Function at 0x140013590
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x270
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rbp + 0x150], rax
movsx r12d, r9w
mov rbx, r8
mov rax, rdx
mov qword [rbp - 0x50], rdx
mov r15, qword [rbp + 0x1d0]
test r8d, r8d
jne 0x140013607
mov rcx, rbx
shr rcx, 0x20
test ecx, ecx
jne 0x140013607
mov rdi, 0xffffffffffffffff
mov qword [rdx], rdi
mov dword [rdx + 8], edi
mov dword [rdx + 0xc], 0xff
jmp 0x14001483a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r14d, r14d
mov r13d, dword [rbp + 0x1c4]
cmp rax, qword [0x140163ce8]
jne 0x140013a59
imul r9d, r12d, 0x1e
add r9d, 0xfffffffa
add r9d, r13d
lea eax, [rbx + 0x168]
mov edx, dword [0x140163d08]
mov r10d, dword [0x140163d10]
cmp edx, r10d
jl 0x140013a59
cmp edx, dword [0x140163d18]
jg 0x140013a59
mov ecx, dword [0x140163d0c]
mov r8d, dword [0x140163d14]
cmp ecx, r8d
jl 0x140013a59
cmp ecx, dword [0x140163d1c]
jg 0x140013a59
sub edx, r10d
cmp edx, eax
jl 0x140013a59
add eax, 0x14
cmp edx, eax
jg 0x140013a59
sub ecx, r8d
cmp ecx, r9d
jl 0x140013a59
lea eax, [r9 + 0x14]
cmp ecx, eax
jg 0x140013a59
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140013a59
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
cmp dword [0x140163d28], r14d
jne 0x140013a59
mov edx, dword [r15 + 8]
lea rcx, [rbp + 0xb8]
call fcn.1400091e0
mov rsi, rax
mov edx, dword [r15 + 4]
lea rcx, [rbp + 0x38]
call fcn.1400091e0
mov rdi, rax
mov edx, dword [r15]
lea rcx, [rbp + 0x18]
call fcn.1400091e0
mov r8d, 2
lea rdx, [0x140148c38]
mov rcx, rax
call fcn.1400550d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], r14
mov byte [rax], r14b
mov r9, rdi
lea r8, [rbp + 0x130]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp - 8]
call fcn.1400bf930
mov r8d, 2
lea rdx, [0x140148c38]
lea rcx, [rbp - 8]
call fcn.1400550d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r14b
mov r9, rsi
lea r8, [rbp + 0x100]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0xd8]
call fcn.1400bf930
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x1400137f8
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400137f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013959
call fcn.140134770
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x140013833
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001382e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013959
call fcn.140134770
movdqa xmm0, xmmword [0x14014fd50]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], r14b
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x14001388d
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013880
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013959
call fcn.140134770
movdqa xmm0, xmmword [0x14014fd50]
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1400138d0
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400138c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013959
call fcn.140134770
movdqa xmm0, xmmword [0x14014fd50]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], r14b
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140013918
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001390b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013959
call fcn.140134770
movdqa xmm0, xmmword [0x14014fd50]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], r14b
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x140013965
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013960
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013960
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140134770
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rax, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0xf
cmova rax, qword [rbp + 0xd8]
mov rdi, 0xffffffffffffffff
mov rdx, rdi
inc rdx
cmp byte [rax + rdx], r14b
jne 0x140013994
inc rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
lea r14, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0xf
cmova r14, qword [rbp + 0xd8]
lea r9, [rbp + 0xd8]
cmova r9, qword [rbp + 0xd8]
lea rdi, [rdi + 1]
cmp byte [r9 + rdi], 0
jne 0x1400139d1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, r14
lea rdx, [rdi + 1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x140013a56
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013a51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013a51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140134770
xor r14d, r14d
movzx esi, r14w
imul eax, r12d, 0x1e
add eax, r13d
mov dword [rsp + 0x3c], eax
add eax, 0xfffffffa
mov dword [rsp + 0x34], eax
add eax, 0x14
mov dword [rsp + 0x38], eax
mov r13d, 3
nop dword [rax]
mov eax, dword [r15]
mov dword [rsp + 0x40], eax
mov eax, dword [r15 + 4]
mov dword [rsp + 0x44], eax
mov eax, dword [r15 + 8]
mov dword [rsp + 0x48], eax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r14
mov rdx, r13
lea rcx, [rbp + 0x100]
call fcn.1400306d0
mov rdi, qword [rbp + 0x100]
mov r8d, listen
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + 0xc]
mov qword [rbp + 0x108], rax
movsx eax, si
imul r12d, eax, 0x2e
lea r14d, [rbx + 0xda]
add r14d, r12d
mov rdx, qword [0x140163d08]
mov rax, qword [0x140163d10]
cmp edx, eax
jl 0x140013b48
cmp edx, dword [0x140163d18]
jg 0x140013b48
mov rcx, qword [0x140163d0c]
mov r8, qword [0x140163d14]
cmp ecx, r8d
jl 0x140013b48
cmp ecx, dword [0x140163d1c]
jg 0x140013b48
sub edx, eax
cmp edx, r14d
jl 0x140013b48
lea eax, [r14 + 0x29]
cmp edx, eax
jg 0x140013b48
sub ecx, r8d
cmp ecx, dword [rsp + 0x34]
jl 0x140013b48
cmp ecx, dword [rsp + 0x38]
jg 0x140013b48
mov edi, 1
jmp 0x140013b4a
xor edi, edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x140163ce8]
jne 0x140013c82
test edi, edi
je 0x140013c82
cmp dword [0x140163d28], 0
jne 0x140013c82
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140013bb0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
movsx rcx, si
mov rax, qword [rbp + 0x100]
inc dword [rax + rcx*4]
jmp 0x140013bec
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140013bec
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_mouse_event]
movsx rcx, si
mov rax, qword [rbp + 0x100]
dec dword [rax + rcx*4]
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140013c02
mov cl, 0x25
jmp 0x140013c16
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140013c38
mov cl, 0x26
xor r9d, r9d
mov r8d, 2
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movsx rcx, si
mov rax, qword [rbp + 0x100]
add dword [rax + rcx*4], 5
jmp 0x140013c82
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140013c4e
mov cl, 0x27
jmp 0x140013c62
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140013c82
mov cl, Ordinal_41
xor r9d, r9d
mov r8d, 2
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movsx rcx, si
mov rax, qword [rbp + 0x100]
add dword [rax + rcx*4], 0xfffffffb
movsx rax, si
mov r8, qword [rbp + 0x100]
lea rcx, [r8 + rax*4]
mov eax, dword [rcx]
cmp eax, 0xff
jl 0x140013ca2
mov dword [rcx], 0xff
jmp 0x140013cac
test eax, eax
jg 0x140013cb3
mov dword [rcx], 0
mov r8, qword [rbp + 0x100]
mov edx, dword [r8 + 4]
mov ecx, dword [r8 + 8]
mov eax, dword [r8]
mov dword [r15], eax
mov dword [r15 + 4], edx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], 0xff
xor eax, eax
mov qword [rbp - 0x48], rax
mov word [rbp + 0xe6], ax
mov word [rbp + 0xf6], ax
mov dword [rbp + 0x120], eax
mov dword [rbp + 0x124], 1
shr rax, 0x20
movzx edx, al
shl edx, 8
mov dword [rbp + 0xd8], r14d
mov eax, dword [rsp + 0x34]
mov dword [rbp + 0xdc], eax
lea eax, [r14 + 0x29]
mov dword [rbp + 0xe8], eax
mov eax, dword [rsp + 0x38]
mov dword [rbp + 0xec], eax
movzx ecx, dl
shl cx, 8
mov word [rbp + 0xe0], cx
mov word [rbp + 0xe2], dx
mov eax, edx
shr eax, 0x10
shl ax, 8
mov word [rbp + 0xe4], ax
mov word [rbp + 0xf0], cx
mov word [rbp + 0xf2], dx
mov word [rbp + 0xf4], ax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x120]
mov r8d, 2
lea rdx, [rbp + 0xd8]
mov rcx, qword [0x140163d00]
call qword [sym.imp.MSIMG32.dll_GradientFill]
mov r11d, dword [rsp + 0x3c]
add r11d, 0xfffffffb
lea r10d, [rbx + 0xdb]
add r10d, r12d
xor r14d, r14d
mov word [rbp + 0xe6], r14w
mov word [rbp + 0xf6], r14w
test edi, edi
je 0x140013e9e
mov dword [rbp - 0x28], reloc.WLDAP32.dll_Ordinal_30
mov dword [rbp - 0x24], reloc.WLDAP32.dll_Ordinal_30
mov eax, dword [0x140163cd4]
cdq
and edx, r13d
lea r8d, [rdx + rax]
sar r8d, 2
mov dword [rbp - 0x38], r8d
mov eax, dword [0x140163cd8]
cdq
and edx, r13d
add eax, edx
sar eax, 2
mov dword [rbp - 0x34], eax
mov dword [rbp + 0x128], r14d
mov dword [rbp + 0x12c], 1
mov eax, dword [0x140163cdc]
cdq
and edx, r13d
add eax, edx
sar eax, 2
movzx r9d, al
mov rax, qword [rbp - 0x38]
shr rax, 0x20
movzx ecx, al
shl ecx, 8
mov eax, r9d
shl eax, 0x10
or ecx, eax
movzx eax, r8b
or ecx, eax
mov rax, qword [rbp - 0x28]
shr rax, 0x20
movzx edx, al
shl edx, 8
or edx, 0x1e001e
lea eax, [r10 + 0x27]
mov dword [rbp + 0xe8], eax
lea eax, [r11 + 0x12]
mov dword [rbp + 0xec], eax
movzx eax, cl
shl ax, 8
mov word [rbp + 0xe0], ax
mov edi, 0xff00
and cx, di
shl r9w, 8
mov word [rbp + 0xe4], r9w
movzx eax, dl
shl ax, 8
mov word [rbp + 0xf0], ax
movzx eax, dx
and ax, di
lea r9, [rbp + 0x128]
jmp 0x140013f98
mov dword [rbp + 0x130], reloc.WLDAP32.dll_Ordinal_30
mov dword [rbp + 0x134], reloc.WLDAP32.dll_Ordinal_30
mov eax, 0x66666667
imul dword [0x140163cd4]
mov r9d, edx
sar r9d, 1
mov eax, r9d
shr eax, 0x1f
add r9d, eax
mov dword [rbp - 0x18], r9d
mov eax, 0x66666667
imul dword [0x140163cd8]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rbp - 0x14], edx
mov dword [rbp + 0xf8], r14d
mov dword [rbp + 0xfc], 1
mov eax, 0x66666667
imul dword [0x140163cdc]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx r8d, dl
mov rax, qword [rbp - 0x18]
shr rax, 0x20
movzx ecx, al
shl ecx, 8
mov eax, r8d
shl eax, 0x10
or ecx, eax
movzx eax, r9b
or ecx, eax
mov rax, qword [rbp + 0x130]
shr rax, 0x20
movzx edx, al
shl edx, 8
or edx, 0x1e001e
lea eax, [r10 + 0x27]
mov dword [rbp + 0xe8], eax
lea eax, [r11 + 0x12]
mov dword [rbp + 0xec], eax
movzx eax, cl
shl ax, 8
mov word [rbp + 0xe0], ax
mov r9d, 0xff00
and cx, r9w
shl r8w, 8
mov word [rbp + 0xe4], r8w
movzx eax, dl
shl ax, 8
mov word [rbp + 0xf0], ax
movzx eax, dx
and ax, r9w
lea r9, [rbp + 0xf8]
shr edx, 0x10
shl dx, 8
mov dword [rsp + 0x28], 1
mov word [rbp + 0xf4], dx
mov word [rbp + 0xe2], cx
mov dword [rsp + 0x20], 1
mov dword [rbp + 0xd8], r10d
mov dword [rbp + 0xdc], r11d
mov word [rbp + 0xf2], ax
mov r8d, 2
lea rdx, [rbp + 0xd8]
mov rcx, qword [0x140163d00]
call qword [sym.imp.MSIMG32.dll_GradientFill]
mov rcx, qword [rbp + 0x100]
test rcx, rcx
je 0x14001402c
mov rdx, qword [rbp + 0x110]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014027
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014092
call fcn.140134770
inc si
cmp si, 2
jle 0x140013a80
movdqa xmm6, xmmword [0x14014fed0]
mov ecx, dword [r15]
lea r10, [rbp + 0x145]
test ecx, ecx
jns 0x1400140a0
neg ecx
nop dword [rax]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x140014060
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400140c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x1400140a0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x145]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.1400c22c0
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r8
lea r14, [0x140148c3c]
cmp rax, r13
jb 0x14001417b
lea rax, [r8 + 3]
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x50]
cmp rcx, 0xf
cmova rdi, qword [rsp + 0x50]
lea rax, [0x140148c3f]
cmp rax, rdi
jbe 0x14001413e
lea rax, [rdi + r8]
cmp r14, rax
ja 0x14001413e
cmp rdi, r14
ja 0x140014136
xor eax, eax
mov esi, eax
jmp 0x140014141
mov rsi, rdi
sub rsi, r14
jmp 0x140014141
mov rsi, r13
inc r8
lea rcx, [rdi + 3]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r13
sub r8, rsi
lea rdx, [r14 + 3]
add rdx, rsi
lea rcx, [rdi + rsi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x50]
jmp 0x14001419b
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.1400c5020
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], sil
movaps xmmword [rbp + 0x130], xmm6
mov r12d, dword [rsp + 0x3c]
add r12d, 0xfffffffe
lea edx, [rbx + 0xdf]
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x58]
mov r8d, r12d
call fcn.14000f330
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140014238
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014233
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014233
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140134770
movdqa xmm6, xmmword [0x14014fed0]
mov r8d, dword [r15 + 4]
lea r10, [rbp + 0x145]
test r8d, r8d
jns 0x1400142a0
neg r8d
nop dword [rax]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140014260
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400142ca
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400142a0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x145]
mov rdx, r10
lea rcx, [rsp + 0x70]
call fcn.1400c22c0
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
lea r14, [0x140148c40]
cmp rax, r13
jb 0x140014375
lea rax, [r8 + 3]
mov qword [rbp - 0x80], rax
lea rdi, [rsp + 0x70]
cmp rcx, 0xf
cmova rdi, qword [rsp + 0x70]
lea rax, [0x140148c43]
cmp rax, rdi
jbe 0x140014336
lea rax, [rdi + r8]
cmp r14, rax
ja 0x140014336
cmp rdi, r14
jbe 0x140014339
mov rsi, rdi
sub rsi, r14
jmp 0x140014339
mov rsi, r13
inc r8
lea rcx, [rdi + 3]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r13
sub r8, rsi
lea rdx, [r14 + 3]
add rdx, rsi
lea rcx, [rdi + rsi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
xor esi, esi
jmp 0x140014395
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.1400c5020
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
movaps xmmword [rbp + 0x130], xmm6
lea edx, [rbx + 0x10d]
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x78]
mov r8d, r12d
call fcn.14000f330
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14001442c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014427
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014427
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140134770
movdqa xmm6, xmmword [0x14014fed0]
mov r8d, dword [r15 + 8]
lea r10, [rbp + 0x145]
test r8d, r8d
jns 0x140014490
neg r8d
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140014450
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400144ba
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140014490
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x145]
mov rdx, r10
lea rcx, [rbp - 0x70]
call fcn.1400c22c0
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
sub rax, r8
lea r14, [0x140148c44]
cmp rax, r13
jb 0x140014561
lea rax, [r8 + 3]
mov qword [rbp - 0x60], rax
lea rdi, [rbp - 0x70]
cmp rcx, 0xf
cmova rdi, qword [rbp - 0x70]
lea rax, [0x140148c47]
cmp rax, rdi
jbe 0x140014523
lea rax, [rdi + r8]
cmp r14, rax
ja 0x140014523
cmp rdi, r14
jbe 0x140014526
mov rsi, rdi
sub rsi, r14
jmp 0x140014526
mov rsi, r13
inc r8
lea rcx, [rdi + 3]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r13, rsi
lea rdx, [r14 + 3]
add rdx, rsi
lea rcx, [rdi + rsi]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x70]
xor esi, esi
jmp 0x140014580
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov rdx, r13
lea rcx, [rbp - 0x70]
call fcn.1400c5020
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
movaps xmmword [rbp + 0x130], xmm6
lea edx, [rbx + 0x13b]
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x98]
mov r8d, r12d
call fcn.14000f330
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14001461f
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001461a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001461a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140134770
mov qword [rbp + 0x130], 0
lea ecx, [rbx + 0x168]
mov dword [rbp + 0xe4], 0
mov dword [rbp + 0xf4], 0
mov dword [rbp + 0xf8], esi
mov dword [rbp + 0xfc], 1
mov rax, qword [rbp + 0x130]
shr rax, 0x20
movzx edx, al
shl edx, 8
mov dword [rbp + 0xd8], ecx
mov eax, dword [rsp + 0x34]
mov dword [rbp + 0xdc], eax
lea eax, [rcx + 0x14]
mov dword [rbp + 0xe8], eax
mov eax, dword [rsp + 0x38]
mov dword [rbp + 0xec], eax
movzx eax, dl
shl ax, 8
mov word [rbp + 0xe0], ax
mov word [rbp + 0xe2], dx
mov word [rbp + 0xf0], ax
mov word [rbp + 0xf2], dx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0xf8]
mov r8d, 2
lea rdx, [rbp + 0xd8]
mov rcx, qword [0x140163d00]
call qword [sym.imp.MSIMG32.dll_GradientFill]
mov eax, dword [r15]
cdq
and edx, 3
lea r8d, [rdx + rax]
sar r8d, 2
mov dword [rbp + 0x130], r8d
mov eax, dword [r15 + 4]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [rbp + 0x134], eax
add ebx, 0x169
mov word [rbp + 0xe6], si
mov word [rbp + 0xf6], si
mov dword [rbp + 0xf8], esi
mov dword [rbp + 0xfc], 1
mov rdx, qword [r15]
mov rax, rdx
shr rax, 0x20
movzx r9d, al
shl r9d, 8
mov eax, dword [r15 + 8]
movzx ecx, al
shl ecx, 0x10
or r9d, ecx
movzx eax, dl
or r9d, eax
mov eax, dword [r15 + 8]
cdq
and edx, 3
add eax, edx
sar eax, 2
movzx edx, al
mov rax, qword [rbp + 0x130]
shr rax, 0x20
movzx ecx, al
shl ecx, 8
mov eax, edx
shl eax, 0x10
or ecx, eax
movzx eax, r8b
or ecx, eax
mov dword [rbp + 0xd8], ebx
mov r8d, dword [rsp + 0x3c]
add r8d, 0xfffffffb
mov dword [rbp + 0xdc], r8d
lea eax, [rbx + 0x12]
mov dword [rbp + 0xe8], eax
lea eax, [r8 + 0x12]
mov dword [rbp + 0xec], eax
movzx eax, r9b
shl ax, 8
mov word [rbp + 0xe0], ax
movzx eax, r9w
mov r8d, 0xff00
and ax, r8w
mov word [rbp + 0xe2], ax
shr r9d, 0x10
shl r9w, 8
mov word [rbp + 0xe4], r9w
movzx eax, cl
shl ax, 8
mov word [rbp + 0xf0], ax
and cx, r8w
mov word [rbp + 0xf2], cx
shl dx, 8
mov word [rbp + 0xf4], dx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0xf8]
mov r8d, 2
lea rdx, [rbp + 0xd8]
mov rcx, qword [0x140163d00]
call qword [sym.imp.MSIMG32.dll_GradientFill]
movups xmm0, xmmword [r15]
mov rax, qword [rbp - 0x50]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140134750
mov rbx, qword [rsp + 0x2b0]
movaps xmm6, xmmword [rsp + 0x260]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret