Function at 0x140053320
Capabilities:
Check for time delay via queryperformancecounter
Enumerate processes
Log keystrokes via application hook
Log keystrokes via polling
Terminate process
Terminate thread

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4b8]
sub rsp, 0x578
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
movaps xmmword [rax - 0xa8], xmm11
movaps xmmword [rax - 0xb8], xmm12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
xor r9d, r9d
lea rdx, [0x140054b40]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [rbp + 0x40], rax
mov ebx, 4
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.1400463c0
test eax, eax
je 0x140053413
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx]
mov eax, dword [rbx + rdx]
cmp dword [0x140106abc], eax
jle 0x1400533ec
lea rcx, [0x140106abc]
call fcn.14006b638
cmp dword [0x140106abc], 0xffffffff
jne 0x1400533ec
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140106aa8], rax
lea rcx, [0x140106abc]
call fcn.14006b5d8
lea rdx, str.SetThreadDpiAwarenessContext
mov rcx, qword [0x140106aa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140053413
mov rcx, 0xfffffffffffffffc
call rax
jmp 0x140053498
mov edx, 3
lea ecx, [rdx + 3]
call fcn.1400463c0
test eax, eax
je 0x140053492
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rbx + rcx]
cmp dword [0x140106ab8], eax
jle 0x140053470
lea rcx, [0x140106ab8]
call fcn.14006b638
cmp dword [0x140106ab8], 0xffffffff
jne 0x140053470
lea rcx, str.shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140106ab0], rax
lea rcx, [0x140106ab8]
call fcn.14006b5d8
lea rdx, str.SetProcessDpiAwareness
mov rcx, qword [0x140106ab0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140053492
mov ecx, 2
call rax
jmp 0x140053498
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
xor r12d, r12d
mov qword [rbp + 0x60], r12
mov dword [rbp + 0x50], 0x50
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbp + 0x80], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp + 0x78], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x70], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x98], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x68], rax
lea rax, [0x140052b10]
mov qword [rbp + 0x58], rax
lea rax, str.D3D11_Overlay_ImGui
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x88], r12
mov dword [rbp + 0x54], 3
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_RegisterClassExW]
lea ecx, [r12 + 1]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r12
mov rcx, qword [rbp + 0x68]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x80000000
xor r8d, r8d
mov rdx, qword [rbp + 0x90]
mov ecx, 0x8000028
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r13, rax
lea r9d, [r12 + 2]
mov r8b, 0xff
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x140079f60]
movdqu xmmword [rbp + 0xc8], xmm0
lea rdx, [rbp + 0xc8]
mov rcx, r13
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
cmp byte [0x140086051], 1
jne 0x1400537e4
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], r12b
lea r8d, [r12 + 4]
lea rdx, str.POST
lea rcx, [rbp + 0x20]
call fcn.14003f900
nop
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], r12b
lea r8d, [r12 + 0x4f]
lea rdx, str.https:__keyauth.win_api_1.2__typeinitver2.0nameOPEN_NEWowneridNnT9EbZXyN
lea rcx, [rsp + 0x78]
call fcn.14003f900
nop
lea r8, [rbp + 0x20]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0xe0]
call fcn.14005dc70
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140053672
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005366c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005366c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006baac
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400536b0
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400536ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400536ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006baac
mov qword [rbp - 8], r12
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x60]
call fcn.14005ddd0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.14005def0
mov rdx, rax
lea rbx, [0x1400cfe58]
mov rcx, rbx
call fcn.14003f800
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14005372a
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053725
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053725
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006baac
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.14005e230
mov rdx, rax
lea rcx, [0x1400cfeb8]
call fcn.14003f800
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140053787
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053782
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053782
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006baac
cmp qword [0x1400cfe70], 0x10
cmovae rbx, qword [0x1400cfe58]
cmp qword [0x1400cfe68], 0xb
jne 0x1400537ba
mov r8d, 0xb
lea rdx, str.Initialized
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400537c1
mov byte [0x1400d059a], 0
mov byte [0x140086051], 0
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.14005cf00
nop
lea rcx, [rbp + 0xe0]
call fcn.140047660
mov ebx, dword [0x1400d0620]
test ebx, ebx
jne 0x1400538a4
cmp qword [0x1400d06d8], 0
jne 0x140053816
lea ecx, [rbx + 0x10]
call fcn.14006b748
mov qword [rbp + 0x4c0], rax
mov dword [rax + 8], r12d
mov qword [0x1400d06d8], rax
mov ebx, r12d
mov edi, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x1d0], 0x130
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rbp + 0x1d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005389e
nop dword [rax + rax]
lea rdx, str.HD_Player.exe
lea rcx, [rbp + 0x1fc]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x14005388a
mov eax, dword [rbp + 0x1ec]
cmp eax, edi
jle 0x14005388a
mov edi, eax
mov ebx, dword [rbp + 0x1d8]
lea rdx, [rbp + 0x1d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140053860
mov dword [0x1400d0620], ebx
mov rdi, qword [0x1400d06d8]
test rdi, rdi
jne 0x1400538d3
lea ecx, [rdi + 0x10]
call fcn.14006b748
mov rdi, rax
mov qword [rbp + 0x4c0], rax
mov dword [rax + 8], r12d
mov qword [0x1400d06d8], rax
mov ebx, dword [0x1400d0620]
mov dword [rdi + 8], ebx
mov eax, ebx
test ebx, ebx
jne 0x140053953
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x1d0], 0x130
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rbp + 0x1d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005394e
nop dword [rax + rax]
lea rdx, str.HD_Player.exe
lea rcx, [rbp + 0x1fc]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov ebx, dword [rbp + 0x1d8]
lea rdx, [rbp + 0x1d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140053920
mov dword [rdi + 8], ebx
mov eax, ebx
test eax, eax
je 0x14005396a
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rdi], rax
mov qword [rbp - 0x2c], r12
mov qword [rbp - 0x18], 2
mov qword [rbp], 2
mov qword [rbp - 0x40], r12
mov dword [rbp - 0x30], 0x1c
mov dword [rbp - 0x38], 0x3c
mov dword [rbp - 0x34], 1
mov dword [rbp - 0x1c], 0x20
mov qword [rbp - 0x10], r13
mov qword [rbp - 0x24], 1
mov qword [rbp - 8], 1
mov dword [rbp + 0x4c8], 0xb000
mov dword [rbp + 0x4cc], 0xa000
lea rbx, [0x1400d0630]
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x4c0]
mov qword [rsp + 0x50], rax
lea rdi, [0x1400d05e0]
mov qword [rsp + 0x48], rdi
lea rsi, [0x1400d06c0]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x4c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
cmp eax, 0x887a0004
jne 0x140053a86
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x4c0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x4c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x140053aa5
call fcn.140052a90
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.USER32.dll_UnregisterClassW]
jmp 0x140054831
mov rcx, qword [0x1400d06c0]
mov rax, qword [rcx]
lea r9, [rbp + 0x4d0]
lea r8, [0x140079c58]
xor edx, edx
call qword [rax + 0x48]
mov rdx, qword [rbp + 0x4d0]
test rdx, rdx
je 0x140053af2
mov rcx, qword [0x1400d05e0]
mov rax, qword [rcx]
lea r9, [0x1400d05e8]
xor r8d, r8d
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x4d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edx, 0xa
mov rcx, r13
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r13
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rdi, qword [0x1400d05a0]
test rdi, rdi
je 0x140053b1b
inc dword [rdi + 0xf4]
mov rdx, qword [0x1400d0590]
mov ecx, 0x5e00
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rbp + 0x4c8], rax
lea rcx, [rbp + 0x4c0]
mov qword [rbp + 0x4d0], rcx
mov qword [rbp + 0x4d8], rax
test rax, rax
je 0x140053b59
xor edx, edx
mov rcx, rax
call fcn.140001bd0
jmp 0x140053b5c
mov rax, r12
mov qword [0x1400d05a0], rax
call fcn.140005700
mov rbx, qword [0x1400d05a0]
test rdi, rdi
cmovne rbx, rdi
mov qword [0x1400d05a0], rbx
lea rdi, [0x140076bf0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x140079e54]
mov r8d, 0x26a20
lea rdx, [0x1400a7050]
mov rcx, qword [rbx + 0x58]
call fcn.140029cc0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
movss xmm6, dword [0x140079e4c]
movaps xmm3, xmm6
mov r8d, 0x20fe0
lea rdx, [0x140086060]
mov rcx, qword [rbx + 0x58]
call fcn.140029cc0
mov qword [0x140107238], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x140079e48]
mov r8d, 0x26a20
lea rdx, [0x1400a7050]
mov rcx, qword [rbx + 0x58]
call fcn.140029cc0
mov qword [0x140106330], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
movaps xmm3, xmm6
mov r8d, 0xb80
lea rdx, [0x1400cda80]
mov rcx, qword [rbx + 0x58]
call fcn.140029cc0
mov qword [0x140106328], rax
xor ecx, ecx
call fcn.140022ba0
mov edx, 2
mov rcx, r13
call qword [sym.imp.USER32.dll_MonitorFromWindow]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rcx
mov dword [rbp + 0xa0], 0x28
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMonitorInfoA]
mov eax, dword [rbp + 0xb0]
sub eax, dword [rbp + 0xa8]
movss xmm12, dword [0x140079dac]
cmp eax, 0x438
jle 0x140053d4c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rax
mov byte [rbp + 0xec], 1
mov dword [rbp + 0xf8], 3
mov dword [rbp + 0xfc], 1
movss xmm0, dword [0x140079f10]
movss dword [rbp + 0x124], xmm0
mov dword [rbp + 0x130], 0x3f800000
mov eax, 0xffff
mov word [rbp + 0x134], ax
movss xmm0, dword [0x140079e60]
movss dword [rbp + 0xf4], xmm0
lea rdx, [rbp + 0xe0]
mov rcx, qword [0x1400d05a0]
mov rcx, qword [rcx + 0x58]
call fcn.140029ae0
mov rbx, qword [0x1400d05a0]
mov qword [rbx + 0x20], r12
lea rcx, [rbp + 0x4c8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140053eaa
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140053eaa
mov rax, qword [0x1400d05a0]
test rax, rax
je 0x140053d91
inc dword [rax + 0xf4]
mov rdx, qword [0x1400d0590]
mov ecx, 0x48
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
mov qword [rbp + 0x4c0], rax
test rax, rax
je 0x140053dcb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
mov qword [rdi + 0x40], rax
jmp 0x140053dce
mov rdi, r12
mov qword [rbx + 0x98], rdi
lea rax, [0x1400773d8]
mov qword [rbx + 0x88], rax
or dword [rbx + 0xc], 6
mov qword [rdi], r13
mov rax, qword [rbp + 0x4c8]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
mov rax, qword [0x1400d05a0]
mov rcx, qword [rax + 0x48a8]
mov rax, qword [rcx]
mov qword [rax + 0x28], r13
mov byte [rdi + 0x2d], 1
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x78], rax
lea rax, str.xinput1_3.dll
mov qword [rbp - 0x80], rax
lea rax, str.xinput9_1_0.dll
mov qword [rbp - 0x78], rax
lea rax, str.xinput1_2.dll
mov qword [rbp - 0x70], rax
lea rax, str.xinput1_1.dll
mov qword [rbp - 0x68], rax
mov rbx, r12
nop dword [rax]
mov rcx, qword [rsp + rbx*8 + 0x78]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140053e7e
inc rbx
cmp rbx, 5
jl 0x140053e60
jmp 0x140053eaa
mov qword [rdi + 0x30], rsi
lea rdx, str.XInputGetCapabilities
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x38], rax
lea rdx, str.XInputGetState
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x40], rax
mov r14, qword [0x1400d0630]
mov rsi, qword [0x1400d05e0]
mov rdi, qword [0x1400d05a0]
test rdi, rdi
je 0x140053eca
inc dword [rdi + 0xf4]
mov rdx, qword [0x1400d0590]
mov ecx, 0x78
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbx, rax
mov qword [rbp + 0x4c0], rax
test rax, rax
je 0x140053f1e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x60], xmm0
mov qword [rbx + 0x70], rax
mov dword [rbx + 0x70], 0x1388
mov dword [rbx + 0x74], 0x2710
jmp 0x140053f21
mov rbx, r12
mov qword [rdi + 0xa0], rbx
lea rax, str.imgui_impl_dx11
mov qword [rdi + 0x90], rax
or dword [rdi + 0xc], 8
mov qword [rbp + 0x4d0], r12
mov qword [rbp + 0x4d8], r12
mov qword [rbp - 0x58], r12
mov rax, qword [rsi]
lea r8, [rbp + 0x4d0]
lea rdx, [0x1400773a8]
mov rcx, rsi
call qword [rax]
test eax, eax
jne 0x140053fb0
mov rcx, qword [rbp + 0x4d0]
mov rax, qword [rcx]
lea r8, [rbp + 0x4d8]
lea rdx, [0x1400773b8]
call qword [rax + 0x30]
test eax, eax
jne 0x140053fb0
mov rcx, qword [rbp + 0x4d8]
mov rax, qword [rcx]
lea r8, [rbp - 0x58]
lea rdx, [0x1400773c8]
call qword [rax + 0x30]
test eax, eax
jne 0x140053fb0
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov rax, qword [rbp - 0x58]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp + 0x4d0]
test rcx, rcx
je 0x140053fc2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x4d8]
test rcx, rcx
je 0x140053fd4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 8]
movaps xmm0, xmmword [0x14007a580]
mov rax, qword [0x1400d05a0]
movups xmmword [rax + 0x3904], xmm0
mov dword [rax + 0x381c], 0x40a00000
mov dword [rax + 0x3820], 0x40400000
mov dword [rax + 0x3824], 0x3f800000
mov qword [rax + 0x37f0], 0x40000000
mov dword [rax + 0x3818], r12d
mov qword [rax + 0x37e8], r12
mov dword [rax + 0x3810], 0x41200000
mov dword [rax + 0x38a8], r12d
xor r15b, r15b
movss xmm7, dword [0x140079ecc]
movss xmm6, dword [0x140079d68]
movss xmm10, dword [0x140079f38]
movss xmm11, dword [0x140079e68]
movss xmm8, dword [0x140079e20]
movss xmm9, dword [0x140079dd8]
mov esi, 1
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400540da
nop word [rax + rax]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageA]
movzx r15d, r15b
cmp dword [rbp - 0x38], 0x12
cmove r15d, esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x1400540a0
movzx r15d, r15b
cmp byte [0x1400d05f4], 1
cmove r15d, esi
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140054107
xor edx, edx
mov rcx, qword [0x1400d0608]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1400d0600]
test rcx, rcx
je 0x140054150
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140054149
lea rdx, [rbp + 0x4c0]
mov rcx, qword [0x1400d0600]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rbp + 0x4c0], 0
jne 0x140054149
mov eax, dword [0x1400d05f0]
mov rcx, qword [0x1400d0600]
jmp 0x14005415e
mov rcx, qword [0x1400d0600]
mov eax, dword [0x1400d05f0]
test eax, eax
jne 0x1400546e2
test r15b, r15b
jne 0x1400546e2
test rcx, rcx
je 0x1400541af
test eax, eax
je 0x1400541af
lea rdx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rbp + 0x1c]
mov r9d, dword [rbp + 0x14]
sub ecx, r9d
sub ecx, 0x1d
mov eax, dword [rbp + 0x18]
mov r8d, dword [rbp + 0x10]
sub eax, r8d
sub eax, 5
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, r13
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x7d
lea rdx, [rbp + 0x300]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x14005427b
mov r8d, 0x7d
lea rdx, [rbp + 0x380]
mov rcx, qword [0x1400d0600]
call qword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x14005427b
mov r8d, 0x7d
lea rdx, [rbp + 0xe0]
mov rcx, r13
call qword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x14005427b
lea rax, [rbp + 0x300]
lea r8, [rbp + 0x380]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140054233
inc rax
test ecx, ecx
jne 0x140054220
test edx, edx
je 0x1400542c7
lea rax, [rbp + 0x300]
lea r8, [rbp + 0xe0]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140054263
inc rax
test ecx, ecx
jne 0x140054250
test edx, edx
je 0x1400542c7
mov edx, 0xffffffec
mov r8d, 0x800a8
mov rcx, r13
call qword [sym.imp.USER32.dll_SetWindowLongA]
cmp dword [0x1400d05f0], 0
je 0x1400542c7
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov rcx, qword [0x1400d0630]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1400d05e8]
mov edx, esi
call qword [rax + 0x108]
mov rcx, qword [0x1400d0630]
mov rax, qword [rcx]
lea r8, [rbp + 0x20]
mov rdx, qword [0x1400d05e8]
call qword [rax + 0x190]
jmp 0x1400546cb
mov rbx, qword [0x1400d05a0]
test rbx, rbx
je 0x1400542dc
mov rax, qword [rbx + 0xa0]
jmp 0x1400542df
mov rax, r12
cmp qword [rax + 0x48], 0
jne 0x1400542f2
call fcn.140044620
mov rbx, qword [0x1400d05a0]
test rbx, rbx
je 0x140054300
mov rsi, qword [rbx + 0x98]
jmp 0x140054303
mov rsi, r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x68]
sub eax, dword [rsp + 0x60]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rsp + 0x6c]
sub eax, dword [rsp + 0x64]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x10], xmm1
movss dword [rbx + 0x14], xmm0
mov qword [rbp - 0x50], r12
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
sub rax, qword [rsi + 0x18]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsi + 0x20]
divss xmm1, xmm0
movss dword [rbx + 0x18], xmm1
mov qword [rsi + 0x18], rcx
mov rdi, qword [0x1400d05a0]
test rdi, rdi
je 0x14005438e
mov r14, qword [rdi + 0x98]
jmp 0x140054391
mov r14, r12
mov r12, qword [r14]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, r12
jne 0x140054436
cmp byte [rdi + 0xdb], 0
je 0x1400543f7
cvttss2si eax, dword [rdi + 0xdfc]
mov dword [rbp + 0x4c8], eax
cvttss2si eax, dword [rdi + 0xe00]
mov dword [rbp + 0x4cc], eax
lea rdx, [rbp + 0x4c8]
mov rcx, r12
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1400543ee
mov edx, dword [rbp + 0x4cc]
mov ecx, dword [rbp + 0x4c8]
call qword [sym.imp.USER32.dll_SetCursorPos]
cmp byte [rdi + 0xdb], 0
jne 0x140054436
cmp byte [r14 + 0x10], 0
jne 0x140054436
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140054436
lea rdx, [rbp - 0x60]
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140054436
movd xmm2, dword [rbp - 0x5c]
cvtdq2ps xmm2, xmm2
movd xmm1, dword [rbp - 0x60]
cvtdq2ps xmm1, xmm1
lea rcx, [rdi + 8]
call fcn.140003360
call fcn.140044c70
cmp byte [rbx + 0x78], 0
je 0x140054448
mov eax, 0xffffffff
jmp 0x140054455
mov rax, qword [0x1400d05a0]
mov eax, dword [rax + 0x4a58]
cmp dword [rsi + 0x28], eax
je 0x140054462
mov dword [rsi + 0x28], eax
call fcn.140044b00
call fcn.140044e20
call fcn.140007df0
movzx eax, byte [0x1400d062f]
mov ecx, eax
test al, al
mov esi, 1
cmove ecx, esi
mov byte [0x1400d062f], cl
cmp byte [0x140086050], sil
jne 0x1400544db
cmp byte [0x1400d059a], 0
je 0x1400544d6
call fcn.140057ad0
cmp byte [0x1400d05f5], 0
je 0x1400544aa
call fcn.14005bff0
cmp byte [0x1400d05cb], 0
je 0x1400544b8
call fcn.140059a80
cmp byte [0x1400d05fa], 0
je 0x1400544c6
call fcn.14005a4b0
cmp byte [0x1400d05c0], 0
je 0x1400544db
call fcn.14005aea0
jmp 0x1400544db
call fcn.14005b760
cmp byte [0x1400d059a], 0
je 0x14005460f
cmp byte [0x1400d05de], 0
je 0x1400544f6
call fcn.140056900
cmp byte [0x1400d062e], 0
je 0x14005452a
movss xmm0, dword [0x1400d05d0]
addss xmm0, xmm12
movss dword [0x1400d05d0], xmm0
comiss xmm0, xmm7
jb 0x140054525
subss xmm0, xmm7
movss dword [0x1400d05d0], xmm0
call fcn.140056440
cmp byte [0x1400d05f9], 0
je 0x140054601
mov rax, qword [0x1400d05a0]
mov rcx, qword [rax + 0x48a8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rcx]
call fcn.140007430
mov rbx, rax
mov r8, qword [0x1400d05a0]
movups xmm0, xmmword [0x1400d0048]
movups xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140003db0
mov edi, eax
movss xmm0, dword [r8 + 0x10]
mulss xmm0, xmm6
subss xmm0, xmm10
movss dword [rsp + 0x70], xmm0
movss xmm1, dword [r8 + 0x14]
mulss xmm1, xmm6
addss xmm1, xmm11
movss dword [rsp + 0x74], xmm1
test eax, 0xff000000
je 0x140054601
movss xmm2, dword [0x140086058]
comiss xmm6, xmm2
ja 0x140054601
subss xmm2, xmm6
mov dword [rsp + 0x28], 0x63
movss dword [rsp + 0x20], xmm8
xorps xmm3, xmm3
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140025440
movss dword [rsp + 0x28], xmm9
mov dword [rsp + 0x20], esi
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.140023a60
mov dword [rbx + 0x78], 0
cmp byte [0x1400d05dc], 0
je 0x14005460f
call fcn.140056bb0
call fcn.140059060
call fcn.140056f50
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test sil, al
je 0x140054637
cmp byte [0x140086050], 0
sete byte [0x140086050]
call fcn.140009a80
mov edx, 0xffffffec
mov rcx, r13
cmp byte [0x140086050], sil
mov r8d, 0x80088
je 0x140054659
mov r8d, 0x800a8
call qword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.140009d90
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov rcx, qword [0x1400d0630]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1400d05e8]
mov edx, esi
call qword [rax + 0x108]
mov rcx, qword [0x1400d0630]
mov rax, qword [rcx]
lea r8, [rsp + 0x78]
mov rdx, qword [0x1400d05e8]
call qword [rax + 0x190]
mov rax, qword [0x1400d05a0]
mov rcx, qword [rax + 0x48a8]
mov rax, qword [rcx]
add rax, 0x48
xor r12d, r12d
mov ecx, r12d
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.140043a00
mov rcx, qword [0x1400d06c0]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, esi
call qword [rax + 0x40]
jmp 0x140054080
mov rdi, qword [0x1400d05a0]
test rdi, rdi
je 0x1400546f7
mov rbx, qword [rdi + 0xa0]
jmp 0x1400546fa
mov rbx, r12
call fcn.1400449e0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14005470e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005471c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14005472b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi + 0x90], r12
mov qword [rdi + 0xa0], r12
mov rax, qword [0x1400d05a0]
test rax, rax
je 0x14005474b
dec dword [rax + 0xf4]
mov rdx, qword [0x1400d0590]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [0x1400d05a0]
test rax, rax
je 0x14005476f
mov rbx, qword [rax + 0x98]
jmp 0x140054772
mov rbx, r12
lea rdi, [rax + 8]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14005478c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1400d05a0]
mov qword [rdi + 0x80], r12
mov qword [rdi + 0x90], r12
test rax, rax
je 0x1400547a5
dec dword [rax + 0xf4]
mov rdx, qword [0x1400d0590]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rbx, qword [0x1400d05a0]
call fcn.140005ac0
mov qword [0x1400d05a0], r12
test rbx, rbx
je 0x1400547f5
mov rcx, rbx
call fcn.14001b370
mov rax, qword [0x1400d05a0]
test rax, rax
je 0x1400547e6
dec dword [rax + 0xf4]
mov rdx, qword [0x1400d0590]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
call fcn.140052a90
mov rcx, r13
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x578]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret