Function at 0x14003d948
Capabilities:
Check for time delay via gettickcount
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x4288
call fcn.140112470
sub rsp, rax
mov r12, rcx
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
xor ebx, ebx
mov r13d, 1
mov eax, r13d
mov dword [rsp + 0x30], 0xfffffff6
mov byte [rsp + 0x42e0], bl
mov byte [rsp + 0x42e8], bl
mov dil, bl
mov r14d, ebx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x4c], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x42d8]
mov dword [rsp + 0x64], eax
lea r11d, [r13 + 0x2c]
mov dword [rsp + 0x48], 0x3e8
cmp r11w, word [rcx]
mov dl, byte [rcx]
lea r10d, [r13 + 0x29]
mov bpl, bl
mov r15b, bl
movzx esi, r10b
lea eax, [rbx + 0x41]
lea r9d, [r13 + 0x27]
cmove esi, r11d
lea r8d, [r13 + 8]
mov dword [rsp + 0xb0], 4
cmp sil, dl
jne 0x14003dd70
lea r8, [rcx + 2]
cmp word [r8], ax
jb 0x14003dd41
cmp r10w, word [r8]
je 0x14003dd41
mov eax, 0x30
cmp word [r8], ax
jb 0x14003da2e
cmp word [r8], 0x39
jbe 0x14003dd41
cmp r9w, word [r8]
je 0x14003dd41
cmp dl, r11b
jne 0x14003da53
mov al, byte [r8]
or al, 0x20
cmp al, 0x63
jne 0x14003da53
mov al, byte [rcx + 4]
or al, 0x20
cmp al, 0x6d
je 0x14003dd41
cmp dl, r10b
jne 0x14003da87
cmp word [r8], bx
je 0x14003dd41
mov eax, 9
cmp ax, word [r8]
ja 0x14003da78
cmp word [r8], 0xd
jbe 0x14003dd41
mov eax, 0x20
cmp ax, word [r8]
je 0x14003dd41
mov qword [rsp + 0x42d8], r8
lea rdx, [rsp + 0x42d8]
lea rcx, [0x14011b53c]
mov r8d, 3
call fcn.1400640d4
cmp al, bl
je 0x14003dab5
mov r15b, r13b
jmp 0x14003dd1a
lea rdx, [rsp + 0x42d8]
lea rcx, str.InitSys
mov r8d, 8
call fcn.1400640d4
cmp al, bl
je 0x14003dae0
mov byte [rsp + 0x42e8], r13b
jmp 0x14003dd1a
lea rdx, [rsp + 0x42d8]
lea rcx, [0x140116b8c]
mov r8d, 3
call fcn.1400640d4
cmp al, bl
je 0x14003db06
mov bpl, r13b
jmp 0x14003dd1a
lea rdx, [rsp + 0x42d8]
lea rcx, str.sys0
mov r8d, 4
call fcn.1400640d4
cmp al, bl
je 0x14003db31
mov eax, 0x41
mov bpl, al
jmp 0x14003dd1f
lea rdx, [rsp + 0x42d8]
lea rcx, str.syscmd
mov r8d, 6
call fcn.1400640d4
cmp al, bl
je 0x14003db57
mov bpl, 0x10
jmp 0x14003dd1a
lea rdx, [rsp + 0x42d8]
lea rcx, str.sys0cmd
mov r8d, 7
call fcn.1400640d4
cmp al, bl
je 0x14003db7d
mov bpl, 0x50
jmp 0x14003dd1a
lea rdx, [rsp + 0x42d8]
lea rcx, str.cont
mov r8d, 4
call fcn.1400640d4
cmp al, bl
je 0x14003dba6
mov r14d, 0x10000
jmp 0x14003dd1a
mov rdx, qword [rsp + 0x42d8]
lea rcx, str.scan:
mov r8d, 5
call fcn.14005a82c
cmp al, bl
je 0x14003dbe4
add qword [rsp + 0x42d8], 0xa
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x42d8]
call fcn.1400717bc
jmp 0x14003dd1a
lea rdx, [rsp + 0x42d8]
lea rcx, str.scanall
mov r8d, 7
call fcn.1400640d4
cmp al, bl
je 0x14003dc0f
mov dword [rsp + 0x30], 0x1000
jmp 0x14003dd1a
lea rdx, [rsp + 0x42d8]
lea rcx, [0x14011a4b4]
mov r8d, 3
call fcn.1400640d4
cmp al, bl
je 0x14003dc3a
mov dword [rsp + 0x4c], 0x40
jmp 0x14003dd1a
lea rdx, [rsp + 0x42d8]
lea rcx, str.freemem
mov r8d, 7
call fcn.1400640d4
cmp al, bl
je 0x14003dc7b
mov cl, r13b
call fcn.14005b588
mov rcx, qword [rsp + 0x42d8]
cmp word [rcx], bx
je 0x14003e443
mov eax, 0x41
jmp 0x14003dd27
lea rdx, [rsp + 0x42d8]
lea rcx, [0x1401197e8]
mov r8d, 6
call fcn.1400640d4
cmp al, bl
je 0x14003dc9e
mov dil, r13b
jmp 0x14003dd1a
mov rdx, qword [rsp + 0x42d8]
lea rcx, str.cur:
mov r8d, 4
call fcn.14005a82c
cmp al, bl
je 0x14003dccf
add qword [rsp + 0x42d8], 8
lea rdx, [rsp + 0x64]
jmp 0x14003dbd2
mov rcx, qword [rsp + 0x42d8]
movzx eax, word [rcx]
cmp ax, bx
je 0x14003dd0d
mov edx, 9
lea r8d, [rdx + 0x17]
cmp dx, ax
ja 0x14003dcf3
cmp ax, 0xd
jbe 0x14003dd0d
cmp r8w, ax
je 0x14003dd0d
add rcx, 2
mov qword [rsp + 0x42d8], rcx
mov ax, word [rcx]
cmp ax, bx
jne 0x14003dce8
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
mov eax, 0x41
mov rcx, qword [rsp + 0x42d8]
mov dl, byte [rcx]
mov r9d, 0x28
lea r11d, [r9 + 5]
cmp sil, dl
jne 0x14003dd41
lea r10d, [r9 + 2]
jmp 0x14003da00
cmp dil, bl
je 0x14003dd6a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x1401357a0]
cmp eax, dword [0x140134cb4]
setne bl
mov edx, ebx
call fcn.14001b938
cdqe
jmp 0x14003ec77
mov r8d, 9
cmp byte [rcx], r11b
jne 0x14003dddd
cmp byte [rcx + 2], r11b
jne 0x14003dddd
movzx eax, word [rcx + 4]
cmp ax, bx
je 0x14003dd9c
cmp r8w, ax
ja 0x14003dd90
cmp ax, 0xd
jbe 0x14003dd9c
mov edx, 0x20
cmp dx, ax
jne 0x14003dddd
jmp 0x14003ddc0
mov edx, 0x20
jmp 0x14003ddc0
cmp r8w, ax
ja 0x14003ddaf
cmp ax, 0xd
jbe 0x14003ddc8
cmp dx, ax
je 0x14003ddc8
add rcx, 2
mov qword [rsp + 0x42d8], rcx
movzx eax, word [rcx]
cmp ax, bx
jne 0x14003dda3
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
mov rcx, qword [rsp + 0x42d8]
cmp bpl, bl
je 0x14003df40
lea rcx, [0x140136118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, str.GlobalPECMD:main:lock
lea rcx, [rsp + 0xf8]
call fcn.14001747c
movzx edi, bpl
and edi, 0x40
mov ecx, edi
call fcn.14001aa48
mov rsi, rax
cmp rax, rbx
jne 0x14003de2a
mov edx, edi
mov rcx, r12
call fcn.140022fd4
mov rsi, rax
cmp rsi, rbx
je 0x14003df1b
mov rcx, qword [rsp + 0x42d8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x58]
movsxd rdi, eax
lea rdx, [rdi + 0x75]
call fcn.14006170c
mov rax, qword [rsp + 0x58]
mov word [rax], bx
test bpl, 0x10
jne 0x14003de77
mov r8d, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x58]
lea rdx, str.THREAD_WAIT__cur:_lu
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x42d8]
lea r8d, [rdi + 0x11]
movsxd rcx, eax
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rcx*2]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rbx, 0xffffffff80000002
lea r8, str.HOTKEY9000000
movsxd rcx, eax
lea rdx, str.SOFTWAREPELOGONRAMDATAHOTKEY
mov r9d, r13d
lea eax, [rcx + rcx]
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [0x1401353b0]
xor r9d, r9d
mov edx, 0x312
mov r8d, 0x895440
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, str.HOTKEY9000000
lea rdx, str.SOFTWAREPELOGONRAMDATAHOTKEY
mov rcx, rbx
mov r13d, eax
call qword [0x1401353b8]
lea rcx, [rsp + 0x58]
call fcn.1400591f8
lea rcx, [rsp + 0xf8]
movsxd rbx, r13d
call fcn.1400174c4
lea rcx, [0x140136118]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
jmp 0x14003ec77
cmp dword [rsp + 0x30], ebx
jl 0x14003e059
lea rcx, [rsp + 0xa0]
lea r12, str.PressKey
call fcn.140061698
mov r11, qword [rsp + 0x42d8]
cmp word [r11], bx
je 0x14003df8f
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x42d8]
mov r8d, 0x2c
call fcn.140065568
mov r12, qword [rsp + 0xa0]
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x170], bl
call fcn.1400fae60
lea rcx, [rsp + 0x170]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov ebp, 0x100
mov word [rsp + 0x270], bx
cmp dword [rsp + 0x30], ebp
jae 0x14003dff1
movsxd rax, dword [rsp + 0x30]
lea rdx, [0x14011b490]
lea rcx, [rsp + 0x270]
movzx r8d, byte [rsp + rax + 0x170]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14003e021
lea rdi, [rsp + 0x170]
lea rsi, [rsp + 0x270]
movzx r8d, byte [rdi]
lea rdx, [0x14011b490]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
add rsi, 0xa
add rdi, r13
sub rbp, r13
jne 0x14003e001
mov rdi, qword [rsp + 0x42d0]
lea r8, [rsp + 0x270]
mov rdx, r12
mov rcx, rdi
mov word [rsp + 0xc6e], bx
call fcn.140060abc
lea rcx, [rsp + 0xa0]
call fcn.1400591f8
mov r15d, ebx
jmp 0x14003ec42
mov esi, 0x80000000
mov edi, 0xfffffc18
mov r8d, 0x64
cmp r11w, word [rcx]
jne 0x14003e0ab
lea rdx, [rcx + 2]
movzx eax, word [rdx]
or ax, 0x20
cmp ax, 0x63
je 0x14003e0ab
cmp ax, r8w
je 0x14003e0ab
lea rcx, [rsp + 0x42d8]
mov qword [rsp + 0x42d8], rdx
mov byte [rsp + 0x42e0], r13b
call fcn.140016e2c
mov rcx, qword [rsp + 0x42d8]
mov eax, 0x3d
cmp ax, word [rcx]
jne 0x14003e0c6
mov bpl, byte [rcx]
add rcx, 2
mov qword [rsp + 0x42d8], rcx
jmp 0x14003e0c9
mov bpl, bl
movzx eax, word [rcx]
mov r12d, 9
sub ax, 0x30
cmp ax, r12w
ja 0x14003e1ef
movsd xmm0, qword [0x14011b488]
mov qword [rsp + 0xc8], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xc8]
mov dword [rsp + 0x60], esi
movsd qword [rsp + 0xe8], xmm0
call fcn.1400717bc
mov r11, qword [rsp + 0x42d8]
cmp r11, qword [rsp + 0xc8]
jae 0x14003e14f
lea eax, [r12 + 0x17]
cmp r12w, word [r11]
ja 0x14003e133
cmp word [r11], 0xd
jbe 0x14003e14f
cmp ax, word [r11]
je 0x14003e14f
add r11, 2
mov qword [rsp + 0x42d8], r11
cmp r11, qword [rsp + 0xc8]
jb 0x14003e126
cmp dword [rsp + 0x60], ebx
jl 0x14003e1a9
mov esi, dword [rsp + 0x60]
mov eax, 0x2e
cmp ax, word [r11]
jne 0x14003e1a9
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x42d8]
call fcn.1400659b0
movsd xmm5, qword [rsp + 0xe8]
comisd xmm5, xmmword [0x140119a80]
jb 0x14003e27c
addsd xmm5, qword [0x14011b480]
mulsd xmm5, qword [0x14011b478]
cvttsd2si edi, xmm5
jmp 0x14003e27c
movzx eax, word [r11]
cmp ax, bx
je 0x14003e1dd
mov ecx, 0x20
cmp r12w, ax
ja 0x14003e1c3
cmp ax, 0xd
jbe 0x14003e1dd
cmp cx, ax
je 0x14003e1dd
add r11, 2
mov qword [rsp + 0x42d8], r11
mov ax, word [r11]
cmp ax, bx
jne 0x14003e1b7
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
jmp 0x14003e27c
cmp r9w, word [rcx]
jne 0x14003e284
movsd xmm0, qword [0x14011b488]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x42d8]
movsd qword [rsp + 0xd8], xmm0
call fcn.1400cba7c
cmp eax, ebx
jle 0x14003e27c
movsd xmm1, qword [rsp + 0xd8]
xorpd xmm2, xmm2
comisd xmm1, xmm2
jb 0x14003e27c
addsd xmm1, qword [0x14011b480]
pxor xmm0, xmm0
cvttsd2si rax, xmm1
cvttsd2si esi, xmm1
cvtsi2sd xmm0, rax
subsd xmm2, xmm0
addsd xmm1, xmm2
comisd xmm1, xmmword [0x14011b470]
jbe 0x14003e27c
movsd xmm0, qword [0x14011b468]
comisd xmm0, xmm1
jbe 0x14003e27c
mulsd xmm1, qword [0x14011b478]
cvttsd2si edi, xmm1
mov rcx, qword [rsp + 0x42d8]
mov eax, 0x2a
cmp ax, word [rcx]
je 0x14003e4a2
cmp esi, 0x80000000
jne 0x14003e2a2
cmp edi, ebx
jl 0x14003e4a2
lea rcx, [rsp + 0x70]
mov word [rsp + 0x102], bx
mov word [rsp + 0x100], bx
lea r12, str.PressKey
call fcn.140061698
mov rax, qword [rsp + 0x42d8]
mov r8d, 0x2c
cmp r8w, word [rax]
jne 0x14003e301
add rax, 2
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x42d8]
mov qword [rsp + 0x42d8], rax
call fcn.140065568
mov rax, qword [rsp + 0x70]
cmp word [rax], bx
cmovne r12, rax
cmp bpl, bl
jne 0x14003e413
mov al, byte [rsp + 0x42e0]
cmp al, bl
jne 0x14003e325
cmp esi, ebx
jne 0x14003e415
cmp edi, ebx
jg 0x14003e44a
cmp esi, ebx
jne 0x14003e332
mov edx, 2
cmp al, bl
je 0x14003e335
mov edx, r13d
or edx, r14d
mov ecx, esi
call fcn.140025870
mov ebp, 9
mov r13d, eax
lea esi, [rbp + 0x27]
mov qword [rsp + 0x38], r13
cmp r15b, bl
jne 0x14003e363
add eax, 0xffffffa0
cmp eax, ebp
ja 0x14003e363
sub r13d, esi
mov qword [rsp + 0x38], r13
cmp r13d, ebx
jle 0x14003e380
lea rdx, str.0x_X
lea rcx, [rsp + 0x100]
mov r8d, r13d
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdi, qword [rsp + 0x42d0]
lea rax, [0x14011b460]
lea r8, [rsp + 0x100]
cmp r13d, ebx
lea rdx, str.PressKey.Hex
mov rcx, rdi
cmovle r8, rax
call fcn.140060abc
cmp r13d, ebx
jle 0x14003e3f8
cmp r13d, 0x41
jl 0x14003e3be
cmp r13d, 0x5a
jle 0x14003e3ca
movzx eax, r13w
sub ax, si
cmp ax, bp
ja 0x14003e3e0
movsx eax, r13b
mov word [rsp + 0x102], bx
mov word [rsp + 0x100], ax
jmp 0x14003e3f8
lea rdx, str.0x_X
lea rcx, [rsp + 0x100]
mov r8d, r13d
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x100]
mov rdx, r12
mov rcx, rdi
call fcn.140060abc
mov r13d, 1
jmp 0x14003e472
cmp esi, ebx
jl 0x14003e472
cmp bpl, bl
je 0x14003e44a
mov eax, ebx
mov ecx, esi
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rsp + 0x42d8]
cmp word [r11], bx
jne 0x14003e472
lea rcx, [rsp + 0x70]
call fcn.1400591f8
xor eax, eax
jmp 0x14003ec77
mov rcx, qword [rsp + 0x42d0]
cmp edi, ebx
mov r8d, ebx
cmovg r8d, edi
cmp esi, ebx
mov eax, ebx
cmovg eax, esi
xor r9d, r9d
movsxd rdx, eax
call fcn.1400192e0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
lea rcx, [rsp + 0x70]
mov esi, 0x80000000
mov byte [rsp + 0x42e0], bl
call fcn.1400591f8
mov rcx, qword [rsp + 0x42d8]
mov eax, 0x2a
cmp word [rcx], bx
je 0x14003ec35
mov qword [rsp + 0x40], rbx
or edi, 0xffffffff
mov r8, rbx
mov r12b, bl
mov bpl, bl
cmp ax, word [rcx]
jne 0x14003e4e4
movsxd r8, dword [rsp + 0x64]
mov edi, r13d
mov qword [rsp + 0x40], r8
jmp 0x14003e4d3
add edi, r13d
add rcx, 2
mov qword [rsp + 0x42d8], rcx
cmp ax, word [rcx]
je 0x14003e4d0
cmp edi, ebx
mov r14d, 0x3d
jle 0x14003e50b
lea eax, [r14 - 0x10]
cmp ax, word [rcx]
jne 0x14003e549
add rcx, 2
mov r8, rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x42d8], rcx
mov r15d, 0x30
or dword [rsp + 0x68], 0xffffffff
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
mov rax, qword [rsp + 0x42d8]
cmp r14w, word [rax]
jne 0x14003e5cd
mov r13b, byte [rax]
add rax, 2
mov qword [rsp + 0x42d8], rax
jmp 0x14003e5d0
cmp r14w, word [rcx]
jne 0x14003e554
mov r12b, r13b
jmp 0x14003e561
mov eax, 0x24
cmp ax, word [rcx]
jne 0x14003e575
mov bpl, 2
add rcx, 2
mov qword [rsp + 0x40], rbx
mov r8, rbx
mov qword [rsp + 0x42d8], rcx
movzx eax, word [rcx]
mov r15d, 0x30
lea ecx, [r15 - 0x27]
sub ax, r15w
cmp ax, cx
ja 0x14003e5a5
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x42d8]
call fcn.14007154c
mov r8, qword [rsp + 0x40]
sub edi, r13d
cmp edi, ebx
jle 0x14003e511
cmp bpl, bl
jne 0x14003e511
mov edx, edi
mov ecx, r8d
call fcn.14001b7e0
mov r8d, eax
mov qword [rsp + 0x40], r8
jmp 0x14003e511
mov r13b, bl
movzx eax, word [rax]
mov ecx, 9
sub ax, r15w
cmp ax, cx
ja 0x14003e5f8
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x42d8]
call fcn.1400717bc
mov r8, qword [rsp + 0x40]
cmp bpl, bl
lea r14, [rsp + 0xb8]
lea rax, [rsp + 0x40]
cmovne r14, rax
mov r15d, ebx
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0x38], r15
cmp bpl, bl
jne 0x14003e639
cmp r8, rbx
jne 0x14003e643
mov r15d, 0x80070057
mov qword [rsp + 0x38], r15
cmp r8, rbx
je 0x14003e673
cmp bpl, bl
jne 0x14003e673
xor edx, edx
mov ecx, 0x100000
cmp r12b, bl
je 0x14003e657
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x14003e65d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r14], rax
cmp rax, rbx
jne 0x14003e673
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x50]
mov edx, 0x209
call fcn.14006170c
mov rax, qword [rsp + 0x50]
mov edi, 0x208
mov word [rax], bx
mov rdx, qword [rsp + 0x50]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.14006d63c
mov rcx, qword [rsp + 0x78]
mov edx, 0x5c
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rax, qword [rsp + 0x50]
lea rcx, str.SystemRoot
mov word [rax], bx
mov rdx, qword [rsp + 0x50]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
lea rcx, [rsp + 0x88]
call fcn.140061b5c
mov rax, qword [rsp + 0x42d8]
mov qword [rsp + 0xd0], rbx
cmp word [rax], bx
je 0x14003e92b
mov ebp, 1
mov al, byte [0x14013224f]
cmp al, bl
jle 0x14003e92b
lea rdx, [rsp + 0x42d8]
lea rcx, [0x14011b438]
mov r8d, 7
call fcn.1400640d4
cmp al, bl
je 0x14003e76c
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x42d8]
call fcn.1400717bc
cmp dword [rsp + 0x48], ebx
jge 0x14003e908
mov dword [rsp + 0x48], ebx
jmp 0x14003e908
mov edi, dword [rsp + 0xb0]
lea rdx, [rsp + 0x42d8]
lea rcx, [0x14011b42c]
mov r8d, edi
call fcn.1400640d4
cmp al, bl
je 0x14003e8a2
mov rax, qword [rsp + 0x42d8]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xe0]
mov r8d, ebp
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xe0], rax
call fcn.1400249a8
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x42d8], rax
call fcn.140061698
lea rcx, [rsp + 0xc0]
call fcn.140061698
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0xc0]
call fcn.140061900
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x80]
call fcn.14001bfcc
lea rcx, [rsp + 0xc0]
call fcn.1400591f8
cmp qword [rsp + 0xa8], rbx
jle 0x14003e886
mov r12d, 8
mov rcx, r12
call fcn.1400fb138
mov rdi, rax
cmp rax, rbx
je 0x14003e858
mov rcx, qword [rsp + 0x80]
mov qword [rax], rcx
mov qword [rsp + 0x80], rbx
jmp 0x14003e85b
mov rdi, rbx
mov rcx, qword [rsp + 0x98]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov r9d, r12d
call fcn.140061af8
mov qword [rax], rdi
add qword [rsp + 0x98], rbp
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
lea rcx, [rsp + 0x80]
call fcn.1400591f8
jmp 0x14003e908
lea rdx, [rsp + 0x42d8]
lea rcx, str._cmd
mov r8d, edi
call fcn.1400640d4
cmp al, bl
jne 0x14003e91b
mov rcx, qword [rsp + 0x42d8]
movzx eax, word [rcx]
cmp ax, bx
je 0x14003e8fb
mov edx, 9
lea r8d, [rdx + 0x17]
cmp dx, ax
ja 0x14003e8e1
cmp ax, 0xd
jbe 0x14003e8fb
cmp r8w, ax
je 0x14003e8fb
add rcx, 2
mov qword [rsp + 0x42d8], rcx
mov ax, word [rcx]
cmp ax, bx
jne 0x14003e8d6
lea rcx, [rsp + 0x42d8]
call fcn.140016e2c
mov rax, qword [rsp + 0x42d8]
cmp word [rax], bx
jne 0x14003e71b
jmp 0x14003e92b
mov r11, qword [rsp + 0x42d8]
mov qword [rsp + 0xd0], r11
cmp byte [rsp + 0x42e0], bl
je 0x14003e936
neg esi
mov edi, dword [rsp + 0x4c]
cmp edi, ebx
jne 0x14003e94d
cmp qword [r14], rbx
je 0x14003e94d
mov rcx, qword [rsp + 0x50]
call fcn.14001a39c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ebp, [rsi + rax]
cmp qword [r14], rbx
je 0x14003ea3c
mov cl, byte [0x14013224f]
cmp cl, bl
jle 0x14003ea3c
mov r15, qword [rsp + 0x42d0]
mov r12d, 1
cmp esi, ebx
je 0x14003ea33
mov edi, 0x3e8
jle 0x14003e99f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ebp
sub esi, eax
js 0x14003ea33
cmp esi, edi
cmovl edi, esi
xor r9d, r9d
mov r8, r14
mov edx, r12d
mov rcx, r15
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], edi
call fcn.14001b908
cmp eax, ebx
je 0x14003ea33
mov al, byte [0x14013224f]
mov edi, 0x64
cmp al, bl
jle 0x14003ea25
lea rcx, [rsp + 0x140]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, ebx
je 0x14003ea25
sub edi, r12d
je 0x14003ea25
cmp dword [rsp + 0x148], 0x12
je 0x14003ea25
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x14013224f]
cmp r11b, bl
jg 0x14003e9cf
mov al, byte [0x14013224f]
cmp al, bl
jg 0x14003e97b
mov r15, qword [rsp + 0x38]
mov edi, dword [rsp + 0x4c]
movsxd rax, dword [rsp + 0x68]
cmp eax, ebx
jl 0x14003ea56
cmp r13b, bl
je 0x14003eb21
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbp, qword [rsp + 0x42d0]
cmp qword [rsp + 0x98], rbx
jle 0x14003eb9e
mov al, byte [0x14013224f]
cmp al, bl
jle 0x14003eb9e
cmp edi, ebx
jne 0x14003ea88
mov rcx, qword [rsp + 0x50]
call fcn.14001a39c
cmp qword [rsp + 0x98], rbx
mov rsi, qword [rsp + 0x88]
jle 0x14003eb9e
mov r14d, 1
mov al, byte [0x14013224f]
cmp al, bl
jle 0x14003eb8d
cmp dword [rsp + 0x98], ebx
mov r13d, ebx
mov rdi, rbx
jle 0x14003eb8d
movsxd r15, dword [rsp + 0x98]
mov r12d, r14d
mov al, byte [0x14013224f]
cmp al, bl
jle 0x14003eb59
mov rdx, qword [rsi + rdi*8]
cmp rdx, rbx
je 0x14003eb42
mov rdx, qword [rdx]
xor r8d, r8d
mov rcx, rbp
call fcn.14003ad14
mov r11, qword [rsi + rdi*8]
mov rcx, qword [r11]
call fcn.1400fa140
cmp rax, rbx
jg 0x14003eb3f
mov rbp, qword [rsi + rdi*8]
cmp rbp, rbx
je 0x14003eb1b
mov rcx, rbp
call fcn.1400591f8
mov rcx, rbp
call fcn.1400faf4c
mov qword [rsi + rdi*8], rbx
jmp 0x14003eb42
mov rbp, qword [rsp + 0x42d0]
mov rdx, rax
xor r9d, r9d
mov rcx, rbp
xor r8d, r8d
call fcn.1400192e0
jmp 0x14003ea5e
mov r13d, r12d
mov rbp, qword [rsp + 0x42d0]
add rdi, r14
add r12d, r14d
cmp rdi, r15
jl 0x14003ead0
cmp r13d, ebx
jle 0x14003eb8d
mov rbp, qword [rsp + 0x42d0]
movsxd rdx, dword [rsp + 0x48]
xor r9d, r9d
mov rcx, rbp
xor r8d, r8d
call fcn.1400192e0
movsxd r11, r13d
cmp r11, rbx
mov qword [rsp + 0x98], r11
jg 0x14003eaa4
mov r14, qword [rsp + 0xf0]
mov r15, qword [rsp + 0x38]
mov edi, dword [rsp + 0x4c]
cmp edi, ebx
jne 0x14003ebb1
cmp qword [r14], rbx
je 0x14003ebb1
mov rcx, qword [rsp + 0x78]
call fcn.14001a39c
mov rax, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0x42d0]
cmp rax, rbx
je 0x14003ebe4
cmp word [rax], bx
je 0x14003ebe4
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call fcn.14004abf8
mov r15d, eax
lea rcx, [rsp + 0x88]
call fcn.1400282c4
lea rcx, [rsp + 0x88]
call fcn.1400591f8
lea rcx, [rsp + 0x78]
call fcn.1400591f8
lea rcx, [rsp + 0x50]
call fcn.1400591f8
mov rcx, qword [rsp + 0xb8]
cmp rcx, rbx
je 0x14003ec2b
cmp rcx, 0xffffffffffffffff
je 0x14003ec2b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], rbx
jmp 0x14003ec42
mov r15, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x42d0]
cmp byte [rsp + 0x42e8], bl
je 0x14003ec6a
call fcn.140024e1c
cmp eax, ebx
je 0x14003ec63
lea rdx, str.exec
mov rcx, rdi
call fcn.140024ee0
xor ecx, ecx
call fcn.14002b034
xor edx, edx
mov rcx, rdi
call fcn.14009dca8
movsxd rax, r15d
add rsp, 0x4288
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret