Function at 0x1400d129c
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Get common file path
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x420
mov rsi, rcx
lea rcx, [rax + 0x10]
xor edi, edi
mov r12, r9
mov r15, r8
mov qword [rax + 0x10], rdx
mov dword [rsp + 0x7c], edi
call fcn.140057738
lea ebp, [rdi + 2]
lea rdx, [rsp + 0x468]
lea rcx, [0x14011b11c]
mov r8d, ebp
call fcn.1400623c0
mov rcx, qword [rsp + 0x468]
lea r13, [rsp + 0x84]
mov byte [rsp + 0x78], al
lea rax, [rsp + 0x84]
mov word [rsp + 0x84], di
mov rbx, rcx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x40], rax
jmp 0x1400d132f
mov eax, 0x3d
cmp ax, dx
je 0x1400d1339
add rcx, rbp
movzx edx, word [rcx]
cmp dx, di
jne 0x1400d1322
jmp 0x1400d1345
lea r13, [rcx + 2]
mov word [rcx], di
mov qword [rsp + 0x50], r13
mov rcx, rbx
mov r14, rsi
mov qword [rsp + 0x58], rsi
mov bpl, dil
call fcn.140017e84
mov ecx, 0x3a
lea eax, [rcx - 0x39]
lea edx, [rcx - 0x36]
lea r8, [0x14012d0c0]
cmp cx, word [rbx]
jne 0x1400d138a
cmp cx, word [rbx + 2]
jne 0x1400d138a
mov r12, qword [0x14012d100]
mov bpl, al
add rbx, rdx
mov r14, r8
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x98], rdi
cmp byte [rsi + 0xda], dil
jne 0x1400d13bd
test byte [rsi + 0xd], 0xf
jne 0x1400d13bd
lea r8, [rsp + 0x98]
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.140075e18
jmp 0x1400d13d7
lea r8, [rsp + 0x98]
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.1400742a0
mov rbx, qword [rsp + 0x98]
lea rcx, [rsp + 0x88]
call fcn.14005fa18
mov eax, 1
lea r8, [rsp + 0x88]
xor r9d, r9d
mov rdx, r13
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.140075fb4
mov r11, qword [rsp + 0x88]
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x40], r11
cmp word [rbx], ax
jne 0x1400d1803
lea rdx, [0x14011b100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x1400d1734
mov r11, qword [rsp + 0x40]
lea rcx, [0x14011b0f0]
mov r8d, 9
mov rdx, r11
mov dword [rsp + 0x460], 0xfff80000
mov qword [rsp + 0x468], r11
call fcn.140058db8
mov ebp, 0x20
cmp al, dil
je 0x1400d1523
movzx eax, word [r11 + 0x12]
or ax, bp
sub ax, 0x61
cmp ax, 0x19
jbe 0x1400d1523
lea rcx, [rsp + 0x478]
call fcn.14005fa18
lea rcx, [rsp + 0x140]
lea rdx, [0x14011b060]
lea r8d, [rbp + 0x6e]
call fcn.1400f4550
lea r14d, [rbp - 0x1f]
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x140]
xor r9d, r9d
mov rcx, rsi
mov byte [rsp + 0x20], r14b
call fcn.1400742a0
mov rdx, qword [rsp + 0x478]
mov r8d, r14d
mov rcx, rsi
call fcn.14003a128
mov r11, qword [rsp + 0x468]
lea r13d, [rbp - 0x1e]
add r11, 0x12
mov qword [rsp + 0x468], r11
cmp word [r11], di
je 0x1400d1514
add r11, r13
mov qword [rsp + 0x468], r11
lea rcx, [rsp + 0x478]
call fcn.140057768
jmp 0x1400d152d
mov r14d, 1
lea r13d, [r14 + 1]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x468]
call fcn.14006ee08
mov ebx, dword [rsp + 0x460]
mov r15d, 0x1a
lea r12d, [r15 + 0x26]
test r12b, bl
je 0x1400d156c
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov ecx, 0xffff
call qword [sym.imp.USER32.DLL_SendMessageW]
test bpl, bl
je 0x1400d1585
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov ecx, 0xffff
call qword [sym.imp.USER32.DLL_SendMessageW]
mov ebp, 0x10
test bpl, bl
je 0x1400d16ab
lea rcx, [rsp + 0x478]
call fcn.14005fa18
mov rax, qword [rsp + 0x468]
lea r8d, [rbp + 0x2a]
mov r12d, 0x2000
cmp r8w, word [rax]
jne 0x1400d15e1
add rax, r13
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x468]
mov qword [rsp + 0x468], rax
call fcn.14000738c
mov ebx, dword [rsp + 0x460]
jmp 0x1400d161e
mov edx, 2
cmp word [rax], di
je 0x1400d15f6
add rax, rdx
mov qword [rsp + 0x468], rax
mov ecx, 0x2d
cmp cx, word [rax]
jne 0x1400d1606
lea r12d, [rcx - 0x29]
jmp 0x1400d1613
mov ecx, 0x2b
cmp cx, word [rax]
jne 0x1400d161e
mov r12d, edx
add rax, rdx
mov qword [rsp + 0x468], rax
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x468]
mov r9d, 0x2c
mov rcx, rsi
mov word [rsp + 0x20], di
call fcn.140050d3c
mov r8, qword [rsp + 0x478]
mov qword [rsp + 0x468], r8
cmp word [r8], di
jne 0x1400d168d
lea rax, [rsp + 0x210]
lea rdx, [rsp + 0x210]
mov r9d, r14d
mov r8d, ebp
xor ecx, ecx
mov word [rsp + 0x210], di
mov qword [rsp + 0x468], rax
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathW]
mov r8, qword [rsp + 0x468]
xor r9d, r9d
mov edx, 0x1005
mov ecx, r12d
call qword [sym.imp.SHELL32.DLL_SHChangeNotify]
lea rcx, [rsp + 0x478]
call fcn.140057768
test bl, 8
je 0x1400d16c6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1000
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.DLL_SHChangeNotify]
test bl, 4
je 0x1400d16d0
call fcn.140004950
mov eax, 2
test al, bl
je 0x1400d16fc
lea r8, [0x14012d3d0]
lea rdx, [0x1401135e0]
lea rcx, [0x14011b040]
xor r9d, r9d
call fcn.140058e24
call qword [0x14012d3d0]
cmp ebx, edi
jl 0x1400d1713
test r14b, bl
jne 0x1400d170e
mov ecx, 0x7e
test cl, bl
jne 0x1400d1713
call fcn.1400d70f8
lea rcx, [rsp + 0x88]
call fcn.140057768
lea rcx, [rsp + 0x98]
call fcn.140057768
xor eax, eax
jmp 0x1400d26b2
lea rdx, [0x14011b020]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x1400d17fe
mov r9, qword [rsp + 0x40]
lea rcx, [0x140112d70]
mov rdx, r9
call fcn.140058df4
cmp al, dil
jne 0x1400d17ae
lea rcx, [0x140118254]
mov rdx, r9
call fcn.140058df4
cmp al, dil
jne 0x1400d1796
lea rcx, [0x140111694]
mov rdx, r9
call fcn.140058df4
cmp al, dil
je 0x1400d1713
cmp byte [0x14012ccf2], dil
je 0x1400d17ae
lea rcx, [0x14012dc30]
mov byte [0x14012ccf2], dil
call fcn.140057e80
jmp 0x1400d1713
cmp byte [0x14012c96b], dil
je 0x1400d17cb
mov rcx, qword [0x14012cf30]
mov eax, 1
mov byte [0x14012ccf2], al
jmp 0x1400d17f4
mov rcx, qword [0x14012d100]
cmp rcx, rdi
je 0x1400d1713
cmp qword [rcx + 0x20], rdi
je 0x1400d1713
mov eax, 1
mov byte [0x14012ccf2], al
mov rcx, qword [rcx + 0x20]
call fcn.140019b28
jmp 0x1400d1713
mov eax, pe_nt_image_headers64
cmp word [rbx], di
jne 0x1400d181e
neg bpl
mov rcx, r14
sbb rdx, rdx
and rdx, rsi
call fcn.14001a3e0
jmp 0x1400d1713
cmp ax, word [rbx]
je 0x1400d183e
neg bpl
mov rcx, r14
sbb rdx, rdx
and rdx, rsi
call fcn.14001a3e0
cmp qword [r14 + 0x40], rdi
je 0x1400d1713
cmp r12, rdi
je 0x1400d184d
mov rdx, qword [r12 + 0x110]
jmp 0x1400d1854
lea rdx, [0x14010d568]
lea rcx, [rsp + 0xd0]
call fcn.14006ac98
movzx ecx, word [rbx]
mov rdx, rbx
mov rax, rbx
cmp cx, di
je 0x1400d188e
mov r13d, 2
lea r8d, [r13 + 0x38]
cmp r8w, cx
jne 0x1400d1883
lea rdx, [rax + 2]
add rax, r13
mov cx, word [rax]
cmp cx, di
jne 0x1400d1879
lea rcx, [rsp + 0xa8]
call fcn.14006ac98
movzx ecx, word [rbx]
mov r9d, 0x2e
mov r11, rdi
mov rax, rbx
mov qword [rsp + 0x468], rbx
lea r10d, [r9 - 0x2c]
cmp cx, di
je 0x1400d18dd
cmp r9w, cx
cmove r11, rax
add rax, r10
mov cx, word [rax]
cmp cx, di
jne 0x1400d18bb
cmp r11, rdi
cmovne rax, r11
mov qword [rsp + 0x468], rax
mov r12, rdi
cmp r9w, word [rax]
jne 0x1400d18f7
mov word [rax], di
add rax, r10
mov qword [rsp + 0x468], rax
mov r12, rax
lea rcx, [rsp + 0x468]
call fcn.140057738
mov edx, 9
lea ebp, [rdx + 0x17]
lea r8d, [rdx + 4]
cmp r12, rdi
je 0x1400d1940
mov rcx, qword [rsp + 0x468]
mov r12, rcx
jmp 0x1400d1935
cmp dx, ax
ja 0x1400d192d
cmp ax, r8w
jbe 0x1400d193d
cmp bp, ax
je 0x1400d193d
add rcx, r10
movzx eax, word [rcx]
cmp ax, di
jne 0x1400d1922
mov word [rcx], di
mov r11d, 0x2a
mov byte [rsp + 0x478], dil
mov r8b, dil
lea r13d, [r11 - 0x20]
mov qword [rsp + 0xb8], r13
cmp r15, rdi
je 0x1400d19ed
mov rax, r15
cmp word [r15], di
je 0x1400d19ed
lea ecx, [r11 + 0x54]
lea r14d, [r11 - 0x1d]
jmp 0x1400d197f
mov r9d, 0x2e
cmp dx, word [rax]
ja 0x1400d198a
cmp word [rax], r14w
jbe 0x1400d19e8
cmp bp, word [rax]
je 0x1400d19e8
cmp r9w, word [rax]
je 0x1400d1bc2
mov r9d, 0x24
cmp r9w, word [rax]
je 0x1400d1bc2
mov r9d, 0x25
cmp r9w, word [rax]
je 0x1400d1bc2
cmp r11w, word [rax]
jne 0x1400d19c5
or r8b, 4
jmp 0x1400d19e0
cmp cx, word [rax]
jne 0x1400d19db
cmp cx, word [rax + 2]
jne 0x1400d1b79
or r8b, r10b
add rax, 2
mov edx, 9
add rax, r10
cmp word [rax], di
jne 0x1400d1979
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x468], rdi
cmp r8b, dil
je 0x1400d1a0f
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.14007d5ac
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xc8]
call fcn.14005fa18
mov al, byte [rsp + 0x478]
cmp al, dil
je 0x1400d1a4e
mov ecx, 0x2e
cmp al, cl
je 0x1400d1a4e
lea r9, [rsp + 0x468]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x40]
mov r8, r15
call fcn.14007c96c
lea rcx, [rsp + 0xc0]
mov rdx, rbx
mov qword [rsp + 0xa0], rdi
call fcn.14006ac98
mov r15, qword [rsp + 0xc0]
cmp r12, rdi
lea rbp, [0x14010d568]
cmovne rbp, r12
mov r12d, pe_nt_image_headers64
mov qword [rsp + 0x130], rbp
cmp word [rbx], r12w
je 0x1400d2b6b
lea rax, [0x14012e0b8]
mov r13, rdi
mov qword [rsp + 0xb0], rdi
mov rcx, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea r11d, [r12 - 0x3f]
mov r12b, dil
mov r13b, r11b
mov r10b, dil
mov esi, dword [rsp + 0x7c]
mov ebp, 2
lea rcx, [rsp + 0x70]
movzx r10d, r10b
cmp r12b, dil
mov edx, 0x3a
mov r9, r15
mov qword [rsp + 0x60], r15
cmovne r10d, r11d
mov qword [rsp + 0x70], r15
call fcn.1400e7958
mov rax, qword [rsp + 0x70]
mov r12b, dil
cmp dx, word [rax]
jne 0x1400d1b1b
mov word [rax], di
mov r15, qword [rsp + 0x70]
movzx r12d, dil
add r15, rbp
mov qword [rsp + 0x70], r15
cmp word [r15], di
cmovne r12d, r11d
cmp r13b, dil
je 0x1400d1b47
lea rcx, [0x140112394]
mov rdx, r9
call fcn.140058df4
cmp al, dil
je 0x1400d1b44
mov r9, qword [rsp + 0xd0]
mov r10b, r11b
mov qword [rsp + 0x60], r9
mov r13b, dil
mov rbx, qword [r14 + 0x40]
lea rcx, [0x14010eb9c]
mov rdx, r9
call fcn.140058df4
cmp al, dil
je 0x1400d1c2b
mov r14, qword [r14 + 0x38]
mov rbx, qword [r14 + 0x40]
cmp rbx, rdi
je 0x1400d1bd2
lea rax, [rbx + 0x110]
jmp 0x1400d1bf7
cmp cx, word [rax]
jne 0x1400d19db
mov r9d, 0x2e
cmp r9w, word [rax + 2]
jne 0x1400d1b98
or r8b, 8
jmp 0x1400d19d7
cmp cx, word [rax]
jne 0x1400d19db
cmp r11w, word [rax + 2]
jne 0x1400d1bb0
or r8b, r13b
jmp 0x1400d19d7
cmp cx, word [rax]
jne 0x1400d19db
or r8b, 1
jmp 0x1400d19db
mov r9b, byte [rax]
mov byte [rsp + 0x478], r9b
jmp 0x1400d19e0
lea rdx, [0x14010d568]
lea rcx, [rsp + 0xb8]
or esi, r11d
call fcn.14006ac98
lea rax, [rsp + 0xb8]
mov r11d, 1
mov r9, qword [rax]
mov qword [rsp + 0x60], r9
test r11b, sil
je 0x1400d1c1f
lea rcx, [rsp + 0xb8]
and esi, 0xfffffffe
call fcn.140057768
mov r9, qword [rsp + 0x60]
mov r11d, 1
mov r10b, r11b
cmp r12b, dil
jne 0x1400d1acb
mov rbp, qword [rsp + 0x130]
mov dword [rsp + 0x7c], esi
mov dword [rsp + 0x90], r10d
mov dword [rsp + 0x7c], esi
mov rsi, qword [rsp + 0x460]
mov dword [rsp + 0x90], r10d
mov byte [rsp + 0x468], r13b
mov r13, qword [rsp + 0xb0]
mov dword [rsp + 0x80], r12d
mov dword [rsp + 0x90], r10d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x80], r12d
cmp rbx, rdi
je 0x1400d1dd9
cmp rbx, r13
je 0x1400d1dd9
mov r15d, 0x23
cmp r12b, dil
jne 0x1400d1cbe
mov rcx, qword [rbx + 0x110]
mov rdx, r9
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
je 0x1400d1e5e
lea r11d, [r15 - 0x22]
cmp dword [rbx + 0x120], edi
mov r14d, edi
jle 0x1400d1d1b
mov r13, rdi
mov rax, qword [rbx + 0x118]
mov r12, qword [rax + r13 + 8]
cmp r12, rdi
je 0x1400d1d03
mov rcx, qword [r12 + 0x110]
cmp rcx, rdi
je 0x1400d1d03
mov rdx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
je 0x1400d1e5b
mov r11d, 1
add r14d, r11d
add r13, 0x18
cmp r14d, dword [rbx + 0x120]
jl 0x1400d1ccc
mov r12d, dword [rsp + 0x80]
mov rax, qword [rbx + 0x188]
mov r14d, edi
cmp dword [rax], edi
jle 0x1400d1da0
mov r13, rdi
mov rax, qword [rbx + 0x180]
mov rcx, qword [rax]
mov r12, qword [r13 + rcx]
cmp r12, rdi
je 0x1400d1d85
mov rcx, qword [r12 + 0x10]
cmp rcx, rdi
je 0x1400d1d85
mov rdx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x1400d1d7f
cmp byte [rsp + 0x80], dil
je 0x1400d2063
cmp dword [r12 + 8], 0xf
je 0x1400d1e27
cmp dword [r12 + 8], 0x16
je 0x1400d1e27
mov r11d, 1
mov rax, qword [rbx + 0x188]
add r14d, r11d
add r13, 8
cmp r14d, dword [rax]
jl 0x1400d1d2c
mov r12d, dword [rsp + 0x80]
cmp r12b, dil
jne 0x1400d264a
mov rdx, qword [rsp + 0x60]
lea rcx, [rbx + 0x290]
call fcn.1400d7da4
mov r14, rax
cmp rax, rdi
jne 0x1400d28cc
mov r14, qword [rsp + 0x58]
mov r10d, dword [rsp + 0x90]
mov r11d, 1
cmp r10b, dil
jne 0x1400d264a
cmp byte [rsp + 0x78], dil
jne 0x1400d264a
mov r14, qword [r14 + 0x38]
mov r13, rbx
mov qword [rsp + 0xb0], rbx
cmp r14, rdi
je 0x1400d2147
lea rax, [0x14012d0c0]
cmp r14, rax
je 0x1400d2147
mov r15, qword [rsp + 0x68]
mov r13b, byte [rsp + 0x468]
jmp 0x1400d1ac2
mov rax, qword [r12 + 0x38]
mov r10d, dword [rsp + 0x90]
mov r15, qword [rsp + 0x68]
mov r14, qword [rax + 0x270]
mov r12d, dword [rsp + 0x80]
mov r13b, byte [rsp + 0x468]
mov r11d, 1
jmp 0x1400d1ac2
mov rbx, r12
lea rcx, [0x14011b010]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d205c
lea rcx, [0x14011b008]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d1ec7
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x20], dil
mov rcx, qword [rbx + 0x1e0]
mov r8, rbx
mov rdx, qword [rsp + 0x50]
mov r9, rsi
call fcn.1400e3428
movsxd rbx, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400d2661
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1400d2661
lea rcx, [0x14011b000]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d1ef0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov eax, 1
mov byte [rsp + 0x20], al
jmp 0x1400d1e94
lea rcx, [0x14011aff8]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d1fa0
mov rax, qword [rbx + 0x1e0]
mov rcx, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0xf0], rax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0xe0], 3
mov qword [rsp + 0x108], rax
mov eax, 1
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xf8], r11
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rdi
cmp rcx, rdi
je 0x1400d1f7e
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea r9, [rsp + 0xe0]
mov rcx, qword [rbx + 0x20]
mov r8, rbx
mov edx, 0x465
call qword [sym.imp.USER32.DLL_SendMessageW]
mov rbx, rax
jmp 0x1400d1eae
lea rcx, [0x14011aff4]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d22ee
lea rcx, [0x14011aff0]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d1fd8
mov rbx, qword [rbx + 0x20]
mov r14d, edi
jmp 0x1400d2188
mov rcx, qword [rsp + 0x48]
mov r12, qword [rbx + 0x20]
cmp rcx, rdi
je 0x1400d1ff1
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x110], rdi
mov rcx, r12
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xa8]
lea r9, [rsp + 0xe0]
mov edx, 0x459
mov r8, rbx
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0xe0], rsi
call qword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x1400d2147
mov r11, qword [rsp + 0x40]
jmp 0x1400d2095
lea rcx, [0x14011b010]
mov rdx, rbp
mov qword [rsp + 0xa0], r12
call fcn.140058df4
mov r11, qword [rsp + 0x40]
cmp al, dil
je 0x1400d2160
cmp word [r11], r15w
je 0x1400d2160
mov rbx, r12
cmp word [r11], r15w
sete sil
cmp sil, dil
je 0x1400d20ab
add r11, 2
mov qword [rsp + 0x40], r11
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.14006ee08
cmp sil, dil
je 0x1400d212a
cmp dword [rsp + 0x460], edi
jle 0x1400d20e5
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x1e0]
call fcn.14005b28c
jmp 0x1400d2147
jne 0x1400d2147
lea rcx, [0x14012e0b8]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rcx, qword [0x14012d6b8]
cmp rcx, rdi
je 0x1400d211b
call qword [sym.imp.USER32.DLL_UnhookWindowsHookEx]
mov qword [0x14012d6b8], rdi
mov qword [0x14012d6c0], rdi
mov qword [0x14012d6c8], rdi
lea rcx, [0x14012e0b8]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1400d2147
cmp dword [rsp + 0x460], edi
jle 0x1400d213f
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.DLL_SetCapture]
jmp 0x1400d2147
jne 0x1400d2147
call qword [sym.imp.USER32.DLL_ReleaseCapture]
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400d2f6d
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1400d2f6d
lea rcx, [0x14011aff0]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d22d3
mov rax, qword [r12 + 0x38]
add r14d, 0x1000
mov rbx, qword [rax + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140057738
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x1400d230b
lea rcx, [rsp + 0x478]
call fcn.14005fa18
lea rcx, [rsp + 0x468]
call fcn.14005fa18
mov ebp, 2
lea rdx, [rsp + 0x478]
add qword [rsp + 0x40], rbp
lea r13d, [rbp + 0x2a]
lea r12d, [rbp + 0x39]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.1400638e8
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400d2214
add r11, rbp
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
mov qword [rsp + 0x40], r11
call fcn.1400638e8
mov r8, qword [rsp + 0x478]
lea r9, [0x14010d650]
mov rdx, rbx
mov rcx, rsi
call fcn.140062ba8
mov r8, qword [rsp + 0x468]
lea r9, [0x14010e488]
mov edx, r14d
mov rcx, rsi
call fcn.140062bec
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400d2b51
cmp r14d, 0x1000
jl 0x1400d2b51
mov rbx, qword [rsp + 0xa0]
cmp rbx, rdi
je 0x1400d2b51
cmp bp, word [rbx + 8]
je 0x1400d2289
mov eax, 0xd
cmp dword [rbx + 8], eax
jne 0x1400d2b51
lea rcx, [rsp + 0x460]
call fcn.14005fa18
add qword [rsp + 0x40], rbp
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.1400638e8
mov r8, qword [rsp + 0x460]
mov rdx, qword [rbx + 0x70]
lea r9, [0x14010d650]
mov rcx, rsi
call fcn.140062ba8
jmp 0x1400d2b44
lea rcx, [0x14011aff4]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d257c
mov rbx, r12
lea rcx, [rsp + 0x40]
call fcn.140057738
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
je 0x1400d2394
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400d231b
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
or dword [rsp + 0x460], 0xffffffff
or dword [rsp + 0x468], 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.140057738
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
mov bl, dil
lea esi, [rcx - 0x28]
cmp word [rax], cx
jne 0x1400d2354
mov bl, byte [rax]
add rax, rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.14006ee08
cmp eax, edi
jle 0x1400d2f6d
cmp bl, dil
je 0x1400d2efc
cmp dword [rsp + 0x460], edi
jl 0x1400d2f6d
mov ecx, edi
setne cl
call qword [sym.imp.USER32.DLL_ShowCursor]
jmp 0x1400d2f6d
lea rcx, [rsp + 0x468]
call qword [sym.imp.USER32.DLL_GetCursorPos]
mov r11, qword [rsp + 0x468]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x478]
mov qword [rsp + 0x478], r11
call qword [sym.imp.USER32.DLL_ScreenToClient]
lea rcx, [rsp + 0x50]
call fcn.14005fa18
lea rcx, [rsp + 0x60]
call fcn.14005fa18
lea rcx, [rsp + 0x58]
call fcn.14005fa18
lea rcx, [rsp + 0x68]
call fcn.14005fa18
lea rcx, [rsp + 0x460]
call fcn.14005fa18
mov r14d, 2
lea rdx, [rsp + 0x50]
add qword [rsp + 0x40], r14
lea r13d, [r14 + 0x2a]
lea r12d, [r14 + 0x39]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140050f84
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140050f84
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140050f84
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140050f84
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140050f84
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x468]
mov rcx, rsi
call fcn.140062c80
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x46c]
mov rcx, rsi
call fcn.140062c80
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x478]
mov rcx, rsi
call fcn.140062c80
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x47c]
mov rcx, rsi
call fcn.140062c80
mov r11, qword [rsp + 0x460]
cmp word [r11], di
je 0x1400d2542
lea ebp, [r14 - 1]
mov ecx, ebp
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov bx, ax
shr ebx, 0xf
and bx, bp
lea ebp, [r14 + 0xe]
mov ecx, ebp
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
lea ecx, [rbp + 1]
neg ax
sbb dx, dx
and dx, 4
or bx, dx
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, r14d
neg ax
sbb dx, dx
and dx, 8
or bx, dx
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov r8, qword [rsp + 0x460]
neg ax
sbb cx, cx
and cx, bp
or bx, cx
mov rcx, rsi
movzx edx, bx
call fcn.140062c80
lea rcx, [rsp + 0x460]
call fcn.140057768
lea rcx, [rsp + 0x68]
call fcn.140057768
lea rcx, [rsp + 0x58]
call fcn.140057768
lea rcx, [rsp + 0x60]
call fcn.140057768
lea rcx, [rsp + 0x50]
call fcn.140057768
jmp 0x1400d2147
mov eax, dword [r12 + 8]
mov r13d, 1
cmp eax, 3
je 0x1400d2591
cmp eax, r13d
jne 0x1400d25d2
cmp word [rbp], di
jne 0x1400d25d2
mov r9b, byte [rsp + 0x478]
cmp r9b, dil
jne 0x1400d25d2
cmp eax, 3
jne 0x1400d25b2
bt dword [r12 + 0x70], 0x18
jb 0x1400d25c3
cmp eax, r13d
jne 0x1400d25d2
bt dword [r12 + 0x90], 0x18
jae 0x1400d25d2
xor edx, edx
mov rcx, r11
call fcn.14001ce74
mov r11, qword [rsp + 0x40]
lea rcx, [0x14011b008]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d25ff
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x20], dil
mov r8, qword [r12 + 0x38]
lea rcx, [r12 + 0x58]
jmp 0x1400d1e9e
lea rcx, [0x14011b000]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d2624
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r13b
jmp 0x1400d25f0
lea rcx, [0x14011aff8]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d2749
mov rcx, qword [r12 + 0x38]
cmp rcx, rdi
jne 0x1400d26cd
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400d265a
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rbx, 0xffffffff80070057
lea rcx, [rsp + 0xc0]
call fcn.140057768
lea rcx, [rsp + 0xc8]
call fcn.140057768
lea rcx, [rsp + 0xa8]
call fcn.140057768
lea rcx, [rsp + 0xd0]
call fcn.140057768
lea rcx, [rsp + 0x88]
call fcn.140057768
lea rcx, [rsp + 0x98]
call fcn.140057768
mov rax, rbx
mov rbx, qword [rsp + 0x470]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r11, qword [rsp + 0x50]
lea rax, [r12 + 0x58]
mov qword [rsp + 0x140], 3
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x158], r11
mov rax, qword [rcx + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], rdi
cmp rcx, rdi
je 0x1400d273c
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea r9, [rsp + 0x140]
jmp 0x1400d1f86
lea rcx, [0x14011a6b8]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d2888
lea rcx, [0x14011a6c0]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d2888
lea rcx, [0x14011a6c8]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d2888
lea rcx, [0x14011a6a0]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d2888
lea rcx, [0x14011a6ac]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d2888
lea rcx, [0x14011a698]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d2888
lea rcx, [0x14011a6a8]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d2888
lea rcx, [0x14010e8f0]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d287e
lea rcx, [0x14011a690]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
jne 0x1400d287e
mov eax, 9
mov rdx, rsi
mov rcx, r12
cmp dword [r12 + 8], eax
lea rax, [rsp + 0x48]
jne 0x1400d2859
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov r9, r11
mov qword [rsp + 0x20], rbp
call fcn.140099bd4
jmp 0x1400d1eab
mov r10, qword [r12]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa8]
mov r9, rbp
mov r8, r11
mov qword [rsp + 0x20], rax
call qword [r10 + 8]
jmp 0x1400d1eab
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov rbx, qword [r12 + 0x38]
mov rcx, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1400d264f
mov r13, qword [rbx + 0x20]
cmp rcx, rdi
je 0x1400d28b4
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov r11, qword [rsp + 0x40]
mov qword [rsp + 0xe8], r11
mov qword [rsp + 0x110], r12
mov rcx, r13
jmp 0x1400d2009
cmp word [rbp], di
jne 0x1400d28ff
mov rdx, qword [rsp + 0x40]
lea rcx, [rax + 8]
call fcn.14006adb0
mov rdx, qword [r14 + 0x18]
cmp word [rdx], di
je 0x1400d2147
mov r8, qword [rsp + 0x40]
mov rcx, rsi
call fcn.14005ee18
jmp 0x1400d2147
lea rcx, [0x140119f3c]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d29f5
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x460], edi
movzx ecx, word [rax]
mov eax, 9
sub cx, 0x30
cmp cx, ax
ja 0x1400d264a
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.DLL_GetMenu]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.14006ee08
cmp rbx, rdi
je 0x1400d2982
mov eax, dword [rsp + 0x460]
mov edx, dword [r14 + 0x28]
mov rcx, qword [r14 + 0x20]
neg eax
sbb r8d, r8d
not r8d
and r8d, 3
bts r8d, 0xa
call qword [sym.imp.USER32.DLL_EnableMenuItem]
cmp dword [rsp + 0x460], edi
je 0x1400d2991
and byte [r14], 0xfe
jmp 0x1400d2999
mov eax, 1
or byte [r14], al
lea rdx, [r14 + 0x18]
lea rcx, [rsp + 0x460]
call fcn.14006acf8
lea rdx, [0x1401141a8]
lea rcx, [rsp + 0x460]
call fcn.14005fb54
mov rdx, qword [rsp + 0x460]
mov eax, 1
test byte [r14], al
lea rax, [0x140111750]
lea r8, [0x140112368]
cmovne r8, rax
mov rcx, rsi
call fcn.140076fe8
lea rcx, [rsp + 0x460]
jmp 0x1400d2572
lea rcx, [0x14011afec]
mov rdx, rbp
call fcn.140058df4
cmp al, dil
je 0x1400d2147
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x1400d2a25
add rax, 2
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x478]
call fcn.14005fa18
lea rcx, [rsp + 0x468]
call fcn.14005fa18
lea rcx, [rsp + 0x460]
call fcn.14005fa18
mov r13d, 0x2c
lea r8, [rsp + 0x478]
lea r12d, [r13 + 0xf]
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r9d, r12d
mov word [rsp + 0x20], r13w
call fcn.140050f00
lea r8, [rsp + 0x468]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
lea r8, [rsp + 0x460]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
mov r8, qword [r14 + 0x20]
lea rdx, [0x140113490]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x478]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.14005ee18
movzx r8d, word [r14 + 2]
lea rdx, [0x14010e488]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x468]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.14005ee18
mov r8d, dword [r14 + 0x28]
lea rdx, [0x14010e488]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x460]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.14005ee18
lea rcx, [rsp + 0x460]
call fcn.140057768
lea rcx, [rsp + 0x468]
call fcn.140057768
lea rcx, [rsp + 0x478]
jmp 0x1400d2572
lea rcx, [0x14011afe4]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d2f46
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x1400d231b
lea rcx, [rsp + 0x50]
call fcn.14005fa18
lea rcx, [rsp + 0x60]
call fcn.14005fa18
lea rcx, [rsp + 0x58]
call fcn.14005fa18
lea rcx, [rsp + 0x70]
call fcn.14005fa18
lea rcx, [rsp + 0x68]
call fcn.14005fa18
lea rcx, [rsp + 0x478]
call fcn.14005fa18
mov rax, qword [rsp + 0x40]
lea r14d, [rbp - 0x3d]
add rax, r14
mov rbx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x460], rbx
cmp r12w, word [rax]
jne 0x1400d2c1e
add rax, r14
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1400073b0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x460]
cmp word [rax], 0x30
mov r13d, 0x2c
lea r12d, [r13 + 0xf]
jb 0x1400d2c34
cmp word [rax], 0x39
jbe 0x1400d2c3e
mov ecx, 0x28
cmp cx, word [rax]
jne 0x1400d2c8b
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x460], edi
call fcn.14000738c
mov r11d, dword [rsp + 0x460]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x468], r11d
call fcn.14000738c
mov r11d, dword [rsp + 0x460]
mov dword [rsp + 0x46c], r11d
jmp 0x1400d2ccf
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
lea rcx, [rsp + 0x468]
call qword [sym.imp.USER32.DLL_GetCursorPos]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
cmp rbx, rdi
je 0x1400d2d54
lea rdx, [rsp + 0x468]
mov rcx, rbx
call qword [sym.imp.USER32.DLL_ScreenToClient]
mov rax, qword [rsp + 0x478]
mov ebx, edi
mov ebp, 0x10
cmp word [rax], di
je 0x1400d2dac
mov rdx, qword [rsp + 0x68]
cmp word [rdx], di
je 0x1400d2dac
or r9d, 0xffffffff
xor r8d, r8d
mov rcx, rsi
call fcn.14001d7ac
cmp rax, rdi
je 0x1400d2dac
mov rcx, qword [rax]
cmp rcx, rdi
je 0x1400d2d94
mov rax, qword [rcx - 8]
jmp 0x1400d2d97
mov rax, rdi
cmp rax, rbp
jb 0x1400d2dac
mov rdx, qword [rsp + 0x468]
call qword [sym.imp.USER32.DLL_PtInRect]
mov ebx, eax
mov r8, qword [rsp + 0x478]
mov edx, ebx
mov rcx, rsi
call fcn.140062c80
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x58]
mov r12d, 8
lea r8, [rsp + 0x468]
mov rcx, rsi
mov r9d, r12d
mov byte [rsp + 0x28], dil
mov qword [rsp + 0x20], rax
call fcn.14006f520
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x468]
mov rcx, rsi
call fcn.140062c80
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x46c]
mov rcx, rsi
call fcn.140062c80
mov r11, qword [rsp + 0x70]
cmp word [r11], di
je 0x1400d2e84
lea edi, [r12 - 7]
mov ecx, edi
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, ebp
mov bx, ax
shr ebx, 0xf
and bx, di
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
neg ax
sbb cx, cx
and cx, 4
or bx, cx
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
neg ax
sbb cx, cx
and cx, r12w
or bx, cx
mov ecx, r14d
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov r8, qword [rsp + 0x70]
neg ax
sbb cx, cx
and cx, bp
or bx, cx
mov rcx, rsi
movzx edx, bx
call fcn.140062c80
lea rcx, [rsp + 0x478]
call fcn.140057768
lea rcx, [rsp + 0x68]
call fcn.140057768
lea rcx, [rsp + 0x70]
call fcn.140057768
lea rcx, [rsp + 0x58]
call fcn.140057768
lea rcx, [rsp + 0x60]
call fcn.140057768
lea rcx, [rsp + 0x50]
call fcn.140057768
lea rcx, [rsp + 0xc0]
call fcn.140057768
lea rcx, [rsp + 0xc8]
call fcn.140057768
lea rcx, [rsp + 0xa8]
call fcn.140057768
lea rcx, [rsp + 0xd0]
call fcn.140057768
jmp 0x1400d1713
mov rax, qword [rsp + 0x40]
cmp word [rax], di
je 0x1400d2f6d
cmp word [rax], 0x30
jb 0x1400d2f12
cmp word [rax], 0x39
jbe 0x1400d2f6d
add rax, rsi
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14006ee08
cmp eax, edi
jle 0x1400d2f6d
mov edx, dword [rsp + 0x468]
mov ecx, dword [rsp + 0x460]
call qword [sym.imp.USER32.DLL_SetCursorPos]
jmp 0x1400d2f6d
lea rcx, [0x14011afd8]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d2f75
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.1400da8cc
cmp eax, edi
setl dil
mov rbx, rdi
jmp 0x1400d2661
lea rcx, [0x14011afc8]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d2f98
mov byte [rsp + 0x460], dil
mov ebp, 1
jmp 0x1400d2fbd
lea rcx, [0x14011afb8]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d336a
mov ebp, 1
mov byte [rsp + 0x460], bpl
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x478], edi
mov r14d, edi
mov dword [rsp + 0x468], edi
mov dword [rsp + 0x7c], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xa0], r13
call fcn.14005fa18
mov rax, qword [rsp + 0x40]
mov r12d, 0x3b
lea r9d, [r12 - 1]
lea ebx, [r12 - 0x39]
cmp r9w, word [rax]
jne 0x1400d309d
add rax, rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140057738
mov r8, qword [rsp + 0x40]
movzx eax, word [r8]
mov rdx, r8
cmp ax, di
je 0x1400d3065
lea r13d, [r12 - 0xf]
cmp ax, r13w
je 0x1400d3065
cmp ax, r12w
je 0x1400d3065
cmp ax, r9w
je 0x1400d3065
add r8, rbx
mov qword [rsp + 0x40], r8
mov ax, word [r8]
cmp ax, di
jne 0x1400d3042
sub r8, rdx
lea rcx, [rsp + 0x50]
sar r8, 1
call fcn.14005fc80
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400d3088
add r11, rbx
mov qword [rsp + 0x40], r11
lea rdx, [rsp + 0x50]
mov r8b, bpl
mov rcx, rsi
call fcn.140003980
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x1400d31d9
add rax, rbx
lea ebp, [rcx + 0x15]
mov r15, rdi
mov qword [rsp + 0x40], rax
mov r13, rdi
cmp bp, word [rax]
jne 0x1400d3114
add rax, rbx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14006ee08
mov rax, qword [rsp + 0x40]
cmp bp, word [rax]
jne 0x1400d3114
add rax, rbx
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14006ee08
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xb8], rcx
mov ebp, 0x2a
cmp bp, word [rax]
jne 0x1400d312b
add rax, rbx
mov qword [rsp + 0x40], rax
mov r15, rax
jmp 0x1400d312e
mov r13, rax
movzx ecx, word [rax]
cmp cx, di
je 0x1400d3184
mov r8d, 0x3a
cmp bp, cx
jne 0x1400d3156
cmp r13, rdi
jne 0x1400d3156
mov word [rax], di
mov rax, qword [rsp + 0x40]
add rax, rbx
mov r13, rax
jmp 0x1400d3165
cmp cx, r12w
je 0x1400d3174
cmp cx, r8w
je 0x1400d3174
add rax, rbx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, di
je 0x1400d3184
jmp 0x1400d313c
mov word [rax], di
add qword [rsp + 0x40], rbx
mov dword [rsp + 0x7c], 1
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rdx, r13
mov rcx, r15
mov ebp, eax
call qword [sym.imp.USER32.DLL_FindWindowW]
mov rbx, rax
cmp eax, edi
jne 0x1400d3205
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0xb0]
jae 0x1400d31f2
mov edx, dword [rsp + 0xb8]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.14001ec3c
mov rdx, r13
mov rcx, r15
call qword [sym.imp.USER32.DLL_FindWindowW]
mov ebx, eax
cmp eax, edi
je 0x1400d319f
jmp 0x1400d31f2
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x40]
call fcn.14006ee08
mov ebx, dword [rsp + 0x478]
cmp ebx, edi
jne 0x1400d3205
lea rcx, [rsp + 0x50]
call fcn.140057768
jmp 0x1400d265a
mov rdx, qword [rsp + 0x40]
cmp dword [rsp + 0x7c], edi
jne 0x1400d322f
cmp word [rdx], r12w
je 0x1400d3220
mov eax, 0x3a
cmp word [rdx], ax
jne 0x1400d3294
mov eax, 2
add rdx, rax
mov qword [rsp + 0x40], rdx
jmp 0x1400d3234
mov eax, 2
mov ebp, edi
cmp word [rdx], r12w
je 0x1400d3360
mov ecx, 0x3a
cmp word [rdx], cx
je 0x1400d3360
cmp word [rdx], di
je 0x1400d3360
lea r15d, [rcx - 0x17]
cmp r15w, word [rdx]
jne 0x1400d326e
add rdx, rax
mov ebp, 0x5000
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
call fcn.14006ee08
mov r14d, dword [rsp + 0x468]
mov rdx, qword [rsp + 0x40]
cmp eax, edi
jle 0x1400d3294
add r14d, ebp
mov bpl, byte [rsp + 0x460]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x58]
mov rcx, rsi
mov byte [rsp + 0x20], bpl
call fcn.14007c5b4
cmp rax, rdi
jne 0x1400d31f6
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x60], rdi
movsxd rcx, ebx
cmp bpl, dil
jne 0x1400d32ea
mov edx, r14d
call qword [sym.imp.USER32.DLL_PostMessageW]
cdqe
jmp 0x1400d3324
mov rax, qword [rsp + 0x68]
cmp rax, rdi
je 0x1400d331b
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov eax, 2
mov edx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.DLL_SendMessageTimeoutW]
mov rax, qword [rsp + 0x60]
jmp 0x1400d3329
mov edx, r14d
call qword [sym.imp.USER32.DLL_SendMessageW]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x50]
cmp word [rcx], di
je 0x1400d3360
lea rdx, [0x140113988]
lea rcx, [rsp + 0x140]
mov r8, rax
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.14005ee18
lea rcx, [rsp + 0x50]
jmp 0x1400d3772
lea rcx, [0x14011afa8]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d33b6
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x460], rdi
call fcn.1400073b0
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x460]
lea rcx, [0x14012d0c0]
call fcn.140054038
jmp 0x1400d2f6d
lea rcx, [0x14011af9c]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d34c0
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
mov ebx, edi
cmp word [rax], bp
mov r12w, di
lea r13d, [rbp - 0x3d]
sete bl
cmp bx, di
je 0x1400d33f5
add rax, r13
mov qword [rsp + 0x40], rax
mov r14d, pe_nt_image_headers64
cmp r14w, word [rax]
jne 0x1400d340c
add rax, r13
mov r12d, r14d
mov qword [rsp + 0x40], rax
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.14006ee08
cmp dword [rsp + 0x460], edi
movsxd r10, dword [rsp + 0x460]
jle 0x1400d265a
mov rdx, qword [rsp + 0x40]
cmp word [rdx], di
je 0x1400d345f
cmp word [rdx], 0x30
jb 0x1400d3451
cmp word [rdx], 0x39
jbe 0x1400d345f
cmp r14w, word [rdx]
je 0x1400d345f
add rdx, r13
mov qword [rsp + 0x40], rdx
cmp r12w, di
je 0x1400d347c
cmp r14w, word [rdx]
je 0x1400d347c
sub rdx, r13
mov qword [rsp + 0x40], rdx
mov word [rdx], r14w
mov rdx, qword [rsp + 0x40]
cmp bx, di
je 0x1400d3491
sub rdx, r13
mov qword [rsp + 0x40], rdx
mov word [rdx], bp
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsi + 0x40]
cmp rax, rdi
je 0x1400d34a2
mov ecx, dword [rax + 0x288]
jmp 0x1400d34a4
mov ecx, edi
mov dword [rsp + 0x28], ecx
mov r9, rsi
mov r8, rsi
mov rcx, r10
mov qword [rsp + 0x20], rdi
call fcn.1400d00b8
jmp 0x1400d2f6d
lea rcx, [0x14011af94]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d35da
lea rcx, [rsp + 0x70]
call fcn.14005fa18
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x460], edi
call fcn.14005fa18
mov r9d, 0x3a
lea rdx, [rsp + 0x68]
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x40]
call fcn.1400638e8
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400d3520
add r11, 2
mov qword [rsp + 0x40], r11
lea rcx, [rsp + 0x40]
call fcn.140057738
mov rcx, qword [rsp + 0x40]
call fcn.14001ae54
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x40], rax
call fcn.14005fa18
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x468]
lea rdx, [rsp + 0x478]
mov qword [rsp + 0x468], rdi
call fcn.1400d6e38
mov r11, qword [rsp + 0x468]
cmp r11, rdi
je 0x1400d35a7
cmp word [r11], di
je 0x1400d35a7
mov word [r11 - 2], di
mov rdx, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x478]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x460]
mov qword [rsp + 0x20], rdi
call fcn.140008aa4
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
call fcn.14005ee18
lea rcx, [rsp + 0x478]
call fcn.140057768
lea rcx, [rsp + 0x68]
call fcn.140057768
lea rcx, [rsp + 0x70]
jmp 0x1400d3772
lea rcx, [0x14011af88]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d3697
lea rcx, [rsp + 0x40]
call fcn.140057738
mov ebp, 0x3f
mov rcx, qword [rax]
lea r14d, [rbp - 0x3d]
movzx ebx, word [rcx]
cmp bx, bp
jne 0x1400d3615
add qword [rsp + 0x40], r14
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.14006ee08
mov rax, qword [rsp + 0x40]
movsxd r13, dword [rsp + 0x460]
mov r12d, 0x3b
lea r15d, [r12 - 1]
cmp word [rax], r12w
je 0x1400d3653
cmp word [rax], r15w
jne 0x1400d365b
add rax, r14
mov qword [rsp + 0x40], rax
cmp bx, bp
jne 0x1400d265a
lea rcx, [rsp + 0x460]
call fcn.14005fa18
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r15d
mov r8d, r12d
call fcn.1400638e8
mov rcx, r13
call qword [sym.imp.USER32.DLL_IsWindow]
jmp 0x1400d3758
lea rcx, [0x14011af80]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d37b9
lea rcx, [rsp + 0x40]
call fcn.140057738
mov ebp, 0x3f
mov rcx, qword [rax]
lea r14d, [rbp - 0x3d]
movzx ebx, word [rcx]
cmp bx, bp
jne 0x1400d36d2
add qword [rsp + 0x40], r14
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.14006ee08
mov rax, qword [rsp + 0x40]
movsxd r13, dword [rsp + 0x460]
mov r12d, 0x3b
lea r15d, [r12 - 1]
cmp word [rax], r12w
je 0x1400d3710
cmp word [rax], r15w
jne 0x1400d3718
add rax, r14
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x460], edi
jle 0x1400d265a
cmp bx, bp
jne 0x1400d377c
lea rcx, [rsp + 0x460]
call fcn.14005fa18
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r15d
mov r8d, r12d
call fcn.1400638e8
mov rcx, r13
call qword [sym.imp.USER32.DLL_IsWindowEnabled]
mov r8, qword [rsp + 0x460]
mov edx, eax
mov rcx, rsi
call fcn.140062c34
lea rcx, [rsp + 0x460]
call fcn.140057768
jmp 0x1400d2f6d
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x460], 0xfffffc18
call fcn.14006ee08
cmp dword [rsp + 0x460], edi
jl 0x1400d2f6d
mov edx, edi
mov rcx, r13
setne dl
call qword [sym.imp.USER32.DLL_EnableWindow]
jmp 0x1400d2f6d
lea rcx, [rbx + 2]
call fcn.14006059c
cmp al, dil
je 0x1400d3853
lea rcx, [rsp + 0x40]
call fcn.140057738
mov ebp, 0x3f
mov rcx, qword [rax]
movzx ebx, word [rcx]
cmp bx, bp
mov ebp, 2
jne 0x1400d37ef
add qword [rsp + 0x40], rbp
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.14006ee08
mov r8, qword [rsp + 0x40]
movsxd rdx, dword [rsp + 0x460]
mov r12d, 0x3b
cmp word [r8], r12w
je 0x1400d382d
lea eax, [r12 - 1]
cmp word [r8], ax
jne 0x1400d3835
add r8, rbp
mov qword [rsp + 0x40], r8
cmp dword [rsp + 0x460], edi
jle 0x1400d265a
movzx r9d, bx
mov rcx, rsi
call fcn.140079ef4
jmp 0x1400d2f6d
lea rcx, [0x14011af74]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d38a5
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.14000738c
cmp dword [rsp + 0x460], edi
jle 0x1400d265a
movsxd rcx, dword [rsp + 0x460]
mov rdx, qword [rsp + 0x40]
call fcn.14007a120
jmp 0x1400d2f6d
lea rcx, [0x14011af6c]
mov rdx, rbx
call fcn.140058df4
movzx eax, al
mov dword [rsp + 0x460], eax
cmp eax, edi
jne 0x1400d38da
lea rcx, [0x14011af60]
mov rdx, rbx
call fcn.140058df4
cmp al, dil
je 0x1400d2f6d
mov rbp, qword [rsp + 0x40]
mov r11d, 7
lea rcx, [0x14011af58]
mov r8d, r11d
mov rdx, rbp
mov r15, rdi
mov qword [rsp + 0x468], rdi
call fcn.140058db8
cmp al, dil
je 0x1400d3911
add rbp, 0xe
lea r14d, [r11 - 0xb]
jmp 0x1400d397b
lea rcx, [0x14011af50]
mov r8d, r11d
mov rdx, rbp
call fcn.140058db8
cmp al, dil
je 0x1400d3934
add rbp, 0xe
mov r14d, 0xffffffc0
jmp 0x1400d397b
lea rcx, [0x14011af40]
mov r8d, 0xb
mov rdx, rbp
call fcn.140058db8
cmp al, dil
je 0x1400d3954
add rbp, 0x16
jmp 0x1400d3975
lea rcx, [0x14011af38]
mov r8d, 5
mov rdx, rbp
call fcn.140058db8
cmp al, dil
je 0x1400d265a
add rbp, r13
mov r14d, 0xffffffe0
mov r13d, 0x2c
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbp
lea r12d, [r13 + 0xf]
mov r8d, r13d
mov edx, r12d
call fcn.1400579cc
mov rcx, qword [rsp + 0x40]
lea eax, [r13 - 0x2a]
cmp word [rcx], di
je 0x1400d39b0
mov word [rcx], di
add qword [rsp + 0x40], rax
mov ecx, 0x2a
cmp cx, word [rbp]
jne 0x1400d39f6
add rbp, rax
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0xa0], rbp
call fcn.140064048
mov r15, qword [rsp + 0x468]
cmp r15, rdi
je 0x1400d265a
mov rbp, qword [rsp + 0xa0]
jmp 0x1400d3a09
cmp r14d, edi
je 0x1400d265a
cmp word [rbp], di
je 0x1400d265a
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x468], rdi
call fcn.14005fa18
mov rbx, rdi
cmp r15, rdi
jne 0x1400d3adf
mov eax, 0x2e
cmp ax, word [rbp]
jne 0x1400d3a3e
lea rdx, [0x14011af30]
jmp 0x1400d3a56
mov r15d, 0x23
cmp r15w, word [rbp]
jne 0x1400d3a4f
add rbp, 2
lea rdx, [0x14011af28]
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x468]
or r8, r9
call fcn.14005fbd4
lea rdx, [0x14011af00]
lea rcx, [rsp + 0x468]
call fcn.14005fb54
lea rcx, [rsp + 0x468]
mov rdx, rbp
call fcn.14005fb54
mov r8, qword [rsp + 0x468]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.DLL_OpenEventW]
mov rbx, rax
mov r15, rax
cmp rax, rdi
jne 0x1400d3adf
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, 1
cmp eax, edi
cmove eax, ecx
lea rcx, [rsp + 0x478]
mov ebx, eax
call fcn.140057768
lea rcx, [rsp + 0x468]
call fcn.140057768
jmp 0x1400d2661
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140050f00
mov r9, qword [rsp + 0x40]
mov r8, r15
mov edx, r14d
mov rcx, rsi
cmp dword [rsp + 0x460], edi
je 0x1400d3b28
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x20], rax
call fcn.140054f74
jmp 0x1400d3b2d
call fcn.140054e04
mov r8, qword [rsp + 0x478]
mov rbp, rax
cmp word [r8], di
je 0x1400d3b53
lea r9, [0x14010d650]
mov rdx, rax
mov rcx, rsi
call fcn.140062ba8
mov rbp, rdi
cmp rbx, rdi
je 0x1400d3b67
cmp rbx, 0xffffffffffffffff
je 0x1400d3b67
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x478]
call fcn.140057768
lea rcx, [rsp + 0x468]
call fcn.140057768
mov rbx, rbp
jmp 0x1400d2661