Function at 0x1400016f0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get graphical window text
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1228]
mov eax, 0x1328
call fcn.1400def50
sub rsp, rax
mov ebx, edx
mov edi, ecx
mov byte [rsp + 0x4d], 0
mov r14d, 1
cmp edx, 2
jne 0x140001749
mov ebx, r14d
mov dword [rbp + 0x1278], ebx
cmp byte [0x14012bb37], 0
jne 0x140001749
mov byte [0x14012bb37], bl
mov byte [rsp + 0x4d], bl
xor edx, edx
cmp ecx, 0x8000012f
jne 0x140001770
mov edi, 0xa
mov dword [rbp + 0x1270], edi
mov byte [rbp + 0x1280], r14b
mov ecx, edi
mov dword [rsp + 0x40], ecx
mov dword [rbp - 0x48], edx
jmp 0x140001790
cmp ecx, 5
setle al
mov byte [rbp + 0x1280], al
mov dword [rsp + 0x40], ecx
jg 0x140001787
mov dword [rbp - 0x48], edx
jmp 0x140001790
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x48], eax
cmp dword [0x14012bfec], 0
je 0x14000179e
call fcn.140004250
xor sil, sil
mov dword [rsp + 0x70], esi
cmp dword [0x14012ddbc], 0
je 0x1400017c1
call fcn.140003f30
movzx esi, sil
test al, al
cmovne esi, r14d
mov dword [rsp + 0x70], esi
test edi, edi
jle 0x140001805
cmp ebx, r14d
jne 0x140001805
mov byte [rsp + 0x4e], r14b
inc dword [0x14012bb90]
cmp byte [0x14012bb36], 0
jne 0x14000180a
xor r9d, r9d
mov edx, 9
mov r8d, 0xa
mov rcx, qword [0x14012bb88]
call qword [sym.imp.USER32.dll_SetTimer]
test rax, rax
setne byte [0x14012bb36]
jmp 0x14000180a
mov byte [rsp + 0x4e], 0
mov byte [rsp + 0x54], 0
xor al, al
mov byte [rbp + 0x1288], al
xor r10d, r10d
mov r15d, r10d
mov dword [rsp + 0x48], r10d
movzx ecx, byte [rbp + 0x1270]
mov qword [rbp - 0x10], rcx
mov r12, qword [rbp + 0x1280]
mov r13, qword [rbp + 0x1280]
jmp 0x140001845
mov r15d, dword [rsp + 0x48]
movzx esi, byte [rbp + 0x1280]
mov r14d, dword [rsp + 0x40]
test r14d, r14d
jle 0x1400019cf
test al, al
jne 0x1400019cf
cmp byte [0x14012bb37], al
jne 0x1400019dc
cmp dword [0x1401251d0], 0
je 0x1400018e5
cmp dword [0x14012bb3c], 0
jne 0x1400018e5
cmp dword [0x14012bb68], 0
jne 0x140001890
mov eax, 1
jmp 0x1400018e8
mov rcx, qword [0x1401251d8]
cmp byte [rcx + 0x7f], 0
jne 0x1400018d8
cmp dword [rcx + 0x70], 0xffffffff
jle 0x1400018d8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1401251d8]
sub eax, dword [rcx + 0x74]
xor r10d, r10d
cmp eax, dword [rcx + 0x70]
jb 0x1400018d8
cmp dword [rcx + 0x6c], r10d
je 0x1400018d8
mov byte [rcx + 0x7f], 1
cmp byte [rcx + 0xc2], r10b
jne 0x1400018d8
mov dword [rcx + 0x88], 5
mov rax, qword [0x1401251d8]
movzx eax, byte [rax + 0x7f]
jmp 0x1400018e8
mov eax, r10d
mov r9d, 0x311
test eax, eax
cmovne r9d, r10d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x140001de8
inc r15d
mov dword [rsp + 0x48], r15d
mov r8d, dword [0x14012d670]
test r8d, r8d
je 0x140001d1c
mov rdi, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x78]
mov ebx, dword [rbp - 0x80]
mov r14, qword [rsp + 0x78]
xor r15b, r15b
lea rax, [0x14012d660]
mov qword [rbp + 0x58], rax
mov rax, qword [0x14012d668]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x6c], r8d
mov byte [rbp + 0x70], r15b
lea rax, [rbp + 0x58]
mov qword [0x14012d668], rax
xor eax, eax
mov edx, eax
mov dword [rbp + 0x68], eax
test r8d, r8d
jle 0x140001d07
movsxd rcx, edx
add rcx, rcx
mov rax, qword [0x14012d660]
cmp dword [rax + rcx*8 + 8], ebx
jne 0x1400019c0
lea rax, [rbp + 0x118]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8d, ebx
mov rdx, r14
lea rcx, [rbp + 0x58]
call fcn.140004470
test al, al
jne 0x140001d04
mov r8d, dword [rbp + 0x6c]
mov edx, dword [rbp + 0x68]
inc edx
mov dword [rbp + 0x68], edx
cmp edx, r8d
jl 0x140001971
jmp 0x140001d07
cmp byte [0x14012bb37], 0
je 0x140001bc6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140001bc3
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x14012d658]
jne 0x140001bc3
cmp dword [0x14012bb80], 0
je 0x140001a57
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x120]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
xor r8d, r8d
mov ecx, r8d
lea rdx, [rbp + 0x120]
lea r9, str.32770
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x140001a57
cmp rcx, 7
jne 0x140001a40
jmp 0x140001ab1
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x140001bc3
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x120]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysTreeView32
lea rcx, [rbp + 0x120]
call fcn.1400c5794
test eax, eax
je 0x140001aae
lea rdx, str.SysListView32
lea rcx, [rbp + 0x120]
call fcn.1400c5794
test eax, eax
jne 0x140001bc3
xor r8d, r8d
cmp dword [0x1401251d0], 0
je 0x140001b1e
cmp dword [0x14012bb3c], 0
jne 0x140001b1e
cmp dword [0x14012bb68], 0
jne 0x140001ad3
mov eax, 1
jmp 0x140001b21
mov rcx, qword [0x1401251d8]
cmp byte [rcx + 0x7f], 0
jne 0x140001b18
cmp dword [rcx + 0x70], 0xffffffff
jle 0x140001b18
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1401251d8]
sub eax, dword [rcx + 0x74]
cmp eax, dword [rcx + 0x70]
jb 0x140001b18
cmp dword [rcx + 0x6c], 0
je 0x140001b18
mov byte [rcx + 0x7f], 1
cmp byte [rcx + 0xc2], 0
jne 0x140001b18
mov dword [rcx + 0x88], 5
movzx eax, byte [rcx + 0x7f]
jmp 0x140001b21
mov eax, r8d
mov ebx, 0x311
test eax, eax
mov eax, 0xffffffff
cmovne ebx, eax
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, 0x1ff
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_PeekMessageW]
mov r9d, ebx
xor edx, edx
mov r8d, 0x20f
lea rcx, [rsp + 0x78]
test eax, eax
je 0x140001c58
mov edi, dword [rbp - 0x68]
xor eax, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_PeekMessageW]
mov dword [rsp + 0x20], 1
xor edx, edx
lea rcx, [rsp + 0x78]
test eax, eax
jne 0x140001ba0
mov r9d, 0x1ff
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [rbp + 0x1270]
jmp 0x140001c66
mov eax, dword [rbp - 0x68]
sub eax, edi
test eax, eax
jg 0x140001b86
mov r9d, ebx
mov r8d, 0x20f
call qword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [rbp + 0x1270]
jmp 0x140001c66
xor r10d, r10d
cmp dword [0x1401251d0], 0
je 0x140001c3a
cmp dword [0x14012bb3c], 0
jne 0x140001c3a
cmp dword [0x14012bb68], 0
jne 0x140001be8
mov eax, 1
jmp 0x140001c3d
mov rcx, qword [0x1401251d8]
cmp byte [rcx + 0x7f], 0
jne 0x140001c2d
cmp dword [rcx + 0x70], 0xffffffff
jle 0x140001c2d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1401251d8]
sub eax, dword [rcx + 0x74]
cmp eax, dword [rcx + 0x70]
jb 0x140001c2d
cmp dword [rcx + 0x6c], 0
je 0x140001c2d
mov byte [rcx + 0x7f], 1
cmp byte [rcx + 0xc2], 0
jne 0x140001c2d
mov dword [rcx + 0x88], 5
mov rax, qword [0x1401251d8]
movzx eax, byte [rax + 0x7f]
jmp 0x140001c3d
mov eax, r10d
mov r9d, 0x311
test eax, eax
mov eax, 0
cmovne r9d, eax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14000190d
test r14d, r14d
jne 0x140001c96
cmp byte [rsp + 0x54], r14b
jne 0x140001c96
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x54], 1
movzx eax, byte [rbp + 0x1288]
xor r10d, r10d
jmp 0x140001851
test r15d, r15d
jne 0x140001ccb
test sil, sil
je 0x140001ccb
test r14d, r14d
jle 0x140001cb0
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov r15d, eax
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp + 0x1288]
xor r10d, r10d
jmp 0x140001851
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test sil, sil
jne 0x140003d5a
mov ecx, dword [rbp - 0x48]
sub ecx, eax
add ecx, edi
cmp ecx, 5
jle 0x140003d5a
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rbp + 0x1288]
xor r10d, r10d
jmp 0x140001851
mov r15b, 1
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x60]
mov qword [rcx + 8], rax
test r15b, r15b
jne 0x140001ddd
mov edx, dword [rbp - 0x80]
cmp qword [0x14012bb98], 0
je 0x140002299
lea eax, [rdx - 0x100]
cmp eax, 9
jbe 0x140001d47
lea eax, [rdx - 0x200]
cmp eax, 0xe
ja 0x140002299
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x140001da6
mov edx, 0xffffffe0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassLongW]
cmp ax, word [0x14012e1a0]
jne 0x140001d7e
mov edx, 0xffffffeb
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rdi, rax
test rax, rax
jne 0x140001db7
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x140001da3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
jne 0x140001d51
mov edx, dword [rbp - 0x80]
xor r10d, r10d
mov qword [rsp + 0x58], r10
mov rbx, qword [rbp - 0x78]
jmp 0x1400022a0
mov r14, qword [rsp + 0x78]
mov rdx, qword [rax + 0x78]
test rdx, rdx
je 0x140001e03
mov qword [rsp + 0x58], rdi
lea r8, [rsp + 0x78]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
je 0x140001e03
mov r14d, dword [rsp + 0x40]
mov edi, dword [rbp + 0x1270]
movzx esi, byte [rbp + 0x1280]
mov r15d, dword [rsp + 0x48]
movzx eax, byte [rbp + 0x1288]
xor r10d, r10d
jmp 0x140001851
mov rsi, rdi
mov qword [rsp + 0x58], rdi
mov edx, dword [rbp - 0x80]
mov rbx, qword [rbp - 0x78]
cmp edx, 0x100
jne 0x140001f2e
mov qword [rsp + 0x58], rdi
cmp byte [rdi + 0x108], 0
je 0x140001eb2
cmp rbx, 0x25
ja 0x140001e46
movabs rax, 0x2600000200
bt rax, rbx
jb 0x140001e51
mov qword [rsp + 0x58], rdi
cmp rbx, 0x27
jne 0x140001eb2
mov rbx, r14
mov rsi, rdi
mov qword [rsp + 0x58], rdi
nop dword [rax]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
sub eax, 3
cmp eax, dword [rdi + 0xa8]
jae 0x140001e86
mov rdx, qword [rdi + 0x50]
mov r8, qword [rdx + rax*8]
cmp qword [r8 + 0x28], rbx
je 0x140001f67
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
je 0x140001e9d
cmp rax, qword [rdi + 0x30]
jne 0x140001e60
xor eax, eax
mov qword [rbp - 0x30], rax
mov rbx, qword [rbp - 0x78]
mov edx, dword [rbp - 0x80]
cmp edx, 0x100
jne 0x140001f2e
cmp rbx, 0x1b
je 0x140001ee4
cmp rbx, 9
je 0x140001ee4
cmp rbx, 0x41
jne 0x140001f2e
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140001f27
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140001f27
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
sub eax, 3
cmp eax, dword [rsi + 0xa8]
jae 0x140001f0a
mov rdx, qword [rsi + 0x50]
mov r8, qword [rdx + rax*8]
cmp qword [r8 + 0x28], r14
je 0x14000211e
mov rcx, r14
call qword [sym.imp.USER32.dll_GetParent]
mov r14, rax
test rax, rax
je 0x140001f21
cmp rax, qword [rsi + 0x30]
jne 0x140001ee4
xor eax, eax
mov qword [rbp - 0x30], rax
mov rbx, qword [rbp - 0x78]
mov edx, dword [rbp - 0x80]
mov rcx, qword [0x14012d3c0]
test rcx, rcx
je 0x140002252
cmp edx, 0x100
jne 0x140002252
cmp rbx, 0xd
jne 0x140002233
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1116
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140001fc4
cmp eax, 0x2af8
je 0x140001e9d
mov r15, qword [rdx + rax*8]
mov qword [rbp - 0x30], r15
test r15, r15
je 0x140001ea3
movzx eax, byte [r15 + 0x50]
cmp al, 0xf
je 0x140001ea3
xor edi, edi
mov rbx, qword [rbp - 0x78]
cmp al, 0x13
jne 0x140001fea
mov rdi, r15
lea rax, [rbx - 0x25]
test rax, 0xfffffffffffffffd
jne 0x140001fea
cmp rbx, 0x27
sete r8b
mov byte [rsp + 0x20], 0
xor r9d, r9d
mov rdx, r15
mov rcx, rsi
call fcn.14008ddc0
mov edi, dword [rbp + 0x1270]
movzx esi, byte [rbp + 0x1280]
mov r14d, dword [rsp + 0x40]
mov r15d, dword [rsp + 0x48]
movzx eax, byte [rbp + 0x1288]
xor r10d, r10d
jmp 0x140001851
lea rax, [rbx - 0x25]
test rax, 0xfffffffffffffffd
je 0x140001ea7
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140001ea3
mov rbx, qword [rbp - 0x78]
cmp rbx, 9
jne 0x14000203a
cmp byte [r15 + 0x50], 0xc
jne 0x14000203a
mov edx, 0xfffffff0
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_GetWindowLongW]
test al, 4
jne 0x140001ea3
mov rbx, qword [rbp - 0x78]
test rdi, rdi
jne 0x1400020c5
movzx r9d, byte [r15 + 0x52]
cmp r9b, 0xff
je 0x140002081
xor dl, dl
xor ecx, ecx
mov r8d, dword [rsi + 0xa8]
test r8d, r8d
je 0x140002081
mov r10, qword [rsi + 0x50]
mov rdi, qword [r10 + rcx*8]
cmp byte [rdi + 0x50], 0x13
jne 0x140002073
cmp dl, r9b
je 0x14000207c
inc dl
inc ecx
cmp ecx, r8d
jb 0x140002062
jmp 0x140002081
test rdi, rdi
jne 0x1400020c5
xor dl, dl
xor ecx, ecx
mov r8d, dword [rsi + 0xa8]
test r8d, r8d
je 0x140001ea7
mov r9, qword [rsi + 0x50]
nop dword [rax]
mov rdi, qword [r9 + rcx*8]
cmp byte [rdi + 0x50], 0x13
jne 0x1400020b0
test dl, dl
je 0x1400020bc
inc dl
inc ecx
cmp ecx, r8d
jb 0x1400020a0
jmp 0x140001ea7
test rdi, rdi
je 0x140001ea7
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140001ea3
mov rax, qword [rbp - 0x78]
cmp rax, 0x22
je 0x14000210a
cmp rax, 9
jne 0x1400020f7
mov ecx, reloc.WSOCK32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14000210a
xor r8d, r8d
mov byte [rsp + 0x20], 1
mov r9b, 1
mov rdx, rdi
jmp 0x140001fbc
mov r8b, 1
mov byte [rsp + 0x20], r8b
movzx r9d, r8b
mov rdx, rdi
jmp 0x140001fbc
cmp eax, 0x2af8
je 0x140001f21
mov r15, qword [rdx + rax*8]
mov qword [rbp - 0x30], r15
test r15, r15
je 0x140001f27
cmp byte [r15 + 0x50], 0xc
jne 0x140001f27
mov rbx, qword [rbp - 0x78]
cmp rbx, 0x1b
je 0x1400021c2
movzx eax, byte [r15 + 0x51]
cmp rbx, 0x41
je 0x14000219c
test al, al
jns 0x140001f2b
mov edx, 0xfffffff0
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0xb
jb 0x140001f27
lea r9, [0x140101c34]
mov edx, 0xc2
mov r8d, 1
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140001fc4
test al, 2
jne 0x140001f2b
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140001fc4
xor r10d, r10d
mov ecx, r10d
mov edx, dword [rsi + 0xa0]
test edx, edx
jle 0x140002673
mov rax, qword [rsi + 0x90]
add rax, 0xe
cmp dword [rax - 6], 3
jne 0x1400021ec
cmp byte [rax], r10b
je 0x140002208
inc ecx
add rax, 0x10
cmp ecx, edx
jl 0x1400021e1
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
jmp 0x140001840
xor r9d, r9d
mov edx, 0x414
mov r8d, 0x2af80003
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_PostMessageW]
mov qword [rbp - 0x30], r15
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x58], rsi
jmp 0x140001fc4
cmp rbx, 0x1b
jne 0x140002252
xor r9d, r9d
mov edx, 0x1116
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140001fc4
cmp dword [rsi + 0xa8], 0
jne 0x140002263
cmp edx, 0x106
je 0x14000229d
mov rcx, qword [0x1401251d8]
mov byte [rcx + 0x7e], 1
mov eax, dword [rbp - 0x80]
mov dword [rcx + 0x78], eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
mov rcx, qword [0x1401251d8]
mov byte [rcx + 0x7e], 0
test eax, eax
jne 0x140001ddd
mov edx, dword [rbp - 0x80]
mov rbx, qword [rbp - 0x78]
xor r10d, r10d
cmp edx, 0x402
ja 0x140002510
je 0x140002549
cmp edx, 0x113
ja 0x140002449
je 0x140002336
cmp edx, 0x12
je 0x140002320
cmp edx, 0x4b
je 0x140002306
cmp edx, 0x100
jne case.0x140002530.1046
mov rax, qword [0x14012bb58]
cmp qword [rsp + 0x78], rax
jne case.0x140002530.1046
cmp rbx, 0x1b
jne case.0x140002530.1046
xor edx, edx
mov rcx, qword [0x14012bb88]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140001fc4
mov qword [0x14012bb60], r10
mov al, 1
mov byte [rbp + 0x1288], al
mov edi, dword [rbp + 0x1270]
jmp 0x140001840
mov edx, 4
lea rcx, [0x14012d680]
call fcn.140047930
jmp 0x140001fc4
cmp qword [rbp - 0x70], 0
jne case.0x140002530.1046
mov rax, qword [0x14012bb88]
cmp qword [rsp + 0x78], rax
jne case.0x140002530.1046
cmp dword [0x14012bfec], 0
je 0x140002361
call fcn.140004250
cmp dword [0x14012ddbc], 0
je 0x140002384
call fcn.140003f30
movzx ebx, byte [rsp + 0x70]
test al, al
mov eax, 1
cmovne ebx, eax
mov dword [rsp + 0x70], ebx
jmp 0x140002388
mov ebx, dword [rsp + 0x70]
mov r14d, dword [rsp + 0x40]
cmp dword [rbp + 0x1278], 0
je 0x140001de2
cmp r14d, 1
jl 0x140001de2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movzx esi, byte [rbp + 0x1280]
mov edi, dword [rbp + 0x1270]
test sil, sil
jne 0x1400023cc
mov ecx, dword [rbp - 0x48]
sub ecx, eax
add ecx, edi
cmp ecx, 5
jg 0x140001fd6
mov dword [0x14012de38], eax
cmp byte [rsp + 0x4d], 0
je 0x1400023e0
mov byte [0x14012bb37], 0
cmp byte [rsp + 0x4e], 0
je 0x140002432
mov eax, dword [0x14012bb90]
dec eax
mov dword [0x14012bb90], eax
test edi, edi
jle 0x140002432
test eax, eax
jne 0x140002432
cmp dword [0x14012ddbc], eax
jne 0x140002432
cmp dword [0x14012bfec], eax
jne 0x140002432
cmp byte [0x14012bb36], al
je 0x140002432
mov edx, 9
mov rcx, qword [0x14012bb88]
call qword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x140002432
mov byte [0x14012bb36], 0
movzx eax, bl
add rsp, 0x1328
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, edx
sub eax, 0x312
je 0x140002549
sub eax, 0xee
je case.0x140002530.1045
cmp eax, 1
je case.0x140002530.1045
xor edi, edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140003cf6
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x14012d658]
jne 0x140003cf6
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x120]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rcx, rdi
lea rdx, [rbp + 0x120]
lea r8, str.32770
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140003cf6
cmp rcx, 7
jne 0x1400024c0
mov rcx, qword [0x1401251d8]
mov byte [rcx + 0x7e], 1
mov eax, dword [rbp - 0x80]
mov dword [rcx + 0x78], eax
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x140003ce9
mov rax, qword [0x1401251d8]
mov byte [rax + 0x7e], 0
jmp 0x140001fc4
lea eax, [rdx - 0x414]
cmp eax, 0xa
ja case.0x140002530.1046
lea rdi, [0x140000000]
mov ecx, dword [rdi + rax*4 + 0x3dcc]
add rcx, rdi
jmp rcx
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x140002549
cmp rdi, qword [0x14012bb88]
jne case.0x140002530.1046
lea rdi, [0x140000000]
mov r14, r10
lea eax, [rdx - 0x401]
cmp eax, 0x1d
ja case.0x140002574.1031
movzx eax, byte [rdi + rax + 0x3e14]
mov ecx, dword [rdi + rax*4 + 0x3df8]
add rcx, rdi
jmp rcx
mov rdi, qword [rsp + 0x78]
mov edx, 0xffffffe0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassLongW]
cmp ax, word [0x14012e1a0]
je 0x14000259e
xor edi, edi
mov qword [rsp + 0x58], rdi
jmp 0x14000246c
mov edx, 0xffffffeb
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je case.0x140002530.1046
mov rdx, qword [rbp - 0x70]
mov qword [rbp - 0x58], rdx
mov rcx, qword [rbp - 0x78]
movzx r8d, cl
mov dword [rbp - 0x38], r8d
mov r9, rcx
shr r9, 8
mov qword [rbp - 0x10], r9
shr rcx, 0x10
movzx eax, cx
xor r10d, r10d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x60], r8d
cmp eax, dword [rsi + 0xa8]
jae 0x140002604
mov ecx, eax
mov rax, qword [rsi + 0x50]
mov r15, qword [rax + rcx*8]
jmp 0x140002607
mov r15, r10
mov qword [rbp - 0x30], r15
lea rbx, [rsi + 0x90]
mov byte [rsp + 0x4c], r10b
xor dil, dil
mov byte [rsp + 0x44], dil
lea eax, [r8 - 1]
cmp eax, 0x10
ja case.0x14000263a.6
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0x3e34]
add rcx, r8
jmp rcx
mov r14, qword [rsi + 0x60]
test r14, r14
je 0x140002673
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov edx, eax
mov qword [rbp - 0x58], rdx
test eax, eax
jne 0x1400026b4
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragFinish]
xor r10d, r10d
mov qword [rsi + 0x60], r10
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
jmp 0x140001840
mov byte [rsp + 0x44], 2
mov dword [rsp + 0x60], edx
test r15, r15
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
je 0x140001840
lea rbx, [r15 + 0x38]
mov byte [rsp + 0x4c], 1
movzx edi, byte [rsp + 0x44]
jmp case.0x14000263a.2
xor r10d, r10d
test rbx, rbx
je case.0x14000263a.5
mov rdx, qword [rbx + 8]
test rdx, rdx
je case.0x14000263a.5
mov r8d, dword [rsp + 0x60]
nop word [rax + rax]
cmp byte [rdx + 0x18], 0
jne 0x1400026ee
movsxd rcx, dword [rdx + 0x10]
add rcx, rcx
mov rax, qword [rbx]
cmp dword [rax + rcx*8 + 8], r8d
jne 0x1400026ee
cmp byte [rax + rcx*8 + 0xe], dil
je 0x140002709
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x1400026d0
mov edi, r10d
mov edx, dword [rbp - 0x80]
mov rbx, rsi
mov r15, qword [rbp - 0x28]
jmp 0x140002c0e
test r14, r14
je 0x14000271e
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragFinish]
xor r10d, r10d
mov qword [rsi + 0x60], r10
mov qword [rsp + 0x58], rsi
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
jmp 0x140001840
test rbx, rbx
je 0x1400027a0
mov edx, 0xffffffe0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassLongW]
cmp ax, word [0x14012e1a0]
je 0x14000275e
xor r10d, r10d
mov ebx, r10d
mov qword [rsp + 0x58], rbx
jmp 0x14000277c
mov edx, 0xffffffeb
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140002798
xor r10d, r10d
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x140002798
cmp rax, qword [0x14012bb88]
jne case.0x140002530.1046
mov edx, dword [rbp - 0x80]
jmp 0x1400027a8
mov edx, dword [rbp - 0x80]
xor r10d, r10d
jmp 0x1400027a8
mov rbx, r10
mov qword [rsp + 0x58], rbx
mov rcx, qword [0x14012ddc0]
test rcx, rcx
je 0x1400027f1
mov rax, qword [rbp - 0x70]
nop dword [rax + rax]
mov r12, qword [rcx + 0x20]
test r12, r12
je 0x1400027e8
nop dword [rax]
cmp dword [r12 + 0x28], eax
je 0x1400027e3
mov r12, qword [r12 + 0x38]
test r12, r12
jne 0x1400027d0
jmp 0x1400027e8
test r12, r12
jne 0x140002806
mov rcx, qword [rcx + 0x38]
test rcx, rcx
jne 0x1400027c0
mov r12, r10
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
jmp 0x140001840
cmp qword [r12 + 0x10], 0
je 0x140002673
mov edi, dword [r12 + 0x2c]
mov r15, qword [rbp - 0x28]
jmp 0x140002c0e
mov eax, dword [0x14012bfe8]
cmp rbx, rax
jae 0x140002673
mov rax, qword [0x14012bfe0]
mov rdi, qword [rax + rbx*8]
mov qword [rbp + 0x50], rdi
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140002887
mov rdx, qword [rdi + 8]
call fcn.140017a50
mov qword [rbp - 0x50], rax
cmp rax, 0
je 0x140001fc4
mov rcx, qword [rdi + 0x20]
movzx edx, byte [rcx]
lea ecx, [rdx - 2]
test cl, 0xfd
je 0x14000287f
cmp dl, 5
jne 0x14000288b
mov rbx, qword [0x14012bb78]
mov qword [rbp - 0x50], rbx
jmp 0x14000288b
xor eax, eax
mov qword [rbp - 0x50], rax
jmp 0x14000288b
mov qword [rbp - 0x50], r10
mov rdx, qword [rbp - 0x70]
mov rcx, rdi
call fcn.14001b270
cmp qword [rdi + 0x18], 0
jne 0x140001fc4
xor r10d, r10d
cmp byte [rdi + 0x3e], r10b
je 0x1400028c5
movzx eax, word [rbp - 0x70]
mov word [0x14012dddc], ax
mov edi, dword [rdi + 0x28]
mov edx, dword [rbp - 0x80]
mov r15, qword [rbp - 0x28]
jmp 0x140002c09
mov word [0x14012dddc], r10w
mov edi, dword [rdi + 0x28]
mov edx, dword [rbp - 0x80]
mov r15, qword [rbp - 0x28]
jmp 0x140002c09
cmp byte [0x14012dda0], 0
mov edi, dword [rbp + 0x1270]
movzx esi, byte [rbp + 0x1280]
mov r15d, dword [rsp + 0x48]
movzx eax, byte [rbp + 0x1288]
jne 0x14000184c
mov edi, r10d
mov r15, qword [rbp - 0x28]
jmp 0x140002c09
mov rsi, rbx
mov qword [rbp - 0x40], rbx
mov rcx, rbx
call fcn.14002cf40
test rax, rax
jne 0x14000293b
xor r10d, r10d
mov qword [rbp - 0x40], r10
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
jmp 0x140001840
cmp qword [rbx + 0x10], 0
je 0x1400029da
cmp qword [0x14012bb70], 0
jne 0x140002967
cmp dword [0x14012bffc], 0
jne 0x140002967
test byte [0x14012bd8c], 1
jne 0x140002967
call fcn.140017de0
mov rcx, qword [rbx + 0x10]
cmp qword [rcx + 0x398], 0
je 0x1400029aa
test rbx, rbx
mov edi, dword [rbp + 0x1270]
mov r15d, dword [rsp + 0x48]
movzx eax, byte [rbp + 0x1288]
mov r10d, 0
je 0x140001845
mov edi, r10d
mov edx, dword [rbp - 0x80]
mov rbx, qword [rsp + 0x58]
mov r15, qword [rbp - 0x28]
jmp 0x140002c12
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
cmp dword [0x14012bb68], 0
jne 0x1400029da
lea rcx, [0x14012d680]
call fcn.140047510
test al, al
jne 0x1400029da
mov edx, 6
lea rcx, [0x14012d680]
call fcn.140047930
xor r10d, r10d
mov qword [rbp - 0x40], r10
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
jmp 0x140001840
mov rsi, qword [0x14012bb70]
mov qword [rbp - 0x40], rsi
test rsi, rsi
mov edi, dword [rbp + 0x1270]
mov r15d, dword [rsp + 0x48]
movzx eax, byte [rbp + 0x1288]
je 0x140001845
nop dword [rax]
cmp rsi, rbx
je 0x140002a3d
mov rsi, qword [rsi + 8]
mov qword [rbp - 0x40], rsi
test rsi, rsi
jne 0x140002a20
mov edi, dword [rbp + 0x1270]
jmp 0x140001845
mov rax, qword [rsi + 0x10]
cmp edx, 0x41c
jne 0x140002a52
mov rax, qword [rax + 0x3a0]
jmp 0x140002a6a
cmp edx, 0x41e
jne 0x140002a63
mov rax, qword [rax + 0x3b0]
jmp 0x140002a6a
mov rax, qword [rax + 0x3a8]
test rax, rax
je 0x140002673
mov edi, r10d
mov rbx, qword [rsp + 0x58]
mov r15, qword [rbp - 0x28]
jmp 0x140002c12
movzx eax, bx
mov ecx, 0x7fff
and ax, cx
cmp ax, word [0x14012be74]
jae 0x140002673
movzx ecx, ax
mov rax, qword [0x14012bff0]
mov r15, qword [rax + rcx*8]
mov qword [rbp - 0x28], r15
shr rbx, 0x10
test bx, bx
je 0x140002ae3
mov r8d, 0xffff
add bx, r8w
mov r13, qword [r15 + 0x28]
je 0x140002ada
nop word [rax + rax]
mov r13, qword [r13 + 0x18]
add bx, r8w
jne 0x140002ad0
test r13, r13
jne 0x140002bb1
cmp edx, 0x400
jne 0x140002b05
mov rax, qword [rbp - 0x70]
shr rax, 0x10
movzx ecx, ax
lea esi, [rcx + 0x3c2bb3]
mov edi, WSAAsyncSelect
sub edi, ecx
jmp 0x140002b0d
mov esi, r10d
mov edi, 0x3c2c17
cmp byte [r15 + 0x19], 0
jne 0x140002b29
mov r13, r10
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
jmp 0x140001840
mov qword [rbp - 0x50], r10
mov rbx, r10
mov r13, qword [r15 + 0x28]
test r13, r13
je 0x140002ba2
nop dword [rax]
cmp byte [r13 + 0x30], 0
je 0x140002b96
cmp byte [0x14012bbbd], 0
je 0x140002b57
cmp byte [r13 + 0x31], 0
je 0x140002b96
cmp edi, 0x66
lea ecx, [rsi - 0x3c2bb3]
jbe 0x140002b67
mov ecx, reloc.WSOCK32.dll_WSAAsyncSelect
movzx eax, byte [r13 + 0x2c]
cmp ecx, eax
jle 0x140002b96
mov rcx, qword [r13 + 0x10]
test rcx, rcx
je 0x140002b8c
mov rdx, qword [r15 + 0x20]
call fcn.140017a50
mov qword [rbp - 0x50], rax
cmp rax, 0
je 0x140002b96
cmp qword [r13 + 0x10], 0
jne 0x140002bd7
mov rbx, r13
mov r13, qword [r13 + 0x18]
test r13, r13
jne 0x140002b40
mov edx, dword [rbp - 0x80]
mov r13, rbx
xor r10d, r10d
test r13, r13
je 0x140002673
movzx eax, byte [r13 + 0x2b]
cmp byte [r13 + 0x2a], al
jb 0x140002bdc
cmp byte [r13 + 0x2e], 0
je 0x140002bc8
mov byte [r13 + 0x2f], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [r13 + 0x20], eax
jmp 0x140001fc4
mov edx, dword [rbp - 0x80]
jmp 0x140002ba5
mov rax, qword [r13 + 0x10]
test rax, rax
je 0x140002c01
movzx ecx, byte [rax]
lea eax, [rcx - 2]
test al, 0xfd
je 0x140002c01
cmp cl, 5
jne 0x140002c05
mov rax, qword [0x14012bb78]
mov qword [rbp - 0x50], rax
jmp 0x140002c05
mov qword [rbp - 0x50], r10
mov edi, dword [r13 + 0x24]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rbp - 0x40]
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
cmp dword [0x14012bb68], eax
jl 0x140002c53
test r14, r14
je 0x140002c38
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragFinish]
xor r10d, r10d
mov qword [rbx + 0x60], r10
mov edx, dword [rbp - 0x80]
cmp edx, 0x41b
jne 0x140002673
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x140001fc4
mov rax, qword [0x1401251d8]
cmp edi, dword [rax + 0x68]
jge 0x140002c91
test r14, r14
je 0x140002c77
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragFinish]
xor r10d, r10d
mov qword [rbx + 0x60], r10
mov edx, dword [rbp - 0x80]
cmp edx, 0x41b
je 0x140002c44
mov edi, dword [rbp + 0x1270]
movzx eax, byte [rbp + 0x1288]
jmp 0x140001840
mov byte [rsp + 0x70], 1
lea eax, [rdx - 0x402]
cmp eax, 0x1c
ja case.0x140002cbc.1027
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0x3e80]
mov ecx, dword [r8 + rax*4 + 0x3e78]
add rcx, r8
jmp rcx
mov rax, qword [0x14012dd48]
mov qword [0x14012dd50], rax
mov eax, dword [0x14012ddd4]
mov dword [0x14012ddd8], eax
cmp edx, 0x401
jne 0x140002cea
mov rax, qword [rbp + 0x50]
mov rax, qword [rax + 8]
jmp 0x140002cee
mov rax, qword [r15 + 0x20]
mov qword [0x14012dd48], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012ddd4], eax
xor r10d, r10d
inc dword [0x14012bb68]
mov rbx, qword [0x1401251d8]
add rbx, 0xc8
mov qword [0x1401251d8], rbx
mov rax, qword [0x14012bb40]
test rax, rax
lea rcx, [rax + 0x80]
jne 0x140002d35
mov rcx, r10
test rbx, rbx
lea rax, [rbx + 0x80]
jne 0x140002d44
mov rax, r10
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [rcx + 0x40]
movsd qword [rax + 0x40], xmm0
xorps xmm1, xmm1
movups xmmword [rbx], xmm1
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm1
movups xmmword [rbx + 0x30], xmm1
movups xmmword [rbx + 0x40], xmm1
movups xmmword [rbx + 0x50], xmm1
movups xmmword [rbx + 0x60], xmm1
movups xmmword [rbx + 0x70], xmm1
mov byte [rbx + 0x7f], 1
mov dword [rbx + 0x68], edi
xor edx, edx
lea rcx, [0x14012d680]
call fcn.140046d20
movzx eax, byte [rbx + 0xc2]
test al, al
jne 0x140002db4
mov byte [rbx + 0xc2], al
cmp dword [0x14012de34], 0
je 0x140002dc6
cmp dword [0x14012de30], 0
jne 0x140002dca
test al, al
je 0x140002e00
mov dword [rbx + 0x88], reloc.WSOCK32.dll_recv
mov byte [rbx + 0x7f], 0
test al, al
jne 0x140002e00
cmp dword [0x14012de34], 0
jge 0x140002dee
mov dword [rbx + 0x70], 0xffffffff
jmp 0x140002e00
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x74], eax
mov eax, dword [0x14012de34]
mov dword [rbx + 0x70], eax
mov rbx, qword [0x1401251d8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012de38], eax
mov edx, dword [rbp - 0x80]
lea eax, [rdx - 0x401]
cmp eax, 0x1d
ja case.0x140002e40.1032
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0x3ec0]
mov ecx, dword [r8 + rax*4 + 0x3ea0]
add rcx, r8
jmp rcx
movsxd rbx, dword [rsp + 0x50]
lea rcx, [rbx + rbx*2]
inc ebx
mov dword [rsp + 0x50], ebx
mov dword [rbp + rcx*8 + 0x90], 5
mov rsi, qword [rsp + 0x58]
mov rax, rsi
cmp byte [rsp + 0x4c], 0
mov r15, qword [rbp - 0x30]
cmovne rax, r15
mov qword [rbp + rcx*8 + 0x80], rax
mov edi, dword [rbp - 0x38]
lea eax, [rdi - 1]
cmp eax, 0x10
ja case.0x140002e93.6
mov ecx, dword [r8 + rax*4 + 0x3ee0]
add rcx, r8
jmp rcx
mov rax, qword [rbp - 0x64]
mov qword [rsp + 0x68], rax
mov rdi, qword [rbp - 0x10]
test r15, r15
je 0x1400030cc
test dil, dil
je 0x140002fc8
mov dword [rbp - 0x20], 0x80000000
movzx ecx, byte [r15 + 0x50]
sub ecx, 9
je 0x140002f4a
sub ecx, 1
je 0x140002f17
sub ecx, 1
je 0x140002ee9
cmp ecx, 6
jne 0x140002f7b
xor r8d, r8d
mov edx, 0x419
jmp 0x140002f6d
xor r9d, r9d
mov edx, 0x110a
mov r8d, 9
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140002f7b
mov qword [rbp - 0x20], rax
mov edx, 0x1104
mov r8d, 1
jmp 0x140002f6d
mov edx, 0x100c
mov r9d, 1
mov r8, 0xffffffffffffffff
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, eax
cmp r8, 0xffffffffffffffff
je 0x140002f7b
mov dword [rbp - 0x20], 2
mov edx, 0x100e
jmp 0x140002f6d
xor r9d, r9d
xor r8d, r8d
mov edx, OleCreatePictureIndirect
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
je 0x140002f7b
mov r8, rax
mov edx, 0x198
lea r9, [rbp - 0x20]
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [r15 + 0x28]
cmp dword [rbp - 0x20], 0x80000000
jne 0x140002f94
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x140002fa6
mov r9d, 2
lea r8, [rbp - 0x20]
xor edx, edx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x68], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 0x1c]
sub eax, ecx
jns 0x140002fb9
inc eax
sar eax, 1
add eax, 2
add eax, ecx
mov dword [rsp + 0x6c], eax
mov rax, qword [rbp - 0x64]
movzx edx, byte [r15 + 0x50]
sub edx, 9
je 0x1400030bf
sub edx, 1
je 0x140003064
cmp edx, 1
jne 0x1400030cc
mov rcx, qword [r15 + 0x28]
test dil, dil
je 0x14000303e
xor r9d, r9d
mov edx, 0x110a
mov r8d, 9
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbp - 0x58], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
movsxd rcx, ebx
lea rcx, [rcx + rcx*2]
shl rcx, 3
lea r8, [rbp + 0x90]
add r8, rcx
mov rax, r15
mov r9d, 5
xor r14d, r14d
jmp 0x140003120
mov qword [rbp], rax
lea rdx, [rbp]
call qword [sym.imp.USER32.dll_ScreenToClient]
lea r9, [rbp]
xor r8d, r8d
mov edx, 0x1111
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140003089
test dil, dil
je 0x14000308d
mov edx, 0x100c
mov r9d, 1
mov r8, 0xffffffffffffffff
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
inc eax
cdqe
mov qword [rbp - 0x58], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
movsxd rax, ebx
lea rcx, [rax + rax*2]
shl rcx, 3
lea r8, [rbp + 0x90]
add r8, rcx
mov rax, r15
mov r9d, 5
xor r14d, r14d
jmp 0x140003120
xor r9d, r9d
xor r8d, r8d
mov edx, OleCreatePictureIndirect
jmp 0x14000307b
lea rdx, [rsp + 0x68]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
movsxd rax, ebx
lea rcx, [rax + rax*2]
lea rcx, [rcx*8]
lea r8, [rbp + 0x90]
add r8, rcx
test r15, r15
je 0x140003107
mov rax, r15
mov r9d, 5
xor r14d, r14d
jmp 0x140003120
mov qword [rbp + rcx + 0x88], 0xffffffffffffffff
lea rax, [0x140101bd0]
xor r14d, r14d
mov r9d, r14d
lea edx, [rbx + 1]
mov dword [r8], r9d
mov qword [rbp + rcx + 0x80], rax
movsxd rax, edx
lea rcx, [rax + rax*2]
lea ebx, [rdx + 1]
mov edx, 1
mov dword [rbp + rcx*8 + 0x90], edx
mov rax, qword [rbp - 0x58]
mov qword [rbp + rcx*8 + 0x80], rax
movsxd rax, ebx
lea rcx, [rax + rax*2]
inc ebx
mov dword [rbp + rcx*8 + 0x90], edx
mov rax, r14
test dil, dil
sete al
mov qword [rbp + rcx*8 + 0x80], rax
movsxd rax, ebx
lea rcx, [rax + rax*2]
inc ebx
mov dword [rbp + rcx*8 + 0x90], edx
movsxd rax, dword [rsp + 0x68]
mov qword [rbp + rcx*8 + 0x80], rax
movsxd rax, ebx
lea rcx, [rax + rax*2]
inc ebx
mov dword [rsp + 0x50], ebx
mov dword [rbp + rcx*8 + 0x90], edx
movsxd rax, dword [rsp + 0x6c]
mov qword [rbp + rcx*8 + 0x80], rax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_htonl]
jmp 0x1400035e7
mov rax, qword [rbp - 0x64]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov edx, 0xffffffec
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xffffffef
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea r10, [rbp + 0x80]
movsxd rcx, ebx
test r15, r15
je 0x140003213
mov r8, r15
mov r9d, 5
jmp 0x14000322f
lea rax, [rcx + rcx*2]
mov qword [rbp + rax*8 + 0x88], 0xffffffffffffffff
lea r8, [0x140101bd0]
xor eax, eax
mov r9d, eax
lea rax, [rcx + rcx*2]
lea edx, [rbx + 1]
mov dword [r10 + rax*8 + 0x10], r9d
mov qword [r10 + rax*8], r8
movsxd rax, edx
lea rcx, [rax + rax*2]
lea rbx, [rbp + 0x80]
lea rbx, [rbx + rcx*8]
lea edi, [rdx + 1]
mov rcx, r14
call fcn.140081900
mov dword [rbx + 0x10], 5
mov qword [rbx], rax
movsxd rax, edi
lea rcx, [rax + rax*2]
lea rbx, [rbp + 0x80]
lea rbx, [rbx + rcx*8]
inc edi
cmp byte [rsi + 0x112], 0
je 0x14000329b
mov r8d, dword [0x14012d65c]
mov edx, 0x60
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x14000329f
mov eax, dword [rsp + 0x68]
mov dword [rbx + 0x10], 1
cdqe
mov qword [rbx], rax
movsxd rax, edi
lea rcx, [rax + rax*2]
lea rbx, [rbp + 0x80]
lea rbx, [rbx + rcx*8]
inc edi
mov dword [rsp + 0x50], edi
cmp byte [rsi + 0x112], 0
je 0x1400032e4
mov r8d, dword [0x14012d65c]
mov edx, 0x60
mov ecx, dword [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x1400032e8
mov eax, dword [rsp + 0x6c]
mov dword [rbx + 0x10], 1
cdqe
mov qword [rbx], rax
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [rsi + 0x60], rax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_htonl]
mov ebx, edi
movzx edi, byte [rsp + 0x44]
mov r14d, dword [rsp + 0x60]
cmp byte [rsp + 0x4c], 0
lea rcx, [r15 + 0x38]
jne 0x14000332a
lea rcx, [rsi + 0x90]
lea rax, [rbp + 0x110]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x20], dil
mov r9d, r14d
mov r8d, ebx
lea rdx, [rbp + 0x80]
call fcn.140099830
mov rcx, qword [rsi + 0x30]
mov r8d, dword [rbp - 0x38]
test rcx, rcx
je 0x1400036e9
mov eax, r8d
sub eax, 1
je 0x140003681
cmp eax, 1
jne 0x1400036e9
cmp qword [rbp + 0x110], 0
jne 0x140003708
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne cl
cmp cl, byte [rsi + 0x115]
je 0x140003641
mov byte [rsi + 0x115], cl
mov rdx, qword [rsi]
mov rcx, rsi
test eax, eax
je 0x14000363e
call qword [rdx + reloc.WSOCK32.dll_htonl]
jmp 0x140003641
cmp edi, 4
jne 0x1400035d2
movsxd rax, ebx
lea rcx, [rax + rax*2]
inc ebx
mov dword [rsp + 0x50], ebx
mov eax, 1
mov dword [rbp + rcx*8 + 0x90], eax
movsx rax, byte [rbp - 0x10]
mov qword [rbp + rcx*8 + 0x80], rax
movsxd rax, ebx
lea rcx, [rax + rax*2]
lea rbx, [rbp + 0x80]
lea rbx, [rbx + rcx*8]
mov edi, dword [rsp + 0x50]
inc edi
mov r14, qword [rbp - 0x58]
movzx eax, r14w
cmp byte [rsi + 0x112], 0
je 0x140003431
mov r8d, dword [0x14012d65c]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rbx + 0x10], 1
cdqe
mov qword [rbx], rax
movsxd rax, edi
lea rcx, [rax + rax*2]
lea rbx, [rbp + 0x80]
lea rbx, [rbx + rcx*8]
inc edi
mov dword [rsp + 0x50], edi
mov rax, r14
shr rax, 0x10
movzx eax, ax
cmp byte [rsi + 0x112], 0
je 0x14000347c
mov r8d, dword [0x14012d65c]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rbx + 0x10], 1
cdqe
mov qword [rbx], rax
jmp 0x140003303
cmp byte [r15 + 0x50], 0x17
jne 0x140003571
cmp edi, 7
jne 0x140003571
mov dword [rbp + 0x160], recv
mov rdi, qword [rbp - 0x58]
lea eax, [rdi - 1]
mov dword [rbp + 0x164], eax
lea r9, [rbp + 0x160]
xor r8d, r8d
mov edx, 0x703
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r11d, r11d
test rax, rax
movzx edx, r11w
je 0x1400034e4
movzx edx, word [rbp + 0x170]
movsxd rax, ebx
lea rcx, [rax + rax*2]
lea rcx, [rcx*8]
mov r9, rcx
lea r10, [rbp + 0x90]
test dx, dx
je 0x14000351a
mov qword [rbp + rcx + 0x88], 0xffffffffffffffff
lea rax, [rbp + 0x170]
mov r8d, r11d
jmp 0x140003523
movsxd rax, edi
mov r8d, 1
lea edx, [rbx + 1]
mov dword [r10 + r9], r8d
mov qword [rbp + rcx + 0x80], rax
movsxd rax, edx
lea rcx, [rax + rax*2]
lea ebx, [rdx + 1]
mov dword [rsp + 0x50], ebx
mov dword [rbp + rcx*8 + 0x90], r11d
lea rax, [rbp + 0x1d0]
mov qword [rbp + rcx*8 + 0x80], rax
mov qword [rbp + rcx*8 + 0x88], 0xffffffffffffffff
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_htonl]
jmp 0x14000330e
movsxd rax, ebx
lea rcx, [rax + rax*2]
inc ebx
mov dword [rsp + 0x50], ebx
mov edx, 1
mov dword [rbp + rcx*8 + 0x90], edx
mov rax, qword [rbp - 0x58]
mov qword [rbp + rcx*8 + 0x80], rax
mov eax, edi
sub eax, 0xa
je 0x1400035af
sub eax, edx
je 0x1400035a8
cmp eax, 2
je 0x1400035af
jmp 0x1400035d2
cmp byte [r15 + 0x50], 0xa
jne 0x1400035d2
movsxd rax, ebx
lea rcx, [rax + rax*2]
inc ebx
mov dword [rsp + 0x50], ebx
mov dword [rbp + rcx*8 + 0x90], edx
movzx eax, byte [rbp - 0x10]
dec rax
mov qword [rbp + rcx*8 + 0x80], rax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_htonl]
cmp edi, 5
jne 0x14000330e
xor r14d, r14d
movzx edi, byte [rsp + 0x44]
test r15, r15
je 0x140003313
lea r8d, [rbx - 1]
lea rcx, [r15 + 0x38]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x20], dil
mov r14d, dword [rsp + 0x60]
mov r9d, r14d
lea rdx, [rbp + 0x98]
call fcn.140099830
cmp eax, 7
je 0x140003630
cmp qword [rsi + 0x30], 0
jne 0x140003318
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x140003c79
call qword [rdx + reloc.WSOCK32.dll_recv]
cmp dword [0x14012bb68], 0
jne 0x140003708
lea rcx, [0x14012d680]
call fcn.140047510
test al, al
jne 0x140003708
mov edx, 4
lea rcx, [0x14012d680]
call fcn.140047930
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x140003c79
xor eax, eax
mov ecx, eax
mov edx, dword [rsi + 0xa0]
test edx, edx
jle 0x1400036ef
mov rax, qword [rsi + 0x90]
add rax, 0xe
nop word [rax + rax]
cmp dword [rax - 6], 1
jne 0x1400036ab
cmp byte [rax], 0
je 0x1400036b7
inc ecx
add rax, 0x10
cmp ecx, edx
jl 0x1400036a0
jmp 0x1400036ef
mov edx, 0xffffffec
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x10
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x58], rax
mov dword [rsp + 0x50], ebx
jmp 0x1400036ef
cmp r8d, 1
jne 0x140003708
movsxd rax, ebx
sub rax, 3
lea rax, [rax + rax*2]
mov rcx, qword [rbp + rax*8 + 0x80]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x140003c79
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x140003739
mov rax, qword [rsi + 0x30]
mov qword [rbx + 0x38], rax
mov rax, qword [rsi + 0x30]
mov qword [rbx + 0x40], rax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rbx, qword [r12 + 0x20]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
xor r8d, r8d
mov dword [rbp + 0x10], r8d
mov rax, qword [r12]
mov qword [rbp], rax
mov qword [rbp + 8], 0xffffffffffffffff
mov edx, r8d
mov rax, qword [r12 + 0x20]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x140003780
nop
cmp rcx, r12
je 0x140003785
mov rcx, qword [rcx + 0x38]
inc edx
test rcx, rcx
jne 0x140003770
mov edx, 0xffffffff
mov eax, 1
mov dword [rbp + 0x28], eax
lea ecx, [rdx + 1]
mov qword [rbp + 0x18], rcx
mov dword [rbp + 0x40], 5
mov qword [rbp + 0x30], rbx
mov rcx, qword [0x140127aa8]
cmp rcx, qword [0x140127ab0]
jne 0x1400037be
call fcn.140007ad8
mov rcx, qword [0x140127aa8]
xor r8d, r8d
cmp rcx, qword [0x140127aa0]
jb 0x1400037d8
mov rax, qword [0x14012dd38]
mov qword [rcx], rax
mov rcx, qword [0x140127aa8]
add rcx, 0x18
mov qword [0x140127aa8], rcx
mov qword [rcx], r8
lea rax, str.Menu
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], r8d
mov rcx, qword [r12 + 0x10]
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 3
lea r9, [rbp]
xor r8d, r8d
mov rdx, rcx
call fcn.140091d70
mov rax, qword [0x140127aa8]
sub rax, 0x18
mov qword [0x140127aa8], rax
cmp rax, qword [0x140127aa0]
jb 0x140003847
mov rax, qword [rax]
mov qword [0x140127ac8], rax
mov qword [0x14012dd38], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_recv]
test rsi, rsi
je 0x140003c79
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x140003c79
mov rax, qword [rbp - 0x50]
mov qword [rbx + 0x38], rax
mov rdi, qword [rbp + 0x50]
movzx eax, byte [rdi + 0x35]
mov byte [rbx + 0xc5], al
mov rax, qword [rdi + 0x20]
mov qword [rbx + 0x80], rax
movzx eax, byte [rdi + 0x39]
cmp byte [rdi + 0x38], al
jae 0x140003c79
mov byte [0x14012ddde], 0
inc byte [rdi + 0x38]
xor eax, eax
mov dword [rbp + 0x10], eax
mov rax, qword [rdi + 8]
mov qword [rbp], rax
mov qword [rbp + 8], 0xffffffffffffffff
mov byte [rsp + 0x20], 0
mov r9d, 1
lea r8, [rbp]
mov rdx, qword [0x14012dd48]
mov rcx, rdi
call fcn.1400995c0
dec byte [rdi + 0x38]
jmp 0x140003c79
call qword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x140003910
mov ecx, recv
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140003907
mov ecx, reloc.WSOCK32.dll_ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
mov eax, 2
je 0x14000390c
mov eax, 1
xor ebx, ebx
jmp 0x140003914
xor ebx, ebx
mov eax, ebx
mov edx, 1
mov dword [rbp + 0x10], edx
mov qword [rbp], rax
mov byte [0x14012dda0], dl
mov rcx, qword [0x140127aa8]
cmp rcx, qword [0x140127ab0]
jne 0x140003947
call fcn.140007ad8
mov rcx, qword [0x140127aa8]
mov edx, 1
cmp rcx, qword [0x140127aa0]
jb 0x140003961
mov rax, qword [0x14012dd38]
mov qword [rcx], rax
mov rcx, qword [0x140127aa8]
add rcx, 0x18
mov qword [0x140127aa8], rcx
mov qword [rcx], rbx
lea rax, [0x140101c38]
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], ebx
mov qword [rsp + 0x20], rbx
mov r9d, edx
mov r8d, edx
lea rdx, [rbp]
lea rcx, [0x14012dd70]
call fcn.1400996a0
mov rax, qword [0x140127aa8]
sub rax, 0x18
mov qword [0x140127aa8], rax
cmp rax, qword [0x140127aa0]
jb 0x1400039c4
mov rax, qword [rax]
mov qword [0x140127ac8], rax
mov qword [0x14012dd38], rax
mov byte [0x14012dda0], 0
jmp 0x140003c79
mov dword [rbp + 0x10], 5
mov rbx, qword [rsi + 0x10]
mov qword [rbp], rbx
mov rbx, qword [rbx + 0x398]
mov rcx, qword [0x140127aa8]
cmp rcx, qword [0x140127ab0]
jne 0x140003a02
call fcn.140007ad8
mov rcx, qword [0x140127aa8]
cmp rcx, qword [0x140127aa0]
jb 0x140003a1c
mov rax, qword [0x14012dd38]
mov qword [rcx], rax
mov rcx, qword [0x140127aa8]
add rcx, 0x18
mov qword [0x140127aa8], rcx
xor eax, eax
mov qword [rcx], rax
lea rdx, str.InputHook
mov qword [rcx + 8], rdx
mov dword [rcx + 0x10], eax
mov byte [rsp + 0x38], al
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp]
xor r8d, r8d
mov rdx, rbx
mov rcx, rbx
call fcn.140091d70
mov rax, qword [0x140127aa8]
sub rax, 0x18
mov qword [0x140127aa8], rax
cmp rax, qword [0x140127aa0]
jb 0x140003a89
mov rax, qword [rax]
mov qword [0x140127ac8], rax
mov qword [0x14012dd38], rax
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x140003c79
mov dword [rbp + 0x10], 5
mov r8, qword [rsi + 0x10]
mov qword [rbp], r8
mov r9d, 1
mov dword [rbp + 0x28], r9d
mov rcx, qword [rbp - 0x70]
movzx eax, cl
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x40], r9d
sar rcx, 0x10
movzx eax, cx
mov qword [rbp + 0x30], rax
cmp edx, 0x41c
jne 0x140003adc
mov rbx, qword [r8 + 0x3a0]
jmp 0x140003ae3
mov rbx, qword [r8 + 0x3b0]
mov rcx, qword [0x140127aa8]
cmp rcx, qword [0x140127ab0]
jne 0x140003aff
call fcn.140007ad8
mov rcx, qword [0x140127aa8]
cmp rcx, qword [0x140127aa0]
jb 0x140003b19
mov rax, qword [0x14012dd38]
mov qword [rcx], rax
mov rcx, qword [0x140127aa8]
add rcx, 0x18
mov qword [0x140127aa8], rcx
xor eax, eax
mov qword [rcx], rax
lea rdx, str.InputHook
mov qword [rcx + 8], rdx
mov dword [rcx + 0x10], eax
mov byte [rsp + 0x38], al
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
lea r9, [rbp]
xor r8d, r8d
mov rdx, rbx
mov rcx, rbx
call fcn.140091d70
mov rax, qword [0x140127aa8]
sub rax, 0x18
mov qword [0x140127aa8], rax
cmp rax, qword [0x140127aa0]
jb 0x140003c79
mov rax, qword [rax]
mov qword [0x140127ac8], rax
mov qword [0x14012dd38], rax
jmp 0x140003c79
mov rax, qword [rbp - 0x70]
mov word [rbp - 8], ax
sar rax, 0x10
mov word [rbp - 6], ax
xor edx, edx
mov word [rbp - 4], dx
mov dword [rbp + 0x10], 5
mov rbx, qword [rsi + 0x10]
mov qword [rbp], rbx
mov dword [rbp + 0x28], edx
lea rax, [rbp - 8]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0xffffffffffffffff
mov rbx, qword [rbx + 0x3a8]
mov rcx, qword [0x140127aa8]
cmp rcx, qword [0x140127ab0]
jne 0x140003bec
call fcn.140007ad8
mov rcx, qword [0x140127aa8]
xor edx, edx
cmp rcx, qword [0x140127aa0]
jb 0x140003c06
mov rax, qword [0x14012dd38]
mov qword [rcx], rax
mov rcx, qword [0x140127aa8]
add rcx, 0x18
mov qword [0x140127aa8], rcx
mov qword [rcx], rdx
lea rax, str.InputHook
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edx
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 2
lea r9, [rbp]
jmp 0x140003b4c
movzx eax, byte [r15 + 0x10]
add al, 0x64
cmp al, 3
ja 0x140003c50
movzx eax, word [rbp - 0x70]
mov qword [rbx + 0x40], rax
mov rax, qword [rbp - 0x50]
mov qword [rbx + 0x38], rax
movzx eax, byte [r13 + 0x2c]
mov byte [rbx + 0xc5], al
mov rax, qword [r13 + 0x10]
mov qword [rbx + 0x80], rax
mov rdx, r13
mov rcx, r15
call fcn.1400188a0
call fcn.1400047c0
cmp dword [rbp + 0x1278], 0
mov edi, dword [rbp + 0x1270]
movzx esi, byte [rbp + 0x1280]
mov r14d, dword [rsp + 0x40]
mov r15d, dword [rsp + 0x48]
movzx eax, byte [rbp + 0x1288]
mov r10d, 0
je 0x140001851
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test sil, sil
jne 0x140003cca
mov ecx, dword [rbp - 0x48]
sub ecx, eax
add ecx, edi
cmp ecx, 5
jg 0x140001fd1
mov dword [0x14012de38], eax
mov al, 1
mov byte [rbp + 0x1288], al
movzx esi, al
mov byte [rbp + 0x1280], al
xor r10d, r10d
jmp 0x140001851
mov rcx, qword [0x1401251d8]
mov byte [rcx + 0x7e], 0
jmp 0x140003cfd
mov rcx, qword [0x1401251d8]
mov rdx, qword [0x14012bb50]
test rdx, rdx
je 0x140003d2a
lea r8, [rsp + 0x78]
mov rcx, qword [0x14012bb88]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x140001fc4
mov rcx, qword [0x1401251d8]
mov byte [rcx + 0x7e], 1
mov eax, dword [rbp - 0x80]
mov dword [rcx + 0x78], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rax, qword [0x1401251d8]
mov byte [rax + 0x7e], 0
jmp 0x140001fc4
mov dword [0x14012de38], eax
cmp byte [rsp + 0x4d], 0
je 0x140003d6e
mov byte [0x14012bb37], 0
cmp byte [rsp + 0x4e], 0
je 0x140003dc0
mov eax, dword [0x14012bb90]
dec eax
mov dword [0x14012bb90], eax
test edi, edi
jle 0x140003dc0
test eax, eax
jne 0x140003dc0
cmp dword [0x14012ddbc], eax
jne 0x140003dc0
cmp dword [0x14012bfec], eax
jne 0x140003dc0
cmp byte [0x14012bb36], al
je 0x140003dc0
mov edx, 9
mov rcx, qword [0x14012bb88]
call qword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x140003dc0
mov byte [0x14012bb36], 0
movzx eax, byte [rsp + 0x70]
jmp 0x140002435