Function at 0x140001a10
Capabilities:
Check for foreground window switch
Check for software breakpoints
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x23b8]
mov eax, 0x24b8
call fcn.1401119a0
sub rsp, rax
movaps xmmword [rsp + 0x24a0], xmm6
mov ebx, edx
mov byte [rsp + 0x49], 0
mov r15d, ecx
mov esi, 1
cmp edx, 2
jne 0x140001a70
cmp byte [0x14016057f], 0
mov ebx, esi
mov dword [rbp + 0x2408], ebx
jne 0x140001a70
mov byte [0x14016057f], bl
mov byte [rsp + 0x49], bl
xor edi, edi
cmp dword [0x140164974], edi
je 0x140001aaa
cmp qword [0x140164958], rdi
je 0x140001a97
mov rcx, qword [0x140164948]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140164958], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140164974], edi
mov qword [0x140164948], rdi
cmp r15d, 0x8000012f
jne 0x140001acc
mov r15d, 0xa
mov byte [rbp + 0x2410], sil
mov dword [rbp + 0x2400], r15d
mov dword [rbp - 0x60], edi
jmp 0x140001ae9
cmp r15d, 5
setle al
mov byte [rbp + 0x2410], al
jg 0x140001ae0
mov dword [rbp - 0x60], edi
jmp 0x140001ae9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x60], eax
cmp dword [0x140161784], edi
je 0x140001af6
call fcn.140004de0
xor r12b, r12b
cmp dword [0x14016484c], edi
mov dword [rsp + 0x44], r12d
je 0x140001b1a
call fcn.140004970
test al, al
movzx r12d, r12b
cmovne r12d, esi
mov dword [rsp + 0x44], r12d
test r15d, r15d
jle 0x140001b5b
cmp ebx, esi
jne 0x140001b5b
inc dword [0x140160768]
cmp byte [0x14016057e], dil
mov byte [rsp + 0x4a], sil
jne 0x140001b60
mov rcx, qword [0x140160760]
xor r9d, r9d
lea edx, [r9 + 9]
lea r8d, [r9 + 0xa]
call qword [sym.imp.USER32.dll_SetTimer]
test rax, rax
setne byte [0x14016057e]
jmp 0x140001b60
mov byte [rsp + 0x4a], dil
mov byte [rsp + 0x5c], dil
lea rbx, [rbp + 0xa0]
mov byte [rsp + 0x48], dil
mov dword [rsp + 0x40], edi
mov edi, 6
nop word [rax + rax]
mov rcx, rbx
call fcn.140005c00
add rbx, 0x20
sub rdi, rsi
jne 0x140001b80
mov rbx, qword [rbp + 0x2410]
xorps xmm6, xmm6
mov r14, qword [rbp + 0x2410]
mov edi, dword [rbp + 0x2400]
mov r13, qword [rbp + 0x2410]
movsxd rax, r15d
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x68], rax
mov eax, dword [rbp + 0x2400]
mov dword [rsp + 0x64], eax
mov eax, dword [rbp + 0x2400]
mov dword [rbp - 0x18], eax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x20], rax
movzx eax, byte [rbp + 0x2400]
mov byte [rbp + 0x2418], al
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], edi
movsxd rbx, r15d
jmp 0x140001c5d
mov r15d, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
jmp 0x140001c70
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c65
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test rbx, rbx
jle 0x140001d42
cmp byte [rsp + 0x48], 0
jne 0x140001d42
cmp byte [0x14016057f], 0
jne 0x140001d4f
cmp dword [0x14015bc04], 0
je 0x140001cf8
cmp dword [0x1401605bc], 0
jne 0x140001cf8
mov rcx, qword [0x14015bc10]
cmp byte [rcx + 0x12c], 0
jne 0x140001cef
cmp byte [rcx + 0x12e], 0
jne 0x140001cef
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001cef
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14015bc10]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001cef
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140001cfa
xor eax, eax
test eax, eax
lea rcx, [rsp + 0x68]
mov eax, 0
mov r9d, 0x311
cmovne r9d, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x140001c70
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
jbe 0x140002046
mov dword [0x1401648c0], eax
jmp 0x140002046
cmp byte [0x14016057f], 0
je 0x140001f15
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140001f15
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140163c90]
jne 0x140001f15
cmp dword [0x14016075c], 0
je 0x140001dc7
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
xor edi, edi
lea rdx, [rbp + 0x1a0]
mov ecx, edi
lea r8, str.32770
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140001dc9
cmp rcx, 7
jne 0x140001db0
jmp 0x140001e20
xor edi, edi
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x140001f15
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysTreeView32
lea rcx, [rbp + 0x1a0]
call fcn.1400f55a0
test eax, eax
je 0x140001e20
lea rdx, str.SysListView32
lea rcx, [rbp + 0x1a0]
call fcn.1400f55a0
test eax, eax
jne 0x140001f15
cmp dword [0x14015bc04], 0
je 0x140001e7f
cmp dword [0x1401605bc], 0
jne 0x140001e7f
mov rcx, qword [0x14015bc10]
cmp byte [rcx + 0x12c], 0
jne 0x140001e76
cmp byte [rcx + 0x12e], 0
jne 0x140001e76
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001e76
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14015bc10]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001e76
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140001e81
mov eax, edi
test eax, eax
mov dword [rsp + 0x20], edi
mov eax, 0xffffffff
lea rcx, [rsp + 0x68]
mov ebx, 0x311
mov r9d, 0x1ff
cmovne ebx, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edx, edx
lea rcx, [rsp + 0x68]
mov r9d, ebx
mov r8d, 0x20e
test eax, eax
je 0x140001f90
mov edi, dword [rbp - 0x78]
xor eax, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140001ee0
mov r9d, 0x1ff
jmp 0x140001f86
mov eax, dword [rbp - 0x78]
lea rcx, [rsp + 0x68]
sub eax, edi
xor edx, edx
test eax, eax
mov eax, 1
mov dword [rsp + 0x20], eax
jle 0x140001f07
mov r9d, 0x1ff
xor r8d, r8d
jmp 0x140001f99
mov r9d, ebx
mov r8d, 0x20e
jmp 0x140001f99
cmp dword [0x14015bc04], 0
je 0x140001f76
cmp dword [0x1401605bc], 0
jne 0x140001f76
mov rcx, qword [0x14015bc10]
cmp byte [rcx + 0x12c], 0
jne 0x140001f6b
cmp byte [rcx + 0x12e], 0
jne 0x140001f6b
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001f6b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14015bc10]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001f6b
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
xor edi, edi
jmp 0x140001f7a
xor edi, edi
mov eax, edi
test eax, eax
mov r9d, 0x311
cmovne r9d, edi
xor r8d, r8d
lea rcx, [rsp + 0x68]
xor edx, edx
mov eax, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14000203f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x1401648c0]
mov ecx, eax
sub ecx, esi
movsxd rbx, r15d
cmp ecx, 3
cmova edx, eax
mov dword [0x1401648c0], edx
test r15d, r15d
jne 0x140001fe4
cmp byte [rsp + 0x5c], r15b
jne 0x140001fe4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x5c], 1
jmp 0x140001c65
mov edi, dword [rsp + 0x40]
test edi, edi
jne 0x14000200f
test r14b, r14b
je 0x14000200f
test r15d, r15d
jle 0x140001fff
lea ecx, [rdi + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov edi, eax
mov dword [rsp + 0x40], eax
jmp 0x140001c70
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x1400047f1
mov ecx, dword [rbp - 0x60]
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jle 0x1400047f1
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001c70
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
inc edi
cmp dword [0x140163cb0], 0
mov dword [rsp + 0x40], edi
je 0x14000208a
mov r9, qword [rbp - 0x80]
lea rax, [rbp + 0x190]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140004ef0
test al, al
jne 0x140001c70
mov r9d, dword [0x140160758]
mov r11d, dword [rsp + 0x70]
test r9d, r9d
je 0x1400028dd
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400028dd
cmp rax, qword [0x140160760]
je 0x1400028dd
cmp r11d, 0x414
je 0x1400028dd
cmp r11d, 0x402
je 0x1400028dd
lea eax, [r11 - 0x100]
cmp eax, 9
ja 0x14000266c
call qword [sym.imp.USER32.dll_GetFocus]
mov rsi, rax
test rax, rax
je 0x140002660
mov edx, 0xfffffff0
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x140002146
nop dword [rax]
mov rcx, rdi
mov rbx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je 0x14000213a
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x140002110
jmp 0x140002146
mov rdi, rbx
test rbx, rbx
je 0x140002660
mov rbx, rsi
nop dword [rax]
mov r9d, dword [0x140160758]
xor eax, eax
mov ecx, eax
test r9d, r9d
jle 0x140002182
mov rax, qword [0x140160750]
mov r13, qword [rax]
cmp qword [r13 + 8], rbx
je 0x14000217d
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002167
jmp 0x140002182
test r13, r13
jne 0x1400021bd
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x1400021a7
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
jne 0x140002150
mov r11d, dword [rsp + 0x70]
xor esi, esi
mov r9d, dword [0x140160758]
mov r13d, esi
jmp 0x14000266e
mov rdx, qword [r13 + 0xb8]
test rdx, rdx
je 0x1400021ed
lea r8, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
test eax, eax
jne 0x140001c70
mov r9d, dword [0x140160758]
mov r11d, dword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
cmp r11d, 0x100
jne 0x140002605
cmp byte [r13 + 0x108], 0
je 0x140002490
cmp r10, 0x27
ja 0x140002490
movabs rax, 0xa600000200
bt rax, r10
jae 0x140002490
mov rcx, rsi
mov rdi, rsi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jb 0x14000226c
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je 0x140002262
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jae 0x14000246b
mov eax, ebx
imul r14, rax, 0x58
add r14, qword [r13 + 0x28]
mov qword [rbp - 0x68], r14
cmp qword [r14], rdi
jne 0x14000246b
mov eax, 0x2af8
cmp ebx, eax
je 0x14000246b
xor edi, edi
test r14, r14
je 0x140002471
movzx eax, byte [r14 + 8]
cmp al, 0xf
je 0x140002471
mov r10, qword [rsp + 0x78]
mov ebx, edi
cmp al, 0x13
jne 0x1400022ed
lea rax, [r10 - 0x25]
mov rbx, r14
test rax, 0xfffffffffffffffd
jne 0x1400022ed
cmp r10, 0x27
mov byte [rsp + 0x20], dil
mov rdx, r14
mov rcx, r13
sete r8b
xor r9d, r9d
call fcn.1400b87a0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c65
lea rax, [r10 - 0x25]
test rax, 0xfffffffffffffffd
je 0x140002476
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140002471
mov r10, qword [rsp + 0x78]
cmp r10, 9
jne 0x14000233f
cmp byte [r14 + 8], 0xc
jne 0x14000233f
mov rcx, qword [r14]
lea edx, [r10 - 0x19]
call qword [sym.imp.USER32.dll_GetWindowLongW]
test al, 4
jne 0x140002471
mov r10, qword [rsp + 0x78]
test rbx, rbx
jne 0x1400023ec
movzx r11d, byte [r14 + 0xa]
cmp r11b, 0xff
je 0x14000239e
mov r9d, dword [r13 + 0x20]
xor r8b, r8b
mov edx, edi
test r9d, r9d
je 0x14000239e
mov rdi, qword [r13 + 0x28]
nop word [rax + rax]
mov eax, edx
imul rbx, rax, 0x58
add rbx, rdi
cmp byte [rbx + 8], 0x13
jne 0x140002387
cmp r8b, r11b
je 0x140002397
inc r8b
inc edx
cmp edx, r9d
jb 0x140002370
xor r8b, r8b
xor edi, edi
mov edx, edi
jmp 0x1400023b0
test rbx, rbx
jne 0x1400023ec
xor edi, edi
mov r9d, dword [r13 + 0x20]
xor r8b, r8b
mov edx, edi
test r9d, r9d
je 0x140002476
mov r11, qword [r13 + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
imul rbx, rax, 0x58
add rbx, r11
cmp byte [rbx + 8], 0x13
jne 0x1400023d7
test r8b, r8b
je 0x1400023e3
inc r8b
inc edx
cmp edx, r9d
jb 0x1400023c0
jmp 0x140002476
test rbx, rbx
je 0x140002476
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140002467
mov rax, qword [rsp + 0x78]
cmp rax, 0x22
je 0x140002440
cmp rax, 9
jne 0x14000241a
lea ecx, [rax + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140002440
xor r8d, r8d
mov byte [rsp + 0x20], 1
mov r9b, 1
mov rdx, rbx
mov rcx, r13
call fcn.1400b87a0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c65
mov r8b, 1
mov rdx, rbx
movzx r9d, r8b
mov byte [rsp + 0x20], r8b
mov rcx, r13
call fcn.1400b87a0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c65
xor edi, edi
jmp 0x140002471
xor edi, edi
mov qword [rbp - 0x68], rdi
mov r10, qword [rsp + 0x78]
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140160758]
cmp r11d, 0x100
je 0x140002492
jmp 0x140002605
xor edi, edi
cmp r10, 0x1b
je 0x1400024d3
cmp r10, 9
je 0x1400024d3
cmp r10, 0x41
jne 0x140002605
lea ecx, [r10 - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1400025f4
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x1400025f4
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jb 0x14000250c
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rsi, rax
test rax, rax
je 0x140002502
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jae 0x1400025f0
mov ecx, ebx
imul r14, rcx, 0x58
add r14, qword [r13 + 0x28]
mov qword [rbp - 0x68], r14
mov rcx, qword [r14]
cmp rcx, rsi
jne 0x1400025f0
mov eax, 0x2af8
cmp ebx, eax
je 0x1400025f0
test r14, r14
je 0x1400025f4
cmp byte [r14 + 8], 0xc
jne 0x1400025f4
mov r10, qword [rsp + 0x78]
cmp r10, 0x1b
je 0x1400025b6
movzx eax, byte [r14 + 9]
cmp r10, 0x41
je 0x14000258d
test al, al
jns 0x1400025f9
lea r9, [0x1401204ec]
mov edx, 0xc2
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c65
test al, 2
jne 0x1400025f9
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c65
cmp qword [r13 + 0x40], 0
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
je 0x140001c70
mov rcx, qword [r13 + 8]
xor r9d, r9d
mov edx, 0x414
mov r8d, 0x2af80007
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rbx, r15d
jmp 0x140001c70
mov qword [rbp - 0x68], rdi
mov r10, qword [rsp + 0x78]
mov r9d, dword [0x140160758]
mov r11d, dword [rsp + 0x70]
mov rcx, qword [0x1401617f8]
test rcx, rcx
je 0x14000284c
cmp r11d, 0x100
jne 0x14000284c
cmp r10, 0xd
jne 0x140002649
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1116
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c65
cmp r10, 0x1b
jne 0x14000284c
xor r9d, r9d
mov edx, 0x1116
jmp 0x140002571
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140160758]
xor esi, esi
lea eax, [r11 - 0x20a]
test eax, 0xfffffffb
jne 0x140002847
mov rcx, qword [rbp - 0x74]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
mov edx, 0xfffffff0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140160758]
mov edx, esi
test r9d, r9d
jle 0x1400026d4
mov rcx, qword [0x140160750]
nop dword [rax + rax]
mov r8, qword [rcx]
cmp qword [r8 + 8], rax
je 0x140002742
inc edx
add rcx, 8
cmp edx, r9d
jl 0x1400026c0
mov rcx, qword [rsp + 0x68]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9, qword [rsp + 0x78]
mov r8d, eax
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.140001930
test eax, eax
jne 0x14000283b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140160758]
mov edx, esi
test r9d, r9d
jle 0x14000273a
mov rcx, qword [0x140160750]
mov r13, qword [rcx]
cmp qword [r13 + 8], rax
je 0x1400027af
inc edx
add rcx, 8
cmp edx, r9d
jl 0x140002722
mov r13, rsi
jmp 0x140002842
test r8, r8
je 0x1400026d4
cmp rbx, qword [rsp + 0x68]
jne 0x140002775
mov r9, qword [rsp + 0x78]
mov r8d, edi
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.140001930
test eax, eax
jne 0x1400026d4
cmp rbx, qword [rsp + 0x68]
je 0x1400026d4
mov r9, qword [rsp + 0x78]
mov r8d, edi
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.140001930
test eax, eax
je 0x1400026d4
mov r9, qword [rbp - 0x80]
mov rcx, rbx
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rbx, r15d
jmp 0x140001c65
test r13, r13
je 0x140002842
nop dword [rax + rax]
mov r9, qword [rsp + 0x78]
mov r8d, dword [r13 + 0x64]
mov edx, dword [rsp + 0x70]
mov rcx, qword [r13 + 8]
call fcn.140001930
mov rcx, qword [r13 + 8]
test eax, eax
jne 0x140002820
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140160758]
mov edx, esi
test r9d, r9d
jle 0x14000273a
mov rcx, qword [0x140160750]
nop dword [rax]
mov r13, qword [rcx]
cmp qword [r13 + 8], rax
je 0x140002819
inc edx
add rcx, 8
cmp edx, r9d
jl 0x140002800
mov r13, rsi
jmp 0x140002842
test r13, r13
jne 0x1400027c0
jmp 0x140002842
mov r9, qword [rbp - 0x80]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rbx, r15d
jmp 0x140001c65
mov r9d, dword [0x140160758]
mov r11d, dword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
xor esi, esi
mov edi, esi
test r9d, r9d
jle 0x1400028d7
mov ebx, esi
nop dword [rax + rax]
mov rdx, qword [0x140160750]
mov rax, qword [rbx + rdx]
cmp dword [rax + 0x20], esi
jne 0x140002879
cmp r11d, 0x106
je 0x1400028c6
mov rcx, qword [0x14015bc10]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
mov rcx, qword [rbx + rdx]
lea rdx, [rsp + 0x68]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
mov rax, qword [0x14015bc10]
mov byte [rax + 0x128], sil
jne 0x1400022dd
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140160758]
inc edi
add rbx, 8
cmp edi, r9d
jl 0x140002860
mov edi, dword [rsp + 0x40]
jmp 0x1400028df
mov edi, dword [rsp + 0x40]
jmp 0x1400028e4
xor esi, esi
mov r10, qword [rsp + 0x78]
cmp r11d, 0x402
ja 0x140002bd6
je case.0x140002bf7.1044
cmp r11d, 0x113
ja 0x140002acb
je 0x14000299d
cmp r11d, 0x12
je 0x14000297a
cmp r11d, 0x4b
je 0x14000295e
cmp r11d, 0x100
jne case.0x140002bf7.1046
mov rax, qword [0x140160728]
cmp qword [rsp + 0x68], rax
jne case.0x140002bf7.1046
cmp r10, 0x1b
jne case.0x140002bf7.1046
mov rcx, qword [0x140160760]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c70
movzx r14d, byte [rbp + 0x2410]
mov qword [0x140160730], rsi
mov byte [rsp + 0x48], 1
movsxd rbx, r15d
jmp 0x140001c70
xor r8d, r8d
lea rcx, [0x140163cc0]
lea edx, [r8 + 4]
call fcn.1400386f0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c70
cmp qword [rbp - 0x80], 0
jne case.0x140002bf7.1046
mov rax, qword [0x140160760]
cmp qword [rsp + 0x68], rax
jne case.0x140002bf7.1046
cmp dword [0x140161784], 0
je 0x1400029c8
call fcn.140004de0
cmp dword [0x14016484c], 0
je 0x1400029ea
call fcn.140004970
test al, al
movzx r12d, r12b
mov eax, 1
cmovne r12d, eax
mov dword [rsp + 0x44], r12d
cmp dword [rbp + 0x2408], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
je 0x140001c70
movsxd rbx, r15d
cmp rbx, 1
jl 0x140001c70
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x140002a2b
mov ecx, dword [rbp - 0x60]
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jg 0x140001c70
cmp byte [rsp + 0x49], 0
mov dword [0x1401648c0], eax
mov dword [0x1401648c4], eax
movzx eax, byte [0x14016057f]
cmovne eax, esi
mov qword [0x1401648b0], rsi
cmp byte [rsp + 0x4a], 0
mov byte [0x14016057f], al
je 0x140002aab
mov eax, dword [0x140160768]
dec eax
mov dword [0x140160768], eax
test r15d, r15d
jle 0x140002aab
test eax, eax
jne 0x140002aab
cmp dword [0x14016484c], eax
jne 0x140002aab
cmp dword [0x140161784], eax
jne 0x140002aab
cmp byte [0x14016057e], al
je 0x140002aab
mov rcx, qword [0x140160760]
lea edx, [rax + 9]
call qword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x14016057e]
test eax, eax
cmovne ecx, esi
mov byte [0x14016057e], cl
movaps xmm6, xmmword [rsp + 0x24a0]
movzx eax, r12b
add rsp, 0x24b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, r11d
sub eax, 0x312
je case.0x140002bf7.1044
sub eax, 0xee
je case.0x140002bf7.1045
cmp eax, 1
je case.0x140002bf7.1045
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140004781
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140163c90]
jne 0x140004781
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rcx, rsi
lea rdx, [rbp + 0x1a0]
lea r8, str.32770
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140004781
cmp rcx, 7
jne 0x140002b40
mov rcx, qword [0x14015bc10]
lea rdx, [rsp + 0x68]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x140004771
cmp dword [0x14016075c], 0
je 0x140002bb3
mov rax, qword [0x14015e420]
lea rcx, [0x14012046c]
test rax, rax
je 0x140002bad
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, qword [0x14015bc10]
movzx r14d, byte [rbp + 0x2410]
mov byte [rax + 0x128], 0
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c70
lea eax, [r11 - 0x414]
cmp eax, 0xa
ja case.0x140002bf7.1046
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x4894]
add rcx, rdx
jmp rcx
mov rax, qword [rsp + 0x68]
test rax, rax
je case.0x140002bf7.1044
cmp rax, qword [0x140160760]
jne case.0x140002bf7.1046
lea eax, [r11 - 0x401]
mov r12, rsi
cmp eax, 0x1d
ja case.0x140002c3c.1031
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x48dc]
mov ecx, dword [rdx + rax*4 + 0x48c0]
add rcx, rdx
jmp rcx
mov ecx, esi
test r9d, r9d
jle 0x140002c69
mov rax, qword [0x140160750]
nop dword [rax]
mov r13, qword [rax]
mov r8, qword [r13 + 8]
cmp r8, qword [rsp + 0x68]
je 0x140002c71
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002c50
mov r13, rsi
jmp case.0x140002bf7.1046
test r13, r13
je case.0x140002bf7.1046
mov rcx, qword [rbp - 0x80]
mov eax, 0x2af8
movzx ebx, r10w
shr r10, 0x10
cmp ebx, 8
movzx r10d, r10w
mov edi, r10d
mov dword [rsp + 0x60], esi
cmove r10d, eax
mov dword [rsp + 0x64], ebx
mov eax, ecx
mov dword [rbp - 0x18], r10d
cmovne eax, dword [rsp + 0x58]
cmovne rdi, rcx
mov r9d, eax
mov dword [rsp + 0x58], eax
mov esi, eax
cmp r10d, dword [r13 + 0x20]
jae 0x140002cce
mov eax, r10d
imul r14, rax, 0x58
add r14, qword [r13 + 0x28]
xor eax, eax
jmp 0x140002cd3
xor eax, eax
mov r14d, eax
mov qword [rbp - 0x20], rax
mov eax, ebx
mov qword [rbp - 0x68], r14
mov byte [rbp + 0x2418], 0
mov qword [rsp + 0x50], rdi
sub eax, 5
je 0x140002e5b
sub eax, 1
je 0x140002e03
sub eax, 1
je 0x140002de3
sub eax, 1
je 0x140002dc3
cmp eax, 1
je 0x140002d96
movsxd rbx, r15d
test r14, r14
je 0x140001c58
mov rbx, qword [r14 + 0x18]
test rbx, rbx
jne 0x140002d60
test byte [r14 + 9], 1
je 0x140002d42
test r8, r8
je 0x140002d42
xor edx, edx
mov rcx, r8
call qword [sym.imp.USER32.dll_ShowWindow]
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
movsxd rbx, r15d
jmp 0x140001c65
test byte [r14 + 9], 4
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
jne 0x140001c4e
xor eax, eax
mov byte [rbp + 0x2418], 1
mov r14d, eax
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
jmp 0x14000339b
mov rbx, qword [r13 + 0x58]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001c4e
xor eax, eax
mov qword [rsp + 0x50], rdi
mov r14d, eax
mov dword [rsp + 0x58], esi
jmp 0x14000339b
mov rbx, qword [r13 + 0x48]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001c4e
lea rcx, [r13 + 0x62]
jmp 0x140002e21
mov rbx, qword [r13 + 0x40]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001c4e
lea rcx, [r13 + 0x61]
jmp 0x140002e21
mov rbx, qword [r13 + 0x38]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001c4e
lea rcx, [r13 + 0x60]
mov qword [rbp - 0x20], rcx
mov qword [rsp + 0x50], rdi
test rcx, rcx
je 0x140002e9a
cmp byte [rcx], 0
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov edi, dword [rsp + 0x40]
mov dword [rsp + 0x58], esi
jne 0x140002bc9
xor eax, eax
mov dword [rsp + 0x58], esi
mov r14d, eax
jmp 0x14000339b
mov rbx, qword [r13 + 0x50]
mov r12, qword [r13 + 0xa0]
test rbx, rbx
je 0x140002ea8
mov qword [rsp + 0x50], rdi
test r12, r12
je 0x140002ebf
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r14d, eax
mov qword [rsp + 0x50], r14
test eax, eax
je 0x140002ead
mov r11d, dword [rsp + 0x70]
xor eax, eax
mov dword [rsp + 0x58], esi
mov r14d, eax
jmp 0x14000339b
test r12, r12
je 0x140002ebf
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [r13 + 0xa0], rax
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], esi
movsxd rbx, r15d
jmp 0x140001c65
test r10, r10
je 0x140002f27
mov ecx, esi
test r9d, r9d
jle 0x140002f04
mov rax, qword [0x140160750]
nop dword [rax + rax]
mov r13, qword [rax]
cmp qword [r13 + 8], r10
je 0x140002f20
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002ef0
mov r13, rsi
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140002f2a
cmp rax, qword [0x140160760]
jne case.0x140002bf7.1046
jmp 0x140002f2a
test r13, r13
jne 0x140002f2a
jmp 0x140002f07
mov r13, rsi
mov rcx, qword [0x140164850]
test rcx, rcx
je 0x140002f6b
mov rax, qword [rbp - 0x80]
nop word [rax + rax]
mov rdi, qword [rcx + 8]
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x140002f62
nop dword [rax]
cmp dword [rdi + 0x28], eax
je 0x140002f84
mov rdi, qword [rdi + 0x38]
mov qword [rbp - 0x58], rdi
test rdi, rdi
jne 0x140002f50
mov rcx, qword [rcx + 0x30]
test rcx, rcx
jne 0x140002f40
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x58], rsi
movsxd rbx, r15d
jmp 0x140001c65
mov rbx, qword [rdi + 0x10]
movzx r14d, byte [rbp + 0x2410]
test rbx, rbx
je 0x140001c4e
mov r14d, dword [rdi + 0x2c]
jmp 0x14000339f
mov eax, dword [0x140161780]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
cmp r10, rax
jae 0x140001c47
mov rax, qword [0x140161778]
mov rsi, qword [rax + r10*8]
mov qword [rbp], rsi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140002ffb
mov rdx, qword [rsi + 8]
call fcn.140017500
mov qword [rbp - 0x50], rax
movsxd rbx, r15d
test rax, rax
je 0x140001c47
mov rcx, qword [rsi + 0x20]
movzx edx, byte [rcx]
dec dl
test dl, 0xfd
je 0x140003001
xor eax, eax
mov qword [rbp - 0x50], rax
mov rdx, qword [rbp - 0x80]
mov rcx, rsi
call fcn.14001ace0
cmp qword [rsi + 0x18], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jne 0x140001c47
cmp byte [rsi + 0x3e], 0
je 0x14000302f
movzx eax, word [rbp - 0x80]
jmp 0x140003031
xor eax, eax
mov r11d, dword [rsp + 0x70]
mov word [0x14016486c], ax
mov rbx, qword [rsi]
mov r14d, dword [rsi + 0x28]
jmp 0x14000339b
cmp byte [0x140164830], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jne 0x140001c47
mov rbx, qword [0x140164818]
mov r14d, esi
test rbx, rbx
cmove rbx, qword [0x140164398]
jmp 0x14000339b
mov rcx, r10
call fcn.14006a560
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x48], rax
movsxd rbx, r15d
test rax, rax
je 0x140004767
mov rbx, qword [rax + 0x10]
mov r14d, esi
mov r11d, dword [rsp + 0x70]
mov rbx, qword [rbx + 0x388]
jmp 0x14000339b
mov rdi, qword [0x140160748]
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x48], rdi
movsxd rbx, r15d
test rdi, rdi
je 0x140004767
cmp rdi, r10
je 0x1400030f1
mov rdi, qword [rdi + 8]
mov qword [rbp - 0x48], rdi
test rdi, rdi
jne 0x1400030d2
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c65
mov rbx, qword [rdi + 0x10]
cmp r11d, 0x41c
jne 0x140003107
mov rbx, qword [rbx + 0x390]
jmp 0x140003120
cmp r11d, 0x41e
jne 0x140003119
mov rbx, qword [rbx + 0x3a0]
jmp 0x140003120
mov rbx, qword [rbx + 0x398]
mov edi, dword [rsp + 0x40]
test rbx, rbx
je 0x140002bc9
mov r14d, esi
jmp 0x14000339b
movzx r14d, byte [rbp + 0x2410]
movzx eax, r10w
mov ecx, 0x7fff
movsxd rbx, r15d
and ax, cx
cmp ax, word [0x14016179c]
jae 0x140001c47
movzx ecx, ax
mov rax, qword [0x140161788]
shr r10, 0x10
mov r14, qword [rax + rcx*8]
mov qword [rbp - 8], r14
test r10w, r10w
je 0x1400031a7
mov r15, qword [r14 + 0x28]
mov eax, 0xffff
mov qword [rbp - 0x40], r15
add r10w, ax
je 0x14000319e
nop dword [rax + rax]
mov r15, qword [r15 + 0x10]
add r10w, ax
jne 0x140003190
mov qword [rbp - 0x40], r15
test r15, r15
jne 0x1400032fd
cmp r11d, 0x400
jne 0x1400031ca
mov rax, qword [rbp - 0x80]
mov edi, WSAAsyncSelect
shr rax, 0x10
movzx ecx, ax
sub edi, ecx
lea esi, [rcx + 0x3c2bb3]
jmp 0x1400031cf
mov edi, 0x3c2c17
xor eax, eax
cmp byte [r14 + 0x19], al
jne 0x1400031eb
mov r15d, dword [rbp + 0x2400]
mov rbx, qword [rbp - 0x28]
mov qword [rbp - 0x40], rax
jmp 0x140001c58
mov r15, qword [r14 + 0x28]
mov rbx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], r15
test r15, r15
je 0x1400032db
cmp byte [r15 + 0x28], 0
je 0x1400032c5
cmp byte [0x140160840], 0
je 0x140003287
mov r9, qword [r15]
mov rcx, r9
call fcn.1400c1010
test eax, eax
je 0x14000322f
cmp eax, 1
jne 0x1400032c5
mov rcx, qword [r9 + 0x10]
test rcx, rcx
je 0x1400032c5
cmp byte [rcx], 0xcd
jne 0x1400032c5
movzx eax, byte [rcx + 1]
test al, al
je 0x140003287
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx]
test al, al
jne 0x14000326f
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140003267
cmp qword [rax], 0
jne 0x140003287
cmp byte [rcx + 1], 0
jne 0x140003287
jmp 0x140003273
cmp al, 1
je 0x140003287
mov rcx, qword [rcx + 8]
lea rdx, [0x140136e94]
call fcn.1400f55a0
test eax, eax
je 0x1400032c5
lea ecx, [rsi - 0x3c2bb3]
cmp edi, 0x66
jbe 0x140003297
mov ecx, reloc.WSOCK32.dll_WSAAsyncSelect
movzx eax, byte [r15 + 0x24]
cmp ecx, eax
jle 0x1400032c5
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x1400032bb
mov rdx, qword [r14 + 0x20]
call fcn.140017500
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400032c5
cmp qword [r15 + 8], 0
jne 0x14000331f
mov rbx, r15
mov r15, qword [r15 + 0x10]
mov qword [rbp - 0x40], r15
test r15, r15
jne 0x140003203
mov r11d, dword [rsp + 0x70]
mov r15, rbx
mov qword [rbp - 0x40], rbx
movzx r14d, byte [rbp + 0x2410]
mov rbx, qword [rbp - 0x28]
mov edi, dword [rsp + 0x40]
test r15, r15
je 0x140001c40
xor esi, esi
mov r9, qword [r15]
mov rcx, r9
call fcn.1400c1010
test eax, eax
je 0x140003311
cmp eax, 1
jne 0x140003326
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x140003326
movzx ecx, byte [rax]
jmp 0x140003328
mov r11d, dword [rsp + 0x70]
jmp 0x1400032e2
xor cl, cl
movzx eax, byte [r15 + 0x23]
cmp byte [r15 + 0x22], al
jb 0x14000336b
add cl, 0x32
cmp cl, 0x14
ja 0x140003345
mov eax, 0x10fc01
bt eax, ecx
jb 0x14000336b
cmp byte [r15 + 0x26], 0
je 0x140003351
mov byte [r15 + 0x27], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbx, qword [rbp - 0x28]
mov dword [r15 + 0x18], eax
mov r15d, dword [rbp + 0x2400]
jmp 0x140001c58
mov rax, qword [r15 + 8]
test rax, rax
je 0x140003390
movzx ecx, byte [rax]
lea eax, [rcx - 2]
test al, 0xfd
je 0x140003390
cmp cl, 5
jb 0x140003394
mov rax, qword [0x140160740]
mov qword [rbp - 0x50], rax
jmp 0x140003394
mov qword [rbp - 0x50], rsi
mov rbx, qword [r15]
mov r14d, dword [r15 + 0x1c]
mov rdi, qword [rbp - 0x58]
mov r15, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1400c1010
test eax, eax
je 0x1400033b5
cmp eax, 1
jne 0x1400033c6
mov rcx, qword [rbx + 0x10]
mov rax, rbx
test rcx, rcx
je 0x1400033c6
movzx esi, byte [rcx]
jmp 0x1400033c9
xor sil, sil
mov ecx, dword [0x1401605cc]
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
cmp ecx, eax
jl 0x140003453
add eax, 2
cmp ecx, eax
jge 0x1400033f1
lea eax, [rsi + 0x32]
cmp al, 0x14
ja 0x1400033f1
mov ecx, 0x10fc01
bt ecx, eax
jb 0x140003453
test r12, r12
je 0x14000340d
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [r13 + 0xa0], rax
mov r11d, dword [rsp + 0x70]
movsxd r15, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
mov rbx, r15
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
cmp r11d, 0x41b
jne 0x140001c70
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r15d, dword [rbp + 0x2400]
mov rbx, qword [rbp - 0x28]
jmp 0x140001c70
mov rax, qword [0x14015bc10]
cmp r14d, dword [rax + 0x3c]
jl 0x1400033f1
lea eax, [r11 - 0x402]
mov byte [rsp + 0x44], 1
cmp eax, 0x1c
ja case.0x14000348a.1028
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x4908]
mov ecx, dword [rdx + rax*4 + 0x48fc]
add rcx, rdx
jmp rcx
mov rdx, qword [rdi]
lea rcx, [0x1401643a8]
mov r8d, 0x104
call fcn.1401020c4
xor eax, eax
lea rcx, [0x1401645b2]
mov word [0x1401645b0], ax
mov r8d, 0x104
mov rdx, qword [rdi + 0x20]
mov rdx, qword [rdx]
call fcn.1401020c4
xor eax, eax
mov qword [0x1401643a0], rdi
mov word [0x1401647ba], ax
jmp case.0x14000348a.1027
mov rax, qword [0x1401647c0]
mov qword [0x1401647c8], rax
mov eax, dword [0x140164864]
mov dword [0x140164868], eax
cmp r11d, 0x401
jne 0x140003502
mov rax, qword [rbp]
mov rax, qword [rax + 8]
jmp 0x14000350a
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x20]
mov qword [0x1401647c0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140164864], eax
mov rdi, qword [0x140160738]
cmp byte [rdi + 0x23], 0
jne 0x14000352e
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x14000353c
mov rcx, rdi
call fcn.140001610
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x140003558
test byte [rdi + 0x21], 4
je 0x140003552
mov rdx, rdi
call fcn.140064000
mov rdx, qword [rdi + 8]
jmp 0x1400035bb
cmp al, 2
jne 0x1400035b4
mov rdx, qword [0x140164960]
test rdx, rdx
jne 0x1400035bb
lea ecx, [rdx + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140003594
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rdx, [0x14012046c]
lea rax, [0x140120460]
cmovne rdx, rax
jmp 0x1400035bb
xor edx, edx
call fcn.140007200
mov ecx, 0xffffffff
lea rdx, [0x14012046c]
cmp rax, rcx
cmovne rdx, qword [0x140164958]
jmp 0x1400035bb
lea rdx, [0x140162c30]
mov r8d, 0x7f
lea rcx, [rbp + 0x1e0]
call fcn.1401020c4
xor edi, edi
movzx r9d, sil
mov r8b, 1
mov word [rbp + 0x2de], di
xor edx, edx
mov ecx, r14d
call fcn.1400054c0
mov r14, qword [0x14015bc10]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401648c4], eax
mov dword [0x1401648c0], eax
mov eax, dword [rsp + 0x70]
add eax, 0xfffffbff
cmp eax, 0x1d
ja case.0x14000362d.1032
lea r9, [0x140000000]
movzx eax, byte [r9 + rax + 0x4948]
mov ecx, dword [r9 + rax*4 + 0x4928]
add rcx, r9
jmp rcx
movsxd rsi, dword [rsp + 0x60]
mov r8, qword [rbp - 0x68]
mov rax, rsi
inc esi
shl rax, 5
mov word [rbp + 0x70], di
mov dword [rsp + 0x60], esi
cmp byte [rbp + 0x2418], dil
je 0x140003657
mov rcx, qword [r8]
jmp 0x14000365b
mov rcx, qword [r13 + 8]
mov qword [rbp + rax + 0xa0], rcx
mov r10d, 1
mov ecx, dword [rsp + 0x64]
mov dword [rbp + rax + 0xb0], r10d
mov eax, ecx
sub eax, 5
je 0x140003c7a
sub eax, r10d
je 0x140003aba
sub eax, r10d
je 0x140003aba
sub eax, r10d
je 0x140003aba
cmp eax, r10d
je 0x1400037ee
mov r15, qword [rbp - 0x68]
movzx eax, byte [r15 + 8]
cmp al, 0xa
je 0x140003722
cmp al, 0x19
jne 0x1400036f3
mov rax, qword [rbp - 0x74]
lea rdx, [rbp + 0x160]
mov qword [r14 + 0x50], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x160]
lea r9, [0x140000000]
sub dword [r14 + 0x50], eax
mov r10d, 1
mov eax, dword [rbp + 0x164]
sub dword [r14 + 0x54], eax
mov ecx, dword [rsp + 0x64]
movsxd rax, esi
lea rdx, [rbp + 0xa0]
shl rax, 5
inc esi
add rdx, rax
mov dword [r14 + 0x44], ecx
cmp ecx, 5
jae 0x1400037ac
mov eax, ecx
mov rcx, qword [r9 + rax*8 + 0x144138]
jmp 0x1400037bd
cmp cl, 0x49
jne 0x1400036f3
lea rax, [rbp + 0x70]
bt ecx, 8
jae 0x140003738
mov eax, 0x53
jmp 0x140003743
bt ecx, 9
jae 0x14000374b
mov eax, reloc.WSOCK32.dll_WSAStartup
mov word [rbp + 0x70], ax
lea rax, [rbp + 0x72]
bt ecx, 0xa
jae 0x140003758
mov edx, 0x46
jmp 0x140003763
bt ecx, 0xb
jae 0x14000376a
mov edx, 0x66
mov word [rax], dx
add rax, 2
bt ecx, 0xc
jae 0x140003777
mov ecx, 0x43
jmp 0x140003782
bt ecx, 0xd
jae 0x140003789
mov ecx, WSAAsyncSelect
mov word [rax], cx
add rax, 2
mov word [rax], di
lea rdx, [rbp + 0xa0]
movsxd rax, esi
mov ecx, 0x49
shl rax, 5
add rdx, rax
mov dword [rsp + 0x64], ecx
inc esi
mov dword [r14 + 0x44], ecx
movzx eax, cl
lea rcx, [0x1401663a4]
mov word [0x1401663a4], ax
mov dword [rdx + 0x10], edi
mov rdi, qword [rsp + 0x50]
mov qword [rdx], rcx
mov ecx, dword [rsp + 0x64]
movsxd rax, esi
shl rax, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rax + 0xb0], r10d
mov qword [rbp + rax + 0xa0], rdi
jmp 0x140003b87
cmp qword [rsp + 0x50], rdi
mov edx, 3
mov qword [rsp + 0x50], rdi
cmovne edx, r10d
mov dword [r14 + 0x44], edx
mov rax, qword [rbp - 0x74]
mov qword [r14 + 0x50], rax
test r8, r8
je 0x1400039cc
test r15, r15
mov r15, qword [rbp - 0x68]
je 0x14000392c
movzx ecx, byte [r15 + 8]
mov dword [rbp - 0x38], 0x80000000
sub ecx, 9
je 0x1400038ab
sub ecx, r10d
je 0x14000387c
sub ecx, r10d
je 0x140003851
cmp ecx, 6
jne 0x1400038da
xor r8d, r8d
mov edx, 0x419
jmp 0x1400038cd
mov rcx, qword [r15]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400038da
mov qword [rbp - 0x38], rax
mov edx, 0x1104
mov r8d, 1
jmp 0x1400038cd
mov rcx, qword [r15]
mov r9, r10
mov edx, 0x100c
mov r8, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, eax
cmp r8, 0xffffffffffffffff
je 0x1400038da
mov dword [rbp - 0x38], 2
mov edx, 0x100e
jmp 0x1400038cd
mov rcx, qword [r15]
xor r9d, r9d
xor r8d, r8d
mov edx, OleCreatePictureIndirect
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
je 0x1400038da
mov r8, rax
mov edx, 0x198
mov rcx, qword [r15]
lea r9, [rbp - 0x38]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rbp - 0x38], 0x80000000
mov rcx, qword [r15]
jne 0x1400038f2
lea rdx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x140003904
mov r9d, 2
lea r8, [rbp - 0x38]
xor edx, edx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rbp - 0x38]
mov ecx, dword [rbp - 0x34]
mov dword [r14 + 0x50], eax
mov eax, dword [rbp - 0x2c]
sub eax, ecx
jns 0x140003917
inc eax
sar eax, 1
mov r10d, 1
add eax, 2
add eax, ecx
mov dword [r14 + 0x54], eax
mov edx, dword [r14 + 0x44]
movzx ecx, byte [r15 + 8]
sub ecx, 9
je 0x1400039bf
sub ecx, 1
je 0x14000399b
cmp ecx, 1
jne 0x1400039d0
mov rcx, qword [r15]
cmp edx, 1
jne 0x14000396b
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov qword [rsp + 0x50], rdi
jmp 0x1400039d0
mov rax, qword [rbp - 0x74]
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, qword [r15]
lea r9, [rbp + 0x10]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov qword [rsp + 0x50], rdi
jmp 0x1400039d0
mov r9, r10
mov edx, 0x100c
mov r8, 0xffffffffffffffff
mov rcx, qword [r15]
call qword [sym.imp.USER32.dll_SendMessageW]
inc eax
movsxd rdi, eax
mov qword [rsp + 0x50], rdi
jmp 0x1400039d0
xor r9d, r9d
mov edx, OleCreatePictureIndirect
xor r8d, r8d
jmp 0x1400039aa
mov r15, qword [rbp - 0x68]
mov rcx, qword [r13 + 8]
lea rdx, [rbp + 0x170]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x170]
lea r8d, [rsi + 1]
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0x174]
sub dword [r14 + 0x54], eax
movsxd rdx, esi
shl rdx, 5
test r15, r15
je 0x140003a0a
mov rcx, qword [r15]
jmp 0x140003a11
lea rcx, [0x14012046c]
xor r9d, r9d
lea esi, [r8 + 1]
mov r10d, 1
test r15, r15
mov eax, r9d
setne al
mov dword [rbp + rdx + 0xb0], eax
mov qword [rbp + rdx + 0xa0], rcx
mov ecx, r9d
movsxd rdx, esi
inc esi
shl rdx, 5
movsxd rax, r8d
shl rax, 5
mov dword [rbp + rax + 0xb0], r10d
mov qword [rbp + rax + 0xa0], rdi
mov eax, dword [r14 + 0x44]
cmp eax, 3
mov dword [rbp + rdx + 0xb0], r10d
sete cl
mov qword [rbp + rdx + 0xa0], rcx
movsxd rax, dword [r14 + 0x50]
movsxd rcx, esi
inc esi
shl rcx, 5
mov dword [rbp + rcx + 0xb0], r10d
mov qword [rbp + rcx + 0xa0], rax
movsxd rax, dword [r14 + 0x54]
movsxd rcx, esi
shl rcx, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rcx + 0xb0], r10d
mov qword [rbp + rcx + 0xa0], rax
mov ecx, dword [rsp + 0x64]
jmp 0x140003b8a
mov dword [r14 + 0x44], r10d
cmp ecx, 8
jne 0x140003b7e
mov r15d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
movsxd rax, esi
inc esi
shl rax, 5
mov dword [r14 + 0x50], r15d
movsxd rdi, esi
inc esi
shl rdi, 5
mov dword [rbp + rax + 0xb0], r10d
mov qword [rbp + rax + 0xa0], rcx
cmp byte [r13 + 0x110], 0
movzx eax, r15w
je 0x140003b1f
mov r8d, dword [0x140163c94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
cdqe
mov qword [rbp + rdi + 0xa0], rax
mov eax, r15d
mov dword [rbp + rdi + 0xb0], r10d
movsxd rdi, esi
inc esi
shl rdi, 5
shr eax, 0x10
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x60], esi
je 0x140003b68
mov r8d, dword [0x140163c94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
mov ecx, dword [rsp + 0x64]
cdqe
mov qword [rbp + rdi + 0xa0], rax
mov dword [rbp + rdi + 0xb0], r10d
mov r15, qword [rbp - 0x68]
mov rdi, qword [rsp + 0x50]
xor r9d, r9d
cmp byte [rbp + 0x2418], 0
je 0x140003e65
cmp byte [r15 + 8], 0x17
jne 0x140003e65
xor edx, edx
lea rcx, [rbp + 0x2e8]
mov r8d, 0x10b0
call fcn.1400f1130
mov rcx, qword [r15]
lea eax, [rdi - 1]
lea r9, [rbp + 0x2e0]
mov dword [rbp + 0x2e4], eax
xor r8d, r8d
mov dword [rbp + 0x2e0], ntohs
mov edx, 0x703
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140003ec7
cmp word [rbp + 0x350], 0
lea rax, [rbp + 0x2f0]
mov rcx, qword [0x140160738]
lea rdx, [rbp + 0x350]
cmove rdx, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [r9 - 1]
call fcn.1400d5e90
mov rdi, qword [0x140160738]
inc dword [rsp + 0x60]
movsxd rsi, esi
shl rsi, 5
cmp byte [rdi + 0x23], 0
jne 0x140003c38
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x140003c46
mov rcx, rdi
call fcn.140001610
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x140003dc8
test byte [rdi + 0x21], 4
je 0x140003c60
mov rdx, rdi
call fcn.140064000
mov rcx, qword [rdi + 8]
xor eax, eax
mov dword [rbp + rsi + 0xb0], eax
mov qword [rbp + rsi + 0xa0], rcx
jmp 0x140003ec7
mov dword [r14 + 0x44], 5
lea rdx, [rbp + 0x180]
mov rax, qword [rbp - 0x74]
mov qword [r14 + 0x50], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x180]
mov edx, 0xffffffec
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0x184]
sub dword [r14 + 0x54], eax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
and eax, 0xffffffef
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
movsxd rdi, esi
mov rcx, r12
shl rdi, 5
inc esi
call fcn.1400a6150
mov r15, qword [rbp - 0x68]
mov dword [rbp + rdi + 0xb0], 6
mov qword [rbp + rdi + 0xa0], rax
test r15, r15
je 0x140003d0b
mov rdx, qword [r15]
mov r8d, 1
jmp 0x140003d17
xor eax, eax
lea rdx, [0x14012046c]
mov r8d, eax
mov ecx, dword [rsp + 0x60]
add ecx, 2
movsxd rax, esi
shl rax, 5
movsxd rdi, ecx
shl rdi, 5
lea esi, [rcx + 1]
mov dword [rbp + rax + 0xb0], r8d
mov qword [rbp + rax + 0xa0], rdx
cmp byte [r13 + 0x110], 0
mov eax, dword [r14 + 0x50]
je 0x140003d61
mov r8d, dword [0x140163c94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
cdqe
mov r10d, 1
mov dword [rbp + rdi + 0xb0], r10d
mov qword [rbp + rdi + 0xa0], rax
mov eax, dword [r14 + 0x54]
movsxd rdi, esi
inc esi
shl rdi, 5
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x60], esi
je 0x140003dad
mov r8d, dword [0x140163c94]
lea edx, [r10 + 0x5f]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
mov ecx, dword [rsp + 0x64]
cdqe
mov qword [rbp + rdi + 0xa0], rax
mov dword [rbp + rdi + 0xb0], r10d
jmp 0x140003b82
cmp al, 2
jne 0x140003e4b
mov rcx, qword [0x140164960]
test rcx, rcx
jne 0x140003e52
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140003e1a
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rcx, [0x14012046c]
lea rax, [0x140120460]
cmovne rcx, rax
xor eax, eax
mov dword [rbp + rsi + 0xb0], eax
mov qword [rbp + rsi + 0xa0], rcx
jmp 0x140003ec7
xor edx, edx
call fcn.140007200
mov edx, 0xffffffff
lea rcx, [0x14012046c]
cmp rax, rdx
cmovne rcx, qword [0x140164958]
xor eax, eax
mov dword [rbp + rsi + 0xb0], eax
mov qword [rbp + rsi + 0xa0], rcx
jmp 0x140003ec7
lea rcx, [0x140162c30]
xor eax, eax
mov qword [rbp + rsi + 0xa0], rcx
mov dword [rbp + rsi + 0xb0], eax
jmp 0x140003ec7
cmp word [rbp + 0x70], 0
je 0x140003e8d
movsxd rax, esi
lea rdx, [rbp + 0x70]
shl rax, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rax + 0xb0], r9d
mov qword [rbp + rax + 0xa0], rdx
cmp ecx, 8
je 0x140003eb5
cmp ecx, 5
je 0x140003eb5
mov rcx, qword [0x140160738]
lea rdx, [rbp + 0x70]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d5e90
jmp 0x140003ec7
mov rcx, qword [0x140160738]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rdi
call fcn.140001570
mov rax, qword [r13 + 8]
mov rdi, qword [rbp - 0x20]
movzx esi, byte [rbp + 0x2418]
mov qword [r14 + 0xf8], rax
add dword [r13 + 0x34], 2
mov eax, dword [rbp - 0x18]
mov dword [r14 + 0x70], eax
mov rax, qword [rsp + 0x50]
mov qword [r14 + 0x48], rax
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x58], r13
test rdi, rdi
je 0x140003f04
mov byte [rdi], 1
jmp 0x140003f0e
test sil, sil
je 0x140003f0e
or byte [r15 + 9], 4
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e380]
jne 0x140003f2a
call fcn.140007980
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e370]
jb 0x140003f44
mov rax, qword [0x140164390]
mov qword [rcx], rax
mov rcx, qword [0x14015e378]
add rcx, 0x18
lea rax, [0x140120480]
mov qword [0x14015e378], rcx
lea r9, [rbp + 0xa0]
xor r14d, r14d
lea r8, str.call
mov dword [rsp + 0x30], r14d
mov rdx, rbx
mov qword [rcx + 8], rax
lea rax, [rbp + 0x90]
mov qword [rcx], r14
mov dword [rcx + 0x10], r14d
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1400bd2b0
sub qword [0x14015e378], 0x18
cmp qword [r13 + 8], r14
je 0x140004036
mov eax, dword [rsp + 0x64]
test rdi, rdi
je 0x140003fe6
mov byte [rdi], r14b
cmp eax, 6
jne 0x140003ff0
cmp qword [rbp + 0x90], r14
jne 0x140004036
mov rcx, rbx
call fcn.1400c1010
test eax, eax
jne 0x140003fd3
test rbx, rbx
jne 0x140004036
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x140004036
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140004036
test sil, sil
je 0x140003ff0
and byte [r15 + 9], 0xfb
cmp eax, 5
jne 0x140004036
mov rcx, qword [rbp + 0xc0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
mov qword [r13 + 0xa0], r14
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
or eax, 0x10
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, 0xffffffff
add dword [r13 + 0x34], eax
jne 0x1400046d7
mov rcx, qword [r13]
call fcn.1400f75c8
mov edx, 0x130
mov rcx, r13
call fcn.1400eec30
jmp 0x1400046d7
test r13, r13
je 0x140004086
mov rax, qword [r13 + 8]
mov qword [r14 + 0xf8], rax
mov eax, 1
mov dword [r14 + 0x44], eax
add dword [r13 + 0x34], 2
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x58], r13
lea rax, [0x1401643a8]
mov dword [rbp + 0x20], edi
lea rcx, [0x140163cc0]
mov qword [rbp + 0x10], rax
call fcn.140080730
mov dword [rbp + 0x60], edi
lea ecx, [rax + 1]
mov eax, 1
mov qword [rbp + 0x30], rcx
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e380]
mov dword [rbp + 0x40], eax
lea rax, [0x1401645b2]
mov qword [rbp + 0x50], rax
jne 0x1400040d9
call fcn.140007980
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e370]
jb 0x1400040f3
mov rax, qword [0x140164390]
mov qword [rcx], rax
mov rcx, qword [0x14015e378]
add rcx, 0x18
mov dword [rsp + 0x30], edi
mov qword [0x14015e378], rcx
lea rax, str.Menu
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x10]
lea r8, str.call
mov dword [rsp + 0x20], 3
mov qword [rcx], rdi
mov rdx, rbx
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edi
mov rcx, rbx
call fcn.1400bd2b0
sub qword [0x14015e378], 0x18
test r13, r13
je 0x1400046d7
mov eax, 0xffffffff
add dword [r13 + 0x34], eax
jne 0x1400046d7
mov rcx, qword [r13]
call fcn.1400f75c8
mov edx, 0x130
mov rcx, r13
call fcn.1400eec30
jmp 0x1400046d7
mov rax, qword [rbp - 0x50]
mov rbx, qword [rbp]
mov qword [r14 + 0xf8], rax
movzx eax, byte [rbx + 0x35]
mov byte [r14 + 0x136], al
mov r9, qword [rbx]
mov rcx, r9
call fcn.1400c1010
test eax, eax
je 0x14000419f
cmp eax, 1
jne 0x1400041ad
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x1400041ad
movzx ecx, byte [rax]
jmp 0x1400041af
xor cl, cl
movzx eax, byte [rbx + 0x39]
cmp byte [rbx + 0x38], al
jb 0x1400041d2
add cl, 0x32
cmp cl, 0x14
ja 0x1400046d7
mov eax, 0x10fc01
bt eax, ecx
jae 0x1400046d7
mov byte [0x14016486e], dil
xor r9d, r9d
inc byte [rbx + 0x38]
xor r8d, r8d
mov rdx, qword [0x1401647c0]
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.1400c0f50
dec byte [rbx + 0x38]
jmp 0x1400046d7
call qword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x140004230
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140004229
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140004229
lea edx, [rax + 2]
jmp 0x140004233
mov edx, 1
jmp 0x140004233
mov rdx, rdi
mov rcx, qword [0x140160738]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [r14 + 0x48], rdx
call fcn.140001570
mov rax, qword [r14 + 0x48]
mov ebx, 1
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e380]
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x10], rax
mov byte [0x140164830], bl
jne 0x140004278
call fcn.140007980
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e370]
jb 0x140004292
mov rax, qword [0x140164390]
mov qword [rcx], rax
mov rcx, qword [0x14015e378]
add rcx, 0x18
lea rax, [0x1401204f0]
mov qword [0x14015e378], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edi
mov rax, qword [0x140164818]
test rax, rax
je 0x1400042c9
mov rcx, rax
call fcn.140001870
mov rax, qword [0x140164818]
cmp qword [rsp + 0x78], rdi
jne 0x1400042ed
test rax, rax
lea rdx, [rbp + 0x10]
mov r9d, edi
lea rcx, [0x1401647e8]
sete r9b
mov r8d, ebx
call fcn.1400c10c0
sub qword [0x14015e378], 0x18
mov byte [0x140164830], dil
jmp 0x1400046d7
mov rdi, qword [rbp - 0x48]
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e380]
mov dword [rbp + 0x20], 6
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x10], rax
jne 0x140004330
call fcn.140007980
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e370]
jb 0x14000434a
mov rax, qword [0x140164390]
mov qword [rcx], rax
mov rcx, qword [0x14015e378]
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x14015e378], rcx
lea r9, [rbp + 0x10]
xor esi, esi
lea r8, str.call
mov dword [rsp + 0x30], esi
mov rdx, rbx
mov qword [rcx + 8], rax
mov eax, 1
mov qword [rcx], rsi
mov dword [rcx + 0x10], esi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call fcn.1400bd2b0
sub qword [0x14015e378], 0x18
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x1400046d9
mov rcx, qword [rbp - 0x80]
mov edx, 1
mov rax, qword [rbp - 0x48]
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], edx
mov dword [rbp + 0x60], edx
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
movzx eax, cl
sar rcx, 0x10
mov qword [rbp + 0x30], rax
movzx eax, cx
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e380]
mov qword [rbp + 0x50], rax
jne 0x1400043f7
call fcn.140007980
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e370]
jb 0x140004411
mov rax, qword [0x140164390]
mov qword [rcx], rax
mov rcx, qword [0x14015e378]
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 3
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x14015e378], rcx
lea r8, str.call
mov rdx, rbx
mov dword [rcx + 0x10], edi
mov qword [rcx + 8], rax
mov qword [rcx], rdi
mov rcx, rbx
call fcn.1400bd2b0
sub qword [0x14015e378], 0x18
jmp 0x1400046d7
mov rax, qword [rbp - 0x80]
mov rcx, qword [0x14015e378]
mov word [rbp - 0x14], ax
sar rax, 0x10
cmp rcx, qword [0x14015e380]
mov word [rbp - 0x12], ax
mov rax, qword [rbp - 0x48]
mov word [rbp - 0x10], di
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], edi
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x14]
mov qword [rbp + 0x30], rax
jne 0x1400044af
call fcn.140007980
mov rcx, qword [0x14015e378]
cmp rcx, qword [0x14015e370]
jb 0x1400044c9
mov rax, qword [0x140164390]
mov qword [rcx], rax
mov rcx, qword [0x14015e378]
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
jmp 0x140004426
mov rax, qword [rbp - 8]
movzx eax, byte [rax + 0x10]
add al, 0x64
cmp al, 3
ja 0x1400044f8
mov eax, dword [rbp - 0x80]
mov qword [r14 + 0x48], rax
cmp byte [0x1401662cc], dil
mov r15, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x50]
mov qword [r14 + 0xf8], rbx
movzx eax, byte [r15 + 0x24]
mov byte [r14 + 0x136], al
jne 0x1400046d7
cmp dword [0x1401617a4], edi
jne 0x140004534
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401617a4], eax
inc dword [0x1401662c8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [0x1401662c8]
mov ecx, eax
sub ecx, dword [0x1401617a4]
cmp r9d, dword [0x14015d644]
mov r8d, dword [0x14015d640]
mov dword [0x1401617a0], eax
jbe 0x140004573
cmp ecx, r8d
jae 0x140004573
mov ebx, 1
mov edx, ebx
jmp 0x14000457a
mov edx, edi
mov ebx, 1
test edx, edx
je 0x140004656
mov dword [rsp + 0x20], ecx
lea r8, str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea rcx, [rbp + 0x13a0]
mov edx, 0x800
call fcn.1400d08d0
movzx edx, word [0x14016179c]
mov r9d, edi
cmp di, dx
jae 0x1400045f3
mov r8, rdi
mov rax, qword [0x140161788]
mov rcx, qword [rax + r8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x1400045e4
nop dword [rax]
nop dword [rax + rax]
mov byte [rax + 0x27], dil
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400045d0
movzx edx, word [0x14016179c]
inc r9d
movzx eax, dx
add r8, 8
cmp r9d, eax
jl 0x1400045b0
xor r8d, r8d
mov byte [0x1401662cc], 1
movaps xmm3, xmm6
mov dword [0x14015bc04], edi
lea rcx, [rbp + 0x13a0]
mov qword [rsp + 0x20], rdi
lea edx, [r8 + 4]
call fcn.1400d8410
cmp eax, 7
jne 0x140004632
xor r8d, r8d
lea edx, [rax - 3]
lea rcx, [0x140163cc0]
call fcn.1400386f0
mov eax, dword [0x1401617a0]
mov dword [0x1401617a4], eax
mov dword [0x14015bc04], ebx
mov byte [0x1401662cc], dil
mov dword [0x1401662c8], edi
jmp 0x1400046d7
cmp ecx, r8d
jbe 0x140004667
mov dword [0x1401662c8], edi
mov dword [0x1401617a4], eax
mov r14, qword [rbp - 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, r15
movzx eax, byte [r14 + 0xf]
mov byte [0x14016486e], al
inc byte [r15 + 0x22]
mov rdx, qword [0x1401647c0]
call fcn.1400c0f50
dec byte [r15 + 0x22]
test eax, eax
jne 0x1400046a2
mov byte [r15 + 0x27], dil
jmp 0x1400046d7
cmp byte [r15 + 0x27], dil
je 0x1400046d7
mov byte [r15 + 0x27], dil
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [r15 + 0x18]
cmp eax, 0x3e8
ja 0x1400046d7
movzx r8d, word [r14 + 4]
xor r9d, r9d
mov rcx, qword [0x140160760]
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
lea rcx, [rbp + 0x1e0]
call fcn.140005700
cmp dword [rbp + 0x2408], 0
movsxd r15, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
mov rbx, r15
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
je 0x140001c70
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x140004735
movsxd r15, dword [rbp + 0x2400]
mov ecx, dword [rbp - 0x60]
mov rbx, r15
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jg 0x140001c70
jmp 0x14000473c
mov r15d, dword [rbp + 0x2400]
movsxd rbx, r15d
cmp rbx, 0xffffffffffffffff
jle 0x140004752
mov qword [0x1401648b0], rsi
mov dword [0x1401648c0], eax
mov r14b, 1
mov dword [0x1401648c4], eax
mov byte [rbp + 0x2410], r14b
mov byte [rsp + 0x48], 1
mov r12d, dword [rsp + 0x44]
jmp 0x140001c65
mov rcx, qword [0x14015bc10]
mov byte [rcx + 0x128], 0
jmp 0x140004788
mov rcx, qword [0x14015bc10]
mov rdx, qword [0x140160720]
test rdx, rdx
je 0x1400047c5
mov rcx, qword [0x140160760]
lea r8, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
test eax, eax
jne 0x140001c70
mov rcx, qword [0x14015bc10]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140002bb3
cmp rbx, 0xffffffffffffffff
jle 0x140004808
xor ebx, ebx
mov dword [0x1401648c0], eax
mov qword [0x1401648b0], rbx
jmp 0x14000480a
xor ebx, ebx
cmp byte [rsp + 0x49], 0
mov dword [0x1401648c4], eax
movzx eax, byte [0x14016057f]
cmovne eax, ebx
cmp byte [rsp + 0x4a], 0
mov byte [0x14016057f], al
je 0x140002aab
mov eax, dword [0x140160768]
dec eax
mov dword [0x140160768], eax
test r15d, r15d
jle 0x140002aab
test eax, eax
jne 0x140002aab
cmp dword [0x14016484c], eax
jne 0x140002aab
cmp dword [0x140161784], eax
jne 0x140002aab
cmp byte [0x14016057e], al
je 0x140002aab
mov rcx, qword [0x140160760]
lea edx, [rax + 9]
call qword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x14016057e]
test eax, eax
cmovne ecx, ebx
jmp 0x140002aa5