Function at 0x14001c680
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x118
lea rbp, [rsp + 0x60]
cmp word [rcx], 0
mov r12, r9
mov esi, r8d
mov r14d, edx
mov r15, rcx
je 0x14001dd16
mov r13, qword [0x1401101f0]
mov eax, dword [0x140117bb0]
mov edi, dword gs:[0x48]
mov qword [rbp + 0x58], r13
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x18], edi
test edx, edx
jne 0x14001c701
lea r8d, [rdx + 7]
lea rdx, str.Blind
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001c701
mov byte [0x140117f20], 1
add r15, 0xe
jmp 0x14001c70d
mov byte [0x140117f20], 0
test r14d, r14d
jne 0x14001c738
mov r8d, 6
lea rdx, [0x1400f1910]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001c738
mov r14d, 2
add r15, 0xc
mov dword [rbp + 0x108], r14d
mov eax, dword [r13 + 0x7c]
mov dword [rbp + 0x4c], eax
mov eax, dword [r13 + 0x84]
mov dword [rbp + 0x50], eax
lea eax, [rsi - 1]
test eax, 0xfffffffd
jne 0x14001c81f
mov rcx, qword [0x140117e10]
test rcx, rcx
je 0x14001c769
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.AHK_Keybd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x140117e10], 0
mov edi, eax
je 0x14001c798
mov qword [0x140117e10], rbx
jmp 0x14001c7a6
test rbx, rbx
je 0x14001c7a6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xb7
je 0x14001c7dd
test r14d, r14d
jne 0x14001c7d0
call fcn.140015b90
test al, al
je 0x14001c7d0
lea rdx, str.Click
mov rcx, r15
call fcn.1400ba7d0
test rax, rax
jne 0x14001c7dd
mov esi, 1
mov dword [rbp + 0x110], esi
jmp 0x14001c81c
cmp esi, 3
jne 0x14001c7ef
mov esi, 2
mov dword [rbp + 0x110], esi
jmp 0x14001c81c
xor eax, eax
mov esi, eax
mov dword [rbp + 0x110], eax
cmp dword [r13 + 0x7c], eax
jge 0x14001c80d
cmp dword [r13 + 0x84], eax
jge 0x14001c80d
mov eax, 0xffffffff
mov dword [r13 + 0x84], eax
mov dword [r13 + 0x7c], 0xffffffff
mov edi, dword [rbp + 0x18]
xor r13d, r13d
mov byte [rbp + 8], 0
mov ebx, r13d
test r12, r12
je 0x14001c881
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x30], eax
mov esi, eax
test eax, eax
je 0x14001c945
cmp eax, dword [0x140116f80]
je 0x14001c945
mov rcx, r12
call fcn.1400c15c0
test al, al
jne 0x14001c945
mov ecx, dword [0x140116f80]
lea r8d, [r13 + 1]
mov edx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov ebx, esi
setne byte [rbp + 8]
jmp 0x14001c945
test byte [0x140117b5e], 0xc0
je 0x14001c92c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140117b54]
cmp eax, 0x32
jae 0x14001c92c
cmp esi, 2
je 0x14001c92c
cmp byte [0x140117f20], bl
jne 0x14001c92c
cmp r14d, 2
je 0x14001c92c
cmp byte [0x140117dd3], bl
je 0x14001c92c
cmp edi, dword [0x140116f80]
jne 0x14001c92c
test r14d, r14d
je 0x14001c9e4
mov r8, r15
test r15, r15
je 0x14001c920
movzx edx, word [r15]
test dx, dx
je 0x14001c920
mov r9d, 0x4c
nop word [rax + rax]
lea rcx, [0x1400f1e18]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x14001c923
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001c900
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14001c8f0
mov r8, r13
test r8, r8
jne 0x14001ca66
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
call fcn.140021890
mov ebx, eax
mov eax, dword [rbp + 0x100]
mov dword [rbp + 0x30], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r9, [0x140117e60]
mov qword [0x140117e58], rax
mov rdx, r9
mov ecx, r13d
mov rdi, rax
mov r8, qword [rdx]
test r8, r8
je 0x14001c980
cmp r8, rdi
je 0x14001cab6
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x14001c964
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, rdi
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.140021900
mov dword [rbx + 8], eax
mov qword [rbx], rdi
mov cl, 1
mov dword [0x140117f00], eax
call fcn.140021320
and byte [0x140117e57], al
movzx ebx, al
cmp qword [0x140113a80], r13
je 0x14001cac6
movzx eax, byte [0x1401149c2]
movzx ecx, byte [0x1401149c0]
movzx r13d, al
and r13b, cl
not al
and al, cl
jmp 0x14001caed
mov r9d, 0x4c
mov rdx, r15
lea r10d, [r9 + 0x2f]
test rdx, rdx
je 0x14001c92c
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001c92c
lea rcx, [0x1400f1e18]
movzx eax, r9w
cmp r8w, ax
je 0x14001ca2c
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001ca13
add rdx, 2
jmp 0x14001c9fa
add rdx, 2
je 0x14001ca66
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001ca66
lea rcx, [0x1400f1e20]
movzx eax, r10w
cmp r8w, ax
je 0x14001ca60
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001ca47
add rdx, 2
jmp 0x14001ca32
cmp word [rdx], r10w
jne 0x14001c9f1
mov ebx, 0x8000
nop dword [rax + rax]
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
jne 0x14001ca94
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x14001c92c
mov edx, 1
mov dword [0x1401101e4], r13d
mov ecx, 0x8000012f
call fcn.140001b10
mov dword [0x1401101e4], 1
jmp 0x14001ca70
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x14001c9a3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140117b54]
cmp eax, dword [0x140111c34]
jae 0x14001cae5
movzx ecx, byte [0x140117b5e]
and cl, bl
jmp 0x14001cae7
xor cl, cl
movzx r13d, cl
xor al, al
not r13b
mov byte [rbp + 3], cl
and r13b, byte [0x140117e56]
and r13b, bl
mov byte [rbp + 6], al
cmp byte [0x140117f20], 0
mov byte [rbp + 0x100], r13b
mov byte [0x140117e56], r13b
je 0x14001cb30
not r13b
mov byte [rbp + 0x100], bl
and r13b, bl
mov byte [rbp + 2], bl
mov byte [rbp + 4], r13b
movzx r13d, bl
jmp 0x14001cb39
xor al, al
mov byte [rbp + 2], r13b
mov byte [rbp + 4], al
mov rax, qword [rbp + 0x58]
cmp byte [rax + 0x133], 0
je 0x14001cb66
cmp byte [0x140117f20], 0
jne 0x14001cb66
cmp r14d, 2
je 0x14001cb66
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140020960
mov dword [rbp + 0x2c], eax
jmp 0x14001cb6b
xor edx, edx
mov dword [rbp + 0x2c], edx
mov ecx, dword [rbp + 0x110]
mov eax, 0x1f4
mov dword [0x140117f14], ecx
mov esi, 0x5dc
test ecx, ecx
je 0x14001cc11
cmp ecx, 1
mov edx, 0x2ee0
cmovne eax, esi
mov dword [0x140117f08], eax
mov eax, 0x4e20
cmovne eax, edx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001cbb5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400d7ad0
mov rax, qword [0x140112a10]
sub rsp, rcx
mov byte [0x140117f10], bl
xor ebx, ebx
mov byte [0x140117f11], 0
mov dword [0x140117f04], ebx
lea rcx, [rsp + 0x60]
mov byte [0x140117f12], bl
mov qword [rax], rcx
mov ecx, dword [rbp + 0x110]
mov dword [0x140117f18], 0x80000000
mov dword [0x140117f1c], 0x80000000
mov byte [0x140117f13], 1
jmp 0x14001cc13
xor ebx, ebx
mov eax, dword [reloc.WSOCK32.dll_inet_ntoa]
movzx r14d, byte [0x140113b32]
add eax, 0xfffffff8
mov byte [rbp + 0x10], r14b
test eax, 0xfffffffd
jne 0x14001cc50
test ecx, ecx
jne 0x14001cc50
test r12, r12
jne 0x14001cc50
lea ecx, [r12 + 1]
mov byte [rbp + 9], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140113b32], 1
jmp 0x14001cc54
mov byte [rbp + 9], 0
xor dil, dil
cmp word [r15], 0
mov byte [rbp], dil
je 0x14001dada
lea rsi, [0x140000000]
jmp 0x14001cc72
xor ebx, ebx
xor r14b, r14b
cmp dword [0x140117f14], 0
mov byte [rbp + 5], r14b
jne 0x14001cce0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1401101f0]
sub eax, dword [0x140117bb4]
cmp eax, dword [rcx + 0x118]
jbe 0x14001cce0
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp + 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001ccd4
mov edx, 1
mov dword [0x1401101e4], ebx
lea ecx, [rdx - 2]
call fcn.140001b10
mov dword [0x1401101e4], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140117bb4], eax
mov eax, dword [rbp + 0x108]
test eax, eax
jne 0x14001d9b2
movzx edx, word [r15]
lea rcx, [0x1400f1e28]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x14001da1d
movzx eax, word [r15]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x14001cd2c.38
cdqe
movzx eax, byte [rsi + rax + 0x1dd48]
mov ecx, dword [rsi + rax*4 + 0x1dd2c]
add rcx, rsi
jmp rcx
test r13b, 3
jne case.0x14001cd2c.38
or dil, 1
jmp 0x14001daa8
test r13b, 0x30
jne case.0x14001cd2c.38
or dil, 0x10
jmp 0x14001daa8
test r13b, 0xc
jne case.0x14001cd2c.38
or dil, 4
jmp 0x14001daa8
test r13b, 0xc0
jne case.0x14001cd2c.38
or dil, 0x40
jmp 0x14001daa8
lea rbx, [r15 + 2]
mov edx, 0x7d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov qword [rbp + 0x40], rax
mov rsi, rax
test rax, rax
je case.0x14001cd2c.38
mov r15, rbx
nop
movzx ecx, word [r15]
cmp cx, 0x20
je 0x14001cdb0
cmp cx, 9
jne 0x14001cdb6
add r15, 2
jmp 0x14001cda0
mov r12, rax
sub r12, r15
sar r12, 1
jne 0x14001ce6a
lea rbx, [rax + 2]
movzx eax, word [rax + 2]
cmp ax, 0x7d
jne 0x14001cde5
mov rsi, rbx
mov qword [rbp + 0x40], rbx
mov r12d, 1
jmp 0x14001ce6a
cmp ax, 0x20
je 0x14001ce01
cmp ax, 9
jne 0x14001d2b6
cmp ax, 0x20
je 0x14001ce01
cmp ax, 9
jne 0x14001ce0b
movzx eax, word [rbx + 2]
add rbx, 2
jmp 0x14001cdf5
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14001ce43
mov r8d, 2
lea rdx, [0x1400f0818]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001d2b6
mov edx, 0x7d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov qword [rbp + 0x40], rax
mov rsi, rax
test rax, rax
je case.0x14001cd2c.38
mov r12, rax
sub r12, r15
sar r12, 1
mov r8d, 5
lea rdx, [0x1400eeaa0]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001cf67
xor edx, edx
lea rcx, [r15 + 0xa]
mov word [rsi], dx
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001cea0
cmp ax, 9
jne 0x14001cea6
add rcx, 2
jmp 0x14001ce91
lea rax, [rbp + 7]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 1]
lea rax, [rbp + 0x14]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x20]
lea rax, [rbp + 0xc]
lea rdx, [rbp + 0x24]
mov qword [rsp + 0x20], rax
call fcn.14001ed40
mov ecx, dword [rbp + 0x14]
mov eax, 0x7d
mov word [rsi], ax
cmp ecx, 1
jge 0x14001cf15
mov rax, qword [rbp + 0x58]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x24]
movzx r9d, byte [rax + 0x12f]
movzx eax, byte [rbp + 7]
mov byte [rsp + 0x20], al
call fcn.14001fbb0
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
movzx eax, byte [rbp + 7]
xor edx, edx
mov r15, qword [rbp + 0x118]
movzx r9d, r13b
mov byte [rsp + 0x50], al
movzx r8d, dil
mov eax, dword [rbp + 0x20]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x24]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0xc]
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
movzx ecx, byte [rbp + 1]
call fcn.14001ddb0
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
mov r8d, 3
lea rdx, [0x1400f1e38]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001cf9c
mov r15, qword [rbp + 0x40]
mov r14d, 1
mov dword [rbp + 0x108], r14d
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
mov r8d, 4
lea rdx, str.Text
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001cff9
lea rcx, [r15 + 8]
nop word [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001cfcf
cmp ax, 9
jne 0x14001cfd5
add rcx, 2
jmp 0x14001cfc0
cmp rcx, rsi
jne 0x14001d2b6
mov r15, qword [rbp + 0x40]
mov r14d, 2
mov dword [rbp + 0x108], r14d
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
xor edi, edi
mov dword [rbp + 0xc], 2
mov word [rsi], di
mov eax, 1
movzx edx, word [r15]
mov r13, r12
mov dword [rbp + 0x14], eax
mov r14, r15
test dx, dx
je 0x14001d050
nop dword [rax]
lea rcx, [0x1400f16e0]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14001d083
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001d030
movzx edx, word [r14 + 2]
add r14, 2
test dx, dx
jne 0x14001d020
mov r14, rdi
mov rax, qword [0x140117e58]
lea rdx, [rbp]
mov r8b, 1
mov qword [rsp + 0x20], rax
mov rcx, r15
call fcn.140021fa0
mov byte [rbp + 1], al
movzx edi, al
test al, al
je 0x14001d151
xor eax, eax
jmp 0x14001d1d1
movzx eax, word [r14]
lea rbx, [r14 + 2]
mov r13, r14
mov word [rbp + 0x1c], ax
sub r13, r15
mov word [r14], di
sar r13, 1
nop dword [rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14001d0af
cmp ax, 9
jne 0x14001d0b5
add rbx, 2
jmp 0x14001d0a0
mov rax, rsi
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14001d053
mov r8d, 4
lea rdx, str.Down
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001d121
lea r8d, [rax + 4]
mov dword [rbp + 0xc], edi
lea rdx, str.Temp
lea rcx, [rbx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001d100
mov dword [rbp + 0x28], edi
jmp 0x14001d053
cmp word [rbx + 8], 0x52
mov ecx, edi
sete cl
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
test eax, eax
mov ebx, edi
setne bl
inc ebx
mov dword [rbp + 0x28], ebx
jmp 0x14001d053
lea rdx, [0x1400f0818]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14001d141
mov dword [rbp + 0xc], 1
jmp 0x14001d053
mov rcx, rbx
call fcn.14001c140
mov dword [rbp + 0x14], eax
jmp 0x14001d053
xor edx, edx
mov rcx, r15
call fcn.140021e80
movzx esi, ax
test ax, ax
jne 0x14001d1d4
mov r8d, 2
lea rdx, [0x1400f173c]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001d1d4
lea rcx, [r15 + 4]
lea r8d, [rax + 0x10]
lea rdx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov rcx, qword [rbp + 0x38]
lea rdx, [0x1400f1fa8]
mov r8d, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001d1d4
mov rcx, qword [rbp + 0x38]
lea r8d, [rax + 0x10]
add rcx, 4
lea rdx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov rcx, qword [rbp + 0x38]
cmp word [rcx], si
jne 0x14001d1d4
movzx edi, bl
mov byte [rbp + 1], bl
movzx esi, ax
test r14, r14
je 0x14001d1e1
movzx eax, word [rbp + 0x1c]
mov word [r14], ax
mov rax, qword [rbp + 0x40]
mov ecx, 0x7d
mov ebx, dword [rbp + 0x14]
mov word [rax], cx
cmp ebx, 1
jl 0x14001d2ae
test dil, dil
jne 0x14001d802
test si, si
jne 0x14001d802
movzx ecx, byte [r15]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
je 0x14001d347
cmp r13, 1
jbe 0x14001d34b
cmp dword [0x140117f14], 0
je 0x14001d2c4
mov rcx, r15
call fcn.14001c140
mov ecx, dword [0x140117f08]
cmp dword [0x140117f04], ecx
mov ebx, eax
jne 0x14001d255
call fcn.140020280
test eax, eax
je 0x14001d2ae
cmp dword [0x140117f14], 1
jne 0x14001d28f
mov rax, qword [0x140114a98]
mov ecx, dword [0x140117f04]
lea rdx, [rcx + rcx*4]
lea rcx, [rax + rdx*8]
xor edx, edx
mov dword [rcx], 1
or byte [0x140117f11], 1
mov qword [rcx + 8], rdx
mov dword [rcx + 0x10], edx
mov qword [rcx + 0x18], rbx
jmp 0x14001d2a8
mov rax, qword [0x140112a10]
mov edx, dword [0x140117f04]
mov rcx, qword [rax]
xor eax, eax
mov dword [rcx + rdx*8], eax
mov dword [rcx + rdx*8 + 4], ebx
inc dword [0x140117f04]
movzx r13d, byte [rbp + 0x100]
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
xor eax, eax
mov dword [0x1401101e4], eax
mov eax, dword [rbp + 0x18]
cmp dword [0x140116f80], eax
je 0x14001d313
mov rcx, r15
call fcn.14001c140
test eax, eax
js 0x14001d313
mov rcx, r15
call fcn.14001c140
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r13d, byte [rbp + 0x100]
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
mov dword [0x1401101e4], 1
jmp 0x14001daa5
mov rcx, r15
call fcn.14001c140
mov ecx, eax
mov edx, 1
call fcn.140001b10
movzx r13d, byte [rbp + 0x100]
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
mov dword [0x1401101e4], 1
jmp 0x14001daa5
cmp r13, 1
jne 0x14001d3ca
mov r14d, dword [rbp + 0xc]
cmp r14d, 1
je 0x14001d2ae
mov r14, qword [rbp + 0x118]
test r14, r14
je 0x14001d3a1
test ebx, ebx
jle 0x14001d2ae
nop
movzx r8d, word [r15]
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
sub rbx, 1
jne 0x14001d370
movzx r13d, byte [rbp + 0x100]
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
movzx r8d, byte [rbp]
mov edx, ebx
movzx r13d, byte [rbp + 0x100]
movzx ecx, word [r15]
or r8b, r13b
call fcn.14001e010
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
mov r14, qword [rbp + 0x118]
lea r9, [rbp + 2]
test r14, r14
lea r8, [rbp + 0xc]
mov rdx, r12
mov rcx, r15
sete al
mov byte [rsp + 0x20], al
call fcn.1400222d0
mov byte [rbp + 1], al
movzx edi, al
test al, al
je 0x14001d587
mov esi, dword [rbp + 0xc]
test r14, r14
jne 0x14001d48f
test esi, esi
jne 0x14001d411
mov byte [rbp + 5], al
jmp 0x14001d48f
cmp dword [0x140117e50], 0
jne 0x14001d48f
cmp byte [0x140117e55], dil
je 0x14001d48f
cmp byte [0x140117f20], 0
jne 0x14001d48f
movzx ecx, byte [0x140117e54]
lea eax, [rdi - 0x5b]
cmp al, 1
ja 0x14001d44a
lea eax, [rcx - 0x5b]
cmp al, 1
ja 0x14001d44a
cmp dword [0x140117f14], 2
jne 0x14001d467
cmp dil, 0xa4
je 0x14001d45f
cmp dil, 0xa5
jne 0x14001d48f
cmp dword [0x140117f00], 3
je 0x14001d48f
add cl, 0x5c
cmp cl, 1
ja 0x14001d48f
movzx r8d, word [0x140111c38]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.14001e530
cmp dword [0x140117f14], 0
je 0x14001d4a1
movzx eax, byte [0x140117f10]
jmp 0x14001d4a8
xor ecx, ecx
call fcn.140021320
movzx r13d, byte [rbp + 2]
xor r9d, r9d
movzx ecx, r13b
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r14
mov byte [rsp + 0x20], 0
movzx edx, al
mov byte [rbp + 0x100], r13b
call fcn.140020ab0
test ebx, ebx
jle 0x14001d2b6
xor r13d, r13d
nop
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
mov r9, r14
mov byte [rsp + 0x20], 1
movzx edx, dil
mov ecx, esi
call fcn.14001e530
cmp dword [0x140117f14], r13d
jne 0x14001d567
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1401101f0]
sub eax, dword [0x140117bb4]
cmp eax, dword [rcx + 0x118]
jbe 0x14001d567
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, [rbp + 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001d55b
mov edx, 1
mov dword [0x1401101e4], r13d
lea ecx, [rdx - 2]
call fcn.140001b10
mov dword [0x1401101e4], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140117bb4], eax
sub rbx, 1
jne 0x14001d4e0
movzx r13d, byte [rbp + 0x100]
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
cmp r12, 4
jbe 0x14001d625
mov r8d, 4
lea rdx, str.ASC
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001d625
test r14, r14
jne 0x14001d625
lea rcx, [r15 + 6]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001d5c3
cmp ax, 9
jne 0x14001d5c9
add rcx, 2
jmp 0x14001d5b4
call fcn.14001e200
cmp dword [0x140117f14], 2
mov rax, qword [0x1401101f0]
jne 0x14001d603
mov ecx, dword [rax + 0x80]
call fcn.1400205c0
movzx r13d, byte [rbp + 2]
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
mov byte [rbp + 0x100], r13b
jmp 0x14001daa5
mov ecx, dword [rax + 0x7c]
call fcn.1400205c0
movzx r13d, byte [rbp + 2]
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
mov byte [rbp + 0x100], r13b
jmp 0x14001daa5
cmp r12, 2
jbe 0x14001d60b
mov r8d, 2
lea rdx, [0x1400f1e5c]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14001d60b
lea rcx, [r15 + 4]
xor edx, edx
lea r8d, [rax + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
cmp eax, 0x10000
jb 0x14001d688
add eax, 0xffff0000
mov edx, 0x3ff
mov ecx, eax
movzx ebx, ax
shr ecx, 0xa
and bx, dx
and cx, dx
mov r8d, 0x2800
sub cx, r8w
mov edx, 0x2400
sub bx, dx
jmp 0x14001d68f
xor edx, edx
movzx ecx, ax
mov ebx, edx
movzx r13d, byte [rbp + 2]
mov byte [rbp + 0x100], r13b
test r14, r14
je 0x14001d6d8
movzx r8d, cx
xor r9d, r9d
mov rcx, r14
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
test bx, bx
je 0x14001d7c3
movzx r8d, bx
xor r9d, r9d
mov edx, 0x102
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001d7c3
cmp dword [0x140117f14], 2
je 0x14001d70b
movzx edi, byte [rbp]
or dil, r13b
movzx edx, dil
call fcn.14001c3e0
test bx, bx
je 0x14001d7c3
movzx edx, dil
movzx ecx, bx
call fcn.14001c3e0
jmp 0x14001d7c3
mov ecx, gethostbyaddr
lea rdx, [rbp + 0x6a]
mov word [rbp + 0x68], cx
lea r8d, [rcx - 0x26]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
cmp dword [0x140117f14], 0
je 0x14001d736
movzx eax, byte [0x140117f10]
jmp 0x14001d73d
xor ecx, ecx
call fcn.140021320
movzx ecx, al
mov dword [rsp + 0x28], 0xffc3d44f
and cl, 0xc4
mov byte [rsp + 0x20], 1
or cl, 4
xor r9d, r9d
xor r8d, r8d
movzx edx, al
call fcn.140020ab0
movzx eax, word [rbp + 0x68]
lea rbx, [rbp + 0x68]
cmp ax, 0x30
jb 0x14001d7a5
nop
cmp ax, 0x39
ja 0x14001d7a5
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
add al, 0x30
mov byte [rsp + 0x20], r8b
xor r9d, r9d
movzx edx, al
lea ecx, [r8 + 2]
call fcn.14001e530
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x30
jae 0x14001d770
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 1]
call fcn.14001e530
cmp dword [0x140117f14], 2
mov rax, qword [0x1401101f0]
jne 0x14001d7ec
mov ecx, dword [rax + 0x80]
call fcn.1400205c0
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
mov ecx, dword [rax + 0x7c]
call fcn.1400205c0
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
xor r8d, r8d
movzx edx, si
movzx ecx, dil
call fcn.140021580
mov r15, qword [rbp + 0x118]
movzx ebx, al
mov r14d, dword [rbp + 0xc]
test al, al
je 0x14001d95d
test r15, r15
jne 0x14001d95d
test r14d, r14d
jne 0x14001d888
mov eax, dword [rbp + 0x28]
mov byte [rbp + 5], dil
cmp eax, 1
jne 0x14001d862
movzx r13d, byte [rbp + 0x100]
or byte [0x140117e56], bl
or r13b, bl
mov byte [rbp + 0x100], r13b
mov byte [rbp + 2], r13b
jmp 0x14001d965
cmp eax, 2
jne 0x14001d86d
or byte [0x140117e57], bl
movzx r13d, byte [rbp + 0x100]
or r13b, bl
mov byte [rbp + 0x100], r13b
mov byte [rbp + 2], r13b
jmp 0x14001d965
cmp r14d, 1
jne 0x14001d95d
cmp dword [0x140117e50], 0
jne 0x14001d912
cmp byte [0x140117e55], dil
je 0x14001d912
cmp byte [0x140117f20], 0
jne 0x14001d912
movzx ecx, byte [0x140117e54]
lea eax, [rdi - 0x5b]
cmp al, r14b
ja 0x14001d8cd
lea eax, [rcx - 0x5b]
cmp al, r14b
ja 0x14001d8cd
cmp dword [0x140117f14], 2
jne 0x14001d8ea
cmp dil, 0xa4
je 0x14001d8e2
cmp dil, 0xa5
jne 0x14001d912
cmp dword [0x140117f00], 3
je 0x14001d912
add cl, 0x5c
cmp cl, 1
ja 0x14001d912
movzx r8d, word [0x140111c38]
xor r9d, r9d
movzx edx, byte [reloc.OLEAUT32.dll_SafeArrayGetElemsize]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
lea ecx, [r9 + 2]
call fcn.14001e530
movzx ecx, byte [rbp + 4]
movzx eax, bl
not al
and byte [0x140117e57], al
and cl, al
movzx r13d, al
mov byte [rbp + 4], cl
and r13b, byte [0x140117e56]
mov byte [0x140117e56], r13b
cmp dil, 0xa5
jne 0x14001d94d
cmp dword [0x140117f00], 3
jne 0x14001d94d
and cl, 0xfe
mov byte [rbp + 4], cl
or r13b, cl
mov byte [rbp + 0x100], r13b
mov byte [rbp + 2], r13b
jmp 0x14001d965
movzx r13d, byte [rbp + 0x100]
mov eax, dword [rbp + 0x14]
movzx r9d, r13b
movzx r8d, byte [rbp]
movzx edx, si
mov byte [rsp + 0x50], 0
movzx ecx, dil
mov dword [rsp + 0x48], 0x80000000
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call fcn.14001ddb0
mov r15, qword [rbp + 0x40]
movzx r14d, byte [rbp + 5]
jmp 0x14001daa5
cmp eax, 2
jne 0x14001da23
movzx ecx, word [r15]
sub ecx, 8
je 0x14001da16
sub ecx, 1
je 0x14001da0f
sub ecx, 1
je 0x14001da08
sub ecx, 3
je 0x14001d9fa
mov byte [rbp + 1], 0
movzx ecx, word [r15]
test r12, r12
je 0x14001da94
movzx r8d, cx
xor r9d, r9d
mov rcx, r12
mov edx, 0x102
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001daa5
cmp word [r15 + 2], 0xa
lea rax, [r15 + 2]
cmove r15, rax
mov al, 0xd
mov byte [rbp + 1], al
jmp 0x14001da53
mov al, 9
mov byte [rbp + 1], al
jmp 0x14001da53
mov al, 8
mov byte [rbp + 1], al
jmp 0x14001da53
mov eax, dword [rbp + 0x108]
or dil, r13b
je 0x14001da31
test eax, eax
jne 0x14001da31
mov r9b, 1
jmp 0x14001da34
xor r9d, r9d
mov r8, qword [0x140117e58]
lea rdx, [rbp]
movzx ecx, word [r15]
call fcn.1400220d0
movzx edi, byte [rbp]
mov byte [rbp + 1], al
test al, al
je 0x14001d9d3
xor edx, edx
movzx r9d, r13b
mov byte [rsp + 0x50], dl
movzx r8d, dil
mov dword [rsp + 0x48], 0x80000000
movzx ecx, al
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
call fcn.14001ddb0
jmp 0x14001daa5
or dil, r13b
mov edx, 1
movzx r8d, dil
call fcn.14001e010
xor dil, dil
mov byte [rbp], dil
mov r12, qword [rbp + 0x118]
lea rsi, [0x140000000]
add r15, 2
mov byte [0x140117e55], r14b
cmp word [r15], 0
jne 0x14001cc70
movzx r14d, byte [rbp + 0x10]
mov esi, 0x5dc
cmp dword [0x140117f14], 0
je 0x14001db92
cmp byte [0x140117f12], 0
mov ebx, 0xffffffff
mov dword [rbp + 0x100], ebx
jne 0x14001db5a
cmp dword [0x140117f04], 0
jbe 0x14001db5a
cmp byte [0x140117f20], 0
je 0x14001db11
xor bl, bl
jmp 0x14001db1a
movzx ebx, byte [rbp + 6]
not bl
and bl, byte [rbp + 3]
or bl, byte [0x140117e57]
mov r9b, 1
movzx edx, byte [0x140117f10]
or bl, r13b
movzx ecx, bl
mov dword [rsp + 0x28], 0xffc3d44d
xor r8d, r8d
mov byte [rsp + 0x20], 1
call fcn.140020ab0
movzx edx, bl
lea rcx, [rbp + 0x100]
call fcn.140020360
mov ebx, dword [rbp + 0x100]
cmp dword [0x140117f14], 1
mov eax, 0x1f4
cmove esi, eax
cmp dword [0x140117f08], esi
jbe 0x14001db7e
mov rcx, qword [0x140114a98]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edi, edi
mov ecx, ebx
mov dword [0x140117f14], edi
call fcn.1400205c0
jmp 0x14001dc31
cmp qword [0x140113a80], 0
je 0x14001dba9
movzx ecx, byte [0x1401149c0]
movzx edx, byte [rbp + 3]
jmp 0x14001dbd5
cmp dword [0x140111c34], 0
jl 0x14001dbce
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140117b54]
cmp eax, dword [0x140111c34]
jb 0x14001dbce
movzx edx, byte [rbp + 3]
xor cl, cl
jmp 0x14001dbd5
movzx edx, byte [rbp + 3]
movzx ecx, dl
or cl, byte [0x140117e57]
cmp byte [0x140117f20], 0
je 0x14001dbf9
movzx eax, cl
xor al, dl
movzx ebx, al
and al, cl
and bl, dl
not bl
and bl, r13b
or bl, al
jmp 0x14001dc04
movzx ebx, byte [rbp + 6]
not bl
and bl, cl
or bl, r13b
xor ecx, ecx
call fcn.140021320
or al, byte [0x140113b6b]
mov r9b, 1
movzx edx, al
mov dword [rsp + 0x28], 0xffc3d44d
mov r8, r12
mov byte [rsp + 0x20], 1
movzx ecx, bl
call fcn.140020ab0
xor edi, edi
cmp qword [0x140113a80], 0
je 0x14001dc57
movzx ecx, byte [0x1401149c1]
movzx eax, cl
xor al, byte [0x1401149c2]
and al, cl
not al
and cl, al
mov byte [0x1401149c1], cl
cmp dword [rbp + 0x2c], 1
jne 0x14001dc69
mov edx, 1
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140020960
cmp byte [rbp + 8], 0
je 0x14001dc81
mov edx, dword [rbp + 0x30]
xor r8d, r8d
mov ecx, dword [0x140116f80]
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rbp + 9], 0
je 0x14001dc9b
test r14b, r14b
jne 0x14001dc9b
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140113b32], r14b
mov eax, dword [rbp + 0x110]
test eax, eax
jne 0x14001dcc8
mov eax, dword [rbp + 0x48]
cmp dword [0x140117bb0], eax
je 0x14001dd03
call fcn.140005280
test eax, eax
je 0x14001dd03
mov edx, 1
lea ecx, [rdx - 2]
call fcn.140001b10
jmp 0x14001dd03
cmp eax, 1
jne 0x14001dd03
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140116f80]
jne 0x14001dd03
mov edx, 1
mov dword [0x1401101e4], edi
lea ecx, [rdx - 2]
call fcn.140001b10
mov dword [0x1401101e4], 1
mov rax, qword [rbp + 0x58]
mov ecx, dword [rbp + 0x4c]
mov dword [rax + 0x7c], ecx
mov ecx, dword [rbp + 0x50]
mov dword [rax + 0x84], ecx
lea rsp, [rbp + 0xb8]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret