Function at 0x140022970
Capabilities:
Check for foreground window switch
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
movups xmmword [rsp + 0x150], xmm6
lea rax, [0x1400016a0]
mov edx, 0x65
mov dword [0x14002f180], 3
mov qword [0x14002f188], rax
lea rbp, [0x140024038]
mov qword [0x14002f190], 0
mov esi, r9d
mov rdi, rcx
mov qword [0x14002f198], rcx
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [0x14002f1a0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, 0xe1e1e1
mov qword [0x14002f1a8], rax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [0x14002f1c0], rbp
lea rcx, [0x14002f180]
mov qword [0x14002f1b0], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
mov r12, qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
call r12
xor ecx, ecx
mov ebx, eax
call r12
pxor xmm0, xmm0
xor ecx, ecx
mov qword [rsp + 0x50], rdi
cvtsi2ss xmm0, ebx
lea rdi, str.Static
divss xmm0, dword [str.ff_H]
mov rbx, qword [sym.imp.USER32.dll_CreateWindowExA]
cvttss2si edx, xmm0
pxor xmm0, xmm0
mov r9d, 0xc80000
mov qword [rsp + 0x58], 0
cvtsi2ss xmm0, eax
lea r8, section..rdata
divss xmm0, dword [0x140024180]
mov qword [rsp + 0x48], 0
cvttss2si eax, xmm0
mov dword [rsp + 0x38], 0xb4
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x28], edx
mov rdx, rbp
lea rbp, str.Button
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x20], eax
call rbx
mov rdx, rdi
xor ecx, ecx
mov r9d, 0x50000000
lea r8, [0x14002403a]
mov qword [0x14002f228], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x8d
mov dword [rsp + 0x30], 0x87
mov dword [rsp + 0x28], 5
mov dword [rsp + 0x20], 5
call rbx
mov rax, qword [0x14002f228]
mov rdx, rdi
xor ecx, ecx
mov r9d, 0x50000000
lea r8, str._rate__ms__n_trigger_n_output
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x32
mov dword [rsp + 0x30], 0x4b
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], 6
call rbx
mov rax, qword [0x14002f228]
mov rdx, rdi
xor ecx, ecx
mov r9d, 0x50000000
lea r8, str._random_n_stop_after
mov qword [rsp + 0x58], 0
lea rdi, str.Edit
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x21
mov dword [rsp + 0x30], 0x4b
mov dword [rsp + 0x28], 0x6e
mov dword [rsp + 0x20], 6
call rbx
mov rax, qword [0x14002f228]
mov rdx, rbp
xor ecx, ecx
mov r9d, 0x50000000
lea r8, [0x140024072]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x3d
mov dword [rsp + 0x28], 0x19
mov dword [rsp + 0x20], 0x4f
call rbx
mov rax, qword [0x14002f228]
mov rdx, rbp
xor ecx, ecx
mov r9d, 0x50000000
lea r8, [0x14002407d]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 3
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x3d
mov dword [rsp + 0x28], 0x2d
mov dword [rsp + 0x20], 0x4f
call rbx
mov rax, qword [0x14002f228]
mov rdx, rbp
xor ecx, ecx
mov r9d, 0x50000003
lea r8, str.always_on_top
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 5
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x12
mov dword [rsp + 0x30], 0x86
mov dword [rsp + 0x28], 0x56
mov dword [rsp + 0x20], 6
call rbx
mov rax, qword [0x14002f228]
xor ecx, ecx
mov rdx, rdi
mov r9d, 0x50802000
lea r8, [0x14002408d]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 4
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x3d
mov dword [rsp + 0x28], 5
mov dword [rsp + 0x20], 0x4f
call rbx
xor ecx, ecx
mov r9d, 0x50802000
mov rdx, rdi
mov qword [0x14002f1f0], rax
mov rax, qword [0x14002f228]
lea r8, [0x140024096]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 4
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x3d
mov dword [rsp + 0x28], 0x6b
mov dword [rsp + 0x20], 0x4f
call rbx
xor ecx, ecx
mov r9d, 0x50802000
mov rdx, rdi
mov qword [0x14002f1d8], rax
mov rax, qword [0x14002f228]
lea r8, [0x140024096]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 4
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x3d
mov dword [rsp + 0x28], 0x7e
mov dword [rsp + 0x20], 0x4f
call rbx
mov rdx, rbp
xor ecx, ecx
mov r9d, 0x50000003
mov qword [0x14002f1e8], rax
mov rax, qword [0x14002f228]
lea r8, str.toggle
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x86
mov dword [rsp + 0x28], 0x42
mov dword [rsp + 0x20], 6
call rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf5
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov qword [0x14002f170], 0xffffffffffffec78
call fcn.14001dca0
mov rcx, qword [0x14002f228]
mov r14, qword [sym.imp.USER32.dll_ShowWindow]
mov edx, esi
mov dword [0x14002f120], 0
mov r13, rax
mov dword [0x14002f148], 0
mov dword [0x14002f134], 2
mov dword [0x14002f15c], 4
mov dword [0x14002f0c0], 1
mov dword [0x14002f0e8], 1
mov dword [0x14002f0cc], 0
mov dword [0x14002f0f4], 2
call r14
mov rbp, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp byte [0x140023004], 0
je 0x140002420
mov ecx, 0x1b
call rbp
test ax, ax
js 0x140001f60
mov eax, dword [0x14002f234]
cmp eax, 1
je 0x140002440
test eax, eax
jne 0x140001fe8
cmp byte [0x14002f220], 0
je 0x140001f98
pxor xmm0, xmm0
xor ecx, ecx
lea rdx, [0x14002f210]
movups xmmword [0x14002f210], xmm0
call sub.XINPUT1_3.dll_XInputGetState
test eax, eax
je 0x1400029d2
nop word [rax + rax]
cmp dword [0x14002f234], 1
je 0x140001f0c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [sym.imp.USER32.dll_PeekMessageA]
mov r15, qword [sym.imp.USER32.dll_TranslateMessage]
lea rbx, [0x14002f060]
mov rdi, qword [sym.imp.USER32.dll_DispatchMessageA]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
mov rcx, rbx
call rsi
test eax, eax
je 0x140001e90
mov rcx, rbx
call r15
mov rcx, rbx
call rdi
jmp 0x140001f30
mov ecx, dword [0x14002f234]
test ecx, ecx
jne 0x1400024c0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [0x14002f228]
cmp rcx, rax
jne 0x140001ef8
mov edx, 6
call r14
jmp 0x140001ef8
mov ecx, dword [0x14002300c]
call rbp
test ax, ax
jns 0x140001ef8
mov eax, dword [0x140023008]
mov rcx, qword [0x14002f228]
lea rdx, str.clicking...
mov dword [0x14002f234], 1
mov dword [0x14002f098], eax
mov eax, dword [0x14002f1e0]
mov dword [0x14002f094], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x140001ef8
mov dword [0x14002f040], 0
mov r15, qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, 1
lea rsi, [0x140024140]
lea rdi, [0x140024100]
cmp eax, 2
je 0x14000208c
nop dword [rax]
mov ecx, ebx
call rbp
test ax, ax
js 0x140002053
add ebx, 1
cmp ebx, 0xfa
ja 0x140002606
mov edx, dword [0x14002f040]
mov rax, rdx
cmp dword [rsi + rdx*4], ebx
jne 0x140002018
mov ebx, dword [rdi + rdx*4]
add eax, 1
mov dword [0x14002f040], eax
mov ecx, ebx
call rbp
test ax, ax
jns 0x140002021
call r15
cmp qword [0x14002f228], rax
jne 0x140002021
cmp byte [0x14002f220], 0
jne 0x140002070
cmp dword [0x14002300c], ebx
je 0x140002021
mov dword [section..data], ebx
jmp 0x1400020dc
add eax, 1
mov ebx, dword [rdi + rdx*4]
mov dword [0x14002f040], eax
mov ecx, ebx
call rbp
test ax, ax
js 0x1400020bb
add ebx, 1
cmp ebx, 0xfa
ja 0x140002606
mov edx, dword [0x14002f040]
mov rax, rdx
cmp ebx, dword [rsi + rdx*4]
je 0x140002080
mov ecx, ebx
call rbp
test ax, ax
jns 0x140002095
call r15
cmp qword [0x14002f228], rax
jne 0x140002095
cmp ebx, dword [section..data]
je 0x140002095
mov dword [0x14002300c], ebx
mov byte [0x14002f220], 0
cmp ebx, 9
jbe 0x140002f7f
cmp ebx, 0x63
jbe 0x1400029ea
cmp ebx, 0x3e7
jbe 0x140002f6b
cmp ebx, 0x270f
jbe 0x140002f75
mov edx, 5
cmp ebx, 0x1869f
jbe 0x1400025f2
cmp ebx, 0xf423f
jbe 0x140002faa
mov edx, 7
cmp ebx, 0x98967f
jbe 0x1400025f2
cmp ebx, 0x5f5e0ff
jbe 0x1400025ed
cmp ebx, 0x3b9ac9ff
jbe 0x140002d03
mov eax, 9
lea rsi, [rsp + 0x70]
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x60], rsi
lea edx, [rax + 1]
xor r8d, r8d
mov rcx, rdi
call fcn.14001df20
mov eax, dword [rsp + 0x68]
mov r9, qword [rsp + 0x60]
mov ecx, ebx
movabs rdx, 0x3730363035303430
lea r8d, [rax - 1]
mov qword [rsp + 0x88], rdx
movabs rax, 0x3330323031303030
movabs rdx, 0x3531343133313231
mov qword [rsp + 0x80], rax
movabs rax, 0x3131303139303830
mov qword [rsp + 0x90], rax
movabs rax, 0x3931383137313631
mov qword [rsp + 0x98], rdx
movabs rdx, 0x3332323231323032
mov qword [rsp + 0xa0], rax
movabs rax, 0x3732363235323432
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x3133303339323832
mov qword [rsp + 0xb0], rax
movabs rax, 0x3533343333333233
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x3933383337333633
mov qword [rsp + 0xc0], rax
movabs rax, 0x3334323431343034
mov qword [rsp + 0xc8], rdx
movabs rdx, 0x3734363435343434
mov qword [rsp + 0xd0], rax
movabs rax, 0x3135303539343834
mov qword [rsp + 0xd8], rdx
movabs rdx, 0x3535343533353235
mov qword [rsp + 0xe0], rax
movabs rax, 0x3935383537353635
mov qword [rsp + 0xe8], rdx
movabs rdx, 0x3336323631363036
mov qword [rsp + 0xf0], rax
movabs rax, 0x3736363635363436
mov qword [rsp + 0xf8], rdx
movabs rdx, 0x3137303739363836
mov qword [rsp + 0x100], rax
movabs rax, 0x3537343733373237
mov qword [rsp + 0x108], rdx
movabs rdx, 0x3937383737373637
mov qword [rsp + 0x110], rax
movabs rax, 0x3338323831383038
mov qword [rsp + 0x118], rdx
movabs rdx, 0x3738363835383438
mov qword [rsp + 0x120], rax
movabs rax, 0x3139303939383838
mov qword [rsp + 0x128], rdx
movabs rdx, 0x3539343933393239
mov qword [rsp + 0x138], rdx
movabs rdx, 0x39393839373936
mov qword [rsp + 0x130], rax
movabs rax, 0x3935393439333932
mov qword [rsp + 0x139], rax
mov qword [rsp + 0x141], rdx
nop dword [rax]
mov edx, ecx
mov eax, ecx
imul rdx, rdx, 0x51eb851f
shr rdx, 0x25
imul r10d, edx, 0x64
sub eax, r10d
mov r10d, ecx
mov ecx, edx
mov edx, r8d
add eax, eax
lea r11d, [rax + 1]
movzx eax, byte [rsp + rax + 0x80]
movzx r11d, byte [rsp + r11 + 0x80]
mov byte [r9 + rdx], r11b
lea edx, [r8 - 1]
sub r8d, 2
mov byte [r9 + rdx], al
cmp r10d, 0x270f
ja 0x140002358
cmp r10d, 0x3e7
ja 0x140002be4
add ecx, 0x30
mov byte [r9], cl
mov edx, dword [0x14002f234]
mov r8, qword [rsp + 0x60]
mov rcx, qword [0x14002f228]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rsp + 0x60]
cmp rcx, rsi
je 0x1400023e9
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call fcn.140021d40
mov dword [0x14002f130], 0
mov dword [0x14002f158], 0
cmp ebx, 6
ja case.0x140002416.0
lea rdx, [0x1400240ac]
mov eax, ebx
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
movups xmm6, xmmword [rsp + 0x150]
xor eax, eax
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14001dca0
mov ecx, 1
mov rbx, rax
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
xor ecx, ecx
lea rdx, [0x14002f170]
call qword [0x14002f0a0]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
cmp byte [0x14002f220], 0
jne 0x140002511
mov ecx, dword [0x14002300c]
call rbp
mov ecx, eax
shr ax, 0xf
and ecx, 0x8000
movzx edx, byte [0x14002f230]
test dl, dl
jne 0x1400024a8
movzx edx, byte [0x14002f200]
test dl, dl
jne 0x140002554
cmp dl, al
jne 0x140002558
call fcn.1400015e0
jmp 0x140001ef8
mov rcx, qword [0x14002f228]
mov dword [0x14002f234], 0
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [0x14002f228]
lea rdx, section..rdata
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov byte [0x14002f230], 0
jmp 0x140002500
mov ecx, 1
call r12
mov ecx, 0x1b
call rbp
test ax, ax
js 0x1400024f8
jmp 0x140001ef8
pxor xmm0, xmm0
xor ecx, ecx
lea rdx, [0x14002f210]
movups xmmword [0x14002f210], xmm0
call sub.XINPUT1_3.dll_XInputGetState
test eax, eax
je 0x140002d1c
cmp byte [0x14002f230], 0
jne 0x140002558
cmp byte [0x14002f200], 0
je 0x1400024b0
mov byte [0x14002f230], 1
jmp 0x140001ef8
test ecx, ecx
je 0x140002548
call fcn.14001dca0
mov r8d, dword [0x14002f098]
mov rcx, rax
sub rax, rbx
sub rcx, r13
add rcx, rax
movabs rax, 0x431bde82d7b634db
imul rcx
sar rcx, 0x3f
sar rdx, 0x12
sub rdx, rcx
cmp r8, rdx
jg 0x140001ef8
mov edx, dword [0x14002f1e0]
test edx, edx
je 0x1400025a8
sub dword [0x14002f094], 1
je 0x140002f61
mov eax, dword [0x14002f1d0]
test eax, eax
jne 0x140002cce
cmp dword [section..data], 6
lea rax, [0x14002f120]
mov ecx, 2
mov r8d, 0x28
lea rdx, [0x14002f0c0]
cmovbe rdx, rax
call qword [sym.imp.USER32.dll_SendInput]
call fcn.14001dca0
mov r13, rax
jmp 0x140001ef8
mov edx, 8
lea rsi, [rsp + 0x70]
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x60], rsi
jmp 0x140002163
lea rbx, [0x14002f210]
pxor xmm0, xmm0
xor ecx, ecx
mov rdx, rbx
movups xmmword [0x14002f210], xmm0
call sub.XINPUT1_3.dll_XInputGetState
test eax, eax
jne 0x140001ef8
movzx eax, word [0x14002f214]
test ax, ax
je 0x140001ef8
mov byte [0x14002f220], 1
test al, 1
jne 0x14000305d
test al, 2
jne 0x140003050
test al, 4
jne 0x140003043
test al, 8
jne 0x140003009
test al, 0x10
jne 0x140002ff9
test al, 0x20
jne 0x140002fe9
test al, 0x40
jne 0x140002d37
test al, 0x80
jne 0x140002fdc
test ah, 1
jne 0x140002fcf
test ah, 2
jne 0x140002fb4
test ah, 4
jne 0x140003085
test ah, 8
jne 0x14000306a
test ah, 0x10
jne 0x14000309f
test ah, 0x20
jne 0x140003092
and ax, 0x4000
cmp ax, 1
sbb edx, edx
and edx, 0x4000
add edx, 0x4000
mov dword [0x14002300c], edx
mov r15d, edx
mov edx, 5
lea rdi, [rsp + 0x60]
xor r8d, r8d
lea rsi, [rsp + 0x70]
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.14001df20
mov r8, qword [rsp + 0x60]
movabs rax, 0x3330323031303030
movabs rdx, 0x3730363035303430
mov qword [rsp + 0x80], rax
movabs rax, 0x3131303139303830
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3531343133313231
mov qword [rsp + 0x90], rax
movabs rax, 0x3931383137313631
mov qword [rsp + 0x98], rdx
movabs rdx, 0x3332323231323032
mov qword [rsp + 0xa0], rax
movabs rax, 0x3732363235323432
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x3133303339323832
mov qword [rsp + 0xb0], rax
movabs rax, 0x3533343333333233
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x3933383337333633
mov qword [rsp + 0xc0], rax
movabs rax, 0x3334323431343034
mov qword [rsp + 0xc8], rdx
movabs rdx, 0x3734363435343434
mov qword [rsp + 0xd0], rax
movabs rax, 0x3135303539343834
mov qword [rsp + 0xd8], rdx
movabs rdx, 0x3535343533353235
mov qword [rsp + 0xe0], rax
movabs rax, 0x3935383537353635
mov qword [rsp + 0xe8], rdx
movabs rdx, 0x3336323631363036
mov qword [rsp + 0xf0], rax
movabs rax, 0x3736363635363436
mov qword [rsp + 0xf8], rdx
movabs rdx, 0x3137303739363836
mov qword [rsp + 0x100], rax
movabs rax, 0x3537343733373237
mov qword [rsp + 0x108], rdx
movabs rdx, 0x3937383737373637
mov qword [rsp + 0x110], rax
movabs rax, 0x3338323831383038
mov qword [rsp + 0x118], rdx
movabs rdx, 0x3738363835383438
mov qword [rsp + 0x120], rax
movabs rax, 0x3139303939383838
mov qword [rsp + 0x128], rdx
movabs rdx, 0x3539343933393239
mov qword [rsp + 0x138], rdx
movabs rdx, 0x39393839373936
mov qword [rsp + 0x130], rax
movabs rax, 0x3935393439333932
mov qword [rsp + 0x139], rax
mov eax, dword [rsp + 0x68]
mov qword [rsp + 0x141], rdx
lea ecx, [rax - 1]
nop dword [rax]
mov edx, r15d
mov eax, r15d
imul rdx, rdx, 0x51eb851f
shr rdx, 0x25
imul r9d, edx, 0x64
sub eax, r9d
mov r9d, r15d
mov r15d, edx
mov edx, ecx
add eax, eax
lea r10d, [rax + 1]
movzx eax, byte [rsp + rax + 0x80]
movzx r10d, byte [rsp + r10 + 0x80]
mov byte [r8 + rdx], r10b
lea edx, [rcx - 1]
sub ecx, 2
mov byte [r8 + rdx], al
cmp r9d, 0x270f
ja 0x1400028d8
cmp r9d, 0x3e7
ja 0x140002f40
add r15d, 0x30
mov byte [r8], r15b
mov rcx, qword [0x14002f228]
mov edx, 2
mov r8, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rsp + 0x60]
cmp rcx, rsi
je 0x140002969
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call fcn.140021d40
mov rcx, qword [0x14002f228]
pxor xmm6, xmm6
mov dword [0x14002f234], 0
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [0x14002f228]
lea rdx, section..rdata
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400029bb
movzx eax, word [0x14002f214]
and eax, dword [0x14002300c]
je 0x140001ef8
mov ecx, 1
call rsi
xor ecx, ecx
mov rdx, rbx
movups xmmword [rbx], xmm6
call sub.XINPUT1_3.dll_XInputGetState
test eax, eax
jne 0x140001ef8
jmp 0x1400029a1
movzx eax, word [0x14002f214]
and eax, dword [0x14002300c]
jne 0x140001fa9
jmp 0x140001ef8
lea rdi, [rsp + 0x60]
mov edx, 2
lea rsi, [rsp + 0x70]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.14001df20
mov r9, qword [rsp + 0x60]
mov ecx, ebx
movabs rax, 0x3330323031303030
movabs rdx, 0x3730363035303430
mov qword [rsp + 0x80], rax
movabs rax, 0x3131303139303830
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3531343133313231
mov qword [rsp + 0x90], rax
movabs rax, 0x3931383137313631
mov qword [rsp + 0x98], rdx
movabs rdx, 0x3332323231323032
mov qword [rsp + 0xa0], rax
movabs rax, 0x3732363235323432
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x3133303339323832
mov qword [rsp + 0xb0], rax
movabs rax, 0x3533343333333233
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x3933383337333633
mov qword [rsp + 0xc0], rax
movabs rax, 0x3334323431343034
mov qword [rsp + 0xc8], rdx
movabs rdx, 0x3734363435343434
mov qword [rsp + 0xd0], rax
movabs rax, 0x3135303539343834
mov qword [rsp + 0xd8], rdx
movabs rdx, 0x3535343533353235
mov qword [rsp + 0xe0], rax
movabs rax, 0x3935383537353635
mov qword [rsp + 0xe8], rdx
movabs rdx, 0x3336323631363036
mov qword [rsp + 0xf0], rax
movabs rax, 0x3736363635363436
mov qword [rsp + 0xf8], rdx
movabs rdx, 0x3137303739363836
mov qword [rsp + 0x100], rax
movabs rax, 0x3537343733373237
mov qword [rsp + 0x108], rdx
movabs rdx, 0x3937383737373637
mov qword [rsp + 0x110], rax
movabs rax, 0x3338323831383038
mov qword [rsp + 0x118], rdx
movabs rdx, 0x3738363835383438
mov qword [rsp + 0x120], rax
movabs rax, 0x3139303939383838
mov qword [rsp + 0x128], rdx
movabs rdx, 0x3539343933393239
mov qword [rsp + 0x138], rdx
movabs rdx, 0x39393839373936
mov qword [rsp + 0x130], rax
movabs rax, 0x3935393439333932
mov qword [rsp + 0x139], rax
mov qword [rsp + 0x141], rdx
add ecx, ecx
lea eax, [rcx + 1]
movzx ecx, byte [rsp + rcx + 0x80]
movzx eax, byte [rsp + rax + 0x80]
mov byte [r9 + 1], al
jmp 0x1400023b6
mov dword [0x14002f130], 2
mov dword [0x14002f158], 2
nop word cs:[rax + rax]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002c37
mov ecx, 1
call rsi
mov ecx, ebx
call rbp
test ax, ax
js 0x140002c30
mov rcx, qword [0x14002f228]
mov dword [0x14002f234], 0
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [0x14002f228]
lea rdx, section..rdata
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x140001ef8
mov dword [0x14002f130], 1
mov dword [0x14002f158], 1
jmp 0x140002c20
mov dword [0x14002f134], 0x20
mov dword [0x14002f15c], 0x40
jmp 0x140002c20
mov dword [0x14002f134], 8
mov dword [0x14002f15c], 0x10
jmp 0x140002c20
mov dword [0x14002f134], 2
mov dword [0x14002f15c], 4
jmp 0x140002c20
mov edx, dword [0x14002f1cc]
mov ecx, dword [0x14002f1c8]
call fcn.140001450
add eax, dword [0x140023008]
mov dword [0x14002f098], eax
jmp 0x1400025b6
mov word [0x14002f0c8], bx
mov word [0x14002f0f0], bx
jmp 0x140002c20
lea rsi, [rsp + 0x70]
mov edx, 9
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x60], rsi
jmp 0x140002163
movzx eax, word [0x14002f214]
and eax, dword [0x14002300c]
setne cl
setne al
movzx ecx, cl
jmp 0x14000248e
mov eax, 0x40
mov r15d, 0x40
lea rdi, [rsp + 0x60]
xor r8d, r8d
mov edx, 2
mov dword [0x14002300c], eax
lea rsi, [rsp + 0x70]
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.14001df20
mov r8, qword [rsp + 0x60]
movabs rax, 0x3330323031303030
movabs rdx, 0x3730363035303430
mov qword [rsp + 0x80], rax
movabs rax, 0x3131303139303830
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3531343133313231
mov qword [rsp + 0x90], rax
movabs rax, 0x3931383137313631
mov qword [rsp + 0x98], rdx
movabs rdx, 0x3332323231323032
mov qword [rsp + 0xa0], rax
movabs rax, 0x3732363235323432
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x3133303339323832
mov qword [rsp + 0xb0], rax
movabs rax, 0x3533343333333233
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x3933383337333633
mov qword [rsp + 0xc0], rax
movabs rax, 0x3334323431343034
mov qword [rsp + 0xc8], rdx
movabs rdx, 0x3734363435343434
mov qword [rsp + 0xd0], rax
movabs rax, 0x3135303539343834
mov qword [rsp + 0xd8], rdx
movabs rdx, 0x3535343533353235
mov qword [rsp + 0xe0], rax
movabs rax, 0x3935383537353635
mov qword [rsp + 0xe8], rdx
movabs rdx, 0x3336323631363036
mov qword [rsp + 0xf0], rax
movabs rax, 0x3736363635363436
mov qword [rsp + 0xf8], rdx
movabs rdx, 0x3137303739363836
mov qword [rsp + 0x100], rax
movabs rax, 0x3537343733373237
mov qword [rsp + 0x108], rdx
movabs rdx, 0x3937383737373637
mov qword [rsp + 0x110], rax
movabs rax, 0x3338323831383038
mov qword [rsp + 0x118], rdx
movabs rdx, 0x3738363835383438
mov qword [rsp + 0x120], rax
movabs rax, 0x3139303939383838
mov qword [rsp + 0x128], rdx
movabs rdx, 0x3539343933393239
mov qword [rsp + 0x138], rdx
movabs rdx, 0x39393839373936
mov qword [rsp + 0x130], rax
movabs rax, 0x3935393439333932
mov qword [rsp + 0x139], rax
mov qword [rsp + 0x141], rdx
add r15d, r15d
lea eax, [r15 + 1]
movzx r15d, byte [rsp + r15 + 0x80]
movzx eax, byte [rsp + rax + 0x80]
mov byte [r8 + 1], al
jmp 0x140002937
call fcn.1400015e0
jmp 0x1400025a8
mov edx, 3
jmp 0x1400025f2
mov edx, 4
jmp 0x1400025f2
lea rdi, [rsp + 0x60]
lea rsi, [rsp + 0x70]
xor r8d, r8d
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.14001df20
mov r9, qword [rsp + 0x60]
mov ecx, ebx
jmp 0x1400023b3
mov eax, 5
jmp 0x140002151
mov eax, 0x200
mov r15d, 0x200
mov dword [0x14002300c], eax
mov edx, 3
jmp 0x1400026db
mov eax, 0x100
mov r15d, 0x100
jmp 0x140002fbf
mov eax, pe_nt_image_headers64
mov r15d, pe_nt_image_headers64
jmp 0x140002fbf
mov eax, 0x20
mov r15d, 0x20
jmp 0x140002d42
mov eax, 0x10
mov r15d, 0x10
jmp 0x140002d42
mov eax, 8
mov r15d, 8
lea rdi, [rsp + 0x60]
xor r8d, r8d
lea rsi, [rsp + 0x70]
mov edx, 1
mov rcx, rdi
mov dword [0x14002300c], eax
mov qword [rsp + 0x60], rsi
call fcn.14001df20
mov r8, qword [rsp + 0x60]
jmp 0x140002933
mov eax, 4
mov r15d, 4
jmp 0x140003014
mov eax, 2
mov r15d, 2
jmp 0x140003014
mov eax, 1
mov r15d, 1
jmp 0x140003014
mov eax, 0x800
mov r15d, 0x800
mov dword [0x14002300c], eax
mov edx, 4
jmp 0x1400026db
mov eax, 0x400
mov r15d, 0x400
jmp 0x140003075
mov eax, 0x2000
mov r15d, 0x2000
jmp 0x140003075
mov eax, 0x1000
mov r15d, 0x1000
jmp 0x140003075
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.14000dc00
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p__acmdln
mov rbx, qword [rax]
test rbx, rbx
jne 0x1400229bb
jmp 0x140022a31
test cl, cl
je 0x1400229e8
and esi, 1
je 0x1400229d0
mov esi, 1
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__ismbblead
test eax, eax
je 0x1400229b7
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x140022998
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x1400229a6
test cl, cl
je 0x1400229e8
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x1400229e8
cmp al, 0x20
jle 0x1400229d8
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x140022a16
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x140026cb0]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140001910
lea rbx, [0x140026410]
jmp 0x1400229e8