Function at 0x14009e814
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Get common file path
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x420
mov rsi, rcx
xor edi, edi
lea rcx, [rax + 0x10]
mov dword [rsp + 0xa0], edi
mov r12, r9
mov r15, r8
mov qword [rax + 0x10], rdx
call fcn.140052130
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x468]
lea rcx, [0x1401057ec]
call fcn.14005c928
mov rcx, qword [rsp + 0x468]
lea r13, [rsp + 0x84]
mov byte [rsp + 0x70], al
lea rax, [rsp + 0x84]
mov word [rsp + 0x84], di
mov rbx, rcx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x40], rax
jmp 0x14009e8a9
mov eax, 0x3d
cmp ax, dx
je 0x14009e8b3
add rcx, 2
movzx edx, word [rcx]
cmp dx, di
jne 0x14009e89b
jmp 0x14009e8bf
lea r13, [rcx + 2]
mov word [rcx], di
mov qword [rsp + 0x50], r13
mov rcx, rbx
mov r14, rsi
mov bpl, dil
call fcn.140017094
mov ecx, 0x3a
lea r8, [0x140117fa0]
lea eax, [rcx - 0x39]
lea edx, [rcx - 0x36]
cmp cx, word [rbx]
jne 0x14009e8fa
cmp cx, word [rbx + 2]
jne 0x14009e8fa
mov r12, qword [0x140117fe0]
mov bpl, al
add rbx, rdx
mov r14, r8
mov qword [rsp + 0x88], rdi
cmp byte [rsi + 0xda], dil
jne 0x14009e92d
test byte [rsi + 0xd], 0xf
jne 0x14009e92d
lea r8, [rsp + 0x88]
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.14006e6b8
jmp 0x14009e947
lea r8, [rsp + 0x88]
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.14006d030
mov rbx, qword [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.14005a150
mov eax, 1
lea r8, [rsp + 0x90]
xor r9d, r9d
mov rdx, r13
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.14006e854
mov r11, qword [rsp + 0x90]
mov r13d, pe_nt_image_headers64
mov qword [rsp + 0x40], r11
cmp word [rbx], r13w
jne 0x14009ed5f
lea rdx, [0x1401057d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x14009ec95
mov r11, qword [rsp + 0x40]
lea r8d, [r13 - 0x37]
lea rcx, [0x1401057c0]
mov rdx, r11
mov dword [rsp + 0x460], 0xfff80000
mov qword [rsp + 0x468], r11
call fcn.140053674
lea ebp, [r13 - 0x20]
cmp al, dil
je 0x14009ea8f
movzx eax, word [r11 + 0x12]
or ax, bp
sub ax, 0x61
cmp ax, 0x19
jbe 0x14009ea8f
lea rcx, [rsp + 0x478]
call fcn.14005a150
lea rcx, [rsp + 0x140]
lea rdx, [0x140105730]
lea r8d, [r13 + 0x4e]
call fcn.1400de630
lea r14d, [r13 - 0x3f]
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x140]
xor r9d, r9d
mov rcx, rsi
mov byte [rsp + 0x20], r14b
call fcn.14006d030
mov rdx, qword [rsp + 0x478]
mov r8d, r14d
mov rcx, rsi
call fcn.14001f5b4
mov r11, qword [rsp + 0x468]
add r11, 0x12
mov qword [rsp + 0x468], r11
cmp word [r11], di
je 0x14009ea80
add r11, 2
mov qword [rsp + 0x468], r11
lea rcx, [rsp + 0x478]
call fcn.140052160
jmp 0x14009ea95
mov r14d, 1
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x468]
call fcn.140068da0
mov ebx, dword [rsp + 0x460]
mov r12d, 0x1a
mov r15d, 0xffff
test r13b, bl
je 0x14009ead4
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov rcx, r15
call qword [sym.imp.USER32.DLL_SendMessageW]
test bpl, bl
je 0x14009eaeb
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov rcx, r15
call qword [sym.imp.USER32.DLL_SendMessageW]
mov ebp, 0x10
test bpl, bl
je 0x14009ec10
lea rcx, [rsp + 0x478]
call fcn.14005a150
mov rax, qword [rsp + 0x468]
lea r8d, [rbp + 0x2a]
mov r12d, 0x2000
cmp r8w, word [rax]
jne 0x14009eb48
add rax, 2
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x468]
mov qword [rsp + 0x468], rax
call fcn.140006efc
mov ebx, dword [rsp + 0x460]
jmp 0x14009eb83
cmp word [rax], di
je 0x14009eb59
add rax, 2
mov qword [rsp + 0x468], rax
mov ecx, 0x2d
cmp cx, word [rax]
jne 0x14009eb69
lea r12d, [rcx - 0x29]
jmp 0x14009eb77
mov ecx, 0x2b
cmp cx, word [rax]
jne 0x14009eb83
lea r12d, [rcx - 0x29]
add rax, 2
mov qword [rsp + 0x468], rax
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x468]
mov r9d, 0x2c
mov rcx, rsi
mov word [rsp + 0x20], di
call fcn.14004ba2c
mov r8, qword [rsp + 0x478]
mov qword [rsp + 0x468], r8
cmp word [r8], di
jne 0x14009ebf2
lea rax, [rsp + 0x210]
lea rdx, [rsp + 0x210]
mov r9d, r14d
mov r8d, ebp
xor ecx, ecx
mov word [rsp + 0x210], di
mov qword [rsp + 0x468], rax
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathW]
mov r8, qword [rsp + 0x468]
xor r9d, r9d
mov edx, 0x1005
mov ecx, r12d
call qword [sym.imp.SHELL32.DLL_SHChangeNotify]
lea rcx, [rsp + 0x478]
call fcn.140052160
test bl, 8
je 0x14009ec2b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1000
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.DLL_SHChangeNotify]
test bl, 4
je 0x14009ec35
call fcn.1400048f8
test bl, 2
je 0x14009ec5d
lea r8, [0x140118250]
lea rdx, [0x140105720]
lea rcx, [0x140105700]
xor r9d, r9d
call fcn.1400536e0
call qword [0x140118250]
cmp ebx, edi
jl 0x14009ec74
test r14b, bl
jne 0x14009ec6f
mov ecx, 0x7e
test cl, bl
jne 0x14009ec74
call fcn.1400c6cfc
lea rcx, [rsp + 0x90]
call fcn.140052160
lea rcx, [rsp + 0x88]
call fcn.140052160
xor eax, eax
jmp 0x14009fb5f
lea rdx, [0x1401056e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x14009ed5f
mov r9, qword [rsp + 0x40]
lea rcx, [0x1400fcec0]
mov rdx, r9
call fcn.1400536b0
cmp al, dil
jne 0x14009ed0f
lea rcx, [0x140103a0c]
mov rdx, r9
call fcn.1400536b0
cmp al, dil
jne 0x14009ecf7
lea rcx, [0x1400fd79c]
mov rdx, r9
call fcn.1400536b0
cmp al, dil
je 0x14009ec74
cmp byte [0x140117c42], dil
je 0x14009ed0f
lea rcx, [0x140118a90]
mov byte [0x140117c42], dil
call fcn.14005286c
jmp 0x14009ec74
cmp byte [0x140122000], dil
je 0x14009ed2c
mov rcx, qword [0x140117df8]
mov eax, 1
mov byte [0x140117c42], al
jmp 0x14009ed55
mov rcx, qword [0x140117fe0]
cmp rcx, rdi
je 0x14009ec74
cmp qword [rcx + 0x20], rdi
je 0x14009ec74
mov eax, 1
mov byte [0x140117c42], al
mov rcx, qword [rcx + 0x20]
call fcn.140018998
jmp 0x14009ec74
cmp word [rbx], di
jne 0x14009ed7a
neg bpl
mov rcx, r14
sbb rdx, rdx
and rdx, rsi
call fcn.1400192c4
jmp 0x14009ec74
cmp r13w, word [rbx]
je 0x14009ed9b
neg bpl
mov rcx, r14
sbb rdx, rdx
and rdx, rsi
call fcn.1400192c4
cmp qword [r14 + 0x40], rdi
je 0x14009ec74
cmp r12, rdi
je 0x14009edaa
mov rdx, qword [r12 + 0xb8]
jmp 0x14009edb1
lea rdx, [0x1400f9548]
lea rcx, [rsp + 0xd0]
call fcn.140064d14
movzx ecx, word [rbx]
mov rdx, rbx
mov rax, rbx
cmp cx, di
je 0x14009ede8
mov r8d, 0x3a
cmp r8w, cx
jne 0x14009eddc
lea rdx, [rax + 2]
add rax, 2
mov cx, word [rax]
cmp cx, di
jne 0x14009edd2
lea rcx, [rsp + 0xb0]
call fcn.140064d14
movzx ecx, word [rbx]
mov r11, rdi
mov rax, rbx
mov qword [rsp + 0x468], rbx
mov r10d, 0x2e
cmp cx, di
je 0x14009ee34
cmp r10w, cx
cmove r11, rax
add rax, 2
mov cx, word [rax]
cmp cx, di
jne 0x14009ee11
cmp r11, rdi
cmovne rax, r11
mov qword [rsp + 0x468], rax
mov r12, rdi
cmp r10w, word [rax]
jne 0x14009ee4f
mov word [rax], di
add rax, 2
mov qword [rsp + 0x468], rax
mov r12, rax
lea rcx, [rsp + 0x468]
call fcn.140052130
mov edx, 9
lea ebp, [rdx + 0x17]
cmp r12, rdi
je 0x14009ee95
mov rcx, qword [rsp + 0x468]
mov r12, rcx
jmp 0x14009ee8a
cmp dx, ax
ja 0x14009ee81
cmp ax, 0xd
jbe 0x14009ee92
cmp bp, ax
je 0x14009ee92
add rcx, 2
movzx eax, word [rcx]
cmp ax, di
jne 0x14009ee76
mov word [rcx], di
mov r11d, 0x2a
mov byte [rsp + 0x478], dil
mov r8b, dil
lea r13d, [r11 - 0x20]
mov qword [rsp + 0x48], r13
cmp r15, rdi
je 0x14009ef2c
mov rax, r15
cmp word [r15], di
je 0x14009ef2c
lea ecx, [r11 + 0x54]
cmp dx, word [rax]
ja 0x14009eecc
cmp word [rax], 0xd
jbe 0x14009ef2c
cmp bp, word [rax]
je 0x14009ef2c
cmp r10w, word [rax]
je 0x14009f0e0
mov r9d, 0x24
cmp r9w, word [rax]
je 0x14009f0e0
mov r9d, 0x25
cmp r9w, word [rax]
je 0x14009f0e0
cmp r11w, word [rax]
jne 0x14009ef07
or r8b, 4
jmp 0x14009ef23
cmp cx, word [rax]
jne 0x14009ef1e
cmp cx, word [rax + 2]
jne 0x14009f09d
or r8b, 2
add rax, 2
mov edx, 9
add rax, 2
cmp word [rax], di
jne 0x14009eec1
mov qword [rsp + 0x468], rdi
cmp r8b, dil
je 0x14009ef4e
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.1400744cc
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xc8]
call fcn.14005a150
mov al, byte [rsp + 0x478]
cmp al, dil
je 0x14009ef88
cmp al, 0x2e
je 0x14009ef88
lea r9, [rsp + 0x468]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x40]
mov r8, r15
call fcn.1400738f4
lea rcx, [rsp + 0xc0]
mov rdx, rbx
call fcn.140064d14
mov r15, qword [rsp + 0xc0]
cmp r12, rdi
lea rbp, [0x1400f9548]
cmovne rbp, r12
mov r12d, pe_nt_image_headers64
mov qword [rsp + 0x130], rbp
cmp word [rbx], r12w
je 0x1400a0000
lea rax, [0x140118f08]
mov qword [rsp + 0xa8], rdi
mov rcx, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea r10d, [r12 - 0x3f]
mov r12b, dil
mov sil, r10b
mov r9b, dil
mov ebp, dword [rsp + 0xa0]
lea rcx, [rsp + 0x68]
movzx r9d, r9b
cmp r12b, dil
mov edx, 0x3a
mov r13, r15
mov qword [rsp + 0x68], r15
cmovne r9d, r10d
call fcn.1400cb7a8
mov rax, qword [rsp + 0x68]
mov r12b, dil
cmp dx, word [rax]
jne 0x14009f044
mov word [rax], di
mov r15, qword [rsp + 0x68]
movzx r12d, dil
add r15, 2
mov qword [rsp + 0x68], r15
cmp word [r15], di
cmovne r12d, r10d
cmp sil, dil
je 0x14009f06b
lea rcx, [0x1400ff7bc]
mov rdx, r13
call fcn.1400536b0
cmp al, dil
je 0x14009f068
mov r13, qword [rsp + 0xd0]
mov r9b, r10b
mov sil, dil
mov rbx, qword [r14 + 0x40]
lea rcx, [0x1400fa940]
mov rdx, r13
call fcn.1400536b0
cmp al, dil
je 0x14009f140
mov r14, qword [r14 + 0x38]
mov rbx, qword [r14 + 0x40]
cmp rbx, rdi
je 0x14009f0f0
lea r13, [rbx + 0xb8]
jmp 0x14009f115
cmp cx, word [rax]
jne 0x14009ef1e
cmp r10w, word [rax + 2]
jne 0x14009f0b6
or r8b, 8
jmp 0x14009ef1a
cmp cx, word [rax]
jne 0x14009ef1e
cmp r11w, word [rax + 2]
jne 0x14009f0ce
or r8b, r13b
jmp 0x14009ef1a
cmp cx, word [rax]
jne 0x14009ef1e
or r8b, 1
jmp 0x14009ef1e
mov r9b, byte [rax]
mov byte [rsp + 0x478], r9b
jmp 0x14009ef23
lea rdx, [0x1400f9548]
lea rcx, [rsp + 0xb8]
or ebp, r10d
call fcn.140064d14
lea r13, [rsp + 0xb8]
mov r10d, 1
mov r13, qword [r13]
test r10b, bpl
je 0x14009f134
lea rcx, [rsp + 0xb8]
and ebp, 0xfffffffe
call fcn.140052160
mov r10d, 1
mov r9b, r10b
cmp r12b, dil
jne 0x14009eff8
mov dword [rsp + 0xa0], ebp
mov dword [rsp + 0xa0], ebp
mov rbp, qword [rsp + 0x130]
mov dword [rsp + 0x98], r9d
mov byte [rsp + 0x468], sil
mov rsi, qword [rsp + 0x460]
mov dword [rsp + 0x98], r9d
mov dword [rsp + 0x80], r12d
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x98], r9d
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x80], r12d
cmp rbx, rdi
je 0x14009f30a
cmp rbx, qword [rsp + 0xa8]
je 0x14009f30a
mov r15d, 0x23
cmp r12b, dil
jne 0x14009f1d6
mov rcx, qword [rbx + 0xb8]
mov rdx, r13
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
je 0x14009f38c
lea r10d, [r15 - 0x22]
cmp dword [rbx + 0xc8], edi
mov ecx, edi
mov dword [rsp + 0x78], ecx
jle 0x14009f23e
mov r14, rdi
mov rax, qword [rbx + 0xc0]
mov r12, qword [r14 + rax + 8]
cmp r12, rdi
je 0x14009f223
mov rax, qword [r12 + 0xb8]
cmp rax, rdi
je 0x14009f223
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
je 0x14009f389
mov ecx, dword [rsp + 0x78]
mov r10d, 1
add ecx, r10d
add r14, 0x18
cmp ecx, dword [rbx + 0xc8]
mov dword [rsp + 0x78], ecx
jl 0x14009f1e7
mov r12d, dword [rsp + 0x80]
mov rax, qword [rbx + 0x130]
mov r14d, edi
cmp dword [rax], edi
jle 0x14009f2d3
mov r12, rdi
mov qword [rsp + 0x78], rdi
mov rax, qword [rbx + 0x128]
mov rcx, qword [rax]
mov r12, qword [r12 + rcx]
cmp r12, rdi
je 0x14009f2ae
mov rcx, qword [r12 + 0x10]
cmp rcx, rdi
je 0x14009f2ae
mov rdx, r13
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x14009f2a8
cmp byte [rsp + 0x80], dil
je 0x14009f591
cmp dword [r12 + 8], 0xf
je 0x14009f355
cmp dword [r12 + 8], 0x16
je 0x14009f355
mov r10d, 1
mov r12, qword [rsp + 0x78]
mov rax, qword [rbx + 0x130]
add r14d, r10d
add r12, 8
cmp r14d, dword [rax]
mov qword [rsp + 0x78], r12
jl 0x14009f258
mov r12d, dword [rsp + 0x80]
cmp r12b, dil
jne 0x14009faf7
lea rcx, [rbx + 0x230]
mov rdx, r13
call fcn.1400c7de0
mov r14, rax
cmp rax, rdi
jne 0x14009fd61
mov r14, qword [rsp + 0x58]
mov r9d, dword [rsp + 0x98]
mov r10d, 1
cmp r9b, dil
jne 0x14009faf7
cmp byte [rsp + 0x70], dil
jne 0x14009faf7
mov r14, qword [r14 + 0x38]
mov qword [rsp + 0xa8], rbx
cmp r14, rdi
je 0x14009f66d
lea rax, [0x140117fa0]
cmp r14, rax
je 0x14009f66d
mov r15, qword [rsp + 0x60]
mov sil, byte [rsp + 0x468]
jmp 0x14009eff1
mov rax, qword [r12 + 0x38]
mov r9d, dword [rsp + 0x98]
mov r15, qword [rsp + 0x60]
mov r14, qword [rax + 0x210]
mov r12d, dword [rsp + 0x80]
mov sil, byte [rsp + 0x468]
mov r10d, 1
jmp 0x14009eff1
mov rbx, r12
lea rcx, [0x1401056d0]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009f58a
lea rcx, [0x1401056c8]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009f3f5
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x20], dil
mov rcx, qword [rbx + 0x190]
mov r8, rbx
mov rdx, qword [rsp + 0x50]
mov r9, rsi
call fcn.1400d2d50
movsxd rbx, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x14009fb0e
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x14009fb0e
lea rcx, [0x1401056c0]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009f41e
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov eax, 1
mov byte [rsp + 0x20], al
jmp 0x14009f3c2
lea rcx, [0x1401056b8]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009f4ce
mov rax, qword [rbx + 0x190]
mov rcx, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0xf0], rax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0xe0], 3
mov qword [rsp + 0x108], rax
mov eax, 1
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xf8], r11
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rdi
cmp rcx, rdi
je 0x14009f4ac
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea r9, [rsp + 0xe0]
mov rcx, qword [rbx + 0x20]
mov r8, rbx
mov edx, 0x465
call qword [sym.imp.USER32.DLL_SendMessageW]
mov rbx, rax
jmp 0x14009f3dc
lea rcx, [0x1401056b4]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009f7a0
lea rcx, [0x1401056b0]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009f506
mov rbx, qword [rbx + 0x20]
mov r14d, edi
jmp 0x14009f6ae
mov rcx, qword [rsp + 0x48]
mov r12, qword [rbx + 0x20]
cmp rcx, rdi
je 0x14009f51f
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x110], rdi
mov rcx, r12
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xb0]
lea r9, [rsp + 0xe0]
mov edx, 0x459
mov r8, rbx
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0xe0], rsi
call qword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x14009f66d
mov r11, qword [rsp + 0x40]
jmp 0x14009f5bb
lea rcx, [0x1401056d0]
mov rdx, rbp
call fcn.1400536b0
mov r11, qword [rsp + 0x40]
cmp al, dil
je 0x14009f686
cmp word [r11], r15w
je 0x14009f686
mov rbx, r12
cmp word [r11], r15w
sete sil
cmp sil, dil
je 0x14009f5d1
add r11, 2
mov qword [rsp + 0x40], r11
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140068da0
cmp sil, dil
je 0x14009f650
cmp dword [rsp + 0x460], edi
jle 0x14009f60b
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x190]
call fcn.140055988
jmp 0x14009f66d
jne 0x14009f66d
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rcx, qword [0x140118530]
cmp rcx, rdi
je 0x14009f641
call qword [sym.imp.USER32.DLL_UnhookWindowsHookEx]
mov qword [0x140118530], rdi
mov qword [0x140118538], rdi
mov qword [0x140118540], rdi
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x14009f66d
cmp dword [rsp + 0x460], edi
jle 0x14009f665
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.DLL_SetCapture]
jmp 0x14009f66d
jne 0x14009f66d
call qword [sym.imp.USER32.DLL_ReleaseCapture]
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400a0401
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1400a0401
lea rcx, [0x1401056b0]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009f785
mov rax, qword [r12 + 0x38]
add r14d, 0x1000
mov rbx, qword [rax + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140052130
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x14009f7bd
lea rcx, [rsp + 0x468]
call fcn.14005a150
lea rcx, [rsp + 0x460]
call fcn.14005a150
add qword [rsp + 0x40], 2
lea r13d, [rbp - 0x13]
lea r12d, [rbp - 4]
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.14005dd24
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x14009f737
add r11, 2
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
mov qword [rsp + 0x40], r11
call fcn.14005dd24
mov r8, qword [rsp + 0x468]
lea r9, [0x1400ff428]
mov rdx, rbx
mov rcx, rsi
call fcn.14005d100
mov r8, qword [rsp + 0x460]
lea r9, [0x1400fa220]
mov edx, r14d
mov rcx, rsi
call fcn.14005d144
lea rcx, [rsp + 0x460]
call fcn.140052160
lea rcx, [rsp + 0x468]
jmp 0x14009fa1f
lea rcx, [0x1401056b4]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009fa29
mov rbx, r12
lea rcx, [rsp + 0x40]
call fcn.140052130
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
je 0x14009f844
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x14009f7cd
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
or dword [rsp + 0x460], 0xffffffff
or dword [rsp + 0x468], 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.140052130
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
mov bl, dil
cmp word [rax], cx
jne 0x14009f804
mov bl, byte [rax]
add rax, 2
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140068da0
cmp eax, edi
jle 0x1400a0401
cmp bl, dil
je 0x1400a038f
cmp dword [rsp + 0x460], edi
jl 0x1400a0401
mov ecx, edi
setne cl
call qword [sym.imp.USER32.DLL_ShowCursor]
jmp 0x1400a0401
lea rcx, [rsp + 0x468]
call qword [sym.imp.USER32.DLL_GetCursorPos]
mov r11, qword [rsp + 0x468]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x478]
mov qword [rsp + 0x478], r11
call qword [sym.imp.USER32.DLL_ScreenToClient]
lea rcx, [rsp + 0x78]
call fcn.14005a150
lea rcx, [rsp + 0x50]
call fcn.14005a150
lea rcx, [rsp + 0x58]
call fcn.14005a150
lea rcx, [rsp + 0x60]
call fcn.14005a150
lea rcx, [rsp + 0x460]
call fcn.14005a150
add qword [rsp + 0x40], 2
mov r13d, 0x2c
lea r12d, [r13 + 0xf]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
mov r8d, r12d
mov r9d, r13d
call fcn.14004bc74
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.14004bc74
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.14004bc74
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.14004bc74
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.14004bc74
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x468]
mov rcx, rsi
call fcn.14005d1d8
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x46c]
mov rcx, rsi
call fcn.14005d1d8
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x478]
mov rcx, rsi
call fcn.14005d1d8
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x47c]
mov rcx, rsi
call fcn.14005d1d8
mov r11, qword [rsp + 0x460]
cmp word [r11], di
je 0x14009f9ef
lea ebp, [r13 - 0x2b]
mov ecx, ebp
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov bx, ax
shr ebx, 0xf
and bx, bp
lea ebp, [r13 - 0x1c]
mov ecx, ebp
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
lea ecx, [rbp + 1]
neg ax
sbb dx, dx
and dx, 4
or bx, dx
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
lea ecx, [rbp - 0xe]
neg ax
sbb dx, dx
and dx, 8
or bx, dx
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov r8, qword [rsp + 0x460]
neg ax
sbb cx, cx
and cx, bp
or bx, cx
mov rcx, rsi
movzx edx, bx
call fcn.14005d1d8
lea rcx, [rsp + 0x460]
call fcn.140052160
lea rcx, [rsp + 0x60]
call fcn.140052160
lea rcx, [rsp + 0x58]
call fcn.140052160
lea rcx, [rsp + 0x50]
call fcn.140052160
lea rcx, [rsp + 0x78]
call fcn.140052160
jmp 0x14009f66d
mov eax, dword [r12 + 8]
mov r13d, 1
cmp eax, 3
je 0x14009fa3e
cmp eax, r13d
jne 0x14009fa7f
cmp word [rbp], di
jne 0x14009fa7f
mov r9b, byte [rsp + 0x478]
cmp r9b, dil
jne 0x14009fa7f
cmp eax, 3
jne 0x14009fa5f
bt dword [r12 + 0x70], 0x18
jb 0x14009fa70
cmp eax, r13d
jne 0x14009fa7f
bt dword [r12 + 0x88], 0x18
jae 0x14009fa7f
xor edx, edx
mov rcx, r11
call fcn.14001bd20
mov r11, qword [rsp + 0x40]
lea rcx, [0x1401056c8]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009faac
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x20], dil
mov r8, qword [r12 + 0x38]
lea rcx, [r12 + 0x58]
jmp 0x14009f3cc
lea rcx, [0x1401056c0]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009fad1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r13b
jmp 0x14009fa9d
lea rcx, [0x1401056b8]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009fbf6
mov rcx, qword [r12 + 0x38]
cmp rcx, rdi
jne 0x14009fb7a
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x14009fb07
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rbx, 0xffffffff80070057
lea rcx, [rsp + 0xc0]
call fcn.140052160
lea rcx, [rsp + 0xc8]
call fcn.140052160
lea rcx, [rsp + 0xb0]
call fcn.140052160
lea rcx, [rsp + 0xd0]
call fcn.140052160
lea rcx, [rsp + 0x90]
call fcn.140052160
lea rcx, [rsp + 0x88]
call fcn.140052160
mov rax, rbx
mov rbx, qword [rsp + 0x470]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r11, qword [rsp + 0x50]
lea rax, [r12 + 0x58]
mov qword [rsp + 0x140], 3
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x158], r11
mov rax, qword [rcx + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], rdi
cmp rcx, rdi
je 0x14009fbe9
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea r9, [rsp + 0x140]
jmp 0x14009f4b4
lea rcx, [0x1401056a8]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009fd1d
lea rcx, [0x1401056a0]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009fd1d
lea rcx, [0x140105690]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009fd1d
lea rcx, [0x140105688]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009fd1d
lea rcx, [0x140105680]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009fd1d
lea rcx, [0x140105678]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009fd1d
lea rcx, [0x1400fa6a0]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009fd13
lea rcx, [0x140105670]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
jne 0x14009fd13
mov eax, 9
mov rdx, rsi
mov rcx, r12
cmp dword [r12 + 8], eax
lea rax, [rsp + 0x48]
jne 0x14009fcee
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov r9, r11
mov qword [rsp + 0x20], rbp
call fcn.14008ed08
jmp 0x14009f3d9
mov r10, qword [r12]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov r9, rbp
mov r8, r11
mov qword [rsp + 0x20], rax
call qword [r10 + 8]
jmp 0x14009f3d9
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov rbx, qword [r12 + 0x38]
mov rcx, qword [rsp + 0x48]
cmp rbx, rdi
je 0x14009fafc
mov r13, qword [rbx + 0x20]
cmp rcx, rdi
je 0x14009fd49
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov r11, qword [rsp + 0x40]
mov qword [rsp + 0xe8], r11
mov qword [rsp + 0x110], r12
mov rcx, r13
jmp 0x14009f537
cmp word [rbp], di
jne 0x14009fd94
mov rdx, qword [rsp + 0x40]
lea rcx, [rax + 8]
call fcn.140064e2c
mov rdx, qword [r14 + 0x18]
cmp word [rdx], di
je 0x14009f66d
mov r8, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1400596c4
jmp 0x14009f66d
lea rcx, [0x140105668]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009fe8a
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x460], edi
movzx ecx, word [rax]
mov eax, 9
sub cx, 0x30
cmp cx, ax
ja 0x14009faf7
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.DLL_GetMenu]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140068da0
cmp rbx, rdi
je 0x14009fe17
mov eax, dword [rsp + 0x460]
mov edx, dword [r14 + 0x28]
mov rcx, qword [r14 + 0x20]
neg eax
sbb r8d, r8d
not r8d
and r8d, 3
bts r8d, 0xa
call qword [sym.imp.USER32.DLL_EnableMenuItem]
cmp dword [rsp + 0x460], edi
je 0x14009fe26
and byte [r14], 0xfe
jmp 0x14009fe2e
mov eax, 1
or byte [r14], al
lea rdx, [r14 + 0x18]
lea rcx, [rsp + 0x460]
call fcn.140064d74
lea rdx, [0x1400ffa20]
lea rcx, [rsp + 0x460]
call fcn.14005a28c
mov rdx, qword [rsp + 0x460]
mov eax, 1
test byte [r14], al
lea rax, [0x1400fd8a8]
lea r8, [0x1400fe560]
cmovne r8, rax
mov rcx, rsi
call fcn.14006f6b0
lea rcx, [rsp + 0x460]
jmp 0x14009fa1f
lea rcx, [0x140105664]
mov rdx, rbp
call fcn.1400536b0
cmp al, dil
je 0x14009f66d
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x14009feba
add rax, 2
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x478]
call fcn.14005a150
lea rcx, [rsp + 0x468]
call fcn.14005a150
lea rcx, [rsp + 0x460]
call fcn.14005a150
mov r13d, 0x2c
lea r8, [rsp + 0x478]
lea r12d, [r13 + 0xf]
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r9d, r12d
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
lea r8, [rsp + 0x468]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
lea r8, [rsp + 0x460]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
mov r8, qword [r14 + 0x20]
lea rdx, [0x1400ff4e0]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x478]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.1400596c4
movzx r8d, word [r14 + 2]
lea rdx, [0x1400fa220]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x468]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.1400596c4
mov r8d, dword [r14 + 0x28]
lea rdx, [0x1400fa220]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x460]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.1400596c4
lea rcx, [rsp + 0x460]
call fcn.140052160
lea rcx, [rsp + 0x468]
call fcn.140052160
lea rcx, [rsp + 0x478]
jmp 0x14009fa1f
lea rcx, [0x14010565c]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a03da
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x14009f7cd
lea rcx, [rsp + 0x48]
call fcn.14005a150
lea rcx, [rsp + 0x50]
call fcn.14005a150
lea rcx, [rsp + 0x58]
call fcn.14005a150
lea rcx, [rsp + 0x68]
call fcn.14005a150
lea rcx, [rsp + 0x60]
call fcn.14005a150
lea rcx, [rsp + 0x478]
call fcn.14005a150
mov rax, qword [rsp + 0x40]
mov rbx, rdi
add rax, 2
mov qword [rsp + 0x460], rbx
mov qword [rsp + 0x40], rax
cmp r12w, word [rax]
jne 0x1400a00b1
add rax, 2
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14009c980
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x460]
cmp word [rax], 0x30
mov r13d, 0x2c
lea r12d, [r13 + 0xf]
jb 0x1400a00c7
cmp word [rax], 0x39
jbe 0x1400a00d1
mov ecx, 0x28
cmp cx, word [rax]
jne 0x1400a011e
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x460], edi
call fcn.140006efc
mov r11d, dword [rsp + 0x460]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x468], r11d
call fcn.140006efc
mov r11d, dword [rsp + 0x460]
mov dword [rsp + 0x46c], r11d
jmp 0x1400a0162
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
lea rcx, [rsp + 0x468]
call qword [sym.imp.USER32.DLL_GetCursorPos]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
cmp rbx, rdi
je 0x1400a01e7
lea rdx, [rsp + 0x468]
mov rcx, rbx
call qword [sym.imp.USER32.DLL_ScreenToClient]
mov rax, qword [rsp + 0x478]
mov ebx, edi
mov ebp, 0x10
cmp word [rax], di
je 0x1400a023f
mov rdx, qword [rsp + 0x60]
cmp word [rdx], di
je 0x1400a023f
or r9d, 0xffffffff
xor r8d, r8d
mov rcx, rsi
call fcn.14001c5dc
cmp rax, rdi
je 0x1400a023f
mov rcx, qword [rax]
cmp rcx, rdi
je 0x1400a0227
mov rax, qword [rcx - 8]
jmp 0x1400a022a
mov rax, rdi
cmp rax, rbp
jb 0x1400a023f
mov rdx, qword [rsp + 0x468]
call qword [sym.imp.USER32.DLL_PtInRect]
mov ebx, eax
mov r8, qword [rsp + 0x478]
mov edx, ebx
mov rcx, rsi
call fcn.14005d1d8
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x58]
mov r12d, 8
lea r8, [rsp + 0x468]
mov rcx, rsi
mov r9d, r12d
mov byte [rsp + 0x28], dil
mov qword [rsp + 0x20], rax
call fcn.1400694b8
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x468]
mov rcx, rsi
call fcn.14005d1d8
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x46c]
mov rcx, rsi
call fcn.14005d1d8
mov r11, qword [rsp + 0x68]
cmp word [r11], di
je 0x1400a0317
lea edi, [r12 - 7]
mov ecx, edi
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, ebp
mov bx, ax
shr ebx, 0xf
and bx, di
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
neg ax
sbb cx, cx
and cx, 4
or bx, cx
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
neg ax
sbb cx, cx
and cx, r12w
or bx, cx
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov r8, qword [rsp + 0x68]
neg ax
sbb cx, cx
and cx, bp
or bx, cx
mov rcx, rsi
movzx edx, bx
call fcn.14005d1d8
lea rcx, [rsp + 0x478]
call fcn.140052160
lea rcx, [rsp + 0x60]
call fcn.140052160
lea rcx, [rsp + 0x68]
call fcn.140052160
lea rcx, [rsp + 0x58]
call fcn.140052160
lea rcx, [rsp + 0x50]
call fcn.140052160
lea rcx, [rsp + 0x48]
call fcn.140052160
lea rcx, [rsp + 0xc0]
call fcn.140052160
lea rcx, [rsp + 0xc8]
call fcn.140052160
lea rcx, [rsp + 0xb0]
call fcn.140052160
lea rcx, [rsp + 0xd0]
call fcn.140052160
jmp 0x14009ec74
mov rax, qword [rsp + 0x40]
cmp word [rax], di
je 0x1400a0401
cmp word [rax], 0x30
jb 0x1400a03a5
cmp word [rax], 0x39
jbe 0x1400a0401
add rax, 2
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140068da0
cmp eax, edi
jle 0x1400a0401
mov edx, dword [rsp + 0x468]
mov ecx, dword [rsp + 0x460]
call qword [sym.imp.USER32.DLL_SetCursorPos]
jmp 0x1400a0401
lea rcx, [0x140105650]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a0409
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.1400ca980
cmp eax, edi
setl dil
mov rbx, rdi
jmp 0x14009fb0e
lea rcx, [0x140105640]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a042c
mov byte [rsp + 0x460], dil
mov ebx, 1
jmp 0x1400a0450
lea rcx, [0x140105630]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a07f9
mov ebx, 1
mov byte [rsp + 0x460], bl
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x478], edi
mov r14d, edi
mov dword [rsp + 0x468], edi
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xa8], r13
call fcn.14005a150
mov rax, qword [rsp + 0x40]
mov r12d, 0x3b
lea r9d, [r12 - 1]
cmp r9w, word [rax]
jne 0x1400a052e
add rax, 2
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140052130
mov r8, qword [rsp + 0x40]
movzx eax, word [r8]
mov rdx, r8
cmp ax, di
je 0x1400a04f5
lea r13d, [r12 - 0xf]
cmp ax, r13w
je 0x1400a04f5
cmp ax, r12w
je 0x1400a04f5
cmp ax, r9w
je 0x1400a04f5
add r8, 2
mov qword [rsp + 0x40], r8
mov ax, word [r8]
cmp ax, di
jne 0x1400a04d1
sub r8, rdx
lea rcx, [rsp + 0x50]
sar r8, 1
call fcn.14005a3b8
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400a0519
add r11, 2
mov qword [rsp + 0x40], r11
lea rdx, [rsp + 0x50]
mov r8b, bl
mov rcx, rsi
call fcn.14000397c
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x1400a0667
add rax, 2
lea ebp, [rcx + 0x15]
mov r15, rdi
mov qword [rsp + 0x40], rax
mov r13, rdi
cmp bp, word [rax]
jne 0x1400a05a5
add rax, 2
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140068da0
mov rax, qword [rsp + 0x40]
cmp bp, word [rax]
jne 0x1400a05a5
add rax, 2
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140068da0
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rcx
mov ebp, 0x2a
cmp bp, word [rax]
jne 0x1400a05bd
add rax, 2
mov qword [rsp + 0x40], rax
mov r15, rax
jmp 0x1400a05c0
mov r13, rax
movzx ecx, word [rax]
cmp cx, di
je 0x1400a0615
mov r8d, 0x3a
cmp bp, cx
jne 0x1400a05e9
cmp r13, rdi
jne 0x1400a05e9
mov word [rax], di
mov rax, qword [rsp + 0x40]
add rax, 2
mov r13, rax
jmp 0x1400a05f9
cmp cx, r12w
je 0x1400a0608
cmp cx, r8w
je 0x1400a0608
add rax, 2
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, di
je 0x1400a0615
jmp 0x1400a05ce
mov word [rax], di
add qword [rsp + 0x40], 2
mov dword [rsp + 0x78], ebx
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rdx, r13
mov rcx, r15
mov ebp, eax
call qword [sym.imp.USER32.DLL_FindWindowW]
mov rbx, rax
cmp eax, edi
jne 0x1400a0693
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0xb8]
jae 0x1400a0680
mov edx, dword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.14001d848
mov rdx, r13
mov rcx, r15
call qword [sym.imp.USER32.DLL_FindWindowW]
mov ebx, eax
cmp eax, edi
je 0x1400a0630
jmp 0x1400a0680
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x40]
call fcn.140068da0
mov ebx, dword [rsp + 0x478]
cmp ebx, edi
jne 0x1400a0693
lea rcx, [rsp + 0x50]
call fcn.140052160
jmp 0x14009fb07
mov rdx, qword [rsp + 0x40]
cmp dword [rsp + 0x78], edi
jne 0x1400a06b7
cmp word [rdx], r12w
je 0x1400a06ae
mov eax, 0x3a
cmp word [rdx], ax
jne 0x1400a0718
add rdx, 2
mov qword [rsp + 0x40], rdx
mov ebp, edi
cmp word [rdx], r12w
je 0x1400a07ef
mov eax, 0x3a
cmp word [rdx], ax
je 0x1400a07ef
cmp word [rdx], di
je 0x1400a07ef
lea r15d, [rax - 0x17]
cmp r15w, word [rdx]
jne 0x1400a06f2
add rdx, 2
mov ebp, 0x5000
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
call fcn.140068da0
mov r14d, dword [rsp + 0x468]
mov rdx, qword [rsp + 0x40]
cmp eax, edi
jle 0x1400a0718
add r14d, ebp
mov bpl, byte [rsp + 0x460]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x58]
mov rcx, rsi
mov byte [rsp + 0x20], bpl
call fcn.14007353c
cmp rax, rdi
jne 0x1400a0684
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0xa0], rdi
movsxd rcx, ebx
cmp bpl, dil
jne 0x1400a0771
mov edx, r14d
call qword [sym.imp.USER32.DLL_PostMessageW]
cdqe
jmp 0x1400a07b0
mov rax, qword [rsp + 0x60]
cmp rax, rdi
je 0x1400a07a7
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov edx, r14d
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.DLL_SendMessageTimeoutW]
mov rax, qword [rsp + 0xa0]
jmp 0x1400a07b8
mov edx, r14d
call qword [sym.imp.USER32.DLL_SendMessageW]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0x50]
cmp word [rcx], di
je 0x1400a07ef
lea rdx, [0x1401025e0]
lea rcx, [rsp + 0x140]
mov r8, rax
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.1400596c4
lea rcx, [rsp + 0x50]
jmp 0x1400a0bfe
lea rcx, [0x140105620]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a0845
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x460], rdi
call fcn.14009c980
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x460]
lea rcx, [0x140117fa0]
call fcn.14004eb18
jmp 0x1400a0401
lea rcx, [0x140105614]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a0950
mov rax, qword [rsp + 0x40]
mov ebx, edi
mov ebp, 0x3f
cmp word [rax], bp
mov r12w, di
sete bl
cmp bx, di
je 0x1400a0881
add rax, 2
mov qword [rsp + 0x40], rax
mov r13d, pe_nt_image_headers64
cmp r13w, word [rax]
jne 0x1400a0899
add rax, 2
mov r12d, r13d
mov qword [rsp + 0x40], rax
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140068da0
cmp dword [rsp + 0x460], edi
movsxd r10, dword [rsp + 0x460]
jle 0x14009fb07
mov rdx, qword [rsp + 0x40]
cmp word [rdx], di
je 0x1400a08ed
cmp word [rdx], 0x30
jb 0x1400a08de
cmp word [rdx], 0x39
jbe 0x1400a08ed
cmp r13w, word [rdx]
je 0x1400a08ed
add rdx, 2
mov qword [rsp + 0x40], rdx
cmp r12w, di
je 0x1400a090b
cmp r13w, word [rdx]
je 0x1400a090b
sub rdx, 2
mov qword [rsp + 0x40], rdx
mov word [rdx], r13w
mov rdx, qword [rsp + 0x40]
cmp bx, di
je 0x1400a0921
sub rdx, 2
mov qword [rsp + 0x40], rdx
mov word [rdx], bp
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsi + 0x40]
cmp rax, rdi
je 0x1400a0932
mov ecx, dword [rax + 0x228]
jmp 0x1400a0934
mov ecx, edi
mov dword [rsp + 0x28], ecx
mov r9, rsi
mov r8, rsi
mov rcx, r10
mov qword [rsp + 0x20], rdi
call fcn.14009d0a8
jmp 0x1400a0401
lea rcx, [0x14010560c]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a0a6a
lea rcx, [rsp + 0x68]
call fcn.14005a150
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x460], edi
call fcn.14005a150
mov r9d, 0x3a
lea rdx, [rsp + 0x60]
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x40]
call fcn.14005dd24
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400a09b0
add r11, 2
mov qword [rsp + 0x40], r11
lea rcx, [rsp + 0x40]
call fcn.140052130
mov rcx, qword [rsp + 0x40]
call fcn.140019d38
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x40], rax
call fcn.14005a150
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x468]
lea rdx, [rsp + 0x478]
mov qword [rsp + 0x468], rdi
call fcn.1400c6a44
mov r11, qword [rsp + 0x468]
cmp r11, rdi
je 0x1400a0a37
cmp word [r11], di
je 0x1400a0a37
mov word [r11 - 2], di
mov rdx, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x478]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x460]
mov qword [rsp + 0x20], rdi
call fcn.140008588
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.1400596c4
lea rcx, [rsp + 0x478]
call fcn.140052160
lea rcx, [rsp + 0x60]
call fcn.140052160
lea rcx, [rsp + 0x68]
jmp 0x1400a0bfe
lea rcx, [0x140105600]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a0b25
lea rcx, [rsp + 0x40]
call fcn.140052130
mov ebp, 0x3f
mov rcx, qword [rax]
movzx ebx, word [rcx]
cmp bx, bp
jne 0x1400a0aa2
add qword [rsp + 0x40], 2
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140068da0
mov rax, qword [rsp + 0x40]
movsxd r13, dword [rsp + 0x460]
mov r12d, 0x3b
lea r14d, [r12 - 1]
cmp word [rax], r12w
je 0x1400a0ae0
cmp word [rax], r14w
jne 0x1400a0ae9
add rax, 2
mov qword [rsp + 0x40], rax
cmp bx, bp
jne 0x14009fb07
lea rcx, [rsp + 0x460]
call fcn.14005a150
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r14d
mov r8d, r12d
call fcn.14005dd24
mov rcx, r13
call qword [sym.imp.USER32.DLL_IsWindow]
jmp 0x1400a0be4
lea rcx, [0x1401055f8]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a0c45
lea rcx, [rsp + 0x40]
call fcn.140052130
mov ebp, 0x3f
mov rcx, qword [rax]
movzx ebx, word [rcx]
cmp bx, bp
jne 0x1400a0b5d
add qword [rsp + 0x40], 2
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140068da0
mov rax, qword [rsp + 0x40]
movsxd r13, dword [rsp + 0x460]
mov r12d, 0x3b
lea r14d, [r12 - 1]
cmp word [rax], r12w
je 0x1400a0b9b
cmp word [rax], r14w
jne 0x1400a0ba4
add rax, 2
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x460], edi
jle 0x14009fb07
cmp bx, bp
jne 0x1400a0c08
lea rcx, [rsp + 0x460]
call fcn.14005a150
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r14d
mov r8d, r12d
call fcn.14005dd24
mov rcx, r13
call qword [sym.imp.USER32.DLL_IsWindowEnabled]
mov r8, qword [rsp + 0x460]
mov edx, eax
mov rcx, rsi
call fcn.14005d18c
lea rcx, [rsp + 0x460]
call fcn.140052160
jmp 0x1400a0401
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x460], 0xfffffc18
call fcn.140068da0
cmp dword [rsp + 0x460], edi
jl 0x1400a0401
mov edx, edi
mov rcx, r13
setne dl
call qword [sym.imp.USER32.DLL_EnableWindow]
jmp 0x1400a0401
lea rcx, [rbx + 2]
call fcn.14005ac74
cmp al, dil
je 0x1400a0cdc
lea rcx, [rsp + 0x40]
call fcn.140052130
mov ebp, 0x3f
mov rcx, qword [rax]
movzx ebx, word [rcx]
cmp bx, bp
jne 0x1400a0c77
add qword [rsp + 0x40], 2
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140068da0
mov r8, qword [rsp + 0x40]
movsxd rdx, dword [rsp + 0x460]
mov r12d, 0x3b
cmp word [r8], r12w
je 0x1400a0cb5
lea eax, [r12 - 1]
cmp word [r8], ax
jne 0x1400a0cbe
add r8, 2
mov qword [rsp + 0x40], r8
cmp dword [rsp + 0x460], edi
jle 0x14009fb07
movzx r9d, bx
mov rcx, rsi
call fcn.1400727dc
jmp 0x1400a0401
lea rcx, [0x1401055ec]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a0d2e
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140006efc
cmp dword [rsp + 0x460], edi
jle 0x14009fb07
movsxd rcx, dword [rsp + 0x460]
mov rdx, qword [rsp + 0x40]
call fcn.140072a08
jmp 0x1400a0401
lea rcx, [0x1401055e4]
mov rdx, rbx
call fcn.1400536b0
movzx eax, al
mov dword [rsp + 0x460], eax
cmp eax, edi
jne 0x1400a0d63
lea rcx, [0x1401055d8]
mov rdx, rbx
call fcn.1400536b0
cmp al, dil
je 0x1400a0401
mov rbp, qword [rsp + 0x40]
mov r11d, 7
lea rcx, [0x1401055d0]
mov r8d, r11d
mov rdx, rbp
mov r15, rdi
mov qword [rsp + 0x468], rdi
call fcn.140053674
cmp al, dil
je 0x1400a0d9a
add rbp, 0xe
lea r14d, [r11 - 0xb]
jmp 0x1400a0e04
lea rcx, [0x1401055c8]
mov r8d, r11d
mov rdx, rbp
call fcn.140053674
cmp al, dil
je 0x1400a0dbd
add rbp, 0xe
mov r14d, 0xffffffc0
jmp 0x1400a0e04
lea rcx, [0x1401055b8]
mov r8d, 0xb
mov rdx, rbp
call fcn.140053674
cmp al, dil
je 0x1400a0ddd
add rbp, 0x16
jmp 0x1400a0dfe
lea rcx, [0x1401055b0]
mov r8d, 5
mov rdx, rbp
call fcn.140053674
cmp al, dil
je 0x14009fb07
add rbp, r13
mov r14d, 0xffffffe0
mov r13d, 0x2c
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbp
lea r12d, [r13 + 0xf]
mov r8d, r13d
mov edx, r12d
call fcn.1400523c4
mov rcx, qword [rsp + 0x40]
cmp word [rcx], di
je 0x1400a0e36
mov word [rcx], di
add qword [rsp + 0x40], 2
mov ecx, 0x2a
cmp cx, word [rbp]
jne 0x1400a0e7d
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0xa8]
add rbp, 2
mov qword [rsp + 0xa8], rbp
call fcn.14005e484
mov r15, qword [rsp + 0x468]
cmp r15, rdi
je 0x14009fb07
mov rbp, qword [rsp + 0xa8]
jmp 0x1400a0e90
cmp r14d, edi
je 0x14009fb07
cmp word [rbp], di
je 0x14009fb07
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x468], rdi
call fcn.14005a150
mov rbx, rdi
cmp r15, rdi
jne 0x1400a0f66
mov eax, 0x2e
cmp ax, word [rbp]
jne 0x1400a0ec5
lea rdx, [0x1401055a8]
jmp 0x1400a0edd
mov r15d, 0x23
cmp r15w, word [rbp]
jne 0x1400a0ed6
add rbp, 2
lea rdx, [0x1401055a0]
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x468]
or r8, r9
call fcn.14005a30c
lea rdx, [0x140105578]
lea rcx, [rsp + 0x468]
call fcn.14005a28c
lea rcx, [rsp + 0x468]
mov rdx, rbp
call fcn.14005a28c
mov r8, qword [rsp + 0x468]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.DLL_OpenEventW]
mov rbx, rax
mov r15, rax
cmp rax, rdi
jne 0x1400a0f66
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, 1
cmp eax, edi
cmove eax, ecx
lea rcx, [rsp + 0x478]
mov ebx, eax
call fcn.140052160
lea rcx, [rsp + 0x468]
call fcn.140052160
jmp 0x14009fb0e
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.14004bbf0
mov r9, qword [rsp + 0x40]
mov r8, r15
mov edx, r14d
mov rcx, rsi
cmp dword [rsp + 0x460], edi
je 0x1400a0faf
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x20], rax
call fcn.14004f9d4
jmp 0x1400a0fb4
call fcn.14004f864
mov r8, qword [rsp + 0x478]
mov rbp, rax
cmp word [r8], di
je 0x1400a0fda
lea r9, [0x1400ff428]
mov rdx, rax
mov rcx, rsi
call fcn.14005d100
mov rbp, rdi
cmp rbx, rdi
je 0x1400a0fee
cmp rbx, 0xffffffffffffffff
je 0x1400a0fee
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x478]
call fcn.140052160
lea rcx, [rsp + 0x468]
call fcn.140052160
mov rbx, rbp
jmp 0x14009fb0e