Function at 0x140001b00
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13b8]
mov eax, 0x14b8
call fcn.1400f7000
sub rsp, rax
movaps xmmword [rsp + 0x14a0], xmm6
mov ebx, edx
mov byte [rsp + 0x4c], 0
mov r14d, ecx
mov edi, 1
cmp edx, 2
jne 0x140001b60
cmp byte [0x1401328bf], 0
mov ebx, edi
mov dword [rbp + 0x1408], ebx
jne 0x140001b60
mov byte [0x1401328bf], bl
mov byte [rsp + 0x4c], bl
xor esi, esi
cmp dword [0x140136d14], esi
je 0x140001b9a
cmp qword [0x140136cf8], rsi
je 0x140001b87
mov rcx, qword [0x140136ce8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140136cf8], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140136d14], esi
mov qword [0x140136ce8], rsi
cmp r14d, 0x8000012f
jne 0x140001bbc
mov r14d, 0xa
mov byte [rbp + 0x1418], dil
mov dword [rbp + 0x1400], r14d
mov dword [rbp - 0x48], esi
jmp 0x140001bd9
cmp r14d, 5
setle al
mov byte [rbp + 0x1418], al
jg 0x140001bd0
mov dword [rbp - 0x48], esi
jmp 0x140001bd9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x48], eax
cmp dword [0x140133b04], esi
je 0x140001be6
call fcn.140004ef0
xor r12b, r12b
cmp dword [0x140136bec], esi
mov dword [rbp - 0x68], r12d
je 0x140001c08
call fcn.140004a80
test al, al
movzx r12d, r12b
cmovne r12d, edi
mov dword [rbp - 0x68], r12d
test r14d, r14d
jle 0x140001c4c
cmp ebx, edi
jne 0x140001c4c
inc dword [0x140132ab8]
cmp byte [0x1401328be], sil
mov byte [rsp + 0x4d], dil
jne 0x140001c51
mov rcx, qword [0x140132ab0]
xor r9d, r9d
mov edx, 9
mov r8d, 0xa
call qword [sym.imp.USER32.dll_SetTimer]
test rax, rax
setne byte [0x1401328be]
jmp 0x140001c51
mov byte [rsp + 0x4d], sil
mov r15, qword [rbp]
xor dil, dil
mov byte [rbp + 0x1410], dil
mov ebx, esi
mov r13, qword [rbp + 0x1410]
xorps xmm6, xmm6
movsxd rax, r14d
mov qword [rsp + 0x50], r15
movzx r15d, byte [rbp + 0x1418]
mov byte [rsp + 0x60], sil
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x58], rax
movsxd r12, r14d
jmp 0x140001cc0
movzx r15d, byte [rbp + 0x1418]
mov r12, r14
jmp 0x140001cc0
mov r12, r14
jmp 0x140001cbb
movzx edi, byte [rbp + 0x1410]
mov r12, r14
jmp 0x140001cc0
movzx edi, byte [rbp + 0x1410]
mov r12, r14
jmp 0x140001cbb
movsxd r12, r14d
mov ebx, dword [rsp + 0x40]
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movzx ecx, byte [0x1401328bf]
mov esi, eax
test r12, r12
jle 0x140001d94
test dil, dil
jne 0x140001d94
test cl, cl
jne 0x140001d9c
cmp dword [0x14012f234], 0
je 0x140001d48
cmp dword [0x140132a60], 0
jne 0x140001d48
mov rcx, qword [0x14012f240]
cmp byte [rcx + 0x12c], dil
jne 0x140001d3f
cmp byte [rcx + 0x12e], dil
jne 0x140001d3f
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001d3f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012f240]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001d3f
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140001d4c
xor ecx, ecx
mov eax, ecx
test eax, eax
lea rcx, [rsp + 0x68]
mov eax, 0
mov r9d, 0x311
cmovne r9d, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x140001cc0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
jbe 0x1400020b5
mov dword [0x140136c60], eax
jmp 0x1400020b5
test cl, cl
je 0x140001f6b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140001f6b
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140136030]
jne 0x140001f6b
cmp dword [0x140132aac], 0
je 0x140001e17
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
xor edi, edi
lea rdx, [rbp + 0x1a0]
mov ecx, edi
lea r8, str.32770
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140001e19
cmp rcx, 7
jne 0x140001e00
jmp 0x140001e72
xor edi, edi
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x140001f6b
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysTreeView32
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001e72
lea rdx, str.SysListView32
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140001f6b
cmp dword [0x14012f234], 0
je 0x140001ed1
cmp dword [0x140132a60], 0
jne 0x140001ed1
mov rcx, qword [0x14012f240]
cmp byte [rcx + 0x12c], 0
jne 0x140001ec8
cmp byte [rcx + 0x12e], 0
jne 0x140001ec8
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001ec8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012f240]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001ec8
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140001ed3
mov eax, edi
test eax, eax
mov dword [rsp + 0x20], edi
mov eax, 0xffffffff
lea rcx, [rsp + 0x68]
mov ebx, 0x311
mov r9d, 0x1ff
cmovne ebx, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edx, edx
lea rcx, [rsp + 0x68]
mov r9d, ebx
mov r8d, 0x20e
test eax, eax
je 0x140001fe6
mov edi, dword [rbp - 0x78]
xor eax, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edx, edx
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x68]
test eax, eax
jne 0x140001f4c
mov r9d, 0x1ff
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edi, edi
jmp 0x140001ff4
mov eax, dword [rbp - 0x78]
sub eax, edi
test eax, eax
jg 0x140001f36
mov r9d, ebx
mov r8d, 0x20e
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edi, edi
jmp 0x140001ff4
cmp dword [0x14012f234], 0
je 0x140001fcc
cmp dword [0x140132a60], 0
jne 0x140001fcc
mov rcx, qword [0x14012f240]
cmp byte [rcx + 0x12c], 0
jne 0x140001fc1
cmp byte [rcx + 0x12e], 0
jne 0x140001fc1
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001fc1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012f240]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001fc1
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
xor edi, edi
jmp 0x140001fd0
xor edi, edi
mov eax, edi
test eax, eax
lea rcx, [rsp + 0x68]
mov r9d, 0x311
cmovne r9d, edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400020aa
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
jbe 0x140002011
mov dword [0x140136c60], eax
movsxd rsi, r14d
test r14d, r14d
jne 0x140002039
cmp byte [rsp + 0x60], r14b
jne 0x140002039
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx edi, byte [rbp + 0x1410]
mov byte [rsp + 0x60], 1
jmp 0x140001cb8
mov ebx, dword [rsp + 0x40]
test ebx, ebx
jne 0x140002070
test r15b, r15b
je 0x140002070
test r14d, r14d
jle 0x140002056
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx edi, byte [rbp + 0x1410]
mov eax, 1
mov ebx, eax
mov dword [rsp + 0x40], eax
movsxd r12, r14d
jmp 0x140001cc0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r15b, r15b
jne 0x140004926
mov ecx, dword [rbp - 0x48]
sub ecx, eax
add ecx, r14d
cmp ecx, 5
jle 0x140004926
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx edi, byte [rbp + 0x1410]
movsxd r12, r14d
jmp 0x140001cc0
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
inc ebx
cmp dword [0x140136058], 0
mov dword [rsp + 0x40], ebx
je 0x1400020f9
mov r9, qword [rbp - 0x80]
lea rax, [rbp + 0x190]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140005000
test al, al
jne 0x140001cc0
mov r8d, dword [0x140132aa8]
mov r10d, dword [rsp + 0x70]
test r8d, r8d
je 0x1400028d7
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400028d7
cmp rax, qword [0x140132ab0]
je 0x1400028d7
cmp r10d, 0x414
je 0x1400028d7
cmp r10d, 0x402
je 0x1400028d7
lea eax, [r10 - 0x100]
cmp eax, 9
ja 0x14000265b
call qword [sym.imp.USER32.dll_GetFocus]
mov r12, rax
test rax, rax
je 0x14000264c
mov edx, 0xfffffff0
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x1400021a5
nop dword [rax]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x1400021a5
mov edx, 0xfffffff0
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x140002180
mov rdi, r12
nop dword [rax + rax]
mov r8d, dword [0x140132aa8]
xor eax, eax
mov ecx, eax
test r8d, r8d
jle 0x1400021e2
mov rax, qword [0x140132aa0]
mov rbx, qword [rax]
cmp qword [rbx + 8], rdi
je 0x1400021dd
inc ecx
add rax, 8
cmp ecx, r8d
jl 0x1400021c7
jmp 0x1400021e2
test rbx, rbx
jne 0x140002220
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x140002207
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
jne 0x1400021b0
mov r10d, dword [rsp + 0x70]
xor esi, esi
mov r8d, dword [0x140132aa8]
mov r13d, esi
movsxd r12, r14d
jmp 0x14000265d
mov rdx, qword [rbx + 0xb8]
test rdx, rdx
je 0x140002253
lea r8, [rsp + 0x68]
mov rcx, rsi
mov r13, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
movzx edi, byte [rbp + 0x1410]
test eax, eax
jne 0x140001cb8
mov r8d, dword [0x140132aa8]
mov r10d, dword [rsp + 0x70]
mov r13, rbx
mov r9, qword [rsp + 0x78]
cmp r10d, 0x100
jne 0x140002330
cmp byte [rbx + 0x108], 0
mov r15, rbx
je 0x1400022d1
cmp r9, 0x25
ja 0x14000228f
movabs rax, 0x2600000200
bt rax, r9
jb 0x140002295
cmp r9, 0x27
jne 0x1400022d1
mov rdx, r12
mov rcx, rbx
call fcn.140001960
mov r15, rbx
mov r13, rbx
cmp eax, 0x2af8
jne 0x14000236a
xor esi, esi
mov qword [rbp - 0x60], rsi
mov r9, qword [rsp + 0x78]
mov r10d, dword [rsp + 0x70]
mov r8d, dword [0x140132aa8]
cmp r10d, 0x100
jne 0x140002330
cmp r9, 0x1b
je 0x140002303
cmp r9, 9
je 0x140002303
cmp r9, 0x41
jne 0x140002330
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14000231f
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14000231f
mov rdx, r12
mov rcx, r15
call fcn.140001960
cmp eax, 0x2af8
jne 0x140002556
xor eax, eax
mov qword [rbp - 0x60], rax
mov r9, qword [rsp + 0x78]
mov r8d, dword [0x140132aa8]
mov r10d, dword [rsp + 0x70]
mov rcx, qword [0x140134f90]
test rcx, rcx
je 0x140002844
cmp r10d, 0x100
jne 0x140002844
cmp r9, 0xd
jne 0x140002629
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1116
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400023c2
mov eax, eax
imul r14, rax, 0x58
add r14, qword [rbx + 0x28]
mov qword [rbp - 0x60], r14
je 0x1400022b7
movzx eax, byte [r14 + 8]
cmp al, 0xf
je 0x1400022b7
mov r9, qword [rsp + 0x78]
xor esi, esi
mov edi, esi
cmp al, 0x13
jne 0x1400023e6
lea rax, [r9 - 0x25]
mov rdi, r14
test rax, 0xfffffffffffffffd
jne 0x1400023e6
cmp r9, 0x27
mov byte [rsp + 0x20], sil
mov rdx, r14
mov rcx, rbx
sete r8b
xor r9d, r9d
call fcn.1400bc050
movzx r15d, byte [rbp + 0x1418]
mov r14d, dword [rbp + 0x1400]
mov r12, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cc0
cmp r9, 0x25
je 0x1400022bc
cmp r9, 0x27
je 0x1400022bc
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400022b7
mov r9, qword [rsp + 0x78]
cmp r9, 9
jne 0x14000243b
cmp byte [r14 + 8], 0xc
jne 0x14000243b
mov rcx, qword [r14]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
test al, 4
jne 0x1400022b7
mov r9, qword [rsp + 0x78]
mov r15, rbx
mov r13, rbx
test rdi, rdi
jne 0x1400024e9
movzx r11d, byte [r14 + 0xa]
cmp r11b, 0xff
je 0x140002490
mov r10d, dword [rbx + 0x20]
xor r8b, r8b
mov edx, esi
test r10d, r10d
je 0x140002490
mov rsi, qword [rbx + 0x28]
nop word [rax + rax]
mov eax, edx
imul rdi, rax, 0x58
add rdi, rsi
cmp byte [rdi + 8], 0x13
jne 0x140002487
cmp r8b, r11b
je 0x1400024d3
inc r8b
inc edx
cmp edx, r10d
jb 0x140002470
xor esi, esi
lea rax, [rbx + 0x20]
mov r10d, dword [rax]
xor r8b, r8b
mov edx, esi
test r10d, r10d
je 0x1400022bc
mov r11, qword [r15 + 0x28]
nop dword [rax]
mov eax, edx
imul rdi, rax, 0x58
add rdi, r11
cmp byte [rdi + 8], 0x13
jne 0x1400024c7
test r8b, r8b
je 0x1400024e0
inc r8b
inc edx
cmp edx, r10d
jb 0x1400024b0
jmp 0x1400022bc
lea rax, [rbx + 0x20]
test rdi, rdi
jne 0x1400024e9
xor esi, esi
jmp 0x140002494
test rdi, rdi
je 0x1400022bc
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1400022b7
mov rax, qword [rsp + 0x78]
cmp rax, 0x22
je 0x140002520
cmp rax, 9
jne 0x14000251b
mov ecx, reloc.WSOCK32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140002520
xor r8d, r8d
jmp 0x140002523
mov r8b, 1
mov r9b, 1
mov byte [rsp + 0x20], 1
mov rdx, rdi
mov rcx, r15
call fcn.1400bc050
mov r14d, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, qword [rsp + 0x58]
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cbb
mov eax, eax
imul r14, rax, 0x58
add r14, qword [r15 + 0x28]
mov qword [rbp - 0x60], r14
je 0x14000231f
cmp byte [r14 + 8], 0xc
jne 0x14000231f
mov r9, qword [rsp + 0x78]
cmp r9, 0x1b
je 0x1400025d8
movzx eax, byte [r14 + 9]
cmp r9, 0x41
je 0x1400025b3
test al, al
jns 0x140002324
mov rcx, qword [r14]
lea r9, [0x1400f9864]
mov edx, 0xc2
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400023c2
test al, 2
jne 0x140002324
mov rcx, qword [r14]
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400023c2
cmp qword [r15 + 0x40], 0
movsxd r14, dword [rbp + 0x1400]
mov ebx, dword [rsp + 0x40]
mov r12, r14
movzx edi, byte [rbp + 0x1410]
je 0x14000297b
mov rcx, qword [r15 + 8]
xor r9d, r9d
mov edx, 0x414
mov r8d, 0x2af80007
call qword [sym.imp.USER32.dll_PostMessageW]
mov r14d, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, qword [rsp + 0x58]
jmp 0x140001cc0
cmp r9, 0x1b
jne 0x140002844
xor r9d, r9d
mov edx, 0x1116
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400023c2
mov r10d, dword [rsp + 0x70]
mov r8d, dword [0x140132aa8]
movsxd r12, r14d
xor esi, esi
lea eax, [r10 - 0x20a]
test eax, 0xfffffffb
jne 0x14000283f
mov rcx, qword [rbp - 0x74]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
mov edx, 0xfffffff0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140132aa8]
mov edx, esi
test r9d, r9d
jle 0x1400026c4
mov rcx, qword [0x140132aa0]
nop word [rax + rax]
mov r8, qword [rcx]
cmp qword [r8 + 8], rax
je 0x140002732
inc edx
add rcx, 8
cmp edx, r9d
jl 0x1400026b0
mov rcx, qword [rsp + 0x68]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9, qword [rsp + 0x78]
mov r8d, eax
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.1400019f0
test eax, eax
jne 0x140002833
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetParent]
mov r8d, dword [0x140132aa8]
mov edx, esi
test r8d, r8d
jle 0x14000272a
mov rcx, qword [0x140132aa0]
mov r13, qword [rcx]
cmp qword [r13 + 8], rax
je 0x1400027a7
inc edx
add rcx, 8
cmp edx, r8d
jl 0x140002712
mov r13, rsi
jmp 0x14000283a
test r8, r8
je 0x1400026c4
cmp rbx, qword [rsp + 0x68]
jne 0x140002765
mov r9, qword [rsp + 0x78]
mov r8d, edi
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.1400019f0
test eax, eax
jne 0x1400026c4
cmp rbx, qword [rsp + 0x68]
je 0x1400026c4
mov r9, qword [rsp + 0x78]
mov r8d, edi
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.1400019f0
test eax, eax
je 0x1400026c4
mov r9, qword [rbp - 0x80]
mov rcx, rbx
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cc0
test r13, r13
je 0x14000283a
mov r9, qword [rsp + 0x78]
mov r8d, dword [r13 + 0x64]
mov edx, dword [rsp + 0x70]
mov rcx, qword [r13 + 8]
call fcn.1400019f0
mov rcx, qword [r13 + 8]
test eax, eax
jne 0x140002810
call qword [sym.imp.USER32.dll_GetParent]
mov r8d, dword [0x140132aa8]
mov edx, esi
test r8d, r8d
jle 0x14000272a
mov rcx, qword [0x140132aa0]
nop dword [rax]
mov r13, qword [rcx]
cmp qword [r13 + 8], rax
je 0x140002809
inc edx
add rcx, 8
cmp edx, r8d
jl 0x1400027f0
mov r13, rsi
jmp 0x14000283a
test r13, r13
jne 0x1400027b0
jmp 0x14000283a
mov r9, qword [rbp - 0x80]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cc0
mov r8d, dword [0x140132aa8]
mov r10d, dword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
xor esi, esi
mov edi, esi
test r8d, r8d
jle 0x1400028cc
mov ebx, esi
nop
mov rdx, qword [0x140132aa0]
mov rax, qword [rbx + rdx]
cmp dword [rax + 0x20], esi
jne 0x140002869
cmp r10d, 0x106
je 0x1400028b6
mov rcx, qword [0x14012f240]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
mov rcx, qword [rbx + rdx]
lea rdx, [rsp + 0x68]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
mov rax, qword [0x14012f240]
mov byte [rax + 0x128], sil
jne 0x1400023c2
mov r10d, dword [rsp + 0x70]
mov r8d, dword [0x140132aa8]
inc edi
add rbx, 8
cmp edi, r8d
jl 0x140002850
mov r12, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x40]
jmp 0x1400028d9
mov r12, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x40]
jmp 0x1400028de
xor esi, esi
mov r9, qword [rsp + 0x78]
cmp r10d, 0x402
ja 0x140002be6
je case.0x140002c07.1044
cmp r10d, 0x113
ja 0x140002ae2
je 0x1400029b7
cmp r10d, 0x12
je 0x140002988
cmp r10d, 0x4b
je 0x140002963
cmp r10d, 0x100
jne case.0x140002c07.1046
mov rax, qword [0x140132a70]
cmp qword [rsp + 0x68], rax
jne case.0x140002c07.1046
cmp r9, 0x1b
jne case.0x140002c07.1046
mov rcx, qword [0x140132ab0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14d, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cc0
mov r14d, dword [rbp + 0x1400]
mov dil, 1
mov byte [rbp + 0x1410], dil
mov qword [0x140132a78], rsi
movzx r15d, byte [rbp + 0x1418]
jmp 0x140001cc0
xor r8d, r8d
lea rcx, [0x140136060]
mov edx, 4
call fcn.14003a320
mov r14d, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cc0
cmp qword [rbp - 0x80], 0
jne case.0x140002c07.1046
mov rax, qword [0x140132ab0]
cmp qword [rsp + 0x68], rax
jne case.0x140002c07.1046
cmp dword [0x140133b04], 0
je 0x1400029e2
call fcn.140004ef0
cmp dword [0x140136bec], 0
je 0x140002a03
call fcn.140004a80
movzx ebx, byte [rbp - 0x68]
test al, al
mov eax, 1
cmovne ebx, eax
mov dword [rbp - 0x68], ebx
jmp 0x140002a06
mov ebx, dword [rbp - 0x68]
cmp dword [rbp + 0x1408], 0
mov r14d, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
movzx edi, byte [rbp + 0x1410]
je 0x140001cbb
cmp r12, 1
jl 0x140001cbb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r15b, r15b
jne 0x140002a4f
mov ecx, dword [rbp - 0x48]
sub ecx, eax
add ecx, r14d
cmp ecx, 5
jg 0x140001cbb
cmp byte [rsp + 0x4c], 0
mov qword [0x140136c50], rsi
mov dword [0x140136c60], eax
mov dword [0x140136c64], eax
je 0x140002a70
mov byte [0x1401328bf], 0
cmp byte [rsp + 0x4d], 0
je 0x140002ac3
mov eax, dword [0x140132ab8]
dec eax
mov dword [0x140132ab8], eax
test r14d, r14d
jle 0x140002ac3
test eax, eax
jne 0x140002ac3
cmp dword [0x140136bec], eax
jne 0x140002ac3
cmp dword [0x140133b04], eax
jne 0x140002ac3
cmp byte [0x1401328be], al
je 0x140002ac3
mov rcx, qword [0x140132ab0]
mov edx, 9
call qword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x140002ac3
mov byte [0x1401328be], 0
movzx eax, bl
movaps xmm6, xmmword [rsp + 0x14a0]
add rsp, 0x14b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, r10d
sub eax, 0x312
je case.0x140002c07.1044
sub eax, 0xee
je case.0x140002c07.1045
cmp eax, 1
je case.0x140002c07.1045
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x14000489b
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140136030]
jne 0x14000489b
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rcx, rsi
lea rdx, [rbp + 0x1a0]
lea r8, str.32770
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000489b
cmp rcx, 7
jne 0x140002b60
mov rcx, qword [0x14012f240]
lea rdx, [rsp + 0x68]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x14000488b
cmp dword [0x140132aac], 0
je 0x140002bd3
mov rax, qword [0x140131a50]
lea rcx, [0x1400f98c4]
test rax, rax
je 0x140002bcd
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, qword [0x14012f240]
mov byte [rax + 0x128], 0
jmp 0x1400023c2
lea eax, [r10 - 0x414]
cmp eax, 0xa
ja case.0x140002c07.1046
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x49ac]
add rcx, rdx
jmp rcx
mov rax, qword [rsp + 0x68]
test rax, rax
je case.0x140002c07.1044
cmp rax, qword [0x140132ab0]
jne case.0x140002c07.1046
lea eax, [r10 - 0x401]
mov r12, rsi
cmp eax, 0x1d
ja case.0x140002c4e.1031
lea r11, [0x140000000]
movzx eax, byte [r11 + rax + 0x49f4]
mov ecx, dword [r11 + rax*4 + 0x49d8]
add rcx, r11
jmp rcx
mov edx, esi
test r8d, r8d
jle 0x140002c79
mov rcx, qword [0x140132aa0]
nop
mov r13, qword [rcx]
mov rax, qword [rsp + 0x68]
cmp qword [r13 + 8], rax
je 0x140002c81
inc edx
add rcx, 8
cmp edx, r8d
jl 0x140002c60
mov r13, rsi
jmp case.0x140002c07.1046
test r13, r13
je case.0x140002c07.1046
mov rax, qword [rbp - 0x80]
movzx edx, r9w
shr r9, 0x10
movzx r8d, r9w
mov dword [rbp - 0x1c], r8d
mov ecx, r8d
mov dword [rsp + 0x64], edx
mov dword [rsp + 0x48], esi
cmp edx, 8
jne 0x140002cbb
mov r8d, 0x2af8
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x1c], r8d
mov rdi, rcx
cmovne rdi, rax
cmp r8d, dword [r13 + 0x20]
jae 0x140002cd5
mov eax, r8d
imul r14, rax, 0x58
add r14, qword [r13 + 0x28]
jmp 0x140002cd8
mov r14, rsi
movzx r15d, byte [rbp + 0x1418]
mov eax, edx
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x10], rsi
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x50], rdi
sub eax, 5
je 0x140002e33
sub eax, 1
je 0x140002de6
sub eax, 1
je 0x140002dcc
sub eax, 1
je 0x140002db2
cmp eax, 1
je 0x140002d91
test r14, r14
je 0x1400034f3
mov rbx, qword [r14 + 0x18]
test rbx, rbx
jne 0x140002d68
test byte [r14 + 9], 1
je 0x140002d47
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x140002d47
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14d, dword [rbp + 0x1400]
mov r12, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x40]
mov qword [rsp + 0x50], rdi
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cc0
test byte [r14 + 9], 4
movsxd r14, dword [rbp + 0x1400]
mov qword [rsp + 0x50], rdi
jne 0x140001cac
mov byte [rsp + 0x44], 1
mov r14d, esi
mov qword [rsp + 0x50], rdi
jmp 0x140003439
mov rbx, qword [r13 + 0x58]
movsxd r14, dword [rbp + 0x1400]
test rbx, rbx
je 0x140001cac
mov qword [rsp + 0x50], rdi
mov r14d, esi
jmp 0x140003439
mov rbx, qword [r13 + 0x48]
movsxd r14, dword [rbp + 0x1400]
test rbx, rbx
je 0x140001cac
lea rcx, [r13 + 0x62]
jmp 0x140002dfe
mov rbx, qword [r13 + 0x40]
movsxd r14, dword [rbp + 0x1400]
test rbx, rbx
je 0x140001cac
lea rcx, [r13 + 0x61]
jmp 0x140002dfe
mov rbx, qword [r13 + 0x38]
movsxd r14, dword [rbp + 0x1400]
test rbx, rbx
je 0x140001cac
lea rcx, [r13 + 0x60]
mov qword [rbp - 0x10], rcx
mov qword [rsp + 0x50], rdi
test rcx, rcx
je 0x140002e84
cmp byte [rcx], 0
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
movzx edi, byte [rbp + 0x1410]
jne 0x140001c9b
mov r14d, esi
jmp 0x140003439
mov rbx, qword [r13 + 0x50]
mov r12, qword [r13 + 0xa0]
movsxd r14, dword [rbp + 0x1400]
test rbx, rbx
je 0x140002e8c
mov qword [rsp + 0x50], rdi
movzx edi, byte [rbp + 0x1410]
test r12, r12
je 0x140001c9b
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r15d, eax
mov qword [rsp + 0x50], r15
test eax, eax
je 0x140002ea0
mov r10d, dword [rsp + 0x70]
mov r14d, esi
jmp 0x140003439
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
test r12, r12
je 0x140001c96
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
mov qword [r13 + 0xa0], rsi
jmp 0x1400023c2
test r9, r9
je 0x140002f07
mov ecx, esi
test r8d, r8d
jle 0x140002ee4
mov rax, qword [0x140132aa0]
nop dword [rax + rax]
mov r13, qword [rax]
cmp qword [r13 + 8], r9
je 0x140002f00
inc ecx
add rax, 8
cmp ecx, r8d
jl 0x140002ed0
mov r13, rsi
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140002f0a
cmp rax, qword [0x140132ab0]
jne case.0x140002c07.1046
jmp 0x140002f0a
test r13, r13
jne 0x140002f0a
jmp 0x140002ee7
mov r13, rsi
mov rcx, qword [0x140136bf0]
test rcx, rcx
je 0x140002f4b
mov rax, qword [rbp - 0x80]
nop word [rax + rax]
mov rdi, qword [rcx + 8]
mov qword [rbp - 0x40], rdi
test rdi, rdi
je 0x140002f42
nop dword [rax]
cmp dword [rdi + 0x28], eax
je 0x140002f6f
mov rdi, qword [rdi + 0x38]
mov qword [rbp - 0x40], rdi
test rdi, rdi
jne 0x140002f30
mov rcx, qword [rcx + 0x30]
test rcx, rcx
jne 0x140002f20
mov r14d, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, qword [rsp + 0x58]
movzx edi, byte [rbp + 0x1410]
mov qword [rbp - 0x40], rsi
jmp 0x140001cc0
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
test rdi, rdi
je 0x140001ca0
mov rbx, qword [rdi + 0x10]
movsxd r14, dword [rbp + 0x1400]
test rbx, rbx
je 0x140001cac
mov r14d, dword [rdi + 0x2c]
jmp 0x140003444
mov eax, dword [0x140133b00]
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
movzx edi, byte [rbp + 0x1410]
cmp r9, rax
jae 0x140001c96
mov rax, qword [0x140133af8]
mov rdi, qword [rax + r9*8]
mov qword [rbp + 8], rdi
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14000300d
mov rdx, qword [rdi + 8]
call fcn.140018490
movsxd r14, dword [rbp + 0x1400]
mov qword [rbp - 0x50], rax
cmp rax, 0
je 0x140001ca0
mov rcx, qword [rdi + 0x20]
movzx edx, byte [rcx]
dec dl
test dl, 0xfd
je 0x140003011
mov qword [rbp - 0x50], rsi
mov rdx, qword [rbp - 0x80]
mov rcx, rdi
call fcn.14001c1b0
cmp qword [rdi + 0x18], 0
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
jne 0x140001ca0
cmp byte [rdi + 0x3e], 0
je 0x140003059
movzx eax, word [rbp - 0x80]
mov r10d, dword [rsp + 0x70]
mov word [0x140136c0c], ax
mov rbx, qword [rdi]
mov r14d, dword [rdi + 0x28]
jmp 0x140003439
mov r10d, dword [rsp + 0x70]
mov word [0x140136c0c], si
mov rbx, qword [rdi]
mov r14d, dword [rdi + 0x28]
jmp 0x140003439
cmp byte [0x140136bd0], 0
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
movzx edi, byte [rbp + 0x1410]
jne 0x140001c96
mov rbx, qword [0x140136bb8]
mov r14d, esi
test rbx, rbx
cmove rbx, qword [0x140136738]
jmp 0x140003440
mov qword [rbp - 0x58], r9
mov rsi, r9
test r9, r9
jne 0x1400030e0
mov r14d, dword [rbp + 0x1400]
xor eax, eax
movzx r15d, byte [rbp + 0x1418]
mov r12, qword [rsp + 0x58]
movzx edi, byte [rbp + 0x1410]
mov qword [rbp - 0x58], rax
jmp 0x140001cc0
mov rax, qword [0x140132a98]
cmp rax, rsi
jne 0x1400030f9
mov rax, qword [r9 + 8]
mov qword [0x140132a98], rax
jmp 0x14000311b
test rax, rax
je 0x1400030ba
nop
lea rcx, [rax + 8]
mov rax, qword [rax + 8]
cmp rax, r9
je 0x140003114
test rax, rax
jne 0x140003100
jmp 0x1400030ba
mov rax, qword [r9 + 8]
mov qword [rcx], rax
call fcn.140018070
xor edi, edi
mov qword [rsi + 8], rdi
cmp qword [rsi + 0x10], rdi
je 0x140003172
cmp qword [0x140132a98], rdi
jne 0x14000314b
cmp dword [0x140133b14], edi
jne 0x14000314b
test byte [0x140132bb3], 1
jne 0x14000314b
call fcn.140018870
mov rcx, qword [rsi + 0x10]
cmp qword [rcx + 0x388], rdi
je 0x14000316c
mov rbx, qword [rcx + 0x388]
mov r14d, edi
mov r10d, dword [rsp + 0x70]
jmp 0x140003439
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r14d, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, qword [rsp + 0x58]
mov qword [rbp - 0x58], rdi
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cc0
mov rsi, qword [0x140132a98]
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
movzx edi, byte [rbp + 0x1410]
mov qword [rbp - 0x58], rsi
test rsi, rsi
je 0x140001c96
cmp rsi, r9
je 0x1400031e3
mov rsi, qword [rsi + 8]
mov qword [rbp - 0x58], rsi
test rsi, rsi
jne 0x1400031c0
mov r14d, dword [rbp + 0x1400]
mov r12, qword [rsp + 0x58]
jmp 0x140001cc0
mov rbx, qword [rsi + 0x10]
cmp r10d, 0x41c
jne 0x1400031f9
mov rbx, qword [rbx + 0x390]
jmp 0x140003212
cmp r10d, 0x41e
jne 0x14000320b
mov rbx, qword [rbx + 0x3a0]
jmp 0x140003212
mov rbx, qword [rbx + 0x398]
movsxd r14, dword [rbp + 0x1400]
test rbx, rbx
je 0x140001c9b
xor eax, eax
mov r14d, eax
jmp 0x140003440
movsxd r14, dword [rbp + 0x1400]
movzx eax, r9w
movzx r15d, byte [rbp + 0x1418]
mov ecx, 0x7fff
movzx edi, byte [rbp + 0x1410]
and ax, cx
cmp ax, word [0x140132e04]
jae 0x140001c96
movzx ecx, ax
mov rax, qword [0x140133b08]
shr r9, 0x10
mov r14, qword [rax + rcx*8]
mov qword [rbp - 8], r14
test r9w, r9w
je 0x1400032a7
mov r15, qword [r14 + 0x28]
mov eax, 0xffff
mov qword [rbp - 0x38], r15
add r9w, ax
je 0x14000329e
nop word [rax + rax]
mov r15, qword [r15 + 0x10]
add r9w, ax
jne 0x140003290
mov qword [rbp - 0x38], r15
test r15, r15
jne 0x1400033a1
cmp r10d, 0x400
jne 0x1400032ca
mov rax, qword [rbp - 0x80]
mov edi, WSAAsyncSelect
shr rax, 0x10
movzx ecx, ax
sub edi, ecx
lea esi, [rcx + 0x3c2bb3]
jmp 0x1400032cf
mov edi, 0x3c2c17
xor eax, eax
cmp byte [r14 + 0x19], al
jne 0x1400032fb
mov r14d, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, qword [rsp + 0x58]
movzx edi, byte [rbp + 0x1410]
mov qword [rbp - 0x38], rax
jmp 0x140001cc0
mov r15, qword [r14 + 0x28]
mov rbx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x38], r15
test r15, r15
je 0x14000337d
nop
cmp byte [r15 + 0x28], 0
je 0x14000336b
cmp byte [0x140132908], 0
je 0x14000332c
mov rcx, r15
call fcn.1400c4b30
test al, al
je 0x14000336b
lea ecx, [rsi - 0x3c2bb3]
cmp edi, 0x66
jbe 0x14000333c
mov ecx, reloc.WSOCK32.dll_WSAAsyncSelect
movzx eax, byte [r15 + 0x24]
cmp ecx, eax
jle 0x14000336b
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140003361
mov rdx, qword [r14 + 0x20]
call fcn.140018490
mov qword [rbp - 0x50], rax
cmp rax, 0
je 0x14000336b
cmp qword [r15 + 8], 0
jne 0x1400033c8
mov rbx, r15
mov r15, qword [r15 + 0x10]
mov qword [rbp - 0x38], r15
test r15, r15
jne 0x140003310
mov r10d, dword [rsp + 0x70]
mov r15, rbx
mov qword [rbp - 0x38], rbx
movsxd r14, dword [rbp + 0x1400]
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
test r15, r15
je 0x140001c8e
xor esi, esi
mov r9, qword [r15]
mov rcx, r9
call fcn.1400c4a80
test eax, eax
je 0x1400033b5
cmp eax, 1
jne 0x1400033cf
mov ecx, reloc.WSOCK32.dll_recv
mov rcx, qword [r9 + rcx]
test rcx, rcx
je 0x1400033cf
movzx ecx, byte [rcx]
jmp 0x1400033d1
mov r10d, dword [rsp + 0x70]
jmp 0x140003384
xor cl, cl
movzx eax, byte [r15 + 0x23]
cmp byte [r15 + 0x22], al
jb 0x140003409
add cl, 0x32
cmp cl, 0x14
ja 0x1400033ee
mov eax, 0x10fc01
bt eax, ecx
jb 0x140003409
cmp byte [r15 + 0x26], 0
je 0x1400033fa
mov byte [r15 + 0x27], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [r15 + 0x18], eax
jmp 0x1400023c2
mov rax, qword [r15 + 8]
test rax, rax
je 0x14000342e
movzx ecx, byte [rax]
lea eax, [rcx - 2]
test al, 0xfd
je 0x14000342e
cmp cl, 5
jb 0x140003432
mov rax, qword [0x140132a90]
mov qword [rbp - 0x50], rax
jmp 0x140003432
mov qword [rbp - 0x50], rsi
mov rbx, qword [r15]
mov r14d, dword [r15 + 0x1c]
lea r11, [0x140000000]
mov rdi, qword [rbp - 0x40]
mov r15, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1400c4a80
test eax, eax
je 0x14000345a
cmp eax, 1
jne 0x140003470
mov ecx, reloc.WSOCK32.dll_recv
mov rax, rbx
mov rax, qword [rbx + rcx]
test rax, rax
je 0x140003470
movzx esi, byte [rax]
jmp 0x140003473
xor sil, sil
mov ecx, dword [0x140132a88]
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
cmp ecx, eax
jl 0x14000350b
add eax, 2
cmp ecx, eax
jge 0x14000349f
lea eax, [rsi + 0x32]
cmp al, 0x14
ja 0x14000349f
mov ecx, 0x10fc01
bt ecx, eax
jb 0x14000350b
test r12, r12
je 0x1400034bb
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [r13 + 0xa0], rax
mov r10d, dword [rsp + 0x70]
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, r14
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
cmp r10d, 0x41b
jne 0x140001cc0
mov rdi, qword [rbp - 0x58]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r14d, dword [rbp + 0x1400]
mov r12, qword [rsp + 0x58]
movzx edi, byte [rbp + 0x1410]
jmp 0x140001cc0
mov rax, qword [0x14012f240]
cmp r14d, dword [rax + 0x3c]
jge 0x14000357d
test r12, r12
je 0x140003534
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [r13 + 0xa0], rax
mov r10d, dword [rsp + 0x70]
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, r14
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
cmp r10d, 0x41b
jne 0x140001cc0
mov rbx, qword [rbp - 0x58]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r14d, dword [rbp + 0x1400]
mov r12, qword [rsp + 0x58]
jmp 0x140001cbb
lea eax, [r10 - 0x402]
mov byte [rbp - 0x68], 1
cmp eax, 0x1c
ja case.0x1400035a1.1028
movzx eax, byte [r11 + rax + 0x4a20]
mov ecx, dword [r11 + rax*4 + 0x4a14]
add rcx, r11
jmp rcx
mov rdx, qword [rdi]
lea rcx, [0x140136748]
mov r8d, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
lea rcx, [0x140136952]
mov word [0x140136950], ax
mov r8d, 0x104
mov rdx, qword [rdi + 0x20]
mov rdx, qword [rdx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov qword [0x140136740], rdi
mov word [0x140136b5a], ax
jmp case.0x1400035a1.1027
mov rax, qword [0x140136b60]
mov qword [0x140136b68], rax
mov eax, dword [0x140136c04]
mov dword [0x140136c08], eax
cmp r10d, 0x401
jne 0x14000361b
mov rax, qword [rbp + 8]
mov rax, qword [rax + 8]
jmp 0x140003623
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x20]
mov qword [0x140136b60], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140136c04], eax
mov rdi, qword [0x140132a80]
cmp byte [rdi + 0x23], 0
jne 0x140003647
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x140003655
mov rcx, rdi
call fcn.140001640
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x140003671
test byte [rdi + 0x21], 4
je 0x14000366b
mov rdx, rdi
call fcn.140065660
mov rdx, qword [rdi + 8]
jmp 0x1400036d8
cmp al, 2
jne 0x1400036d1
mov rdx, qword [0x140136d00]
test rdx, rdx
jne 0x1400036d8
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400036b1
mov ecx, reloc.WSOCK32.dll_ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rdx, [0x1400f97e4]
lea rax, [0x1400f97d8]
cmovne rdx, rax
jmp 0x1400036d8
xor edx, edx
call fcn.1400073b0
mov ecx, 0xffffffff
lea rdx, [0x1400f97e4]
cmp rax, rcx
cmovne rdx, qword [0x140136cf8]
jmp 0x1400036d8
lea rdx, [0x140132e14]
mov r8d, 0x7f
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edi, edi
movzx r9d, sil
mov r8b, 1
mov word [rbp + 0x2de], di
xor edx, edx
mov ecx, r14d
call fcn.1400055e0
mov r14, qword [0x14012f240]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140136c64], eax
mov dword [0x140136c60], eax
mov eax, dword [rsp + 0x70]
add eax, 0xfffffbff
cmp eax, 0x1d
ja case.0x14000374b.1032
lea r9, [0x140000000]
movzx eax, byte [r9 + rax + 0x4a60]
mov ecx, dword [r9 + rax*4 + 0x4a40]
add rcx, r9
jmp rcx
mov rsi, qword [rbp - 0x60]
mov word [rbp + 0x70], di
cmp byte [rsp + 0x44], dil
je 0x140003761
mov rcx, qword [rsi]
jmp 0x140003765
mov rcx, qword [r13 + 8]
movsxd rdi, dword [rsp + 0x48]
mov r8d, 1
mov rax, rdi
shl rax, 5
inc edi
mov dword [rsp + 0x48], edi
mov qword [rbp + rax + 0xd0], rcx
mov ecx, dword [rsp + 0x64]
mov dword [rbp + rax + 0xe0], r8d
mov eax, ecx
sub eax, 5
je 0x140003c98
sub eax, r8d
je 0x140003bd2
sub eax, r8d
je 0x140003bd2
sub eax, r8d
je 0x140003bd2
cmp eax, r8d
je 0x140003905
movzx eax, byte [rsi + 8]
cmp al, 0xa
je 0x140003839
cmp al, 0x19
jne 0x14000380a
mov rax, qword [rbp - 0x74]
lea rdx, [rbp + 0x98]
mov qword [r14 + 0x50], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x98]
lea r9, [0x140000000]
sub dword [r14 + 0x50], eax
mov r8d, 1
mov eax, dword [rbp + 0x9c]
sub dword [r14 + 0x54], eax
mov ecx, dword [rsp + 0x64]
movsxd rax, edi
lea rdx, [rbp + 0xd0]
shl rax, 5
inc edi
add rdx, rax
mov dword [r14 + 0x44], ecx
cmp ecx, 5
jae 0x1400038bf
mov eax, ecx
mov rcx, qword [r9 + rax*8 + 0x11be68]
jmp 0x1400038d0
cmp cl, 0x49
jne 0x14000380a
lea rax, [rbp + 0x70]
bt ecx, 8
jae 0x14000384f
mov eax, 0x53
jmp 0x14000385a
bt ecx, 9
jae 0x140003862
mov eax, reloc.WSOCK32.dll_WSAStartup
mov word [rbp + 0x70], ax
lea rax, [rbp + 0x72]
bt ecx, 0xa
jae 0x14000386f
mov word [rax], 0x46
jmp 0x14000387a
bt ecx, 0xb
jae 0x14000387e
mov word [rax], 0x66
add rax, 2
bt ecx, 0xc
jae 0x14000388b
mov word [rax], 0x43
jmp 0x140003896
bt ecx, 0xd
jae 0x14000389a
mov word [rax], WSAAsyncSelect
add rax, 2
xor ecx, ecx
lea rdx, [rbp + 0xd0]
mov word [rax], cx
mov ecx, 0x49
movsxd rax, edi
shl rax, 5
add rdx, rax
mov dword [rsp + 0x64], ecx
inc edi
mov dword [r14 + 0x44], ecx
movzx eax, cl
lea rcx, [0x140138744]
mov word [0x140138744], ax
mov r15, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rdx], rcx
mov ecx, dword [rsp + 0x64]
movsxd rax, edi
shl rax, 5
mov dword [rdx + 0x10], r9d
inc edi
mov dword [rsp + 0x48], edi
mov dword [rbp + rax + 0xe0], r8d
mov qword [rbp + rax + 0xd0], r15
jmp 0x140003df1
cmp qword [rsp + 0x50], 0
mov eax, 3
cmovne eax, r8d
mov dword [r14 + 0x44], eax
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x74]
mov qword [r14 + 0x50], rax
test rsi, rsi
je 0x140003ae4
test r15, r15
je 0x140003a3f
movzx ecx, byte [rsi + 8]
mov dword [rbp - 0x30], 0x80000000
sub ecx, 9
je 0x1400039c2
sub ecx, r8d
je 0x140003993
sub ecx, r8d
je 0x140003966
cmp ecx, 6
jne 0x1400039f1
xor r8d, r8d
mov edx, 0x419
jmp 0x1400039e4
mov rcx, qword [rsi]
xor r9d, r9d
mov edx, 0x110a
mov r8d, 9
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400039f1
mov qword [rbp - 0x30], rax
mov edx, 0x1104
mov r8d, 1
jmp 0x1400039e4
mov rcx, qword [rsi]
mov r9, r8
mov r8, 0xffffffffffffffff
mov edx, 0x100c
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, eax
cmp r8, 0xffffffffffffffff
je 0x1400039f1
mov dword [rbp - 0x30], 2
mov edx, 0x100e
jmp 0x1400039e4
mov rcx, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov edx, OleCreatePictureIndirect
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
je 0x1400039f1
mov r8, rax
mov edx, 0x198
mov rcx, qword [rsi]
lea r9, [rbp - 0x30]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rbp - 0x30], 0x80000000
mov rcx, qword [rsi]
jne 0x140003a09
lea rdx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x140003a1b
mov r9d, 2
lea r8, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rbp - 0x30]
mov ecx, dword [rbp - 0x2c]
mov dword [r14 + 0x50], eax
mov eax, dword [rbp - 0x24]
sub eax, ecx
jns 0x140003a2e
inc eax
sar eax, 1
mov r8d, 1
add eax, 2
add eax, ecx
mov dword [r14 + 0x54], eax
movzx ecx, byte [rsi + 8]
sub ecx, 9
je 0x140003ad7
sub ecx, 1
je 0x140003ab3
cmp ecx, 1
jne 0x140003ae4
cmp dword [r14 + 0x44], 1
mov rcx, qword [rsi]
jne 0x140003a82
xor r9d, r9d
mov edx, 0x110a
mov r8d, 9
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, eax
mov qword [rsp + 0x50], r15
jmp 0x140003ae9
mov rax, qword [rbp - 0x74]
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, qword [rsi]
lea r9, [rbp + 0x10]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, eax
mov qword [rsp + 0x50], r15
jmp 0x140003ae9
mov r9, r8
mov edx, 0x100c
mov r8, 0xffffffffffffffff
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_SendMessageW]
inc eax
movsxd r15, eax
mov qword [rsp + 0x50], r15
jmp 0x140003ae9
xor r9d, r9d
mov edx, OleCreatePictureIndirect
xor r8d, r8d
jmp 0x140003ac2
mov r15, qword [rsp + 0x50]
mov rcx, qword [r13 + 8]
lea rdx, [rbp + 0xa8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0xa8]
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0xac]
sub dword [r14 + 0x54], eax
movsxd r8, edi
shl r8, 5
test rsi, rsi
je 0x140003b1f
mov rdx, qword [rsi]
jmp 0x140003b26
lea rdx, [0x1400f97e4]
lea ecx, [rdi + 1]
xor r9d, r9d
lea edi, [rcx + 1]
test rsi, rsi
mov eax, r9d
setne al
mov dword [rbp + r8 + 0xe0], eax
mov qword [rbp + r8 + 0xd0], rdx
mov r8d, 1
movsxd rax, ecx
mov ecx, r9d
shl rax, 5
movsxd rdx, edi
inc edi
shl rdx, 5
mov dword [rbp + rax + 0xe0], r8d
mov qword [rbp + rax + 0xd0], r15
mov eax, dword [r14 + 0x44]
cmp eax, 3
mov dword [rbp + rdx + 0xe0], r8d
sete cl
mov qword [rbp + rdx + 0xd0], rcx
movsxd rax, dword [r14 + 0x50]
movsxd rcx, edi
inc edi
shl rcx, 5
mov dword [rbp + rcx + 0xe0], r8d
mov qword [rbp + rcx + 0xd0], rax
movsxd rax, dword [r14 + 0x54]
movsxd rcx, edi
shl rcx, 5
inc edi
mov dword [rsp + 0x48], edi
mov dword [rbp + rcx + 0xe0], r8d
mov qword [rbp + rcx + 0xd0], rax
mov ecx, dword [rsp + 0x64]
jmp 0x140003df1
mov r15, qword [rsp + 0x50]
mov dword [r14 + 0x44], r8d
cmp ecx, 8
jne 0x140003dee
mov edx, dword [rbp - 0x20]
movsxd rax, edi
inc edi
mov dword [rsp + 0x48], edi
mov ecx, dword [rsp + 0x48]
shl rax, 5
inc ecx
mov dword [r14 + 0x50], edx
movsxd rdi, edi
shl rdi, 5
mov dword [rbp + rax + 0xe0], r8d
mov qword [rbp + rax + 0xd0], r15
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x48], ecx
movzx eax, dx
je 0x140003c47
mov r8d, dword [0x140136040]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [rsp + 0x48]
mov r8d, 1
mov edx, dword [rbp - 0x20]
cdqe
mov qword [rbp + rdi + 0xd0], rax
mov eax, edx
mov dword [rbp + rdi + 0xe0], r8d
movsxd rdi, ecx
inc ecx
shl rdi, 5
shr eax, 0x10
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x48], ecx
je 0x140003dd4
mov r8d, dword [0x140136040]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, 1
jmp 0x140003dd4
mov dword [r14 + 0x44], 5
lea rdx, [rbp + 0xb8]
mov rax, qword [rbp - 0x74]
mov qword [r14 + 0x50], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0xb8]
mov edx, 0xffffffec
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0xbc]
sub dword [r14 + 0x54], eax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
and eax, 0xffffffef
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
movsxd rdi, edi
mov rcx, r12
shl rdi, 5
call fcn.1400aaab0
mov dword [rbp + rdi + 0xe0], 6
lea r9, [rbp + 0xd0]
mov qword [rbp + rdi + 0xd0], rax
test rsi, rsi
je 0x140003d2a
mov rdx, qword [rsi]
mov r8d, 1
jmp 0x140003d36
xor eax, eax
lea rdx, [0x1400f97e4]
mov r8d, eax
mov r11d, dword [rsp + 0x48]
lea eax, [r11 + 1]
movsxd rcx, eax
lea eax, [r11 + 2]
shl rcx, 5
lea r15d, [rax + 1]
movsxd rdi, eax
shl rdi, 5
mov dword [rcx + r9 + 0x10], r8d
mov qword [rcx + r9], rdx
cmp byte [r13 + 0x110], 0
mov eax, dword [r14 + 0x50]
je 0x140003d80
mov r8d, dword [0x140136040]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
cdqe
mov r8d, 1
mov dword [rbp + rdi + 0xe0], r8d
mov qword [rbp + rdi + 0xd0], rax
mov eax, dword [r14 + 0x54]
movsxd rdi, r15d
inc r15d
shl rdi, 5
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x48], r15d
je 0x140003dcf
mov r8d, dword [0x140136040]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, 1
mov r15, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x64]
mov dword [rbp + rdi + 0xe0], r8d
cdqe
mov qword [rbp + rdi + 0xd0], rax
mov edi, dword [rsp + 0x48]
xor r9d, r9d
cmp byte [rsp + 0x44], 0
je 0x140003f86
cmp byte [rsi + 8], 0x17
jne 0x140003f86
xor edx, edx
lea rcx, [rbp + 0x2e8]
mov r8d, 0x10b0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsi]
lea eax, [r15 - 1]
lea r9, [rbp + 0x2e0]
mov dword [rbp + 0x2e4], eax
xor r8d, r8d
mov dword [rbp + 0x2e0], ntohs
mov edx, 0x703
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140003feb
cmp word [rbp + 0x350], 0
lea rax, [rbp + 0x2f0]
mov rcx, qword [0x140132a80]
lea rdx, [rbp + 0x350]
cmove rdx, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8, 0xffffffffffffffff
call fcn.1400dc860
movsxd rsi, edi
inc edi
mov dword [rsp + 0x48], edi
mov rdi, qword [0x140132a80]
shl rsi, 5
cmp byte [rdi + 0x23], 0
jne 0x140003ea2
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x140003eb0
mov rcx, rdi
call fcn.140001640
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x140003ee0
test byte [rdi + 0x21], 4
je 0x140003ec6
mov rdx, rdi
call fcn.140065660
mov rcx, qword [rdi + 8]
xor eax, eax
mov dword [rbp + rsi + 0xe0], eax
mov qword [rbp + rsi + 0xd0], rcx
jmp 0x140003feb
cmp al, 2
jne 0x140003f6c
mov rcx, qword [0x140136d00]
test rcx, rcx
jne 0x140003f73
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140003f38
mov ecx, reloc.WSOCK32.dll_ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rcx, [0x1400f97e4]
lea rax, [0x1400f97d8]
cmovne rcx, rax
xor eax, eax
mov dword [rbp + rsi + 0xe0], eax
mov qword [rbp + rsi + 0xd0], rcx
jmp 0x140003feb
xor edx, edx
call fcn.1400073b0
mov edx, 0xffffffff
lea rcx, [0x1400f97e4]
cmp rax, rdx
cmovne rcx, qword [0x140136cf8]
xor eax, eax
mov dword [rbp + rsi + 0xe0], eax
mov qword [rbp + rsi + 0xd0], rcx
jmp 0x140003feb
lea rcx, [0x140132e14]
xor eax, eax
mov qword [rbp + rsi + 0xd0], rcx
mov dword [rbp + rsi + 0xe0], eax
jmp 0x140003feb
cmp word [rbp + 0x70], 0
je 0x140003fae
movsxd rax, edi
lea rdx, [rbp + 0x70]
shl rax, 5
inc edi
mov dword [rsp + 0x48], edi
mov dword [rbp + rax + 0xe0], r9d
mov qword [rbp + rax + 0xd0], rdx
cmp ecx, 8
je 0x140003fd9
cmp ecx, 5
je 0x140003fd9
mov rcx, qword [0x140132a80]
lea rdx, [rbp + 0x70]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
call fcn.1400dc860
jmp 0x140003feb
mov rcx, qword [0x140132a80]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, r15
call fcn.1400015a0
mov rax, qword [r13 + 8]
mov rsi, qword [rbp - 0x10]
mov qword [r14 + 0xf8], rax
add dword [r13 + 0x34], 2
mov eax, dword [rbp - 0x1c]
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x58], r13
mov dword [r14 + 0x70], eax
mov qword [r14 + 0x48], r15
movzx r14d, byte [rsp + 0x44]
test rsi, rsi
je 0x140004106
mov byte [rsi], 1
mov rdi, qword [rbp - 0x60]
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319b0]
jne 0x140004044
call fcn.140007bf0
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319a0]
jb 0x14000405e
mov rax, qword [0x140136730]
mov qword [rcx], rax
mov rcx, qword [0x1401319a8]
mov r11d, dword [rsp + 0x48]
lea rax, [0x1400f97f8]
add rcx, 0x18
lea r9, [rbp + 0xd0]
mov qword [0x1401319a8], rcx
lea r8, str.call
xor r15d, r15d
mov rdx, rbx
mov dword [rsp + 0x30], r15d
mov qword [rcx + 8], rax
lea rax, [rbp + 0x90]
mov qword [rcx], r15
mov dword [rcx + 0x10], r15d
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r11d
call fcn.1400c07e0
sub qword [0x1401319a8], 0x18
cmp qword [r13 + 8], r15
je 0x14000416b
mov edx, dword [rsp + 0x64]
test rsi, rsi
je 0x14000411c
mov byte [rsi], r15b
cmp edx, 6
jne 0x140004125
cmp qword [rbp + 0x90], r15
jne 0x14000416b
mov rcx, rbx
call fcn.1400c4a80
test eax, eax
jne 0x1400040f3
test rbx, rbx
jne 0x14000416b
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x14000416b
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14000416b
test r14b, r14b
je 0x140004024
mov rdi, qword [rbp - 0x60]
or byte [rdi + 9], 4
jmp 0x140004028
test r14b, r14b
je 0x140004125
and byte [rdi + 9], 0xfb
cmp edx, 5
jne 0x14000416b
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
mov qword [r13 + 0xa0], r15
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
or eax, 0x10
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
sub dword [r13 + 0x34], 1
jne 0x1400047ee
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 0x130
mov rcx, r13
call fcn.1400f60d0
jmp 0x1400047ee
test r13, r13
je 0x1400041b7
mov rax, qword [r13 + 8]
mov qword [r14 + 0xf8], rax
mov dword [r14 + 0x44], 1
add dword [r13 + 0x34], 2
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x58], r13
lea rax, [0x140136748]
mov dword [rbp + 0x20], edi
lea rcx, [0x140136060]
mov qword [rbp + 0x10], rax
call fcn.140081370
mov dword [rbp + 0x60], edi
lea ecx, [rax + 1]
mov eax, 1
mov qword [rbp + 0x30], rcx
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319b0]
mov dword [rbp + 0x40], eax
lea rax, [0x140136952]
mov qword [rbp + 0x50], rax
jne 0x14000420a
call fcn.140007bf0
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319a0]
jb 0x140004224
mov rax, qword [0x140136730]
mov qword [rcx], rax
mov rcx, qword [0x1401319a8]
add rcx, 0x18
mov dword [rsp + 0x30], edi
mov qword [0x1401319a8], rcx
lea rax, str.Menu
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x10]
lea r8, str.call
mov dword [rsp + 0x20], 3
mov qword [rcx], rdi
mov rdx, rbx
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edi
mov rcx, rbx
call fcn.1400c07e0
sub qword [0x1401319a8], 0x18
test r13, r13
je 0x1400047ee
mov eax, 0xffffffff
add dword [r13 + 0x34], eax
jmp 0x140004170
mov rax, qword [rbp - 0x50]
mov rdi, qword [rbp + 8]
mov qword [r14 + 0xf8], rax
movzx eax, byte [rdi + 0x35]
mov byte [r14 + 0x136], al
mov r9, qword [rdi]
mov rcx, r9
call fcn.1400c4a80
test eax, eax
je 0x1400042b4
cmp eax, 1
jne 0x1400042c7
mov ecx, reloc.WSOCK32.dll_recv
mov rcx, qword [rcx + r9]
test rcx, rcx
je 0x1400042c7
movzx ecx, byte [rcx]
jmp 0x1400042c9
xor cl, cl
movzx eax, byte [rdi + 0x39]
cmp byte [rdi + 0x38], al
jb 0x1400042ec
add cl, 0x32
cmp cl, 0x14
ja 0x1400047ee
mov eax, 0x10fc01
bt eax, ecx
jae 0x1400047ee
mov byte [0x140136c0e], 0
xor esi, esi
inc byte [rdi + 0x38]
xor r9d, r9d
mov rdx, qword [0x140136b60]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call fcn.1400c49c0
dec byte [rdi + 0x38]
jmp 0x1400047f0
call qword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x140004350
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140004349
mov ecx, reloc.WSOCK32.dll_ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140004349
mov edx, 2
jmp 0x140004353
mov edx, 1
jmp 0x140004353
mov rdx, rdi
mov rcx, qword [0x140132a80]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [r14 + 0x48], rdx
call fcn.1400015a0
mov rax, qword [r14 + 0x48]
mov ebx, 1
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319b0]
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x10], rax
mov byte [0x140136bd0], bl
jne 0x140004398
call fcn.140007bf0
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319a0]
jb 0x1400043b2
mov rax, qword [0x140136730]
mov qword [rcx], rax
mov rcx, qword [0x1401319a8]
add rcx, 0x18
lea rax, [0x1400f9868]
mov qword [0x1401319a8], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edi
mov rax, qword [0x140136bb8]
test rax, rax
je 0x1400043e9
mov rcx, rax
call fcn.1400018a0
mov rax, qword [0x140136bb8]
cmp qword [rsp + 0x78], rdi
jne 0x14000440d
test rax, rax
lea rdx, [rbp + 0x10]
mov r9d, edi
lea rcx, [0x140136b88]
sete r9b
mov r8d, ebx
call fcn.1400c4bc0
sub qword [0x1401319a8], 0x18
mov byte [0x140136bd0], dil
jmp 0x1400047ee
mov rdi, qword [rbp - 0x58]
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319b0]
mov dword [rbp + 0x20], 6
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x10], rax
jne 0x140004450
call fcn.140007bf0
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319a0]
jb 0x14000446a
mov rax, qword [0x140136730]
mov qword [rcx], rax
mov rcx, qword [0x1401319a8]
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x1401319a8], rcx
lea r9, [rbp + 0x10]
xor esi, esi
lea r8, str.call
mov dword [rsp + 0x30], esi
mov rdx, rbx
mov qword [rcx], rsi
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], esi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 1
call fcn.1400c07e0
sub qword [0x1401319a8], 0x18
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x1400047f0
mov rcx, qword [rbp - 0x80]
mov edx, 1
mov rax, qword [rbp - 0x58]
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], edx
mov dword [rbp + 0x60], edx
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
movzx eax, cl
sar rcx, 0x10
mov qword [rbp + 0x30], rax
movzx eax, cx
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319b0]
mov qword [rbp + 0x50], rax
jne 0x140004516
call fcn.140007bf0
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319a0]
jb 0x140004530
mov rax, qword [0x140136730]
mov qword [rcx], rax
mov rcx, qword [0x1401319a8]
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 3
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x1401319a8], rcx
lea r8, str.call
mov rdx, rbx
mov dword [rcx + 0x10], edi
mov qword [rcx + 8], rax
mov qword [rcx], rdi
mov rcx, rbx
call fcn.1400c07e0
sub qword [0x1401319a8], 0x18
jmp 0x1400047ee
mov rax, qword [rbp - 0x80]
mov rcx, qword [0x1401319a8]
mov word [rbp - 0x18], ax
sar rax, 0x10
cmp rcx, qword [0x1401319b0]
mov word [rbp - 0x16], ax
mov rax, qword [rbp - 0x58]
mov word [rbp - 0x14], di
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], edi
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x30], rax
jne 0x1400045ce
call fcn.140007bf0
mov rcx, qword [0x1401319a8]
cmp rcx, qword [0x1401319a0]
jb 0x1400045e8
mov rax, qword [0x140136730]
mov qword [rcx], rax
mov rcx, qword [0x1401319a8]
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
jmp 0x140004545
mov rax, qword [rbp - 8]
movzx eax, byte [rax + 0x10]
add al, 0x64
cmp al, 3
ja 0x140004617
mov eax, dword [rbp - 0x80]
mov qword [r14 + 0x48], rax
cmp byte [0x140138664], dil
mov rax, qword [rbp - 0x50]
mov r15, qword [rbp - 0x38]
mov qword [r14 + 0xf8], rax
movzx eax, byte [r15 + 0x24]
mov byte [r14 + 0x136], al
jne 0x1400047ee
cmp dword [0x140133b20], edi
jne 0x140004653
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140133b20], eax
inc dword [0x140138660]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [0x140138660]
mov ecx, eax
sub ecx, dword [0x140133b20]
cmp r9d, dword [0x140130c7c]
mov edx, dword [0x140130c78]
mov dword [0x140133b1c], eax
jbe 0x140004690
cmp ecx, edx
jae 0x140004690
mov esi, 1
mov ebx, esi
jmp 0x140004697
mov ebx, edi
mov esi, 1
test ebx, ebx
je 0x14000476a
mov dword [rsp + 0x20], ecx
lea r8, str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea rcx, [rbp + 0x2e0]
mov edx, 0x800
call fcn.1400d6690
movzx edx, word [0x140132e04]
mov r9d, edi
cmp di, dx
jae 0x140004713
mov r8, rdi
nop dword [rax]
mov rax, qword [0x140133b08]
mov rcx, qword [rax + r8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x140004704
nop dword [rax]
nop dword [rax + rax]
mov byte [rax + 0x27], dil
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400046f0
movzx edx, word [0x140132e04]
inc r9d
movzx eax, dx
add r8, 8
cmp r9d, eax
jl 0x1400046d0
movaps xmm3, xmm6
mov byte [0x140138664], 1
xor r8d, r8d
mov dword [0x14012f234], edi
mov edx, 4
mov qword [rsp + 0x20], rdi
lea rcx, [rbp + 0x2e0]
call fcn.1400def40
cmp eax, 7
jne 0x140004755
xor r8d, r8d
lea rcx, [0x140136060]
mov edx, 4
call fcn.14003a320
mov eax, dword [0x140133b1c]
mov dword [0x14012f234], esi
mov byte [0x140138664], dil
jmp 0x14000476e
cmp ecx, edx
jbe 0x14000477e
mov dword [0x140138660], edi
mov dword [0x140133b20], eax
test ebx, ebx
jne 0x1400047ee
mov r14, qword [rbp - 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, r15
movzx eax, byte [r14 + 0xf]
mov byte [0x140136c0e], al
inc byte [r15 + 0x22]
mov rdx, qword [0x140136b60]
call fcn.1400c49c0
dec byte [r15 + 0x22]
test eax, eax
jne 0x1400047b9
mov byte [r15 + 0x27], dil
jmp 0x1400047ee
cmp byte [r15 + 0x27], dil
je 0x1400047ee
mov byte [r15 + 0x27], dil
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [r15 + 0x18]
cmp eax, 0x3e8
ja 0x1400047ee
movzx r8d, word [r14 + 4]
xor r9d, r9d
mov rcx, qword [0x140132ab0]
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
lea rcx, [rbp + 0x1e0]
call fcn.140005820
cmp dword [rbp + 0x1408], 0
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, r14
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
je 0x140001cc0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r15b, r15b
jne 0x14000484e
movsxd r14, dword [rbp + 0x1400]
mov ecx, dword [rbp - 0x48]
mov r12, r14
sub ecx, eax
add ecx, r14d
cmp ecx, 5
jg 0x140001cc0
jmp 0x140004855
mov r14d, dword [rbp + 0x1400]
movsxd r12, r14d
cmp r12, 0xffffffffffffffff
jle 0x14000486b
mov qword [0x140136c50], rsi
mov dword [0x140136c60], eax
mov dil, 1
mov dword [0x140136c64], eax
mov byte [rbp + 0x1410], dil
movzx r15d, dil
mov byte [rbp + 0x1418], dil
jmp 0x140001cbb
mov rcx, qword [0x14012f240]
mov byte [rcx + 0x128], 0
jmp 0x1400048a2
mov rcx, qword [0x14012f240]
mov rdx, qword [0x140132a68]
test rdx, rdx
je 0x1400048ec
mov rcx, qword [0x140132ab0]
lea r8, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
movsxd r14, dword [rbp + 0x1400]
movzx r15d, byte [rbp + 0x1418]
mov r12, r14
mov ebx, dword [rsp + 0x40]
movzx edi, byte [rbp + 0x1410]
test eax, eax
jne 0x140001cc0
mov rcx, qword [0x14012f240]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rax, qword [0x14012f240]
mov byte [rax + 0x128], 0
jmp 0x1400023c2
cmp rsi, 0xffffffffffffffff
jle 0x140004939
mov qword [0x140136c50], rdi
mov dword [0x140136c60], eax
cmp byte [rsp + 0x4c], 0
mov dword [0x140136c64], eax
je 0x14000494d
mov byte [0x1401328bf], 0
cmp byte [rsp + 0x4d], 0
je 0x1400049a0
mov eax, dword [0x140132ab8]
dec eax
mov dword [0x140132ab8], eax
test r14d, r14d
jle 0x1400049a0
test eax, eax
jne 0x1400049a0
cmp dword [0x140136bec], eax
jne 0x1400049a0
cmp dword [0x140133b04], eax
jne 0x1400049a0
cmp byte [0x1401328be], al
je 0x1400049a0
mov rcx, qword [0x140132ab0]
mov edx, 9
call qword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x1400049a0
mov byte [0x1401328be], 0
movzx eax, byte [rbp - 0x68]
jmp 0x140002ac6