Function at 0x1400019e0
Capabilities:
Check for foreground window switch
Check for software breakpoints
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x23b8]
mov eax, 0x24b8
call fcn.1400ed080
sub rsp, rax
movaps xmmword [rsp + 0x24a0], xmm6
mov ebx, edx
mov byte [rsp + 0x49], 0
mov r15d, ecx
mov esi, 1
cmp edx, 2
jne 0x140001a40
cmp byte [0x14012787f], 0
mov ebx, esi
mov dword [rbp + 0x2408], ebx
jne 0x140001a40
mov byte [0x14012787f], bl
mov byte [rsp + 0x49], bl
xor edi, edi
cmp dword [0x14012bc74], edi
je 0x140001a7a
cmp qword [0x14012bc58], rdi
je 0x140001a67
mov rcx, qword [0x14012bc48]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x14012bc58], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x14012bc74], edi
mov qword [0x14012bc48], rdi
cmp r15d, 0x8000012f
jne 0x140001a9c
mov r15d, 0xa
mov byte [rbp + 0x2410], sil
mov dword [rbp + 0x2400], r15d
mov dword [rbp - 0x60], edi
jmp 0x140001ab9
cmp r15d, 5
setle al
mov byte [rbp + 0x2410], al
jg 0x140001ab0
mov dword [rbp - 0x60], edi
jmp 0x140001ab9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x60], eax
cmp dword [0x140128a84], edi
je 0x140001ac6
call fcn.140004d90
xor r12b, r12b
cmp dword [0x14012bb4c], edi
mov dword [rsp + 0x44], r12d
je 0x140001aea
call fcn.140004920
test al, al
movzx r12d, r12b
cmovne r12d, esi
mov dword [rsp + 0x44], r12d
test r15d, r15d
jle 0x140001b2b
cmp ebx, esi
jne 0x140001b2b
inc dword [0x140127a68]
cmp byte [0x14012787e], dil
mov byte [rsp + 0x4a], sil
jne 0x140001b30
mov rcx, qword [0x140127a60]
xor r9d, r9d
lea edx, [r9 + 9]
lea r8d, [r9 + 0xa]
call qword [sym.imp.USER32.dll_SetTimer]
test rax, rax
setne byte [0x14012787e]
jmp 0x140001b30
mov byte [rsp + 0x4a], dil
mov rbx, qword [rbp + 0x2410]
xorps xmm6, xmm6
mov r14, qword [rbp + 0x2410]
mov r13, qword [rbp + 0x2410]
movsxd rax, r15d
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x68], rax
mov eax, dword [rbp + 0x2400]
mov dword [rsp + 0x64], eax
mov eax, dword [rbp + 0x2400]
mov dword [rbp - 0x18], eax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x20], rax
movzx eax, byte [rbp + 0x2400]
mov byte [rbp + 0x2418], al
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x2410]
mov byte [rsp + 0x5c], dil
mov byte [rsp + 0x48], dil
mov dword [rsp + 0x40], edi
mov edi, dword [rbp + 0x2400]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], edi
movsxd rbx, r15d
jmp 0x140001bff
mov r15d, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
jmp 0x140001c10
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c07
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test rbx, rbx
jle 0x140001ce2
cmp byte [rsp + 0x48], 0
jne 0x140001ce2
cmp byte [0x14012787f], 0
jne 0x140001cef
cmp dword [0x1401241f4], 0
je 0x140001c98
cmp dword [0x1401278bc], 0
jne 0x140001c98
mov rcx, qword [0x140124200]
cmp byte [rcx + 0x12c], 0
jne 0x140001c8f
cmp byte [rcx + 0x12e], 0
jne 0x140001c8f
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001c8f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001c8f
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140001c9a
xor eax, eax
test eax, eax
lea rcx, [rsp + 0x68]
mov eax, 0
mov r9d, 0x311
cmovne r9d, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x140001c10
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
jbe 0x140001fe8
mov dword [0x14012bbc0], eax
jmp 0x140001fe8
cmp byte [0x14012787f], 0
je 0x140001eb7
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140001eb7
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x14012af90]
jne 0x140001eb7
cmp dword [0x140127a5c], 0
je 0x140001d67
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
xor edi, edi
lea rdx, [rbp + 0x1a0]
mov ecx, edi
lea r8, str.32770
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140001d69
cmp rcx, 7
jne 0x140001d50
jmp 0x140001dc2
xor edi, edi
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x140001eb7
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysTreeView32
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001dc2
lea rdx, str.SysListView32
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140001eb7
cmp dword [0x1401241f4], 0
je 0x140001e21
cmp dword [0x1401278bc], 0
jne 0x140001e21
mov rcx, qword [0x140124200]
cmp byte [rcx + 0x12c], 0
jne 0x140001e18
cmp byte [rcx + 0x12e], 0
jne 0x140001e18
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001e18
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001e18
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140001e23
mov eax, edi
test eax, eax
mov dword [rsp + 0x20], edi
mov eax, 0xffffffff
lea rcx, [rsp + 0x68]
mov ebx, 0x311
mov r9d, 0x1ff
cmovne ebx, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edx, edx
lea rcx, [rsp + 0x68]
mov r9d, ebx
mov r8d, 0x20e
test eax, eax
je 0x140001f32
mov edi, dword [rbp - 0x78]
xor eax, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140001e82
mov r9d, 0x1ff
jmp 0x140001f28
mov eax, dword [rbp - 0x78]
lea rcx, [rsp + 0x68]
sub eax, edi
xor edx, edx
test eax, eax
mov eax, 1
mov dword [rsp + 0x20], eax
jle 0x140001ea9
mov r9d, 0x1ff
xor r8d, r8d
jmp 0x140001f3b
mov r9d, ebx
mov r8d, 0x20e
jmp 0x140001f3b
cmp dword [0x1401241f4], 0
je 0x140001f18
cmp dword [0x1401278bc], 0
jne 0x140001f18
mov rcx, qword [0x140124200]
cmp byte [rcx + 0x12c], 0
jne 0x140001f0d
cmp byte [rcx + 0x12e], 0
jne 0x140001f0d
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001f0d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001f0d
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
xor edi, edi
jmp 0x140001f1c
xor edi, edi
mov eax, edi
test eax, eax
mov r9d, 0x311
cmovne r9d, edi
xor r8d, r8d
lea rcx, [rsp + 0x68]
xor edx, edx
mov eax, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140001fe1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x14012bbc0]
mov ecx, eax
sub ecx, esi
movsxd rbx, r15d
cmp ecx, 3
cmova edx, eax
mov dword [0x14012bbc0], edx
test r15d, r15d
jne 0x140001f86
cmp byte [rsp + 0x5c], r15b
jne 0x140001f86
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x5c], 1
jmp 0x140001c07
mov edi, dword [rsp + 0x40]
test edi, edi
jne 0x140001fb1
test r14b, r14b
je 0x140001fb1
test r15d, r15d
jle 0x140001fa1
lea ecx, [rdi + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov edi, eax
mov dword [rsp + 0x40], eax
jmp 0x140001c10
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x1400047a1
mov ecx, dword [rbp - 0x60]
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jle 0x1400047a1
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001c10
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
inc edi
cmp dword [0x14012afb0], 0
mov dword [rsp + 0x40], edi
je 0x14000202c
mov r9, qword [rbp - 0x80]
lea rax, [rbp + 0x190]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140004ea0
test al, al
jne 0x140001c10
mov r9d, dword [0x140127a58]
mov r11d, dword [rsp + 0x70]
test r9d, r9d
je 0x14000287d
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x14000287d
cmp rax, qword [0x140127a60]
je 0x14000287d
cmp r11d, 0x414
je 0x14000287d
cmp r11d, 0x402
je 0x14000287d
lea eax, [r11 - 0x100]
cmp eax, 9
ja 0x14000260c
call qword [sym.imp.USER32.dll_GetFocus]
mov rsi, rax
test rax, rax
je 0x140002600
mov edx, 0xfffffff0
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x1400020e6
nop
mov rcx, rdi
mov rbx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je 0x1400020da
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x1400020b0
jmp 0x1400020e6
mov rdi, rbx
test rbx, rbx
je 0x140002600
mov rbx, rsi
nop dword [rax]
mov r9d, dword [0x140127a58]
xor eax, eax
mov ecx, eax
test r9d, r9d
jle 0x140002122
mov rax, qword [0x140127a50]
mov r13, qword [rax]
cmp qword [r13 + 8], rbx
je 0x14000211d
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002107
jmp 0x140002122
test r13, r13
jne 0x14000215d
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x140002147
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
jne 0x1400020f0
mov r11d, dword [rsp + 0x70]
xor esi, esi
mov r9d, dword [0x140127a58]
mov r13d, esi
jmp 0x14000260e
mov rdx, qword [r13 + 0xb8]
test rdx, rdx
je 0x14000218d
lea r8, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
test eax, eax
jne 0x140001c10
mov r9d, dword [0x140127a58]
mov r11d, dword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
cmp r11d, 0x100
jne 0x1400025a5
cmp byte [r13 + 0x108], 0
je 0x140002430
cmp r10, 0x27
ja 0x140002430
movabs rax, 0xa600000200
bt rax, r10
jae 0x140002430
mov rcx, rsi
mov rdi, rsi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jb 0x14000220c
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je 0x140002202
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jae 0x14000240b
mov eax, ebx
imul r14, rax, 0x58
add r14, qword [r13 + 0x28]
mov qword [rbp - 0x68], r14
cmp qword [r14], rdi
jne 0x14000240b
mov eax, 0x2af8
cmp ebx, eax
je 0x14000240b
xor edi, edi
test r14, r14
je 0x140002411
movzx eax, byte [r14 + 8]
cmp al, 0xf
je 0x140002411
mov r10, qword [rsp + 0x78]
mov ebx, edi
cmp al, 0x13
jne 0x14000228d
lea rax, [r10 - 0x25]
mov rbx, r14
test rax, 0xfffffffffffffffd
jne 0x14000228d
cmp r10, 0x27
mov byte [rsp + 0x20], dil
mov rdx, r14
mov rcx, r13
sete r8b
xor r9d, r9d
call fcn.1400b4460
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c07
lea rax, [r10 - 0x25]
test rax, 0xfffffffffffffffd
je 0x140002416
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140002411
mov r10, qword [rsp + 0x78]
cmp r10, 9
jne 0x1400022df
cmp byte [r14 + 8], 0xc
jne 0x1400022df
mov rcx, qword [r14]
lea edx, [r10 - 0x19]
call qword [sym.imp.USER32.dll_GetWindowLongW]
test al, 4
jne 0x140002411
mov r10, qword [rsp + 0x78]
test rbx, rbx
jne 0x14000238c
movzx r11d, byte [r14 + 0xa]
cmp r11b, 0xff
je 0x14000233e
mov r9d, dword [r13 + 0x20]
xor r8b, r8b
mov edx, edi
test r9d, r9d
je 0x14000233e
mov rdi, qword [r13 + 0x28]
nop word [rax + rax]
mov eax, edx
imul rbx, rax, 0x58
add rbx, rdi
cmp byte [rbx + 8], 0x13
jne 0x140002327
cmp r8b, r11b
je 0x140002337
inc r8b
inc edx
cmp edx, r9d
jb 0x140002310
xor r8b, r8b
xor edi, edi
mov edx, edi
jmp 0x140002350
test rbx, rbx
jne 0x14000238c
xor edi, edi
mov r9d, dword [r13 + 0x20]
xor r8b, r8b
mov edx, edi
test r9d, r9d
je 0x140002416
mov r11, qword [r13 + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
imul rbx, rax, 0x58
add rbx, r11
cmp byte [rbx + 8], 0x13
jne 0x140002377
test r8b, r8b
je 0x140002383
inc r8b
inc edx
cmp edx, r9d
jb 0x140002360
jmp 0x140002416
test rbx, rbx
je 0x140002416
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140002407
mov rax, qword [rsp + 0x78]
cmp rax, 0x22
je 0x1400023e0
cmp rax, 9
jne 0x1400023ba
lea ecx, [rax + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1400023e0
xor r8d, r8d
mov byte [rsp + 0x20], 1
mov r9b, 1
mov rdx, rbx
mov rcx, r13
call fcn.1400b4460
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c07
mov r8b, 1
mov rdx, rbx
movzx r9d, r8b
mov byte [rsp + 0x20], r8b
mov rcx, r13
call fcn.1400b4460
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c07
xor edi, edi
jmp 0x140002411
xor edi, edi
mov qword [rbp - 0x68], rdi
mov r10, qword [rsp + 0x78]
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140127a58]
cmp r11d, 0x100
je 0x140002432
jmp 0x1400025a5
xor edi, edi
cmp r10, 0x1b
je 0x140002473
cmp r10, 9
je 0x140002473
cmp r10, 0x41
jne 0x1400025a5
lea ecx, [r10 - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140002594
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x140002594
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jb 0x1400024ac
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rsi, rax
test rax, rax
je 0x1400024a2
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jae 0x140002590
mov ecx, ebx
imul r14, rcx, 0x58
add r14, qword [r13 + 0x28]
mov qword [rbp - 0x68], r14
mov rcx, qword [r14]
cmp rcx, rsi
jne 0x140002590
mov eax, 0x2af8
cmp ebx, eax
je 0x140002590
test r14, r14
je 0x140002594
cmp byte [r14 + 8], 0xc
jne 0x140002594
mov r10, qword [rsp + 0x78]
cmp r10, 0x1b
je 0x140002556
movzx eax, byte [r14 + 9]
cmp r10, 0x41
je 0x14000252d
test al, al
jns 0x140002599
lea r9, [0x1400ef854]
mov edx, 0xc2
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c07
test al, 2
jne 0x140002599
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c07
cmp qword [r13 + 0x40], 0
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
je 0x140001c10
mov rcx, qword [r13 + 8]
xor r9d, r9d
mov edx, 0x414
mov r8d, 0x2af80007
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rbx, r15d
jmp 0x140001c10
mov qword [rbp - 0x68], rdi
mov r10, qword [rsp + 0x78]
mov r9d, dword [0x140127a58]
mov r11d, dword [rsp + 0x70]
mov rcx, qword [0x140128af8]
test rcx, rcx
je 0x1400027ec
cmp r11d, 0x100
jne 0x1400027ec
cmp r10, 0xd
jne 0x1400025e9
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1116
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c07
cmp r10, 0x1b
jne 0x1400027ec
xor r9d, r9d
mov edx, 0x1116
jmp 0x140002511
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140127a58]
xor esi, esi
lea eax, [r11 - 0x20a]
test eax, 0xfffffffb
jne 0x1400027e7
mov rcx, qword [rbp - 0x74]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
mov edx, 0xfffffff0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140127a58]
mov r8d, esi
test r9d, r9d
jle 0x140002675
mov rcx, qword [0x140127a50]
nop dword [rax]
mov rdx, qword [rcx]
cmp qword [rdx + 8], rax
je 0x1400026e3
inc r8d
add rcx, 8
cmp r8d, r9d
jl 0x140002660
mov rcx, qword [rsp + 0x68]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9, qword [rsp + 0x78]
mov r8d, eax
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.140001900
test eax, eax
jne 0x1400027db
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140127a58]
mov edx, esi
test r9d, r9d
jle 0x1400026db
mov rcx, qword [0x140127a50]
mov r13, qword [rcx]
cmp qword [r13 + 8], rax
je 0x140002750
inc edx
add rcx, 8
cmp edx, r9d
jl 0x1400026c3
mov r13, rsi
jmp 0x1400027e2
test rdx, rdx
je 0x140002675
cmp rbx, qword [rsp + 0x68]
jne 0x140002716
mov r9, qword [rsp + 0x78]
mov r8d, edi
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.140001900
test eax, eax
jne 0x140002675
cmp rbx, qword [rsp + 0x68]
je 0x140002675
mov r9, qword [rsp + 0x78]
mov r8d, edi
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.140001900
test eax, eax
je 0x140002675
mov r9, qword [rbp - 0x80]
mov rcx, rbx
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rbx, r15d
jmp 0x140001c07
test r13, r13
je 0x1400027e2
nop dword [rax]
mov r9, qword [rsp + 0x78]
mov r8d, dword [r13 + 0x64]
mov edx, dword [rsp + 0x70]
mov rcx, qword [r13 + 8]
call fcn.140001900
mov rcx, qword [r13 + 8]
test eax, eax
jne 0x1400027c0
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140127a58]
mov edx, esi
test r9d, r9d
jle 0x1400026db
mov rcx, qword [0x140127a50]
nop dword [rax]
mov r13, qword [rcx]
cmp qword [r13 + 8], rax
je 0x1400027b9
inc edx
add rcx, 8
cmp edx, r9d
jl 0x1400027a0
mov r13, rsi
jmp 0x1400027e2
test r13, r13
jne 0x140002760
jmp 0x1400027e2
mov r9, qword [rbp - 0x80]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rbx, r15d
jmp 0x140001c07
mov r9d, dword [0x140127a58]
mov r11d, dword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
xor esi, esi
mov edi, esi
test r9d, r9d
jle 0x140002877
mov ebx, esi
nop dword [rax + rax]
mov rdx, qword [0x140127a50]
mov rax, qword [rbx + rdx]
cmp dword [rax + 0x20], esi
jne 0x140002819
cmp r11d, 0x106
je 0x140002866
mov rcx, qword [0x140124200]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
mov rcx, qword [rbx + rdx]
lea rdx, [rsp + 0x68]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
mov rax, qword [0x140124200]
mov byte [rax + 0x128], sil
jne 0x14000227d
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140127a58]
inc edi
add rbx, 8
cmp edi, r9d
jl 0x140002800
mov edi, dword [rsp + 0x40]
jmp 0x14000287f
mov edi, dword [rsp + 0x40]
jmp 0x140002884
xor esi, esi
mov r10, qword [rsp + 0x78]
cmp r11d, 0x402
ja 0x140002b76
je case.0x140002b97.1044
cmp r11d, 0x113
ja 0x140002a6b
je 0x14000293d
cmp r11d, 0x12
je 0x14000291a
cmp r11d, 0x4b
je 0x1400028fe
cmp r11d, 0x100
jne case.0x140002b97.1046
mov rax, qword [0x140127a28]
cmp qword [rsp + 0x68], rax
jne case.0x140002b97.1046
cmp r10, 0x1b
jne case.0x140002b97.1046
mov rcx, qword [0x140127a60]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c10
movzx r14d, byte [rbp + 0x2410]
mov qword [0x140127a30], rsi
mov byte [rsp + 0x48], 1
movsxd rbx, r15d
jmp 0x140001c10
xor r8d, r8d
lea rcx, [0x14012afc0]
lea edx, [r8 + 4]
call fcn.1400380f0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c10
cmp qword [rbp - 0x80], 0
jne case.0x140002b97.1046
mov rax, qword [0x140127a60]
cmp qword [rsp + 0x68], rax
jne case.0x140002b97.1046
cmp dword [0x140128a84], 0
je 0x140002968
call fcn.140004d90
cmp dword [0x14012bb4c], 0
je 0x14000298a
call fcn.140004920
test al, al
movzx r12d, r12b
mov eax, 1
cmovne r12d, eax
mov dword [rsp + 0x44], r12d
cmp dword [rbp + 0x2408], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
je 0x140001c10
movsxd rbx, r15d
cmp rbx, 1
jl 0x140001c10
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x1400029cb
mov ecx, dword [rbp - 0x60]
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jg 0x140001c10
cmp byte [rsp + 0x49], 0
mov dword [0x14012bbc0], eax
mov dword [0x14012bbc4], eax
movzx eax, byte [0x14012787f]
cmovne eax, esi
mov qword [0x14012bbb0], rsi
cmp byte [rsp + 0x4a], 0
mov byte [0x14012787f], al
je 0x140002a4b
mov eax, dword [0x140127a68]
dec eax
mov dword [0x140127a68], eax
test r15d, r15d
jle 0x140002a4b
test eax, eax
jne 0x140002a4b
cmp dword [0x14012bb4c], eax
jne 0x140002a4b
cmp dword [0x140128a84], eax
jne 0x140002a4b
cmp byte [0x14012787e], al
je 0x140002a4b
mov rcx, qword [0x140127a60]
lea edx, [rax + 9]
call qword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x14012787e]
test eax, eax
cmovne ecx, esi
mov byte [0x14012787e], cl
movaps xmm6, xmmword [rsp + 0x24a0]
movzx eax, r12b
add rsp, 0x24b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, r11d
sub eax, 0x312
je case.0x140002b97.1044
sub eax, 0xee
je case.0x140002b97.1045
cmp eax, 1
je case.0x140002b97.1045
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140004731
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x14012af90]
jne 0x140004731
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rcx, rsi
lea rdx, [rbp + 0x1a0]
lea r8, str.32770
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140004731
cmp rcx, 7
jne 0x140002ae0
mov rcx, qword [0x140124200]
lea rdx, [rsp + 0x68]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x140004721
cmp dword [0x140127a5c], 0
je 0x140002b53
mov rax, qword [0x140126a10]
lea rcx, [0x1400ef7d4]
test rax, rax
je 0x140002b4d
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, qword [0x140124200]
movzx r14d, byte [rbp + 0x2410]
mov byte [rax + 0x128], 0
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c10
lea eax, [r11 - 0x414]
cmp eax, 0xa
ja case.0x140002b97.1046
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x4844]
add rcx, rdx
jmp rcx
mov rax, qword [rsp + 0x68]
test rax, rax
je case.0x140002b97.1044
cmp rax, qword [0x140127a60]
jne case.0x140002b97.1046
lea eax, [r11 - 0x401]
mov r12, rsi
cmp eax, 0x1d
ja case.0x140002bdc.1031
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x488c]
mov ecx, dword [rdx + rax*4 + 0x4870]
add rcx, rdx
jmp rcx
mov ecx, esi
test r9d, r9d
jle 0x140002c09
mov rax, qword [0x140127a50]
nop dword [rax]
mov r13, qword [rax]
mov r8, qword [r13 + 8]
cmp r8, qword [rsp + 0x68]
je 0x140002c11
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002bf0
mov r13, rsi
jmp case.0x140002b97.1046
test r13, r13
je case.0x140002b97.1046
mov rcx, qword [rbp - 0x80]
mov eax, 0x2af8
movzx ebx, r10w
shr r10, 0x10
cmp ebx, 8
movzx r10d, r10w
mov edi, r10d
mov dword [rsp + 0x60], esi
cmove r10d, eax
mov dword [rsp + 0x64], ebx
mov eax, ecx
mov dword [rbp - 0x18], r10d
cmovne eax, dword [rsp + 0x58]
cmovne rdi, rcx
mov r9d, eax
mov dword [rsp + 0x58], eax
mov esi, eax
cmp r10d, dword [r13 + 0x20]
jae 0x140002c6e
mov eax, r10d
imul r14, rax, 0x58
add r14, qword [r13 + 0x28]
xor eax, eax
jmp 0x140002c73
xor eax, eax
mov r14d, eax
mov qword [rbp - 0x20], rax
mov eax, ebx
mov qword [rbp - 0x68], r14
mov byte [rbp + 0x2418], 0
mov qword [rsp + 0x50], rdi
sub eax, 5
je 0x140002dfb
sub eax, 1
je 0x140002da3
sub eax, 1
je 0x140002d83
sub eax, 1
je 0x140002d63
cmp eax, 1
je 0x140002d36
movsxd rbx, r15d
test r14, r14
je 0x140001bfa
mov rbx, qword [r14 + 0x18]
test rbx, rbx
jne 0x140002d00
test byte [r14 + 9], 1
je 0x140002ce2
test r8, r8
je 0x140002ce2
xor edx, edx
mov rcx, r8
call qword [sym.imp.USER32.dll_ShowWindow]
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
movsxd rbx, r15d
jmp 0x140001c07
test byte [r14 + 9], 4
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
jne 0x140001bf0
xor eax, eax
mov byte [rbp + 0x2418], 1
mov r14d, eax
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
jmp 0x14000333c
mov rbx, qword [r13 + 0x58]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001bf0
xor eax, eax
mov qword [rsp + 0x50], rdi
mov r14d, eax
mov dword [rsp + 0x58], esi
jmp 0x14000333c
mov rbx, qword [r13 + 0x48]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001bf0
lea rcx, [r13 + 0x62]
jmp 0x140002dc1
mov rbx, qword [r13 + 0x40]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001bf0
lea rcx, [r13 + 0x61]
jmp 0x140002dc1
mov rbx, qword [r13 + 0x38]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001bf0
lea rcx, [r13 + 0x60]
mov qword [rbp - 0x20], rcx
mov qword [rsp + 0x50], rdi
test rcx, rcx
je 0x140002e3a
cmp byte [rcx], 0
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov edi, dword [rsp + 0x40]
mov dword [rsp + 0x58], esi
jne 0x140002b69
xor eax, eax
mov dword [rsp + 0x58], esi
mov r14d, eax
jmp 0x14000333c
mov rbx, qword [r13 + 0x50]
mov r12, qword [r13 + 0xa0]
test rbx, rbx
je 0x140002e48
mov qword [rsp + 0x50], rdi
test r12, r12
je 0x140002e5f
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r14d, eax
mov qword [rsp + 0x50], r14
test eax, eax
je 0x140002e4d
mov r11d, dword [rsp + 0x70]
xor eax, eax
mov dword [rsp + 0x58], esi
mov r14d, eax
jmp 0x14000333c
test r12, r12
je 0x140002e5f
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [r13 + 0xa0], rax
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], esi
movsxd rbx, r15d
jmp 0x140001c07
test r10, r10
je 0x140002ec7
mov ecx, esi
test r9d, r9d
jle 0x140002ea4
mov rax, qword [0x140127a50]
nop dword [rax + rax]
mov r13, qword [rax]
cmp qword [r13 + 8], r10
je 0x140002ec0
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002e90
mov r13, rsi
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140002eca
cmp rax, qword [0x140127a60]
jne case.0x140002b97.1046
jmp 0x140002eca
test r13, r13
jne 0x140002eca
jmp 0x140002ea7
mov r13, rsi
mov rcx, qword [0x14012bb50]
test rcx, rcx
je 0x140002f0b
mov rax, qword [rbp - 0x80]
nop word [rax + rax]
mov rdi, qword [rcx + 8]
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x140002f02
nop dword [rax]
cmp dword [rdi + 0x28], eax
je 0x140002f24
mov rdi, qword [rdi + 0x38]
mov qword [rbp - 0x58], rdi
test rdi, rdi
jne 0x140002ef0
mov rcx, qword [rcx + 0x30]
test rcx, rcx
jne 0x140002ee0
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x58], rsi
movsxd rbx, r15d
jmp 0x140001c07
mov rbx, qword [rdi + 0x10]
movzx r14d, byte [rbp + 0x2410]
test rbx, rbx
je 0x140001bf0
mov r14d, dword [rdi + 0x2c]
jmp 0x140003340
mov eax, dword [0x140128a80]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
cmp r10, rax
jae 0x140001be9
mov rax, qword [0x140128a78]
mov rsi, qword [rax + r10*8]
mov qword [rbp], rsi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140002f9b
mov rdx, qword [rsi + 8]
call fcn.140017550
mov qword [rbp - 0x50], rax
movsxd rbx, r15d
test rax, rax
je 0x140001be9
mov rcx, qword [rsi + 0x20]
movzx edx, byte [rcx]
dec dl
test dl, 0xfd
je 0x140002fa1
xor eax, eax
mov qword [rbp - 0x50], rax
mov rdx, qword [rbp - 0x80]
mov rcx, rsi
call fcn.14001ad30
cmp qword [rsi + 0x18], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jne 0x140001be9
cmp byte [rsi + 0x3e], 0
je 0x140002fcf
movzx eax, word [rbp - 0x80]
jmp 0x140002fd1
xor eax, eax
mov r11d, dword [rsp + 0x70]
mov word [0x14012bb6c], ax
mov rbx, qword [rsi]
mov r14d, dword [rsi + 0x28]
jmp 0x14000333c
cmp byte [0x14012bb30], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jne 0x140001be9
mov rbx, qword [0x14012bb18]
mov r14d, esi
test rbx, rbx
cmove rbx, qword [0x14012b698]
jmp 0x14000333c
mov rcx, r10
call fcn.140065d70
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x48], rax
movsxd rbx, r15d
test rax, rax
je 0x140004717
mov rbx, qword [rax + 0x10]
mov r14d, esi
mov r11d, dword [rsp + 0x70]
mov rbx, qword [rbx + 0x388]
jmp 0x14000333c
mov rdi, qword [0x140127a48]
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x48], rdi
movsxd rbx, r15d
test rdi, rdi
je 0x140004717
cmp rdi, r10
je 0x140003091
mov rdi, qword [rdi + 8]
mov qword [rbp - 0x48], rdi
test rdi, rdi
jne 0x140003072
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c07
mov rbx, qword [rdi + 0x10]
cmp r11d, 0x41c
jne 0x1400030a7
mov rbx, qword [rbx + 0x390]
jmp 0x1400030c0
cmp r11d, 0x41e
jne 0x1400030b9
mov rbx, qword [rbx + 0x3a0]
jmp 0x1400030c0
mov rbx, qword [rbx + 0x398]
mov edi, dword [rsp + 0x40]
test rbx, rbx
je 0x140002b69
mov r14d, esi
jmp 0x14000333c
movzx r14d, byte [rbp + 0x2410]
movzx eax, r10w
mov ecx, 0x7fff
movsxd rbx, r15d
and ax, cx
cmp ax, word [0x140128a9c]
jae 0x140001be9
movzx ecx, ax
mov rax, qword [0x140128a88]
shr r10, 0x10
mov r14, qword [rax + rcx*8]
mov qword [rbp - 8], r14
test r10w, r10w
je 0x140003147
mov r15, qword [r14 + 0x28]
mov eax, 0xffff
mov qword [rbp - 0x40], r15
add r10w, ax
je 0x14000313e
nop dword [rax + rax]
mov r15, qword [r15 + 0x10]
add r10w, ax
jne 0x140003130
mov qword [rbp - 0x40], r15
test r15, r15
jne 0x14000329e
cmp r11d, 0x400
jne 0x14000316a
mov rax, qword [rbp - 0x80]
mov edi, WSAAsyncSelect
shr rax, 0x10
movzx ecx, ax
sub edi, ecx
lea esi, [rcx + 0x3c2bb3]
jmp 0x14000316f
mov edi, 0x3c2c17
xor eax, eax
cmp byte [r14 + 0x19], al
jne 0x14000318b
mov r15d, dword [rbp + 0x2400]
mov rbx, qword [rbp - 0x28]
mov qword [rbp - 0x40], rax
jmp 0x140001bfa
mov r15, qword [r14 + 0x28]
mov rbx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], r15
test r15, r15
je 0x14000327c
cmp byte [r15 + 0x28], 0
je 0x140003266
cmp byte [0x140127b40], 0
je 0x140003228
mov r9, qword [r15]
mov rcx, r9
call fcn.1400bcb20
test eax, eax
je 0x1400031cf
cmp eax, 1
jne 0x140003266
mov rcx, qword [r9 + 0x10]
test rcx, rcx
je 0x140003266
cmp byte [rcx], 0xcd
jne 0x140003266
movzx eax, byte [rcx + 1]
test al, al
je 0x140003228
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx]
test al, al
jne 0x14000320f
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140003207
cmp qword [rax], 0
jne 0x140003228
cmp byte [rcx + 1], 0
jne 0x140003228
jmp 0x140003213
cmp al, 1
je 0x140003228
mov rcx, qword [rcx + 8]
lea rdx, [0x140106204]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140003266
lea ecx, [rsi - 0x3c2bb3]
cmp edi, 0x66
jbe 0x140003238
mov ecx, reloc.WSOCK32.dll_WSAAsyncSelect
movzx eax, byte [r15 + 0x24]
cmp ecx, eax
jle 0x140003266
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x14000325c
mov rdx, qword [r14 + 0x20]
call fcn.140017550
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140003266
cmp qword [r15 + 8], 0
jne 0x1400032c0
mov rbx, r15
mov r15, qword [r15 + 0x10]
mov qword [rbp - 0x40], r15
test r15, r15
jne 0x1400031a3
mov r11d, dword [rsp + 0x70]
mov r15, rbx
mov qword [rbp - 0x40], rbx
movzx r14d, byte [rbp + 0x2410]
mov rbx, qword [rbp - 0x28]
mov edi, dword [rsp + 0x40]
test r15, r15
je 0x140001be2
xor esi, esi
mov r9, qword [r15]
mov rcx, r9
call fcn.1400bcb20
test eax, eax
je 0x1400032b2
cmp eax, 1
jne 0x1400032c7
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x1400032c7
movzx ecx, byte [rax]
jmp 0x1400032c9
mov r11d, dword [rsp + 0x70]
jmp 0x140003283
xor cl, cl
movzx eax, byte [r15 + 0x23]
cmp byte [r15 + 0x22], al
jb 0x14000330c
add cl, 0x32
cmp cl, 0x14
ja 0x1400032e6
mov eax, 0x10fc01
bt eax, ecx
jb 0x14000330c
cmp byte [r15 + 0x26], 0
je 0x1400032f2
mov byte [r15 + 0x27], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbx, qword [rbp - 0x28]
mov dword [r15 + 0x18], eax
mov r15d, dword [rbp + 0x2400]
jmp 0x140001bfa
mov rax, qword [r15 + 8]
test rax, rax
je 0x140003331
movzx ecx, byte [rax]
lea eax, [rcx - 2]
test al, 0xfd
je 0x140003331
cmp cl, 5
jb 0x140003335
mov rax, qword [0x140127a40]
mov qword [rbp - 0x50], rax
jmp 0x140003335
mov qword [rbp - 0x50], rsi
mov rbx, qword [r15]
mov r14d, dword [r15 + 0x1c]
mov rdi, qword [rbp - 0x58]
mov r15, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1400bcb20
test eax, eax
je 0x140003356
cmp eax, 1
jne 0x140003367
mov rcx, qword [rbx + 0x10]
mov rax, rbx
test rcx, rcx
je 0x140003367
movzx esi, byte [rcx]
jmp 0x14000336a
xor sil, sil
mov ecx, dword [0x1401278cc]
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
cmp ecx, eax
jl 0x1400033f4
add eax, 2
cmp ecx, eax
jge 0x140003392
lea eax, [rsi + 0x32]
cmp al, 0x14
ja 0x140003392
mov ecx, 0x10fc01
bt ecx, eax
jb 0x1400033f4
test r12, r12
je 0x1400033ae
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [r13 + 0xa0], rax
mov r11d, dword [rsp + 0x70]
movsxd r15, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
mov rbx, r15
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
cmp r11d, 0x41b
jne 0x140001c10
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r15d, dword [rbp + 0x2400]
mov rbx, qword [rbp - 0x28]
jmp 0x140001c10
mov rax, qword [0x140124200]
cmp r14d, dword [rax + 0x3c]
jl 0x140003392
lea eax, [r11 - 0x402]
mov byte [rsp + 0x44], 1
cmp eax, 0x1c
ja case.0x14000342b.1028
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x48b8]
mov ecx, dword [rdx + rax*4 + 0x48ac]
add rcx, rdx
jmp rcx
mov rdx, qword [rdi]
lea rcx, [0x14012b6a8]
mov r8d, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
lea rcx, [0x14012b8b2]
mov word [0x14012b8b0], ax
mov r8d, 0x104
mov rdx, qword [rdi + 0x20]
mov rdx, qword [rdx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov qword [0x14012b6a0], rdi
mov word [0x14012baba], ax
jmp case.0x14000342b.1027
mov rax, qword [0x14012bac0]
mov qword [0x14012bac8], rax
mov eax, dword [0x14012bb64]
mov dword [0x14012bb68], eax
cmp r11d, 0x401
jne 0x1400034a5
mov rax, qword [rbp]
mov rax, qword [rax + 8]
jmp 0x1400034ad
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x20]
mov qword [0x14012bac0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012bb64], eax
mov rdi, qword [0x140127a38]
cmp byte [rdi + 0x23], 0
jne 0x1400034d1
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x1400034df
mov rcx, rdi
call fcn.1400015e0
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x1400034fb
test byte [rdi + 0x21], 4
je 0x1400034f5
mov rdx, rdi
call fcn.140060930
mov rdx, qword [rdi + 8]
jmp 0x14000355e
cmp al, 2
jne 0x140003557
mov rdx, qword [0x14012bc60]
test rdx, rdx
jne 0x14000355e
lea ecx, [rdx + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140003537
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rdx, [0x1400ef7d4]
lea rax, [0x1400ef7c8]
cmovne rdx, rax
jmp 0x14000355e
xor edx, edx
call fcn.1400071d0
mov ecx, 0xffffffff
lea rdx, [0x1400ef7d4]
cmp rax, rcx
cmovne rdx, qword [0x14012bc58]
jmp 0x14000355e
lea rdx, [0x140129f30]
mov r8d, 0x7f
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edi, edi
movzx r9d, sil
mov r8b, 1
mov word [rbp + 0x2de], di
xor edx, edx
mov ecx, r14d
call fcn.140005480
mov r14, qword [0x140124200]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012bbc4], eax
mov dword [0x14012bbc0], eax
mov eax, dword [rsp + 0x70]
add eax, 0xfffffbff
cmp eax, 0x1d
ja case.0x1400035d1.1032
lea r9, [0x140000000]
movzx eax, byte [r9 + rax + 0x48f8]
mov ecx, dword [r9 + rax*4 + 0x48d8]
add rcx, r9
jmp rcx
mov r8, qword [rbp - 0x68]
mov word [rbp + 0x70], di
cmp byte [rbp + 0x2418], dil
je 0x1400035e9
mov rcx, qword [r8]
jmp 0x1400035ed
mov rcx, qword [r13 + 8]
movsxd rsi, dword [rsp + 0x60]
mov r10d, 1
mov rax, rsi
inc esi
shl rax, 5
mov dword [rsp + 0x60], esi
mov qword [rbp + rax + 0xd0], rcx
mov ecx, dword [rsp + 0x64]
mov dword [rbp + rax + 0xe0], r10d
mov eax, ecx
sub eax, 5
je 0x140003c1e
sub eax, r10d
je 0x140003a5e
sub eax, r10d
je 0x140003a5e
sub eax, r10d
je 0x140003a5e
cmp eax, r10d
je 0x140003792
mov r15, qword [rbp - 0x68]
movzx eax, byte [r15 + 8]
cmp al, 0xa
je 0x1400036c6
cmp al, 0x19
jne 0x140003697
mov rax, qword [rbp - 0x74]
lea rdx, [rbp + 0x98]
mov qword [r14 + 0x50], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x98]
lea r9, [0x140000000]
sub dword [r14 + 0x50], eax
mov r10d, 1
mov eax, dword [rbp + 0x9c]
sub dword [r14 + 0x54], eax
mov ecx, dword [rsp + 0x64]
movsxd rax, esi
lea rdx, [rbp + 0xd0]
shl rax, 5
inc esi
add rdx, rax
mov dword [r14 + 0x44], ecx
cmp ecx, 5
jae 0x140003750
mov eax, ecx
mov rcx, qword [r9 + rax*8 + 0x111e08]
jmp 0x140003761
cmp cl, 0x49
jne 0x140003697
lea rax, [rbp + 0x70]
bt ecx, 8
jae 0x1400036dc
mov eax, 0x53
jmp 0x1400036e7
bt ecx, 9
jae 0x1400036ef
mov eax, reloc.WSOCK32.dll_WSAStartup
mov word [rbp + 0x70], ax
lea rax, [rbp + 0x72]
bt ecx, 0xa
jae 0x1400036fc
mov edx, 0x46
jmp 0x140003707
bt ecx, 0xb
jae 0x14000370e
mov edx, 0x66
mov word [rax], dx
add rax, 2
bt ecx, 0xc
jae 0x14000371b
mov ecx, 0x43
jmp 0x140003726
bt ecx, 0xd
jae 0x14000372d
mov ecx, WSAAsyncSelect
mov word [rax], cx
add rax, 2
mov word [rax], di
lea rdx, [rbp + 0xd0]
movsxd rax, esi
mov ecx, 0x49
shl rax, 5
add rdx, rax
mov dword [rsp + 0x64], ecx
inc esi
mov dword [r14 + 0x44], ecx
movzx eax, cl
lea rcx, [0x14012d6a4]
mov word [0x14012d6a4], ax
mov dword [rdx + 0x10], edi
mov rdi, qword [rsp + 0x50]
mov qword [rdx], rcx
mov ecx, dword [rsp + 0x64]
movsxd rax, esi
shl rax, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rax + 0xe0], r10d
mov qword [rbp + rax + 0xd0], rdi
jmp 0x140003b2b
cmp qword [rsp + 0x50], rdi
mov edx, 3
mov qword [rsp + 0x50], rdi
cmovne edx, r10d
mov dword [r14 + 0x44], edx
mov rax, qword [rbp - 0x74]
mov qword [r14 + 0x50], rax
test r8, r8
je 0x140003970
test r15, r15
mov r15, qword [rbp - 0x68]
je 0x1400038d0
movzx ecx, byte [r15 + 8]
mov dword [rbp - 0x38], 0x80000000
sub ecx, 9
je 0x14000384f
sub ecx, r10d
je 0x140003820
sub ecx, r10d
je 0x1400037f5
cmp ecx, 6
jne 0x14000387e
xor r8d, r8d
mov edx, 0x419
jmp 0x140003871
mov rcx, qword [r15]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14000387e
mov qword [rbp - 0x38], rax
mov edx, 0x1104
mov r8d, 1
jmp 0x140003871
mov rcx, qword [r15]
mov r9, r10
mov edx, 0x100c
mov r8, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, eax
cmp r8, 0xffffffffffffffff
je 0x14000387e
mov dword [rbp - 0x38], 2
mov edx, 0x100e
jmp 0x140003871
mov rcx, qword [r15]
xor r9d, r9d
xor r8d, r8d
mov edx, OleCreatePictureIndirect
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
je 0x14000387e
mov r8, rax
mov edx, 0x198
mov rcx, qword [r15]
lea r9, [rbp - 0x38]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rbp - 0x38], 0x80000000
mov rcx, qword [r15]
jne 0x140003896
lea rdx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x1400038a8
mov r9d, 2
lea r8, [rbp - 0x38]
xor edx, edx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rbp - 0x38]
mov ecx, dword [rbp - 0x34]
mov dword [r14 + 0x50], eax
mov eax, dword [rbp - 0x2c]
sub eax, ecx
jns 0x1400038bb
inc eax
sar eax, 1
mov r10d, 1
add eax, 2
add eax, ecx
mov dword [r14 + 0x54], eax
mov edx, dword [r14 + 0x44]
movzx ecx, byte [r15 + 8]
sub ecx, 9
je 0x140003963
sub ecx, 1
je 0x14000393f
cmp ecx, 1
jne 0x140003974
mov rcx, qword [r15]
cmp edx, 1
jne 0x14000390f
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov qword [rsp + 0x50], rdi
jmp 0x140003974
mov rax, qword [rbp - 0x74]
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, qword [r15]
lea r9, [rbp + 0x10]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov qword [rsp + 0x50], rdi
jmp 0x140003974
mov r9, r10
mov edx, 0x100c
mov r8, 0xffffffffffffffff
mov rcx, qword [r15]
call qword [sym.imp.USER32.dll_SendMessageW]
inc eax
movsxd rdi, eax
mov qword [rsp + 0x50], rdi
jmp 0x140003974
xor r9d, r9d
mov edx, OleCreatePictureIndirect
xor r8d, r8d
jmp 0x14000394e
mov r15, qword [rbp - 0x68]
mov rcx, qword [r13 + 8]
lea rdx, [rbp + 0xa8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0xa8]
lea r8d, [rsi + 1]
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0xac]
sub dword [r14 + 0x54], eax
movsxd rdx, esi
shl rdx, 5
test r15, r15
je 0x1400039ae
mov rcx, qword [r15]
jmp 0x1400039b5
lea rcx, [0x1400ef7d4]
xor r9d, r9d
lea esi, [r8 + 1]
mov r10d, 1
test r15, r15
mov eax, r9d
setne al
mov dword [rbp + rdx + 0xe0], eax
mov qword [rbp + rdx + 0xd0], rcx
mov ecx, r9d
movsxd rdx, esi
inc esi
shl rdx, 5
movsxd rax, r8d
shl rax, 5
mov dword [rbp + rax + 0xe0], r10d
mov qword [rbp + rax + 0xd0], rdi
mov eax, dword [r14 + 0x44]
cmp eax, 3
mov dword [rbp + rdx + 0xe0], r10d
sete cl
mov qword [rbp + rdx + 0xd0], rcx
movsxd rax, dword [r14 + 0x50]
movsxd rcx, esi
inc esi
shl rcx, 5
mov dword [rbp + rcx + 0xe0], r10d
mov qword [rbp + rcx + 0xd0], rax
movsxd rax, dword [r14 + 0x54]
movsxd rcx, esi
shl rcx, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rcx + 0xe0], r10d
mov qword [rbp + rcx + 0xd0], rax
mov ecx, dword [rsp + 0x64]
jmp 0x140003b2e
mov dword [r14 + 0x44], r10d
cmp ecx, 8
jne 0x140003b22
mov r15d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
movsxd rax, esi
inc esi
shl rax, 5
mov dword [r14 + 0x50], r15d
movsxd rdi, esi
inc esi
shl rdi, 5
mov dword [rbp + rax + 0xe0], r10d
mov qword [rbp + rax + 0xd0], rcx
cmp byte [r13 + 0x110], 0
movzx eax, r15w
je 0x140003ac3
mov r8d, dword [0x14012af94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
cdqe
mov qword [rbp + rdi + 0xd0], rax
mov eax, r15d
mov dword [rbp + rdi + 0xe0], r10d
movsxd rdi, esi
inc esi
shl rdi, 5
shr eax, 0x10
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x60], esi
je 0x140003b0c
mov r8d, dword [0x14012af94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
mov ecx, dword [rsp + 0x64]
cdqe
mov qword [rbp + rdi + 0xd0], rax
mov dword [rbp + rdi + 0xe0], r10d
mov r15, qword [rbp - 0x68]
mov rdi, qword [rsp + 0x50]
xor r9d, r9d
cmp byte [rbp + 0x2418], 0
je 0x140003e09
cmp byte [r15 + 8], 0x17
jne 0x140003e09
xor edx, edx
lea rcx, [rbp + 0x2e8]
mov r8d, 0x10b0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r15]
lea eax, [rdi - 1]
lea r9, [rbp + 0x2e0]
mov dword [rbp + 0x2e4], eax
xor r8d, r8d
mov dword [rbp + 0x2e0], ntohs
mov edx, 0x703
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140003e6b
cmp word [rbp + 0x350], 0
lea rax, [rbp + 0x2f0]
mov rcx, qword [0x140127a38]
lea rdx, [rbp + 0x350]
cmove rdx, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [r9 - 1]
call fcn.1400d3520
mov rdi, qword [0x140127a38]
inc dword [rsp + 0x60]
movsxd rsi, esi
shl rsi, 5
cmp byte [rdi + 0x23], 0
jne 0x140003bdc
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x140003bea
mov rcx, rdi
call fcn.1400015e0
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x140003d6c
test byte [rdi + 0x21], 4
je 0x140003c04
mov rdx, rdi
call fcn.140060930
mov rcx, qword [rdi + 8]
xor eax, eax
mov dword [rbp + rsi + 0xe0], eax
mov qword [rbp + rsi + 0xd0], rcx
jmp 0x140003e6b
mov dword [r14 + 0x44], 5
lea rdx, [rbp + 0xb8]
mov rax, qword [rbp - 0x74]
mov qword [r14 + 0x50], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0xb8]
mov edx, 0xffffffec
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0xbc]
sub dword [r14 + 0x54], eax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
and eax, 0xffffffef
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
movsxd rdi, esi
mov rcx, r12
shl rdi, 5
inc esi
call fcn.1400a35f0
mov r15, qword [rbp - 0x68]
mov dword [rbp + rdi + 0xe0], 6
mov qword [rbp + rdi + 0xd0], rax
test r15, r15
je 0x140003caf
mov rdx, qword [r15]
mov r8d, 1
jmp 0x140003cbb
xor eax, eax
lea rdx, [0x1400ef7d4]
mov r8d, eax
mov ecx, dword [rsp + 0x60]
add ecx, 2
movsxd rax, esi
shl rax, 5
movsxd rdi, ecx
shl rdi, 5
lea esi, [rcx + 1]
mov dword [rbp + rax + 0xe0], r8d
mov qword [rbp + rax + 0xd0], rdx
cmp byte [r13 + 0x110], 0
mov eax, dword [r14 + 0x50]
je 0x140003d05
mov r8d, dword [0x14012af94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
cdqe
mov r10d, 1
mov dword [rbp + rdi + 0xe0], r10d
mov qword [rbp + rdi + 0xd0], rax
mov eax, dword [r14 + 0x54]
movsxd rdi, esi
inc esi
shl rdi, 5
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x60], esi
je 0x140003d51
mov r8d, dword [0x14012af94]
lea edx, [r10 + 0x5f]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
mov ecx, dword [rsp + 0x64]
cdqe
mov qword [rbp + rdi + 0xd0], rax
mov dword [rbp + rdi + 0xe0], r10d
jmp 0x140003b26
cmp al, 2
jne 0x140003def
mov rcx, qword [0x14012bc60]
test rcx, rcx
jne 0x140003df6
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140003dbe
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rcx, [0x1400ef7d4]
lea rax, [0x1400ef7c8]
cmovne rcx, rax
xor eax, eax
mov dword [rbp + rsi + 0xe0], eax
mov qword [rbp + rsi + 0xd0], rcx
jmp 0x140003e6b
xor edx, edx
call fcn.1400071d0
mov edx, 0xffffffff
lea rcx, [0x1400ef7d4]
cmp rax, rdx
cmovne rcx, qword [0x14012bc58]
xor eax, eax
mov dword [rbp + rsi + 0xe0], eax
mov qword [rbp + rsi + 0xd0], rcx
jmp 0x140003e6b
lea rcx, [0x140129f30]
xor eax, eax
mov qword [rbp + rsi + 0xd0], rcx
mov dword [rbp + rsi + 0xe0], eax
jmp 0x140003e6b
cmp word [rbp + 0x70], 0
je 0x140003e31
movsxd rax, esi
lea rdx, [rbp + 0x70]
shl rax, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rax + 0xe0], r9d
mov qword [rbp + rax + 0xd0], rdx
cmp ecx, 8
je 0x140003e59
cmp ecx, 5
je 0x140003e59
mov rcx, qword [0x140127a38]
lea rdx, [rbp + 0x70]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d3520
jmp 0x140003e6b
mov rcx, qword [0x140127a38]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rdi
call fcn.140001540
mov rax, qword [r13 + 8]
mov rdi, qword [rbp - 0x20]
movzx esi, byte [rbp + 0x2418]
mov qword [r14 + 0xf8], rax
add dword [r13 + 0x34], 2
mov eax, dword [rbp - 0x18]
mov dword [r14 + 0x70], eax
mov rax, qword [rsp + 0x50]
mov qword [r14 + 0x48], rax
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x58], r13
test rdi, rdi
je 0x140003ea8
mov byte [rdi], 1
jmp 0x140003eb2
test sil, sil
je 0x140003eb2
or byte [r15 + 9], 4
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
jne 0x140003ece
call fcn.140007950
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x140003ee8
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
add rcx, 0x18
lea rax, [0x1400ef7e8]
mov qword [0x140126968], rcx
lea r9, [rbp + 0xd0]
xor r14d, r14d
lea r8, str.call
mov dword [rsp + 0x30], r14d
mov rdx, rbx
mov qword [rcx + 8], rax
lea rax, [rbp + 0x90]
mov qword [rcx], r14
mov dword [rcx + 0x10], r14d
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1400b8990
sub qword [0x140126968], 0x18
cmp qword [r13 + 8], r14
je 0x140003fda
mov eax, dword [rsp + 0x64]
test rdi, rdi
je 0x140003f8a
mov byte [rdi], r14b
cmp eax, 6
jne 0x140003f94
cmp qword [rbp + 0x90], r14
jne 0x140003fda
mov rcx, rbx
call fcn.1400bcb20
test eax, eax
jne 0x140003f77
test rbx, rbx
jne 0x140003fda
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x140003fda
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140003fda
test sil, sil
je 0x140003f94
and byte [r15 + 9], 0xfb
cmp eax, 5
jne 0x140003fda
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
mov qword [r13 + 0xa0], r14
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
or eax, 0x10
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, 0xffffffff
add dword [r13 + 0x34], eax
jne 0x140004687
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 0x130
mov rcx, r13
call fcn.1400ec260
jmp 0x140004687
test r13, r13
je 0x14000402b
mov rax, qword [r13 + 8]
mov qword [r14 + 0xf8], rax
mov eax, 1
mov dword [r14 + 0x44], eax
add dword [r13 + 0x34], 2
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x58], r13
lea rax, [0x14012b6a8]
mov dword [rbp + 0x20], edi
lea rcx, [0x14012afc0]
mov qword [rbp + 0x10], rax
call fcn.14007ae10
mov dword [rbp + 0x60], edi
lea ecx, [rax + 1]
mov eax, 1
mov qword [rbp + 0x30], rcx
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
mov dword [rbp + 0x40], eax
lea rax, [0x14012b8b2]
mov qword [rbp + 0x50], rax
jne 0x14000407e
call fcn.140007950
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x140004098
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
add rcx, 0x18
mov dword [rsp + 0x30], edi
mov qword [0x140126968], rcx
lea rax, str.Menu
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x10]
lea r8, str.call
mov dword [rsp + 0x20], 3
mov qword [rcx], rdi
mov rdx, rbx
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edi
mov rcx, rbx
call fcn.1400b8990
sub qword [0x140126968], 0x18
test r13, r13
je 0x140004687
mov eax, 0xffffffff
add dword [r13 + 0x34], eax
jne 0x140004687
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 0x130
mov rcx, r13
call fcn.1400ec260
jmp 0x140004687
mov rax, qword [rbp - 0x50]
mov rbx, qword [rbp]
mov qword [r14 + 0xf8], rax
movzx eax, byte [rbx + 0x35]
mov byte [r14 + 0x136], al
mov r9, qword [rbx]
mov rcx, r9
call fcn.1400bcb20
test eax, eax
je 0x140004145
cmp eax, 1
jne 0x140004153
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x140004153
movzx ecx, byte [rax]
jmp 0x140004155
xor cl, cl
movzx eax, byte [rbx + 0x39]
cmp byte [rbx + 0x38], al
jb 0x140004178
add cl, 0x32
cmp cl, 0x14
ja 0x140004687
mov eax, 0x10fc01
bt eax, ecx
jae 0x140004687
mov byte [0x14012bb6e], dil
xor r9d, r9d
inc byte [rbx + 0x38]
xor r8d, r8d
mov rdx, qword [0x14012bac0]
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.1400bca60
dec byte [rbx + 0x38]
jmp 0x140004687
call qword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x1400041d6
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400041cf
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400041cf
lea edx, [rax + 2]
jmp 0x1400041d9
mov edx, 1
jmp 0x1400041d9
mov rdx, rdi
mov rcx, qword [0x140127a38]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [r14 + 0x48], rdx
call fcn.140001540
mov rax, qword [r14 + 0x48]
mov ebx, 1
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x10], rax
mov byte [0x14012bb30], bl
jne 0x14000421e
call fcn.140007950
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x140004238
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
add rcx, 0x18
lea rax, [0x1400ef858]
mov qword [0x140126968], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edi
mov rax, qword [0x14012bb18]
test rax, rax
je 0x14000426f
mov rcx, rax
call fcn.140001840
mov rax, qword [0x14012bb18]
cmp qword [rsp + 0x78], rdi
jne 0x140004293
test rax, rax
lea rdx, [rbp + 0x10]
mov r9d, edi
lea rcx, [0x14012bae8]
sete r9b
mov r8d, ebx
call fcn.1400bcbd0
sub qword [0x140126968], 0x18
mov byte [0x14012bb30], dil
jmp 0x140004687
mov rdi, qword [rbp - 0x48]
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
mov dword [rbp + 0x20], 6
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x10], rax
jne 0x1400042d6
call fcn.140007950
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x1400042f0
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x140126968], rcx
lea r9, [rbp + 0x10]
xor esi, esi
lea r8, str.call
mov dword [rsp + 0x30], esi
mov rdx, rbx
mov qword [rcx + 8], rax
mov eax, 1
mov qword [rcx], rsi
mov dword [rcx + 0x10], esi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call fcn.1400b8990
sub qword [0x140126968], 0x18
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x140004689
mov rcx, qword [rbp - 0x80]
mov edx, 1
mov rax, qword [rbp - 0x48]
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], edx
mov dword [rbp + 0x60], edx
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
movzx eax, cl
sar rcx, 0x10
mov qword [rbp + 0x30], rax
movzx eax, cx
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
mov qword [rbp + 0x50], rax
jne 0x14000439d
call fcn.140007950
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x1400043b7
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 3
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x140126968], rcx
lea r8, str.call
mov rdx, rbx
mov dword [rcx + 0x10], edi
mov qword [rcx + 8], rax
mov qword [rcx], rdi
mov rcx, rbx
call fcn.1400b8990
sub qword [0x140126968], 0x18
jmp 0x140004687
mov rax, qword [rbp - 0x80]
mov rcx, qword [0x140126968]
mov word [rbp - 0x14], ax
sar rax, 0x10
cmp rcx, qword [0x140126970]
mov word [rbp - 0x12], ax
mov rax, qword [rbp - 0x48]
mov word [rbp - 0x10], di
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], edi
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x14]
mov qword [rbp + 0x30], rax
jne 0x140004455
call fcn.140007950
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x14000446f
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
jmp 0x1400043cc
mov rax, qword [rbp - 8]
movzx eax, byte [rax + 0x10]
add al, 0x64
cmp al, 3
ja 0x14000449e
mov eax, dword [rbp - 0x80]
mov qword [r14 + 0x48], rax
cmp byte [0x14012d5cc], dil
mov r15, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x50]
mov qword [r14 + 0xf8], rbx
movzx eax, byte [r15 + 0x24]
mov byte [r14 + 0x136], al
jne 0x140004687
cmp dword [0x140128aa4], edi
jne 0x1400044da
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140128aa4], eax
inc dword [0x14012d5c8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [0x14012d5c8]
mov ecx, eax
sub ecx, dword [0x140128aa4]
cmp r9d, dword [0x140125c34]
mov r8d, dword [0x140125c30]
mov dword [0x140128aa0], eax
jbe 0x140004519
cmp ecx, r8d
jae 0x140004519
mov ebx, 1
mov edx, ebx
jmp 0x140004520
mov edx, edi
mov ebx, 1
test edx, edx
je 0x140004606
mov dword [rsp + 0x20], ecx
lea r8, str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea rcx, [rbp + 0x13a0]
mov edx, 0x800
call fcn.1400ce4e0
movzx edx, word [0x140128a9c]
mov r9d, edi
cmp di, dx
jae 0x1400045a3
mov r8, rdi
nop word [rax + rax]
mov rax, qword [0x140128a88]
mov rcx, qword [rax + r8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x140004594
nop dword [rax]
nop dword [rax + rax]
mov byte [rax + 0x27], dil
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140004580
movzx edx, word [0x140128a9c]
inc r9d
movzx eax, dx
add r8, 8
cmp r9d, eax
jl 0x140004560
xor r8d, r8d
mov byte [0x14012d5cc], 1
movaps xmm3, xmm6
mov dword [0x1401241f4], edi
lea rcx, [rbp + 0x13a0]
mov qword [rsp + 0x20], rdi
lea edx, [r8 + 4]
call fcn.1400d5ab0
cmp eax, 7
jne 0x1400045e2
xor r8d, r8d
lea edx, [rax - 3]
lea rcx, [0x14012afc0]
call fcn.1400380f0
mov eax, dword [0x140128aa0]
mov dword [0x140128aa4], eax
mov dword [0x1401241f4], ebx
mov byte [0x14012d5cc], dil
mov dword [0x14012d5c8], edi
jmp 0x140004687
cmp ecx, r8d
jbe 0x140004617
mov dword [0x14012d5c8], edi
mov dword [0x140128aa4], eax
mov r14, qword [rbp - 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, r15
movzx eax, byte [r14 + 0xf]
mov byte [0x14012bb6e], al
inc byte [r15 + 0x22]
mov rdx, qword [0x14012bac0]
call fcn.1400bca60
dec byte [r15 + 0x22]
test eax, eax
jne 0x140004652
mov byte [r15 + 0x27], dil
jmp 0x140004687
cmp byte [r15 + 0x27], dil
je 0x140004687
mov byte [r15 + 0x27], dil
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [r15 + 0x18]
cmp eax, 0x3e8
ja 0x140004687
movzx r8d, word [r14 + 4]
xor r9d, r9d
mov rcx, qword [0x140127a60]
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
lea rcx, [rbp + 0x1e0]
call fcn.1400056c0
cmp dword [rbp + 0x2408], 0
movsxd r15, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
mov rbx, r15
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
je 0x140001c10
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x1400046e5
movsxd r15, dword [rbp + 0x2400]
mov ecx, dword [rbp - 0x60]
mov rbx, r15
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jg 0x140001c10
jmp 0x1400046ec
mov r15d, dword [rbp + 0x2400]
movsxd rbx, r15d
cmp rbx, 0xffffffffffffffff
jle 0x140004702
mov qword [0x14012bbb0], rsi
mov dword [0x14012bbc0], eax
mov r14b, 1
mov dword [0x14012bbc4], eax
mov byte [rbp + 0x2410], r14b
mov byte [rsp + 0x48], 1
mov r12d, dword [rsp + 0x44]
jmp 0x140001c07
mov rcx, qword [0x140124200]
mov byte [rcx + 0x128], 0
jmp 0x140004738
mov rcx, qword [0x140124200]
mov rdx, qword [0x140127a20]
test rdx, rdx
je 0x140004775
mov rcx, qword [0x140127a60]
lea r8, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
test eax, eax
jne 0x140001c10
mov rcx, qword [0x140124200]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140002b53
cmp rbx, 0xffffffffffffffff
jle 0x1400047b8
xor ebx, ebx
mov dword [0x14012bbc0], eax
mov qword [0x14012bbb0], rbx
jmp 0x1400047ba
xor ebx, ebx
cmp byte [rsp + 0x49], 0
mov dword [0x14012bbc4], eax
movzx eax, byte [0x14012787f]
cmovne eax, ebx
cmp byte [rsp + 0x4a], 0
mov byte [0x14012787f], al
je 0x140002a4b
mov eax, dword [0x140127a68]
dec eax
mov dword [0x140127a68], eax
test r15d, r15d
jle 0x140002a4b
test eax, eax
jne 0x140002a4b
cmp dword [0x14012bb4c], eax
jne 0x140002a4b
cmp dword [0x140128a84], eax
jne 0x140002a4b
cmp byte [0x14012787e], al
je 0x140002a4b
mov rcx, qword [0x140127a60]
lea edx, [rax + 9]
call qword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x14012787e]
test eax, eax
cmovne ecx, ebx
jmp 0x140002a45