Function at 0x1400d90b0
Capabilities:
Create thread
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14021d5c0]
xor rax, rsp
mov qword [rbp + 0x150], rax
lea rcx, [0x1400d9020]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401a3ca8
xor edi, edi
lea rcx, str..CarMetrics
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
mov qword [rax], rdi
mov rbx, rax
lea r8d, [rdi + 3]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x1400d913b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs rdx, 0x3c3c86f048ad114
mov qword [0x140240dc0], rbx
movabs rcx, 0x1dd70e4a3072117
movabs r8, 0x1e31228b353c6f
call fcn.1400e4870
movabs rdx, 0x2ccea3dc5a858df
mov qword [rbp - 0x10], rax
movabs rcx, 0x12e1797732825ef
movabs r8, 0x35fdb0cea1898e
call fcn.1400e4870
movabs rdx, 0x3da4863129ea028
mov qword [rbp - 8], rax
movabs rcx, 0x2281c1070061f39
movabs r8, 0x204c4137fb4c0c
call fcn.1400e4870
movabs rdx, 0x163c0cec2b5445f
mov qword [rbp], rax
movabs rcx, 0x3c0df650b5875ae
movabs r8, 0x1754313c98627d
call fcn.1400e4870
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x38], rdi
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 8], rax
mov edx, 0x222558
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400d921b
mov eax, 0xfffffff6
jmp 0x1400daa47
call fcn.1400d75a0
test al, al
jne 0x1400d922e
mov eax, 0xfffffff7
jmp 0x1400daa47
cmp qword [0x14023b4b0], rdi
jne 0x1400d9241
mov eax, 0xfffffff8
jmp 0x1400daa47
mov qword [rsp + 0x2a0], r13
mov r13d, 1
mov ecx, r13d
call fcn.1401a3ca8
lea rcx, [rbp - 0x18]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400f5ad0]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x1400daabd
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x298], r12
mov qword [rsp + 0x268], r14
mov qword [rsp + 0x260], r15
cmp dword [rbp - 0x18], edi
je 0x1400daab3
movaps xmm0, xmmword [rbp - 0x20]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400daab3
xorps xmm0, xmm0
mov ecx, 0x1f4
movdqa xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14023b4a8], dil
jne 0x1400d9484
movabs rbx, 0xfffffffffffd
movabs r15, 0xffff800fffffffff
movabs r12, 0xffffffffd
movabs r14, 0xfffffffffd
mov rsi, qword [0x140240dc0]
cmp qword [rsi], 0xffffffffffffffff
je 0x1400d93fa
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea ecx, [rax + 0xf]
call fcn.1401a3d18
mov rbx, rax
mov qword [rsp + 0x38], rdi
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
mov edx, 0x222040
mov dword [rax], 0x74737552
mov dword [rax + 4], 0x65696c43
mov dword [rax + 8], 0x652e746e
mov word [rax + 0xc], 0x6578
mov byte [rax + 0xe], dil
lea rax, [rbp - 0x80]
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], Ordinal_30
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call fcn.1401a3b4c
mov r8, qword [rsp + 0x60]
movabs rax, 0xffffffffffff
add rax, r8
movabs rcx, 0xfffffffffffd
cmp rax, rcx
ja 0x1400d93f0
mov rdx, qword [rsp + 0x68]
lea rax, [rdx + r15]
cmp rax, r12
ja 0x1400d93f0
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, r14
ja 0x1400d93f0
mov qword [rsi + 0x18], r8
movabs rbx, 0xfffffffffffd
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rcx
jmp 0x1400d9403
movabs rbx, 0xfffffffffffd
mov r8, rdi
mov rdx, rdi
mov rcx, rdi
movabs rax, 0xffffffffffff
add rax, r8
cmp rax, rbx
ja 0x1400d9427
lea rax, [rdx + r15]
cmp rax, r12
ja 0x1400d9427
lea rax, [rcx - 1]
cmp rax, r14
jbe 0x1400d9441
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14023b4a8], dil
je 0x1400d9313
jmp 0x1400d9484
cmp byte [0x14023b4a8], dil
jne 0x1400d9484
nop word [rax + rax]
mov rdx, qword [0x14023fd98]
mov rcx, qword [0x14023fda0]
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14023b480], rax
test rax, rax
jne 0x1400d9484
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14023b4a8], dil
je 0x1400d9450
mov rdx, qword [0x14023fd70]
call fcn.1400623a0
mov qword [0x14023b4b8], rax
test rax, rax
jne 0x1400d94a4
lea edi, [rax - 7]
jmp 0x1400daa17
mov rdx, qword [0x14023fd78]
call fcn.1400623a0
mov qword [0x14023b4c0], rax
test rax, rax
jne 0x1400d94c4
lea edi, [rax - 6]
jmp 0x1400daa17
cmp byte [0x14023b4a8], dil
jne 0x1400d95a3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a28f0
call fcn.1400e45b0
mov edx, 2
mov qword [rbp - 0x80], reloc.SHLWAPI.dll_IStream_Read
mov rsi, rax
mov qword [rbp - 0x78], rdi
call fcn.1400ec9f0
mov r8d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x80]
mov rcx, rax
lea rbx, [rax + 0x10]
mov qword [rsp + 0x50], rbx
call sub.VCRUNTIME140.dll_memmove
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov rdx, rsi
call fcn.1400e4940
mov edx, 2
mov qword [rsp + 0x60], rdi
mov rsi, rax
mov qword [rsp + 0x68], reloc.SHLWAPI.dll_IStream_Read
call fcn.1400ec9f0
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x10], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
lea rbx, [rax + 0x10]
mov qword [rbp], rbx
call sub.VCRUNTIME140.dll_memmove
lea r8, [rbp - 0x10]
mov qword [rbp - 8], rbx
mov rdx, rsi
call fcn.1400e4940
mov rdx, rax
call fcn.1400e4c20
mov rcx, qword [0x140240dc0]
lea rdx, [rsi + 0x18]
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x333c0a8
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x333cbd8
mov qword [0x14023b4d0], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a9a78
mov qword [0x14023b4c8], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x3394b80
mov qword [0x14023b500], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a4ef8
mov qword [0x14023b4d8], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x334dd78
mov qword [0x14023b4e0], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a8338
mov qword [0x14023b4e8], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x3343e08
mov qword [0x14023b4f0], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x337b380
mov qword [0x14023b4f8], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a4c40
mov qword [0x14023b520], rax
call fcn.1400e45b0
mov edx, 2
mov qword [0x14023b538], rax
mov qword [rsp + 0x60], reloc.SHLWAPI.dll_IStream_Read
mov qword [rsp + 0x68], reloc.WS2_32.dll_recv
call fcn.1400ec9f0
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x10], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
lea rbx, [rax + 0x10]
mov qword [rbp], rbx
call sub.VCRUNTIME140.dll_memmove
mov rdx, qword [0x14023b4f0]
lea r8, [rbp - 0x10]
mov qword [rbp - 8], rbx
call fcn.1400e4940
mov rbx, rax
lea rdx, [rax + 0x18]
call fcn.1400e4a40
test eax, eax
jle 0x1400d9780
add rbx, 0x20
mov esi, eax
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x140240dc0]
mov rdx, rbx
call fcn.1400e45b0
mov rdx, rax
call fcn.140062cd0
add rbx, 8
sub rsi, r13
jne 0x1400d9760
mov rcx, qword [0x140233f00]
call fcn.1400c11a0
lea rdx, [rsp + 0x60]
call fcn.140062ed0
lea r12, [0x14023c1d8]
mov r15, rax
cmp r12, rax
je 0x1400d982d
mov r14, qword [0x14023c1d8]
mov rsi, qword [r14 + 8]
cmp byte [rsi + 0x19], dil
jne 0x1400d97f1
nop word [rax + rax]
mov r8, qword [rsi + 0x10]
mov rdx, r12
mov rcx, r12
call fcn.1400eacd0
mov rbx, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x20]
call fcn.1400e0620
mov edx, 0x48
mov rcx, rbx
call fcn.1401a3b4c
cmp byte [rsi + 0x19], dil
je 0x1400d97c0
mov qword [r14 + 8], r14
mov qword [r14], r14
mov qword [r14 + 0x10], r14
mov rcx, qword [0x14023c1d8]
mov qword [0x14023c1e0], rdi
mov rax, qword [r15]
mov qword [0x14023c1d8], rax
mov rax, qword [r15 + 8]
mov qword [r15], rcx
mov rcx, qword [0x14023c1e0]
mov qword [0x14023c1e0], rax
mov qword [r15 + 8], rcx
lea rcx, [rsp + 0x60]
call fcn.1400dd5c0
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov ecx, 5
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
cmp byte [0x14023b4a8], dil
jne 0x1400d99e1
nop
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x333c0a8
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x333cbd8
mov qword [0x14023b4d0], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a9a78
mov qword [0x14023b4c8], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x3394b80
mov qword [0x14023b500], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a4ef8
mov qword [0x14023b4d8], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x334dd78
mov qword [0x14023b4e0], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a8338
mov qword [0x14023b4e8], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x3343e08
mov qword [0x14023b4f0], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x337b380
mov qword [0x14023b4f8], rax
call fcn.1400e45b0
mov rdx, qword [0x14023b4b8]
mov rcx, qword [0x140240dc0]
add rdx, 0x33a4c40
mov qword [0x14023b520], rax
call fcn.1400e45b0
mov ecx, Ordinal_41
mov qword [0x14023b538], rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13b, al
jne 0x1400d99e1
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
sub rax, rbx
cmp rax, 0x1b6b0b00
jge 0x1400d99e1
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14023b4a8], dil
je 0x1400d9860
mov rcx, r13
mov byte [0x14023b5ec], r13b
call fcn.1401a3ca8
lea rcx, [rbp - 0x28]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400f5cc0]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1400daaa4
cmp dword [rbp - 0x28], edi
je 0x1400daab3
movaps xmm0, xmmword [rbp - 0x30]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400daab3
xorps xmm0, xmm0
mov rcx, r13
movdqa xmmword [rbp - 0x30], xmm0
call fcn.1401a3ca8
lea rcx, [rbp - 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400f5cf0]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x1400daa95
cmp dword [rbp - 0x38], edi
je 0x1400daab3
movaps xmm0, xmmword [rbp - 0x40]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400daab3
xorps xmm0, xmm0
mov rcx, r13
movdqa xmmword [rbp - 0x40], xmm0
call fcn.1401a3ca8
lea rcx, [rbp - 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400f5d60]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400daa86
cmp dword [rbp - 0x48], edi
je 0x1400daab3
movaps xmm0, xmmword [rbp - 0x50]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400daab3
xorps xmm0, xmm0
mov rcx, r13
movdqa xmmword [rbp - 0x50], xmm0
call fcn.1401a3ca8
lea rcx, [rbp + 0x18]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400f5e20]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x1400daa77
cmp dword [rbp + 0x18], edi
je 0x1400daab3
movaps xmm0, xmmword [rbp + 0x10]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400daab3
xorps xmm0, xmm0
mov rcx, r13
movdqa xmmword [rbp + 0x10], xmm0
call fcn.1401a3ca8
lea rcx, [rbp - 0x58]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400f5f10]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x1400daa68
cmp dword [rbp - 0x58], edi
je 0x1400daab3
movaps xmm0, xmmword [rbp - 0x60]
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400daab3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0x10000
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp byte [0x14023b4a8], dil
jne 0x1400da143
movabs r14, 0xdd67c8a60dd67c
movabs rbx, 0x346dc5d63886594b
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
mov rax, rbx
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [0x14023b8dc]
cmp rdx, rax
jle 0x1400d9df0
mov edx, 2
mov qword [rsp + 0x60], reloc.SHLWAPI.dll_IStream_Read
mov qword [rsp + 0x68], rdi
call fcn.1400ec9f0
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x10], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
lea rbx, [rax + 0x10]
mov qword [rbp], rbx
call sub.VCRUNTIME140.dll_memmove
mov rdx, qword [0x14023b500]
lea r8, [rbp - 0x10]
mov qword [rbp - 8], rbx
call fcn.1400e4940
mov rcx, qword [0x140240dc0]
lea rdx, [rax + 0x10]
call fcn.1400e45b0
lea rcx, [0x140233ee0]
mov qword [0x140240d10], rax
call fcn.140080370
mov rcx, qword [0x140239110]
movabs rax, 0x3759f22983759f23
sub rcx, qword [0x140239108]
xor r15b, r15b
imul rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor sil, sil
mov qword [rbp - 0x70], rdi
mov rbx, rdx
xor r12b, r12b
sar rbx, 6
mov rax, rbx
shr rax, 0x3f
add rbx, rax
je 0x1400d9d39
cmp rbx, r14
ja 0x1400daacc
mov rdx, rbx
call fcn.1400ec820
mov rdx, qword [0x140239110]
lea r9, [rbp - 0x80]
imul rcx, rbx, 0x128
mov r8, rax
mov qword [rbp - 0x80], rax
add rcx, rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rcx
mov rcx, qword [0x140239108]
call fcn.1400edce0
mov r14, rax
mov qword [rbp - 0x78], rax
jmp 0x1400d9d3d
mov r14, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x80]
cmp rbx, r14
je 0x1400d9da7
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140084400
mov eax, dword [rbp + 0x60]
cmp eax, 0x8d
jne 0x1400d9d6c
movzx r15d, r13b
jmp 0x1400d9d86
cmp eax, 0x91
jne 0x1400d9d79
movzx r12d, r13b
jmp 0x1400d9d86
cmp eax, 0x90
movzx esi, sil
cmove esi, r13d
lea rcx, [rbp + 0x20]
call fcn.1400690e0
add rbx, 0x128
cmp rbx, r14
jne 0x1400d9d50
mov byte [0x14023ba6c], r13b
test r15b, r15b
jne 0x1400d9dae
mov byte [0x14023ba6c], dil
test sil, sil
lea rcx, [rbp - 0x80]
setne byte [0x14023ba6d]
test r12b, r12b
setne byte [0x14023ba6e]
call fcn.1400dff50
mov eax, dword [0x14023b894]
movabs r14, 0xdd67c8a60dd67c
inc eax
mov dword [0x14023b894], eax
cmp eax, 0x3e8
jl 0x1400d9df0
mov dword [0x14023b894], edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14023b480]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
sete byte [0x14023b4a9]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400da015
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13b, al
je 0x1400d9e7e
mov rax, qword [0x14023ba78]
cmp byte [rax], dil
je 0x1400d9e42
mov ecx, 0x7d0
mov byte [rax], dil
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x14023bae0]
cmp byte [rax], dil
je 0x1400d9e51
mov byte [rax], dil
mov rax, qword [0x14023baf8]
cmp byte [rax], dil
je 0x1400d9e60
mov byte [rax], dil
mov rax, qword [0x14023bb10]
cmp byte [rax], dil
je 0x1400d9e6f
mov byte [rax], dil
mov rax, qword [0x14023bb40]
cmp byte [rax], dil
je 0x1400d9e7e
mov byte [rax], dil
cmp byte [0x14023b4a9], dil
je 0x1400da003
mov ecx, dword [0x14023b5f0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13b, al
je 0x1400d9eaa
cmp byte [0x14023b5c8], dil
sete byte [0x14023b5c8]
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13b, al
je 0x1400d9ec8
cmp byte [0x14023b880], dil
sete byte [0x14023b880]
cmp qword [0x14023b5a0], rdi
je 0x1400da003
cmp byte [0x1402351b1], dil
je 0x1400da003
mov ecx, dword [0x14023b9c8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13b, al
je 0x1400d9f6b
cmp qword [0x14023b5a0], rdi
jne 0x1400d9f05
cmp byte [0x14023b4a8], dil
jne 0x1400d9f6b
mov rbx, qword [0x140235178]
lea rdx, [rbx + 0x8b0]
call fcn.1400e4a40
or eax, 4
lea rdx, [rbx + 0x8b0]
mov r8d, eax
call fcn.1400e4ce0
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [0x140235178]
add rsi, 0x8b0
mov rdx, rsi
call fcn.1400e4a40
mov rdx, rsi
mov ebx, eax
call fcn.1400e4a40
shr eax, 2
lea r8d, [rbx - 4]
test r13b, al
mov rdx, rsi
cmove r8d, ebx
call fcn.1400e4ce0
mov ecx, dword [0x14023b9dc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rax, qword [0x14023b938]
setne cl
mov byte [rax], cl
mov ecx, dword [0x14023b9d0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rax, qword [0x14023bbf0]
setne cl
mov byte [rax], cl
mov ecx, dword [0x14023ba04]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rax, qword [0x14023bbf8]
setne cl
mov byte [rax], cl
mov ecx, dword [0x14023b9cc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13b, al
je 0x1400d9fdb
cmp byte [0x14023b928], dil
sete byte [0x14023b928]
mov eax, dword [0x14023b888]
inc eax
mov dword [0x14023b888], eax
cmp eax, 0x3e8
jl 0x1400d9ff6
mov dword [0x14023b888], edi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x80], r13
call fcn.1400e5120
cmp byte [0x14023b4a8], dil
jne 0x1400da143
jmp 0x1400d9c07
mov byte [0x14023b4a8], r13b
cmp dword [rbp - 0x18], edi
je 0x1400da057
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x18], eax
je 0x1400da108
movaps xmm0, xmmword [rbp - 0x20]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400da12f
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
cmp dword [rbp - 0x28], edi
je 0x1400da092
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x28], eax
je 0x1400da108
movaps xmm0, xmmword [rbp - 0x30]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400da12f
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
cmp dword [rbp - 0x38], edi
je 0x1400da0c5
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x38], eax
je 0x1400da108
movaps xmm0, xmmword [rbp - 0x40]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400da12f
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
cmp dword [rbp - 0x48], edi
je 0x1400da0f8
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x48], eax
je 0x1400da108
movaps xmm0, xmmword [rbp - 0x50]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400da12f
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp dword [rbp - 0x58], edi
je 0x1400da143
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x58], eax
jne 0x1400da114
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x60]
lea rcx, [rsp + 0x60]
xor edx, edx
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x1400da13b
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov rcx, qword [0x14023b5d0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bc38]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bc40]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bc48]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bc50]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bc58]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bc88]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bc98]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bca0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bca8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bcb0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bcb8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bcc0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bcc8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bcd0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bcd8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bce0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bce8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bcf0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bcf8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd00]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd08]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd10]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd18]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd20]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd28]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd30]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd38]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd40]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd50]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd58]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd60]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd68]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd70]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd78]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd80]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd88]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd90]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bd98]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bda0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bda8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bdb0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bdb8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bdc0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bdc8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bdd0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bdd8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bde0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bde8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bdf0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bdf8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be00]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be08]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be10]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be18]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be20]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be28]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be30]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be38]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be40]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be48]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be50]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be58]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be60]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be68]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be70]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be78]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be80]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be90]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023be98]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bea0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bea8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023beb0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023beb8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bec0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bec8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bed0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bed8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bee0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bee8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bef0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bef8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf00]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf08]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf10]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf18]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf20]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf28]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf30]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf38]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf40]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf48]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf50]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf58]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf60]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf68]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf70]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf78]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf80]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf88]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf90]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bf98]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfa0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfa8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfb0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfb8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfc0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfc8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfd0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfd8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfe0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bfe8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bff0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023bff8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c000]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c008]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c010]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c018]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c020]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c028]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c030]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c038]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c040]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c048]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c050]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c058]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c060]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c068]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c070]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c078]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c080]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c088]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c090]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c098]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0a0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0a8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0b0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0b8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0c0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0c8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0d8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0e0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0e8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0f0]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c0f8]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c100]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c108]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c110]
mov rdx, r13
call fcn.1401a3b4c
mov rcx, qword [0x14023c120]
mov rdx, r13
call fcn.1401a3b4c
cmp dword [rbp - 0x58], edi
jne 0x1400daa61
cmp dword [rbp + 0x18], edi
jne 0x1400daa61
cmp dword [rbp - 0x48], edi
jne 0x1400daa61
cmp dword [rbp - 0x38], edi
jne 0x1400daa61
cmp dword [rbp - 0x28], edi
jne 0x1400daa61
cmp dword [rbp - 0x18], 0
jne 0x1400daa61
mov r14, qword [rsp + 0x268]
mov eax, edi
mov rsi, qword [rsp + 0x290]
mov r12, qword [rsp + 0x298]
mov r15, qword [rsp + 0x260]
mov r13, qword [rsp + 0x2a0]
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1401a37c0
add rsp, 0x270
pop rdi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rbp - 0x58], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x18], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x48], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x38], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x28], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, r13d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x18], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call fcn.1400e26c0
int3