Function at 0x140095340
Capabilities:
Create thread
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1401cd5c0]
xor rax, rsp
mov qword [rbp + 0x40], rax
lea rcx, [0x140095230]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14015b6b8
xor edi, edi
lea rcx, str..CarMetrics
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
mov qword [rax], rdi
mov rbx, rax
lea r8d, [rdi + 3]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x1400953c5
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs rdx, 0x3c3c86f048ad114
mov qword [0x1401f2410], rbx
movabs rcx, 0x1dd70e4a3072117
movabs r8, 0x1e31228b353c6f
call fcn.14009f980
movabs rdx, 0x2ccea3dc5a858df
mov qword [rbp - 0x80], rax
movabs rcx, 0x12e1797732825ef
movabs r8, 0x35fdb0cea1898e
call fcn.14009f980
movabs rdx, 0x3da4863129ea028
mov qword [rbp - 0x78], rax
movabs rcx, 0x2281c1070061f39
movabs r8, 0x204c4137fb4c0c
call fcn.14009f980
movabs rdx, 0x163c0cec2b5445f
mov qword [rbp - 0x70], rax
movabs rcx, 0x3c0df650b5875ae
movabs r8, 0x1754313c98627d
call fcn.14009f980
mov rcx, qword [rbx]
lea r8, [rbp - 0x80]
mov qword [rsp + 0x38], rdi
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x68], rax
mov edx, 0x222558
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400954a5
mov eax, 0xfffffff6
jmp 0x140096dfd
call fcn.140093a20
test al, al
jne 0x1400954b8
mov eax, 0xfffffff7
jmp 0x140096dfd
cmp qword [0x1401ebda0], rdi
jne 0x1400954cb
mov eax, 0xfffffff8
jmp 0x140096dfd
mov ecx, 1
call fcn.14015b6b8
lea rcx, [rbp + 0x18]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400ada20]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140096e90
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], r12
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x150], r15
cmp dword [rbp + 0x18], edi
je 0x140096e84
movaps xmm0, xmmword [rbp + 0x10]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140096e84
xorps xmm0, xmm0
mov ecx, 0x1f4
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401ebd98], dil
jne 0x14009570c
mov qword [rsp + 0x190], r13
movabs rbx, 0xfffffffffffd
movabs r13, 0xffffffffffff
movabs r15, 0xffff800fffffffff
movabs r12, 0xffffffffd
movabs r14, 0xfffffffffd
mov rsi, qword [0x1401f2410]
cmp qword [rsi], 0xffffffffffffffff
je 0x140095681
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea ecx, [rax + 0xf]
call fcn.14015b728
mov rbx, rax
mov qword [rsp + 0x38], rdi
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
mov edx, 0x222040
mov dword [rax], 0x74737552
mov dword [rax + 4], 0x65696c43
mov dword [rax + 8], 0x652e746e
mov word [rax + 0xc], 0x6578
mov byte [rax + 0xe], dil
lea rax, [rbp + 0x20]
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], Ordinal_30
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call fcn.14015b55c
mov r8, qword [rsp + 0x60]
movabs rcx, 0xfffffffffffd
lea rax, [r8 + r13]
cmp rax, rcx
ja 0x140095677
mov rdx, qword [rsp + 0x68]
lea rax, [rdx + r15]
cmp rax, r12
ja 0x140095677
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, r14
ja 0x140095677
mov qword [rsi + 0x18], r8
movabs rbx, 0xfffffffffffd
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rcx
jmp 0x14009568a
movabs rbx, 0xfffffffffffd
mov r8, rdi
mov rdx, rdi
mov rcx, rdi
lea rax, [r8 + r13]
cmp rax, rbx
ja 0x1400956a5
lea rax, [rdx + r15]
cmp rax, r12
ja 0x1400956a5
lea rax, [rcx - 1]
cmp rax, r14
jbe 0x1400956bf
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401ebd98], dil
je 0x1400955a3
jmp 0x140095704
cmp byte [0x1401ebd98], dil
jne 0x140095704
nop dword [rax + rax]
mov rdx, qword [0x1401f12f8]
mov rcx, qword [0x1401f1300]
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401ebd70], rax
test rax, rax
jne 0x140095704
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401ebd98], dil
je 0x1400956d0
mov r13, qword [rsp + 0x190]
mov rdx, qword [0x1401f12d0]
call fcn.140063980
mov qword [0x1401ebda8], rax
test rax, rax
jne 0x14009572c
lea edi, [rax - 7]
jmp 0x140096dd5
mov rdx, qword [0x1401f12d8]
call fcn.140063980
mov qword [0x1401ebdb0], rax
test rax, rax
jne 0x14009574c
lea edi, [rax - 6]
jmp 0x140096dd5
cmp byte [0x1401ebd98], dil
jne 0x14009582b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c478d0
call fcn.14009f6c0
mov edx, 2
mov qword [rbp + 0x20], reloc.SHLWAPI.dll_IStream_Read
mov rsi, rax
mov qword [rbp + 0x28], rdi
call fcn.1400a65a0
mov r8d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x20]
mov rcx, rax
lea rbx, [rax + 0x10]
mov qword [rsp + 0x50], rbx
call sub.VCRUNTIME140.dll_memmove
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov rdx, rsi
call fcn.14009fa50
mov edx, 2
mov qword [rsp + 0x60], rdi
mov rsi, rax
mov qword [rsp + 0x68], reloc.SHLWAPI.dll_IStream_Read
call fcn.1400a65a0
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
lea rbx, [rax + 0x10]
mov qword [rbp - 0x70], rbx
call sub.VCRUNTIME140.dll_memmove
lea r8, [rbp - 0x80]
mov qword [rbp - 0x78], rbx
mov rdx, rsi
call fcn.14009fa50
mov rdx, rax
call fcn.14009fc10
mov rcx, qword [0x1401f2410]
lea rdx, [rsi + 0x18]
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c8eb18
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c8df20
mov qword [0x1401ebdb8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c8eb18
mov qword [0x1401ebdc0], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c701c8
mov qword [0x1401ebdb8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c59120
mov qword [0x1401ebdf8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c49d10
mov qword [0x1401ebdc8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
mov qword [0x1401ebdd0], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
mov qword [0x1401ebdd8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c808c0
mov qword [0x1401ebde0], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c4e1f0
mov qword [0x1401ebde8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3caa9b8
mov qword [0x1401ebdf0], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c49a88
mov qword [0x1401ebe18], rax
call fcn.14009f6c0
mov rcx, qword [0x1401f2410]
mov rbx, qword [0x1401ebdb0]
mov qword [0x1401ebe30], rax
add rbx, 0xc00
mov eax, edi
mov r10, qword [rcx]
mov dword [rbp - 0x58], eax
cmp r10, 0xffffffffffffffff
je 0x140095a35
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x140095a35
mov qword [rsp + 0x38], rdi
lea rax, [rbx + 3]
mov qword [rbp - 0x70], rax
lea r8, [rbp - 0x80]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x68], rax
mov r9d, Ordinal_45
lea rax, [rbp + 0x20]
mov qword [rbp - 0x80], 1
mov qword [rsp + 0x30], rax
mov edx, 0x22219c
mov dword [rsp + 0x28], edi
mov rcx, r10
mov qword [rsp + 0x20], rdi
mov qword [rbp - 0x60], 4
mov dword [rbp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x1401f2410]
mov eax, dword [rbp - 0x58]
test eax, eax
jne 0x140095a3e
lea edx, [rax + 0x38]
jmp 0x140095a48
movsxd rdx, eax
add rdx, 0x3f
add rdx, rbx
call fcn.14009f6c0
mov rcx, qword [0x1401e3ec8]
mov qword [0x1401ebe50], rax
call fcn.14007ca00
lea rdx, [rsp + 0x60]
call fcn.1400642b0
lea r12, [0x1401ecbf0]
mov r15, rax
cmp r12, rax
je 0x140095afd
mov r14, qword [0x1401ecbf0]
mov rsi, qword [r14 + 8]
cmp byte [rsi + 0x19], dil
jne 0x140095ac1
nop
mov r8, qword [rsi + 0x10]
mov rdx, r12
mov rcx, r12
call fcn.1400a4c60
mov rbx, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x20]
call fcn.14009ba20
mov edx, 0x48
mov rcx, rbx
call fcn.14015b55c
cmp byte [rsi + 0x19], dil
je 0x140095a90
mov qword [r14 + 8], r14
mov qword [r14], r14
mov qword [r14 + 0x10], r14
mov rcx, qword [0x1401ecbf0]
mov qword [0x1401ecbf8], rdi
mov rax, qword [r15]
mov qword [0x1401ecbf0], rax
mov rax, qword [r15 + 8]
mov qword [r15], rcx
mov rcx, qword [0x1401ecbf8]
mov qword [0x1401ecbf8], rax
mov qword [r15 + 8], rcx
lea rcx, [rsp + 0x60]
call fcn.140099140
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov ecx, 5
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
cmp byte [0x1401ebd98], dil
jne 0x140095cc5
nop
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c8df20
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c8eb18
mov qword [0x1401ebdc0], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c701c8
mov qword [0x1401ebdb8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c59120
mov qword [0x1401ebdf8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c49d10
mov qword [0x1401ebdc8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
mov qword [0x1401ebdd0], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c808c0
mov qword [0x1401ebdd8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c4e1f0
mov qword [0x1401ebde8], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3caa9b8
mov qword [0x1401ebdf0], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
add rdx, 0x3c49a88
mov qword [0x1401ebe18], rax
call fcn.14009f6c0
mov rdx, qword [0x1401ebda8]
mov rcx, qword [0x1401f2410]
mov qword [0x1401ebe30], rax
call fcn.14009f6c0
mov ecx, Ordinal_41
mov qword [0x1401ebe48], rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140095cc5
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
sub rax, rbx
cmp rax, 0x1b6b0b00
jge 0x140095cc5
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401ebd98], dil
je 0x140095b30
mov ecx, 1
mov byte [0x1401ebf2c], 1
call fcn.14015b6b8
lea rcx, [rbp + 8]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400adc10]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp], rax
test rax, rax
je 0x140096e75
cmp dword [rbp + 8], edi
je 0x140096e84
movaps xmm0, xmmword [rbp]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140096e84
xorps xmm0, xmm0
lea ecx, [rax + 1]
movdqa xmmword [rbp], xmm0
call fcn.14015b6b8
lea rcx, [rbp - 8]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400add50]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x140096e66
cmp dword [rbp - 8], edi
je 0x140096e84
movaps xmm0, xmmword [rbp - 0x10]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140096e84
xorps xmm0, xmm0
lea ecx, [rax + 1]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.14015b6b8
lea rcx, [rbp - 0x18]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400addb0]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140096e57
cmp dword [rbp - 0x18], edi
je 0x140096e84
movaps xmm0, xmmword [rbp - 0x20]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140096e84
xorps xmm0, xmm0
lea ecx, [rax + 1]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14015b6b8
lea rcx, [rbp - 0x28]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400ade10]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140096e48
cmp dword [rbp - 0x28], edi
je 0x140096e84
movaps xmm0, xmmword [rbp - 0x30]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140096e84
xorps xmm0, xmm0
lea ecx, [rax + 1]
movdqa xmmword [rbp - 0x30], xmm0
call fcn.14015b6b8
lea rcx, [rbp - 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400adeb0]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140096e39
cmp dword [rbp - 0x38], edi
je 0x140096e84
movaps xmm0, xmmword [rbp - 0x40]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140096e84
xorps xmm0, xmm0
lea ecx, [rax + 1]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.14015b6b8
lea rcx, [rbp + 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400adf40]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x140096e2a
cmp dword [rbp + 0x38], edi
je 0x140096e84
movaps xmm0, xmmword [rbp + 0x30]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140096e84
xorps xmm0, xmm0
lea ecx, [rax + 1]
movdqa xmmword [rbp + 0x30], xmm0
call fcn.14015b6b8
lea rcx, [rbp - 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400ae030]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140096e1b
cmp dword [rbp - 0x48], edi
je 0x140096e84
movaps xmm0, xmmword [rbp - 0x50]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140096e84
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0x10000
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp byte [0x1401ebd98], dil
jne 0x1400963cd
movabs rsi, 0x346dc5d63886594b
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
mov rax, rsi
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [0x1401ec238]
cmp rdx, rax
jle 0x140096064
mov edx, 2
mov qword [rsp + 0x60], reloc.SHLWAPI.dll_IStream_Read
mov qword [rsp + 0x68], rdi
call fcn.1400a65a0
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
lea rbx, [rax + 0x10]
mov qword [rbp - 0x70], rbx
call sub.VCRUNTIME140.dll_memmove
mov rdx, qword [0x1401ebdf8]
lea r8, [rbp - 0x80]
mov qword [rbp - 0x78], rbx
call fcn.14009fa50
mov rcx, qword [0x1401f2410]
lea rdx, [rax + 0x10]
call fcn.14009f6c0
mov qword [0x1401f2360], rax
call fcn.14006b680
mov eax, dword [0x1401ec1e4]
inc eax
mov dword [0x1401ec1e4], eax
cmp eax, 0x3e8
jl 0x140096064
mov dword [0x1401ec1e4], edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x1401ebd70]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
sete byte [0x1401ebd99]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140096229
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140096100
mov rax, qword [0x1401ec428]
cmp byte [rax], dil
je 0x1400960b5
mov ecx, 0x7d0
mov byte [rax], dil
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1401ec490]
cmp byte [rax], dil
je 0x1400960c4
mov byte [rax], dil
mov rax, qword [0x1401ec4a8]
cmp byte [rax], dil
je 0x1400960d3
mov byte [rax], dil
mov rax, qword [0x1401ec4c0]
cmp byte [rax], dil
je 0x1400960e2
mov byte [rax], dil
mov rax, qword [0x1401ec4e0]
cmp byte [rax], dil
je 0x1400960f1
mov byte [rax], dil
mov rax, qword [0x1401ec518]
cmp byte [rax], dil
je 0x140096100
mov byte [rax], dil
cmp byte [0x1401ebd99], dil
je 0x140096217
mov ecx, dword [0x1401ebf30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14009612b
cmp byte [0x1401ebf08], dil
sete byte [0x1401ebf08]
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140096148
cmp byte [0x1401ec1c0], dil
sete byte [0x1401ec1c0]
cmp qword [0x1401ebee0], rdi
je 0x140096217
cmp byte [0x1401e52b4], dil
je 0x140096217
mov ecx, dword [0x1401ec35c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rax, qword [0x1401ec290]
setne cl
mov byte [rax], cl
mov ecx, dword [0x1401ec5e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140096197
mov rax, qword [0x1401ec5d8]
mov byte [rax], 1
mov ecx, dword [0x1401ec350]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rax, qword [0x1401ec5f8]
setne cl
mov byte [rax], cl
mov ecx, dword [0x1401ec384]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rax, qword [0x1401ec600]
setne cl
mov byte [rax], cl
mov ecx, dword [0x1401ec34c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400961eb
cmp byte [0x1401ec280], dil
sete byte [0x1401ec280]
mov eax, dword [0x1401ec1d4]
inc eax
mov dword [0x1401ec1d4], eax
cmp eax, 0x3e8
jl 0x140096206
mov dword [0x1401ec1d4], edi
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x20], 1
call fcn.14009fd80
cmp byte [0x1401ebd98], dil
je 0x140095fb5
jmp 0x1400963cd
mov byte [0x1401ebd98], 1
cmp dword [rbp + 0x18], edi
je 0x14009626b
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp + 0x18], eax
je 0x140096392
movaps xmm0, xmmword [rbp + 0x10]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400963b9
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
cmp dword [rbp + 8], edi
je 0x1400962a6
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp + 8], eax
je 0x140096392
movaps xmm0, xmmword [rbp]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400963b9
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
cmp dword [rbp - 8], edi
je 0x1400962e1
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 8], eax
je 0x140096392
movaps xmm0, xmmword [rbp - 0x10]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400963b9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
cmp dword [rbp - 0x18], edi
je 0x14009631c
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x18], eax
je 0x140096392
movaps xmm0, xmmword [rbp - 0x20]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400963b9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
cmp dword [rbp - 0x38], edi
je 0x14009634f
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x38], eax
je 0x140096392
movaps xmm0, xmmword [rbp - 0x40]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400963b9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
cmp dword [rbp - 0x28], edi
je 0x140096382
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x28], eax
je 0x140096392
movaps xmm0, xmmword [rbp - 0x30]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400963b9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
cmp dword [rbp - 0x48], edi
je 0x1400963cd
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x48], eax
jne 0x14009639e
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x50]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x1400963c5
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov rcx, qword [0x1401ebf10]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec640]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec648]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec650]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec658]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec660]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec690]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6a0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6a8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6b0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6b8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6c0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6c8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6d0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6d8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6e0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6e8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6f0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec6f8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec700]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec708]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec710]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec718]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec720]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec728]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec730]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec738]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec740]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec748]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec758]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec760]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec768]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec770]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec778]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec780]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec788]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec790]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec798]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7a0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7a8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7b0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7b8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7c0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7c8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7d0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7d8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7e0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7e8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7f0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec7f8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec800]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec808]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec810]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec818]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec820]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec828]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec830]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec838]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec840]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec848]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec850]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec858]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec860]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec868]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec870]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec878]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec880]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec888]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec898]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8a0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8a8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8b0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8b8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8c0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8c8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8e0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8e8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8f0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec8f8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec900]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec908]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec910]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec918]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec920]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec928]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec930]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec938]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec940]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec948]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec950]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec958]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec960]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec968]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec970]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec978]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec980]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec988]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec990]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec998]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9a0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9a8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9b0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9b8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9c0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9c8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9d0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9d8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9e0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9e8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9f0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ec9f8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca00]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca08]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca10]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca18]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca20]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca28]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca30]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca38]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca40]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca48]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca50]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca58]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca60]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca68]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca70]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca78]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca80]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca88]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca90]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401eca98]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecaa0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecaa8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecab0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecab8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecac0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecac8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecad0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecad8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecae0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecaf0]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecaf8]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecb00]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecb08]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecb10]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecb18]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecb20]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecb28]
mov edx, 1
call fcn.14015b55c
mov rcx, qword [0x1401ecb38]
mov edx, 1
call fcn.14015b55c
cmp dword [rbp - 0x48], edi
jne 0x140096e14
cmp dword [rbp + 0x38], edi
jne 0x140096e14
cmp dword [rbp - 0x38], edi
jne 0x140096e14
cmp dword [rbp - 0x28], edi
jne 0x140096e14
cmp dword [rbp - 0x18], edi
jne 0x140096e14
cmp dword [rbp - 8], edi
jne 0x140096e14
cmp dword [rbp + 8], edi
jne 0x140096e14
cmp dword [rbp + 0x18], 0
jne 0x140096e14
mov r14, qword [rsp + 0x158]
mov eax, edi
mov r12, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
mov r15, qword [rsp + 0x150]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.14015b1d0
add rsp, 0x160
pop rdi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rbp - 0x48], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x38], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x38], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x28], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x18], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 8], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 8], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x18], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3