Function at 0x14001dda0
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x958
lea rbp, [rsp + 0x60]
cmp word [rcx], 0
mov r12, r9
mov r13d, r8d
mov r15d, edx
mov r14, rcx
je 0x14001f6b2
mov rsi, qword [0x14011f188]
xor dil, dil
mov eax, dword [0x140127cd8]
mov qword [rbp + 0x30], rsi
mov dword [rbp + 0x38], eax
test edx, edx
jne 0x14001de69
lea r8d, [rdx + 6]
lea rdx, str.Blind
call fcn.1400c15e4
test eax, eax
jne 0x14001de69
movzx eax, word [r14 + 0xc]
add r14, 0xc
mov byte [0x140128020], 1
cmp ax, 0x7d
je 0x14001de75
test ax, ax
je 0x14001f6b2
cmp ax, 0x21
je 0x14001de54
cmp ax, 0x23
je 0x14001de4e
cmp ax, 0x2b
je 0x14001de48
cmp ax, 0x5e
jne 0x14001de58
or dil, 3
jmp 0x14001de58
or dil, 0x30
jmp 0x14001de58
or dil, 0xc0
jmp 0x14001de58
or dil, 0xc
movzx eax, word [r14 + 2]
add r14, 2
cmp ax, 0x7d
jne 0x14001de21
jmp 0x14001de75
mov byte [0x140128020], dil
test r15d, r15d
jne 0x14001de9f
mov r8d, 6
lea rdx, [0x140102608]
mov rcx, r14
call fcn.1400c15e4
test eax, eax
jne 0x14001de9f
mov r15d, 2
add r14, 0xc
mov dword [rbp + 0x948], r15d
mov eax, dword [rsi + 0x98]
mov dword [rbp + 0x3c], eax
mov eax, dword [rsi + 0xa0]
xor esi, esi
mov dword [rbp + 0x40], eax
lea eax, [r13 - 1]
test eax, 0xfffffffd
jne 0x14001df95
mov rcx, qword [0x140127f10]
test rcx, rcx
je 0x14001ded4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.AHK_Keybd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x140127f10], 0
mov esi, eax
je 0x14001df03
mov qword [0x140127f10], rbx
jmp 0x14001df11
test rbx, rbx
je 0x14001df11
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xb7
je 0x14001df4a
test r15d, r15d
jne 0x14001df3b
call fcn.140017390
test al, al
je 0x14001df3b
lea rdx, [0x140102a60]
mov rcx, r14
call fcn.14009d9e0
test rax, rax
jne 0x14001df4a
mov r13d, 1
mov dword [rbp + 0x950], r13d
jmp 0x14001df93
cmp r13d, 3
jne 0x14001df5f
mov r13d, 2
mov dword [rbp + 0x950], r13d
jmp 0x14001df93
mov rsi, qword [rbp + 0x30]
xor eax, eax
mov r13d, eax
mov dword [rbp + 0x950], eax
cmp dword [rsi + 0x98], eax
jge 0x14001df83
cmp dword [rsi + 0xa0], eax
jge 0x14001df83
mov eax, 0xffffffff
mov dword [rsi + 0xa0], eax
mov dword [rsi + 0x98], 0xffffffff
xor esi, esi
mov byte [rbp + 8], 0
mov ebx, esi
test r12, r12
je 0x14001dff8
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x24], eax
mov r15d, eax
test eax, eax
je 0x14001e0ea
cmp eax, dword [0x140127508]
je 0x14001e0ea
mov rcx, r12
call fcn.1400a46f0
test al, al
jne 0x14001e0ea
mov ecx, dword [0x140127508]
mov r8d, 1
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov ebx, r15d
setne byte [rbp + 8]
jmp 0x14001e0ea
test byte [0x140127c7e], 0xc0
je 0x14001e09c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140127c74]
cmp eax, 0x32
jae 0x14001e09c
cmp r13d, 2
je 0x14001e09c
cmp byte [0x140128020], 0
jne 0x14001e09c
cmp r15d, 2
je 0x14001e09c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x140127508]
jne 0x14001e09c
test r15d, r15d
je 0x14001e191
mov r8, r14
test r14, r14
je 0x14001e090
movzx edx, word [r14]
test dx, dx
je 0x14001e090
mov r9d, 0x4c
nop dword [rax]
lea rcx, [0x140102a70]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x14001e093
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e070
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14001e060
mov r8, rsi
test r8, r8
jne 0x14001e215
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14001e0e1
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x70]
mov dword [rbp + 0x70], 0x48
mov ecx, eax
mov ebx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14001e0e1
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14001e0e1
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov eax, dword [rbp + 0x940]
mov dword [rbp + 0x24], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r15d, r15d
lea r9, [0x140127f60]
mov ecx, r15d
mov qword [0x140127f58], rax
mov rdx, r9
mov rsi, rax
nop dword [rax]
mov r8, qword [rdx]
test r8, r8
je 0x14001e12c
cmp r8, rsi
je 0x14001e25e
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x14001e110
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, rsi
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.140022fe0
mov dword [rbx + 8], eax
mov qword [rbx], rsi
mov cl, 1
mov dword [0x140128000], eax
call fcn.140022a50
and byte [0x140127f57], al
movzx ebx, al
cmp qword [0x140125d78], r15
je 0x14001e26e
movzx eax, byte [0x140125e84]
movzx edx, byte [0x140125e82]
movzx ecx, al
and cl, dl
not al
and al, dl
mov byte [rbp + 6], al
jmp 0x14001e296
mov r9d, 0x4c
mov rdx, r14
lea r10d, [r9 + 0x2f]
nop
test rdx, rdx
je 0x14001e09c
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001e09c
lea rcx, [0x140102a70]
movzx eax, r9w
cmp r8w, ax
je 0x14001e1db
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e1c2
add rdx, 2
jmp 0x14001e1a9
add rdx, 2
je 0x14001e215
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001e215
lea rcx, [0x140102a78]
movzx eax, r10w
cmp r8w, ax
je 0x14001e20f
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001e1f6
add rdx, 2
jmp 0x14001e1e1
cmp word [rdx], r10w
jne 0x14001e1a0
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x14001e23d
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14001e09c
mov edx, 1
mov dword [0x14011f180], esi
mov ecx, 0x8000012f
call fcn.140001710
mov dword [0x14011f180], 1
jmp 0x14001e215
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x14001e14f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140127c74]
cmp eax, dword [0x14011fb30]
jae 0x14001e28d
movzx edx, byte [0x140127c7e]
and dl, bl
jmp 0x14001e28f
xor dl, dl
movzx ecx, dl
mov byte [rbp + 6], r15b
movzx r13d, byte [0x140127f56]
not cl
and cl, bl
mov byte [rbp + 3], dl
and r13b, cl
mov byte [rbp + 5], r15b
cmp byte [0x140128020], r15b
mov byte [rbp + 0x940], r13b
mov byte [0x140127f56], r13b
je 0x14001e2f1
mov byte [rbp + 0x940], bl
movzx r13d, bl
mov byte [rbp], bl
test dil, dil
je 0x14001e2f5
movzx eax, dil
not al
and al, bl
movzx r13d, al
mov byte [rbp + 0x940], al
mov byte [rbp], al
xor al, bl
mov byte [rbp + 5], al
jmp 0x14001e2f5
mov byte [rbp], r13b
mov rax, qword [rbp + 0x30]
cmp byte [rax + 0xc4], r15b
je 0x14001e325
cmp byte [0x140128020], r15b
jne 0x14001e325
cmp dword [rbp + 0x948], 2
je 0x14001e325
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140022090
mov dword [rbp + 0x20], eax
jmp 0x14001e329
mov dword [rbp + 0x20], r15d
mov ecx, dword [rbp + 0x950]
mov eax, 0x1f4
mov dword [0x140128014], ecx
mov edi, 0x5dc
test ecx, ecx
je 0x14001e3cf
cmp ecx, 1
mov edx, 0x2ee0
cmovne eax, edi
mov dword [0x140128008], eax
mov eax, 0x4e20
cmovne eax, edx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001e373
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400daca0
mov rax, qword [0x140122088]
sub rsp, rcx
mov byte [0x140128010], bl
xor ebx, ebx
mov byte [0x140128011], r15b
mov dword [0x140128004], ebx
lea rcx, [rsp + 0x60]
mov byte [0x140128012], bl
mov qword [rax], rcx
mov ecx, dword [rbp + 0x950]
mov dword [0x140128018], 0x80000000
mov dword [0x14012801c], 0x80000000
mov byte [0x140128013], 1
jmp 0x14001e3d1
xor ebx, ebx
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
movzx esi, byte [0x140125ad8]
add eax, 0xfffffff9
mov byte [rbp + 0xa], sil
test eax, 0xfffffffd
jne 0x14001e40d
test ecx, ecx
jne 0x14001e40d
test r12, r12
jne 0x14001e40d
lea ecx, [r12 + 1]
mov byte [rbp + 9], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140125ad8], 1
jmp 0x14001e411
mov byte [rbp + 9], r15b
cmp word [r14], 0
mov byte [rbp + 1], r15b
je 0x14001f37d
lea rdi, [0x140000000]
jmp 0x14001e441
movzx r13d, byte [rbp + 0x940]
xor ebx, ebx
mov r12, qword [rbp + 0x958]
cmp dword [0x140128014], 0
mov byte [rbp + 4], 0
jne 0x14001e4af
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14011f188]
sub eax, dword [0x140127cd8]
cmp eax, dword [rcx + 0x88]
jbe 0x14001e4af
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp + 0xc0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001e4a3
mov edx, 1
mov dword [0x14011f180], ebx
lea ecx, [rdx - 2]
call fcn.140001710
mov dword [0x14011f180], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140127cd8], eax
mov esi, dword [rbp + 0x948]
test esi, esi
jne 0x14001f053
movzx edx, word [r14]
lea rcx, [0x140102a80]
call fcn.1400bcaf8
test rax, rax
je 0x14001f0ae
movzx eax, word [r14]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x14001e4fa.38
cdqe
movzx eax, byte [rdi + rax + 0x1f6e4]
mov ecx, dword [rdi + rax*4 + 0x1f6c8]
add rcx, rdi
jmp rcx
test r13b, 3
jne case.0x14001e4fa.38
or r15b, 1
jmp 0x14001f346
test r13b, 0x30
jne case.0x14001e4fa.38
or r15b, 0x10
jmp 0x14001f346
test r13b, 0xc
jne case.0x14001e4fa.38
or r15b, 4
jmp 0x14001f346
test r13b, 0xc0
jne case.0x14001e4fa.38
or r15b, 0x40
jmp 0x14001f346
mov edx, 0x7d
lea rcx, [r14 + 2]
call fcn.1400bcaf8
mov qword [rbp + 0x48], rax
mov rdi, rax
test rax, rax
je case.0x14001e4fa.38
movzx ecx, word [r14 + 2]
add r14, 2
cmp cx, 0x20
je 0x14001e566
cmp cx, 9
je 0x14001e566
mov r12, rax
sub r12, r14
sar r12, 1
jne 0x14001e632
lea rbx, [rax + 2]
movzx eax, word [rax + 2]
cmp ax, 0x7d
jne 0x14001e5aa
mov rdi, rbx
mov qword [rbp + 0x48], rbx
mov r12d, 1
jmp 0x14001e63f
cmp ax, 0x20
je 0x14001e5cc
cmp ax, 9
jne 0x14001e781
nop word [rax + rax]
cmp ax, 0x20
je 0x14001e5cc
cmp ax, 9
jne 0x14001e5d6
movzx eax, word [rbx + 2]
add rbx, 2
jmp 0x14001e5c0
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call fcn.1400c15e4
test eax, eax
je 0x14001e60c
mov r8d, 2
lea rdx, [0x1401017c8]
mov rcx, rbx
call fcn.1400c15e4
test eax, eax
jne 0x14001e781
mov edx, 0x7d
mov rcx, rbx
call fcn.1400bcaf8
mov qword [rbp + 0x48], rax
mov rdi, rax
test rax, rax
je case.0x14001e4fa.38
mov r12, rax
sub r12, r14
sar r12, 1
cmp r12, 0x400
jae 0x14001e781
lea rbx, [r12 + r12]
mov rdx, r14
mov r8, rbx
lea rcx, [rbp + 0xf0]
call fcn.1400bcbb0
xor esi, esi
lea rdx, str.Click
lea rcx, [rbp + 0xf0]
mov word [rbp + rbx + 0xf0], si
lea r8d, [rsi + 5]
call fcn.1400c15e4
test eax, eax
jne 0x14001e75f
lea rcx, [rbp + 0xfa]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001e694
cmp ax, 9
jne 0x14001e69a
add rcx, 2
jmp 0x14001e685
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 2]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x14]
lea rax, [rbp + 0xc]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x20], rax
call fcn.140020780
mov ecx, dword [rbp + 0x10]
cmp ecx, 1
jge 0x14001e707
mov rax, qword [rbp + 0x30]
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x14]
lea rcx, [rbp + 0x18]
movzx r9d, byte [rax + 0xc3]
movzx eax, byte [rbp + 7]
mov byte [rsp + 0x20], al
call fcn.140021390
movzx r12d, byte [rbp + 0x940]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
jmp 0x14001f34e
movzx eax, byte [rbp + 7]
xor edx, edx
mov byte [rsp + 0x50], al
movzx r9d, r13b
mov eax, dword [rbp + 0x14]
movzx r8d, r15b
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x18]
mov dword [rsp + 0x40], eax
mov rax, qword [rbp + 0x958]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0xc]
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
movzx ecx, byte [rbp + 2]
call fcn.14001f750
movzx r12d, byte [rbp + 0x940]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
jmp 0x14001f34e
lea rdx, [0x140102aa0]
lea rcx, [rbp + 0xf0]
call fcn.1400c1404
test eax, eax
jne 0x14001e795
mov eax, 1
mov dword [rbp + 0x948], eax
movzx r12d, byte [rbp + 0x940]
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001f34e
lea rdx, str.Text
lea rcx, [rbp + 0xf0]
call fcn.1400c1404
test eax, eax
jne 0x14001e7cb
movzx r12d, byte [rbp + 0x940]
mov eax, 2
mov r14, qword [rbp + 0x48]
xor r15b, r15b
mov dword [rbp + 0x948], eax
jmp 0x14001f34e
movzx edx, word [rbp + 0xf0]
lea rbx, [rbp + 0xf0]
mov r15d, 2
mov r13d, 1
mov dword [rbp + 0xc], r15d
mov r14, r12
mov dword [rbp + 0x10], r13d
test dx, dx
je 0x14001e8f2
nop dword [rax]
lea rcx, [0x140102ab4]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14001e830
add rcx, r15
movzx eax, word [rcx]
test ax, ax
jne 0x14001e810
add rbx, r15
movzx edx, word [rbx]
test dx, dx
jne 0x14001e800
jmp 0x14001e8f2
test rbx, rbx
je 0x14001e8f2
lea rax, [rbp + 0xf0]
mov word [rbx], si
mov r14, rbx
sub r14, rax
sar r14, 1
add rbx, r15
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14001e84c
cmp ax, 9
je 0x14001e84c
mov rax, rdi
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14001e8f2
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call fcn.1400c15e4
test eax, eax
jne 0x14001e8c8
lea r8d, [rax + 4]
mov dword [rbp + 0xc], esi
lea rdx, str.Temp
mov r15d, esi
lea rcx, [rbx + 8]
call fcn.1400c15e4
test eax, eax
jne 0x14001e8ab
mov dword [rbp + 0x1c], esi
jmp 0x14001e8f2
cmp word [rbx + 8], 0x52
mov ecx, esi
sete cl
call fcn.1400cdca8
test eax, eax
mov ebx, esi
setne bl
inc ebx
mov dword [rbp + 0x1c], ebx
jmp 0x14001e8f2
lea rdx, [0x1401017c8]
mov rcx, rbx
call fcn.1400c1404
test eax, eax
jne 0x14001e8e4
mov r15d, r13d
mov dword [rbp + 0xc], r13d
jmp 0x14001e8f2
mov rcx, rbx
call fcn.14009def0
mov r13, rax
mov dword [rbp + 0x10], eax
mov rcx, qword [0x140127f58]
lea rdx, [rbp + 1]
mov qword [rsp + 0x20], rcx
mov r8b, 1
lea rcx, [rbp + 0xf0]
call fcn.140023640
mov byte [rbp + 2], al
movzx edi, al
test al, al
jne 0x14001e9a9
xor edx, edx
lea rcx, [rbp + 0xf0]
call fcn.140023550
movzx esi, ax
test ax, ax
jne 0x14001e9a9
mov r8d, 2
lea rdx, [0x140102458]
lea rcx, [rbp + 0xf0]
call fcn.1400c15e4
test eax, eax
jne 0x14001e9a9
lea r8d, [rax + 0x10]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xf4]
call fcn.1400c8160
mov rcx, qword [rbp + 0x28]
lea rdx, [0x140102c38]
mov r8d, 2
mov ebx, eax
call fcn.1400c15e4
test eax, eax
jne 0x14001e9a9
mov rcx, qword [rbp + 0x28]
lea r8d, [rax + 0x10]
add rcx, 4
lea rdx, [rbp + 0x28]
call fcn.1400c8160
mov rcx, qword [rbp + 0x28]
cmp word [rcx], si
jne 0x14001e9a9
movzx edi, bl
mov byte [rbp + 2], bl
movzx esi, ax
cmp r13d, 1
jl 0x14001e781
test dil, dil
jne 0x14001eea2
test si, si
jne 0x14001eea2
cmp r14, 1
jne 0x14001ea4e
cmp r15d, r14d
je 0x14001e781
mov r14, qword [rbp + 0x958]
test r14, r14
je 0x14001ea23
test r13d, r13d
jle 0x14001e781
mov ebx, r13d
movzx r8d, word [rbp + 0xf0]
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
sub rbx, 1
jne 0x14001e9f0
movzx r12d, byte [rbp + 0x940]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
jmp 0x14001f34e
movzx r8d, byte [rbp + 1]
mov edx, r13d
movzx r12d, byte [rbp + 0x940]
movzx ecx, word [rbp + 0xf0]
or r8b, r12b
call fcn.14001f9b0
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001f34e
mov r14, qword [rbp + 0x958]
lea r9, [rbp]
test r14, r14
lea r8, [rbp + 0xc]
mov rdx, r12
lea rcx, [rbp + 0xf0]
sete al
mov byte [rsp + 0x20], al
call fcn.1400238a0
mov byte [rbp + 2], al
movzx edi, al
test al, al
je 0x14001ec18
mov esi, dword [rbp + 0xc]
test r14, r14
jne 0x14001eb1a
test esi, esi
jne 0x14001ea9c
mov byte [rbp + 4], al
jmp 0x14001eb1a
cmp dword [0x140127f50], 0
jne 0x14001eb1a
cmp byte [0x140127f55], dil
je 0x14001eb1a
cmp byte [0x140128020], 0
jne 0x14001eb1a
movzx ecx, byte [0x140127f54]
lea eax, [rdi - 0x5b]
cmp al, 1
ja 0x14001ead5
lea eax, [rcx - 0x5b]
cmp al, 1
ja 0x14001ead5
cmp dword [0x140128014], 2
jne 0x14001eaf2
cmp dil, 0xa4
je 0x14001eaea
cmp dil, 0xa5
jne 0x14001eb1a
cmp dword [0x140128000], 3
je 0x14001eb1a
add cl, 0x5c
cmp cl, 1
ja 0x14001eb1a
movzx r8d, word [0x14011fb34]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.14001fed0
cmp dword [0x140128014], 0
je 0x14001eb2c
movzx eax, byte [0x140128010]
jmp 0x14001eb33
xor ecx, ecx
call fcn.140022a50
movzx r12d, byte [rbp]
xor r9d, r9d
movzx ecx, r12b
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r14
mov byte [rsp + 0x20], 0
movzx edx, al
mov byte [rbp + 0x940], r12b
call fcn.1400221e0
test r13d, r13d
jle 0x14001e789
mov ebx, r13d
xor r12d, r12d
nop dword [rax]
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
mov r9, r14
mov byte [rsp + 0x20], 1
movzx edx, dil
mov ecx, esi
call fcn.14001fed0
cmp dword [0x140128014], r12d
jne 0x14001ebfa
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14011f188]
sub eax, dword [0x140127cd8]
cmp eax, dword [rcx + 0x88]
jbe 0x14001ebfa
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, [rbp + 0xc0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001ebee
mov edx, 1
mov dword [0x14011f180], r12d
lea ecx, [rdx - 2]
call fcn.140001710
mov dword [0x14011f180], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140127cd8], eax
sub rbx, 1
jne 0x14001eb70
movzx r12d, byte [rbp + 0x940]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
jmp 0x14001f34e
cmp r12, 4
jbe 0x14001ecc3
mov r8d, 4
lea rdx, str.ASC
lea rcx, [rbp + 0xf0]
call fcn.1400c15e4
test eax, eax
jne 0x14001ecc9
test r14, r14
jne 0x14001ecc9
lea rcx, [rbp + 0xf6]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001ec62
cmp ax, 9
jne 0x14001ec68
add rcx, 2
jmp 0x14001ec53
call fcn.14001fba0
cmp dword [0x140128014], 2
mov rax, qword [0x14011f188]
jne 0x14001eca0
mov ecx, dword [rax + 0x9c]
call fcn.140021cb0
movzx r12d, byte [rbp]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
mov byte [rbp + 0x940], r12b
jmp 0x14001f34e
mov ecx, dword [rax + 0x98]
call fcn.140021cb0
movzx r12d, byte [rbp]
xor r15b, r15b
mov r14, qword [rbp + 0x48]
mov byte [rbp + 0x940], r12b
jmp 0x14001f34e
cmp r12, 2
jbe 0x14001ecab
mov r8d, 2
lea rdx, [0x140102adc]
lea rcx, [rbp + 0xf0]
call fcn.1400c15e4
test eax, eax
jne 0x14001ecab
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rbp + 0xf4]
call fcn.1400c80ac
cmp eax, 0x10000
jb 0x14001ed2b
add eax, 0xffff0000
mov edx, 0x3ff
mov ecx, eax
movzx ebx, ax
shr ecx, 0xa
and bx, dx
and cx, dx
mov r8d, 0x2800
sub cx, r8w
mov edx, 0x2400
sub bx, dx
jmp 0x14001ed34
xor r15d, r15d
movzx ecx, ax
mov ebx, r15d
movzx r12d, byte [rbp]
mov byte [rbp + 0x940], r12b
test r14, r14
je 0x14001ed7d
movzx r8d, cx
xor r9d, r9d
mov rcx, r14
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
test bx, bx
je 0x14001ee64
movzx r8d, bx
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001ee64
cmp dword [0x140128014], 2
je 0x14001edb0
movzx edi, byte [rbp + 1]
or dil, r12b
movzx edx, dil
call fcn.14001db00
test bx, bx
je 0x14001ee64
movzx edx, dil
movzx ecx, bx
call fcn.14001db00
jmp 0x14001ee64
mov ecx, gethostbyaddr
lea rdx, [rbp + 0x5a]
mov word [rbp + 0x58], cx
lea r8d, [rcx - 0x26]
mov ecx, eax
call fcn.1400c6e2c
cmp dword [0x140128014], 0
je 0x14001edda
movzx eax, byte [0x140128010]
jmp 0x14001ede1
xor ecx, ecx
call fcn.140022a50
movzx ecx, al
mov dword [rsp + 0x28], 0xffc3d44f
and cl, 0xc4
mov byte [rsp + 0x20], 1
or cl, 4
xor r9d, r9d
xor r8d, r8d
movzx edx, al
call fcn.1400221e0
movzx eax, word [rbp + 0x58]
lea rbx, [rbp + 0x58]
cmp ax, 0x30
jb 0x14001ee46
cmp ax, 0x39
ja 0x14001ee46
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
lea edx, [rax + 0x30]
mov byte [rsp + 0x20], r8b
xor r9d, r9d
lea ecx, [r8 + 2]
call fcn.14001fed0
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x30
jae 0x14001ee13
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 1]
call fcn.14001fed0
cmp dword [0x140128014], 2
mov rax, qword [0x14011f188]
jne 0x14001ee8b
mov ecx, dword [rax + 0x9c]
call fcn.140021cb0
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001f34e
mov ecx, dword [rax + 0x98]
call fcn.140021cb0
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001f34e
xor r8d, r8d
movzx edx, si
movzx ecx, dil
call fcn.140022cb0
mov r14, qword [rbp + 0x958]
movzx ebx, al
test al, al
je 0x14001eff5
test r14, r14
jne 0x14001eff5
test r15d, r15d
jne 0x14001ef24
mov eax, dword [rbp + 0x1c]
mov byte [rbp + 4], dil
cmp eax, 1
jne 0x14001eefe
movzx r12d, byte [rbp + 0x940]
or byte [0x140127f56], bl
or r12b, bl
mov byte [rbp + 0x940], r12b
mov byte [rbp], r12b
jmp 0x14001effd
cmp eax, 2
jne 0x14001ef09
or byte [0x140127f57], bl
movzx r12d, byte [rbp + 0x940]
or r12b, bl
mov byte [rbp + 0x940], r12b
mov byte [rbp], r12b
jmp 0x14001effd
cmp r15d, 1
jne 0x14001eff5
cmp dword [0x140127f50], 0
jne 0x14001efae
cmp byte [0x140127f55], dil
je 0x14001efae
cmp byte [0x140128020], 0
jne 0x14001efae
movzx ecx, byte [0x140127f54]
lea eax, [rdi - 0x5b]
cmp al, r15b
ja 0x14001ef69
lea eax, [rcx - 0x5b]
cmp al, r15b
ja 0x14001ef69
cmp dword [0x140128014], 2
jne 0x14001ef86
cmp dil, 0xa4
je 0x14001ef7e
cmp dil, 0xa5
jne 0x14001efae
cmp dword [0x140128000], 3
je 0x14001efae
add cl, 0x5c
cmp cl, 1
ja 0x14001efae
movzx r8d, word [0x14011fb34]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.14001fed0
movzx r12d, byte [rbp + 0x940]
movzx eax, bl
not al
and byte [0x140127f56], al
and r12b, al
and byte [0x140127f57], al
mov byte [rbp + 0x940], r12b
mov byte [rbp], r12b
cmp dil, 0xa5
jne 0x14001effd
cmp dword [0x140128000], 3
jne 0x14001effd
and r12b, 0xfe
mov byte [rbp + 0x940], r12b
mov byte [rbp], r12b
jmp 0x14001effd
movzx r12d, byte [rbp + 0x940]
movzx r8d, byte [rbp + 1]
movzx r9d, r12b
mov byte [rsp + 0x50], 0
movzx edx, si
mov dword [rsp + 0x48], 0x80000000
movzx ecx, dil
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
call fcn.14001f750
mov r14, qword [rbp + 0x48]
xor r15b, r15b
jmp 0x14001f34e
movzx r12d, byte [rbp + 0x940]
jmp 0x14001f352
cmp esi, 2
jne 0x14001f0ae
movzx ecx, word [r14]
sub ecx, 8
je 0x14001f0a2
sub ecx, 1
je 0x14001f096
sub ecx, 1
je 0x14001f08a
cmp ecx, 3
je 0x14001f07c
mov byte [rbp + 2], 0
xor dil, dil
jmp 0x14001f17c
cmp word [r14 + 2], 0xa
lea rax, [r14 + 2]
cmove r14, rax
mov byte [rbp + 2], recv
mov dil, ntohs
jmp 0x14001f17c
mov byte [rbp + 2], 9
mov dil, 9
jmp 0x14001f17c
mov byte [rbp + 2], 8
mov dil, 8
jmp 0x14001f17c
movzx eax, r15b
or al, r13b
je 0x14001f0c0
test esi, esi
jne 0x14001f0c0
mov sil, 1
jmp 0x14001f0c3
xor sil, sil
movzx ebx, word [r14]
cmp bx, 0xa
jne 0x14001f0d5
mov dil, ntohs
jmp 0x14001f178
mov rdx, qword [0x140127f58]
movzx ecx, bx
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rdi, ax
mov rcx, rdi
shr rcx, 8
cmp cl, 0xff
jne 0x14001f132
cmp dil, 0xff
jne 0x14001f132
test sil, sil
je 0x14001f137
cmp bx, 0x5a
ja 0x14001f11f
cmp bx, 0x41
jb 0x14001f137
movzx eax, bl
cmp bx, 0x5a
ja 0x14001f12d
cmp bx, 0x41
jb 0x14001f12d
mov cl, 1
jmp 0x14001f12f
lea eax, [rbx - 0x61]
cmp ax, 0x19
ja 0x14001f137
movzx eax, bl
and al, 0xdf
xor cl, cl
movzx edi, al
test cl, 0x38
je 0x14001f13c
xor dil, dil
jmp 0x14001f178
movzx eax, cl
and al, 6
cmp al, 6
jne 0x14001f14b
or r15b, 8
jmp 0x14001f169
test cl, 2
je 0x14001f15a
test r15b, 3
jne 0x14001f15a
or r15b, 1
test cl, 4
je 0x14001f169
test r15b, 0xc
jne 0x14001f169
or r15b, 4
test cl, 1
je 0x14001f178
test r15b, 0x30
jne 0x14001f178
or r15b, 0x10
mov byte [rbp + 2], dil
test dil, dil
je 0x14001f313
or r15b, r13b
lea eax, [rdi - 1]
cmp al, 5
ja 0x14001f195
cmp dil, 3
jne 0x14001f19c
lea eax, [rdi + 0x66]
cmp al, 5
ja 0x14001f1a1
mov sil, 1
jmp 0x14001f1a4
xor sil, sil
cmp dword [0x140128014], 0
jne 0x14001f20b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14011f188]
sub eax, dword [0x140127cd8]
cmp eax, dword [rcx + 0x88]
jbe 0x14001f20b
xor ebx, ebx
lea rcx, [rbp + 0x70]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001f1ff
lea edx, [rbx + 1]
mov dword [0x14011f180], ebx
lea ecx, [rbx - 1]
call fcn.140001710
mov dword [0x14011f180], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140127cd8], eax
mov rax, qword [0x14011f188]
movzx ecx, byte [rax + 0xc5]
test cl, cl
je 0x14001f226
mov ebx, 0xffc3d44d
sub ebx, ecx
jmp 0x14001f22b
mov ebx, 0xffc3d44f
cmp dword [0x140128014], 0
je 0x14001f23d
movzx eax, byte [0x140128010]
jmp 0x14001f244
xor ecx, ecx
call fcn.140022a50
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov r8, r12
mov byte [rsp + 0x20], 1
movzx edx, al
movzx ecx, r15b
call fcn.1400221e0
test sil, sil
je 0x14001f2a0
test r12, r12
jne 0x14001f2a0
mov rax, qword [0x14011f188]
lea r9d, [r12 + 1]
mov byte [rsp + 0x30], r12b
mov edx, 0x80000000
mov dword [rsp + 0x28], 2
mov r8d, edx
movzx ecx, byte [rax + 0xc3]
mov dword [rsp + 0x20], ecx
movzx ecx, dil
call fcn.140020eb0
jmp 0x14001f2d1
mov rax, qword [0x14011f188]
xor r8d, r8d
mov r9, r12
movzx edx, dil
movzx ecx, byte [rax + 0xc5]
mov eax, 0xffc3d44d
sub eax, ecx
lea ecx, [r8 + 2]
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], 1
call fcn.14001fed0
cmp dword [0x140128014], 0
je 0x14001f2e3
movzx eax, byte [0x140128010]
jmp 0x14001f2ea
xor ecx, ecx
call fcn.140022a50
movzx edx, r13b
not dl
and dl, al
and dl, 0xcc
je 0x14001f343
mov dword [rsp + 0x28], 0xffc3d44d
mov r9b, 1
mov r8, r12
mov byte [rsp + 0x20], 0
xor ecx, ecx
call fcn.1400221e0
jmp 0x14001f343
movzx ecx, word [r14]
test r12, r12
je 0x14001f332
mov r8d, ecx
xor r9d, r9d
mov rcx, r12
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001f343
or r15b, r13b
mov edx, 1
movzx r8d, r15b
call fcn.14001f9b0
xor r15b, r15b
movzx r12d, byte [rbp + 0x940]
mov byte [rbp + 1], r15b
movzx eax, byte [rbp + 4]
lea rdi, [0x140000000]
add r14, 2
mov byte [0x140127f55], al
cmp word [r14], 0
jne 0x14001e430
movzx esi, byte [rbp + 0xa]
mov edi, 0x5dc
jmp 0x14001f385
movzx r12d, byte [rbp + 0x940]
cmp dword [0x140128014], 0
je 0x14001f43e
cmp byte [0x140128012], 0
mov ebx, 0xffffffff
mov dword [rbp + 0x940], ebx
jne 0x14001f407
cmp dword [0x140128004], 0
jbe 0x14001f407
cmp byte [0x140128020], 0
je 0x14001f3be
movzx ebx, byte [rbp + 5]
jmp 0x14001f3c7
movzx ebx, byte [rbp + 6]
not bl
and bl, byte [rbp + 3]
or bl, byte [0x140127f57]
mov r9b, 1
movzx edx, byte [0x140128010]
or bl, r12b
movzx ecx, bl
mov dword [rsp + 0x28], 0xffc3d44d
xor r8d, r8d
mov byte [rsp + 0x20], 1
call fcn.1400221e0
movzx edx, bl
lea rcx, [rbp + 0x940]
call fcn.140021b10
mov ebx, dword [rbp + 0x940]
cmp dword [0x140128014], 1
mov eax, 0x1f4
cmove edi, eax
cmp dword [0x140128008], edi
jbe 0x14001f42a
mov rcx, qword [0x140125ef0]
call fcn.1400c1574
xor edi, edi
mov ecx, ebx
mov dword [0x140128014], edi
call fcn.140021cb0
jmp 0x14001f4e5
cmp qword [0x140125d78], 0
je 0x14001f455
movzx ecx, byte [0x140125e82]
movzx edx, byte [rbp + 3]
jmp 0x14001f481
cmp dword [0x14011fb30], 0
jl 0x14001f47a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140127c74]
cmp eax, dword [0x14011fb30]
jb 0x14001f47a
movzx edx, byte [rbp + 3]
xor cl, cl
jmp 0x14001f481
movzx edx, byte [rbp + 3]
movzx ecx, dl
or cl, byte [0x140127f57]
cmp byte [0x140128020], 0
je 0x14001f4a9
or r12b, byte [rbp + 5]
movzx eax, cl
xor al, dl
movzx ebx, al
and al, cl
and bl, dl
not bl
and bl, r12b
or bl, al
jmp 0x14001f4b4
movzx ebx, byte [rbp + 6]
not bl
and bl, cl
or bl, r12b
xor ecx, ecx
call fcn.140022a50
or al, byte [0x140125e81]
mov r9b, 1
mov r8, qword [rbp + 0x958]
movzx edx, al
mov dword [rsp + 0x28], 0xffc3d44d
movzx ecx, bl
mov byte [rsp + 0x20], 1
call fcn.1400221e0
xor edi, edi
cmp qword [0x140125d78], 0
je 0x14001f50b
movzx ecx, byte [0x140125e83]
movzx eax, cl
xor al, byte [0x140125e84]
and al, cl
not al
and cl, al
mov byte [0x140125e83], cl
cmp dword [rbp + 0x20], 1
jne 0x14001f5ac
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
jne 0x14001f5ac
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14001f558
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayLock
lea ecx, [r8 + 1]
call fcn.14001fed0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayLock
lea ecx, [r8 + 2]
call fcn.14001fed0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140127508]
jne 0x14001f5ac
mov edx, 1
mov dword [0x14011f180], edi
lea ecx, [rdx - 2]
call fcn.140001710
mov dword [0x14011f180], 1
cmp byte [rbp + 8], 0
je 0x14001f5c4
mov edx, dword [rbp + 0x24]
xor r8d, r8d
mov ecx, dword [0x140127508]
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rbp + 9], 0
je 0x14001f5de
test sil, sil
jne 0x14001f5de
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140125ad8], sil
mov eax, dword [rbp + 0x950]
test eax, eax
jne 0x14001f661
mov eax, dword [rbp + 0x38]
cmp dword [0x140127cd8], eax
je 0x14001f69c
cmp dword [0x14011f180], 0
je 0x14001f69c
cmp dword [0x140125a2c], 0
jne 0x14001f69c
cmp dword [0x140125a3c], 0
je 0x14001f652
mov rcx, qword [0x14011f188]
cmp byte [rcx + 0x7f], 0
jne 0x14001f652
cmp dword [rcx + 0x70], 0xffffffff
jle 0x14001f64c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14011f188]
sub eax, dword [rcx + 0x74]
cmp eax, dword [rcx + 0x70]
jb 0x14001f64c
cmp dword [rcx + 0x6c], 0
je 0x14001f64c
mov byte [rcx + 0x7f], 1
cmp byte [rcx + 0x7f], 0
je 0x14001f69c
mov edx, 1
lea ecx, [rdx - 2]
call fcn.140001710
jmp 0x14001f69c
cmp eax, 1
jne 0x14001f69c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140127508]
jne 0x14001f69c
mov edx, 1
mov dword [0x14011f180], edi
lea ecx, [rdx - 2]
call fcn.140001710
mov dword [0x14011f180], 1
mov rax, qword [rbp + 0x30]
mov ecx, dword [rbp + 0x3c]
mov dword [rax + 0x98], ecx
mov ecx, dword [rbp + 0x40]
mov dword [rax + 0xa0], ecx
lea rsp, [rbp + 0x8f8]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret