Function at 0x100044d94
Capabilities:
Accept command line arguments
Check mutex on windows
Delete file
Log keystrokes
Log keystrokes via polling
Register raw input devices

Disassembly:
push r13
push r14
push r15
mov eax, 0x2e60
call fcn.10017b0f0
sub rsp, rax
mov qword [rsp + 0x150], 0xfffffffffffffffe
mov qword [rsp + 0x2e80], rbx
mov qword [rsp + 0x2e88], rsi
mov qword [rsp + 0x2e90], rdi
mov qword [rsp + 0x2e98], r12
movaps xmmword [rsp + 0x2e50], xmm6
movaps xmmword [rsp + 0x2e40], xmm7
movaps xmmword [rsp + 0x2e30], xmm8
movaps xmmword [rsp + 0x2e20], xmm9
movaps xmmword [rsp + 0x2e10], xmm10
movaps xmmword [rsp + 0x2e00], xmm11
mov rax, qword [0x100190170]
xor rax, rsp
mov qword [rsp + 0x2df8], rax
xor esi, esi
mov r12d, esi
mov dword [rsp + 0x60], esi
xor r9d, r9d
xor r8d, r8d
lea r13d, [rsi + 1]
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea ecx, [rsi + 0x43]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, esi
je 0x100044e6f
call fcn.100056a30
mov byte [rsp + 0x30], r13b
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov r9d, 0xfffe
mov r8d, r13d
mov edx, 0x450
xor ecx, ecx
call fcn.10017156c
jmp 0x100044e9a
mov dword [rsp + 0x68], r13d
lea rdx, [rsp + 0x68]
lea rcx, [0x1000268d0]
call sub.slc.dll_SLGetWindowsInformationDWORD
mov edx, dword [rsp + 0x68]
cmp eax, esi
cmovl edx, esi
mov ecx, esi
cmp edx, r13d
sete cl
cmp ecx, esi
jne 0x100044ea2
mov eax, r13d
jmp 0x100046f78
lea rcx, [0x100046fd0]
call qword [sym.imp.msvcrt.dll_int____cdecl___unsigned_long_long_unsigned___int64_____cdecl__set_new_handler_int____cdecl___unsigned_long_long_unsigned___int64___]
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_int___cdecl__set_new_mode_int_]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
xor r8d, r8d
xor edx, edx
call fcn.100171104
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov r8, qword [0x1001a09b0]
lea rdx, [0x100026928]
lea rcx, [rsp + 0x70]
call fcn.10016e8bc
mov rdi, qword [rsp + 0x80]
mov r8, rdi
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp rax, rsi
je 0x100044f78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, 0xb7
cmp eax, r14d
jne 0x100044f78
xor edx, edx
mov rcx, qword [0x1001a09b8]
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
cmp rax, rsi
je 0x100044f68
mov rcx, rax
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, esi
je 0x100044f55
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
mov rcx, rdi
call sub.msvcrt.dll_free
mov eax, r14d
jmp 0x100046f78
mov rcx, rdi
call sub.msvcrt.dll_free
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
mov dword [rsp + 0x138], r13d
mov qword [rsp + 0x140], rsi
mov dword [rsp + 0x148], esi
mov dword [rsp + 0x14c], esi
xor r8d, r8d
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0xf0]
call sub.gdiplus.dll_GdiplusStartup
mov dword [rsp + 0x29d0], esi
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0x29d4]
call sub.msvcrt.dll_memset
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rsp + 0x29d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x100045024
mov word [rsp + 0x2bd6], si
mov edx, 0x5c
lea rcx, [rsp + 0x29d0]
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rsi
je 0x10004503b
mov word [rax], si
jmp 0x10004503b
lea r8, [0x10002695c]
mov rdx, rbx
lea rcx, [rsp + 0x29d0]
call sub.msvcrt.dll_wcscpy_s
mov edx, 0xda
lea rcx, [rsp + 0x120]
call fcn.10016e534
nop
mov dl, r13b
lea rcx, [rsp + 0x160]
call fcn.10016f3d0
nop
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x160]
call fcn.10016f830
cmp al, sil
jne 0x10004518c
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov edx, 0xa9
lea rcx, [rsp + 0xc0]
call fcn.10016e534
nop
mov r8, qword [rsp + 0x130]
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x70]
call fcn.10016e8bc
nop
mov rcx, qword [rsp + 0xd0]
call sub.msvcrt.dll_free
mov byte [rsp + 0x30], r13b
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rbx
mov rax, qword [0x1001a09b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xfffe
mov r8d, r13d
xor edx, edx
xor ecx, ecx
call fcn.10017156c
nop
mov rcx, rbx
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x2970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10016ee3c
lea rcx, [rsp + 0x160]
call fcn.10016f9e8
nop
mov rcx, qword [rsp + 0x29c0]
cmp rcx, rsi
je 0x10004513a
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x29a8]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x2990]
cmp rcx, rsi
je 0x10004515b
call sub.msvcrt.dll_free
nop
lea r9, [fcn.10016e648]
mov edx, 0x28
mov r8d, 0x100
lea rcx, [rsp + 0x160]
call fcn.10017a4cc
nop
mov qword [0x1001a72b0], rsi
mov edi, 2
jmp 0x1000465e4
mov edx, 0x81
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadMenuW]
mov qword [rsp + 0x88], rax
mov r8d, 0x400
mov r15d, 2
mov edx, r15d
mov rcx, rax
call qword [sym.imp.USER32.dll_RemoveMenu]
mov dl, r13b
mov cl, r13b
call fcn.10004e608
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, esi
jge 0x100045286
mov byte [rsp + 0x30], r13b
mov qword [rsp + 0x28], rsi
mov rax, qword [0x1001a09b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xfffe
mov r8d, r13d
mov edx, 0x8d
xor ecx, ecx
call fcn.10017156c
nop
mov rcx, qword [rsp + 0x2970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10016ee3c
lea rcx, [rsp + 0x160]
call fcn.10016f9e8
nop
mov rcx, qword [rsp + 0x29c0]
cmp rcx, rsi
je 0x100045234
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x29a8]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x2990]
cmp rcx, rsi
je 0x100045255
call sub.msvcrt.dll_free
nop
lea r9, [fcn.10016e648]
mov edx, 0x28
mov r8d, 0x100
lea rcx, [rsp + 0x160]
call fcn.10017a4cc
nop
mov qword [0x1001a72b0], rsi
mov edi, 0x32
jmp 0x1000465e4
mov dil, sil
mov qword [rsp + 0xb8], rsi
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [0x1000276f8]
mov r8d, r13d
xor edx, edx
lea rcx, [0x1000276d8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jl 0x1000453fd
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x2be0]
xor r8d, r8d
xor edx, edx
lea rcx, [0x10002ae20]
call sub.SHELL32.dll_SHGetFolderPathEx
cmp eax, esi
jl 0x1000453fd
mov rax, rbx
lea rcx, [rsp + 0x2be0]
cmp word [rcx], si
je 0x1000452fc
add rcx, r15
sub rax, r13
jne 0x1000452ef
cmp rax, rsi
je 0x1000453fd
mov rcx, rbx
sub rcx, rax
sub rbx, rcx
lea rax, [rsp + rcx*2 + 0x2be0]
mov r9d, esi
je 0x100045354
lea rdx, [rbx + rcx + 0x7ffffefb]
lea rcx, [0x100026960]
sub rcx, rax
cmp rdx, rsi
je 0x10004534f
movzx r8d, word [rax + rcx]
cmp r8w, si
je 0x10004534f
mov word [rax], r8w
add rax, r15
sub rbx, r13
sub rdx, r13
cmp rbx, rsi
jne 0x10004532d
cmp rbx, rsi
jne 0x10004535d
sub rax, r15
mov r9d, 0x8007007a
mov word [rax], si
cmp r9d, esi
jl 0x1000453fd
lea rcx, [rsp + 0x2be0]
mov rax, qword [0x10019fc68]
cmp rcx, rax
je 0x1000453ab
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x2be0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [0x10019fc68], rax
cmp rax, rsi
jne 0x1000453ab
mov ecx, 0x8007000e
call fcn.10004c690
nop
jmp 0x1000453c6
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, esi
jbe 0x1000453fd
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
mov rdx, qword [0x10019fc68]
call qword [rax + 0x30]
cmp eax, esi
jl 0x1000453fd
movzx edi, dil
cmp dword [rsp + 0x68], esi
cmovne edi, r13d
mov rcx, qword [rsp + 0xb8]
cmp rcx, rsi
je 0x100045410
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dil, sil
jne 0x10004549f
mov rcx, qword [rsp + 0x2970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10016ee3c
lea rcx, [rsp + 0x160]
call fcn.10016f9e8
nop
mov rcx, qword [rsp + 0x29c0]
cmp rcx, rsi
je 0x10004544d
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x29a8]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x2990]
cmp rcx, rsi
je 0x10004546e
call sub.msvcrt.dll_free
nop
lea r9, [fcn.10016e648]
mov edx, 0x28
mov r8d, 0x100
lea rcx, [rsp + 0x160]
call fcn.10017a4cc
nop
mov qword [0x1001a72b0], rsi
mov edi, 5
jmp 0x1000465e4
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x1000454ca
lea r14, [0x10019a4f8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
jmp 0x1000454d1
lea r14, [0x10019a4f8]
lea rax, [0x100047110]
mov qword [rbx + 0x2a8], rax
cmp cl, sil
je 0x1000454ed
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x10004550f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x328], rsi
cmp cl, sil
je 0x100045524
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x100045546
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
lea rax, [0x100047704]
mov qword [rbx + 0x2b0], rax
cmp cl, sil
je 0x100045562
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x100045584
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x330], rsi
cmp cl, sil
je 0x100045599
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x1000455bb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
lea rax, [0x10004bb38]
mov qword [rbx + 0x2b8], rax
cmp cl, sil
je 0x1000455d7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x1000455f9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x338], rsi
cmp cl, sil
je 0x10004560e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x100045630
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
lea rax, [0x10004bd00]
mov qword [rbx + 0x2c0], rax
cmp cl, sil
je 0x10004564c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x10004566e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x340], rsi
cmp cl, sil
je 0x100045683
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x1000456a5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
lea rax, [0x10004a46c]
mov qword [rbx + 0x2e8], rax
cmp cl, sil
je 0x1000456c1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x1000456e3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x368], rsi
cmp cl, sil
je 0x1000456f8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x10004571a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
lea rax, [0x10004b408]
mov qword [rbx + 0x2d8], rax
cmp cl, sil
je 0x100045736
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x100045758
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x358], rsi
cmp cl, sil
je 0x10004576d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r8d, r8d
mov dl, r13b
lea rcx, [0x10004b5a8]
call fcn.10004e53c
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x1000457a1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
lea rax, [0x100048144]
mov qword [rbx + 0x2d0], rax
cmp cl, sil
je 0x1000457bd
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x1000457df
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x350], rsi
cmp cl, sil
je 0x1000457f4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x100045816
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
lea rax, [0x100047b98]
mov qword [rbx + 0x2c8], rax
cmp cl, sil
je 0x100045832
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x100045854
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x348], rsi
cmp cl, sil
je 0x100045869
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x10004588b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
lea rax, [0x10004bdf4]
mov qword [rbx + 0x2f0], rax
cmp cl, sil
je 0x1000458a7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x1000458c9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov qword [rbx + 0x370], rsi
cmp cl, sil
je 0x1000458de
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0xb8], rsi
call fcn.100056cbc
cmp al, sil
je 0x100045915
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
xor r8d, r8d
lea rdx, [0x10004be04]
lea ecx, [r8 + 7]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rsp + 0xb8], rax
call fcn.10005768c
lea r11, [0x10019fc70]
mov qword [0x100199788], r11
lea rcx, [0x100199548]
call fcn.10005b418
lea rcx, [0x100199540]
call fcn.100060344
call fcn.100041bc0
call fcn.100056cbc
cmp al, sil
je 0x10004617e
mov dword [rsp + 0x68], esi
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
test byte [rsp + 0x68], r13b
jne 0x100045d70
mov ebx, 0x750
mov rcx, rbx
call fcn.100179d98
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, rsi
je 0x100045a72
lea rdx, [0x100026708]
lea rcx, [rsp + 0xa0]
call fcn.10016e414
nop
mov dword [rsp + 0x60], r13d
lea rdx, [0x100026810]
lea rcx, [rsp + 0xc0]
call fcn.10016e414
nop
mov dword [rsp + 0x60], 3
mov edx, 0x80
lea rcx, [rsp + 0x70]
call fcn.10016e534
nop
mov r12d, 7
mov dword [rsp + 0x60], r12d
movss xmm8, dword [0x100039dc0]
movss dword [rsp + 0x58], xmm8
movss xmm6, dword [0x100039dbc]
movss dword [rsp + 0x50], xmm6
movss xmm9, dword [0x100039db8]
movss dword [rsp + 0x48], xmm9
movss xmm0, dword [0x100039db4]
movss dword [rsp + 0x40], xmm0
movss xmm10, dword [0x100039db0]
movss dword [rsp + 0x38], xmm10
movss xmm7, dword [0x100039dac]
movss dword [rsp + 0x30], xmm7
movss xmm11, dword [0x100039da8]
movss dword [rsp + 0x28], xmm11
movss xmm0, dword [0x100039da4]
movss dword [rsp + 0x20], xmm0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xc0]
mov rdx, rax
mov rcx, rdi
call fcn.100040ba0
jmp 0x100045aa9
mov rax, rsi
movss xmm8, dword [0x100039dc0]
movss xmm6, dword [0x100039dbc]
movss xmm9, dword [0x100039db8]
movss xmm10, dword [0x100039db0]
movss xmm7, dword [0x100039dac]
movss xmm11, dword [0x100039da8]
mov qword [0x10019f550], rax
test r12b, 4
je 0x100045acd
and r12d, 0xfffffffb
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
nop
test r15b, r12b
je 0x100045ae9
and r12d, 0xfffffffd
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0xd0]
call sub.msvcrt.dll_free
nop
test r13b, r12b
je 0x100045aff
and r12d, 0xfffffffe
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_free
mov rcx, rbx
call fcn.100179d98
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, rsi
je 0x100045bce
lea rdx, [0x100026708]
lea rcx, [rsp + 0xa0]
call fcn.10016e414
nop
or r12d, 8
mov dword [rsp + 0x60], r12d
lea rdx, [0x100026810]
lea rcx, [rsp + 0xc0]
call fcn.10016e414
nop
or r12d, 0x10
mov dword [rsp + 0x60], r12d
mov edx, 0x82
lea rcx, [rsp + 0x70]
call fcn.10016e534
nop
or r12d, 0x20
mov dword [rsp + 0x60], r12d
movss dword [rsp + 0x58], xmm8
movss xmm0, dword [0x100039da0]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x48], xmm9
movss dword [rsp + 0x40], xmm6
movss dword [rsp + 0x38], xmm10
movss dword [rsp + 0x30], xmm7
movss dword [rsp + 0x28], xmm11
movss xmm0, dword [0x100039d9c]
movss dword [rsp + 0x20], xmm0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xc0]
mov rdx, rax
mov rcx, rdi
call fcn.100040ba0
jmp 0x100045bd1
mov rax, rsi
mov qword [0x10019f558], rax
test r12b, 0x20
je 0x100045bf5
and r12d, 0xffffffdf
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
nop
test r12b, 0x10
je 0x100045c12
and r12d, 0xffffffef
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0xd0]
call sub.msvcrt.dll_free
nop
test r12b, 8
je 0x100045c29
and r12d, 0xfffffff7
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_free
mov rcx, rbx
call fcn.100179d98
mov rbx, rax
mov qword [rsp + 0x68], rax
cmp rax, rsi
je 0x100045d0a
lea rdx, [0x100026698]
lea rcx, [rsp + 0xa0]
call fcn.10016e414
nop
or r12d, 0x40
mov dword [rsp + 0x60], r12d
lea rdx, [0x100026788]
lea rcx, [rsp + 0xc0]
call fcn.10016e414
nop
bts r12d, 7
mov dword [rsp + 0x60], r12d
mov edx, 0x83
lea rcx, [rsp + 0x70]
call fcn.10016e534
nop
bts r12d, 8
mov dword [rsp + 0x60], r12d
movss dword [rsp + 0x58], xmm8
movss xmm0, dword [0x100039d98]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x48], xmm9
movss xmm0, dword [0x100039d94]
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x38], xmm10
movss xmm0, dword [0x100039d90]
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x28], xmm11
movss xmm0, dword [0x100039d8c]
movss dword [rsp + 0x20], xmm0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xc0]
mov rdx, rax
mov rcx, rbx
call fcn.100040ba0
jmp 0x100045d0d
mov rax, rsi
mov qword [0x10019f560], rax
bt r12d, 8
jae 0x100045d33
btr r12d, 8
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
nop
test r12b, r12b
jns 0x100045d50
btr r12d, 7
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0xd0]
call sub.msvcrt.dll_free
nop
test r12b, 0x40
je 0x10004617e
and r12d, 0xffffffbf
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_free
jmp 0x10004617e
mov ebx, 0x750
mov rcx, rbx
call fcn.100179d98
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, rsi
je 0x100045e76
lea rdx, [0x100026708]
lea rcx, [rsp + 0xa0]
call fcn.10016e414
nop
mov dword [rsp + 0x60], 0x200
lea rdx, [0x100026810]
lea rcx, [rsp + 0xc0]
call fcn.10016e414
nop
mov dword [rsp + 0x60], 0x600
mov edx, 0x80
lea rcx, [rsp + 0x70]
call fcn.10016e534
nop
mov r12d, 0xe00
mov dword [rsp + 0x60], r12d
movss xmm7, dword [0x100039dc0]
movss dword [rsp + 0x58], xmm7
movss xmm0, dword [0x100039d88]
movss dword [rsp + 0x50], xmm0
movss xmm8, dword [0x100039db8]
movss dword [rsp + 0x48], xmm8
movss xmm0, dword [0x100039d84]
movss dword [rsp + 0x40], xmm0
movss xmm9, dword [0x100039db0]
movss dword [rsp + 0x38], xmm9
movss xmm6, dword [0x100039dac]
movss dword [rsp + 0x30], xmm6
movss xmm10, dword [0x100039da8]
movss dword [rsp + 0x28], xmm10
movss xmm0, dword [0x100039d80]
movss dword [rsp + 0x20], xmm0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xc0]
mov rdx, rax
mov rcx, rdi
call fcn.100040ba0
jmp 0x100045ea4
mov rax, rsi
movss xmm7, dword [0x100039dc0]
movss xmm8, dword [0x100039db8]
movss xmm9, dword [0x100039db0]
movss xmm6, dword [0x100039dac]
movss xmm10, dword [0x100039da8]
mov qword [0x10019f550], rax
bt r12d, 0xb
jae 0x100045eca
btr r12d, 0xb
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
nop
bt r12d, 0xa
jae 0x100045ee9
btr r12d, 0xa
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0xd0]
call sub.msvcrt.dll_free
nop
bt r12d, 9
jae 0x100045f02
btr r12d, 9
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_free
mov rcx, rbx
call fcn.100179d98
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, rsi
je 0x100045fdb
lea rdx, [0x100026708]
lea rcx, [rsp + 0xa0]
call fcn.10016e414
nop
bts r12d, 0xc
mov dword [rsp + 0x60], r12d
lea rdx, [0x100026810]
lea rcx, [rsp + 0xc0]
call fcn.10016e414
nop
bts r12d, 0xd
mov dword [rsp + 0x60], r12d
mov edx, 0x82
lea rcx, [rsp + 0x70]
call fcn.10016e534
nop
bts r12d, 0xe
mov dword [rsp + 0x60], r12d
movss dword [rsp + 0x58], xmm7
movss xmm0, dword [0x100039d7c]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x48], xmm8
movss xmm0, dword [0x100039d78]
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x38], xmm9
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm10
movss xmm0, dword [0x100039d74]
movss dword [rsp + 0x20], xmm0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xc0]
mov rdx, rax
mov rcx, rdi
call fcn.100040ba0
jmp 0x100045fde
mov rax, rsi
mov qword [0x10019f558], rax
bt r12d, 0xe
jae 0x100046004
btr r12d, 0xe
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
nop
bt r12d, 0xd
jae 0x100046023
btr r12d, 0xd
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0xd0]
call sub.msvcrt.dll_free
nop
bt r12d, 0xc
jae 0x10004603c
btr r12d, 0xc
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_free
mov rcx, rbx
call fcn.100179d98
mov rbx, rax
mov qword [rsp + 0x68], rax
cmp rax, rsi
je 0x10004611d
lea rdx, [0x100026698]
lea rcx, [rsp + 0xa0]
call fcn.10016e414
nop
bts r12d, 0xf
mov dword [rsp + 0x60], r12d
lea rdx, [0x100026788]
lea rcx, [rsp + 0xc0]
call fcn.10016e414
nop
bts r12d, 0x10
mov dword [rsp + 0x60], r12d
mov edx, 0x83
lea rcx, [rsp + 0x70]
call fcn.10016e534
nop
bts r12d, 0x11
mov dword [rsp + 0x60], r12d
movss dword [rsp + 0x58], xmm7
movss xmm0, dword [0x100038470]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x48], xmm8
movss xmm0, dword [0x100039d70]
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x38], xmm9
movss xmm0, dword [0x100039d6c]
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x28], xmm10
movss xmm0, dword [0x100039d68]
movss dword [rsp + 0x20], xmm0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xc0]
mov rdx, rax
mov rcx, rbx
call fcn.100040ba0
jmp 0x100046120
mov rax, rsi
mov qword [0x10019f560], rax
bt r12d, 0x11
jae 0x100046146
btr r12d, 0x11
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
nop
bt r12d, 0x10
jae 0x100046165
btr r12d, 0x10
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsp + 0xd0]
call sub.msvcrt.dll_free
nop
bt r12d, 0xf
jae 0x10004617e
btr r12d, 0xf
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_free
mov ecx, 0x49e90
call fcn.100179d98
mov qword [rsp + 0x68], rax
cmp rax, rsi
je 0x1000461c0
mov rcx, qword [0x10019f560]
mov qword [rsp + 0x20], rcx
mov r9, qword [0x10019f558]
mov r8, qword [0x10019f550]
lea rdx, [0x10019fe80]
mov rcx, rax
call fcn.10006248c
mov rbx, rax
jmp 0x1000461c3
mov rbx, rsi
mov qword [0x10019f520], rbx
lea r8, [0x100199b90]
lea rdx, [0x100199d10]
lea rcx, [rsp + 0x64]
call fcn.10006f4d0
mov byte [rbx], al
mov rax, qword [rbx + 0x49da0]
neg rax
sbb cl, cl
and cl, byte [0x100199d14]
mov byte [0x100199d12], cl
mov dl, byte [0x100199d13]
mov rcx, rbx
call fcn.100062cf4
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, 0xfff8
jne 0x10004622f
mov eax, dword [0x100199d38]
cmp eax, esi
jne 0x100046263
mov eax, dword [0x100199d3c]
cmp eax, esi
jne 0x100046270
lea rdx, [0x100199d3c]
lea rcx, [0x100199d38]
call fcn.10004c248
mov dword [0x100199d40], 0x320
mov dword [0x100199d44], 0x1f0
mov byte [0x100199d48], sil
mov eax, dword [0x100199d38]
cmp eax, 0x80000000
je 0x100046277
mov eax, dword [0x100199d3c]
cmp eax, 0x80000000
jne 0x10004629d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0x320
jle 0x100046296
mov ecx, r13d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0x258
jg 0x10004629d
mov byte [0x100199d48], r13b
mov bl, byte [0x100199d48]
call fcn.100056cbc
cmp al, sil
je 0x1000463c5
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0xf0
mov dword [rsp + 0x20], 0x140
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1001a09b0]
call fcn.10004f994
xor edx, edx
lea r8d, [rdx + 0x24]
lea rcx, [rsp + 0xfc]
call sub.msvcrt.dll_memset
mov r15d, 0x28
mov dword [rsp + 0xf8], r15d
call fcn.10005691c
mov rbx, rax
xor edx, edx
lea rcx, [0x1000269a8]
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, rsi
cmovne rbx, rax
lea edx, [r15 - 0x26]
mov rcx, rbx
call qword [sym.imp.USER32.dll_MonitorFromWindow]
mov rcx, rax
lea rdx, [rsp + 0xf8]
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [rsp + 0xc0], esi
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0xc4]
call sub.msvcrt.dll_memset
call fcn.10005691c
mov rcx, rax
lea rdx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov r11d, dword [rsp + 0xfc]
mov dword [rsp + 0xdc], r11d
mov eax, dword [rsp + 0x104]
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0xe0], eax
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0xe8], eax
mov dword [rsp + 0xc8], esi
call fcn.10005691c
mov rcx, rax
lea rdx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_SetWindowPlacement]
mov bl, r13b
jmp 0x10004642f
lea r9, [0x100199d44]
lea r8, [0x100199d40]
lea rdx, [0x100199d3c]
lea rcx, [0x100199d38]
call fcn.100057894
mov r11d, dword [0x100199d3c]
mov dword [rsp + 0x38], r11d
mov eax, dword [0x100199d38]
mov dword [rsp + 0x30], eax
mov eax, dword [0x100199d44]
mov dword [rsp + 0x28], eax
mov eax, dword [0x100199d40]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1001a09b0]
call fcn.10004f994
mov r15d, 0x28
neg bl
sbb ebx, ebx
and ebx, 0xfffffffe
call fcn.10005691c
mov rcx, rax
lea edx, [rbx + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.10005691c
mov rcx, rax
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rcx, [0x1000269d0]
call fcn.100170fe0
cmp al, sil
jne 0x100046501
mov rcx, qword [rsp + 0xf0]
call fcn.100043d08
cmp al, sil
jne 0x100046501
mov rcx, qword [rsp + 0x2970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10016ee3c
lea rcx, [rsp + 0x160]
call fcn.10016f9e8
nop
mov rcx, qword [rsp + 0x29c0]
cmp rcx, rsi
je 0x1000464b4
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x29a8]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x2990]
cmp rcx, rsi
je 0x1000464d5
call sub.msvcrt.dll_free
nop
lea r9, [fcn.10016e648]
mov r8d, 0x100
mov rdx, r15
lea rcx, [rsp + 0x160]
call fcn.10017a4cc
nop
mov qword [0x1001a72b0], rsi
mov edi, esi
jmp 0x1000465e4
call fcn.100056cbc
cmp al, sil
je 0x1000465f8
mov eax, 0xc
mov word [rsp + 0x88], ax
mov word [rsp + 0x8a], r13w
call fcn.10005691c
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x8c], esi
mov r8d, 0x10
mov edx, r13d
lea rcx, [rsp + 0x88]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
cmp eax, esi
jne 0x1000465f8
lea rcx, [0x1000269f0]
call fcn.10006021c
nop
mov rcx, qword [rsp + 0x2970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10016ee3c
lea rcx, [rsp + 0x160]
call fcn.10016f9e8
nop
mov rcx, qword [rsp + 0x29c0]
cmp rcx, rsi
je 0x100046599
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x29a8]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x2990]
cmp rcx, rsi
je 0x1000465ba
call sub.msvcrt.dll_free
nop
lea r9, [fcn.10016e648]
mov r8d, 0x100
mov rdx, r15
lea rcx, [rsp + 0x160]
call fcn.10017a4cc
nop
mov qword [0x1001a72b0], rsi
mov edi, 0x32
mov rcx, qword [rsp + 0x130]
call sub.msvcrt.dll_free
mov eax, edi
jmp 0x100046f78
mov rcx, qword [0x10019f520]
call fcn.100062958
mov r11, qword [0x10019f520]
mov rax, qword [r11 + 0x49da0]
neg rax
sbb cl, cl
and cl, byte [0x100199d14]
mov byte [0x100199d12], cl
mov dword [rsp + 0x60], esi
call fcn.100056cbc
mov dil, al
call fcn.10005691c
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8b, dil
mov rdx, rbx
call fcn.100171104
call fcn.100056cbc
cmp al, sil
je 0x100046663
lea rcx, [0x100026a48]
call fcn.100171274
call fcn.100050070
call fcn.10005691c
mov rcx, rax
mov edx, r13d
call fcn.1000574c8
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.100057428
call fcn.100056cbc
cmp al, sil
je 0x1000466bb
mov qword [rsp + 0x28], rsi
lea rax, [0x100047070]
mov qword [rsp + 0x20], rax
lea r9, [0x100047010]
xor r8d, r8d
xor edx, edx
mov edi, dword [rsp + 0x60]
mov ecx, edi
call fcn.100050270
mov ebx, eax
jmp 0x1000466ed
mov qword [rsp + 0x28], rsi
lea rax, [0x100047070]
mov qword [rsp + 0x20], rax
lea r9, [0x100047010]
mov r8d, dword [0x100199d44]
mov edx, dword [0x100199d40]
mov edi, dword [rsp + 0x60]
mov ecx, edi
call fcn.100050270
mov ebx, eax
cmp ebx, esi
je 0x10004683e
cmp dword [0x100199d20], r13d
jl 0x100046711
mov dword [0x100199d20], r13d
mov rcx, qword [0x10019f520]
call fcn.100064ad8
call fcn.100056cbc
cmp al, sil
jne 0x1000467d9
cmp ebx, 0x8876017c
jne 0x1000467ab
call fcn.100056b20
cmp al, sil
je 0x10004675e
call fcn.100056a30
mov byte [rsp + 0x30], r13b
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov r9d, 0xfffe
mov r8d, r13d
mov edx, 0xfb
xor ecx, ecx
call fcn.10017156c
call fcn.10005691c
mov rcx, rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x28], 0x1e0
mov dword [rsp + 0x20], 0x280
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
call fcn.10005691c
mov rcx, rax
mov edx, r13d
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.10005691c
mov rcx, rax
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x28], rsi
lea rax, [0x100047070]
mov qword [rsp + 0x20], rax
lea r9, [0x100047010]
mov edx, 0x280
mov r8d, 0x1e0
mov ecx, edi
call fcn.100050270
mov ebx, eax
jmp 0x1000467ff
mov qword [rsp + 0x28], rsi
lea rax, [0x100047070]
mov qword [rsp + 0x20], rax
lea r9, [0x100047010]
xor r8d, r8d
xor edx, edx
mov ecx, edi
call fcn.100050270
mov ebx, eax
cmp ebx, 0x8876017c
jne 0x10004683e
call fcn.100056b20
cmp al, sil
je 0x100046c5a
call fcn.100056a30
mov byte [rsp + 0x30], r13b
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov r9d, 0xfffe
mov r8d, r13d
mov edx, 0xa8
xor ecx, ecx
call fcn.10017156c
cmp ebx, esi
jl 0x100046c5a
mov dil, sil
lea rcx, [rsp + 0x70]
call fcn.100056d0c
nop
cmp qword [rsp + 0x70], rsi
jbe 0x100046914
lea rcx, [0x100026a58]
call fcn.100170fe0
cmp al, sil
jne 0x100046914
xor r8d, r8d
lea rdx, [rsp + 0x88]
mov rcx, qword [0x10019f520]
call fcn.1000647c0
nop
mov edx, 0x5c
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rsi
jne 0x1000468d6
cmp qword [rsp + 0x88], rsi
jbe 0x1000468c2
lea rdx, [0x100026a6c]
lea rcx, [rsp + 0x88]
call fcn.10016e788
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x88]
call fcn.10016e7cc
jmp 0x1000468e8
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x88]
call fcn.10016e6f0
lea rdx, [rsp + 0x88]
mov rcx, qword [0x10019f520]
call fcn.100064008
movzx edi, dil
cmp al, sil
cmovne edi, r13d
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_free
mov ecx, 0x90
call fcn.100179d98
mov qword [rsp + 0x88], rax
cmp rax, rsi
je 0x10004694f
call fcn.100056cbc
mov bl, al
call fcn.10005691c
mov rdx, rax
xor r9d, r9d
mov r8b, bl
mov rcx, qword [rsp + 0x88]
call fcn.1001770e8
jmp 0x100046952
mov rax, rsi
mov qword [0x10019f570], rax
mov rcx, rax
call fcn.1001772dc
cmp dil, sil
jne 0x100046a14
mov rcx, qword [0x10019f520]
cmp rcx, rsi
je 0x100046a14
xor r8d, r8d
lea rdx, [rsp + 0x88]
call fcn.100064a14
nop
cmp qword [rsp + 0x88], rsi
jbe 0x100046a07
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, r13d
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x100046a07
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_free
lea rcx, [0x100026a58]
call fcn.100170fe0
cmp al, sil
jne 0x100046a14
lea rcx, [rsp + 0xf8]
call fcn.100056d0c
bts r12d, 0x12
cmp qword [rax], rsi
jne 0x100046a14
mov bl, r13b
jmp 0x100046a17
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_free
mov bl, sil
bt r12d, 0x12
jae 0x100046a2b
mov rcx, qword [rsp + 0x108]
call sub.msvcrt.dll_free
cmp bl, sil
je 0x100046b10
mov byte [rsp + 0x64], sil
cmp byte [0x100199d16], sil
jne 0x100046a56
lea rcx, [rsp + 0x64]
call fcn.1000444a8
cmp al, sil
jne 0x100046a56
mov bl, sil
jmp 0x100046a59
mov bl, r13b
cmp byte [rsp + 0x64], sil
je 0x100046a73
mov byte [0x100199d16], r13b
mov rcx, qword [0x10019f520]
call fcn.100064ad8
cmp bl, sil
je 0x100046ac8
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov rcx, qword [0x10019f520]
call fcn.100064a14
nop
cmp qword [rsp + 0xa0], rsi
jbe 0x100046ab9
lea rdx, [rsp + 0xa0]
mov rcx, qword [0x10019f520]
call fcn.100064008
movzx edi, dil
cmp al, sil
cmovne edi, r13d
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_free
jmp 0x100046b10
mov rcx, qword [0x10019f520]
call fcn.1000635a0
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, qword [0x10019f520]
call fcn.100064a14
cmp qword [rsp + 0xc0], rsi
jbe 0x100046b03
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0xd0]
call sub.msvcrt.dll_free
cmp dil, sil
jne 0x100046b49
cmp byte [0x100199d10], sil
je 0x100046b35
mov r9b, r13b
xor r8d, r8d
mov dl, r13b
mov rcx, qword [0x10019f520]
call fcn.100062d74
jmp 0x100046b49
mov r9b, r13b
mov r8b, r13b
xor edx, edx
mov rcx, qword [0x10019f520]
call fcn.100062d74
call fcn.100041a64
call fcn.100041ae4
call fcn.100041b60
mov edx, 0xbd
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadMenuW]
mov qword [0x10019f548], rax
call fcn.100056cbc
cmp al, sil
je 0x100046b8d
xor edx, edx
mov rcx, qword [0x10019f548]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.100044c14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0xad
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov r12, rax
cmp rax, rsi
jne 0x100046bb7
lea rcx, [0x100026a70]
call fcn.10006021c
mov edi, esi
lea rbx, [rsp + 0x178]
cmp qword [rbx], rsi
je 0x100046c05
mov rdx, qword [rbx]
lea rcx, [rsp + 0x160]
call fcn.10017017c
mov qword [rbx], rsi
mov dword [rbx + 8], esi
movsxd rax, edi
lea rcx, [rax + rax*4]
lea rcx, [rsp + rcx*8 + 0x160]
lea rdx, [0x100002660]
call fcn.10016e658
add edi, r13d
add rbx, r15
cmp edi, 0x100
jb 0x100046bc1
mov dword [rsp + 0x2960], esi
mov dword [rsp + 0x2964], esi
mov byte [rsp + 0x2968], sil
mov rcx, r12
call fcn.10005362c
call fcn.100056cbc
cmp al, sil
je 0x100046c43
mov rax, qword [rsp + 0xb8]
cmp rax, rsi
je 0x100046c43
mov rcx, rax
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, r13d
call qword [sym.imp.USER32.dll_ShowCursor]
nop
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
mov rcx, qword [0x10019f538]
cmp rcx, rsi
je 0x100046c73
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x10019f538], rsi
call fcn.1001713d8
mov rcx, qword [0x10019f570]
cmp rcx, rsi
je 0x100046c9d
call fcn.100177328
mov rcx, qword [0x10019f570]
cmp rcx, rsi
je 0x100046c9d
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov qword [0x10019f570], rsi
mov rbx, qword [0x10019f520]
cmp rbx, rsi
je 0x100046cc0
mov rcx, rbx
call fcn.10006275c
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10019f520], rsi
mov rcx, qword [0x10019f550]
cmp rcx, rsi
je 0x100046d51
call fcn.10004126c
mov rbx, qword [0x10019f550]
lea rcx, [rbx + 0x18]
call fcn.100071f6c
lea rcx, [rbx + 0x388]
call fcn.100071f6c
mov rbx, qword [0x10019f550]
mov qword [rsp + 0x88], rbx
cmp rbx, rsi
je 0x100046d4a
mov rcx, qword [rbx + 0x720]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rbx + 0x708]
call sub.msvcrt.dll_free
nop
lea rcx, [rbx + 0x388]
call fcn.100071a94
nop
lea rcx, [rbx + 0x18]
call fcn.100071a94
nop
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10019f550], rsi
mov rcx, qword [0x10019f558]
cmp rcx, rsi
je 0x100046ddb
call fcn.10004126c
mov rbx, qword [0x10019f558]
lea rcx, [rbx + 0x18]
call fcn.100071f6c
lea rcx, [rbx + 0x388]
call fcn.100071f6c
mov rbx, qword [0x10019f558]
mov qword [rsp + 0x88], rbx
cmp rbx, rsi
je 0x100046dd4
mov rcx, qword [rbx + 0x720]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rbx + 0x708]
call sub.msvcrt.dll_free
nop
lea rcx, [rbx + 0x388]
call fcn.100071a94
nop
lea rcx, [rbx + 0x18]
call fcn.100071a94
nop
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10019f558], rsi
mov rcx, qword [0x10019f560]
cmp rcx, rsi
je 0x100046e65
call fcn.10004126c
mov rbx, qword [0x10019f560]
lea rcx, [rbx + 0x18]
call fcn.100071f6c
lea rcx, [rbx + 0x388]
call fcn.100071f6c
mov rbx, qword [0x10019f560]
mov qword [rsp + 0x88], rbx
cmp rbx, rsi
je 0x100046e5e
mov rcx, qword [rbx + 0x720]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rbx + 0x708]
call sub.msvcrt.dll_free
nop
lea rcx, [rbx + 0x388]
call fcn.100071a94
nop
lea rcx, [rbx + 0x18]
call fcn.100071a94
nop
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10019f560], rsi
mov rbx, qword [0x10019f588]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call fcn.100177328
mov rcx, qword [0x10019f588]
cmp rcx, rsi
je 0x100046e92
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov qword [0x10019f588], rsi
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0xf0]
call sub.gdiplus.dll_GdiplusShutdown
call fcn.100056cbc
mov cl, al
call fcn.100170acc
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, sil
je 0x100046eda
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov ebx, dword [rbx + 0x228]
cmp cl, sil
je 0x100046eef
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rcx, qword [rsp + 0x2970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10016ee3c
lea rcx, [rsp + 0x160]
call fcn.10016f9e8
nop
mov rcx, qword [rsp + 0x29c0]
cmp rcx, rsi
je 0x100046f23
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x29a8]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x2990]
cmp rcx, rsi
je 0x100046f44
call sub.msvcrt.dll_free
nop
lea r9, [fcn.10016e648]
mov r8d, 0x100
mov rdx, r15
lea rcx, [rsp + 0x160]
call fcn.10017a4cc
nop
mov qword [0x1001a72b0], rsi
mov rcx, qword [rsp + 0x130]
call sub.msvcrt.dll_free
mov eax, ebx
mov rcx, qword [rsp + 0x2df8]
xor rcx, rsp
call fcn.10017a260
lea r11, [rsp + 0x2e60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
ret