Function at 0x14001e200
Capabilities:
Access peb ldr_data
Check for foreground window switch
Check for time delay via gettickcount
Check os version
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x108
lea rbp, [rsp + 0x60]
mov r14, qword [0x14013b0f8]
mov r15d, dword gs:[0x48]
mov r13, r9
mov edi, r8d
mov esi, edx
mov r12, rcx
mov qword [rbp + 0x38], r14
mov dword [rbp + 0x50], r15d
test edx, edx
jne 0x14001e26f
lea r8d, [rdx + 7]
lea rdx, str.Blind
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001e26f
mov byte [0x14013e4a3], 1
add r12, 0xe
jmp 0x14001e27a
mov byte [0x14013e4a3], 0
test esi, esi
jne 0x14001e2a3
lea rdx, [0x140107e50]
mov r8d, 6
mov rcx, r12
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001e2a3
mov esi, 2
add r12, 0xc
mov dword [rbp + 0xf8], esi
mov eax, dword [r14 + 0x7c]
mov dword [rbp + 0x1c], eax
mov eax, dword [r14 + 0x84]
mov dword [rbp + 0x24], eax
xor eax, eax
cmp edi, 1
je 0x14001e2c4
cmp edi, 3
jne 0x14001e396
cmp qword [0x140143f78], rax
je 0x14001e359
mov rcx, qword [0x1401404d0]
test rcx, rcx
je 0x14001e2e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.AHK_Keybd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x1401404d0], 0
mov edi, eax
je 0x14001e312
mov qword [0x1401404d0], rbx
jmp 0x14001e31b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xb7
je 0x14001e351
test esi, esi
jne 0x14001e344
call fcn.140016330
test al, al
je 0x14001e344
lea rdx, str.Click
mov rcx, r12
call fcn.1400e0a80
test rax, rax
jne 0x14001e351
mov edi, 1
mov dword [rbp + 0x100], edi
jmp 0x14001e396
mov edi, dword [rbp + 0x100]
xor eax, eax
cmp edi, 3
jne 0x14001e36b
mov edi, 2
mov dword [rbp + 0x100], edi
jmp 0x14001e396
cmp dword [r14 + 0x7c], 0
mov edi, eax
mov dword [rbp + 0x100], eax
jge 0x14001e387
cmp dword [r14 + 0x84], 0
jge 0x14001e387
or eax, 0xffffffff
mov dword [r14 + 0x84], eax
mov dword [r14 + 0x7c], 0xffffffff
xor edx, edx
mov byte [rbp + 7], 0
mov ebx, edx
test r13, r13
je 0x14001e3f9
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r15d, eax
mov dword [rbp + 0x28], eax
test eax, eax
je 0x14001e521
cmp eax, dword [0x1401430c0]
je 0x14001e521
mov rcx, r13
call fcn.1400e9c60
test al, al
jne 0x14001e521
mov ecx, dword [0x1401430c0]
mov r8d, 1
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, r15d
test eax, eax
setne byte [rbp + 7]
jmp 0x14001e521
test byte [0x140143cf6], 0xc0
je 0x14001e508
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140143cec]
cmp eax, 0x32
jae 0x14001e508
cmp edi, 2
je 0x14001e508
cmp byte [0x14013e4a3], bl
jne 0x14001e508
cmp esi, 2
je 0x14001e508
cmp byte [0x140143f66], bl
je 0x14001e508
cmp r15d, dword [0x1401430c0]
jne 0x14001e508
lea rdx, [0x1401080e8]
mov rcx, r12
call fcn.140007290
test esi, esi
je 0x14001e4c2
test rax, rax
setne al
test al, al
je 0x14001e508
xor r13d, r13d
mov ebx, 0x8000
nop dword [rax + rax]
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
jne 0x14001e4a0
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x14001e501
mov edx, 1
mov ecx, 0x8000012f
mov dword [0x14013b0c8], r13d
call fcn.140001b80
mov dword [0x14013b0c8], 1
jmp 0x14001e480
test rax, rax
je 0x14001e508
nop word [rax + rax]
lea rcx, [rax + 2]
lea rdx, [0x1401080f0]
call fcn.140007290
test rax, rax
je 0x14001e473
cmp word [rax], 0x7b
je 0x14001e473
lea rdx, [0x1401080e8]
mov rcx, rax
call fcn.140007290
test rax, rax
jne 0x14001e4d0
jmp 0x14001e508
mov r13, qword [rbp + 0x108]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call fcn.1400236b0
mov ebx, eax
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0x28], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov rcx, rax
mov qword [0x14013e4d0], rax
call fcn.1400238e0
mov cl, 1
mov dword [0x14013e4c8], eax
call fcn.1400231a0
and byte [0x140140487], al
cmp qword [0x14013f848], 0
movzx ebx, al
je 0x14001e576
movzx eax, byte [0x14013f65f]
movzx edx, byte [0x14013f6f3]
movzx ecx, al
not al
and cl, dl
and al, dl
mov byte [rbp + 6], al
jmp 0x14001e59e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140143cec]
cmp eax, dword [0x14013b0bc]
jae 0x14001e595
movzx edx, byte [0x140143cf6]
and dl, bl
jmp 0x14001e597
xor dl, dl
movzx ecx, dl
mov byte [rbp + 6], 0
movzx r15d, byte [0x140140486]
not cl
mov byte [rbp + 3], dl
and cl, bl
and r15b, cl
cmp byte [0x14013e4a3], 0
mov byte [rbp + 0xf0], r15b
mov byte [0x140140486], r15b
je 0x14001e5e0
not r15b
mov byte [rbp + 0xf0], bl
mov byte [rbp + 2], bl
and r15b, bl
mov byte [rbp + 4], r15b
movzx r15d, bl
jmp 0x14001e5e9
xor al, al
mov byte [rbp + 2], r15b
mov byte [rbp + 4], al
cmp byte [r14 + 0x133], 0
je 0x14001e60f
cmp byte [0x14013e4a3], 0
jne 0x14001e60f
cmp esi, 2
je 0x14001e60f
mov edx, 2
mov cl, reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140022800
jmp 0x14001e611
xor eax, eax
mov dword [rbp + 0x34], eax
mov dword [0x1401405f0], edi
mov eax, 0x1f4
test edi, edi
je 0x14001e6ab
cmp edi, 1
jne 0x14001e639
mov ecx, 0x4e20
mov dword [0x14013e4b8], eax
jmp 0x14001e648
mov ecx, 0x2ee0
mov dword [0x14013e4b8], 0x5dc
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14001e65b
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140100df0
sub rsp, rax
mov byte [0x14013e4ab], bl
xor ebx, ebx
lea rax, [rsp + 0x60]
mov dword [0x14013e4b0], 0x80000000
mov dword [0x14013e4b4], 0x80000000
mov byte [0x14013e4aa], 0
mov byte [0x14013e4a8], 1
mov qword [0x14013e4c0], rax
mov dword [0x14013e4bc], ebx
mov byte [0x14013e4a9], bl
jmp 0x14001e6ad
xor ebx, ebx
movzx eax, byte [0x140140264]
mov byte [rbp + 0x10], al
mov eax, dword [reloc.WSOCK32.dll_inet_ntoa]
cmp eax, 8
je 0x14001e6c7
cmp eax, 0xa
jne 0x14001e729
test edi, edi
jne 0x14001e729
test r13, r13
jne 0x14001e729
mov eax, dword [0x140144130]
mov byte [rbp + 8], 1
test al, 1
jne 0x14001e70d
or eax, 1
lea rcx, str.user32
mov dword [0x140144130], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.BlockInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140144128], rax
jmp 0x14001e714
mov rax, qword [0x140144128]
test rax, rax
je 0x14001e720
mov ecx, 1
call rax
mov byte [0x140140264], 1
jmp 0x14001e72d
mov byte [rbp + 8], 0
xor r14b, r14b
cmp word [r12], 0
mov byte [rbp], r14b
je 0x14001f5a7
lea rdi, [0x140000000]
jmp 0x14001e752
xor ebx, ebx
cmp dword [0x1401405f0], 0
mov byte [rbp + 5], 0
jne 0x14001e7bd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14013b0f8]
sub eax, dword [0x140143d4c]
cmp eax, dword [rcx + 0x118]
jbe 0x14001e7bd
lea rcx, [rbp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001e7b1
mov edx, 1
or ecx, 0xffffffff
mov dword [0x14013b0c8], ebx
call fcn.140001b80
mov dword [0x14013b0c8], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140143d4c], eax
test esi, esi
jne 0x14001f3cf
movzx edx, word [r12]
lea rcx, [0x1401080f8]
call qword [sym.imp.MSVCR100.dll_wcschr]
test rax, rax
je 0x14001f441
movzx eax, word [r12]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x14001e805.38
cdqe
movzx eax, byte [rdi + rax + 0x1f9c4]
mov ecx, dword [rdi + rax*4 + 0x1f9a8]
add rcx, rdi
jmp rcx
test r15b, 3
jne case.0x14001e805.38
or r14b, 1
jmp 0x14001f57b
test r15b, 0x30
jne case.0x14001e805.38
or r14b, 0x10
jmp 0x14001f57b
test r15b, 0xc
jne case.0x14001e805.38
or r14b, 4
jmp 0x14001f57b
test r15b, 0xc0
jne case.0x14001e805.38
or r14b, 0x40
jmp 0x14001f57b
lea rbx, [r12 + 2]
mov edx, 0x7d
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcschr]
mov rdi, rax
mov qword [rbp + 0x40], rax
test rax, rax
je case.0x14001e805.38
mov r12, rbx
nop dword [rax]
movzx ecx, word [r12]
cmp cx, 0x20
je 0x14001e891
cmp cx, 9
jne 0x14001e897
add r12, 2
jmp 0x14001e880
mov r13, rax
sub r13, r12
sar r13, 1
jne 0x14001e94a
lea rbx, [rax + 2]
movzx eax, word [rax + 2]
cmp ax, 0x7d
jne 0x14001e8c6
mov rdi, rbx
mov qword [rbp + 0x40], rbx
mov r13d, 1
jmp 0x14001e94a
cmp ax, 0x20
je 0x14001e8d6
cmp ax, 9
jne 0x14001ed45
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14001e8e5
cmp ax, 9
jne 0x14001e8eb
add rbx, 2
jmp 0x14001e8d6
lea rdx, str.Down
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
je 0x14001e923
lea rdx, [0x140105074]
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001ed45
mov edx, 0x7d
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcschr]
mov rdi, rax
mov qword [rbp + 0x40], rax
test rax, rax
je case.0x14001e805.38
mov r13, rax
sub r13, r12
sar r13, 1
lea rdx, [0x140106cc8]
mov r8d, 5
mov rcx, r12
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001ea49
mov word [rdi], ax
lea rcx, [r12 + 0xa]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001e97f
cmp ax, 9
jne 0x14001e985
add rcx, 2
jmp 0x14001e970
lea rax, [rbp + 9]
lea r9, [rbp + 1]
lea r8, [rbp + 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x14]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc]
mov qword [rsp + 0x20], rax
call fcn.140020b80
mov ecx, dword [rbp + 0x14]
mov eax, 0x7d
mov word [rdi], ax
cmp ecx, 1
jge 0x14001e9fc
cmp dword [rbp + 0x18], 0x80000000
je 0x14001ed45
mov rax, qword [rbp + 0x38]
lea r8, [rbp + 0x54]
lea rdx, [rbp + 0x2c]
movzx r9d, byte [rax + 0x12f]
movzx eax, byte [rbp + 9]
lea rcx, [rbp + 0x18]
mov byte [rsp + 0x20], al
call fcn.140021b60
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
movzx eax, byte [rbp + 9]
mov r12, qword [rbp + 0x108]
xor edx, edx
mov byte [rsp + 0x50], al
mov eax, dword [rbp + 0x2c]
movzx r9d, r15b
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x18]
movzx r8d, r14b
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0xc]
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x30], dl
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
movzx ecx, byte [rbp + 1]
call fcn.14001fa30
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
lea rdx, [0x140108108]
mov r8d, 3
mov rcx, r12
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001ea77
mov r12, qword [rbp + 0x40]
mov esi, 1
mov dword [rbp + 0xf8], esi
jmp 0x14001f578
lea rdx, str.Text
mov r8d, 4
mov rcx, r12
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001eac8
lea rcx, [r12 + 8]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001eaa5
cmp ax, 9
jne 0x14001eaab
add rcx, 2
jmp 0x14001ea96
cmp rcx, rdi
jne 0x14001ed45
mov r12, qword [rbp + 0x40]
mov esi, 2
mov dword [rbp + 0xf8], esi
jmp 0x14001f578
mov eax, 1
lea rdx, [0x140107c20]
xor esi, esi
mov rcx, r12
mov dword [rbp + 0xc], 2
mov r15, r13
mov dword [rbp + 0x14], eax
mov word [rdi], si
call fcn.140007290
mov r14, rax
test rax, rax
je 0x14001ebbb
movzx eax, word [rax]
mov r15, r14
lea rbx, [r14 + 2]
sub r15, r12
mov word [r14], si
mov word [rbp + 0x20], ax
sar r15, 1
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14001eb21
cmp ax, 9
jne 0x14001eb27
add rbx, 2
jmp 0x14001eb12
mov rax, rdi
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14001ebbb
lea rdx, str.Down
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001eb93
add rbx, 8
lea r8d, [rax + 4]
lea rdx, str.Temp
mov rcx, rbx
mov dword [rbp + 0xc], esi
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001eb76
mov dword [rbp + 0x30], esi
jmp 0x14001ebbb
cmp word [rbx], 0x52
mov ecx, esi
sete cl
call qword [sym.imp.MSVCR100.dll_toupper]
mov ebx, esi
test eax, eax
setne bl
inc ebx
mov dword [rbp + 0x30], ebx
jmp 0x14001ebbb
lea rdx, [0x140105074]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14001ebb0
mov dword [rbp + 0xc], 1
jmp 0x14001ebbb
mov rcx, rbx
call fcn.14001db30
mov dword [rbp + 0x14], eax
mov r9, qword [0x14013e4d0]
lea rdx, [rbp]
mov r8b, 1
mov rcx, r12
call fcn.140023e00
movzx edi, al
mov byte [rbp + 1], al
test al, al
jne 0x14001ec61
mov rcx, r12
call fcn.140023d00
movzx esi, ax
test ax, ax
jne 0x14001ec61
lea rdx, [0x140107c7c]
mov r8d, 2
mov rcx, r12
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001ec61
lea rcx, [r12 + 4]
lea r8d, [rax + 0x10]
lea rdx, [rbp + 0x48]
call qword [sym.imp.MSVCR100.dll_wcstoul]
mov rcx, qword [rbp + 0x48]
lea rdx, [0x140108278]
mov r8d, 2
mov ebx, eax
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001ec61
mov rcx, qword [rbp + 0x48]
lea r8d, [rax + 0x10]
lea rdx, [rbp + 0x48]
add rcx, 4
call qword [sym.imp.MSVCR100.dll_wcstoul]
mov rcx, qword [rbp + 0x48]
cmp word [rcx], si
jne 0x14001ec61
movzx edi, bl
mov byte [rbp + 1], bl
movzx esi, ax
test r14, r14
je 0x14001ec6e
movzx eax, word [rbp + 0x20]
mov word [r14], ax
mov rax, qword [rbp + 0x40]
mov r14d, dword [rbp + 0x14]
mov ecx, 0x7d
mov word [rax], cx
cmp r14d, 1
jl 0x14001ed37
test dil, dil
jne 0x14001f29b
test si, si
jne 0x14001f29b
movzx ecx, byte [r12]
call qword [sym.imp.MSVCR100.dll_isdigit]
test eax, eax
je 0x14001edd3
cmp r15, 1
jbe 0x14001edd7
cmp dword [0x1401405f0], 0
je 0x14001ed4e
mov rcx, r12
call fcn.14001db30
mov ecx, dword [0x14013e4b8]
cmp dword [0x14013e4bc], ecx
mov ebx, eax
jne 0x14001ece5
call fcn.140022110
test eax, eax
je 0x14001ed37
cmp dword [0x1401405f0], 1
mov ecx, dword [0x14013e4bc]
jne 0x14001ed21
lea rdx, [rcx + rcx*4]
mov rcx, qword [0x14013e4c0]
xor r8d, r8d
or byte [0x14013e4aa], 1
mov dword [rcx + rdx*8], 1
mov qword [rcx + rdx*8 + 8], r8
mov qword [rcx + rdx*8 + 0x18], rbx
mov dword [rcx + rdx*8 + 0x10], r8d
jmp 0x14001ed31
mov rax, qword [0x14013e4c0]
xor edx, edx
mov dword [rax + rcx*8], edx
mov dword [rax + rcx*8 + 4], ebx
inc dword [0x14013e4bc]
movzx r15d, byte [rbp + 0xf0]
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
xor eax, eax
mov dword [0x14013b0c8], eax
mov eax, dword [rbp + 0x50]
cmp dword [0x1401430c0], eax
je 0x14001ed9e
mov rcx, r12
call fcn.14001db30
test eax, eax
js 0x14001ed9e
mov rcx, r12
call fcn.14001db30
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r15d, byte [rbp + 0xf0]
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
mov dword [0x14013b0c8], 1
jmp 0x14001f578
mov rcx, r12
call fcn.14001db30
mov edx, 1
mov ecx, eax
call fcn.140001b80
movzx r15d, byte [rbp + 0xf0]
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
mov dword [0x14013b0c8], 1
jmp 0x14001f578
cmp r15, 1
jne 0x14001ee5e
cmp dword [rbp + 0xc], 1
je 0x14001ed37
mov r13, qword [rbp + 0x108]
test r13, r13
je 0x14001ee32
test r14d, r14d
jle 0x14001ed37
mov rbx, r14
nop
movzx r8d, word [r12]
xor r9d, r9d
mov edx, 0x102
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
dec rbx
jne 0x14001ee00
movzx r15d, byte [rbp + 0xf0]
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
movzx r8d, byte [rbp]
movzx r15d, byte [rbp + 0xf0]
movzx ecx, word [r12]
or r8b, r15b
mov edx, r14d
call fcn.14001feb0
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
mov rbx, qword [rbp + 0x108]
lea r9, [rbp + 2]
lea r8, [rbp + 0xc]
test rbx, rbx
mov rdx, r13
mov rcx, r12
sete al
mov byte [rsp + 0x20], al
call fcn.140024150
movzx edi, al
mov byte [rbp + 1], al
test al, al
je 0x14001f0b7
mov esi, dword [rbp + 0xc]
mov r13, rbx
test rbx, rbx
jne 0x14001eead
test esi, esi
jne 0x14001eea4
mov byte [rbp + 5], al
jmp 0x14001eead
movzx ecx, dil
call fcn.14001ddd0
cmp dword [0x1401405f0], 0
je 0x14001eec2
movzx ebx, byte [0x14013e4ab]
jmp 0x14001efcb
cmp qword [0x14013f848], 0
je 0x14001eed8
movzx ebx, byte [0x14013f65f]
jmp 0x14001efcb
mov ecx, 0xa0
xor bl, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r12d, 0x8000
movzx ebx, bl
test r12w, ax
mov eax, reloc.WSOCK32.dll_recv
mov ecx, 0xa1
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r12w, ax
je 0x14001ef0e
or bl, 0x20
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r12w, ax
je 0x14001ef22
or bl, 1
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r12w, ax
je 0x14001ef36
or bl, 2
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r12w, ax
je 0x14001ef4a
or bl, 4
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r12w, ax
je 0x14001ef5e
or bl, 8
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r12w, ax
je 0x14001ef72
or bl, 0x40
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r12w, ax
je 0x14001ef86
or bl, 0x80
cmp qword [0x14013f848], 0
je 0x14001efcb
movzx ecx, byte [0x14013f65f]
movzx eax, bl
not al
and al, cl
je 0x14001efcb
movzx edx, byte [0x14013f6f3]
not al
and byte [0x14013f6f2], al
and cl, al
and dl, al
mov byte [0x14013f65f], cl
lea rcx, [0x14013f740]
mov byte [0x14013f6f3], dl
call fcn.1400232d0
movzx r15d, byte [rbp + 2]
xor r9d, r9d
mov r8, r13
movzx edx, bl
movzx ecx, r15b
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
mov byte [rbp + 0xf0], r15b
call fcn.140022950
test r14d, r14d
jle 0x14001ed3f
mov rbx, r14
xor r15d, r15d
nop word [rax + rax]
xor r8d, r8d
mov r9, r13
movzx edx, dil
mov ecx, esi
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 1
call fcn.140020440
cmp dword [0x1401405f0], r15d
jne 0x14001f097
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14013b0f8]
sub eax, dword [0x140143d4c]
cmp eax, dword [rcx + 0x118]
jbe 0x14001f097
lea rcx, [rbp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001f08b
mov edx, 1
or ecx, 0xffffffff
mov dword [0x14013b0c8], r15d
call fcn.140001b80
mov dword [0x14013b0c8], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140143d4c], eax
dec rbx
jne 0x14001f010
movzx r15d, byte [rbp + 0xf0]
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
cmp r13, 4
jbe 0x14001f158
lea rdx, str.ASC
mov r8d, 4
mov rcx, r12
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001f158
test rbx, rbx
jne 0x14001f158
lea rcx, [r12 + 6]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x14001f0f4
cmp ax, 9
jne 0x14001f0fa
add rcx, 2
jmp 0x14001f0e5
call fcn.14001fff0
cmp dword [0x1401405f0], 2
mov rax, qword [0x14013b0f8]
jne 0x14001f135
mov ecx, dword [rax + 0x80]
call fcn.140022450
movzx r15d, byte [rbp + 2]
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
mov byte [rbp + 0xf0], r15b
jmp 0x14001f578
mov ecx, dword [rax + 0x7c]
call fcn.140022450
movzx r15d, byte [rbp + 2]
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
mov byte [rbp + 0xf0], r15b
jmp 0x14001f578
cmp r13, 2
jbe 0x14001f13d
lea rdx, [0x14010812c]
mov r8d, 2
mov rcx, r12
call qword [sym.imp.MSVCR100.dll__wcsnicmp]
test eax, eax
jne 0x14001f13d
lea rcx, [r12 + 4]
lea r8d, [rax + 0x10]
xor edx, edx
call qword [sym.imp.MSVCR100.dll_wcstol]
cmp eax, 0x10000
jb 0x14001f1bc
add eax, 0xffff0000
mov edx, 0x3ff
mov r8d, 0x2800
mov ecx, eax
movzx ebx, ax
shr ecx, 0xa
and bx, dx
and cx, dx
mov edx, 0x2400
sub cx, r8w
sub bx, dx
jmp 0x14001f1c3
xor edx, edx
movzx ecx, ax
mov ebx, edx
mov r13, qword [rbp + 0x108]
movzx r15d, byte [rbp + 2]
mov byte [rbp + 0xf0], r15b
test r13, r13
je 0x14001f20c
movzx r8d, cx
xor r9d, r9d
mov edx, 0x102
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
test bx, bx
je 0x14001f25a
movzx r8d, bx
xor r9d, r9d
mov edx, 0x102
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001f25a
cmp dword [0x1401405f0], 2
je 0x14001f238
movzx edi, byte [rbp]
or dil, r15b
movzx edx, dil
call fcn.14001de60
test bx, bx
je 0x14001f25a
movzx edx, dil
movzx ecx, bx
call fcn.14001de60
jmp 0x14001f25a
mov ecx, gethostbyaddr
lea rdx, [rbp + 0x5a]
lea r8d, [rcx - 0x26]
mov word [rbp + 0x58], cx
mov ecx, eax
call qword [sym.imp.MSVCR100.dll__itow]
lea rcx, [rbp + 0x58]
call fcn.14001fff0
cmp dword [0x1401405f0], 2
mov rax, qword [0x14013b0f8]
jne 0x14001f284
mov ecx, dword [rax + 0x80]
call fcn.140022450
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
mov ecx, dword [rax + 0x7c]
call fcn.140022450
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
xor r8d, r8d
movzx edx, si
movzx ecx, dil
call fcn.1400233b0
mov r12, qword [rbp + 0x108]
mov r13d, dword [rbp + 0xc]
movzx ebx, al
test al, al
je 0x14001f37b
test r12, r12
jne 0x14001f37b
test r13d, r13d
jne 0x14001f31e
mov eax, dword [rbp + 0x30]
mov byte [rbp + 5], dil
cmp eax, 1
jne 0x14001f2fb
movzx r15d, byte [rbp + 0xf0]
or byte [0x140140486], bl
or r15b, bl
mov byte [rbp + 0xf0], r15b
mov byte [rbp + 2], r15b
jmp 0x14001f383
cmp eax, 2
jne 0x14001f306
or byte [0x140140487], bl
movzx r15d, byte [rbp + 0xf0]
or r15b, bl
mov byte [rbp + 0xf0], r15b
mov byte [rbp + 2], r15b
jmp 0x14001f383
cmp r13d, 1
jne 0x14001f37b
movzx ecx, dil
call fcn.14001ddd0
movzx r15d, byte [0x140140486]
movzx eax, byte [rbp + 4]
movzx r11d, bl
not r11b
and byte [0x140140487], r11b
and r15b, r11b
and al, r11b
mov byte [0x140140486], r15b
mov byte [rbp + 4], al
cmp dil, 0xa5
jne 0x14001f36b
cmp dword [0x14013e4c8], 3
jne 0x14001f36b
and al, 0xfe
mov byte [rbp + 4], al
or r15b, al
mov byte [rbp + 0xf0], r15b
mov byte [rbp + 2], r15b
jmp 0x14001f383
movzx r15d, byte [rbp + 0xf0]
movzx r8d, byte [rbp]
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x48], 0x80000000
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x30], bl
movzx r9d, r15b
movzx edx, si
movzx ecx, dil
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
call fcn.14001fa30
mov esi, dword [rbp + 0xf8]
mov r12, qword [rbp + 0x40]
jmp 0x14001f578
cmp esi, 2
jne 0x14001f441
movzx ecx, word [r12]
sub ecx, 8
je 0x14001f437
dec ecx
je 0x14001f42d
dec ecx
je 0x14001f423
sub ecx, 3
je 0x14001f413
mov byte [rbp + 1], 0
test r13, r13
je 0x14001f562
movzx r8d, word [r12]
xor r9d, r9d
mov edx, 0x102
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001f578
cmp word [r12 + 2], 0xa
lea rax, [r12 + 2]
cmove r12, rax
mov bl, 0xd
mov byte [rbp + 1], bl
jmp 0x14001f521
mov bl, 9
mov byte [rbp + 1], bl
jmp 0x14001f521
mov bl, 8
mov byte [rbp + 1], bl
jmp 0x14001f521
movzx eax, r14b
or al, r15b
je 0x14001f453
test esi, esi
jne 0x14001f453
mov dil, 1
jmp 0x14001f456
xor dil, dil
movzx esi, word [r12]
cmp si, 0xa
jne 0x14001f468
mov bl, 0xd
jmp 0x14001f510
mov rdx, qword [0x14013e4d0]
movzx ecx, si
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rbx, ax
mov rcx, rbx
shr rcx, 8
cmp cl, 0xff
jne 0x14001f4cb
cmp bl, 0xff
jne 0x14001f4cb
test dil, dil
je 0x14001f4d0
movzx edi, si
test edi, 0xffffff80
jne 0x14001f4d0
mov edx, 0x103
mov ecx, edi
call qword [sym.imp.MSVCR100.dll__isctype]
test eax, eax
je 0x14001f4d0
movzx ecx, si
call fcn.140016bd0
mov edx, 1
mov ecx, edi
movzx ebx, al
call qword [sym.imp.MSVCR100.dll__isctype]
test eax, eax
setne cl
test cl, 0x38
je 0x14001f4d4
xor bl, bl
jmp 0x14001f510
movzx eax, cl
and al, 6
cmp al, 6
jne 0x14001f4e3
or r14b, 8
jmp 0x14001f501
test cl, 2
je 0x14001f4f2
test r14b, 3
jne 0x14001f4f2
or r14b, 1
test cl, 4
je 0x14001f501
test r14b, 0xc
jne 0x14001f501
or r14b, 4
test cl, 1
je 0x14001f510
test r14b, 0x30
jne 0x14001f510
or r14b, 0x10
mov esi, dword [rbp + 0xf8]
mov byte [rbp + 1], bl
test bl, bl
je 0x14001f3ef
xor edx, edx
movzx r9d, r15b
movzx r8d, r14b
mov byte [rsp + 0x50], dl
mov dword [rsp + 0x48], 0x80000000
mov dword [rsp + 0x40], 0x80000000
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x30], dl
movzx ecx, bl
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
call fcn.14001fa30
jmp 0x14001f578
movzx ecx, word [r12]
or r14b, r15b
mov edx, 1
movzx r8d, r14b
call fcn.14001feb0
xor r14b, r14b
mov byte [rbp], r14b
movzx eax, byte [rbp + 5]
mov r13, qword [rbp + 0x108]
add r12, 2
cmp word [r12], 0
lea rdi, [0x140000000]
mov byte [0x140140483], al
jne 0x14001e750
cmp dword [0x1401405f0], 0
je 0x14001f667
or ebx, 0xffffffff
cmp byte [0x14013e4a9], 0
mov dword [rbp + 0xf0], ebx
jne 0x14001f62a
cmp dword [0x14013e4bc], 0
jbe 0x14001f62a
cmp byte [0x14013e4a3], 0
je 0x14001f5de
xor eax, eax
mov ebx, eax
jmp 0x14001f5ea
movzx ebx, byte [rbp + 6]
movzx edx, byte [rbp + 3]
not ebx
and ebx, edx
or bl, byte [0x140140487]
movzx edx, byte [0x14013e4ab]
mov r9b, 1
or bl, r15b
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
movzx ecx, bl
mov byte [rsp + 0x20], 1
call fcn.140022950
lea rcx, [rbp + 0xf0]
movzx edx, bl
call fcn.1400221f0
mov ebx, dword [rbp + 0xf0]
cmp dword [0x1401405f0], 1
mov eax, 0x5dc
mov ecx, 0x1f4
cmove eax, ecx
cmp dword [0x14013e4b8], eax
jbe 0x14001f653
mov rcx, qword [0x14013e4c0]
call qword [sym.imp.MSVCR100.dll_free]
xor edi, edi
mov ecx, ebx
mov dword [0x1401405f0], edi
call fcn.140022450
jmp 0x14001f803
cmp qword [0x14013f848], 0
je 0x14001f67e
movzx ecx, byte [0x14013f6f3]
movzx edx, byte [rbp + 3]
jmp 0x14001f6aa
cmp dword [0x14013b0bc], 0
jl 0x14001f6a3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140143cec]
cmp eax, dword [0x14013b0bc]
jb 0x14001f6a3
movzx edx, byte [rbp + 3]
xor cl, cl
jmp 0x14001f6aa
movzx edx, byte [rbp + 3]
movzx ecx, dl
or cl, byte [0x140140487]
cmp byte [0x14013e4a3], 0
je 0x14001f6d1
movzx eax, cl
xor al, dl
movzx edi, al
and al, cl
and dil, dl
not dil
and dil, r15b
or dil, al
jmp 0x14001f6de
movzx edi, byte [rbp + 6]
not dil
and dil, cl
or dil, r15b
cmp qword [0x14013f848], 0
je 0x14001f6f4
movzx ebx, byte [0x14013f65f]
jmp 0x14001f7e2
mov ecx, 0xa0
xor bl, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
movzx ebx, bl
test si, ax
mov eax, reloc.WSOCK32.dll_recv
mov ecx, 0xa1
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14001f727
or bl, 0x20
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14001f73a
or bl, 1
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14001f74d
or bl, 2
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14001f760
or bl, 4
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14001f773
or bl, 8
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14001f786
or bl, 0x40
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14001f799
or bl, 0x80
cmp qword [0x14013f848], 0
je 0x14001f7e2
movzx r8d, byte [0x14013f65f]
movzx eax, bl
not al
and al, r8b
je 0x14001f7e2
movzx edx, byte [0x14013f6f3]
not al
lea rcx, [0x14013f740]
and byte [0x14013f6f2], al
and r8b, al
and dl, al
mov byte [0x14013f6f3], dl
mov byte [0x14013f65f], r8b
call fcn.1400232d0
mov r9b, 1
mov r8, r13
movzx edx, bl
movzx ecx, dil
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 1
call fcn.140022950
xor edi, edi
cmp qword [0x14013f848], 0
je 0x14001f829
movzx ecx, byte [0x14013f6f2]
movzx eax, cl
xor al, byte [0x14013f65f]
and al, cl
not al
and cl, al
mov byte [0x14013f6f2], cl
cmp dword [rbp + 0x34], 1
jne 0x14001f8cd
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
jne 0x14001f8cd
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14001f879
xor r8d, r8d
xor r9d, r9d
mov dl, reloc.OLEAUT32.dll_SafeArrayLock
lea ecx, [r8 + 1]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], r8b
call fcn.140020440
xor r8d, r8d
xor r9d, r9d
mov dl, reloc.OLEAUT32.dll_SafeArrayLock
lea ecx, [r8 + 2]
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], r8b
call fcn.140020440
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1401430c0]
jne 0x14001f8cd
mov edx, 1
or ecx, 0xffffffff
mov dword [0x14013b0c8], edi
call fcn.140001b80
mov dword [0x14013b0c8], 1
cmp byte [rbp + 7], 0
je 0x14001f8e5
mov edx, dword [rbp + 0x28]
mov ecx, dword [0x1401430c0]
xor r8d, r8d
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rbp + 8], 0
je 0x14001f941
cmp byte [rbp + 0x10], 0
jne 0x14001f941
mov eax, dword [0x140144130]
test al, 1
jne 0x14001f92a
or eax, 1
lea rcx, str.user32
mov dword [0x140144130], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.BlockInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140144128], rax
jmp 0x14001f931
mov rax, qword [0x140144128]
test rax, rax
je 0x14001f93a
xor ecx, ecx
call rax
mov byte [0x140140264], 0
cmp dword [rbp + 0x100], 1
jne 0x14001f980
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1401430c0]
jne 0x14001f980
mov edx, 1
or ecx, 0xffffffff
mov dword [0x14013b0c8], edi
call fcn.140001b80
mov dword [0x14013b0c8], 1
mov rax, qword [rbp + 0x38]
mov ecx, dword [rbp + 0x1c]
mov dword [rax + 0x7c], ecx
mov ecx, dword [rbp + 0x24]
mov dword [rax + 0x84], ecx
lea rsp, [rbp + 0xa8]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret