Function at 0x1400d6c5c
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Get common file path
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x420
mov rsi, rcx
lea rcx, [rax + 0x10]
xor edi, edi
mov r12, r9
mov r15, r8
mov qword [rax + 0x10], rdx
mov dword [rsp + 0x7c], edi
call fcn.140059340
lea ebp, [rdi + 2]
lea rdx, [rsp + 0x468]
lea rcx, [0x14012257c]
mov r8d, ebp
call fcn.14006439c
mov rcx, qword [rsp + 0x468]
lea r13, [rsp + 0x84]
mov byte [rsp + 0x78], al
lea rax, [rsp + 0x84]
mov word [rsp + 0x84], di
mov rbx, rcx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x40], rax
jmp 0x1400d6cef
mov eax, 0x3d
cmp ax, dx
je 0x1400d6cf9
add rcx, rbp
movzx edx, word [rcx]
cmp dx, di
jne 0x1400d6ce2
jmp 0x1400d6d05
lea r13, [rcx + 2]
mov word [rcx], di
mov qword [rsp + 0x50], r13
mov rcx, rbx
mov r14, rsi
mov qword [rsp + 0x58], rsi
mov bpl, dil
call fcn.14001885c
mov ecx, 0x3a
lea eax, [rcx - 0x39]
lea edx, [rcx - 0x36]
lea r8, [0x1401340d0]
cmp cx, word [rbx]
jne 0x1400d6d4a
cmp cx, word [rbx + 2]
jne 0x1400d6d4a
mov r12, qword [0x140134110]
mov bpl, al
add rbx, rdx
mov r14, r8
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x98], rdi
cmp byte [rsi + 0xda], dil
jne 0x1400d6d7d
test byte [rsi + 0xd], 0xf
jne 0x1400d6d7d
lea r8, [rsp + 0x98]
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.140078c2c
jmp 0x1400d6d97
lea r8, [rsp + 0x98]
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.1400770b4
mov rbx, qword [rsp + 0x98]
lea rcx, [rsp + 0x88]
call fcn.140061940
mov eax, 1
lea r8, [rsp + 0x88]
xor r9d, r9d
mov rdx, r13
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.140078dc8
mov r11, qword [rsp + 0x88]
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x40], r11
cmp word [rbx], ax
jne 0x1400d71c3
lea rdx, [0x140122560]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x1400d70f4
mov r11, qword [rsp + 0x40]
lea rcx, [0x140122550]
mov r8d, 9
mov rdx, r11
mov dword [rsp + 0x460], 0xfff80000
mov qword [rsp + 0x468], r11
call fcn.14005a9ec
mov ebp, 0x20
cmp al, dil
je 0x1400d6ee3
movzx eax, word [r11 + 0x12]
or ax, bp
sub ax, 0x61
cmp ax, 0x19
jbe 0x1400d6ee3
lea rcx, [rsp + 0x478]
call fcn.140061940
lea rcx, [rsp + 0x140]
lea rdx, [0x1401224c0]
lea r8d, [rbp + 0x6e]
call fcn.1400fafa0
lea r14d, [rbp - 0x1f]
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x140]
xor r9d, r9d
mov rcx, rsi
mov byte [rsp + 0x20], r14b
call fcn.1400770b4
mov rdx, qword [rsp + 0x478]
mov r8d, r14d
mov rcx, rsi
call fcn.14003aea0
mov r11, qword [rsp + 0x468]
lea r13d, [rbp - 0x1e]
add r11, 0x12
mov qword [rsp + 0x468], r11
cmp word [r11], di
je 0x1400d6ed4
add r11, r13
mov qword [rsp + 0x468], r11
lea rcx, [rsp + 0x478]
call fcn.140059370
jmp 0x1400d6eed
mov r14d, 1
lea r13d, [r14 + 1]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x468]
call fcn.140071a90
mov ebx, dword [rsp + 0x460]
mov r15d, 0x1a
lea r12d, [r15 + 0x26]
test r12b, bl
je 0x1400d6f2c
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov ecx, 0xffff
call qword [sym.imp.USER32.DLL_SendMessageW]
test bpl, bl
je 0x1400d6f45
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov ecx, 0xffff
call qword [sym.imp.USER32.DLL_SendMessageW]
mov ebp, 0x10
test bpl, bl
je 0x1400d706b
lea rcx, [rsp + 0x478]
call fcn.140061940
mov rax, qword [rsp + 0x468]
lea r8d, [rbp + 0x2a]
mov r12d, 0x2000
cmp r8w, word [rax]
jne 0x1400d6fa1
add rax, r13
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x468]
mov qword [rsp + 0x468], rax
call fcn.140007b0c
mov ebx, dword [rsp + 0x460]
jmp 0x1400d6fde
mov edx, 2
cmp word [rax], di
je 0x1400d6fb6
add rax, rdx
mov qword [rsp + 0x468], rax
mov ecx, 0x2d
cmp cx, word [rax]
jne 0x1400d6fc6
lea r12d, [rcx - 0x29]
jmp 0x1400d6fd3
mov ecx, 0x2b
cmp cx, word [rax]
jne 0x1400d6fde
mov r12d, edx
add rax, rdx
mov qword [rsp + 0x468], rax
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x468]
mov r9d, 0x2c
mov rcx, rsi
mov word [rsp + 0x20], di
call fcn.140052944
mov r8, qword [rsp + 0x478]
mov qword [rsp + 0x468], r8
cmp word [r8], di
jne 0x1400d704d
lea rax, [rsp + 0x210]
lea rdx, [rsp + 0x210]
mov r9d, r14d
mov r8d, ebp
xor ecx, ecx
mov word [rsp + 0x210], di
mov qword [rsp + 0x468], rax
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathW]
mov r8, qword [rsp + 0x468]
xor r9d, r9d
mov edx, 0x1005
mov ecx, r12d
call qword [sym.imp.SHELL32.DLL_SHChangeNotify]
lea rcx, [rsp + 0x478]
call fcn.140059370
test bl, 8
je 0x1400d7086
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1000
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.DLL_SHChangeNotify]
test bl, 4
je 0x1400d7090
call fcn.140004930
mov eax, 2
test al, bl
je 0x1400d70bc
lea r8, [0x1401343e0]
lea rdx, [0x14011a7f8]
lea rcx, [0x1401224a0]
xor r9d, r9d
call fcn.14005aa8c
call qword [0x1401343e0]
cmp ebx, edi
jl 0x1400d70d3
test r14b, bl
jne 0x1400d70ce
mov ecx, 0x7e
test cl, bl
jne 0x1400d70d3
call fcn.1400dcbd4
lea rcx, [rsp + 0x88]
call fcn.140059370
lea rcx, [rsp + 0x98]
call fcn.140059370
xor eax, eax
jmp 0x1400d8072
lea rdx, [0x140122480]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x1400d71be
mov r9, qword [rsp + 0x40]
lea rcx, [0x140119ef0]
mov rdx, r9
call fcn.14005aa28
cmp al, dil
jne 0x1400d716e
lea rcx, [0x14011f5b0]
mov rdx, r9
call fcn.14005aa28
cmp al, dil
jne 0x1400d7156
lea rcx, [0x1401187e4]
mov rdx, r9
call fcn.14005aa28
cmp al, dil
je 0x1400d70d3
cmp byte [0x140133d02], dil
je 0x1400d716e
lea rcx, [0x140134c80]
mov byte [0x140133d02], dil
call fcn.140059aa4
jmp 0x1400d70d3
cmp byte [0x14013e000], dil
je 0x1400d718b
mov rcx, qword [0x140133f40]
mov eax, 1
mov byte [0x140133d02], al
jmp 0x1400d71b4
mov rcx, qword [0x140134110]
cmp rcx, rdi
je 0x1400d70d3
cmp qword [rcx + 0x20], rdi
je 0x1400d70d3
mov eax, 1
mov byte [0x140133d02], al
mov rcx, qword [rcx + 0x20]
call fcn.14001a540
jmp 0x1400d70d3
mov eax, pe_nt_image_headers64
cmp word [rbx], di
jne 0x1400d71de
neg bpl
mov rcx, r14
sbb rdx, rdx
and rdx, rsi
call fcn.14001adf8
jmp 0x1400d70d3
cmp ax, word [rbx]
je 0x1400d71fe
neg bpl
mov rcx, r14
sbb rdx, rdx
and rdx, rsi
call fcn.14001adf8
cmp qword [r14 + 0x40], rdi
je 0x1400d70d3
cmp r12, rdi
je 0x1400d720d
mov rdx, qword [r12 + 0x110]
jmp 0x1400d7214
lea rdx, [0x1401145d8]
lea rcx, [rsp + 0xd0]
call fcn.14006d8b0
movzx ecx, word [rbx]
mov rdx, rbx
mov rax, rbx
cmp cx, di
je 0x1400d724e
mov r13d, 2
lea r8d, [r13 + 0x38]
cmp r8w, cx
jne 0x1400d7243
lea rdx, [rax + 2]
add rax, r13
mov cx, word [rax]
cmp cx, di
jne 0x1400d7239
lea rcx, [rsp + 0xa8]
call fcn.14006d8b0
movzx ecx, word [rbx]
mov r9d, 0x2e
mov r11, rdi
mov rax, rbx
mov qword [rsp + 0x468], rbx
lea r10d, [r9 - 0x2c]
cmp cx, di
je 0x1400d729d
cmp r9w, cx
cmove r11, rax
add rax, r10
mov cx, word [rax]
cmp cx, di
jne 0x1400d727b
cmp r11, rdi
cmovne rax, r11
mov qword [rsp + 0x468], rax
mov r12, rdi
cmp r9w, word [rax]
jne 0x1400d72b7
mov word [rax], di
add rax, r10
mov qword [rsp + 0x468], rax
mov r12, rax
lea rcx, [rsp + 0x468]
call fcn.140059340
mov edx, 9
lea ebp, [rdx + 0x17]
lea r8d, [rdx + 4]
cmp r12, rdi
je 0x1400d7300
mov rcx, qword [rsp + 0x468]
mov r12, rcx
jmp 0x1400d72f5
cmp dx, ax
ja 0x1400d72ed
cmp ax, r8w
jbe 0x1400d72fd
cmp bp, ax
je 0x1400d72fd
add rcx, r10
movzx eax, word [rcx]
cmp ax, di
jne 0x1400d72e2
mov word [rcx], di
mov r11d, 0x2a
mov byte [rsp + 0x478], dil
mov r8b, dil
lea r13d, [r11 - 0x20]
mov qword [rsp + 0xb8], r13
cmp r15, rdi
je 0x1400d73ad
mov rax, r15
cmp word [r15], di
je 0x1400d73ad
lea ecx, [r11 + 0x54]
lea r14d, [r11 - 0x1d]
jmp 0x1400d733f
mov r9d, 0x2e
cmp dx, word [rax]
ja 0x1400d734a
cmp word [rax], r14w
jbe 0x1400d73a8
cmp bp, word [rax]
je 0x1400d73a8
cmp r9w, word [rax]
je 0x1400d7582
mov r9d, 0x24
cmp r9w, word [rax]
je 0x1400d7582
mov r9d, 0x25
cmp r9w, word [rax]
je 0x1400d7582
cmp r11w, word [rax]
jne 0x1400d7385
or r8b, 4
jmp 0x1400d73a0
cmp cx, word [rax]
jne 0x1400d739b
cmp cx, word [rax + 2]
jne 0x1400d7539
or r8b, r10b
add rax, 2
mov edx, 9
add rax, r10
cmp word [rax], di
jne 0x1400d7339
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x468], rdi
cmp r8b, dil
je 0x1400d73cf
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.1400803c4
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xc8]
call fcn.140061940
mov al, byte [rsp + 0x478]
cmp al, dil
je 0x1400d740e
mov ecx, 0x2e
cmp al, cl
je 0x1400d740e
lea r9, [rsp + 0x468]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x40]
mov r8, r15
call fcn.14007f784
lea rcx, [rsp + 0xc0]
mov rdx, rbx
mov qword [rsp + 0xa0], rdi
call fcn.14006d8b0
mov r15, qword [rsp + 0xc0]
cmp r12, rdi
lea rbp, [0x1401145d8]
cmovne rbp, r12
mov r12d, pe_nt_image_headers64
mov qword [rsp + 0x130], rbp
cmp word [rbx], r12w
je 0x1400d852b
lea rax, [0x140135110]
mov r13, rdi
mov qword [rsp + 0xb0], rdi
mov rcx, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea r11d, [r12 - 0x3f]
mov r12b, dil
mov r13b, r11b
mov r10b, dil
mov esi, dword [rsp + 0x7c]
mov ebp, 2
lea rcx, [rsp + 0x70]
movzx r10d, r10b
cmp r12b, dil
mov edx, 0x3a
mov r9, r15
mov qword [rsp + 0x60], r15
cmovne r10d, r11d
mov qword [rsp + 0x70], r15
call fcn.14000a884
mov rax, qword [rsp + 0x70]
mov r12b, dil
cmp dx, word [rax]
jne 0x1400d74db
mov word [rax], di
mov r15, qword [rsp + 0x70]
movzx r12d, dil
add r15, rbp
mov qword [rsp + 0x70], r15
cmp word [r15], di
cmovne r12d, r11d
cmp r13b, dil
je 0x1400d7507
lea rcx, [0x140119514]
mov rdx, r9
call fcn.14005aa28
cmp al, dil
je 0x1400d7504
mov r9, qword [rsp + 0xd0]
mov r10b, r11b
mov qword [rsp + 0x60], r9
mov r13b, dil
mov rbx, qword [r14 + 0x40]
lea rcx, [0x140115ccc]
mov rdx, r9
call fcn.14005aa28
cmp al, dil
je 0x1400d75eb
mov r14, qword [r14 + 0x38]
mov rbx, qword [r14 + 0x40]
cmp rbx, rdi
je 0x1400d7592
lea rax, [rbx + 0x110]
jmp 0x1400d75b7
cmp cx, word [rax]
jne 0x1400d739b
mov r9d, 0x2e
cmp r9w, word [rax + 2]
jne 0x1400d7558
or r8b, 8
jmp 0x1400d7397
cmp cx, word [rax]
jne 0x1400d739b
cmp r11w, word [rax + 2]
jne 0x1400d7570
or r8b, r13b
jmp 0x1400d7397
cmp cx, word [rax]
jne 0x1400d739b
or r8b, 1
jmp 0x1400d739b
mov r9b, byte [rax]
mov byte [rsp + 0x478], r9b
jmp 0x1400d73a0
lea rdx, [0x1401145d8]
lea rcx, [rsp + 0xb8]
or esi, r11d
call fcn.14006d8b0
lea rax, [rsp + 0xb8]
mov r11d, 1
mov r9, qword [rax]
mov qword [rsp + 0x60], r9
test r11b, sil
je 0x1400d75df
lea rcx, [rsp + 0xb8]
and esi, 0xfffffffe
call fcn.140059370
mov r9, qword [rsp + 0x60]
mov r11d, 1
mov r10b, r11b
cmp r12b, dil
jne 0x1400d748b
mov rbp, qword [rsp + 0x130]
mov dword [rsp + 0x7c], esi
mov dword [rsp + 0x90], r10d
mov dword [rsp + 0x7c], esi
mov rsi, qword [rsp + 0x460]
mov dword [rsp + 0x90], r10d
mov byte [rsp + 0x468], r13b
mov r13, qword [rsp + 0xb0]
mov dword [rsp + 0x80], r12d
mov dword [rsp + 0x90], r10d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x80], r12d
cmp rbx, rdi
je 0x1400d7799
cmp rbx, r13
je 0x1400d7799
mov r15d, 0x23
cmp r12b, dil
jne 0x1400d767e
mov rcx, qword [rbx + 0x110]
mov rdx, r9
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
je 0x1400d781e
lea r11d, [r15 - 0x22]
cmp dword [rbx + 0x120], edi
mov r14d, edi
jle 0x1400d76db
mov r13, rdi
mov rax, qword [rbx + 0x118]
mov r12, qword [rax + r13 + 8]
cmp r12, rdi
je 0x1400d76c3
mov rcx, qword [r12 + 0x110]
cmp rcx, rdi
je 0x1400d76c3
mov rdx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
je 0x1400d781b
mov r11d, 1
add r14d, r11d
add r13, 0x18
cmp r14d, dword [rbx + 0x120]
jl 0x1400d768c
mov r12d, dword [rsp + 0x80]
mov rax, qword [rbx + 0x188]
mov r14d, edi
cmp dword [rax], edi
jle 0x1400d7760
mov r13, rdi
mov rax, qword [rbx + 0x180]
mov rcx, qword [rax]
mov r12, qword [r13 + rcx]
cmp r12, rdi
je 0x1400d7745
mov rcx, qword [r12 + 0x10]
cmp rcx, rdi
je 0x1400d7745
mov rdx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
cmp eax, edi
jne 0x1400d773f
cmp byte [rsp + 0x80], dil
je 0x1400d7a23
cmp dword [r12 + 8], 0xf
je 0x1400d77e7
cmp dword [r12 + 8], 0x16
je 0x1400d77e7
mov r11d, 1
mov rax, qword [rbx + 0x188]
add r14d, r11d
add r13, 8
cmp r14d, dword [rax]
jl 0x1400d76ec
mov r12d, dword [rsp + 0x80]
cmp r12b, dil
jne 0x1400d800a
mov rdx, qword [rsp + 0x60]
lea rcx, [rbx + 0x290]
call fcn.1400de098
mov r14, rax
cmp rax, rdi
jne 0x1400d828c
mov r14, qword [rsp + 0x58]
mov r10d, dword [rsp + 0x90]
mov r11d, 1
cmp r10b, dil
jne 0x1400d800a
cmp byte [rsp + 0x78], dil
jne 0x1400d800a
mov r14, qword [r14 + 0x38]
mov r13, rbx
mov qword [rsp + 0xb0], rbx
cmp r14, rdi
je 0x1400d7b07
lea rax, [0x1401340d0]
cmp r14, rax
je 0x1400d7b07
mov r15, qword [rsp + 0x68]
mov r13b, byte [rsp + 0x468]
jmp 0x1400d7482
mov rax, qword [r12 + 0x38]
mov r10d, dword [rsp + 0x90]
mov r15, qword [rsp + 0x68]
mov r14, qword [rax + 0x270]
mov r12d, dword [rsp + 0x80]
mov r13b, byte [rsp + 0x468]
mov r11d, 1
jmp 0x1400d7482
mov rbx, r12
lea rcx, [0x140122470]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d7a1c
lea rcx, [0x140122468]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d7887
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x20], dil
mov rcx, qword [rbx + 0x1e0]
mov r8, rbx
mov rdx, qword [rsp + 0x50]
mov r9, rsi
call fcn.1400e9bd4
movsxd rbx, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400d8021
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1400d8021
lea rcx, [0x140122460]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d78b0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov eax, 1
mov byte [rsp + 0x20], al
jmp 0x1400d7854
lea rcx, [0x140122458]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d7960
mov rax, qword [rbx + 0x1e0]
mov rcx, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0xf0], rax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0xe0], 3
mov qword [rsp + 0x108], rax
mov eax, 1
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xf8], r11
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rdi
cmp rcx, rdi
je 0x1400d793e
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea r9, [rsp + 0xe0]
mov rcx, qword [rbx + 0x20]
mov r8, rbx
mov edx, 0x465
call qword [sym.imp.USER32.DLL_SendMessageW]
mov rbx, rax
jmp 0x1400d786e
lea rcx, [0x140122454]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d7cae
lea rcx, [0x140122450]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d7998
mov rbx, qword [rbx + 0x20]
mov r14d, edi
jmp 0x1400d7b48
mov rcx, qword [rsp + 0x48]
mov r12, qword [rbx + 0x20]
cmp rcx, rdi
je 0x1400d79b1
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x110], rdi
mov rcx, r12
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xa8]
lea r9, [rsp + 0xe0]
mov edx, 0x459
mov r8, rbx
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0xe0], rsi
call qword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x1400d7b07
mov r11, qword [rsp + 0x40]
jmp 0x1400d7a55
lea rcx, [0x140122470]
mov rdx, rbp
mov qword [rsp + 0xa0], r12
call fcn.14005aa28
mov r11, qword [rsp + 0x40]
cmp al, dil
je 0x1400d7b20
cmp word [r11], r15w
je 0x1400d7b20
mov rbx, r12
cmp word [r11], r15w
sete sil
cmp sil, dil
je 0x1400d7a6b
add r11, 2
mov qword [rsp + 0x40], r11
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140071a90
cmp sil, dil
je 0x1400d7aea
cmp dword [rsp + 0x460], edi
jle 0x1400d7aa5
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x1e0]
call fcn.14005cf6c
jmp 0x1400d7b07
jne 0x1400d7b07
lea rcx, [0x140135110]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rcx, qword [0x1401346d0]
cmp rcx, rdi
je 0x1400d7adb
call qword [sym.imp.USER32.DLL_UnhookWindowsHookEx]
mov qword [0x1401346d0], rdi
mov qword [0x1401346d8], rdi
mov qword [0x1401346e0], rdi
lea rcx, [0x140135110]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1400d7b07
cmp dword [rsp + 0x460], edi
jle 0x1400d7aff
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.DLL_SetCapture]
jmp 0x1400d7b07
jne 0x1400d7b07
call qword [sym.imp.USER32.DLL_ReleaseCapture]
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400d892d
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1400d892d
lea rcx, [0x140122450]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d7c93
mov rax, qword [r12 + 0x38]
add r14d, 0x1000
mov rbx, qword [rax + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140059340
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x1400d7ccb
lea rcx, [rsp + 0x478]
call fcn.140061940
lea rcx, [rsp + 0x468]
call fcn.140061940
mov ebp, 2
lea rdx, [rsp + 0x478]
add qword [rsp + 0x40], rbp
lea r13d, [rbp + 0x2a]
lea r12d, [rbp + 0x39]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.1400658c4
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400d7bd4
add r11, rbp
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
mov qword [rsp + 0x40], r11
call fcn.1400658c4
mov r8, qword [rsp + 0x478]
lea r9, [0x1401146d0]
mov rdx, rbx
mov rcx, rsi
call fcn.140064b84
mov r8, qword [rsp + 0x468]
lea r9, [0x1401155b8]
mov edx, r14d
mov rcx, rsi
call fcn.140064bc8
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400d8511
cmp r14d, 0x1000
jl 0x1400d8511
mov rbx, qword [rsp + 0xa0]
cmp rbx, rdi
je 0x1400d8511
cmp bp, word [rbx + 8]
je 0x1400d7c49
mov eax, 0xd
cmp dword [rbx + 8], eax
jne 0x1400d8511
lea rcx, [rsp + 0x460]
call fcn.140061940
add qword [rsp + 0x40], rbp
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.1400658c4
mov r8, qword [rsp + 0x460]
mov rdx, qword [rbx + 0x70]
lea r9, [0x1401146d0]
mov rcx, rsi
call fcn.140064b84
jmp 0x1400d8504
lea rcx, [0x140122454]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d7f3c
mov rbx, r12
lea rcx, [rsp + 0x40]
call fcn.140059340
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
je 0x1400d7d54
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400d7cdb
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
or dword [rsp + 0x460], 0xffffffff
or dword [rsp + 0x468], 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.140059340
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
mov bl, dil
lea esi, [rcx - 0x28]
cmp word [rax], cx
jne 0x1400d7d14
mov bl, byte [rax]
add rax, rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140071a90
cmp eax, edi
jle 0x1400d892d
cmp bl, dil
je 0x1400d88bc
cmp dword [rsp + 0x460], edi
jl 0x1400d892d
mov ecx, edi
setne cl
call qword [sym.imp.USER32.DLL_ShowCursor]
jmp 0x1400d892d
lea rcx, [rsp + 0x468]
call qword [sym.imp.USER32.DLL_GetCursorPos]
mov r11, qword [rsp + 0x468]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x478]
mov qword [rsp + 0x478], r11
call qword [sym.imp.USER32.DLL_ScreenToClient]
lea rcx, [rsp + 0x50]
call fcn.140061940
lea rcx, [rsp + 0x60]
call fcn.140061940
lea rcx, [rsp + 0x58]
call fcn.140061940
lea rcx, [rsp + 0x68]
call fcn.140061940
lea rcx, [rsp + 0x460]
call fcn.140061940
mov r14d, 2
lea rdx, [rsp + 0x50]
add qword [rsp + 0x40], r14
lea r13d, [r14 + 0x2a]
lea r12d, [r14 + 0x39]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140052b8c
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140052b8c
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140052b8c
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140052b8c
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8d, r12d
call fcn.140052b8c
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x468]
mov rcx, rsi
call fcn.140064c5c
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x46c]
mov rcx, rsi
call fcn.140064c5c
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x478]
mov rcx, rsi
call fcn.140064c5c
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x47c]
mov rcx, rsi
call fcn.140064c5c
mov r11, qword [rsp + 0x460]
cmp word [r11], di
je 0x1400d7f02
lea ebp, [r14 - 1]
mov ecx, ebp
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov bx, ax
shr ebx, 0xf
and bx, bp
lea ebp, [r14 + 0xe]
mov ecx, ebp
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
lea ecx, [rbp + 1]
neg ax
sbb dx, dx
and dx, 4
or bx, dx
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, r14d
neg ax
sbb dx, dx
and dx, 8
or bx, dx
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov r8, qword [rsp + 0x460]
neg ax
sbb cx, cx
and cx, bp
or bx, cx
mov rcx, rsi
movzx edx, bx
call fcn.140064c5c
lea rcx, [rsp + 0x460]
call fcn.140059370
lea rcx, [rsp + 0x68]
call fcn.140059370
lea rcx, [rsp + 0x58]
call fcn.140059370
lea rcx, [rsp + 0x60]
call fcn.140059370
lea rcx, [rsp + 0x50]
call fcn.140059370
jmp 0x1400d7b07
mov eax, dword [r12 + 8]
mov r13d, 1
cmp eax, 3
je 0x1400d7f51
cmp eax, r13d
jne 0x1400d7f92
cmp word [rbp], di
jne 0x1400d7f92
mov r9b, byte [rsp + 0x478]
cmp r9b, dil
jne 0x1400d7f92
cmp eax, 3
jne 0x1400d7f72
bt dword [r12 + 0x70], 0x18
jb 0x1400d7f83
cmp eax, r13d
jne 0x1400d7f92
bt dword [r12 + 0x90], 0x18
jae 0x1400d7f92
xor edx, edx
mov rcx, r11
call fcn.14001d888
mov r11, qword [rsp + 0x40]
lea rcx, [0x140122468]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d7fbf
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x20], dil
mov r8, qword [r12 + 0x38]
lea rcx, [r12 + 0x58]
jmp 0x1400d785e
lea rcx, [0x140122460]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d7fe4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r13b
jmp 0x1400d7fb0
lea rcx, [0x140122458]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d8109
mov rcx, qword [r12 + 0x38]
cmp rcx, rdi
jne 0x1400d808d
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400d801a
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rbx, 0xffffffff80070057
lea rcx, [rsp + 0xc0]
call fcn.140059370
lea rcx, [rsp + 0xc8]
call fcn.140059370
lea rcx, [rsp + 0xa8]
call fcn.140059370
lea rcx, [rsp + 0xd0]
call fcn.140059370
lea rcx, [rsp + 0x88]
call fcn.140059370
lea rcx, [rsp + 0x98]
call fcn.140059370
mov rax, rbx
mov rbx, qword [rsp + 0x470]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r11, qword [rsp + 0x50]
lea rax, [r12 + 0x58]
mov qword [rsp + 0x140], 3
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x158], r11
mov rax, qword [rcx + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], rdi
cmp rcx, rdi
je 0x1400d80fc
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea r9, [rsp + 0x140]
jmp 0x1400d7946
lea rcx, [0x140121b18]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d8248
lea rcx, [0x140121b20]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d8248
lea rcx, [0x140121b28]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d8248
lea rcx, [0x140121b00]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d8248
lea rcx, [0x140121b0c]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d8248
lea rcx, [0x140121af8]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d8248
lea rcx, [0x140121b08]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d8248
lea rcx, [0x140115a20]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d823e
lea rcx, [0x140121af0]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
jne 0x1400d823e
mov eax, 9
mov rdx, rsi
mov rcx, r12
cmp dword [r12 + 8], eax
lea rax, [rsp + 0x48]
jne 0x1400d8219
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov r9, r11
mov qword [rsp + 0x20], rbp
call fcn.14009eee8
jmp 0x1400d786b
mov r10, qword [r12]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa8]
mov r9, rbp
mov r8, r11
mov qword [rsp + 0x20], rax
call qword [r10 + 8]
jmp 0x1400d786b
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov rbx, qword [r12 + 0x38]
mov rcx, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1400d800f
mov r13, qword [rbx + 0x20]
cmp rcx, rdi
je 0x1400d8274
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov r11, qword [rsp + 0x40]
mov qword [rsp + 0xe8], r11
mov qword [rsp + 0x110], r12
mov rcx, r13
jmp 0x1400d79c9
cmp word [rbp], di
jne 0x1400d82bf
mov rdx, qword [rsp + 0x40]
lea rcx, [rax + 8]
call fcn.14006d9c8
mov rdx, qword [r14 + 0x18]
cmp word [rdx], di
je 0x1400d7b07
mov r8, qword [rsp + 0x40]
mov rcx, rsi
call fcn.140060d64
jmp 0x1400d7b07
lea rcx, [0x140121794]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d83b5
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x460], edi
movzx ecx, word [rax]
mov eax, 9
sub cx, 0x30
cmp cx, ax
ja 0x1400d800a
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.DLL_GetMenu]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140071a90
cmp rbx, rdi
je 0x1400d8342
mov eax, dword [rsp + 0x460]
mov edx, dword [r14 + 0x28]
mov rcx, qword [r14 + 0x20]
neg eax
sbb r8d, r8d
not r8d
and r8d, 3
bts r8d, 0xa
call qword [sym.imp.USER32.DLL_EnableMenuItem]
cmp dword [rsp + 0x460], edi
je 0x1400d8351
and byte [r14], 0xfe
jmp 0x1400d8359
mov eax, 1
or byte [r14], al
lea rdx, [r14 + 0x18]
lea rcx, [rsp + 0x460]
call fcn.14006d910
lea rdx, [0x14011b3c8]
lea rcx, [rsp + 0x460]
call fcn.140061a7c
mov rdx, qword [rsp + 0x460]
mov eax, 1
test byte [r14], al
lea rax, [0x1401188a0]
lea r8, [0x1401194e8]
cmovne r8, rax
mov rcx, rsi
call fcn.140079dfc
lea rcx, [rsp + 0x460]
jmp 0x1400d7f32
lea rcx, [0x14012244c]
mov rdx, rbp
call fcn.14005aa28
cmp al, dil
je 0x1400d7b07
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x1400d83e5
add rax, 2
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x478]
call fcn.140061940
lea rcx, [rsp + 0x468]
call fcn.140061940
lea rcx, [rsp + 0x460]
call fcn.140061940
mov r13d, 0x2c
lea r8, [rsp + 0x478]
lea r12d, [r13 + 0xf]
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r9d, r12d
mov word [rsp + 0x20], r13w
call fcn.140052b08
lea r8, [rsp + 0x468]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
lea r8, [rsp + 0x460]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
mov r8, qword [r14 + 0x20]
lea rdx, [0x14011a600]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x478]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.140060d64
movzx r8d, word [r14 + 2]
lea rdx, [0x1401155b8]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x468]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.140060d64
mov r8d, dword [r14 + 0x28]
lea rdx, [0x1401155b8]
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x460]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.140060d64
lea rcx, [rsp + 0x460]
call fcn.140059370
lea rcx, [rsp + 0x468]
call fcn.140059370
lea rcx, [rsp + 0x478]
jmp 0x1400d7f32
lea rcx, [0x140122444]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d8906
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
cmp bp, word [rax]
jne 0x1400d7cdb
lea rcx, [rsp + 0x50]
call fcn.140061940
lea rcx, [rsp + 0x60]
call fcn.140061940
lea rcx, [rsp + 0x58]
call fcn.140061940
lea rcx, [rsp + 0x70]
call fcn.140061940
lea rcx, [rsp + 0x68]
call fcn.140061940
lea rcx, [rsp + 0x478]
call fcn.140061940
mov rax, qword [rsp + 0x40]
lea r14d, [rbp - 0x3d]
add rax, r14
mov rbx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x460], rbx
cmp r12w, word [rax]
jne 0x1400d85de
add rax, r14
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140007b30
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x460]
cmp word [rax], 0x30
mov r13d, 0x2c
lea r12d, [r13 + 0xf]
jb 0x1400d85f4
cmp word [rax], 0x39
jbe 0x1400d85fe
mov ecx, 0x28
cmp cx, word [rax]
jne 0x1400d864b
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x460], edi
call fcn.140007b0c
mov r11d, dword [rsp + 0x460]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x468], r11d
call fcn.140007b0c
mov r11d, dword [rsp + 0x460]
mov dword [rsp + 0x46c], r11d
jmp 0x1400d868f
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
lea rcx, [rsp + 0x468]
call qword [sym.imp.USER32.DLL_GetCursorPos]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
cmp rbx, rdi
je 0x1400d8714
lea rdx, [rsp + 0x468]
mov rcx, rbx
call qword [sym.imp.USER32.DLL_ScreenToClient]
mov rax, qword [rsp + 0x478]
mov ebx, edi
mov ebp, 0x10
cmp word [rax], di
je 0x1400d876c
mov rdx, qword [rsp + 0x68]
cmp word [rdx], di
je 0x1400d876c
or r9d, 0xffffffff
xor r8d, r8d
mov rcx, rsi
call fcn.14001e38c
cmp rax, rdi
je 0x1400d876c
mov rcx, qword [rax]
cmp rcx, rdi
je 0x1400d8754
mov rax, qword [rcx - 8]
jmp 0x1400d8757
mov rax, rdi
cmp rax, rbp
jb 0x1400d876c
mov rdx, qword [rsp + 0x468]
call qword [sym.imp.USER32.DLL_PtInRect]
mov ebx, eax
mov r8, qword [rsp + 0x478]
mov edx, ebx
mov rcx, rsi
call fcn.140064c5c
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x58]
mov r12d, 8
lea r8, [rsp + 0x468]
mov rcx, rsi
mov r9d, r12d
mov byte [rsp + 0x28], dil
mov qword [rsp + 0x20], rax
call fcn.1400721a8
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x468]
mov rcx, rsi
call fcn.140064c5c
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x46c]
mov rcx, rsi
call fcn.140064c5c
mov r11, qword [rsp + 0x70]
cmp word [r11], di
je 0x1400d8844
lea edi, [r12 - 7]
mov ecx, edi
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, ebp
mov bx, ax
shr ebx, 0xf
and bx, di
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
neg ax
sbb cx, cx
and cx, 4
or bx, cx
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
neg ax
sbb cx, cx
and cx, r12w
or bx, cx
mov ecx, r14d
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov r8, qword [rsp + 0x70]
neg ax
sbb cx, cx
and cx, bp
or bx, cx
mov rcx, rsi
movzx edx, bx
call fcn.140064c5c
lea rcx, [rsp + 0x478]
call fcn.140059370
lea rcx, [rsp + 0x68]
call fcn.140059370
lea rcx, [rsp + 0x70]
call fcn.140059370
lea rcx, [rsp + 0x58]
call fcn.140059370
lea rcx, [rsp + 0x60]
call fcn.140059370
lea rcx, [rsp + 0x50]
call fcn.140059370
lea rcx, [rsp + 0xc0]
call fcn.140059370
lea rcx, [rsp + 0xc8]
call fcn.140059370
lea rcx, [rsp + 0xa8]
call fcn.140059370
lea rcx, [rsp + 0xd0]
call fcn.140059370
jmp 0x1400d70d3
mov rax, qword [rsp + 0x40]
cmp word [rax], di
je 0x1400d892d
cmp word [rax], 0x30
jb 0x1400d88d2
cmp word [rax], 0x39
jbe 0x1400d892d
add rax, rsi
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140071a90
cmp eax, edi
jle 0x1400d892d
mov edx, dword [rsp + 0x468]
mov ecx, dword [rsp + 0x460]
call qword [sym.imp.USER32.DLL_SetCursorPos]
jmp 0x1400d892d
lea rcx, [0x140122438]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d8935
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.1400e1054
cmp eax, edi
setl dil
mov rbx, rdi
jmp 0x1400d8021
lea rcx, [0x140122428]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d8958
mov byte [rsp + 0x460], dil
mov ebp, 1
jmp 0x1400d897d
lea rcx, [0x140122418]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d8d2a
mov ebp, 1
mov byte [rsp + 0x460], bpl
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x478], edi
mov r14d, edi
mov dword [rsp + 0x468], edi
mov dword [rsp + 0x7c], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xa0], r13
call fcn.140061940
mov rax, qword [rsp + 0x40]
mov r12d, 0x3b
lea r9d, [r12 - 1]
lea ebx, [r12 - 0x39]
cmp r9w, word [rax]
jne 0x1400d8a5d
add rax, rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140059340
mov r8, qword [rsp + 0x40]
movzx eax, word [r8]
mov rdx, r8
cmp ax, di
je 0x1400d8a25
lea r13d, [r12 - 0xf]
cmp ax, r13w
je 0x1400d8a25
cmp ax, r12w
je 0x1400d8a25
cmp ax, r9w
je 0x1400d8a25
add r8, rbx
mov qword [rsp + 0x40], r8
mov ax, word [r8]
cmp ax, di
jne 0x1400d8a02
sub r8, rdx
lea rcx, [rsp + 0x50]
sar r8, 1
call fcn.140061ba8
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400d8a48
add r11, rbx
mov qword [rsp + 0x40], r11
lea rdx, [rsp + 0x50]
mov r8b, bpl
mov rcx, rsi
call fcn.14000395c
mov rax, qword [rsp + 0x40]
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x1400d8b99
add rax, rbx
lea ebp, [rcx + 0x15]
mov r15, rdi
mov qword [rsp + 0x40], rax
mov r13, rdi
cmp bp, word [rax]
jne 0x1400d8ad4
add rax, rbx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140071a90
mov rax, qword [rsp + 0x40]
cmp bp, word [rax]
jne 0x1400d8ad4
add rax, rbx
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140071a90
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xb8], rcx
mov ebp, 0x2a
cmp bp, word [rax]
jne 0x1400d8aeb
add rax, rbx
mov qword [rsp + 0x40], rax
mov r15, rax
jmp 0x1400d8aee
mov r13, rax
movzx ecx, word [rax]
cmp cx, di
je 0x1400d8b44
mov r8d, 0x3a
cmp bp, cx
jne 0x1400d8b16
cmp r13, rdi
jne 0x1400d8b16
mov word [rax], di
mov rax, qword [rsp + 0x40]
add rax, rbx
mov r13, rax
jmp 0x1400d8b25
cmp cx, r12w
je 0x1400d8b34
cmp cx, r8w
je 0x1400d8b34
add rax, rbx
mov qword [rsp + 0x40], rax
mov cx, word [rax]
cmp cx, di
je 0x1400d8b44
jmp 0x1400d8afc
mov word [rax], di
add qword [rsp + 0x40], rbx
mov dword [rsp + 0x7c], 1
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rdx, r13
mov rcx, r15
mov ebp, eax
call qword [sym.imp.USER32.DLL_FindWindowW]
mov rbx, rax
cmp eax, edi
jne 0x1400d8bc5
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0xb0]
jae 0x1400d8bb2
mov edx, dword [rsp + 0xb8]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.14001f844
mov rdx, r13
mov rcx, r15
call qword [sym.imp.USER32.DLL_FindWindowW]
mov ebx, eax
cmp eax, edi
je 0x1400d8b5f
jmp 0x1400d8bb2
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x40]
call fcn.140071a90
mov ebx, dword [rsp + 0x478]
cmp ebx, edi
jne 0x1400d8bc5
lea rcx, [rsp + 0x50]
call fcn.140059370
jmp 0x1400d801a
mov rdx, qword [rsp + 0x40]
cmp dword [rsp + 0x7c], edi
jne 0x1400d8bef
cmp word [rdx], r12w
je 0x1400d8be0
mov eax, 0x3a
cmp word [rdx], ax
jne 0x1400d8c54
mov eax, 2
add rdx, rax
mov qword [rsp + 0x40], rdx
jmp 0x1400d8bf4
mov eax, 2
mov ebp, edi
cmp word [rdx], r12w
je 0x1400d8d20
mov ecx, 0x3a
cmp word [rdx], cx
je 0x1400d8d20
cmp word [rdx], di
je 0x1400d8d20
lea r15d, [rcx - 0x17]
cmp r15w, word [rdx]
jne 0x1400d8c2e
add rdx, rax
mov ebp, 0x5000
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x40]
call fcn.140071a90
mov r14d, dword [rsp + 0x468]
mov rdx, qword [rsp + 0x40]
cmp eax, edi
jle 0x1400d8c54
add r14d, ebp
mov bpl, byte [rsp + 0x460]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x58]
mov rcx, rsi
mov byte [rsp + 0x20], bpl
call fcn.14007f3cc
cmp rax, rdi
jne 0x1400d8bb6
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x60], rdi
movsxd rcx, ebx
cmp bpl, dil
jne 0x1400d8caa
mov edx, r14d
call qword [sym.imp.USER32.DLL_PostMessageW]
cdqe
jmp 0x1400d8ce4
mov rax, qword [rsp + 0x68]
cmp rax, rdi
je 0x1400d8cdb
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov eax, 2
mov edx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.DLL_SendMessageTimeoutW]
mov rax, qword [rsp + 0x60]
jmp 0x1400d8ce9
mov edx, r14d
call qword [sym.imp.USER32.DLL_SendMessageW]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x50]
cmp word [rcx], di
je 0x1400d8d20
lea rdx, [0x14011aba8]
lea rcx, [rsp + 0x140]
mov r8, rax
call qword [sym.imp.USER32.DLL_wsprintfW]
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x140]
mov rcx, rsi
call fcn.140060d64
lea rcx, [rsp + 0x50]
jmp 0x1400d9132
lea rcx, [0x140122408]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d8d76
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x460], rdi
call fcn.140007b30
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x460]
lea rcx, [0x1401340d0]
call fcn.140055c40
jmp 0x1400d892d
lea rcx, [0x1401223fc]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d8e80
mov rax, qword [rsp + 0x40]
mov ebp, 0x3f
mov ebx, edi
cmp word [rax], bp
mov r12w, di
lea r13d, [rbp - 0x3d]
sete bl
cmp bx, di
je 0x1400d8db5
add rax, r13
mov qword [rsp + 0x40], rax
mov r14d, pe_nt_image_headers64
cmp r14w, word [rax]
jne 0x1400d8dcc
add rax, r13
mov r12d, r14d
mov qword [rsp + 0x40], rax
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140071a90
cmp dword [rsp + 0x460], edi
movsxd r10, dword [rsp + 0x460]
jle 0x1400d801a
mov rdx, qword [rsp + 0x40]
cmp word [rdx], di
je 0x1400d8e1f
cmp word [rdx], 0x30
jb 0x1400d8e11
cmp word [rdx], 0x39
jbe 0x1400d8e1f
cmp r14w, word [rdx]
je 0x1400d8e1f
add rdx, r13
mov qword [rsp + 0x40], rdx
cmp r12w, di
je 0x1400d8e3c
cmp r14w, word [rdx]
je 0x1400d8e3c
sub rdx, r13
mov qword [rsp + 0x40], rdx
mov word [rdx], r14w
mov rdx, qword [rsp + 0x40]
cmp bx, di
je 0x1400d8e51
sub rdx, r13
mov qword [rsp + 0x40], rdx
mov word [rdx], bp
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsi + 0x40]
cmp rax, rdi
je 0x1400d8e62
mov ecx, dword [rax + 0x288]
jmp 0x1400d8e64
mov ecx, edi
mov dword [rsp + 0x28], ecx
mov r9, rsi
mov r8, rsi
mov rcx, r10
mov qword [rsp + 0x20], rdi
call fcn.1400d5a78
jmp 0x1400d892d
lea rcx, [0x1401223f4]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d8f9a
lea rcx, [rsp + 0x70]
call fcn.140061940
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x460], edi
call fcn.140061940
mov r9d, 0x3a
lea rdx, [rsp + 0x68]
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x40]
call fcn.1400658c4
mov r11, qword [rsp + 0x40]
cmp word [r11], di
je 0x1400d8ee0
add r11, 2
mov qword [rsp + 0x40], r11
lea rcx, [rsp + 0x40]
call fcn.140059340
mov rcx, qword [rsp + 0x40]
call fcn.14001b86c
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x40], rax
call fcn.140061940
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x468]
lea rdx, [rsp + 0x478]
mov qword [rsp + 0x468], rdi
call fcn.1400dc914
mov r11, qword [rsp + 0x468]
cmp r11, rdi
je 0x1400d8f67
cmp word [r11], di
je 0x1400d8f67
mov word [r11 - 2], di
mov rdx, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x478]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x460]
mov qword [rsp + 0x20], rdi
call fcn.140009228
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
call fcn.140060d64
lea rcx, [rsp + 0x478]
call fcn.140059370
lea rcx, [rsp + 0x68]
call fcn.140059370
lea rcx, [rsp + 0x70]
jmp 0x1400d9132
lea rcx, [0x1401223e8]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d9057
lea rcx, [rsp + 0x40]
call fcn.140059340
mov ebp, 0x3f
mov rcx, qword [rax]
lea r14d, [rbp - 0x3d]
movzx ebx, word [rcx]
cmp bx, bp
jne 0x1400d8fd5
add qword [rsp + 0x40], r14
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140071a90
mov rax, qword [rsp + 0x40]
movsxd r13, dword [rsp + 0x460]
mov r12d, 0x3b
lea r15d, [r12 - 1]
cmp word [rax], r12w
je 0x1400d9013
cmp word [rax], r15w
jne 0x1400d901b
add rax, r14
mov qword [rsp + 0x40], rax
cmp bx, bp
jne 0x1400d801a
lea rcx, [rsp + 0x460]
call fcn.140061940
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r15d
mov r8d, r12d
call fcn.1400658c4
mov rcx, r13
call qword [sym.imp.USER32.DLL_IsWindow]
jmp 0x1400d9118
lea rcx, [0x1401223e0]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d9179
lea rcx, [rsp + 0x40]
call fcn.140059340
mov ebp, 0x3f
mov rcx, qword [rax]
lea r14d, [rbp - 0x3d]
movzx ebx, word [rcx]
cmp bx, bp
jne 0x1400d9092
add qword [rsp + 0x40], r14
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140071a90
mov rax, qword [rsp + 0x40]
movsxd r13, dword [rsp + 0x460]
mov r12d, 0x3b
lea r15d, [r12 - 1]
cmp word [rax], r12w
je 0x1400d90d0
cmp word [rax], r15w
jne 0x1400d90d8
add rax, r14
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x460], edi
jle 0x1400d801a
cmp bx, bp
jne 0x1400d913c
lea rcx, [rsp + 0x460]
call fcn.140061940
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r9d, r15d
mov r8d, r12d
call fcn.1400658c4
mov rcx, r13
call qword [sym.imp.USER32.DLL_IsWindowEnabled]
mov r8, qword [rsp + 0x460]
mov edx, eax
mov rcx, rsi
call fcn.140064c10
lea rcx, [rsp + 0x460]
call fcn.140059370
jmp 0x1400d892d
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x460], 0xfffffc18
call fcn.140071a90
cmp dword [rsp + 0x460], edi
jl 0x1400d892d
mov edx, edi
mov rcx, r13
setne dl
call qword [sym.imp.USER32.DLL_EnableWindow]
jmp 0x1400d892d
lea rcx, [rbx + 2]
call fcn.1400624c4
cmp al, dil
je 0x1400d9213
lea rcx, [rsp + 0x40]
call fcn.140059340
mov ebp, 0x3f
mov rcx, qword [rax]
movzx ebx, word [rcx]
cmp bx, bp
mov ebp, 2
jne 0x1400d91af
add qword [rsp + 0x40], rbp
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140071a90
mov r8, qword [rsp + 0x40]
movsxd rdx, dword [rsp + 0x460]
mov r12d, 0x3b
cmp word [r8], r12w
je 0x1400d91ed
lea eax, [r12 - 1]
cmp word [r8], ax
jne 0x1400d91f5
add r8, rbp
mov qword [rsp + 0x40], r8
cmp dword [rsp + 0x460], edi
jle 0x1400d801a
movzx r9d, bx
mov rcx, rsi
call fcn.14007ccb4
jmp 0x1400d892d
lea rcx, [0x1401223d4]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d9265
or dword [rsp + 0x460], 0xffffffff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.140007b0c
cmp dword [rsp + 0x460], edi
jle 0x1400d801a
movsxd rcx, dword [rsp + 0x460]
mov rdx, qword [rsp + 0x40]
call fcn.14007cee0
jmp 0x1400d892d
lea rcx, [0x1401223cc]
mov rdx, rbx
call fcn.14005aa28
movzx eax, al
mov dword [rsp + 0x460], eax
cmp eax, edi
jne 0x1400d929a
lea rcx, [0x1401223c0]
mov rdx, rbx
call fcn.14005aa28
cmp al, dil
je 0x1400d892d
mov rbp, qword [rsp + 0x40]
mov r11d, 7
lea rcx, [0x1401223b8]
mov r8d, r11d
mov rdx, rbp
mov r15, rdi
mov qword [rsp + 0x468], rdi
call fcn.14005a9ec
cmp al, dil
je 0x1400d92d1
add rbp, 0xe
lea r14d, [r11 - 0xb]
jmp 0x1400d933b
lea rcx, [0x1401223b0]
mov r8d, r11d
mov rdx, rbp
call fcn.14005a9ec
cmp al, dil
je 0x1400d92f4
add rbp, 0xe
mov r14d, 0xffffffc0
jmp 0x1400d933b
lea rcx, [0x1401223a0]
mov r8d, 0xb
mov rdx, rbp
call fcn.14005a9ec
cmp al, dil
je 0x1400d9314
add rbp, 0x16
jmp 0x1400d9335
lea rcx, [0x140122398]
mov r8d, 5
mov rdx, rbp
call fcn.14005a9ec
cmp al, dil
je 0x1400d801a
add rbp, r13
mov r14d, 0xffffffe0
mov r13d, 0x2c
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbp
lea r12d, [r13 + 0xf]
mov r8d, r13d
mov edx, r12d
call fcn.1400595d8
mov rcx, qword [rsp + 0x40]
lea eax, [r13 - 0x2a]
cmp word [rcx], di
je 0x1400d9370
mov word [rcx], di
add qword [rsp + 0x40], rax
mov ecx, 0x2a
cmp cx, word [rbp]
jne 0x1400d93b6
add rbp, rax
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0xa0], rbp
call fcn.140066060
mov r15, qword [rsp + 0x468]
cmp r15, rdi
je 0x1400d801a
mov rbp, qword [rsp + 0xa0]
jmp 0x1400d93c9
cmp r14d, edi
je 0x1400d801a
cmp word [rbp], di
je 0x1400d801a
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x468], rdi
call fcn.140061940
mov rbx, rdi
cmp r15, rdi
jne 0x1400d949f
mov eax, 0x2e
cmp ax, word [rbp]
jne 0x1400d93fe
lea rdx, [0x140122390]
jmp 0x1400d9416
mov r15d, 0x23
cmp r15w, word [rbp]
jne 0x1400d940f
add rbp, 2
lea rdx, [0x140122388]
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x468]
or r8, r9
call fcn.140061afc
lea rdx, [0x140122360]
lea rcx, [rsp + 0x468]
call fcn.140061a7c
lea rcx, [rsp + 0x468]
mov rdx, rbp
call fcn.140061a7c
mov r8, qword [rsp + 0x468]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.DLL_OpenEventW]
mov rbx, rax
mov r15, rax
cmp rax, rdi
jne 0x1400d949f
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, 1
cmp eax, edi
cmove eax, ecx
lea rcx, [rsp + 0x478]
mov ebx, eax
call fcn.140059370
lea rcx, [rsp + 0x468]
call fcn.140059370
jmp 0x1400d8021
lea r8, [rsp + 0x478]
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov rcx, rsi
mov word [rsp + 0x20], r13w
call fcn.140052b08
mov r9, qword [rsp + 0x40]
mov r8, r15
mov edx, r14d
mov rcx, rsi
cmp dword [rsp + 0x460], edi
je 0x1400d94e8
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x20], rax
call fcn.140056b7c
jmp 0x1400d94ed
call fcn.140056a0c
mov r8, qword [rsp + 0x478]
mov rbp, rax
cmp word [r8], di
je 0x1400d9513
lea r9, [0x1401146d0]
mov rdx, rax
mov rcx, rsi
call fcn.140064b84
mov rbp, rdi
cmp rbx, rdi
je 0x1400d9527
cmp rbx, 0xffffffffffffffff
je 0x1400d9527
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x478]
call fcn.140059370
lea rcx, [rsp + 0x468]
call fcn.140059370
mov rbx, rbp
jmp 0x1400d8021