Function at 0x14001f460
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x168
lea rbp, [rsp + 0x60]
cmp word [rcx], 0
mov r15, r9
mov r14d, r8d
mov r13d, edx
mov rsi, rcx
je 0x140020da3
mov r12, qword [0x14012f240]
mov eax, dword [0x140136c60]
mov edi, dword gs:[0x48]
mov qword [rbp + 0x58], r12
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x1c], edi
test edx, edx
jne 0x14001f4e7
mov r8d, 7
lea rdx, str.Blind
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001f4e7
add rsi, 0xe
mov byte [0x140136d1c], 1
mov qword [rbp + 0x10], rsi
jmp 0x14001f4f7
mov byte [0x140136d1c], 0
mov qword [rbp + 0x10], rsi
test r13d, r13d
jne 0x14001f526
mov r8d, 6
lea rdx, [0x1401109a0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001f526
mov r13d, 2
add rsi, 0xc
mov dword [rbp + 0x158], r13d
mov qword [rbp + 0x10], rsi
mov eax, dword [r12 + 0x7c]
mov dword [rbp + 0x4c], eax
mov eax, dword [r12 + 0x84]
mov dword [rbp + 0x50], eax
lea eax, [r14 - 1]
test eax, 0xfffffffd
jne 0x14001f61a
mov rcx, qword [0x140136ed0]
test rcx, rcx
je 0x14001f55a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.AHK_Keybd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x140136ed0], 0
mov edi, eax
je 0x14001f589
mov qword [0x140136ed0], rbx
jmp 0x14001f597
test rbx, rbx
je 0x14001f597
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xb7
je 0x14001f5d0
test r13d, r13d
jne 0x14001f5c1
call fcn.1400177d0
test al, al
je 0x14001f5c1
lea rdx, str.Click
mov rcx, rsi
call fcn.1400d6b70
test rax, rax
jne 0x14001f5d0
mov r14d, 1
mov dword [rbp + 0x160], r14d
jmp 0x14001f617
cmp r14d, 3
jne 0x14001f5e5
mov r14d, 2
mov dword [rbp + 0x160], r14d
jmp 0x14001f617
xor eax, eax
mov r14d, eax
mov dword [rbp + 0x160], eax
cmp dword [r12 + 0x7c], eax
jge 0x14001f606
cmp dword [r12 + 0x84], eax
jge 0x14001f606
mov eax, 0xffffffff
mov dword [r12 + 0x84], eax
mov dword [r12 + 0x7c], 0xffffffff
mov edi, dword [rbp + 0x1c]
xor r12d, r12d
mov byte [rbp + 8], 0
mov ebx, r12d
test r15, r15
je 0x14001f681
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x34], eax
mov r14d, eax
test eax, eax
je 0x14001f780
cmp eax, dword [0x140136030]
je 0x14001f780
mov rcx, r15
call fcn.1400df220
test al, al
jne 0x14001f780
mov ecx, dword [0x140136030]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov ebx, r14d
setne byte [rbp + 8]
jmp 0x14001f780
test byte [0x140136c0e], 0xc0
je 0x14001f72c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140136c04]
cmp eax, 0x32
jae 0x14001f72c
cmp r14d, 2
je 0x14001f72c
cmp byte [0x140136d1c], bl
jne 0x14001f72c
cmp r13d, 2
je 0x14001f72c
cmp byte [0x140136e83], bl
je 0x14001f72c
cmp edi, dword [0x140136030]
jne 0x14001f72c
test r13d, r13d
je 0x14001f820
mov r8, rsi
test rsi, rsi
je 0x14001f720
movzx edx, word [rsi]
test dx, dx
je 0x14001f720
mov r9d, 0x4c
nop word [rax + rax]
lea rcx, [0x140110ea8]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x14001f723
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001f700
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14001f6f0
mov r8, r12
test r8, r8
jne 0x14001f8e3
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14001f777
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x80]
mov dword [rbp + 0x80], 0x48
mov ecx, eax
mov ebx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14001f777
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x14001f777
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov eax, dword [rbp + 0x150]
mov dword [rbp + 0x34], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r9, [0x140136f20]
mov qword [0x140136fc0], rax
mov rdx, r9
mov ecx, r12d
mov rdi, rax
nop
mov r8, qword [rdx]
test r8, r8
je 0x14001f7bc
cmp r8, rdi
je 0x14001f929
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x14001f7a0
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, rdi
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.140024bb0
mov dword [rbx + 8], eax
mov qword [rbx], rdi
mov cl, 1
mov dword [0x140136f14], eax
call fcn.140024620
and byte [0x140136047], al
movzx ebx, al
cmp qword [0x140132ae0], r12
je 0x14001f939
movzx eax, byte [0x140132bae]
movzx ecx, byte [0x140132baa]
movzx r12d, al
and r12b, cl
not al
and al, cl
jmp 0x14001f960
mov rdx, rsi
mov r9d, 0x4c
mov r10d, 0x7b
nop
test rdx, rdx
je 0x14001f72c
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001f72c
nop word [rax + rax]
lea rcx, [0x140110ea8]
movzx eax, r9w
nop dword [rax + rax]
cmp r8w, ax
je 0x14001f887
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001f860
movzx r8d, word [rdx + 2]
add rdx, 2
test r8w, r8w
jne 0x14001f850
jmp 0x14001f72c
test rdx, rdx
je 0x14001f72c
add rdx, 2
je 0x14001f8e3
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001f8e3
lea rcx, [0x140110eb0]
movzx eax, r10w
nop dword [rax + rax]
cmp r8w, ax
je 0x14001f8d4
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001f8b0
movzx r8d, word [rdx + 2]
add rdx, 2
test r8w, r8w
jne 0x14001f8a0
jmp 0x14001f8e3
test rdx, rdx
je 0x14001f8e3
cmp word [rdx], r10w
jne 0x14001f830
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001f907
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001f72c
mov edx, 1
mov dword [0x14012f234], r12d
mov ecx, 0x8000012f
call fcn.140001b00
mov dword [0x14012f234], 1
jmp 0x14001f8e3
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x14001f7df
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140136c04]
cmp eax, dword [0x140130c8c]
jae 0x14001f958
movzx ecx, byte [0x140136c0e]
and cl, bl
jmp 0x14001f95a
xor cl, cl
movzx r12d, cl
xor al, al
not r12b
mov byte [rbp + 3], cl
and r12b, byte [0x140136046]
and r12b, bl
mov byte [rbp + 6], al
cmp byte [0x140136d1c], 0
mov byte [rbp + 0x150], r12b
mov byte [0x140136046], r12b
je 0x14001f9a3
not r12b
mov byte [rbp + 0x150], bl
and r12b, bl
mov byte [rbp + 2], bl
mov byte [rbp + 4], r12b
movzx r12d, bl
jmp 0x14001f9ac
xor al, al
mov byte [rbp + 2], r12b
mov byte [rbp + 4], al
mov rax, qword [rbp + 0x58]
cmp byte [rax + 0x133], 0
je 0x14001f9dc
cmp byte [0x140136d1c], 0
jne 0x14001f9dc
cmp r13d, 2
je 0x14001f9dc
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140023c30
mov dword [rbp + 0x30], eax
xor r8d, r8d
jmp 0x14001f9e3
xor r8d, r8d
mov dword [rbp + 0x30], r8d
mov ecx, dword [rbp + 0x160]
mov eax, 0x1f4
mov dword [0x140136fcc], ecx
mov edi, 0x5dc
test ecx, ecx
je 0x14001fa87
cmp ecx, 1
mov edx, 0x2ee0
cmovne eax, edi
mov dword [0x140136f1c], eax
mov eax, 0x4e20
cmovne eax, edx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001fa2d
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400f7000
mov rax, qword [0x140131a60]
sub rsp, rcx
mov byte [0x140136d18], bl
mov byte [0x140136d19], 0
mov dword [0x140136f18], r8d
lea rcx, [rsp + 0x60]
mov byte [0x140136d1a], 0
mov qword [rax], rcx
mov ecx, dword [rbp + 0x160]
mov dword [0x140136fd0], 0x80000000
mov dword [0x140136fd4], 0x80000000
mov byte [0x140136d1b], 1
mov eax, dword [str._v_a_a_a]
movzx r13d, byte [0x14013290a]
add eax, 0xfffffff8
mov byte [rbp + 0xa], r13b
test eax, 0xfffffffd
jne 0x14001fac4
test ecx, ecx
jne 0x14001fac4
test r15, r15
jne 0x14001fac4
mov ecx, 1
mov byte [rbp + 9], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14013290a], 1
jmp 0x14001fac8
mov byte [rbp + 9], 0
xor r14b, r14b
cmp word [rsi], 0
mov byte [rbp], r14b
je 0x140020abe
lea rbx, [0x140000000]
xor r13b, r13b
cmp dword [0x140136fcc], 0
mov byte [rbp + 5], r13b
jne 0x14001fb57
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012f240]
xor edi, edi
sub eax, dword [0x140136c64]
cmp eax, dword [rcx + 0x118]
jbe 0x14001fb59
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, [rbp + 0xd0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001fb49
mov edx, 1
mov dword [0x14012f234], edi
mov ecx, 0xffffffff
call fcn.140001b00
mov dword [0x14012f234], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140136c64], eax
jmp 0x14001fb59
xor edi, edi
mov eax, dword [rbp + 0x158]
test eax, eax
jne 0x140020862
movzx edx, word [rsi]
lea rcx, [0x140110eb8]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x1400208af
movzx eax, word [rsi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x14001fba3.38
cdqe
movzx eax, byte [rbx + rax + 0x20dd4]
mov ecx, dword [rbx + rax*4 + 0x20db8]
add rcx, rbx
jmp rcx
test r12b, 3
jne case.0x14001fba3.38
or r14b, 1
jmp 0x140020a89
test r12b, 0x30
jne case.0x14001fba3.38
or r14b, 0x10
jmp 0x140020a89
test r12b, 0xc
jne case.0x14001fba3.38
or r14b, 4
jmp 0x140020a89
test r12b, 0xc0
jne case.0x14001fba3.38
or r14b, 0x40
jmp 0x140020a89
mov edx, 0x7d
lea rcx, [rsi + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov qword [rbp + 0x40], rax
mov rdi, rax
test rax, rax
je case.0x14001fba3.38
movzx ecx, word [rsi + 2]
add rsi, 2
cmp cx, 0x20
je 0x14001fc10
cmp cx, 9
je 0x14001fc10
mov r15, rax
mov qword [rbp + 0x10], rsi
sub r15, rsi
sar r15, 1
jne 0x14001fcdc
lea rbx, [rax + 2]
movzx eax, word [rax + 2]
cmp ax, 0x7d
jne 0x14001fc57
mov rdi, rbx
mov qword [rbp + 0x40], rbx
mov r15d, 1
jmp 0x14001fcdc
cmp ax, 0x20
je 0x14001fc73
cmp ax, 9
jne 0x140020138
cmp ax, 0x20
je 0x14001fc73
cmp word [rbx], 9
jne 0x14001fc7d
movzx eax, word [rbx + 2]
add rbx, 2
jmp 0x14001fc67
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14001fcb5
mov r8d, 2
lea rdx, [0x14010f8a8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140020138
mov edx, 0x7d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov qword [rbp + 0x40], rax
mov rdi, rax
test rax, rax
je case.0x14001fba3.38
mov r15, rax
sub r15, rsi
sar r15, 1
mov r8d, 5
lea rdx, [0x14010db30]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001fdd8
xor r8d, r8d
lea rcx, [rsi + 0xa]
mov word [rdi], r8w
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001fd14
cmp ax, 9
jne 0x14001fd1a
add rcx, 2
jmp 0x14001fd05
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 1]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x24]
lea rax, [rbp + 0xc]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.140021e90
mov ecx, dword [rbp + 0x18]
mov word [rdi], 0x7d
cmp ecx, 1
jge 0x14001fd86
mov rax, qword [rbp + 0x58]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x24]
lea rcx, [rbp + 0x28]
movzx r9d, byte [rax + 0x12f]
movzx eax, byte [rbp + 7]
mov byte [rsp + 0x20], al
call fcn.140022ea0
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
movzx eax, byte [rbp + 7]
xor edx, edx
mov r15, qword [rbp + 0x168]
movzx r9d, r12b
mov byte [rsp + 0x50], al
movzx r8d, r14b
mov eax, dword [rbp + 0x24]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x28]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0xc]
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
movzx ecx, byte [rbp + 1]
call fcn.140020e40
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
mov r8d, 3
lea rdx, [0x140110ec8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001fe0d
mov rsi, qword [rbp + 0x40]
mov r13d, 1
mov dword [rbp + 0x158], r13d
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
mov r8d, 4
lea rdx, str.Text
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001fe69
lea rcx, [rsi + 8]
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001fe3f
cmp ax, 9
jne 0x14001fe45
add rcx, 2
jmp 0x14001fe30
cmp rcx, rdi
jne 0x140020138
mov rsi, qword [rbp + 0x40]
mov r13d, 2
mov dword [rbp + 0x158], r13d
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
xor ebx, ebx
mov r13d, 2
mov word [rdi], bx
mov eax, 1
movzx edx, word [rsi]
mov r12, r15
mov dword [rbp + 0xc], r13d
mov r14, rsi
mov dword [rbp + 0x18], eax
test dx, dx
je 0x14001febc
nop
lea rcx, [0x140110770]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14001fec4
add rcx, r13
movzx eax, word [rcx]
test ax, ax
jne 0x14001fea0
add r14, r13
movzx edx, word [r14]
test dx, dx
jne 0x14001fe90
mov r14, rbx
jmp 0x14001ff9a
test r14, r14
je 0x14001ff9a
movzx eax, word [r14]
mov r12, r14
sub r12, rsi
mov word [r14], bx
sar r12, 1
lea rbx, [r14 + 2]
mov word [rbp + 0x20], ax
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14001fef5
cmp ax, 9
jne 0x14001fefa
add rbx, r13
jmp 0x14001fee6
mov rax, rdi
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14001ff98
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001ff6d
xor edi, edi
lea rdx, str.Temp
mov r8d, 4
mov dword [rbp + 0xc], edi
lea rcx, [rbx + 8]
mov r13d, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001ff4f
xor ebx, ebx
mov dword [rbp + 0x2c], ebx
jmp 0x14001ff9a
cmp word [rbx + 8], 0x52
mov ecx, edi
sete cl
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
test eax, eax
mov ebx, edi
setne bl
inc ebx
mov dword [rbp + 0x2c], ebx
jmp 0x14001ff98
lea rdx, [0x14010f8a8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14001ff8d
mov r13d, 1
mov dword [rbp + 0xc], r13d
jmp 0x14001ff98
mov rcx, rbx
call fcn.14001eeb0
mov dword [rbp + 0x18], eax
xor ebx, ebx
mov rax, qword [0x140136fc0]
lea rdx, [rbp]
mov r8b, 1
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.140025360
mov byte [rbp + 1], al
movzx edi, al
test al, al
je 0x14001ffc7
movzx esi, bx
jmp 0x140020052
xor edx, edx
mov rcx, rsi
call fcn.140025240
movzx esi, ax
test ax, ax
jne 0x140020052
mov rbx, qword [rbp + 0x10]
lea rdx, [0x1401107cc]
mov rcx, rbx
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140020052
lea rcx, [rbx + 4]
mov r8d, reloc.WSOCK32.dll_recv
add byte [rax - 0x73], cl
push rbp
cmp bh, bh
adc eax, 0xd90ed
mov rcx, qword [rbp + 0x38]
lea rdx, [0x140111038]
mov r8d, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140020052
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp + 0x38]
add rcx, 4
mov r8d, reloc.WSOCK32.dll_recv
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov rcx, qword [rbp + 0x38]
cmp word [rcx], si
jne 0x140020052
movzx edi, bl
mov byte [rbp + 1], bl
movzx esi, ax
test r14, r14
je 0x14002005f
movzx eax, word [rbp + 0x20]
mov word [r14], ax
mov rax, qword [rbp + 0x40]
mov r14d, dword [rbp + 0x18]
mov word [rax], 0x7d
cmp r14d, 1
jl 0x140020130
test dil, dil
jne 0x1400206b7
test si, si
jne 0x1400206b7
mov rsi, qword [rbp + 0x10]
movzx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
je 0x1400201cb
cmp r12, 1
jbe 0x1400201cf
cmp dword [0x140136fcc], 0
je 0x140020146
mov rcx, rsi
call fcn.14001eeb0
mov ecx, dword [0x140136f1c]
cmp dword [0x140136f18], ecx
mov ebx, eax
jne 0x1400200d5
call fcn.140023550
test eax, eax
je 0x140020130
cmp dword [0x140136fcc], 1
jne 0x14002010f
mov rax, qword [0x140133b28]
mov ecx, dword [0x140136f18]
lea rdx, [rcx + rcx*4]
lea rcx, [rax + rdx*8]
xor edx, edx
mov dword [rcx], 1
or byte [0x140136d19], 1
mov qword [rcx + 8], rdx
mov dword [rcx + 0x10], edx
mov qword [rcx + 0x18], rbx
jmp 0x14002012a
mov edx, dword [0x140136f18]
xor r8d, r8d
mov rax, qword [0x140131a60]
mov rcx, qword [rax]
mov dword [rcx + rdx*8], r8d
mov dword [rcx + rdx*8 + 4], ebx
inc dword [0x140136f18]
movzx r12d, byte [rbp + 0x150]
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
mov eax, dword [rbp + 0x1c]
xor r8d, r8d
cmp dword [0x140136030], eax
mov dword [0x14012f234], r8d
je 0x140020197
mov rcx, rsi
call fcn.14001eeb0
test eax, eax
js 0x140020197
mov rcx, rsi
call fcn.14001eeb0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r12d, byte [rbp + 0x150]
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
mov dword [0x14012f234], 1
jmp 0x140020a86
mov rcx, rsi
call fcn.14001eeb0
mov ecx, eax
mov edx, 1
call fcn.140001b00
movzx r12d, byte [rbp + 0x150]
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
mov dword [0x14012f234], 1
jmp 0x140020a86
cmp r12, 1
jne 0x14002025a
cmp r13d, 1
je 0x140020130
mov r13, qword [rbp + 0x168]
test r13, r13
je 0x140020231
test r14d, r14d
jle 0x140020130
mov rbx, r14
nop word [rax + rax]
movzx r8d, word [rsi]
xor r9d, r9d
mov edx, 0x102
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
sub rbx, 1
jne case.0x1400acad0.4
movzx r12d, byte [rbp + 0x150]
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
movzx r8d, byte [rbp]
mov edx, r14d
movzx r12d, byte [rbp + 0x150]
movzx ecx, word [rsi]
or r8b, r12b
call fcn.1400210a0
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
mov r13, qword [rbp + 0x168]
lea r9, [rbp + 2]
test r13, r13
lea r8, [rbp + 0xc]
mov rdx, r15
mov rcx, rsi
sete al
mov byte [rsp + 0x20], al
call fcn.1400256d0
mov byte [rbp + 1], al
movzx edi, al
test al, al
je 0x14002042c
mov esi, dword [rbp + 0xc]
test r13, r13
jne 0x140020320
test esi, esi
jne 0x1400202a1
mov byte [rbp + 5], al
jmp 0x140020320
cmp dword [0x140136f10], 0
jne 0x140020320
cmp byte [0x140136045], dil
je 0x140020320
cmp byte [0x140136d1c], 0
jne 0x140020320
movzx ecx, byte [0x140136044]
lea eax, [rdi - 0x5b]
cmp al, 1
ja 0x1400202da
lea eax, [rcx - 0x5b]
cmp al, 1
ja 0x1400202da
cmp dword [0x140136fcc], 2
jne 0x1400202f7
cmp dil, 0xa4
je 0x1400202ef
cmp dil, 0xa5
jne 0x140020320
cmp dword [0x140136f14], 3
je 0x140020320
add cl, 0x5c
cmp cl, 1
ja 0x140020320
movzx r8d, word [0x140130c90]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov ecx, 2
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
call fcn.1400215d0
cmp dword [0x140136fcc], 0
je 0x140020332
movzx eax, byte [0x140136d18]
jmp 0x140020339
xor ecx, ecx
call fcn.140024620
movzx r12d, byte [rbp + 2]
xor r9d, r9d
movzx ecx, r12b
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r13
mov byte [rsp + 0x20], 0
movzx edx, al
mov byte [rbp + 0x150], r12b
call fcn.140023d80
test r14d, r14d
jle 0x140020138
mov rbx, r14
xor r12d, r12d
nop dword [rax]
nop word [rax + rax]
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
mov r9, r13
mov byte [rsp + 0x20], 1
movzx edx, dil
mov ecx, esi
call fcn.1400215d0
cmp dword [0x140136fcc], r12d
jne 0x14002040c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012f240]
sub eax, dword [0x140136c64]
cmp eax, dword [rcx + 0x118]
jbe 0x14002040c
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, [rbp + 0xd0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140020400
mov edx, 1
mov dword [0x14012f234], r12d
mov ecx, 0xffffffff
call fcn.140001b00
mov dword [0x14012f234], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140136c64], eax
sub rbx, 1
jne 0x140020380
movzx r12d, byte [rbp + 0x150]
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
cmp r15, 4
jbe 0x1400204d2
mov r8d, 4
lea rdx, str.ASC
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400204d8
test r13, r13
jne 0x1400204d8
lea rcx, [rsi + 6]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x140020470
cmp ax, 9
jne 0x140020476
add rcx, 2
jmp 0x140020461
call fcn.1400212a0
cmp dword [0x140136fcc], 2
mov rax, qword [0x14012f240]
jne 0x1400204b0
mov ecx, dword [rax + 0x80]
call fcn.140023890
movzx r12d, byte [rbp + 2]
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
mov byte [rbp + 0x150], r12b
jmp 0x140020a86
mov ecx, dword [rax + 0x7c]
call fcn.140023890
movzx r12d, byte [rbp + 2]
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
mov byte [rbp + 0x150], r12b
jmp 0x140020a86
cmp r15, 2
jbe 0x1400204b8
mov r8d, 2
lea rdx, [0x140110eec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400204b8
lea rcx, [rsi + 4]
xor edx, edx
mov r8d, reloc.WSOCK32.dll_recv
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
cmp eax, 0x10000
jb 0x140020537
add eax, 0xffff0000
mov edx, 0x3ff
mov ecx, eax
movzx ebx, ax
shr ecx, 0xa
and bx, dx
and cx, dx
mov r8d, 0x2800
sub cx, r8w
mov edx, 0x2400
sub bx, dx
jmp 0x140020540
xor r8d, r8d
movzx ecx, ax
mov ebx, r8d
movzx r12d, byte [rbp + 2]
mov byte [rbp + 0x150], r12b
test r13, r13
je 0x140020589
movzx r8d, cx
xor r9d, r9d
mov rcx, r13
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
test bx, bx
je 0x140020678
movzx r8d, bx
xor r9d, r9d
mov edx, 0x102
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140020678
cmp dword [0x140136fcc], 2
je 0x1400205bc
movzx edi, byte [rbp]
or dil, r12b
movzx edx, dil
call fcn.14001f1c0
test bx, bx
je 0x140020678
movzx edx, dil
movzx ecx, bx
call fcn.14001f1c0
jmp 0x140020678
mov ecx, gethostbyname
lea rdx, [rbp + 0x6a]
mov word [rbp + 0x68], cx
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
cmp dword [0x140136fcc], 0
je 0x1400205e9
movzx eax, byte [0x140136d18]
jmp 0x1400205f0
xor ecx, ecx
call fcn.140024620
movzx ecx, al
mov dword [rsp + 0x28], 0xffc3d44f
and cl, 0xc4
mov byte [rsp + 0x20], 1
or cl, 4
xor r9d, r9d
xor r8d, r8d
movzx edx, al
call fcn.140023d80
movzx eax, word [rbp + 0x68]
lea rbx, [rbp + 0x68]
cmp ax, 0x30
jb 0x140020659
cmp ax, 0x39
ja 0x140020659
movzx edx, byte [rbx]
xor r8d, r8d
add dl, 0x30
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov ecx, 2
call fcn.1400215d0
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x30
jae 0x140020622
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov ecx, 1
call fcn.1400215d0
cmp dword [0x140136fcc], 2
mov rax, qword [0x14012f240]
jne 0x1400206a1
mov ecx, dword [rax + 0x80]
call fcn.140023890
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
mov ecx, dword [rax + 0x7c]
call fcn.140023890
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
xor r8d, r8d
movzx edx, si
movzx ecx, dil
call fcn.140024880
mov r15, qword [rbp + 0x168]
movzx ebx, al
test al, al
je 0x14002080f
test r15, r15
jne 0x14002080f
test r13d, r13d
jne 0x140020739
mov eax, dword [rbp + 0x2c]
mov byte [rbp + 5], dil
cmp eax, 1
jne 0x140020713
movzx r12d, byte [rbp + 0x150]
or byte [0x140136046], bl
or r12b, bl
mov byte [rbp + 0x150], r12b
mov byte [rbp + 2], r12b
jmp 0x140020817
cmp eax, 2
jne 0x14002071e
or byte [0x140136047], bl
movzx r12d, byte [rbp + 0x150]
or r12b, bl
mov byte [rbp + 0x150], r12b
mov byte [rbp + 2], r12b
jmp 0x140020817
cmp r13d, 1
jne 0x14002080f
cmp dword [0x140136f10], 0
jne 0x1400207c4
cmp byte [0x140136045], dil
je 0x1400207c4
cmp byte [0x140136d1c], 0
jne 0x1400207c4
movzx ecx, byte [0x140136044]
lea eax, [rdi - 0x5b]
cmp al, r13b
ja 0x14002077e
lea eax, [rcx - 0x5b]
cmp al, r13b
ja 0x14002077e
cmp dword [0x140136fcc], 2
jne 0x14002079b
cmp dil, 0xa4
je 0x140020793
cmp dil, 0xa5
jne 0x1400207c4
cmp dword [0x140136f14], 3
je 0x1400207c4
add cl, 0x5c
cmp cl, 1
ja 0x1400207c4
movzx r8d, word [0x140130c90]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov ecx, 2
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
call fcn.1400215d0
movzx ecx, byte [rbp + 4]
movzx eax, bl
not al
and byte [0x140136047], al
and cl, al
movzx r12d, al
mov byte [rbp + 4], cl
and r12b, byte [0x140136046]
mov byte [0x140136046], r12b
cmp dil, 0xa5
jne 0x1400207ff
cmp dword [0x140136f14], 3
jne 0x1400207ff
and cl, 0xfe
mov byte [rbp + 4], cl
or r12b, cl
mov byte [rbp + 0x150], r12b
mov byte [rbp + 2], r12b
jmp 0x140020817
movzx r12d, byte [rbp + 0x150]
movzx r8d, byte [rbp]
movzx r9d, r12b
mov byte [rsp + 0x50], 0
movzx edx, si
mov dword [rsp + 0x48], 0x80000000
movzx ecx, dil
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
call fcn.140020e40
mov rsi, qword [rbp + 0x40]
movzx r13d, byte [rbp + 5]
jmp 0x140020a86
cmp eax, 2
jne 0x1400208b5
movzx ecx, word [rsi]
sub ecx, 8
je 0x1400208a7
sub ecx, 1
je 0x14002089f
sub ecx, 1
je 0x140020897
cmp ecx, 3
je 0x140020886
mov byte [rbp + 1], r13b
xor bl, bl
jmp 0x1400208e4
cmp word [rsi + 2], 0xa
lea rax, [rsi + 2]
cmove rsi, rax
mov qword [rbp + 0x10], rsi
mov byte [rbp + 1], ntohs
mov bl, 0xd
jmp 0x1400208e4
mov byte [rbp + 1], 9
mov bl, 9
jmp 0x1400208e4
mov byte [rbp + 1], 8
mov bl, 8
jmp 0x1400208e4
mov eax, dword [rbp + 0x158]
or r14b, r12b
je 0x1400208c3
test eax, eax
jne 0x1400208c3
mov r9b, 1
jmp 0x1400208c6
xor r9d, r9d
mov r8, qword [0x140136fc0]
lea rdx, [rbp]
movzx ecx, word [rsi]
call fcn.1400254c0
movzx r14d, byte [rbp]
movzx ebx, al
mov byte [rbp + 1], al
test bl, bl
je 0x140020afd
or r14b, r12b
lea eax, [rbx - 1]
cmp al, 5
ja 0x1400208fb
cmp bl, 3
jne 0x140020902
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x140020907
mov sil, 1
jmp 0x140020910
xor sil, sil
nop word [rax + rax]
cmp dword [0x140136fcc], 0
jne 0x14002097c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012f240]
sub eax, dword [0x140136c64]
cmp eax, dword [rcx + 0x118]
jbe 0x14002097c
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, [rbp + 0x80]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140020970
mov edx, 1
mov dword [0x14012f234], edi
mov ecx, 0xffffffff
call fcn.140001b00
mov dword [0x14012f234], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140136c64], eax
mov rax, qword [0x14012f240]
movzx ecx, byte [rax + 0x136]
test cl, cl
je 0x140020997
mov edi, 0xffc3d44d
sub edi, ecx
jmp 0x14002099c
mov edi, 0xffc3d44f
cmp dword [0x140136fcc], 0
je 0x1400209ae
movzx eax, byte [0x140136d18]
jmp 0x1400209b5
xor ecx, ecx
call fcn.140024620
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov r8, r15
mov byte [rsp + 0x20], 1
movzx edx, al
movzx ecx, r14b
call fcn.140023d80
test sil, sil
je 0x140020a11
test r15, r15
jne 0x140020a11
mov rax, qword [0x14012f240]
mov r9d, 1
mov byte [rsp + 0x30], r13b
movzx ecx, bl
mov dword [rsp + 0x28], 2
movzx edx, byte [rax + 0x12f]
mov dword [rsp + 0x20], edx
mov edx, 0x80000000
mov r8d, edx
call fcn.1400229d0
jmp 0x140020a42
mov rax, qword [0x14012f240]
xor r8d, r8d
mov r9, r15
movzx edx, bl
movzx ecx, byte [rax + 0x136]
mov eax, 0xffc3d44d
sub eax, ecx
mov ecx, 2
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], 1
call fcn.1400215d0
cmp dword [0x140136fcc], 0
je 0x140020a54
movzx eax, byte [0x140136d18]
jmp 0x140020a5b
xor ecx, ecx
call fcn.140024620
movzx edx, r12b
not dl
and dl, al
and dl, 0xcc
je 0x140020a82
mov dword [rsp + 0x28], 0xffc3d44d
mov r9b, 1
mov r8, r15
mov byte [rsp + 0x20], r13b
xor ecx, ecx
call fcn.140023d80
mov rsi, qword [rbp + 0x10]
xor r14b, r14b
mov byte [rbp], r14b
mov r15, qword [rbp + 0x168]
lea rbx, [0x140000000]
add rsi, 2
mov byte [0x140136045], r13b
mov qword [rbp + 0x10], rsi
cmp word [rsi], 0
jne 0x14001fae0
movzx r13d, byte [rbp + 0xa]
mov edi, 0x5dc
cmp dword [0x140136fcc], 0
je 0x140020bb5
cmp byte [0x140136d1a], 0
mov ebx, 0xffffffff
mov dword [rbp + 0x150], ebx
jne 0x140020b7d
cmp dword [0x140136f18], 0
jbe 0x140020b7d
cmp byte [0x140136d1c], 0
je 0x140020b34
xor bl, bl
jmp 0x140020b3d
movzx ecx, word [rsi]
test r15, r15
je 0x140020b1e
mov r8d, ecx
xor r9d, r9d
mov rcx, r15
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140020a86
or r14b, r12b
mov edx, 1
movzx r8d, r14b
call fcn.1400210a0
jmp 0x140020a86
movzx ebx, byte [rbp + 6]
not bl
and bl, byte [rbp + 3]
or bl, byte [0x140136047]
mov r9b, 1
movzx edx, byte [0x140136d18]
or bl, r12b
movzx ecx, bl
mov dword [rsp + 0x28], 0xffc3d44d
xor r8d, r8d
mov byte [rsp + 0x20], 1
call fcn.140023d80
movzx edx, bl
lea rcx, [rbp + 0x150]
call fcn.140023630
mov ebx, dword [rbp + 0x150]
cmp dword [0x140136fcc], 1
mov eax, 0x1f4
cmove edi, eax
cmp dword [0x140136f1c], edi
jbe 0x140020ba1
mov rcx, qword [0x140133b28]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edi, edi
mov ecx, ebx
mov dword [0x140136fcc], edi
call fcn.140023890
jmp 0x140020c54
cmp qword [0x140132ae0], 0
je 0x140020bcc
movzx ecx, byte [0x140132baa]
movzx edx, byte [rbp + 3]
jmp 0x140020bf8
cmp dword [0x140130c8c], 0
jl 0x140020bf1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140136c04]
cmp eax, dword [0x140130c8c]
jb 0x140020bf1
movzx edx, byte [rbp + 3]
xor cl, cl
jmp 0x140020bf8
movzx edx, byte [rbp + 3]
movzx ecx, dl
or cl, byte [0x140136047]
cmp byte [0x140136d1c], 0
je 0x140020c1c
movzx eax, cl
xor al, dl
movzx ebx, al
and al, cl
and bl, dl
not bl
and bl, r12b
or bl, al
jmp 0x140020c27
movzx ebx, byte [rbp + 6]
not bl
and bl, cl
or bl, r12b
xor ecx, ecx
call fcn.140024620
or al, byte [0x140132b07]
mov r9b, 1
movzx edx, al
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r15
mov byte [rsp + 0x20], 1
movzx ecx, bl
call fcn.140023d80
xor edi, edi
cmp qword [0x140132ae0], 0
je 0x140020c7a
movzx ecx, byte [0x140132bab]
movzx eax, cl
xor al, byte [0x140132bae]
and al, cl
not al
and cl, al
mov byte [0x140132bab], cl
cmp dword [rbp + 0x30], 1
jne 0x140020c8c
mov edx, 1
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140023c30
cmp byte [rbp + 8], 0
je 0x140020ca4
mov edx, dword [rbp + 0x34]
xor r8d, r8d
mov ecx, dword [0x140136030]
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rbp + 9], 0
je 0x140020cbe
test r13b, r13b
jne 0x140020cbe
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14013290a], r13b
mov eax, dword [rbp + 0x160]
test eax, eax
jne 0x140020d53
mov eax, dword [rbp + 0x48]
cmp dword [0x140136c60], eax
je 0x140020d90
cmp dword [0x14012f234], 0
je 0x140020d90
cmp dword [0x140132a60], 0
jne 0x140020d90
mov rcx, qword [0x14012f240]
cmp byte [rcx + 0x12c], 0
jne 0x140020d42
cmp byte [rcx + 0x12e], 0
jne 0x140020d39
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140020d39
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012f240]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140020d39
mov byte [rcx + 0x12c], 1
cmp byte [rcx + 0x12c], 0
je 0x140020d90
mov edx, 1
mov ecx, 0xffffffff
call fcn.140001b00
jmp 0x140020d90
cmp eax, 1
jne 0x140020d90
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140136030]
jne 0x140020d90
mov edx, 1
mov dword [0x14012f234], edi
mov ecx, 0xffffffff
call fcn.140001b00
mov dword [0x14012f234], 1
mov rax, qword [rbp + 0x58]
mov ecx, dword [rbp + 0x4c]
mov dword [rax + 0x7c], ecx
mov ecx, dword [rbp + 0x50]
mov dword [rax + 0x84], ecx
lea rsp, [rbp + 0x108]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret