mov dword [0x1401324a0], eax
mov eax, 0x4e20
cmovne eax, edx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001e9ea
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e19f0
mov rax, qword [0x14012c318]
sub rsp, rcx
mov byte [0x1401324a8], bl
xor ebx, ebx
mov byte [0x1401324a9], 0
mov dword [0x14013249c], ebx
lea rcx, [rsp + 0x60]
mov byte [0x1401324aa], bl
mov qword [rax], rcx
mov ecx, dword [rbp + 0x950]
mov dword [0x1401324b0], 0x80000000
mov dword [0x1401324b4], 0x80000000
mov byte [0x1401324ab], 1
jmp 0x14001ea48
xor ebx, ebx
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
movzx esi, byte [0x14012fe84]
add eax, 0xfffffff9
mov byte [rbp + 0xa], sil
test eax, 0xfffffffd
jne 0x14001ea84
test ecx, ecx
jne 0x14001ea84
test r12, r12
jne 0x14001ea84
mov ecx, 1
mov byte [rbp + 9], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14012fe84], 1
jmp 0x14001ea88
mov byte [rbp + 9], 0
xor r15b, r15b
cmp word [r14], 0
mov byte [rbp + 1], r15b
jne 0x14001eaf7
movzx r12d, byte [rbp + 0x940]
cmp dword [0x1401324b8], 0
je 0x14001fadb
cmp byte [0x1401324aa], 0
mov ebx, 0xffffffff
mov dword [rbp + 0x940], ebx
jne 0x14001faa4
cmp dword [0x14013249c], 0
jbe 0x14001faa4
cmp byte [0x1401324ac], 0
je 0x14001fa5b
movzx ebx, byte [rbp + 5]
jmp 0x14001fa64
movzx r13d, byte [rbp + 0x940]
xor ebx, ebx
mov r12, qword [rbp + 0x958]
cmp dword [0x1401324b8], 0
mov byte [rbp + 4], 0
jne 0x14001eb67
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140129398]
sub eax, dword [0x140132168]
cmp eax, dword [rcx + 0x88]
jbe 0x14001eb67
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp + 0xc0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001eb5b
mov edx, 1
mov dword [0x140129390], ebx
mov ecx, 0xffffffff
call fcn.140001800
mov dword [0x140129390], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140132168], eax
mov esi, dword [rbp + 0x948]
test esi, esi
jne 0x14001f726
movzx edx, word [r14]
lea rcx, [0x14010ad60]
call fcn.1400c42b8
test rax, rax
je 0x14001f781
movzx eax, word [r14]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x14001ebb9.34
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x1fe1c]
mov ecx, dword [rdx + rax*4 + 0x1fe00]
add rcx, rdx
jmp rcx
test r13b, 3
jne case.0x14001ebb9.34
or r15b, 1
jmp 0x14001fa28
test r13b, 0x30
jne case.0x14001ebb9.34
or r15b, 0x10
jmp 0x14001fa28
test r13b, 0xc
jne case.0x14001ebb9.34
or r15b, 4
jmp 0x14001fa28
test r13b, 0xc0
jne case.0x14001ebb9.34
or r15b, 0x40
jmp 0x14001fa28
mov edx, 0x7d
lea rcx, [r14 + 2]
call fcn.1400c42b8
mov qword [rbp + 0x48], rax
mov rdi, rax
test rax, rax
je case.0x14001ebb9.34
movzx ecx, word [r14 + 2]
add r14, 2
cmp cx, 0x20
je 0x14001ec25
cmp cx, 9
je 0x14001ec25
mov r12, rax
sub r12, r14
sar r12, 1
jne 0x14001ecf6
lea rcx, [rax + 2]
movzx eax, word [rax + 2]
cmp ax, 0x7d
jne 0x14001ec69
mov rdi, rcx
mov qword [rbp + 0x48], rcx
mov r12d, 1
jmp 0x14001ed03
cmp ax, 0x20
je 0x14001ec79
cmp ax, 9
jne 0x14001ee4c
mov rbx, rcx
nop dword [rax]
cmp ax, 0x20
je 0x14001ec8c
cmp word [rbx], 9
jne 0x14001ec96
movzx eax, word [rbx + 2]
add rbx, 2
jmp 0x14001ec80
mov r8d, 4
mov qword [rbp + 0x30], rbx
lea rdx, str.Down
mov rcx, rbx
call fcn.1400c8430
test eax, eax
je 0x14001ecd0
mov r8d, 2
lea rdx, [0x140109aa8]
mov rcx, rbx
call fcn.1400c8430
test eax, eax
jne 0x14001ee4c
mov edx, 0x7d
mov rcx, rbx
call fcn.1400c42b8
mov qword [rbp + 0x48], rax
mov rdi, rax
test rax, rax
je case.0x14001ebb9.34
mov r12, rax
sub r12, r14
sar r12, 1
cmp r12, 0x400
jae 0x14001ee4c
lea rbx, [r12 + r12]
mov rdx, r14
mov r8, rbx
lea rcx, [rbp + 0xf0]
call fcn.1400e5b10
xor esi, esi
lea rdx, str.Click
mov r8d, 5
mov word [rbp + rbx + 0xf0], si
lea rcx, [rbp + 0xf0]
call fcn.1400c8430
test eax, eax
jne 0x14001ee2a
lea rcx, [rbp + 0xfa]
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001ed5f
cmp ax, 9
jne 0x14001ed65
add rcx, 2
jmp 0x14001ed50
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 2]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x14]
lea rax, [rbp + 0xc]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x20], rax
call fcn.140020f00
mov ecx, dword [rbp + 0x10]
cmp ecx, 1
jge 0x14001edd2
mov rax, qword [rbp + 0x50]
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x14]
lea rcx, [rbp + 0x18]
movzx r9d, byte [rax + 0xc3]
movzx eax, byte [rbp + 7]
mov byte [rsp + 0x20], al
call fcn.140021d10
movzx r12d, byte [rbp + 0x940]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
jmp 0x14001fa30
movzx eax, byte [rbp + 7]
xor edx, edx
mov byte [rsp + 0x50], al
movzx r9d, r13b
mov eax, dword [rbp + 0x14]
movzx r8d, r15b
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x18]
mov dword [rsp + 0x40], eax
mov rax, qword [rbp + 0x958]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0xc]
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
movzx ecx, byte [rbp + 2]
call fcn.14001fe80
movzx r12d, byte [rbp + 0x940]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
jmp 0x14001fa30
lea rdx, [0x14010ad80]
lea rcx, [rbp + 0xf0]
call fcn.1400c8244
test eax, eax
jne 0x14001ee60
mov eax, 1
mov dword [rbp + 0x948], eax
movzx r12d, byte [rbp + 0x940]
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001fa30
lea rdx, str.Text
lea rcx, [rbp + 0xf0]
call fcn.1400c8244
test eax, eax
jne 0x14001ee96
movzx r12d, byte [rbp + 0x940]
mov eax, 2
mov r14, qword [rbp + 0x48]
xor r15b, r15b
mov dword [rbp + 0x948], eax
jmp 0x14001fa30
movzx edx, word [rbp + 0xf0]
lea r8, [rbp + 0xf0]
mov r15d, 2
mov r13d, 1
mov dword [rbp + 0xc], r15d
mov r14, r12
mov dword [rbp + 0x10], r13d
test dx, dx
je 0x14001efd0
nop dword [rax]
nop dword [rax + rax]
lea rcx, [0x14010ad94]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14001ef01
add rcx, r15
movzx eax, word [rcx]
test ax, ax
jne 0x14001eee0
add r8, r15
movzx edx, word [r8]
test dx, dx
jne 0x14001eed0
jmp 0x14001efd0
test r8, r8
je 0x14001efd0
lea rax, [rbp + 0xf0]
mov word [r8], si
mov r14, r8
lea rbx, [r8 + 2]
sub r14, rax
sar r14, 1
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14001ef31
cmp ax, 9
jne 0x14001ef36
add rbx, r15
jmp 0x14001ef22
mov rax, rdi
mov qword [rbp + 0x30], rbx
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14001efd0
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call fcn.1400c8430
test eax, eax
jne 0x14001efa6
mov r8d, 4
mov dword [rbp + 0xc], esi
lea rdx, str.Temp
mov r15d, esi
lea rcx, [rbx + 8]
call fcn.1400c8430
test eax, eax
jne 0x14001ef89
mov dword [rbp + 0x1c], esi
jmp 0x14001efd0
cmp word [rbx + 8], 0x52
mov ecx, esi
sete cl
call fcn.1400d40b8
test eax, eax
mov ebx, esi
setne bl
inc ebx
mov dword [rbp + 0x1c], ebx
jmp 0x14001efd0
lea rdx, [0x140109aa8]
mov rcx, rbx
call fcn.1400c8244
test eax, eax
jne 0x14001efc2
mov r15d, r13d
mov dword [rbp + 0xc], r13d
jmp 0x14001efd0
mov rcx, rbx
call fcn.1400a5590
mov r13, rax
mov dword [rbp + 0x10], eax
mov rcx, qword [0x140132490]
lea rdx, [rbp + 1]
mov qword [rsp + 0x20], rcx
mov r8b, 1
lea rcx, [rbp + 0xf0]
call fcn.140024000
mov byte [rbp + 2], al
movzx edi, al
test al, al
jne 0x14001f08b
xor edx, edx
lea rcx, [rbp + 0xf0]
call fcn.140023f10
movzx esi, ax
test ax, ax
jne 0x14001f08b
mov r8d, 2
lea rdx, [0x14010a738]
lea rcx, [rbp + 0xf0]
call fcn.1400c8430
test eax, eax
jne 0x14001f08b
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xf4]
call fcn.1400ce8fc
mov rcx, qword [rbp + 0x28]
lea rdx, [0x14010af08]
mov r8d, 2
mov ebx, eax
call fcn.1400c8430
test eax, eax
jne 0x14001f08b
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x28]
add rcx, 4
mov r8d, reloc.WSOCK32.dll_recv
call fcn.1400ce8fc
mov rcx, qword [rbp + 0x28]
cmp word [rcx], si
jne 0x14001f08b
movzx edi, bl
mov byte [rbp + 2], bl
movzx esi, ax
cmp r13d, 1
jl 0x14001ee4c
test dil, dil
jne 0x14001f574
test si, si
jne 0x14001f574
cmp r14, 1
jne 0x14001f13e
cmp r15d, r14d
je 0x14001ee4c
mov r14, qword [rbp + 0x958]
test r14, r14
je 0x14001f113
test r13d, r13d
jle 0x14001ee4c
mov ebx, r13d
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [rbp + 0xf0]
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
sub rbx, 1
jne 0x14001f0e0
movzx r12d, byte [rbp + 0x940]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
jmp 0x14001fa30
movzx r8d, byte [rbp + 1]
mov edx, r13d
movzx r12d, byte [rbp + 0x940]
movzx ecx, word [rbp + 0xf0]
or r8b, r12b
call fcn.1400200e0
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001fa30
mov r14, qword [rbp + 0x958]
lea r9, [rbp]
test r14, r14
lea r8, [rbp + 0xc]
mov rdx, r12
lea rcx, [rbp + 0xf0]
sete al
mov byte [rsp + 0x20], al
call fcn.140024260
mov byte [rbp + 2], al
movzx edi, al
test al, al
je 0x14001f30a
mov esi, dword [rbp + 0xc]
test r14, r14
jne 0x14001f208
test esi, esi
jne 0x14001f189
mov byte [rbp + 4], al
jmp 0x14001f208
cmp dword [0x1401323e8], 0
jne 0x14001f208
cmp byte [0x1401323ed], dil
je 0x14001f208
cmp byte [0x1401324ac], 0
jne 0x14001f208
movzx ecx, byte [0x1401323ec]
lea eax, [rdi - 0x5b]
cmp al, 1
ja 0x14001f1c2
lea eax, [rcx - 0x5b]
cmp al, 1
ja 0x14001f1c2
cmp dword [0x1401324b8], 2
jne 0x14001f1df
cmp dil, 0xa4
je 0x14001f1d7
cmp dil, 0xa5
jne 0x14001f208
cmp dword [0x140132498], 3
je 0x14001f208
add cl, 0x5c
cmp cl, 1
ja 0x14001f208
movzx r8d, word [0x1401293b4]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov ecx, 2
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
call fcn.140020610
cmp dword [0x1401324b8], 0
je 0x14001f21a
movzx eax, byte [0x1401324a8]
jmp 0x14001f221
xor ecx, ecx
call fcn.1400233e0
movzx r12d, byte [rbp]
xor r9d, r9d
movzx ecx, r12b
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r14
mov byte [rsp + 0x20], 0
movzx edx, al
mov byte [rbp + 0x940], r12b
call fcn.140022b60
test r13d, r13d
jle 0x14001ee54
mov ebx, r13d
xor r12d, r12d
nop dword [rax + rax]
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
mov r9, r14
mov byte [rsp + 0x20], 1
movzx edx, dil
mov ecx, esi
call fcn.140020610
cmp dword [0x1401324b8], r12d
jne 0x14001f2ec
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140129398]
sub eax, dword [0x140132168]
cmp eax, dword [rcx + 0x88]
jbe 0x14001f2ec
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, [rbp + 0xc0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001f2e0
mov edx, 1
mov dword [0x140129390], r12d
mov ecx, 0xffffffff
call fcn.140001800
mov dword [0x140129390], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140132168], eax
sub rbx, 1
jne 0x14001f260
movzx r12d, byte [rbp + 0x940]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
jmp 0x14001fa30
cmp r12, 4
jbe 0x14001f38b
lea rdx, [0x14010adb0]
lea rcx, [rbp + 0xf0]
call fcn.1400c8244
test eax, eax
jne 0x14001f391
test r14, r14
jne 0x14001f391
mov rcx, qword [rbp + 0x30]
call fcn.1400202e0
cmp dword [0x1401324b8], 2
mov rax, qword [0x140129398]
jne 0x14001f368
mov ecx, dword [rax + 0x9c]
call fcn.140022630
movzx r12d, byte [rbp]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
mov byte [rbp + 0x940], r12b
jmp 0x14001fa30
mov ecx, dword [rax + 0x98]
call fcn.140022630
movzx r12d, byte [rbp]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
mov byte [rbp + 0x940], r12b
jmp 0x14001fa30
cmp r12, 2
jbe 0x14001f373
mov r8d, 2
lea rdx, [0x14010adb8]
lea rcx, [rbp + 0xf0]
call fcn.1400c8430
test eax, eax
jne 0x14001f373
xor edx, edx
lea rcx, [rbp + 0xf4]
mov r8d, reloc.WSOCK32.dll_recv
call fcn.1400ce848
cmp eax, 0x10000
jb 0x14001f3f5
add eax, 0xffff0000
mov edx, 0x3ff
mov ecx, eax
movzx ebx, ax
shr ecx, 0xa
and bx, dx
and cx, dx
mov r8d, 0x2800
sub cx, r8w
mov edx, 0x2400
sub bx, dx
jmp 0x14001f3fc
xor edx, edx
movzx ecx, ax
mov ebx, edx
movzx r12d, byte [rbp]
mov byte [rbp + 0x940], r12b
test r14, r14
je 0x14001f445
movzx r8d, cx
xor r9d, r9d
mov rcx, r14
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
test bx, bx
je 0x14001f536
movzx r8d, bx
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001f536
cmp dword [0x1401324b8], 2
je 0x14001f478
movzx edi, byte [rbp + 1]
or dil, r12b
movzx edx, dil
call fcn.14001e170
test bx, bx
je 0x14001f536
movzx edx, dil
movzx ecx, bx
call fcn.14001e170
jmp 0x14001f536
mov ecx, gethostbyaddr
lea rdx, [rbp + 0x62]
mov word [rbp + 0x60], cx
mov r8d, 0xa
mov ecx, eax
call fcn.1400cd5a4
cmp dword [0x1401324b8], 0
je 0x14001f4a4
movzx eax, byte [0x1401324a8]
jmp 0x14001f4ab
xor ecx, ecx
call fcn.1400233e0
movzx ecx, al
mov dword [rsp + 0x28], 0xffc3d44f
and cl, 0xc4
mov byte [rsp + 0x20], 1
or cl, 4
xor r9d, r9d
xor r8d, r8d
movzx edx, al
call fcn.140022b60
movzx eax, word [rbp + 0x60]
lea rbx, [rbp + 0x60]
cmp ax, 0x30
jb 0x14001f517
nop dword [rax]
cmp ax, 0x39
ja 0x14001f517
movzx edx, byte [rbx]
xor r8d, r8d
add dl, 0x30
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov ecx, 2
call fcn.140020610
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x30
jae 0x14001f4e0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov ecx, 1
call fcn.140020610
cmp dword [0x1401324b8], 2
mov rax, qword [0x140129398]
jne 0x14001f55d
mov ecx, dword [rax + 0x9c]
call fcn.140022630
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001fa30
mov ecx, dword [rax + 0x98]
call fcn.140022630
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001fa30
xor r8d, r8d
movzx edx, si
movzx ecx, dil
call fcn.140023680
mov r14, qword [rbp + 0x958]
movzx ebx, al
test al, al
je 0x14001f6c8
test r14, r14
jne 0x14001f6c8
test r15d, r15d
jne 0x14001f5f6
mov eax, dword [rbp + 0x1c]
mov byte [rbp + 4], dil
cmp eax, 1
jne 0x14001f5d0
movzx r12d, byte [rbp + 0x940]
or byte [0x1401323ee], bl
or r12b, bl
mov byte [rbp + 0x940], r12b
mov byte [rbp], r12b
jmp 0x14001f6d0
cmp eax, 2
jne 0x14001f5db
or byte [0x1401323ef], bl
movzx r12d, byte [rbp + 0x940]
or r12b, bl
mov byte [rbp + 0x940], r12b
mov byte [rbp], r12b
jmp 0x14001f6d0
cmp r15d, 1
jne 0x14001f6c8
cmp dword [0x1401323e8], 0
jne 0x14001f681
cmp byte [0x1401323ed], dil
je 0x14001f681
cmp byte [0x1401324ac], 0
jne 0x14001f681
movzx ecx, byte [0x1401323ec]
lea eax, [rdi - 0x5b]
cmp al, r15b
ja 0x14001f63b
lea eax, [rcx - 0x5b]
cmp al, r15b
ja 0x14001f63b
cmp dword [0x1401324b8], 2
jne 0x14001f658
cmp dil, 0xa4
je 0x14001f650
cmp dil, 0xa5
jne 0x14001f681
cmp dword [0x140132498], 3
je 0x14001f681
add cl, 0x5c
cmp cl, 1
ja 0x14001f681
movzx r8d, word [0x1401293b4]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov ecx, 2
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
call fcn.140020610
movzx r12d, byte [rbp + 0x940]
movzx eax, bl
not al
and byte [0x1401323ee], al
and r12b, al
and byte [0x1401323ef], al
mov byte [rbp + 0x940], r12b
mov byte [rbp], r12b
cmp dil, 0xa5
jne 0x14001f6d0
cmp dword [0x140132498], 3
jne 0x14001f6d0
and r12b, 0xfe
mov byte [rbp + 0x940], r12b
mov byte [rbp], r12b
jmp 0x14001f6d0
movzx r12d, byte [rbp + 0x940]
movzx r8d, byte [rbp + 1]
movzx r9d, r12b
mov byte [rsp + 0x50], 0
movzx edx, si
mov dword [rsp + 0x48], 0x80000000
movzx ecx, dil
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
call fcn.14001fe80
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001fa30
movzx r12d, byte [rbp + 0x940]
jmp 0x14001fa34
cmp esi, 2
jne 0x14001f781
movzx ecx, word [r14]
sub ecx, 8
je 0x14001f775
sub ecx, 1
je 0x14001f769
sub ecx, 1
je 0x14001f75d
cmp ecx, 3
je 0x14001f74f
mov byte [rbp + 2], 0
xor dil, dil
jmp 0x14001f853
cmp word [r14 + 2], 0xa
lea rax, [r14 + 2]
cmove r14, rax
mov byte [rbp + 2], recv
mov dil, ntohs
jmp 0x14001f853
mov byte [rbp + 2], 9
mov dil, 9
jmp 0x14001f853
mov byte [rbp + 2], 8
mov dil, 8
jmp 0x14001f853
movzx eax, r15b
or al, r13b
je 0x14001f793
test esi, esi
jne 0x14001f793
mov sil, 1
jmp 0x14001f796
xor sil, sil
movzx ebx, word [r14]
cmp bx, 0xa
jne 0x14001f7a8
mov dil, ntohs
jmp 0x14001f84f
mov rdx, qword [0x140132490]
movzx ecx, bx
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rdi, ax
mov rcx, rdi
shr rcx, 8
cmp cl, 0xff
jne 0x14001f809
cmp dil, 0xff
jne 0x14001f809
test sil, sil
je 0x14001f80e
lea eax, [rbx - 0x41]
cmp ax, 0x19
lea eax, [rbx - 0x61]
ja 0x14001f7ea
cmp ax, 0x19
jbe 0x14001f7f0
movzx eax, bx
jmp 0x14001f7fb
cmp ax, 0x19
ja 0x14001f80e
movzx eax, bx
mov ecx, 0xffdf
and ax, cx
sub bx, 0x41
movzx edi, al
cmp bx, 0x19
setbe cl
test cl, 0x38
je 0x14001f813
xor dil, dil
jmp 0x14001f84f
movzx eax, cl
and al, 6
cmp al, 6
jne 0x14001f822
or r15b, 8
jmp 0x14001f840
test cl, 2
je 0x14001f831
test r15b, 3
jne 0x14001f831
or r15b, 1
test cl, 4
je 0x14001f840
test r15b, 0xc
jne 0x14001f840
or r15b, 4
test cl, 1
je 0x14001f84f
test r15b, 0x30
jne 0x14001f84f
or r15b, 0x10
mov byte [rbp + 2], dil
test dil, dil
je 0x14001f9f5
or r15b, r13b
lea eax, [rdi - 1]
cmp al, 5
ja 0x14001f86c
cmp dil, 3
jne 0x14001f873
lea eax, [rdi + 0x66]
cmp al, 5
ja 0x14001f878
mov sil, 1
jmp 0x14001f880
xor sil, sil
nop dword [rax + rax]
cmp dword [0x1401324b8], 0
jne 0x14001f8eb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140129398]
sub eax, dword [0x140132168]
cmp eax, dword [rcx + 0x88]
jbe 0x14001f8eb
xor ebx, ebx
lea rcx, [rbp + 0x70]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001f8df
mov edx, 1
mov dword [0x140129390], ebx
mov ecx, 0xffffffff
call fcn.140001800
mov dword [0x140129390], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140132168], eax
mov rax, qword [0x140129398]
movzx ecx, byte [rax + 0xc5]
test cl, cl
je 0x14001f906
mov ebx, 0xffc3d44d
sub ebx, ecx
jmp 0x14001f90b
mov ebx, 0xffc3d44f
cmp dword [0x1401324b8], 0
je 0x14001f91d
movzx eax, byte [0x1401324a8]
jmp 0x14001f924
xor ecx, ecx
call fcn.1400233e0
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov r8, r12
mov byte [rsp + 0x20], 1
movzx edx, al
movzx ecx, r15b
call fcn.140022b60
test sil, sil
je 0x14001f981
test r12, r12
jne 0x14001f981
mov rax, qword [0x140129398]
mov edx, 0x80000000
mov byte [rsp + 0x30], r12b
mov r9d, 1
mov dword [rsp + 0x28], 2
mov r8d, edx
movzx ecx, byte [rax + 0xc3]
mov dword [rsp + 0x20], ecx
movzx ecx, dil
call fcn.140021840
jmp 0x14001f9b3
mov rax, qword [0x140129398]
xor r8d, r8d
mov r9, r12
movzx edx, dil
movzx ecx, byte [rax + 0xc5]
mov eax, 0xffc3d44d
sub eax, ecx
mov ecx, 2
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], 1
call fcn.140020610
cmp dword [0x1401324b8], 0
je 0x14001f9c5
movzx eax, byte [0x1401324a8]
jmp 0x14001f9cc
xor ecx, ecx
call fcn.1400233e0
movzx edx, r13b
not dl
and dl, al
and dl, 0xcc
je 0x14001fa25
mov dword [rsp + 0x28], 0xffc3d44d
mov r9b, 1
mov r8, r12
mov byte [rsp + 0x20], 0
xor ecx, ecx
call fcn.140022b60
jmp 0x14001fa25
movzx ecx, word [r14]
test r12, r12
je 0x14001fa14
mov r8d, ecx
xor r9d, r9d
mov rcx, r12
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001fa25
or r15b, r13b
mov edx, 1
movzx r8d, r15b
call fcn.1400200e0
xor r15b, r15b
movzx r12d, byte [rbp + 0x940]
mov byte [rbp + 1], r15b
movzx eax, byte [rbp + 4]
add r14, 2
mov byte [0x1401323ed], al
cmp word [r14], 0
jne 0x14001eae6
movzx esi, byte [rbp + 0xa]
mov edi, 0x5dc
jmp 0x14001ea9e
movzx ebx, byte [rbp + 6]
not bl
and bl, byte [rbp + 3]
or bl, byte [0x1401323ef]
mov r9b, 1
movzx edx, byte [0x1401324a8]
or bl, r12b
movzx ecx, bl
mov dword [rsp + 0x28], 0xffc3d44d
xor r8d, r8d
mov byte [rsp + 0x20], 1
call fcn.140022b60
movzx edx, bl
lea rcx, [rbp + 0x940]
call fcn.140022490
mov ebx, dword [rbp + 0x940]
cmp dword [0x1401324b8], 1
mov eax, 0x1f4
cmove edi, eax
cmp dword [0x1401324a0], edi
jbe 0x14001fac7
mov rcx, qword [0x140130358]
call fcn.1400c83c0
xor edi, edi
mov ecx, ebx
mov dword [0x1401324b8], edi
call fcn.140022630
jmp 0x14001fb82
cmp qword [0x1401301a8], 0
je 0x14001faf2
movzx ecx, byte [0x1401300c5]
movzx edx, byte [rbp + 3]
jmp 0x14001fb1e
cmp dword [0x140129d60], 0
jl 0x14001fb17
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140132104]
cmp eax, dword [0x140129d60]
jb 0x14001fb17
movzx edx, byte [rbp + 3]
xor cl, cl
jmp 0x14001fb1e
movzx edx, byte [rbp + 3]
movzx ecx, dl
or cl, byte [0x1401323ef]
cmp byte [0x1401324ac], 0
je 0x14001fb46
or r12b, byte [rbp + 5]
movzx eax, cl
xor al, dl
movzx ebx, al
and al, cl
and bl, dl
not bl
and bl, r12b
or bl, al
jmp 0x14001fb51
movzx ebx, byte [rbp + 6]
not bl
and bl, cl
or bl, r12b
xor ecx, ecx
call fcn.1400233e0
or al, byte [0x1401300c4]
mov r9b, 1
mov r8, qword [rbp + 0x958]
movzx edx, al
mov dword [rsp + 0x28], 0xffc3d44d
movzx ecx, bl
mov byte [rsp + 0x20], 1
call fcn.140022b60
xor edi, edi
cmp qword [0x1401301a8], 0
je 0x14001fba8
movzx ecx, byte [0x1401300c6]
movzx eax, cl
xor al, byte [0x1401300c7]
and al, cl
not al
and cl, al
mov byte [0x1401300c6], cl
cmp dword [rbp + 0x20], 1
jne 0x14001fc4b
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
jne 0x14001fc4b
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14001fbf4
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayLock
mov ecx, 1
call fcn.140020610
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayLock
mov ecx, 2
call fcn.140020610
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1401319a0]
jne 0x14001fc4b
mov edx, 1
mov dword [0x140129390], edi
mov ecx, 0xffffffff
call fcn.140001800
mov dword [0x140129390], 1
cmp byte [rbp + 8], 0
je 0x14001fc63
mov edx, dword [rbp + 0x24]
xor r8d, r8d
mov ecx, dword [0x1401319a0]
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rbp + 9], 0
je 0x14001fc7d
test sil, sil
jne 0x14001fc7d
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14012fe84], sil
mov eax, dword [rbp + 0x950]
test eax, eax
jne 0x14001fd19
mov eax, dword [rbp + 0x38]
cmp dword [0x140132168], eax
je 0x14001fd56
cmp dword [0x140129390], 0
je 0x14001fd56
cmp byte [0x14012fe66], 0
jne 0x14001fd56
cmp dword [0x14012fea0], 0
je 0x14001fd08
mov rcx, qword [0x140129398]
cmp byte [rcx + 0x7a], 0
jne 0x14001fd08
cmp dword [rcx + 0x70], 0xffffffff
jle 0x14001fd02
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140129398]
sub eax, dword [rcx + 0x74]
cmp eax, dword [rcx + 0x70]
jb 0x14001fd02
cmp dword [rcx + 0x6c], 0
je 0x14001fd02
cmp byte [rcx + 0xc2], 0
mov byte [rcx + 0x7a], 1
jne 0x14001fd02
mov dword [rcx + 0x88], 5
cmp byte [rcx + 0x7a], 0
je 0x14001fd56
mov edx, 1
mov ecx, 0xffffffff
call fcn.140001800
jmp 0x14001fd56
cmp eax, 1
jne 0x14001fd56
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1401319a0]
jne 0x14001fd56
mov edx, 1
mov dword [0x140129390], edi
mov ecx, 0xffffffff
call fcn.140001800
mov dword [0x140129390], 1
mov rax, qword [rbp + 0x50]
mov ecx, dword [rbp + 0x3c]
mov dword [rax + 0x98], ecx
mov ecx, dword [rbp + 0x40]
mov dword [rax + 0xa0], ecx
lea rsp, [rbp + 0x8f8]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret