Function at 0x140035780
Capabilities:
Check for time delay via gettickcount
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x4278
call fcn.1400e6ce0
sub rsp, rax
mov r15, rcx
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
xor ebp, ebp
mov r12d, 1
mov eax, r12d
mov byte [rsp + 0x42d0], bpl
mov dil, bpl
mov byte [rsp + 0x42d8], bpl
mov r13d, ebp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x42c8]
mov dword [rsp + 0x58], eax
lea r11d, [r12 + 0x2c]
mov dword [rsp + 0x44], 0x3e8
cmp r11w, word [rcx]
mov dl, byte [rcx]
lea r10d, [r12 + 0x29]
movzx ebx, r10b
mov sil, bpl
mov r14b, bpl
cmove ebx, r11d
lea eax, [rbp + 0x41]
lea r9d, [r12 + 0x27]
cmp bl, dl
jne 0x140035b15
lea r8, [rcx + 2]
cmp word [r8], ax
jb 0x140035b15
cmp r10w, word [r8]
je 0x140035b15
mov eax, 0x30
cmp word [r8], ax
jb 0x140035853
cmp word [r8], 0x39
jbe 0x140035b15
cmp r9w, word [r8]
je 0x140035b15
cmp dl, r11b
jne 0x140035878
mov al, byte [r8]
or al, 0x20
cmp al, 0x63
jne 0x140035878
mov al, byte [rcx + 4]
or al, 0x20
cmp al, 0x6d
je 0x140035b15
cmp dl, r10b
jne 0x1400358ad
mov r10d, 9
cmp word [r8], bp
je 0x140035b1b
cmp r10w, word [r8]
ja 0x14003589e
cmp word [r8], 0xd
jbe 0x140035b1b
mov edx, 0x20
cmp dx, word [r8]
je 0x140035b20
mov qword [rsp + 0x42c8], r8
lea rdx, [rsp + 0x42c8]
lea rcx, [0x1400ee704]
mov r8d, 3
call fcn.140058710
cmp al, bpl
je 0x1400358dc
mov r14b, r12b
jmp 0x140035aef
lea rdx, [rsp + 0x42c8]
lea rcx, str.InitSys
mov r8d, 8
call fcn.140058710
cmp al, bpl
je 0x140035908
mov byte [rsp + 0x42d8], r12b
jmp 0x140035aef
lea rdx, [rsp + 0x42c8]
lea rcx, [0x1400ea5cc]
mov r8d, 3
call fcn.140058710
cmp al, bpl
je 0x14003592f
mov sil, r12b
jmp 0x140035aef
lea rdx, [rsp + 0x42c8]
lea rcx, str.sys0
mov r8d, 4
call fcn.140058710
cmp al, bpl
je 0x14003595b
mov eax, 0x41
mov sil, al
jmp 0x140035af4
lea rdx, [rsp + 0x42c8]
lea rcx, str.syscmd
mov r8d, 6
call fcn.140058710
cmp al, bpl
je 0x140035982
mov sil, 0x10
jmp 0x140035aef
lea rdx, [rsp + 0x42c8]
lea rcx, str.sys0cmd
mov r8d, 7
call fcn.140058710
cmp al, bpl
je 0x1400359a9
mov sil, 0x50
jmp 0x140035aef
lea rdx, [rsp + 0x42c8]
lea rcx, str.cont
mov r8d, 4
call fcn.140058710
cmp al, bpl
je 0x1400359d3
mov r13d, 0x10000
jmp 0x140035aef
lea rdx, [rsp + 0x42c8]
lea rcx, str.scanall
mov r8d, 7
call fcn.140058710
cmp al, bpl
je 0x1400359fa
mov dil, r12b
jmp 0x140035aef
lea rdx, [rsp + 0x42c8]
lea rcx, [0x1400edfdc]
mov r8d, 3
call fcn.140058710
cmp al, bpl
je 0x140035a26
mov dword [rsp + 0x40], 0x40
jmp 0x140035aef
lea rdx, [rsp + 0x42c8]
lea rcx, str.freemem
mov r8d, 7
call fcn.140058710
cmp al, bpl
je 0x140035a68
mov cl, r12b
call fcn.1400509cc
mov rcx, qword [rsp + 0x42c8]
cmp word [rcx], bp
je 0x1400360c8
mov eax, 0x41
jmp 0x140035afc
mov rdx, qword [rsp + 0x42c8]
lea rcx, str.cur:
mov r8d, 4
call fcn.14004fdfc
cmp al, bpl
je 0x140035aa4
add qword [rsp + 0x42c8], 8
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x42c8]
call fcn.1400640cc
jmp 0x140035aef
mov rcx, qword [rsp + 0x42c8]
movzx eax, word [rcx]
cmp ax, bp
je 0x140035ae2
mov edx, 9
lea r8d, [rdx + 0x17]
cmp dx, ax
ja 0x140035ac8
cmp ax, 0xd
jbe 0x140035ae2
cmp r8w, ax
je 0x140035ae2
add rcx, 2
mov qword [rsp + 0x42c8], rcx
mov ax, word [rcx]
cmp ax, bp
jne 0x140035abd
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
mov eax, 0x41
mov rcx, qword [rsp + 0x42c8]
mov dl, byte [rcx]
mov r9d, 0x28
lea r11d, [r9 + 5]
cmp bl, dl
jne 0x140035b15
lea r10d, [r9 + 2]
jmp 0x140035825
mov r10d, 9
mov edx, 0x20
cmp byte [rcx], r11b
jne 0x140035b81
cmp byte [rcx + 2], r11b
jne 0x140035b81
movzx eax, word [rcx + 4]
cmp ax, bp
je 0x140035b64
cmp r10w, ax
ja 0x140035b40
cmp ax, 0xd
jbe 0x140035b64
cmp dx, ax
jne 0x140035b81
jmp 0x140035b64
cmp r10w, ax
ja 0x140035b53
cmp ax, 0xd
jbe 0x140035b6c
cmp dx, ax
je 0x140035b6c
add rcx, 2
mov qword [rsp + 0x42c8], rcx
movzx eax, word [rcx]
cmp ax, bp
jne 0x140035b47
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
mov rcx, qword [rsp + 0x42c8]
cmp sil, bpl
je 0x140035ce4
lea rcx, [0x140107de8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, str.GlobalPECMD:main:lock
lea rcx, [rsp + 0xe8]
call fcn.140014bf0
movzx ebx, sil
and ebx, 0x40
mov ecx, ebx
call fcn.140017840
mov rdi, rax
cmp rax, rbp
jne 0x140035bce
mov edx, ebx
mov rcx, r15
call fcn.140021d7c
mov rdi, rax
cmp rdi, rbp
je 0x140035cbf
mov rcx, qword [rsp + 0x42c8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x50]
movsxd rbx, eax
lea rdx, [rbx + 0x75]
call fcn.140056040
mov rax, qword [rsp + 0x50]
mov word [rax], bp
test sil, 0x10
jne 0x140035c1b
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
lea rdx, str.THREAD_WAIT__cur:_lu
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x42c8]
lea r8d, [rbx + 0x11]
movsxd rcx, eax
mov rax, qword [rsp + 0x50]
lea rcx, [rax + rcx*2]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rbx, 0xffffffff80000002
lea r8, str.HOTKEY9000000
movsxd rcx, eax
lea rdx, str.SOFTWAREPELOGONRAMDATAHOTKEY
mov r9d, r12d
lea eax, [rcx + rcx]
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [0x140107168]
xor r9d, r9d
mov edx, 0x312
mov r8d, 0x895440
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, str.HOTKEY9000000
lea rdx, str.SOFTWAREPELOGONRAMDATAHOTKEY
mov rcx, rbx
mov r12d, eax
call qword [0x140107170]
lea rcx, [rsp + 0x50]
call fcn.14004ea6c
lea rcx, [rsp + 0xe8]
movsxd rbx, r12d
call fcn.140014c14
lea rcx, [0x140107de8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
jmp 0x1400369be
cmp dil, bpl
je 0x140035dcf
lea rcx, [rsp + 0xb8]
lea rbp, str.PressKey
call fcn.140055fcc
mov r11, qword [rsp + 0x42c8]
xor r13d, r13d
cmp word [r11], r13w
je 0x140035d33
lea r8d, [r13 + 0x2c]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x42c8]
call fcn.140059810
mov rbp, qword [rsp + 0xb8]
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x160], r13b
call fcn.1400cc8d0
lea rcx, [rsp + 0x160]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov word [rsp + 0x260], r13w
lea rbx, [rsp + 0x160]
lea rdi, [rsp + 0x260]
mov esi, 0x100
movzx r8d, byte [rbx]
lea rdx, str.0x_02X
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
add rdi, 0xa
add rbx, r12
sub rsi, r12
jne 0x140035d7c
lea r8, [rsp + 0x260]
mov rdx, rbp
mov rcx, r15
mov word [rsp + 0xc5e], r13w
call fcn.140055710
lea rcx, [rsp + 0xb8]
call fcn.14004ea6c
xor ebp, ebp
mov r14d, ebp
jmp 0x140036988
mov edi, 0x80000000
mov ebx, 0xfffffc18
mov r8d, 0x64
cmp r11w, word [rcx]
jne 0x140035e21
lea rdx, [rcx + 2]
movzx eax, word [rdx]
or ax, 0x20
cmp ax, 0x63
je 0x140035e21
cmp ax, r8w
je 0x140035e21
lea rcx, [rsp + 0x42c8]
mov qword [rsp + 0x42c8], rdx
mov byte [rsp + 0x42d0], r12b
call fcn.14001462c
mov rcx, qword [rsp + 0x42c8]
mov eax, 0x3d
cmp ax, word [rcx]
jne 0x140035e3c
mov sil, byte [rcx]
add rcx, 2
mov qword [rsp + 0x42c8], rcx
jmp 0x140035e3f
mov sil, bpl
movzx eax, word [rcx]
sub ax, 0x30
cmp ax, r10w
ja 0x140035f64
movsd xmm0, qword [0x1400ee658]
mov qword [rsp + 0x80], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x60], edi
movsd qword [rsp + 0xd8], xmm0
call fcn.1400640cc
mov r11, qword [rsp + 0x42c8]
mov r10d, 9
cmp r11, qword [rsp + 0x80]
jae 0x140035ec4
lea eax, [r10 + 0x17]
cmp r10w, word [r11]
ja 0x140035ea8
cmp word [r11], 0xd
jbe 0x140035ec4
cmp ax, word [r11]
je 0x140035ec4
add r11, 2
mov qword [rsp + 0x42c8], r11
cmp r11, qword [rsp + 0x80]
jb 0x140035e9b
mov eax, dword [rsp + 0x60]
cmp eax, ebp
jl 0x140035f1e
mov edi, eax
mov eax, 0x2e
cmp ax, word [r11]
jne 0x140035f1e
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x42c8]
call fcn.140059bf8
movsd xmm5, qword [rsp + 0xd8]
comisd xmm5, xmmword [0x1400ee650]
jb 0x140035ff1
addsd xmm5, qword [0x1400ee648]
mulsd xmm5, qword [0x1400ee640]
cvttsd2si ebx, xmm5
jmp 0x140035ff1
movzx eax, word [r11]
cmp ax, bp
je 0x140035f52
mov ecx, 0x20
cmp r10w, ax
ja 0x140035f38
cmp ax, 0xd
jbe 0x140035f52
cmp cx, ax
je 0x140035f52
add r11, 2
mov qword [rsp + 0x42c8], r11
mov ax, word [r11]
cmp ax, bp
jne 0x140035f2c
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
jmp 0x140035ff1
cmp r9w, word [rcx]
jne 0x140035ff9
movsd xmm0, qword [0x1400ee658]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x42c8]
movsd qword [rsp + 0xc8], xmm0
call fcn.1400a4420
cmp eax, ebp
jle 0x140035ff1
movsd xmm1, qword [rsp + 0xc8]
xorpd xmm2, xmm2
comisd xmm1, xmm2
jb 0x140035ff1
addsd xmm1, qword [0x1400ee648]
pxor xmm0, xmm0
cvttsd2si rax, xmm1
cvttsd2si edi, xmm1
cvtsi2sd xmm0, rax
subsd xmm2, xmm0
addsd xmm1, xmm2
comisd xmm1, xmmword [0x1400ee638]
jbe 0x140035ff1
movsd xmm0, qword [0x1400ee630]
comisd xmm0, xmm1
jbe 0x140035ff1
mulsd xmm1, qword [0x1400ee640]
cvttsd2si ebx, xmm1
mov rcx, qword [rsp + 0x42c8]
mov eax, 0x2a
cmp ax, word [rcx]
je 0x1400361fd
cmp edi, 0x80000000
jne 0x140036017
cmp ebx, ebp
jl 0x1400361fd
mov word [rsp + 0xf2], bp
mov word [rsp + 0xf0], bp
lea rcx, [rsp + 0x68]
lea rbp, str.PressKey
call fcn.140055fcc
mov rax, qword [rsp + 0x42c8]
mov r8d, 0x2c
cmp r8w, word [rax]
jne 0x140036078
add rax, 2
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x42c8]
mov qword [rsp + 0x42c8], rax
call fcn.140059810
mov rax, qword [rsp + 0x68]
xor ecx, ecx
cmp word [rax], cx
cmovne rbp, rax
xor eax, eax
cmp byte [rsp + 0x42d0], al
jne 0x1400360f5
cmp edi, eax
jne 0x140036090
cmp ebx, eax
jg 0x140036090
lea edx, [rax + 2]
jmp 0x1400360f8
xor ebp, ebp
cmp edi, ebp
jl 0x1400361cc
cmp sil, bpl
je 0x1400360cf
mov ecx, edi
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rsp + 0x42c8]
cmp word [r11], bp
jne 0x1400361cc
lea rcx, [rsp + 0x68]
call fcn.14004ea6c
xor eax, eax
jmp 0x1400369be
cmp ebx, ebp
mov r8d, ebp
mov rcx, r15
cmovg r8d, ebx
cmp edi, ebp
cmovg eax, edi
xor r9d, r9d
movsxd rdx, eax
call fcn.14001bbe8
mov qword [rsp + 0x30], rax
jmp 0x1400361cc
mov edx, r12d
or edx, r13d
mov ecx, edi
call fcn.140025c3c
xor ebx, ebx
mov r12d, eax
lea esi, [rbx + 9]
lea edi, [rbx + 0x30]
mov qword [rsp + 0x30], r12
cmp r14b, bl
jne 0x140036126
add eax, 0xffffffa0
cmp eax, esi
ja 0x140036126
sub r12d, edi
mov qword [rsp + 0x30], r12
cmp r12d, ebx
jle 0x140036143
lea rdx, str.0x_X
lea rcx, [rsp + 0xf0]
mov r8d, r12d
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [0x1400ee628]
lea r8, [rsp + 0xf0]
cmp r12d, ebx
lea rdx, str.PressKey.Hex
mov rcx, r15
cmovle r8, rax
call fcn.140055710
cmp r12d, ebx
jle 0x1400361b3
cmp r12d, 0x41
jl 0x140036179
cmp r12d, 0x5a
jle 0x140036185
movzx eax, r12w
sub ax, di
cmp ax, si
ja 0x14003619b
movsx eax, r12b
mov word [rsp + 0xf2], bx
mov word [rsp + 0xf0], ax
jmp 0x1400361b3
lea rdx, str.0x_X
lea rcx, [rsp + 0xf0]
mov r8d, r12d
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0xf0]
mov rdx, rbp
mov rcx, r15
call fcn.140055710
xor ebp, ebp
lea r12d, [rbp + 1]
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
lea rcx, [rsp + 0x68]
mov edi, 0x80000000
mov byte [rsp + 0x42d0], bpl
call fcn.14004ea6c
mov rcx, qword [rsp + 0x42c8]
mov eax, 0x2a
cmp word [rcx], bp
je 0x140036983
xor r15d, r15d
mov qword [rsp + 0x38], rbp
or ebx, 0xffffffff
mov r8, rbp
mov sil, r15b
cmp ax, word [rcx]
jne 0x14003623f
movsxd r8, dword [rsp + 0x58]
mov ebx, r12d
mov qword [rsp + 0x38], r8
jmp 0x14003622e
add ebx, r12d
add rcx, 2
mov qword [rsp + 0x42c8], rcx
cmp ax, word [rcx]
je 0x14003622b
cmp ebx, r15d
mov r13d, 0x3d
jle 0x140036267
lea eax, [r13 - 0x10]
cmp ax, word [rcx]
jne 0x1400362a5
add rcx, 2
mov r8, r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x42c8], rcx
mov r14d, 0x30
or dword [rsp + 0x5c], 0xffffffff
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
mov rax, qword [rsp + 0x42c8]
cmp r13w, word [rax]
jne 0x14003632a
mov r12b, byte [rax]
add rax, 2
mov qword [rsp + 0x42c8], rax
jmp 0x14003632d
cmp r13w, word [rcx]
jne 0x1400362b0
mov bpl, r12b
jmp 0x1400362bd
mov eax, 0x24
cmp ax, word [rcx]
jne 0x1400362d1
mov sil, 2
add rcx, 2
mov qword [rsp + 0x38], r15
mov r8, r15
mov qword [rsp + 0x42c8], rcx
movzx eax, word [rcx]
mov r14d, 0x30
lea ecx, [r14 - 0x27]
sub ax, r14w
cmp ax, cx
ja 0x140036301
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x42c8]
call fcn.140063ef4
mov r8, qword [rsp + 0x38]
sub ebx, r12d
cmp ebx, r15d
jle 0x14003626d
cmp sil, r15b
jne 0x14003626d
mov edx, ebx
mov ecx, r8d
call fcn.1400185d4
mov r8d, eax
mov qword [rsp + 0x38], r8
jmp 0x14003626d
mov r12b, r15b
movzx eax, word [rax]
mov ecx, 9
sub ax, r14w
cmp ax, cx
ja 0x140036355
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x42c8]
call fcn.1400640cc
mov r8, qword [rsp + 0x38]
cmp sil, r15b
lea r13, [rsp + 0xa8]
lea rax, [rsp + 0x38]
cmovne r13, rax
mov r14d, r15d
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0x30], r14
cmp sil, r15b
jne 0x140036396
cmp r8, r15
jne 0x1400363a0
mov r14d, 0x80070057
mov qword [rsp + 0x30], r14
cmp r8, r15
je 0x1400363d5
cmp sil, r15b
jne 0x1400363d5
xor edx, edx
mov ecx, 0x100000
cmp bpl, r15b
je 0x1400363b4
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x1400363ba
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebp, ebp
mov qword [r13], rax
cmp rax, rbp
jne 0x1400363d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov qword [rsp + 0x30], r14
jmp 0x1400363d7
xor ebp, ebp
lea rcx, [rsp + 0x48]
mov edx, 0x209
call fcn.140056040
mov rax, qword [rsp + 0x48]
mov ebx, 0x208
mov word [rax], bp
mov rdx, qword [rsp + 0x48]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.1400601cc
mov rcx, qword [rsp + 0x78]
mov edx, 0x5c
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rax, qword [rsp + 0x48]
lea rcx, str.SystemRoot
mov word [rax], bp
mov rdx, qword [rsp + 0x48]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
lea rcx, [rsp + 0x90]
call fcn.140056490
mov rax, qword [rsp + 0x42c8]
mov r15, rbp
mov qword [rsp + 0x88], rbp
cmp word [rax], bp
je 0x140036682
mov esi, 1
mov al, byte [0x14010421f]
cmp al, bpl
jle 0x140036682
lea rdx, [rsp + 0x42c8]
lea rcx, str._delms:
mov r8d, 7
call fcn.140058710
cmp al, bpl
je 0x1400364d5
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x42c8]
call fcn.1400640cc
cmp dword [rsp + 0x44], ebp
jge 0x14003665f
mov dword [rsp + 0x44], ebp
jmp 0x14003665f
mov ebx, 4
lea rdx, [rsp + 0x42c8]
lea rcx, str._del
mov r8d, ebx
call fcn.140058710
cmp al, bpl
je 0x1400365f8
mov rax, qword [rsp + 0x42c8]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xc0]
mov r8d, esi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xc0], rax
call fcn.1400236d0
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x42c8], rax
call fcn.140055fcc
lea rcx, [rsp + 0xb0]
call fcn.140055fcc
mov rbx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0xb0]
mov r8, rbx
call fcn.140056234
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x70]
call fcn.140018d04
lea rcx, [rsp + 0xb0]
call fcn.14004ea6c
cmp rbx, rbp
jle 0x1400365df
mov ecx, 8
call fcn.1400ccba8
mov rbx, rax
cmp rax, rbp
je 0x1400365ae
mov rcx, qword [rsp + 0x70]
mov qword [rax], rcx
mov qword [rsp + 0x70], rbp
jmp 0x1400365b1
mov rbx, rbp
mov rcx, qword [rsp + 0xa0]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x90]
mov r9d, 8
call fcn.14005642c
mov qword [rax], rbx
add qword [rsp + 0xa0], rsi
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
jmp 0x14003665f
lea rdx, [rsp + 0x42c8]
lea rcx, str._cmd
mov r8d, ebx
call fcn.140058710
cmp al, bpl
jne 0x140036672
mov rcx, qword [rsp + 0x42c8]
movzx eax, word [rcx]
cmp ax, bp
je 0x140036652
mov edx, 9
lea r8d, [rdx + 0x17]
cmp dx, ax
ja 0x140036638
cmp ax, 0xd
jbe 0x140036652
cmp r8w, ax
je 0x140036652
add rcx, 2
mov qword [rsp + 0x42c8], rcx
mov ax, word [rcx]
cmp ax, bp
jne 0x14003662d
lea rcx, [rsp + 0x42c8]
call fcn.14001462c
mov rax, qword [rsp + 0x42c8]
cmp word [rax], bp
jne 0x140036482
jmp 0x140036682
mov r15, qword [rsp + 0x42c8]
mov qword [rsp + 0x88], r15
cmp byte [rsp + 0x42d0], bpl
je 0x14003668e
neg edi
mov ebx, dword [rsp + 0x40]
cmp ebx, ebp
jne 0x1400366a6
cmp qword [r13], rbp
je 0x1400366a6
mov rcx, qword [rsp + 0x48]
call fcn.140017200
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea esi, [rdi + rax]
cmp qword [r13], rbp
je 0x1400367a5
mov cl, byte [0x14010421f]
cmp cl, bpl
jle 0x1400367a5
mov r14, qword [rsp + 0x42c0]
mov ebp, 1
xor r15d, r15d
cmp edi, r15d
je 0x140036792
mov ebx, 0x3e8
jle 0x1400366fd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, esi
sub edi, eax
js 0x140036792
cmp edi, ebx
cmovl ebx, edi
xor r9d, r9d
mov r8, r13
mov edx, ebp
mov rcx, r14
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], ebx
call fcn.1400186fc
cmp eax, r15d
je 0x140036792
mov al, byte [0x14010421f]
mov ebx, 0x64
cmp al, r15b
jle 0x140036783
lea rcx, [rsp + 0x130]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r15d
je 0x140036783
sub ebx, ebp
je 0x140036783
cmp dword [rsp + 0x138], 0x12
je 0x140036783
lea rcx, [rsp + 0x130]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x130]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x14010421f]
cmp r11b, r15b
jg 0x14003672e
mov al, byte [0x14010421f]
cmp al, r15b
jg 0x1400366d8
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x40]
xor ebp, ebp
movsxd rax, dword [rsp + 0x5c]
cmp eax, ebp
jl 0x1400367d3
cmp r12b, bpl
je 0x1400367bd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400367d3
mov rcx, qword [rsp + 0x42c0]
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
call fcn.14001bbe8
cmp qword [rsp + 0xa0], rbp
jle 0x1400368f5
mov al, byte [0x14010421f]
cmp al, bpl
jle 0x1400368f5
cmp ebx, ebp
jne 0x1400367fe
mov rcx, qword [rsp + 0x48]
call fcn.140017200
cmp qword [rsp + 0xa0], rbp
mov rdi, qword [rsp + 0x90]
jle 0x1400368f5
mov r15, qword [rsp + 0x42c0]
mov r13d, 1
mov al, byte [0x14010421f]
cmp al, bpl
jle 0x1400368dc
mov rax, qword [rsp + 0xa0]
mov r12d, ebp
mov rbx, rbp
cmp eax, ebp
jle 0x1400368dc
movsxd r14, eax
mov ebp, r13d
xor edx, edx
mov al, byte [0x14010421f]
cmp al, dl
jle 0x1400368ae
mov rcx, qword [rdi + rbx*8]
cmp rcx, rdx
je 0x1400368a3
mov rcx, qword [rcx]
xor edx, edx
call fcn.14001d94c
mov r11, qword [rdi + rbx*8]
mov rcx, qword [r11]
call fcn.1400cbe58
xor edx, edx
cmp rax, rdx
jg 0x1400368a0
mov rsi, qword [rdi + rbx*8]
cmp rsi, rdx
je 0x14003689a
mov rcx, rsi
call fcn.14004ea6c
mov rcx, rsi
call fcn.1400cc9bc
xor edx, edx
mov qword [rdi + rbx*8], rdx
jmp 0x1400368a3
mov r12d, ebp
add rbx, r13
add ebp, r13d
cmp rbx, r14
jl 0x14003684f
xor ebp, ebp
cmp r12d, ebp
jle 0x1400368dc
movsxd rdx, dword [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.14001bbe8
movsxd r11, r12d
cmp r11, rbp
mov qword [rsp + 0xa0], r11
jg 0x140036822
mov r13, qword [rsp + 0xe0]
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x40]
cmp ebx, ebp
jne 0x140036909
cmp qword [r13], rbp
je 0x140036909
mov rcx, qword [rsp + 0x78]
call fcn.140017200
cmp r15, rbp
je 0x140036937
cmp word [r15], bp
je 0x140036937
mov rdx, r15
mov r15, qword [rsp + 0x42c0]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rbp
call fcn.14003f698
mov r14d, eax
jmp 0x14003693f
mov r15, qword [rsp + 0x42c0]
lea rcx, [rsp + 0x90]
call fcn.14006b7fc
lea rcx, [rsp + 0x78]
call fcn.14004ea6c
lea rcx, [rsp + 0x48]
call fcn.14004ea6c
mov rcx, qword [rsp + 0xa8]
cmp rcx, rbp
je 0x140036979
cmp rcx, 0xffffffffffffffff
je 0x140036979
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xa8], rbp
jmp 0x140036988
mov r14, qword [rsp + 0x30]
cmp byte [rsp + 0x42d8], bpl
je 0x1400369b1
call fcn.140023a64
cmp eax, ebp
je 0x1400369aa
lea rdx, str.exec
mov rcx, r15
call fcn.140023b28
xor ecx, ecx
call fcn.14002c8b4
xor edx, edx
mov rcx, r15
call fcn.14007e26c
movsxd rax, r14d
add rsp, 0x4278
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret