Function at 0x1400070b0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
mov eax, 0x1790
call fcn.1401354c0
sub rsp, rax
lea rdi, [rsp + 0x40]
mov ecx, 0x5d4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x17a0]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x1780], rax
mov byte [rsp + 0x15f8], 0
mov byte [rsp + 0x1602], 0
mov byte [rsp + 0x1600], 0
mov byte [rsp + 0x15ff], 0
mov byte [rsp + 0x1606], 0
mov byte [rsp + 0x1608], 0
mov byte [rsp + 0x1605], 0
mov byte [rsp + 0x15fd], 0
mov byte [rsp + 0x1601], 0
mov byte [rsp + 0x1604], 0
mov byte [rsp + 0x160b], 0
mov byte [rsp + 0x160a], 0
mov byte [rsp + 0x1603], 0
mov byte [rsp + 0x15fe], 0
mov byte [rsp + 0x1609], 0
mov byte [rsp + 0x160c], 0
mov byte [rsp + 0x1607], 0
mov byte [rsp + 0x40], 0
cmp dword [rsp + 0x17a8], 2
jne 0x1400071a9
mov dword [rsp + 0x17a8], 1
movzx eax, byte [0x14032153c]
test eax, eax
jne 0x1400071a9
mov byte [0x14032153c], 1
mov byte [rsp + 0x40], 1
cmp dword [rsp + 0x17a0], 0x8000012f
jne 0x1400071c8
mov dword [rsp + 0x17a0], 0xa
mov byte [rsp + 0x41], 1
jmp 0x1400071f6
cmp dword [rsp + 0x17a0], 5
jg 0x1400071df
mov dword [rsp + 0x1610], 1
jmp 0x1400071ea
mov dword [rsp + 0x1610], 0
movzx eax, byte [rsp + 0x1610]
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x41]
test eax, eax
je 0x14000720c
mov dword [rsp + 0x1614], 0
jmp 0x140007219
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x1614], eax
mov eax, dword [rsp + 0x1614]
mov dword [rsp + 0x44], eax
cmp dword [0x1403222c4], 0
je 0x140007232
call fcn.14000b590
mov byte [rsp + 0x48], 0
cmp dword [0x14032211c], 0
je 0x140007251
call fcn.1400061f0
movzx eax, al
test eax, eax
je 0x140007251
mov byte [rsp + 0x48], 1
cmp dword [rsp + 0x17a0], 0
jle 0x140007272
cmp dword [rsp + 0x17a8], 1
jne 0x140007272
mov dword [rsp + 0x1618], 1
jmp 0x14000727d
mov dword [rsp + 0x1618], 0
movzx eax, byte [rsp + 0x1618]
mov byte [rsp + 0x49], al
movzx eax, byte [rsp + 0x49]
test eax, eax
je 0x1400072eb
mov eax, dword [0x140321540]
inc eax
mov dword [0x140321540], eax
movzx eax, byte [0x140321533]
test eax, eax
jne 0x1400072eb
xor r9d, r9d
mov r8d, 0xa
mov edx, 9
mov rcx, qword [0x1403213e8]
call qword [sym.imp.USER32.dll_SetTimer]
test rax, rax
je 0x1400072d5
mov byte [rsp + 0x161c], 1
jmp 0x1400072dd
mov byte [rsp + 0x161c], 0
movzx eax, byte [rsp + 0x161c]
mov byte [0x140321533], al
mov byte [rsp + 0x4a], 0
mov byte [rsp + 0x4b], 0
mov dword [rsp + 0x4c], 0
lea r9, [fcn.140006040]
mov r8d, 6
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
lea rcx, [rsp + 0x170]
call fcn.140006170
cmp dword [rsp + 0x17a0], 0
jle 0x14000738a
movzx eax, byte [rsp + 0x4b]
test eax, eax
jne 0x14000738a
movzx eax, byte [0x14032153c]
test eax, eax
jne 0x14000738a
call fcn.140006ad0
test eax, eax
je 0x140007350
mov dword [rsp + 0x1620], 0
jmp 0x14000735b
mov dword [rsp + 0x1620], 0x311
mov byte [rsp + 0x15f8], 1
mov r9d, dword [rsp + 0x1620]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
jne 0x140007385
jmp 0x14000731c
jmp 0x14000781f
mov byte [rsp + 0x2a5], 0
movzx eax, byte [0x14032153c]
test eax, eax
je 0x140007693
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x140007693
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1403219e8]
jne 0x140007693
mov byte [rsp + 0x2a4], 0
cmp dword [0x140321588], 0
je 0x14000743a
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [0x140266430]
lea rcx, [rsp + 0xa0]
call fcn.1401a74f0
test eax, eax
jne 0x140007420
mov dword [rsp + 0x1624], 1
jmp 0x14000742b
mov dword [rsp + 0x1624], 0
movzx eax, byte [rsp + 0x1624]
mov byte [rsp + 0x2a4], al
movzx eax, byte [rsp + 0x2a4]
test eax, eax
jne 0x1400074cd
call qword [sym.imp.USER32.dll_GetFocus]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1400074cd
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [0x140266440]
lea rcx, [rsp + 0xa0]
call fcn.1401a7920
test eax, eax
je 0x1400074b3
lea rdx, [0x140266460]
lea rcx, [rsp + 0xa0]
call fcn.1401a7920
test eax, eax
je 0x1400074b3
mov dword [rsp + 0x1628], 0
jmp 0x1400074be
mov dword [rsp + 0x1628], 1
movzx eax, byte [rsp + 0x1628]
mov byte [rsp + 0x2a4], al
movzx eax, byte [rsp + 0x2a4]
test eax, eax
je 0x140007693
mov byte [rsp + 0x2a5], 1
call fcn.140006ad0
test eax, eax
je 0x1400074fb
mov dword [rsp + 0x162c], 0xffffffff
jmp 0x140007506
mov dword [rsp + 0x162c], 0x311
mov eax, dword [rsp + 0x162c]
mov dword [rsp + 0x2a8], eax
mov byte [rsp + 0x15f8], 1
mov dword [rsp + 0x20], 0
mov r9d, 0x1ff
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140007583
mov byte [rsp + 0x15f8], 1
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0x2a8]
mov r8d, 0x20f
xor edx, edx
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_PeekMessageW]
mov byte [rsp + 0x15fd], 1
mov dword [rsp + 0x254], eax
jmp 0x140007693
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x2ac], eax
mov byte [rsp + 0x15f8], 1
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x2a8]
mov r8d, 0x20f
xor edx, edx
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140007600
mov byte [rsp + 0x15f8], 1
mov dword [rsp + 0x20], 1
mov r9d, 0x1ff
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_PeekMessageW]
mov byte [rsp + 0x15fd], 1
mov dword [rsp + 0x254], eax
jmp 0x140007693
mov eax, dword [rsp + 0x2ac]
mov ecx, dword [rsp + 0x288]
sub ecx, eax
mov eax, ecx
test eax, eax
jle 0x140007648
mov byte [rsp + 0x15f8], 1
mov dword [rsp + 0x20], 1
mov r9d, 0x1ff
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_PeekMessageW]
mov dword [rsp + 0x1630], eax
jmp 0x14000767d
mov byte [rsp + 0x15f8], 1
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0x2a8]
mov r8d, 0x20f
xor edx, edx
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_PeekMessageW]
mov dword [rsp + 0x1630], eax
mov byte [rsp + 0x15fd], 1
mov eax, dword [rsp + 0x1630]
mov dword [rsp + 0x254], eax
movzx eax, byte [rsp + 0x2a5]
test eax, eax
jne 0x1400076fa
call fcn.140006ad0
test eax, eax
je 0x1400076b5
mov dword [rsp + 0x1634], 0
jmp 0x1400076c0
mov dword [rsp + 0x1634], 0x311
mov byte [rsp + 0x15f8], 1
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0x1634]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_PeekMessageW]
mov byte [rsp + 0x15fd], 1
mov dword [rsp + 0x254], eax
cmp byte [rsp + 0x15fd], 0
jne 0x140007710
lea rcx, str.peek_result
call fcn.1401352a0
cmp dword [rsp + 0x254], 0
jne 0x14000781f
cmp dword [rsp + 0x17a0], 0
jne 0x140007743
movzx eax, byte [rsp + 0x4a]
test eax, eax
jne 0x140007743
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x4a], 1
jmp 0x14000731c
cmp dword [rsp + 0x4c], 0
jne 0x140007777
movzx eax, byte [rsp + 0x41]
test eax, eax
je 0x140007777
cmp dword [rsp + 0x17a0], 0
jle 0x140007768
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
jmp 0x14000731c
movzx r8d, byte [rsp + 0x41]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x17a0]
call fcn.140006a70
test eax, eax
je 0x14000780f
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x1400077a1
mov byte [0x14032153c], 0
movzx eax, byte [rsp + 0x49]
test eax, eax
je 0x140007805
mov eax, dword [0x140321540]
dec eax
mov dword [0x140321540], eax
cmp dword [rsp + 0x17a0], 0
jle 0x140007805
cmp dword [0x140321540], 0
jne 0x140007805
cmp dword [0x14032211c], 0
jne 0x140007805
cmp dword [0x1403222c4], 0
jne 0x140007805
movzx eax, byte [0x140321533]
test eax, eax
je 0x140007805
mov edx, 9
mov rcx, qword [0x1403213e8]
call qword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x140007805
mov byte [0x140321533], 0
movzx eax, byte [rsp + 0x48]
jmp 0x14000b398
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000731c
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
lea rcx, [0x140322220]
call fcn.140006570
test eax, eax
je 0x1400078a1
cmp byte [rsp + 0x15f8], 0
jne 0x14000784f
lea rcx, [0x14026653c]
call fcn.1401352a0
mov byte [rsp + 0x15f8], 1
lea rax, [rsp + 0x248]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x268]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x280]
mov r8, qword [rsp + 0x278]
mov edx, dword [rsp + 0x270]
mov rcx, qword [rsp + 0x268]
call fcn.140006f90
movzx eax, al
test eax, eax
je 0x1400078a1
jmp 0x14000731c
cmp qword [0x140321590], 0
je 0x1400080fe
cmp dword [rsp + 0x270], 0x100
jb 0x1400080fe
cmp dword [rsp + 0x270], 0x109
ja 0x1400080fe
cmp byte [rsp + 0x15f8], 0
jne 0x1400078e7
lea rcx, [0x14026653c]
call fcn.1401352a0
mov rcx, qword [rsp + 0x268]
call fcn.1400d4a50
mov byte [rsp + 0x15fe], 1
mov qword [rsp + 0x120], rax
cmp byte [rsp + 0x15fe], 0
jne 0x14000791a
lea rcx, str.pgui
call fcn.1401352a0
cmp qword [rsp + 0x120], 0
je 0x1400080fe
cmp byte [rsp + 0x15f8], 0
jne 0x14000793f
lea rcx, [0x14026653c]
call fcn.1401352a0
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x60], rax
cmp byte [rsp + 0x15fe], 0
jne 0x140007962
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x78], 0
je 0x1400079d4
mov byte [rsp + 0x15f8], 1
cmp byte [rsp + 0x15fe], 0
jne 0x14000798f
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x1400079a5
lea rcx, str.pgui
call fcn.1401352a0
lea r8, [rsp + 0x268]
mov rax, qword [rsp + 0x120]
mov rdx, qword [rax + 0x78]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
je 0x1400079d4
jmp 0x14000731c
cmp dword [rsp + 0x270], 0x100
jne 0x140007d7e
cmp byte [rsp + 0x15fe], 0
jne 0x1400079fb
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
movzx eax, byte [rax + 0x108]
test eax, eax
je 0x140007d7e
cmp qword [rsp + 0x278], 0x22
je 0x140007a4d
cmp qword [rsp + 0x278], 0x21
je 0x140007a4d
cmp qword [rsp + 0x278], 9
je 0x140007a4d
cmp qword [rsp + 0x278], 0x25
je 0x140007a4d
cmp qword [rsp + 0x278], 0x27
jne 0x140007d7e
cmp byte [rsp + 0x15fe], 0
jne 0x140007a63
lea rcx, str.pgui
call fcn.1401352a0
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x120]
call fcn.1400065d0
mov byte [rsp + 0x15ff], 1
mov qword [rsp + 0x128], rax
cmp byte [rsp + 0x15ff], 0
jne 0x140007a9b
lea rcx, [0x140266548]
call fcn.1401352a0
cmp qword [rsp + 0x128], 0
je 0x140007d7e
cmp byte [rsp + 0x15ff], 0
jne 0x140007ac0
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x50]
cmp eax, 0xf
je 0x140007d7e
mov qword [rsp + 0x130], 0
cmp byte [rsp + 0x15ff], 0
jne 0x140007af7
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x50]
cmp eax, 0x13
jne 0x140007ba6
cmp byte [rsp + 0x15ff], 0
jne 0x140007b22
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x130], rax
cmp qword [rsp + 0x278], 0x25
je 0x140007b48
cmp qword [rsp + 0x278], 0x27
jne 0x140007ba6
cmp qword [rsp + 0x278], 0x27
jne 0x140007b5d
mov byte [rsp + 0x1638], 1
jmp 0x140007b65
mov byte [rsp + 0x1638], 0
cmp byte [rsp + 0x15fe], 0
jne 0x140007b7b
lea rcx, str.pgui
call fcn.1401352a0
mov byte [rsp + 0x20], 0
xor r9d, r9d
movzx r8d, byte [rsp + 0x1638]
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x120]
call fcn.1400dac60
jmp 0x14000731c
cmp qword [rsp + 0x278], 0x25
je 0x140007d7e
cmp qword [rsp + 0x278], 0x27
je 0x140007d7e
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140007d7e
cmp qword [rsp + 0x278], 9
jne 0x140007c47
cmp byte [rsp + 0x15ff], 0
jne 0x140007bfe
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x50]
cmp eax, 0xc
jne 0x140007c47
cmp byte [rsp + 0x15ff], 0
jne 0x140007c25
lea rcx, [0x140266548]
call fcn.1401352a0
mov edx, 0xfffffff0
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 4
test eax, eax
jne 0x140007d7e
cmp qword [rsp + 0x130], 0
jne 0x140007cdb
cmp byte [rsp + 0x15ff], 0
jne 0x140007c6c
lea rcx, [0x140266548]
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x140007c82
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx edx, byte [rax + 0x52]
mov rcx, qword [rsp + 0x120]
call fcn.1400d51d0
mov qword [rsp + 0x130], rax
cmp qword [rsp + 0x130], 0
jne 0x140007cdb
cmp byte [rsp + 0x15fe], 0
jne 0x140007cc4
lea rcx, str.pgui
call fcn.1401352a0
xor edx, edx
mov rcx, qword [rsp + 0x120]
call fcn.1400d51d0
mov qword [rsp + 0x130], rax
cmp qword [rsp + 0x130], 0
je 0x140007d7e
mov rax, qword [rsp + 0x130]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140007d7e
cmp qword [rsp + 0x278], 0x22
je 0x140007d35
cmp qword [rsp + 0x278], 9
jne 0x140007d2b
mov ecx, reloc.WSOCK32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140007d35
mov byte [rsp + 0x1639], 0
jmp 0x140007d3d
mov byte [rsp + 0x1639], 1
cmp byte [rsp + 0x15fe], 0
jne 0x140007d53
lea rcx, str.pgui
call fcn.1401352a0
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, byte [rsp + 0x1639]
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x120]
call fcn.1400dac60
jmp 0x14000731c
cmp dword [rsp + 0x270], 0x100
jne 0x140007fcb
cmp qword [rsp + 0x278], 0x1b
je 0x140007de6
cmp qword [rsp + 0x278], 9
je 0x140007de6
cmp qword [rsp + 0x278], 0x41
jne 0x140007fcb
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140007fcb
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x140007fcb
cmp byte [rsp + 0x15fe], 0
jne 0x140007dfc
lea rcx, str.pgui
call fcn.1401352a0
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x120]
call fcn.1400065d0
mov byte [rsp + 0x15ff], 1
mov qword [rsp + 0x128], rax
cmp byte [rsp + 0x15ff], 0
jne 0x140007e34
lea rcx, [0x140266548]
call fcn.1401352a0
cmp qword [rsp + 0x128], 0
je 0x140007fcb
cmp byte [rsp + 0x15ff], 0
jne 0x140007e59
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x50]
cmp eax, 0xc
jne 0x140007fcb
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x1640], rax
cmp qword [rsp + 0x1640], 0x1b
je 0x140007f03
cmp qword [rsp + 0x1640], 0x41
je 0x140007e99
jmp 0x140007f2b
cmp byte [rsp + 0x15ff], 0
jne 0x140007eaf
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x51]
and eax, 2
test eax, eax
jne 0x140007efe
cmp byte [rsp + 0x15ff], 0
jne 0x140007ed8
lea rcx, [0x140266548]
call fcn.1401352a0
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14000731c
jmp 0x140007fcb
cmp byte [rsp + 0x15fe], 0
jne 0x140007f19
lea rcx, str.pgui
call fcn.1401352a0
mov rcx, qword [rsp + 0x120]
call fcn.1400d41d0
jmp 0x14000731c
cmp byte [rsp + 0x15ff], 0
jne 0x140007f41
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x51]
and eax, 0x80
test eax, eax
je 0x140007fcb
cmp byte [rsp + 0x15ff], 0
jne 0x140007f6c
lea rcx, [0x140266548]
call fcn.1401352a0
mov edx, 0xfffffff0
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0x800
test eax, eax
jne 0x140007fcb
cmp byte [rsp + 0x15ff], 0
jne 0x140007fa2
lea rcx, [0x140266548]
call fcn.1401352a0
lea r9, [0x14026645c]
mov r8d, 1
mov edx, 0xc2
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14000731c
cmp qword [0x140325830], 0
je 0x140008037
cmp dword [rsp + 0x270], 0x100
jne 0x140008037
cmp qword [rsp + 0x278], 0xd
jne 0x14000800c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1116
mov rcx, qword [0x140325830]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14000731c
cmp qword [rsp + 0x278], 0x1b
jne 0x140008037
xor r9d, r9d
mov r8d, 1
mov edx, 0x1116
mov rcx, qword [0x140325830]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14000731c
cmp byte [rsp + 0x15fe], 0
jne 0x14000804d
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
cmp dword [rax + 0xa8], 0
jne 0x14000806f
cmp dword [rsp + 0x270], 0x106
je 0x1400080fe
mov rax, qword [0x14031a1e8]
mov byte [rax + 0x7e], 1
mov rax, qword [0x14031a1e8]
mov ecx, dword [rsp + 0x270]
mov dword [rax + 0x78], ecx
mov byte [rsp + 0x15f8], 1
cmp byte [rsp + 0x15fe], 0
jne 0x1400080a9
lea rcx, str.pgui
call fcn.1401352a0
lea rdx, [rsp + 0x268]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x1400080d1
mov byte [rsp + 0x1648], 1
jmp 0x1400080d9
mov byte [rsp + 0x1648], 0
movzx eax, byte [rsp + 0x1648]
mov byte [rsp + 0x50], al
mov rax, qword [0x14031a1e8]
mov byte [rax + 0x7e], 0
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x1400080fe
jmp 0x14000731c
mov eax, dword [rsp + 0x270]
mov dword [rsp + 0x164c], eax
cmp dword [rsp + 0x164c], 0x402
ja 0x1400081ae
cmp dword [rsp + 0x164c], 0x402
je case.0x1400081e7.1044
cmp dword [rsp + 0x164c], 0x113
ja 0x14000817e
cmp dword [rsp + 0x164c], 0x113
je 0x14000b0ca
cmp dword [rsp + 0x164c], 0x12
je 0x14000b241
cmp dword [rsp + 0x164c], 0x4b
je 0x14000b1e4
cmp dword [rsp + 0x164c], 0x100
je 0x14000b1f9
jmp case.0x1400081e7.1046
cmp dword [rsp + 0x164c], 0x312
je case.0x1400081e7.1044
cmp dword [rsp + 0x164c], 0x400
je case.0x1400081e7.1045
cmp dword [rsp + 0x164c], 0x401
je case.0x1400081e7.1045
jmp case.0x1400081e7.1046
mov eax, dword [rsp + 0x164c]
sub eax, 0x414
mov dword [rsp + 0x164c], eax
cmp dword [rsp + 0x164c], 0xa
ja case.0x1400081e7.1046
mov eax, dword [rsp + 0x164c]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0xb3c8]
add rax, rcx
jmp rax
cmp byte [rsp + 0x15f8], 0
jne 0x1400081ff
lea rcx, [0x14026653c]
call fcn.1401352a0
cmp qword [rsp + 0x268], 0
je case.0x1400081e7.1044
cmp byte [rsp + 0x15f8], 0
jne 0x140008220
lea rcx, [0x14026653c]
call fcn.1401352a0
mov rax, qword [0x1403213e8]
cmp qword [rsp + 0x268], rax
je case.0x1400081e7.1044
jmp case.0x1400081e7.1046
mov qword [rsp + 0x228], 0
mov eax, dword [rsp + 0x270]
mov dword [rsp + 0x1650], eax
mov eax, dword [rsp + 0x1650]
sub eax, 0x401
mov dword [rsp + 0x1650], eax
cmp dword [rsp + 0x1650], 0x1d
ja case.0x140008291.1033
mov eax, dword [rsp + 0x1650]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0xb418]
mov eax, dword [rcx + rax*4 + 0xb3f4]
add rax, rcx
jmp rax
cmp byte [rsp + 0x15f8], 0
jne 0x1400082a9
lea rcx, [0x14026653c]
call fcn.1401352a0
mov rcx, qword [rsp + 0x268]
call fcn.1400d4a00
mov byte [rsp + 0x15fe], 1
mov qword [rsp + 0x120], rax
cmp byte [rsp + 0x15fe], 0
jne 0x1400082dc
lea rcx, str.pgui
call fcn.1401352a0
cmp qword [rsp + 0x120], 0
jne 0x1400082f1
jmp case.0x1400081e7.1046
mov byte [rsp + 0x1600], 1
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x278]
and rax, 0xff
movzx eax, al
mov byte [rsp + 0x1601], 1
mov dword [rsp + 0x13c], eax
mov rax, qword [rsp + 0x278]
shr rax, 8
and rax, 0xff
mov byte [rsp + 0x1602], 1
mov byte [rsp + 0x150], al
mov rax, qword [rsp + 0x278]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rsp + 0x138], eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], 0
cmp byte [rsp + 0x1601], 0
jne 0x14000838f
lea rcx, str.gui_action
call fcn.1401352a0
mov byte [rsp + 0x1604], 1
mov eax, dword [rsp + 0x13c]
mov dword [rsp + 0x144], eax
cmp byte [rsp + 0x15fe], 0
jne 0x1400083bb
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov eax, dword [rax + 0xa8]
cmp dword [rsp + 0x138], eax
jae 0x140008409
cmp byte [rsp + 0x15fe], 0
jne 0x1400083e8
lea rcx, str.pgui
call fcn.1401352a0
mov eax, dword [rsp + 0x138]
mov rcx, qword [rsp + 0x120]
mov rcx, qword [rcx + 0x50]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x1658], rax
jmp 0x140008415
mov qword [rsp + 0x1658], 0
mov byte [rsp + 0x15ff], 1
mov rax, qword [rsp + 0x1658]
mov qword [rsp + 0x128], rax
cmp byte [rsp + 0x15fe], 0
jne 0x140008443
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
add rax, 0x90
mov qword [rsp + 0x158], rax
mov byte [rsp + 0x1605], 1
mov byte [rsp + 0x151], 0
mov byte [rsp + 0x1606], 1
mov byte [rsp + 0x140], 0
cmp byte [rsp + 0x1601], 0
jne 0x14000848f
lea rcx, str.gui_action
call fcn.1401352a0
mov eax, dword [rsp + 0x13c]
mov dword [rsp + 0x1660], eax
mov eax, dword [rsp + 0x1660]
dec eax
mov dword [rsp + 0x1660], eax
cmp dword [rsp + 0x1660], 0x10
ja case.0x1400084d3.6
mov eax, dword [rsp + 0x1660]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0xb438]
add rax, rcx
jmp rax
jmp 0x14000863b
mov qword [rsp + 0x158], 0
jmp 0x14000863b
cmp byte [rsp + 0x15fe], 0
jne 0x140008501
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x228], rax
cmp qword [rsp + 0x228], 0
je 0x140008556
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov eax, eax
mov byte [rsp + 0x1600], 1
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0x148], 0
jne 0x14000859a
cmp qword [rsp + 0x228], 0
je 0x140008595
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.SHELL32.dll_DragFinish]
cmp byte [rsp + 0x15fe], 0
jne 0x140008585
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov qword [rax + 0x60], 0
jmp 0x14000731c
jmp 0x14000863b
mov byte [rsp + 0x1606], 1
mov byte [rsp + 0x140], 2
cmp byte [rsp + 0x1600], 0
jne 0x1400085c5
lea rcx, str.gui_event_info
call fcn.1401352a0
mov byte [rsp + 0x1604], 1
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x144], eax
cmp byte [rsp + 0x15ff], 0
jne 0x1400085f1
lea rcx, [0x140266548]
call fcn.1401352a0
cmp qword [rsp + 0x128], 0
jne 0x140008601
jmp 0x14000731c
cmp byte [rsp + 0x15ff], 0
jne 0x140008617
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
add rax, 0x38
mov qword [rsp + 0x158], rax
mov byte [rsp + 0x1605], 1
mov byte [rsp + 0x151], 1
cmp qword [rsp + 0x158], 0
je 0x1400086db
cmp byte [rsp + 0x1606], 0
jne 0x140008660
lea rcx, str.gui_event_kind
call fcn.1401352a0
cmp byte [rsp + 0x1604], 0
jne 0x140008676
lea rcx, str.gui_event_code
call fcn.1401352a0
movzx r8d, byte [rsp + 0x140]
mov edx, dword [rsp + 0x144]
mov rcx, qword [rsp + 0x158]
call fcn.1400a6910
test eax, eax
je 0x1400086db
cmp qword [rsp + 0x228], 0
je 0x1400086d6
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.SHELL32.dll_DragFinish]
cmp byte [rsp + 0x15fe], 0
jne 0x1400086c6
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov qword [rax + 0x60], 0
jmp 0x14000731c
mov dword [rsp + 0x110], 0
jmp 0x140008fb2
cmp qword [rsp + 0x278], 0
je 0x14000878c
mov rcx, qword [rsp + 0x278]
call fcn.1400d4a00
mov byte [rsp + 0x15fe], 1
mov qword [rsp + 0x120], rax
cmp byte [rsp + 0x15fe], 0
jne 0x14000872d
lea rcx, str.pgui
call fcn.1401352a0
cmp qword [rsp + 0x120], 0
jne 0x14000878a
cmp byte [rsp + 0x15f8], 0
jne 0x14000874e
lea rcx, [0x14026653c]
call fcn.1401352a0
cmp qword [rsp + 0x268], 0
je 0x14000878a
cmp byte [rsp + 0x15f8], 0
jne 0x14000876f
lea rcx, [0x14026653c]
call fcn.1401352a0
mov rax, qword [0x1403213e8]
cmp qword [rsp + 0x268], rax
je 0x14000878a
jmp case.0x1400081e7.1046
jmp 0x1400087a0
mov byte [rsp + 0x15fe], 1
mov qword [rsp + 0x120], 0
mov edx, dword [rsp + 0x280]
lea rcx, [0x1403219f0]
call fcn.1400066c0
mov byte [rsp + 0x1607], 1
mov qword [rsp + 0xe8], rax
cmp byte [rsp + 0x1607], 0
jne 0x1400087d9
lea rcx, str.menu_item
call fcn.1401352a0
cmp qword [rsp + 0xe8], 0
jne 0x1400087e9
jmp 0x14000731c
cmp byte [rsp + 0x1607], 0
jne 0x1400087ff
lea rcx, str.menu_item
call fcn.1401352a0
mov rax, qword [rsp + 0xe8]
add rax, 0x10
mov rcx, rax
call fcn.140006150
test rax, rax
jne 0x14000881d
jmp 0x14000731c
cmp byte [rsp + 0x1607], 0
jne 0x140008833
lea rcx, str.menu_item
call fcn.1401352a0
mov rax, qword [rsp + 0xe8]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x110], eax
jmp 0x140008fb2
mov eax, dword [0x1403222e0]
cmp qword [rsp + 0x278], rax
jb 0x14000885f
jmp 0x14000731c
mov byte [rsp + 0x1608], 1
mov rax, qword [0x1403222d8]
mov rcx, qword [rsp + 0x278]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x118], rax
cmp byte [rsp + 0x1608], 0
jne 0x140008898
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x118]
cmp qword [rax + 0x20], 0
je 0x14000898b
cmp byte [rsp + 0x1608], 0
jne 0x1400088c1
lea rcx, [0x140266554]
call fcn.1401352a0
cmp byte [rsp + 0x1608], 0
jne 0x1400088d7
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x118]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x118]
mov rcx, qword [rax + 0x20]
call fcn.1400313f0
mov byte [rsp + 0x1609], 1
mov qword [rsp + 0x78], rax
cmp byte [rsp + 0x1609], 0
jne 0x140008917
lea rcx, str.criterion_found_hwnd
call fcn.1401352a0
cmp qword [rsp + 0x78], 0
jne 0x140008924
jmp 0x14000731c
cmp byte [rsp + 0x1608], 0
jne 0x14000893a
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x118]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax]
cmp eax, 1
je 0x140008989
cmp byte [rsp + 0x1608], 0
jne 0x140008964
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x118]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax]
cmp eax, 3
je 0x140008989
mov byte [rsp + 0x1609], 1
mov qword [rsp + 0x78], 0
jmp 0x14000899c
mov byte [rsp + 0x1609], 1
mov qword [rsp + 0x78], 0
cmp byte [rsp + 0x1608], 0
jne 0x1400089b2
lea rcx, [0x140266554]
call fcn.1401352a0
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x118]
call fcn.14002ff90
cmp byte [rsp + 0x1608], 0
jne 0x1400089dd
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x118]
cmp qword [rax + 0x18], 0
je 0x1400089f1
jmp 0x14000731c
cmp byte [rsp + 0x1608], 0
jne 0x140008a07
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x118]
movzx eax, byte [rax + 0x3e]
test eax, eax
je 0x140008a31
mov rax, qword [rsp + 0x280]
and rax, 0xffff
movzx eax, ax
mov dword [rsp + 0x1664], eax
jmp 0x140008a3c
mov dword [rsp + 0x1664], 0
movzx eax, word [rsp + 0x1664]
mov word [0x14032213c], ax
cmp byte [rsp + 0x1608], 0
jne 0x140008a61
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x118]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x110], eax
jmp 0x140008fb2
movzx eax, byte [0x140322100]
test eax, eax
je 0x140008a88
jmp 0x14000731c
mov dword [rsp + 0x110], 0
jmp 0x140008fb2
mov rcx, qword [rsp + 0x278]
call fcn.14004a950
mov byte [rsp + 0x160a], 1
mov qword [rsp + 0x230], rax
cmp byte [rsp + 0x160a], 0
jne 0x140008acb
lea rcx, str.input_hook
call fcn.1401352a0
cmp qword [rsp + 0x230], 0
jne 0x140008adb
jmp 0x14000731c
mov dword [rsp + 0x110], 0
jmp 0x140008fb2
mov byte [rsp + 0x160a], 1
mov rax, qword [0x140321728]
mov qword [rsp + 0x230], rax
jmp 0x140008b36
cmp byte [rsp + 0x160a], 0
jne 0x140008b1a
lea rcx, str.input_hook
call fcn.1401352a0
mov byte [rsp + 0x160a], 1
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 8]
mov qword [rsp + 0x230], rax
cmp byte [rsp + 0x160a], 0
jne 0x140008b4c
lea rcx, str.input_hook
call fcn.1401352a0
cmp qword [rsp + 0x230], 0
je 0x140008b81
cmp byte [rsp + 0x160a], 0
jne 0x140008b6d
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x278]
cmp qword [rsp + 0x230], rax
je 0x140008b81
jmp 0x140008b04
cmp byte [rsp + 0x160a], 0
jne 0x140008b97
lea rcx, str.input_hook
call fcn.1401352a0
cmp qword [rsp + 0x230], 0
jne 0x140008ba7
jmp 0x14000731c
cmp dword [rsp + 0x270], 0x41c
jne 0x140008bea
cmp byte [rsp + 0x160a], 0
jne 0x140008bca
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + 0x3a0]
mov qword [rsp + 0x1668], rax
jmp 0x140008c6b
cmp dword [rsp + 0x270], 0x41e
jne 0x140008c2a
cmp byte [rsp + 0x160a], 0
jne 0x140008c0d
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + 0x3b0]
mov qword [rsp + 0x1670], rax
jmp 0x140008c5b
cmp byte [rsp + 0x160a], 0
jne 0x140008c40
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + 0x3a8]
mov qword [rsp + 0x1670], rax
mov rax, qword [rsp + 0x1670]
mov qword [rsp + 0x1668], rax
cmp qword [rsp + 0x1668], 0
jne 0x140008c7b
jmp 0x14000731c
mov dword [rsp + 0x110], 0
jmp 0x140008fb2
mov rax, qword [rsp + 0x278]
and rax, 0x7fff
mov word [rsp + 0xf0], ax
movzx eax, word [rsp + 0xf0]
mov rcx, qword [0x14031a1f0]
movzx ecx, word [rcx]
cmp eax, ecx
jl 0x140008cbc
jmp 0x14000731c
movzx eax, word [rsp + 0xf0]
mov byte [rsp + 0x160b], 1
mov rcx, qword [0x1403222b8]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0xf8], rax
mov byte [rsp + 0x160c], 1
mov qword [rsp + 0x108], 0
mov rax, qword [rsp + 0x278]
shr rax, 0x10
and rax, 0xffff
mov word [rsp + 0x100], ax
movzx eax, word [rsp + 0x100]
test eax, eax
je 0x140008db7
movzx eax, word [rsp + 0x100]
dec ax
mov word [rsp + 0x100], ax
cmp byte [rsp + 0x160b], 0
jne 0x140008d46
lea rcx, [0x140266564]
call fcn.1401352a0
mov byte [rsp + 0x160c], 1
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x108], rax
jmp 0x140008da9
cmp byte [rsp + 0x160c], 0
jne 0x140008d7a
lea rcx, str.variant
call fcn.1401352a0
mov byte [rsp + 0x160c], 1
mov rax, qword [rsp + 0x108]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x108], rax
movzx eax, word [rsp + 0x100]
dec ax
mov word [rsp + 0x100], ax
movzx eax, word [rsp + 0x100]
test eax, eax
je 0x140008db7
jmp 0x140008d64
cmp byte [rsp + 0x160c], 0
jne 0x140008dcd
lea rcx, str.variant
call fcn.1401352a0
cmp qword [rsp + 0x108], 0
jne 0x140008e8e
cmp dword [rsp + 0x270], 0x400
jne 0x140008e10
mov rax, qword [rsp + 0x280]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov ecx, 0xffc3d44d
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1678], eax
jmp 0x140008e1b
mov dword [rsp + 0x1678], 0
cmp byte [rsp + 0x160b], 0
jne 0x140008e31
lea rcx, [0x140266564]
call fcn.1401352a0
mov eax, dword [rsp + 0x1678]
mov byte [rsp + 0x1609], 1
xor r9d, r9d
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xf8]
call fcn.14002f9d0
mov byte [rsp + 0x160c], 1
mov qword [rsp + 0x108], rax
cmp byte [rsp + 0x160c], 0
jne 0x140008e7e
lea rcx, str.variant
call fcn.1401352a0
cmp qword [rsp + 0x108], 0
jne 0x140008e8e
jmp 0x14000731c
cmp byte [rsp + 0x160c], 0
jne 0x140008ea4
lea rcx, str.variant
call fcn.1401352a0
cmp byte [rsp + 0x160b], 0
jne 0x140008eba
lea rcx, [0x140266564]
call fcn.1401352a0
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0xf8]
call fcn.14000b550
movzx eax, al
test eax, eax
jne 0x140008efe
cmp byte [rsp + 0x160c], 0
jne 0x140008eec
lea rcx, str.variant
call fcn.1401352a0
mov rcx, qword [rsp + 0x108]
call fcn.14000b750
jmp 0x14000731c
cmp byte [rsp + 0x160c], 0
jne 0x140008f14
lea rcx, str.variant
call fcn.1401352a0
mov rax, qword [rsp + 0x108]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0
je 0x140008f53
mov rax, qword [rsp + 0x2b0]
movzx eax, byte [rax]
cmp eax, 2
je 0x140008f53
mov rax, qword [rsp + 0x2b0]
movzx eax, byte [rax]
cmp eax, 4
jne 0x140008f66
mov byte [rsp + 0x1609], 1
mov qword [rsp + 0x78], 0
jmp 0x140008f8a
mov rax, qword [rsp + 0x2b0]
movzx eax, byte [rax]
cmp eax, 5
jne 0x140008f8a
mov byte [rsp + 0x1609], 1
mov rax, qword [0x140321568]
mov qword [rsp + 0x78], rax
cmp byte [rsp + 0x160c], 0
jne 0x140008fa0
lea rcx, str.variant
call fcn.1401352a0
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x110], eax
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
cmp dword [0x140321544], eax
jl 0x14000905f
cmp qword [rsp + 0x228], 0
je 0x140009003
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.SHELL32.dll_DragFinish]
cmp byte [rsp + 0x15fe], 0
jne 0x140008ff3
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov qword [rax + 0x60], 0
cmp dword [rsp + 0x270], 0x41b
jne 0x14000905a
cmp byte [rsp + 0x160a], 0
jne 0x140009026
lea rcx, str.input_hook
call fcn.1401352a0
cmp byte [rsp + 0x160a], 0
jne 0x14000903c
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x230]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x14000731c
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0x68]
cmp dword [rsp + 0x110], eax
jge 0x140009111
cmp qword [rsp + 0x228], 0
je 0x1400090b5
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.SHELL32.dll_DragFinish]
cmp byte [rsp + 0x15fe], 0
jne 0x1400090a5
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov qword [rax + 0x60], 0
cmp dword [rsp + 0x270], 0x41b
jne 0x14000910c
cmp byte [rsp + 0x160a], 0
jne 0x1400090d8
lea rcx, str.input_hook
call fcn.1401352a0
cmp byte [rsp + 0x160a], 0
jne 0x1400090ee
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x230]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x14000731c
mov byte [rsp + 0x48], 1
mov eax, dword [rsp + 0x270]
mov dword [rsp + 0x167c], eax
mov eax, dword [rsp + 0x167c]
sub eax, 0x402
mov dword [rsp + 0x167c], eax
cmp dword [rsp + 0x167c], 0x1c
ja case.0x140009161.1033
mov eax, dword [rsp + 0x167c]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0xb49c]
mov eax, dword [rcx + rax*4 + 0xb47c]
add rax, rcx
jmp rax
jmp 0x140009200
mov rax, qword [0x1403220a8]
mov qword [0x1403220b0], rax
mov eax, dword [0x140322134]
mov dword [0x140322138], eax
cmp dword [rsp + 0x270], 0x401
jne 0x1400091bb
cmp byte [rsp + 0x1608], 0
jne 0x1400091a5
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x118]
mov rax, qword [rax + 8]
mov qword [rsp + 0x1680], rax
jmp 0x1400091e5
cmp byte [rsp + 0x160b], 0
jne 0x1400091d1
lea rcx, [0x140266564]
call fcn.1401352a0
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x1680], rax
mov rax, qword [rsp + 0x1680]
mov qword [0x1403220a8], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140322134], eax
xor r9d, r9d
mov r8b, 1
xor edx, edx
mov ecx, dword [rsp + 0x110]
call fcn.140006790
mov rax, qword [0x14031a1e8]
mov qword [rsp + 0x2b8], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140322198], eax
mov eax, dword [rsp + 0x270]
mov dword [rsp + 0x1688], eax
mov eax, dword [rsp + 0x1688]
sub eax, 0x401
mov dword [rsp + 0x1688], eax
cmp dword [rsp + 0x1688], 0x1d
ja case.0x14000927e.1033
mov eax, dword [rsp + 0x1688]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0xb4e0]
mov eax, dword [rcx + rax*4 + 0xb4bc]
add rax, rcx
jmp rax
cmp byte [rsp + 0x1605], 0
jne 0x140009296
lea rcx, str.event_is_control_generated
call fcn.1401352a0
movzx eax, byte [rsp + 0x151]
test eax, eax
je 0x1400092ca
cmp byte [rsp + 0x15ff], 0
jne 0x1400092b8
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x1690], rax
jmp 0x1400092f0
cmp byte [rsp + 0x15fe], 0
jne 0x1400092e0
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x1690], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009306
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1698], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009338
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov rdx, qword [rsp + 0x1690]
mov rcx, qword [rsp + 0x1698]
call fcn.14000b7c0
cmp byte [rsp + 0x1601], 0
jne 0x14000937b
lea rcx, str.gui_action
call fcn.1401352a0
mov eax, dword [rsp + 0x13c]
mov dword [rsp + 0x16a0], eax
mov eax, dword [rsp + 0x16a0]
dec eax
mov dword [rsp + 0x16a0], eax
cmp dword [rsp + 0x16a0], 0x10
ja case.0x1400093bf.6
mov eax, dword [rsp + 0x16a0]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0xb500]
add rax, rcx
jmp rax
cmp byte [rsp + 0x1602], 0
jne 0x1400093d7
lea rcx, str.gui_event_byte
call fcn.1401352a0
cmp byte [rsp + 0x150], 0
je 0x1400093eb
mov byte [rsp + 0x16a4], 1
jmp 0x1400093f3
mov byte [rsp + 0x16a4], 0
movzx eax, byte [rsp + 0x16a4]
mov byte [rsp + 0x2c0], al
mov rax, qword [rsp + 0x28c]
mov qword [rsp + 0x218], rax
cmp byte [rsp + 0x15ff], 0
jne 0x140009428
lea rcx, [0x140266548]
call fcn.1401352a0
cmp qword [rsp + 0x128], 0
je 0x140009666
movzx eax, byte [rsp + 0x2c0]
test eax, eax
je 0x14000948c
cmp byte [rsp + 0x15ff], 0
jne 0x140009459
lea rcx, [0x140266548]
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x14000946f
lea rcx, str.pgui
call fcn.1401352a0
lea r8, [rsp + 0x218]
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x120]
call fcn.1400ca7b0
cmp byte [rsp + 0x15ff], 0
jne 0x1400094a2
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x50]
mov byte [rsp + 0x16a8], al
cmp byte [rsp + 0x16a8], 9
je 0x1400094dc
cmp byte [rsp + 0x16a8], 0xa
je 0x140009528
cmp byte [rsp + 0x16a8], 0xb
je 0x140009587
jmp 0x140009666
cmp byte [rsp + 0x15ff], 0
jne 0x1400094f2
lea rcx, [0x140266548]
call fcn.1401352a0
xor r9d, r9d
xor r8d, r8d
mov edx, OleCreatePictureIndirect
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
inc eax
cdqe
mov byte [rsp + 0x1600], 1
mov qword [rsp + 0x148], rax
jmp 0x140009666
movzx eax, byte [rsp + 0x2c0]
test eax, eax
je 0x140009582
cmp byte [rsp + 0x15ff], 0
jne 0x14000954a
lea rcx, [0x140266548]
call fcn.1401352a0
mov r9d, 1
mov r8, 0xffffffffffffffff
mov edx, 0x100c
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
inc eax
cdqe
mov byte [rsp + 0x1600], 1
mov qword [rsp + 0x148], rax
jmp 0x140009666
movzx eax, byte [rsp + 0x2c0]
test eax, eax
je 0x1400095de
cmp byte [rsp + 0x15ff], 0
jne 0x1400095a9
lea rcx, [0x140266548]
call fcn.1401352a0
xor r9d, r9d
mov r8d, 9
mov edx, 0x110a
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov byte [rsp + 0x1600], 1
mov qword [rsp + 0x148], rax
jmp 0x140009666
mov rax, qword [rsp + 0x28c]
mov qword [rsp + 0x2d8], rax
cmp byte [rsp + 0x15ff], 0
jne 0x140009604
lea rcx, [0x140266548]
call fcn.1401352a0
lea rdx, [rsp + 0x2d8]
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp byte [rsp + 0x15ff], 0
jne 0x140009634
lea rcx, [0x140266548]
call fcn.1401352a0
lea r9, [rsp + 0x2d8]
xor r8d, r8d
mov edx, 0x1111
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov byte [rsp + 0x1600], 1
mov qword [rsp + 0x148], rax
cmp byte [rsp + 0x15fe], 0
jne 0x14000967c
lea rcx, str.pgui
call fcn.1401352a0
lea rdx, [rsp + 0x218]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp byte [rsp + 0x15ff], 0
jne 0x1400096ac
lea rcx, [0x140266548]
call fcn.1401352a0
cmp qword [rsp + 0x128], 0
je 0x140009748
cmp byte [rsp + 0x1603], 0
jne 0x1400096d1
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16b0], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009703
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x15ff], 0
jne 0x140009731
lea rcx, [0x140266548]
call fcn.1401352a0
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x16b0]
call fcn.14000b7c0
jmp 0x1400097c3
cmp byte [rsp + 0x1603], 0
jne 0x14000975e
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16b8], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009790
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov r8, 0xffffffffffffffff
lea rdx, [0x14026647c]
mov rcx, qword [rsp + 0x16b8]
call fcn.14000b830
cmp byte [rsp + 0x1603], 0
jne 0x1400097d9
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16c0], rax
cmp byte [rsp + 0x1603], 0
jne 0x14000980b
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x16c0]
call fcn.14000b8c0
movzx eax, byte [rsp + 0x2c0]
test eax, eax
jne 0x140009851
mov dword [rsp + 0x16c8], 1
jmp 0x14000985c
mov dword [rsp + 0x16c8], 0
cmp byte [rsp + 0x1603], 0
jne 0x140009872
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16d0], rax
cmp byte [rsp + 0x1603], 0
jne 0x1400098a4
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov edx, dword [rsp + 0x16c8]
mov rcx, qword [rsp + 0x16d0]
call fcn.14000b790
cmp byte [rsp + 0x1603], 0
jne 0x1400098e6
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16d8], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009918
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov edx, dword [rsp + 0x218]
mov rcx, qword [rsp + 0x16d8]
call fcn.14000b790
cmp byte [rsp + 0x1603], 0
jne 0x14000995a
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16e0], rax
cmp byte [rsp + 0x1603], 0
jne 0x14000998c
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov edx, dword [rsp + 0x21c]
mov rcx, qword [rsp + 0x16e0]
call fcn.14000b790
jmp 0x14000a37a
mov rax, qword [rsp + 0x28c]
mov qword [rsp + 0x218], rax
cmp byte [rsp + 0x15fe], 0
jne 0x1400099e3
lea rcx, str.pgui
call fcn.1401352a0
lea rdx, [rsp + 0x218]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp byte [rsp + 0x15fe], 0
jne 0x140009a13
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x140009a29
lea rcx, str.pgui
call fcn.1401352a0
mov edx, 0xffffffec
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xffffffef
mov r8d, eax
mov edx, 0xffffffec
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [rsp + 0x15ff], 0
jne 0x140009a73
lea rcx, [0x140266548]
call fcn.1401352a0
cmp qword [rsp + 0x128], 0
je 0x140009b0f
cmp byte [rsp + 0x1603], 0
jne 0x140009a98
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16e8], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009aca
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x15ff], 0
jne 0x140009af8
lea rcx, [0x140266548]
call fcn.1401352a0
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x16e8]
call fcn.14000b7c0
jmp 0x140009b8a
cmp byte [rsp + 0x1603], 0
jne 0x140009b25
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16f0], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009b57
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov r8, 0xffffffffffffffff
lea rdx, [0x140266480]
mov rcx, qword [rsp + 0x16f0]
call fcn.14000b830
cmp byte [rsp + 0x1603], 0
jne 0x140009ba0
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x16f8], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009bd2
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov rcx, qword [rsp + 0x228]
call fcn.1400d32e0
mov rdx, rax
mov rcx, qword [rsp + 0x16f8]
call fcn.14000b7c0
cmp byte [rsp + 0x1603], 0
jne 0x140009c1d
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1700], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009c4f
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x15fe], 0
jne 0x140009c7d
lea rcx, str.pgui
call fcn.1401352a0
mov edx, dword [rsp + 0x218]
mov rcx, qword [rsp + 0x120]
call fcn.14000b9f0
mov edx, eax
mov rcx, qword [rsp + 0x1700]
call fcn.14000b790
cmp byte [rsp + 0x1603], 0
jne 0x140009cb6
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1708], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009ce8
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x15fe], 0
jne 0x140009d16
lea rcx, str.pgui
call fcn.1401352a0
mov edx, dword [rsp + 0x21c]
mov rcx, qword [rsp + 0x120]
call fcn.14000b9f0
mov edx, eax
mov rcx, qword [rsp + 0x1708]
call fcn.14000b790
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.SHELL32.dll_DragFinish]
cmp byte [rsp + 0x15fe], 0
jne 0x140009d5d
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov qword [rax + 0x60], 0
jmp 0x14000a37a
cmp byte [rsp + 0x1601], 0
jne 0x140009d88
lea rcx, str.gui_action
call fcn.1401352a0
cmp dword [rsp + 0x13c], 4
jne 0x140009f71
cmp byte [rsp + 0x1603], 0
jne 0x140009dac
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1710], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009dde
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x1602], 0
jne 0x140009e0c
lea rcx, str.gui_event_byte
call fcn.1401352a0
movsx eax, byte [rsp + 0x150]
mov edx, eax
mov rcx, qword [rsp + 0x1710]
call fcn.14000b790
cmp byte [rsp + 0x1603], 0
jne 0x140009e39
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1718], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009e6b
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x15fe], 0
jne 0x140009e99
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x148]
and rax, 0xffff
movzx eax, ax
mov edx, eax
mov rcx, qword [rsp + 0x120]
call fcn.14000b9f0
mov edx, eax
mov rcx, qword [rsp + 0x1718]
call fcn.14000b790
cmp byte [rsp + 0x1603], 0
jne 0x140009ede
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1720], rax
cmp byte [rsp + 0x1603], 0
jne 0x140009f10
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x15fe], 0
jne 0x140009f3e
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x148]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov edx, eax
mov rcx, qword [rsp + 0x120]
call fcn.14000b9f0
mov edx, eax
mov rcx, qword [rsp + 0x1720]
call fcn.14000b790
jmp 0x14000a37a
jmp 0x14000a37a
cmp byte [rsp + 0x15ff], 0
jne 0x140009f91
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x50]
cmp eax, 0x17
jne 0x14000a203
cmp byte [rsp + 0x1601], 0
jne 0x140009fbc
lea rcx, str.gui_action
call fcn.1401352a0
cmp dword [rsp + 0x13c], 7
jne 0x14000a203
mov dword [rsp + 0x310], shutdown
cmp byte [rsp + 0x1600], 0
jne 0x140009feb
lea rcx, str.gui_event_info
call fcn.1401352a0
mov eax, dword [rsp + 0x148]
dec eax
mov dword [rsp + 0x314], eax
cmp byte [rsp + 0x15ff], 0
jne 0x14000a011
lea rcx, [0x140266548]
call fcn.1401352a0
lea r9, [rsp + 0x310]
xor r8d, r8d
mov edx, 0x703
mov rax, qword [rsp + 0x128]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x14000a05e
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rsp + rax + 0x320], cx
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rsp + rax + 0x380], cx
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x320]
test eax, eax
je 0x14000a0f8
cmp byte [rsp + 0x1603], 0
jne 0x14000a08d
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1728], rax
cmp byte [rsp + 0x1603], 0
jne 0x14000a0bf
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0x320]
mov rcx, qword [rsp + 0x1728]
call fcn.14000b830
jmp 0x14000a182
cmp byte [rsp + 0x1603], 0
jne 0x14000a10e
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1730], rax
cmp byte [rsp + 0x1603], 0
jne 0x14000a140
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x1600], 0
jne 0x14000a16e
lea rcx, str.gui_event_info
call fcn.1401352a0
mov edx, dword [rsp + 0x148]
mov rcx, qword [rsp + 0x1730]
call fcn.14000b790
cmp byte [rsp + 0x1603], 0
jne 0x14000a198
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1738], rax
cmp byte [rsp + 0x1603], 0
jne 0x14000a1ca
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0x380]
mov rcx, qword [rsp + 0x1738]
call fcn.14000b830
jmp 0x14000a37a
cmp byte [rsp + 0x1603], 0
jne 0x14000a219
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1740], rax
cmp byte [rsp + 0x1603], 0
jne 0x14000a24b
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x1740]
call fcn.14000b8c0
cmp byte [rsp + 0x1601], 0
jne 0x14000a28e
lea rcx, str.gui_action
call fcn.1401352a0
mov eax, dword [rsp + 0x13c]
mov dword [rsp + 0x1748], eax
cmp dword [rsp + 0x1748], 0xa
je 0x14000a2eb
cmp dword [rsp + 0x1748], 0xb
je 0x14000a2bf
cmp dword [rsp + 0x1748], 0xd
je 0x14000a2eb
jmp 0x14000a37a
cmp byte [rsp + 0x15ff], 0
jne 0x14000a2d5
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
movzx eax, byte [rax + 0x50]
cmp eax, 0xa
je 0x14000a2eb
jmp 0x14000a37a
cmp byte [rsp + 0x1603], 0
jne 0x14000a301
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
movsxd rax, dword [rsp + 0x204]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x170]
mov qword [rsp + 0x1750], rax
cmp byte [rsp + 0x1603], 0
jne 0x14000a333
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
inc eax
mov byte [rsp + 0x1603], 1
mov dword [rsp + 0x204], eax
cmp byte [rsp + 0x1602], 0
jne 0x14000a361
lea rcx, str.gui_event_byte
call fcn.1401352a0
movzx eax, byte [rsp + 0x150]
dec eax
mov edx, eax
mov rcx, qword [rsp + 0x1750]
call fcn.14000b790
cmp byte [rsp + 0x15fe], 0
jne 0x14000a390
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x14000a3a6
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x120]
call qword [rax + reloc.WSOCK32.dll_htonl]
cmp byte [rsp + 0x1601], 0
jne 0x14000a3d2
lea rcx, str.gui_action
call fcn.1401352a0
cmp dword [rsp + 0x13c], 5
jne 0x14000a557
cmp byte [rsp + 0x15ff], 0
jne 0x14000a3f6
lea rcx, [0x140266548]
call fcn.1401352a0
cmp qword [rsp + 0x128], 0
je 0x14000a557
cmp byte [rsp + 0x15fe], 0
jne 0x14000a41b
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x1606], 0
jne 0x14000a431
lea rcx, str.gui_event_kind
call fcn.1401352a0
cmp byte [rsp + 0x1604], 0
jne 0x14000a447
lea rcx, str.gui_event_code
call fcn.1401352a0
cmp byte [rsp + 0x1603], 0
jne 0x14000a45d
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
cmp byte [rsp + 0x15ff], 0
jne 0x14000a473
lea rcx, [0x140266548]
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
dec eax
lea rcx, [rsp + 0x188]
mov rdx, qword [rsp + 0x128]
add rdx, 0x38
mov qword [rsp + 0x1758], rdx
mov qword [rsp + 0x30], 0
mov r8, qword [rsp + 0x120]
mov qword [rsp + 0x28], r8
movzx r8d, byte [rsp + 0x140]
mov byte [rsp + 0x20], r8b
mov r9d, dword [rsp + 0x144]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x1758]
mov rcx, rax
call fcn.1400e7060
mov dword [rsp + 0x13d4], eax
cmp dword [rsp + 0x13d4], 7
je 0x14000a510
cmp byte [rsp + 0x15fe], 0
jne 0x14000a501
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x30], 0
jne 0x14000a557
cmp byte [rsp + 0x15fe], 0
jne 0x14000a526
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x14000a53c
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x120]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x14000b08d
cmp byte [rsp + 0x1605], 0
jne 0x14000a56d
lea rcx, str.event_is_control_generated
call fcn.1401352a0
movzx eax, byte [rsp + 0x151]
test eax, eax
je 0x14000a5a5
cmp byte [rsp + 0x15ff], 0
jne 0x14000a58f
lea rcx, [0x140266548]
call fcn.1401352a0
mov rax, qword [rsp + 0x128]
add rax, 0x38
mov qword [rsp + 0x1760], rax
jmp 0x14000a5d1
cmp byte [rsp + 0x15fe], 0
jne 0x14000a5bb
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
add rax, 0x90
mov qword [rsp + 0x1760], rax
mov rax, qword [rsp + 0x1760]
mov qword [rsp + 0x15e0], rax
mov rax, qword [rsp + 0x15e0]
mov qword [rsp + 0x13f8], rax
cmp byte [rsp + 0x15fe], 0
jne 0x14000a607
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x1606], 0
jne 0x14000a61d
lea rcx, str.gui_event_kind
call fcn.1401352a0
cmp byte [rsp + 0x1604], 0
jne 0x14000a633
lea rcx, str.gui_event_code
call fcn.1401352a0
cmp byte [rsp + 0x1603], 0
jne 0x14000a649
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
lea rax, [rsp + 0x13e8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x28], rax
movzx eax, byte [rsp + 0x140]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x144]
mov r8d, dword [rsp + 0x204]
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x13f8]
call fcn.1400e7060
mov dword [rsp + 0x13d4], eax
cmp byte [rsp + 0x15fe], 0
jne 0x14000a6b1
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x30], 0
je 0x14000a7d8
cmp byte [rsp + 0x1601], 0
jne 0x14000a6da
lea rcx, str.gui_action
call fcn.1401352a0
mov eax, dword [rsp + 0x13c]
mov dword [rsp + 0x1768], eax
cmp dword [rsp + 0x1768], 1
je 0x14000a734
cmp dword [rsp + 0x1768], 2
je 0x14000a701
jmp 0x14000a7d8
cmp qword [rsp + 0x13e8], 0
jne 0x14000a72f
cmp byte [rsp + 0x15fe], 0
jne 0x14000a722
lea rcx, str.pgui
call fcn.1401352a0
mov rcx, qword [rsp + 0x120]
call fcn.1400c8a90
jmp 0x14000a7d8
cmp byte [rsp + 0x1601], 0
jne 0x14000a74a
lea rcx, str.gui_action
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x14000a760
lea rcx, str.pgui
call fcn.1401352a0
mov edx, dword [rsp + 0x13c]
mov rcx, qword [rsp + 0x120]
call fcn.140006b90
test eax, eax
je 0x14000a7d8
cmp byte [rsp + 0x15fe], 0
jne 0x14000a78e
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x14000a7a4
lea rcx, str.pgui
call fcn.1401352a0
mov edx, 0xffffffec
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x10
mov r8d, eax
mov edx, 0xffffffec
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [rsp + 0x1601], 0
jne 0x14000a7ee
lea rcx, str.gui_action
call fcn.1401352a0
cmp dword [rsp + 0x13c], 1
jne 0x14000a85b
cmp byte [rsp + 0x1603], 0
jne 0x14000a80e
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
cmp byte [rsp + 0x1603], 0
jne 0x14000a824
lea rcx, str.gui_event_arg_count
call fcn.1401352a0
mov eax, dword [rsp + 0x204]
sub eax, 3
cdqe
imul rax, rax, 0x18
mov rax, qword [rsp + rax + 0x170]
mov ecx, dword [rsp + 0x204]
sub ecx, 3
movsxd rcx, ecx
imul rcx, rcx, 0x18
mov rcx, qword [rsp + rcx + 0x170]
mov rax, qword [rax]
call qword [rax + reloc.WSOCK32.dll_recv]
cmp byte [rsp + 0x15fe], 0
jne 0x14000a871
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x14000a887
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x120]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x14000b08d
cmp byte [rsp + 0x15fe], 0
jne 0x14000a8b8
lea rcx, str.pgui
call fcn.1401352a0
cmp qword [rsp + 0x120], 0
je 0x14000a965
cmp byte [rsp + 0x15fe], 0
jne 0x14000a8dd
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x120]
mov rcx, qword [rcx + 0x30]
mov qword [rax + 0x38], rcx
cmp byte [rsp + 0x15fe], 0
jne 0x14000a90b
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x120]
mov rcx, qword [rcx + 0x30]
mov qword [rax + 0x40], rcx
cmp byte [rsp + 0x15fe], 0
jne 0x14000a939
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x14000a94f
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x120]
call qword [rax + reloc.WSOCK32.dll_htonl]
cmp byte [rsp + 0x1607], 0
jne 0x14000a97b
lea rcx, str.menu_item
call fcn.1401352a0
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x1400], rax
mov rax, qword [rsp + 0x1400]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1400]
call qword [rax + reloc.WSOCK32.dll_htonl]
cmp byte [rsp + 0x1607], 0
jne 0x14000a9bb
lea rcx, str.menu_item
call fcn.1401352a0
mov r8, 0xffffffffffffffff
mov rax, qword [rsp + 0xe8]
mov rdx, qword [rax]
lea rcx, [rsp + 0x1420]
call fcn.140006000
cmp byte [rsp + 0x1607], 0
jne 0x14000a9f0
lea rcx, str.menu_item
call fcn.1401352a0
mov rcx, qword [rsp + 0xe8]
call fcn.1400e1590
inc eax
mov eax, eax
mov edx, eax
lea rcx, [rsp + 0x1438]
call fcn.140006050
mov rdx, qword [rsp + 0x1400]
lea rcx, [rsp + 0x1450]
call fcn.140005fd0
cmp byte [rsp + 0x1607], 0
jne 0x14000aa3b
lea rcx, str.menu_item
call fcn.1401352a0
mov rax, qword [rsp + 0xe8]
add rax, 0x10
mov rcx, rax
call fcn.140006160
mov byte [rsp + 0x20], 0
mov r9d, 3
lea r8, [rsp + 0x1420]
lea rdx, [0x140266488]
mov rcx, rax
call fcn.1400eb6f0
mov rax, qword [rsp + 0x1400]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1400]
call qword [rax + reloc.WSOCK32.dll_recv]
cmp byte [rsp + 0x15fe], 0
jne 0x14000aa9d
lea rcx, str.pgui
call fcn.1401352a0
cmp qword [rsp + 0x120], 0
je 0x14000aaea
cmp byte [rsp + 0x15fe], 0
jne 0x14000aabe
lea rcx, str.pgui
call fcn.1401352a0
cmp byte [rsp + 0x15fe], 0
jne 0x14000aad4
lea rcx, str.pgui
call fcn.1401352a0
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x120]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x14000b08d
cmp byte [rsp + 0x1609], 0
jne 0x14000ab05
lea rcx, str.criterion_found_hwnd
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x38], rcx
cmp byte [rsp + 0x1608], 0
jne 0x14000ab2c
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x118]
movzx ecx, byte [rcx + 0x35]
mov byte [rax + 0xc5], cl
cmp byte [rsp + 0x1608], 0
jne 0x14000ab5c
lea rcx, [0x140266554]
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x118]
mov rcx, qword [rcx + 0x20]
mov qword [rax + 0x80], rcx
cmp byte [rsp + 0x1608], 0
jne 0x14000ab8d
lea rcx, [0x140266554]
call fcn.1401352a0
mov rcx, qword [rsp + 0x118]
call fcn.140032a80
jmp 0x14000b08d
call qword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x14000abef
mov ecx, recv
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14000abd4
mov ecx, reloc.WSOCK32.dll_ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14000abd4
mov dword [rsp + 0x176c], 2
jmp 0x14000abdf
mov dword [rsp + 0x176c], 1
mov eax, dword [rsp + 0x176c]
mov dword [rsp + 0x1770], eax
jmp 0x14000abfa
mov dword [rsp + 0x1770], 0
mov eax, dword [rsp + 0x1770]
mov dword [rsp + 0x1474], eax
movsxd rax, dword [rsp + 0x1474]
mov rdx, rax
lea rcx, [rsp + 0x1488]
call fcn.140006050
mov byte [0x140322100], 1
lea rdx, [0x140266498]
lea rcx, [0x1403212d0]
call fcn.140019c00
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 1
lea rdx, [rsp + 0x1488]
lea rcx, [0x1403220d0]
call fcn.1400e6ef0
lea rcx, [0x1403212d0]
call fcn.140019280
mov byte [0x140322100], 0
jmp 0x14000b08d
cmp byte [rsp + 0x160a], 0
jne 0x14000ac91
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x14b8]
call fcn.140005fd0
cmp byte [rsp + 0x160a], 0
jne 0x14000acc0
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x398]
lea rcx, [rsp + 0x15e8]
call fcn.140006080
mov rcx, rax
call fcn.140006160
mov byte [rsp + 0x20], 0
mov r9d, 1
lea r8, [rsp + 0x14b8]
lea rdx, [0x1402664c0]
mov rcx, rax
call fcn.1400eb6f0
cmp byte [rsp + 0x160a], 0
jne 0x14000ad20
lea rcx, str.input_hook
call fcn.1401352a0
cmp byte [rsp + 0x160a], 0
jne 0x14000ad36
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x230]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x14000b08d
cmp byte [rsp + 0x160a], 0
jne 0x14000ad6f
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x14f0]
call fcn.140005fd0
movzx eax, byte [rsp + 0x280]
mov edx, eax
lea rcx, [rsp + 0x1508]
call fcn.140006050
mov rax, qword [rsp + 0x280]
sar rax, 0x10
movzx eax, ax
mov edx, eax
lea rcx, [rsp + 0x1520]
call fcn.140006050
cmp dword [rsp + 0x270], 0x41c
jne 0x14000adfd
cmp byte [rsp + 0x160a], 0
jne 0x14000ade0
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + 0x3a0]
mov qword [rsp + 0x1778], rax
jmp 0x14000ae2e
cmp byte [rsp + 0x160a], 0
jne 0x14000ae13
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + 0x3b0]
mov qword [rsp + 0x1778], rax
mov rdx, qword [rsp + 0x1778]
lea rcx, [rsp + 0x1558]
call fcn.140006080
lea rcx, [rsp + 0x1558]
call fcn.140006160
mov byte [rsp + 0x20], 0
mov r9d, 3
lea r8, [rsp + 0x14f0]
lea rdx, [0x1402664d8]
mov rcx, rax
call fcn.1400eb6f0
jmp 0x14000b08d
movzx eax, word [rsp + 0x280]
mov word [rsp + 0x1574], ax
mov rax, qword [rsp + 0x280]
sar rax, 0x10
mov word [rsp + 0x1576], ax
xor eax, eax
mov word [rsp + 0x1578], ax
cmp byte [rsp + 0x160a], 0
jne 0x14000aebb
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x1598]
call fcn.140005fd0
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0x1574]
lea rcx, [rsp + 0x15b0]
call fcn.140006000
cmp byte [rsp + 0x160a], 0
jne 0x14000af06
lea rcx, str.input_hook
call fcn.1401352a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x3a8]
lea rcx, [rsp + 0x15f0]
call fcn.140006080
mov rcx, rax
call fcn.140006160
mov byte [rsp + 0x20], 0
mov r9d, 2
lea r8, [rsp + 0x1598]
lea rdx, [0x1402664f0]
mov rcx, rax
call fcn.1400eb6f0
jmp 0x14000b08d
cmp byte [rsp + 0x160b], 0
jne 0x14000af6b
lea rcx, [0x140266564]
call fcn.1401352a0
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax + 0x10]
cmp eax, 0x9c
jl 0x14000afc4
cmp byte [rsp + 0x160b], 0
jne 0x14000af94
lea rcx, [0x140266564]
call fcn.1401352a0
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax + 0x10]
cmp eax, 0x9f
jg 0x14000afc4
mov rax, qword [rsp + 0x280]
and rax, 0xffff
movzx eax, ax
mov rcx, qword [rsp + 0x2b8]
mov qword [rcx + 0x40], rax
cmp byte [rsp + 0x1609], 0
jne 0x14000afda
lea rcx, str.criterion_found_hwnd
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x38], rcx
cmp byte [rsp + 0x160c], 0
jne 0x14000b001
lea rcx, str.variant
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x108]
movzx ecx, byte [rcx + 0x2c]
mov byte [rax + 0xc5], cl
cmp byte [rsp + 0x160c], 0
jne 0x14000b031
lea rcx, str.variant
call fcn.1401352a0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x108]
mov rcx, qword [rcx + 0x10]
mov qword [rax + 0x80], rcx
cmp byte [rsp + 0x160c], 0
jne 0x14000b062
lea rcx, str.variant
call fcn.1401352a0
cmp byte [rsp + 0x160b], 0
jne 0x14000b078
lea rcx, [0x140266564]
call fcn.1401352a0
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0xf8]
call fcn.1400327b0
call fcn.14000b6c0
cmp dword [rsp + 0x17a8], 0
jne 0x14000b0a1
jmp 0x14000731c
movzx r8d, byte [rsp + 0x41]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x17a0]
call fcn.140006a70
test eax, eax
je 0x14000b0c5
mov byte [rsp + 0x4b], 1
mov byte [rsp + 0x41], 1
jmp 0x14000731c
cmp qword [rsp + 0x280], 0
jne 0x14000b0fc
cmp byte [rsp + 0x15f8], 0
jne 0x14000b0eb
lea rcx, [0x14026653c]
call fcn.1401352a0
mov rax, qword [0x1403213e8]
cmp qword [rsp + 0x268], rax
je 0x14000b101
jmp case.0x1400081e7.1046
cmp dword [0x1403222c4], 0
je 0x14000b10f
call fcn.14000b590
cmp dword [0x14032211c], 0
je 0x14000b129
call fcn.1400061f0
movzx eax, al
test eax, eax
je 0x14000b129
mov byte [rsp + 0x48], 1
cmp dword [rsp + 0x17a8], 0
jne 0x14000b138
jmp 0x14000731c
cmp dword [rsp + 0x17a0], 1
jge 0x14000b147
jmp 0x14000731c
movzx r8d, byte [rsp + 0x41]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x17a0]
call fcn.140006a70
test eax, eax
je 0x14000b1df
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x14000b171
mov byte [0x14032153c], 0
movzx eax, byte [rsp + 0x49]
test eax, eax
je 0x14000b1d5
mov eax, dword [0x140321540]
dec eax
mov dword [0x140321540], eax
cmp dword [rsp + 0x17a0], 0
jle 0x14000b1d5
cmp dword [0x140321540], 0
jne 0x14000b1d5
cmp dword [0x14032211c], 0
jne 0x14000b1d5
cmp dword [0x1403222c4], 0
jne 0x14000b1d5
movzx eax, byte [0x140321533]
test eax, eax
je 0x14000b1d5
mov edx, 9
mov rcx, qword [0x1403213e8]
call qword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x14000b1d5
mov byte [0x140321533], 0
movzx eax, byte [rsp + 0x48]
jmp 0x14000b398
jmp 0x14000731c
mov qword [0x140321528], 0
mov byte [rsp + 0x4b], 1
jmp 0x14000731c
cmp byte [rsp + 0x15f8], 0
jne 0x14000b20f
lea rcx, [0x14026653c]
call fcn.1401352a0
mov rax, qword [0x1403213f0]
cmp qword [rsp + 0x268], rax
jne 0x14000b23f
cmp qword [rsp + 0x278], 0x1b
jne 0x14000b23f
xor edx, edx
mov rcx, qword [0x1403213e8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14000731c
jmp case.0x1400081e7.1046
mov edx, 4
lea rcx, [0x1403219f0]
call fcn.140080b90
jmp 0x14000731c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14000b30e
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1403219e8]
jne 0x14000b30e
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [0x140266508]
lea rcx, [rsp + 0xa0]
call fcn.1401a74f0
test eax, eax
jne 0x14000b30e
mov rax, qword [0x14031a1e8]
mov byte [rax + 0x7e], 1
mov rax, qword [0x14031a1e8]
mov ecx, dword [rsp + 0x270]
mov dword [rax + 0x78], ecx
mov byte [rsp + 0x15f8], 1
lea rdx, [rsp + 0x268]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x14000b303
mov rax, qword [0x14031a1e8]
mov byte [rax + 0x7e], 0
jmp 0x14000731c
mov rax, qword [0x14031a1e8]
mov byte [rax + 0x7e], 0
cmp qword [0x140321400], 0
je 0x14000b340
mov byte [rsp + 0x15f8], 1
lea r8, [rsp + 0x268]
mov rdx, qword [0x140321400]
mov rcx, qword [0x1403213e8]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x14000b393
mov rax, qword [0x14031a1e8]
mov byte [rax + 0x7e], 1
mov rax, qword [0x14031a1e8]
mov ecx, dword [rsp + 0x270]
mov dword [rax + 0x78], ecx
mov byte [rsp + 0x15f8], 1
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_TranslateMessage]
mov byte [rsp + 0x15f8], 1
lea rcx, [rsp + 0x268]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rax, qword [0x14031a1e8]
mov byte [rax + 0x7e], 0
jmp 0x14000731c
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WSOCK32.dll_recv
call fcn.140134a00
mov rax, rdi
mov rcx, qword [rsp + 0x1780]
xor rcx, rsp
call fcn.140135520
add rsp, 0x1790
pop rdi
ret