Function at 0x140001a20
Capabilities:
Check for foreground window switch
Check for software breakpoints
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x23b8]
mov eax, 0x24b8
call fcn.1400ecec0
sub rsp, rax
movaps xmmword [rsp + 0x24a0], xmm6
mov ebx, edx
mov byte [rsp + 0x49], 0
mov r15d, ecx
mov esi, 1
cmp edx, 2
jne 0x140001a80
cmp byte [0x14012787f], 0
mov ebx, esi
mov dword [rbp + 0x2408], ebx
jne 0x140001a80
mov byte [0x14012787f], bl
mov byte [rsp + 0x49], bl
xor edi, edi
cmp dword [0x14012bc74], edi
je 0x140001aba
cmp qword [0x14012bc58], rdi
je 0x140001aa7
mov rcx, qword [0x14012bc48]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x14012bc58], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x14012bc74], edi
mov qword [0x14012bc48], rdi
cmp r15d, 0x8000012f
jne 0x140001adc
mov r15d, 0xa
mov byte [rbp + 0x2410], sil
mov dword [rbp + 0x2400], r15d
mov dword [rbp - 0x60], edi
jmp 0x140001af9
cmp r15d, 5
setle al
mov byte [rbp + 0x2410], al
jg 0x140001af0
mov dword [rbp - 0x60], edi
jmp 0x140001af9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x60], eax
cmp dword [0x140128a84], edi
je 0x140001b06
call fcn.140004e00
xor r12b, r12b
cmp dword [0x14012bb4c], edi
mov dword [rsp + 0x44], r12d
je 0x140001b2a
call fcn.140004990
test al, al
movzx r12d, r12b
cmovne r12d, esi
mov dword [rsp + 0x44], r12d
test r15d, r15d
jle 0x140001b6b
cmp ebx, esi
jne 0x140001b6b
inc dword [0x140127a68]
cmp byte [0x14012787e], dil
mov byte [rsp + 0x4a], sil
jne 0x140001b70
mov rcx, qword [0x140127a60]
xor r9d, r9d
lea edx, [r9 + 9]
lea r8d, [r9 + 0xa]
call qword [sym.imp.USER32.dll_SetTimer]
test rax, rax
setne byte [0x14012787e]
jmp 0x140001b70
mov byte [rsp + 0x4a], dil
mov byte [rsp + 0x5c], dil
lea rbx, [rbp + 0xa0]
mov byte [rsp + 0x48], dil
mov dword [rsp + 0x40], edi
mov edi, 6
nop word [rax + rax]
mov rcx, rbx
call fcn.140005c30
add rbx, 0x20
sub rdi, rsi
jne 0x140001b90
mov rbx, qword [rbp + 0x2410]
xorps xmm6, xmm6
mov r14, qword [rbp + 0x2410]
mov edi, dword [rbp + 0x2400]
mov r13, qword [rbp + 0x2410]
movsxd rax, r15d
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x68], rax
mov eax, dword [rbp + 0x2400]
mov dword [rsp + 0x64], eax
mov eax, dword [rbp + 0x2400]
mov dword [rbp - 0x18], eax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x20], rax
movzx eax, byte [rbp + 0x2400]
mov byte [rbp + 0x2418], al
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x2410]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], edi
movsxd rbx, r15d
jmp 0x140001c6d
mov r15d, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
jmp 0x140001c80
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c75
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test rbx, rbx
jle 0x140001d52
cmp byte [rsp + 0x48], 0
jne 0x140001d52
cmp byte [0x14012787f], 0
jne 0x140001d5f
cmp dword [0x1401241f4], 0
je 0x140001d08
cmp dword [0x1401278bc], 0
jne 0x140001d08
mov rcx, qword [0x140124200]
cmp byte [rcx + 0x12c], 0
jne 0x140001cff
cmp byte [rcx + 0x12e], 0
jne 0x140001cff
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001cff
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001cff
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140001d0a
xor eax, eax
test eax, eax
lea rcx, [rsp + 0x68]
mov eax, 0
mov r9d, 0x311
cmovne r9d, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x140001c80
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
jbe 0x140002058
mov dword [0x14012bbc0], eax
jmp 0x140002058
cmp byte [0x14012787f], 0
je 0x140001f27
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140001f27
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x14012af90]
jne 0x140001f27
cmp dword [0x140127a5c], 0
je 0x140001dd7
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
xor edi, edi
lea rdx, [rbp + 0x1a0]
mov ecx, edi
lea r8, str.32770
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140001dd9
cmp rcx, 7
jne 0x140001dc0
jmp 0x140001e32
xor edi, edi
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x140001f27
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysTreeView32
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001e32
lea rdx, str.SysListView32
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140001f27
cmp dword [0x1401241f4], 0
je 0x140001e91
cmp dword [0x1401278bc], 0
jne 0x140001e91
mov rcx, qword [0x140124200]
cmp byte [rcx + 0x12c], 0
jne 0x140001e88
cmp byte [rcx + 0x12e], 0
jne 0x140001e88
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001e88
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001e88
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
jmp 0x140001e93
mov eax, edi
test eax, eax
mov dword [rsp + 0x20], edi
mov eax, 0xffffffff
lea rcx, [rsp + 0x68]
mov ebx, 0x311
mov r9d, 0x1ff
cmovne ebx, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor edx, edx
lea rcx, [rsp + 0x68]
mov r9d, ebx
mov r8d, 0x20e
test eax, eax
je 0x140001fa2
mov edi, dword [rbp - 0x78]
xor eax, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140001ef2
mov r9d, 0x1ff
jmp 0x140001f98
mov eax, dword [rbp - 0x78]
lea rcx, [rsp + 0x68]
sub eax, edi
xor edx, edx
test eax, eax
mov eax, 1
mov dword [rsp + 0x20], eax
jle 0x140001f19
mov r9d, 0x1ff
xor r8d, r8d
jmp 0x140001fab
mov r9d, ebx
mov r8d, 0x20e
jmp 0x140001fab
cmp dword [0x1401241f4], 0
je 0x140001f88
cmp dword [0x1401278bc], 0
jne 0x140001f88
mov rcx, qword [0x140124200]
cmp byte [rcx + 0x12c], 0
jne 0x140001f7d
cmp byte [rcx + 0x12e], 0
jne 0x140001f7d
cmp dword [rcx + 0x120], 0xffffffff
jle 0x140001f7d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140124200]
sub eax, dword [rcx + 0x11c]
cmp eax, dword [rcx + 0x120]
jb 0x140001f7d
mov byte [rcx + 0x12c], 1
movzx eax, byte [rcx + 0x12c]
xor edi, edi
jmp 0x140001f8c
xor edi, edi
mov eax, edi
test eax, eax
mov r9d, 0x311
cmovne r9d, edi
xor r8d, r8d
lea rcx, [rsp + 0x68]
xor edx, edx
mov eax, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140002051
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x14012bbc0]
mov ecx, eax
sub ecx, esi
movsxd rbx, r15d
cmp ecx, 3
cmova edx, eax
mov dword [0x14012bbc0], edx
test r15d, r15d
jne 0x140001ff6
cmp byte [rsp + 0x5c], r15b
jne 0x140001ff6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x5c], 1
jmp 0x140001c75
mov edi, dword [rsp + 0x40]
test edi, edi
jne 0x140002021
test r14b, r14b
je 0x140002021
test r15d, r15d
jle 0x140002011
lea ecx, [rdi + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov edi, eax
mov dword [rsp + 0x40], eax
jmp 0x140001c80
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x140004811
mov ecx, dword [rbp - 0x60]
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jle 0x140004811
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001c80
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
inc edi
cmp dword [0x14012afb0], 0
mov dword [rsp + 0x40], edi
je 0x14000209c
mov r9, qword [rbp - 0x80]
lea rax, [rbp + 0x190]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140004f10
test al, al
jne 0x140001c80
mov r9d, dword [0x140127a58]
mov r11d, dword [rsp + 0x70]
test r9d, r9d
je 0x1400028ed
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400028ed
cmp rax, qword [0x140127a60]
je 0x1400028ed
cmp r11d, 0x414
je 0x1400028ed
cmp r11d, 0x402
je 0x1400028ed
lea eax, [r11 - 0x100]
cmp eax, 9
ja 0x14000267c
call qword [sym.imp.USER32.dll_GetFocus]
mov rsi, rax
test rax, rax
je 0x140002670
mov edx, 0xfffffff0
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x140002156
nop
mov rcx, rdi
mov rbx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je 0x14000214a
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x140002120
jmp 0x140002156
mov rdi, rbx
test rbx, rbx
je 0x140002670
mov rbx, rsi
nop dword [rax]
mov r9d, dword [0x140127a58]
xor eax, eax
mov ecx, eax
test r9d, r9d
jle 0x140002192
mov rax, qword [0x140127a50]
mov r13, qword [rax]
cmp qword [r13 + 8], rbx
je 0x14000218d
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002177
jmp 0x140002192
test r13, r13
jne 0x1400021cd
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x1400021b7
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
jne 0x140002160
mov r11d, dword [rsp + 0x70]
xor esi, esi
mov r9d, dword [0x140127a58]
mov r13d, esi
jmp 0x14000267e
mov rdx, qword [r13 + 0xb8]
test rdx, rdx
je 0x1400021fd
lea r8, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
test eax, eax
jne 0x140001c80
mov r9d, dword [0x140127a58]
mov r11d, dword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
cmp r11d, 0x100
jne 0x140002615
cmp byte [r13 + 0x108], 0
je 0x1400024a0
cmp r10, 0x27
ja 0x1400024a0
movabs rax, 0xa600000200
bt rax, r10
jae 0x1400024a0
mov rcx, rsi
mov rdi, rsi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jb 0x14000227c
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je 0x140002272
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jae 0x14000247b
mov eax, ebx
imul r14, rax, 0x58
add r14, qword [r13 + 0x28]
mov qword [rbp - 0x68], r14
cmp qword [r14], rdi
jne 0x14000247b
mov eax, 0x2af8
cmp ebx, eax
je 0x14000247b
xor edi, edi
test r14, r14
je 0x140002481
movzx eax, byte [r14 + 8]
cmp al, 0xf
je 0x140002481
mov r10, qword [rsp + 0x78]
mov ebx, edi
cmp al, 0x13
jne 0x1400022fd
lea rax, [r10 - 0x25]
mov rbx, r14
test rax, 0xfffffffffffffffd
jne 0x1400022fd
cmp r10, 0x27
mov byte [rsp + 0x20], dil
mov rdx, r14
mov rcx, r13
sete r8b
xor r9d, r9d
call fcn.1400b4670
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c75
lea rax, [r10 - 0x25]
test rax, 0xfffffffffffffffd
je 0x140002486
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140002481
mov r10, qword [rsp + 0x78]
cmp r10, 9
jne 0x14000234f
cmp byte [r14 + 8], 0xc
jne 0x14000234f
mov rcx, qword [r14]
lea edx, [r10 - 0x19]
call qword [sym.imp.USER32.dll_GetWindowLongW]
test al, 4
jne 0x140002481
mov r10, qword [rsp + 0x78]
test rbx, rbx
jne 0x1400023fc
movzx r11d, byte [r14 + 0xa]
cmp r11b, 0xff
je 0x1400023ae
mov r9d, dword [r13 + 0x20]
xor r8b, r8b
mov edx, edi
test r9d, r9d
je 0x1400023ae
mov rdi, qword [r13 + 0x28]
nop word [rax + rax]
mov eax, edx
imul rbx, rax, 0x58
add rbx, rdi
cmp byte [rbx + 8], 0x13
jne 0x140002397
cmp r8b, r11b
je 0x1400023a7
inc r8b
inc edx
cmp edx, r9d
jb 0x140002380
xor r8b, r8b
xor edi, edi
mov edx, edi
jmp 0x1400023c0
test rbx, rbx
jne 0x1400023fc
xor edi, edi
mov r9d, dword [r13 + 0x20]
xor r8b, r8b
mov edx, edi
test r9d, r9d
je 0x140002486
mov r11, qword [r13 + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
imul rbx, rax, 0x58
add rbx, r11
cmp byte [rbx + 8], 0x13
jne 0x1400023e7
test r8b, r8b
je 0x1400023f3
inc r8b
inc edx
cmp edx, r9d
jb 0x1400023d0
jmp 0x140002486
test rbx, rbx
je 0x140002486
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140002477
mov rax, qword [rsp + 0x78]
cmp rax, 0x22
je 0x140002450
cmp rax, 9
jne 0x14000242a
lea ecx, [rax + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140002450
xor r8d, r8d
mov byte [rsp + 0x20], 1
mov r9b, 1
mov rdx, rbx
mov rcx, r13
call fcn.1400b4670
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c75
mov r8b, 1
mov rdx, rbx
movzx r9d, r8b
mov byte [rsp + 0x20], r8b
mov rcx, r13
call fcn.1400b4670
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c75
xor edi, edi
jmp 0x140002481
xor edi, edi
mov qword [rbp - 0x68], rdi
mov r10, qword [rsp + 0x78]
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140127a58]
cmp r11d, 0x100
je 0x1400024a2
jmp 0x140002615
xor edi, edi
cmp r10, 0x1b
je 0x1400024e3
cmp r10, 9
je 0x1400024e3
cmp r10, 0x41
jne 0x140002615
lea ecx, [r10 - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140002604
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x140002604
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jb 0x14000251c
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rsi, rax
test rax, rax
je 0x140002512
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ebx, [rax - 3]
cmp ebx, dword [r13 + 0x20]
jae 0x140002600
mov ecx, ebx
imul r14, rcx, 0x58
add r14, qword [r13 + 0x28]
mov qword [rbp - 0x68], r14
mov rcx, qword [r14]
cmp rcx, rsi
jne 0x140002600
mov eax, 0x2af8
cmp ebx, eax
je 0x140002600
test r14, r14
je 0x140002604
cmp byte [r14 + 8], 0xc
jne 0x140002604
mov r10, qword [rsp + 0x78]
cmp r10, 0x1b
je 0x1400025c6
movzx eax, byte [r14 + 9]
cmp r10, 0x41
je 0x14000259d
test al, al
jns 0x140002609
lea r9, [0x1400ef864]
mov edx, 0xc2
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c75
test al, 2
jne 0x140002609
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c75
cmp qword [r13 + 0x40], 0
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
movsxd rbx, r15d
je 0x140001c80
mov rcx, qword [r13 + 8]
xor r9d, r9d
mov edx, 0x414
mov r8d, 0x2af80007
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rbx, r15d
jmp 0x140001c80
mov qword [rbp - 0x68], rdi
mov r10, qword [rsp + 0x78]
mov r9d, dword [0x140127a58]
mov r11d, dword [rsp + 0x70]
mov rcx, qword [0x140128af8]
test rcx, rcx
je 0x14000285c
cmp r11d, 0x100
jne 0x14000285c
cmp r10, 0xd
jne 0x140002659
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1116
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c75
cmp r10, 0x1b
jne 0x14000285c
xor r9d, r9d
mov edx, 0x1116
jmp 0x140002581
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140127a58]
xor esi, esi
lea eax, [r11 - 0x20a]
test eax, 0xfffffffb
jne 0x140002857
mov rcx, qword [rbp - 0x74]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
mov edx, 0xfffffff0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140127a58]
mov edx, esi
test r9d, r9d
jle 0x1400026e4
mov rcx, qword [0x140127a50]
nop dword [rax + rax]
mov r8, qword [rcx]
cmp qword [r8 + 8], rax
je 0x140002752
inc edx
add rcx, 8
cmp edx, r9d
jl 0x1400026d0
mov rcx, qword [rsp + 0x68]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9, qword [rsp + 0x78]
mov r8d, eax
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.140001940
test eax, eax
jne 0x14000284b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140127a58]
mov edx, esi
test r9d, r9d
jle 0x14000274a
mov rcx, qword [0x140127a50]
mov r13, qword [rcx]
cmp qword [r13 + 8], rax
je 0x1400027bf
inc edx
add rcx, 8
cmp edx, r9d
jl 0x140002732
mov r13, rsi
jmp 0x140002852
test r8, r8
je 0x1400026e4
cmp rbx, qword [rsp + 0x68]
jne 0x140002785
mov r9, qword [rsp + 0x78]
mov r8d, edi
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.140001940
test eax, eax
jne 0x1400026e4
cmp rbx, qword [rsp + 0x68]
je 0x1400026e4
mov r9, qword [rsp + 0x78]
mov r8d, edi
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call fcn.140001940
test eax, eax
je 0x1400026e4
mov r9, qword [rbp - 0x80]
mov rcx, rbx
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rbx, r15d
jmp 0x140001c75
test r13, r13
je 0x140002852
nop dword [rax + rax]
mov r9, qword [rsp + 0x78]
mov r8d, dword [r13 + 0x64]
mov edx, dword [rsp + 0x70]
mov rcx, qword [r13 + 8]
call fcn.140001940
mov rcx, qword [r13 + 8]
test eax, eax
jne 0x140002830
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, dword [0x140127a58]
mov edx, esi
test r9d, r9d
jle 0x14000274a
mov rcx, qword [0x140127a50]
nop dword [rax]
mov r13, qword [rcx]
cmp qword [r13 + 8], rax
je 0x140002829
inc edx
add rcx, 8
cmp edx, r9d
jl 0x140002810
mov r13, rsi
jmp 0x140002852
test r13, r13
jne 0x1400027d0
jmp 0x140002852
mov r9, qword [rbp - 0x80]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rbx, r15d
jmp 0x140001c75
mov r9d, dword [0x140127a58]
mov r11d, dword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
xor esi, esi
mov edi, esi
test r9d, r9d
jle 0x1400028e7
mov ebx, esi
nop dword [rax + rax]
mov rdx, qword [0x140127a50]
mov rax, qword [rbx + rdx]
cmp dword [rax + 0x20], esi
jne 0x140002889
cmp r11d, 0x106
je 0x1400028d6
mov rcx, qword [0x140124200]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
mov rcx, qword [rbx + rdx]
lea rdx, [rsp + 0x68]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
mov rax, qword [0x140124200]
mov byte [rax + 0x128], sil
jne 0x1400022ed
mov r11d, dword [rsp + 0x70]
mov r9d, dword [0x140127a58]
inc edi
add rbx, 8
cmp edi, r9d
jl 0x140002870
mov edi, dword [rsp + 0x40]
jmp 0x1400028ef
mov edi, dword [rsp + 0x40]
jmp 0x1400028f4
xor esi, esi
mov r10, qword [rsp + 0x78]
cmp r11d, 0x402
ja 0x140002be6
je case.0x140002c07.1044
cmp r11d, 0x113
ja 0x140002adb
je 0x1400029ad
cmp r11d, 0x12
je 0x14000298a
cmp r11d, 0x4b
je 0x14000296e
cmp r11d, 0x100
jne case.0x140002c07.1046
mov rax, qword [0x140127a28]
cmp qword [rsp + 0x68], rax
jne case.0x140002c07.1046
cmp r10, 0x1b
jne case.0x140002c07.1046
mov rcx, qword [0x140127a60]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c80
movzx r14d, byte [rbp + 0x2410]
mov qword [0x140127a30], rsi
mov byte [rsp + 0x48], 1
movsxd rbx, r15d
jmp 0x140001c80
xor r8d, r8d
lea rcx, [0x14012afc0]
lea edx, [r8 + 4]
call fcn.140038210
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jmp 0x140001c80
cmp qword [rbp - 0x80], 0
jne case.0x140002c07.1046
mov rax, qword [0x140127a60]
cmp qword [rsp + 0x68], rax
jne case.0x140002c07.1046
cmp dword [0x140128a84], 0
je 0x1400029d8
call fcn.140004e00
cmp dword [0x14012bb4c], 0
je 0x1400029fa
call fcn.140004990
test al, al
movzx r12d, r12b
mov eax, 1
cmovne r12d, eax
mov dword [rsp + 0x44], r12d
cmp dword [rbp + 0x2408], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
je 0x140001c80
movsxd rbx, r15d
cmp rbx, 1
jl 0x140001c80
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x140002a3b
mov ecx, dword [rbp - 0x60]
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jg 0x140001c80
cmp byte [rsp + 0x49], 0
mov dword [0x14012bbc0], eax
mov dword [0x14012bbc4], eax
movzx eax, byte [0x14012787f]
cmovne eax, esi
mov qword [0x14012bbb0], rsi
cmp byte [rsp + 0x4a], 0
mov byte [0x14012787f], al
je 0x140002abb
mov eax, dword [0x140127a68]
dec eax
mov dword [0x140127a68], eax
test r15d, r15d
jle 0x140002abb
test eax, eax
jne 0x140002abb
cmp dword [0x14012bb4c], eax
jne 0x140002abb
cmp dword [0x140128a84], eax
jne 0x140002abb
cmp byte [0x14012787e], al
je 0x140002abb
mov rcx, qword [0x140127a60]
lea edx, [rax + 9]
call qword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x14012787e]
test eax, eax
cmovne ecx, esi
mov byte [0x14012787e], cl
movaps xmm6, xmmword [rsp + 0x24a0]
movzx eax, r12b
add rsp, 0x24b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, r11d
sub eax, 0x312
je case.0x140002c07.1044
sub eax, 0xee
je case.0x140002c07.1045
cmp eax, 1
je case.0x140002c07.1045
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x1400047a1
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x14012af90]
jne 0x1400047a1
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rcx, rsi
lea rdx, [rbp + 0x1a0]
lea r8, str.32770
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400047a1
cmp rcx, 7
jne 0x140002b50
mov rcx, qword [0x140124200]
lea rdx, [rsp + 0x68]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x140004791
cmp dword [0x140127a5c], 0
je 0x140002bc3
mov rax, qword [0x140126a10]
lea rcx, [0x1400ef7e4]
test rax, rax
je 0x140002bbd
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, qword [0x140124200]
movzx r14d, byte [rbp + 0x2410]
mov byte [rax + 0x128], 0
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c80
lea eax, [r11 - 0x414]
cmp eax, 0xa
ja case.0x140002c07.1046
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x48b4]
add rcx, rdx
jmp rcx
mov rax, qword [rsp + 0x68]
test rax, rax
je case.0x140002c07.1044
cmp rax, qword [0x140127a60]
jne case.0x140002c07.1046
lea eax, [r11 - 0x401]
mov r12, rsi
cmp eax, 0x1d
ja case.0x140002c4c.1031
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x48fc]
mov ecx, dword [rdx + rax*4 + 0x48e0]
add rcx, rdx
jmp rcx
mov ecx, esi
test r9d, r9d
jle 0x140002c79
mov rax, qword [0x140127a50]
nop dword [rax]
mov r13, qword [rax]
mov r8, qword [r13 + 8]
cmp r8, qword [rsp + 0x68]
je 0x140002c81
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002c60
mov r13, rsi
jmp case.0x140002c07.1046
test r13, r13
je case.0x140002c07.1046
mov rcx, qword [rbp - 0x80]
mov eax, 0x2af8
movzx ebx, r10w
shr r10, 0x10
cmp ebx, 8
movzx r10d, r10w
mov edi, r10d
mov dword [rsp + 0x60], esi
cmove r10d, eax
mov dword [rsp + 0x64], ebx
mov eax, ecx
mov dword [rbp - 0x18], r10d
cmovne eax, dword [rsp + 0x58]
cmovne rdi, rcx
mov r9d, eax
mov dword [rsp + 0x58], eax
mov esi, eax
cmp r10d, dword [r13 + 0x20]
jae 0x140002cde
mov eax, r10d
imul r14, rax, 0x58
add r14, qword [r13 + 0x28]
xor eax, eax
jmp 0x140002ce3
xor eax, eax
mov r14d, eax
mov qword [rbp - 0x20], rax
mov eax, ebx
mov qword [rbp - 0x68], r14
mov byte [rbp + 0x2418], 0
mov qword [rsp + 0x50], rdi
sub eax, 5
je 0x140002e6b
sub eax, 1
je 0x140002e13
sub eax, 1
je 0x140002df3
sub eax, 1
je 0x140002dd3
cmp eax, 1
je 0x140002da6
movsxd rbx, r15d
test r14, r14
je 0x140001c68
mov rbx, qword [r14 + 0x18]
test rbx, rbx
jne 0x140002d70
test byte [r14 + 9], 1
je 0x140002d52
test r8, r8
je 0x140002d52
xor edx, edx
mov rcx, r8
call qword [sym.imp.USER32.dll_ShowWindow]
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
movsxd rbx, r15d
jmp 0x140001c75
test byte [r14 + 9], 4
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
jne 0x140001c5e
xor eax, eax
mov byte [rbp + 0x2418], 1
mov r14d, eax
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
jmp 0x1400033ac
mov rbx, qword [r13 + 0x58]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001c5e
xor eax, eax
mov qword [rsp + 0x50], rdi
mov r14d, eax
mov dword [rsp + 0x58], esi
jmp 0x1400033ac
mov rbx, qword [r13 + 0x48]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001c5e
lea rcx, [r13 + 0x62]
jmp 0x140002e31
mov rbx, qword [r13 + 0x40]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001c5e
lea rcx, [r13 + 0x61]
jmp 0x140002e31
mov rbx, qword [r13 + 0x38]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], r9d
test rbx, rbx
je 0x140001c5e
lea rcx, [r13 + 0x60]
mov qword [rbp - 0x20], rcx
mov qword [rsp + 0x50], rdi
test rcx, rcx
je 0x140002eaa
cmp byte [rcx], 0
movzx r14d, byte [rbp + 0x2410]
mov qword [rsp + 0x50], rdi
mov edi, dword [rsp + 0x40]
mov dword [rsp + 0x58], esi
jne 0x140002bd9
xor eax, eax
mov dword [rsp + 0x58], esi
mov r14d, eax
jmp 0x1400033ac
mov rbx, qword [r13 + 0x50]
mov r12, qword [r13 + 0xa0]
test rbx, rbx
je 0x140002eb8
mov qword [rsp + 0x50], rdi
test r12, r12
je 0x140002ecf
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r14d, eax
mov qword [rsp + 0x50], r14
test eax, eax
je 0x140002ebd
mov r11d, dword [rsp + 0x70]
xor eax, eax
mov dword [rsp + 0x58], esi
mov r14d, eax
jmp 0x1400033ac
test r12, r12
je 0x140002ecf
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [r13 + 0xa0], rax
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov dword [rsp + 0x58], esi
movsxd rbx, r15d
jmp 0x140001c75
test r10, r10
je 0x140002f37
mov ecx, esi
test r9d, r9d
jle 0x140002f14
mov rax, qword [0x140127a50]
nop dword [rax + rax]
mov r13, qword [rax]
cmp qword [r13 + 8], r10
je 0x140002f30
inc ecx
add rax, 8
cmp ecx, r9d
jl 0x140002f00
mov r13, rsi
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140002f3a
cmp rax, qword [0x140127a60]
jne case.0x140002c07.1046
jmp 0x140002f3a
test r13, r13
jne 0x140002f3a
jmp 0x140002f17
mov r13, rsi
mov rcx, qword [0x14012bb50]
test rcx, rcx
je 0x140002f7b
mov rax, qword [rbp - 0x80]
nop word [rax + rax]
mov rdi, qword [rcx + 8]
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x140002f72
nop dword [rax]
cmp dword [rdi + 0x28], eax
je 0x140002f94
mov rdi, qword [rdi + 0x38]
mov qword [rbp - 0x58], rdi
test rdi, rdi
jne 0x140002f60
mov rcx, qword [rcx + 0x30]
test rcx, rcx
jne 0x140002f50
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x58], rsi
movsxd rbx, r15d
jmp 0x140001c75
mov rbx, qword [rdi + 0x10]
movzx r14d, byte [rbp + 0x2410]
test rbx, rbx
je 0x140001c5e
mov r14d, dword [rdi + 0x2c]
jmp 0x1400033b0
mov eax, dword [0x140128a80]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
cmp r10, rax
jae 0x140001c57
mov rax, qword [0x140128a78]
mov rsi, qword [rax + r10*8]
mov qword [rbp], rsi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000300b
mov rdx, qword [rsi + 8]
call fcn.1400175f0
mov qword [rbp - 0x50], rax
movsxd rbx, r15d
test rax, rax
je 0x140001c57
mov rcx, qword [rsi + 0x20]
movzx edx, byte [rcx]
dec dl
test dl, 0xfd
je 0x140003011
xor eax, eax
mov qword [rbp - 0x50], rax
mov rdx, qword [rbp - 0x80]
mov rcx, rsi
call fcn.14001add0
cmp qword [rsi + 0x18], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jne 0x140001c57
cmp byte [rsi + 0x3e], 0
je 0x14000303f
movzx eax, word [rbp - 0x80]
jmp 0x140003041
xor eax, eax
mov r11d, dword [rsp + 0x70]
mov word [0x14012bb6c], ax
mov rbx, qword [rsi]
mov r14d, dword [rsi + 0x28]
jmp 0x1400033ac
cmp byte [0x14012bb30], 0
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
jne 0x140001c57
mov rbx, qword [0x14012bb18]
mov r14d, esi
test rbx, rbx
cmove rbx, qword [0x14012b698]
jmp 0x1400033ac
mov rcx, r10
call fcn.140065e70
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x48], rax
movsxd rbx, r15d
test rax, rax
je 0x140004787
mov rbx, qword [rax + 0x10]
mov r14d, esi
mov r11d, dword [rsp + 0x70]
mov rbx, qword [rbx + 0x388]
jmp 0x1400033ac
mov rdi, qword [0x140127a48]
movzx r14d, byte [rbp + 0x2410]
mov qword [rbp - 0x48], rdi
movsxd rbx, r15d
test rdi, rdi
je 0x140004787
cmp rdi, r10
je 0x140003101
mov rdi, qword [rdi + 8]
mov qword [rbp - 0x48], rdi
test rdi, rdi
jne 0x1400030e2
mov r12d, dword [rsp + 0x44]
movsxd rbx, r15d
jmp 0x140001c75
mov rbx, qword [rdi + 0x10]
cmp r11d, 0x41c
jne 0x140003117
mov rbx, qword [rbx + 0x390]
jmp 0x140003130
cmp r11d, 0x41e
jne 0x140003129
mov rbx, qword [rbx + 0x3a0]
jmp 0x140003130
mov rbx, qword [rbx + 0x398]
mov edi, dword [rsp + 0x40]
test rbx, rbx
je 0x140002bd9
mov r14d, esi
jmp 0x1400033ac
movzx r14d, byte [rbp + 0x2410]
movzx eax, r10w
mov ecx, 0x7fff
movsxd rbx, r15d
and ax, cx
cmp ax, word [0x140128a9c]
jae 0x140001c57
movzx ecx, ax
mov rax, qword [0x140128a88]
shr r10, 0x10
mov r14, qword [rax + rcx*8]
mov qword [rbp - 8], r14
test r10w, r10w
je 0x1400031b7
mov r15, qword [r14 + 0x28]
mov eax, 0xffff
mov qword [rbp - 0x40], r15
add r10w, ax
je 0x1400031ae
nop dword [rax + rax]
mov r15, qword [r15 + 0x10]
add r10w, ax
jne 0x1400031a0
mov qword [rbp - 0x40], r15
test r15, r15
jne 0x14000330e
cmp r11d, 0x400
jne 0x1400031da
mov rax, qword [rbp - 0x80]
mov edi, WSAAsyncSelect
shr rax, 0x10
movzx ecx, ax
sub edi, ecx
lea esi, [rcx + 0x3c2bb3]
jmp 0x1400031df
mov edi, 0x3c2c17
xor eax, eax
cmp byte [r14 + 0x19], al
jne 0x1400031fb
mov r15d, dword [rbp + 0x2400]
mov rbx, qword [rbp - 0x28]
mov qword [rbp - 0x40], rax
jmp 0x140001c68
mov r15, qword [r14 + 0x28]
mov rbx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], r15
test r15, r15
je 0x1400032ec
cmp byte [r15 + 0x28], 0
je 0x1400032d6
cmp byte [0x140127b40], 0
je 0x140003298
mov r9, qword [r15]
mov rcx, r9
call fcn.1400bcce0
test eax, eax
je 0x14000323f
cmp eax, 1
jne 0x1400032d6
mov rcx, qword [r9 + 0x10]
test rcx, rcx
je 0x1400032d6
cmp byte [rcx], 0xcd
jne 0x1400032d6
movzx eax, byte [rcx + 1]
test al, al
je 0x140003298
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx]
test al, al
jne 0x14000327f
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140003277
cmp qword [rax], 0
jne 0x140003298
cmp byte [rcx + 1], 0
jne 0x140003298
jmp 0x140003283
cmp al, 1
je 0x140003298
mov rcx, qword [rcx + 8]
lea rdx, [0x140106214]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400032d6
lea ecx, [rsi - 0x3c2bb3]
cmp edi, 0x66
jbe 0x1400032a8
mov ecx, reloc.WSOCK32.dll_WSAAsyncSelect
movzx eax, byte [r15 + 0x24]
cmp ecx, eax
jle 0x1400032d6
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x1400032cc
mov rdx, qword [r14 + 0x20]
call fcn.1400175f0
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400032d6
cmp qword [r15 + 8], 0
jne 0x140003330
mov rbx, r15
mov r15, qword [r15 + 0x10]
mov qword [rbp - 0x40], r15
test r15, r15
jne 0x140003213
mov r11d, dword [rsp + 0x70]
mov r15, rbx
mov qword [rbp - 0x40], rbx
movzx r14d, byte [rbp + 0x2410]
mov rbx, qword [rbp - 0x28]
mov edi, dword [rsp + 0x40]
test r15, r15
je 0x140001c50
xor esi, esi
mov r9, qword [r15]
mov rcx, r9
call fcn.1400bcce0
test eax, eax
je 0x140003322
cmp eax, 1
jne 0x140003337
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x140003337
movzx ecx, byte [rax]
jmp 0x140003339
mov r11d, dword [rsp + 0x70]
jmp 0x1400032f3
xor cl, cl
movzx eax, byte [r15 + 0x23]
cmp byte [r15 + 0x22], al
jb 0x14000337c
add cl, 0x32
cmp cl, 0x14
ja 0x140003356
mov eax, 0x10fc01
bt eax, ecx
jb 0x14000337c
cmp byte [r15 + 0x26], 0
je 0x140003362
mov byte [r15 + 0x27], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbx, qword [rbp - 0x28]
mov dword [r15 + 0x18], eax
mov r15d, dword [rbp + 0x2400]
jmp 0x140001c68
mov rax, qword [r15 + 8]
test rax, rax
je 0x1400033a1
movzx ecx, byte [rax]
lea eax, [rcx - 2]
test al, 0xfd
je 0x1400033a1
cmp cl, 5
jb 0x1400033a5
mov rax, qword [0x140127a40]
mov qword [rbp - 0x50], rax
jmp 0x1400033a5
mov qword [rbp - 0x50], rsi
mov rbx, qword [r15]
mov r14d, dword [r15 + 0x1c]
mov rdi, qword [rbp - 0x58]
mov r15, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1400bcce0
test eax, eax
je 0x1400033c6
cmp eax, 1
jne 0x1400033d7
mov rcx, qword [rbx + 0x10]
mov rax, rbx
test rcx, rcx
je 0x1400033d7
movzx esi, byte [rcx]
jmp 0x1400033da
xor sil, sil
mov ecx, dword [0x1401278cc]
mov eax, dword [reloc.WSOCK32.dll_inet_addr]
cmp ecx, eax
jl 0x140003464
add eax, 2
cmp ecx, eax
jge 0x140003402
lea eax, [rsi + 0x32]
cmp al, 0x14
ja 0x140003402
mov ecx, 0x10fc01
bt ecx, eax
jb 0x140003464
test r12, r12
je 0x14000341e
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov qword [r13 + 0xa0], rax
mov r11d, dword [rsp + 0x70]
movsxd r15, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
mov rbx, r15
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
cmp r11d, 0x41b
jne 0x140001c80
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r15d, dword [rbp + 0x2400]
mov rbx, qword [rbp - 0x28]
jmp 0x140001c80
mov rax, qword [0x140124200]
cmp r14d, dword [rax + 0x3c]
jl 0x140003402
lea eax, [r11 - 0x402]
mov byte [rsp + 0x44], 1
cmp eax, 0x1c
ja case.0x14000349b.1028
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x4928]
mov ecx, dword [rdx + rax*4 + 0x491c]
add rcx, rdx
jmp rcx
mov rdx, qword [rdi]
lea rcx, [0x14012b6a8]
mov r8d, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
lea rcx, [0x14012b8b2]
mov word [0x14012b8b0], ax
mov r8d, 0x104
mov rdx, qword [rdi + 0x20]
mov rdx, qword [rdx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov qword [0x14012b6a0], rdi
mov word [0x14012baba], ax
jmp case.0x14000349b.1027
mov rax, qword [0x14012bac0]
mov qword [0x14012bac8], rax
mov eax, dword [0x14012bb64]
mov dword [0x14012bb68], eax
cmp r11d, 0x401
jne 0x140003515
mov rax, qword [rbp]
mov rax, qword [rax + 8]
jmp 0x14000351d
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x20]
mov qword [0x14012bac0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012bb64], eax
mov rdi, qword [0x140127a38]
cmp byte [rdi + 0x23], 0
jne 0x140003541
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x14000354f
mov rcx, rdi
call fcn.140001620
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x14000356b
test byte [rdi + 0x21], 4
je 0x140003565
mov rdx, rdi
call fcn.140060a30
mov rdx, qword [rdi + 8]
jmp 0x1400035ce
cmp al, 2
jne 0x1400035c7
mov rdx, qword [0x14012bc60]
test rdx, rdx
jne 0x1400035ce
lea ecx, [rdx + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400035a7
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rdx, [0x1400ef7e4]
lea rax, [0x1400ef7d8]
cmovne rdx, rax
jmp 0x1400035ce
xor edx, edx
call fcn.140007250
mov ecx, 0xffffffff
lea rdx, [0x1400ef7e4]
cmp rax, rcx
cmovne rdx, qword [0x14012bc58]
jmp 0x1400035ce
lea rdx, [0x140129f30]
mov r8d, 0x7f
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edi, edi
movzx r9d, sil
mov r8b, 1
mov word [rbp + 0x2de], di
xor edx, edx
mov ecx, r14d
call fcn.1400054f0
mov r14, qword [0x140124200]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012bbc4], eax
mov dword [0x14012bbc0], eax
mov eax, dword [rsp + 0x70]
add eax, 0xfffffbff
cmp eax, 0x1d
ja case.0x140003641.1032
lea r9, [0x140000000]
movzx eax, byte [r9 + rax + 0x4968]
mov ecx, dword [r9 + rax*4 + 0x4948]
add rcx, r9
jmp rcx
movsxd rsi, dword [rsp + 0x60]
mov r8, qword [rbp - 0x68]
mov rax, rsi
inc esi
shl rax, 5
mov word [rbp + 0x70], di
mov dword [rsp + 0x60], esi
cmp byte [rbp + 0x2418], dil
je 0x14000366b
mov rcx, qword [r8]
jmp 0x14000366f
mov rcx, qword [r13 + 8]
mov qword [rbp + rax + 0xa0], rcx
mov r10d, 1
mov ecx, dword [rsp + 0x64]
mov dword [rbp + rax + 0xb0], r10d
mov eax, ecx
sub eax, 5
je 0x140003c8e
sub eax, r10d
je 0x140003ace
sub eax, r10d
je 0x140003ace
sub eax, r10d
je 0x140003ace
cmp eax, r10d
je 0x140003802
mov r15, qword [rbp - 0x68]
movzx eax, byte [r15 + 8]
cmp al, 0xa
je 0x140003736
cmp al, 0x19
jne 0x140003707
mov rax, qword [rbp - 0x74]
lea rdx, [rbp + 0x160]
mov qword [r14 + 0x50], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x160]
lea r9, [0x140000000]
sub dword [r14 + 0x50], eax
mov r10d, 1
mov eax, dword [rbp + 0x164]
sub dword [r14 + 0x54], eax
mov ecx, dword [rsp + 0x64]
movsxd rax, esi
lea rdx, [rbp + 0xa0]
shl rax, 5
inc esi
add rdx, rax
mov dword [r14 + 0x44], ecx
cmp ecx, 5
jae 0x1400037c0
mov eax, ecx
mov rcx, qword [r9 + rax*8 + 0x111e18]
jmp 0x1400037d1
cmp cl, 0x49
jne 0x140003707
lea rax, [rbp + 0x70]
bt ecx, 8
jae 0x14000374c
mov eax, 0x53
jmp 0x140003757
bt ecx, 9
jae 0x14000375f
mov eax, reloc.WSOCK32.dll_WSAStartup
mov word [rbp + 0x70], ax
lea rax, [rbp + 0x72]
bt ecx, 0xa
jae 0x14000376c
mov edx, 0x46
jmp 0x140003777
bt ecx, 0xb
jae 0x14000377e
mov edx, 0x66
mov word [rax], dx
add rax, 2
bt ecx, 0xc
jae 0x14000378b
mov ecx, 0x43
jmp 0x140003796
bt ecx, 0xd
jae 0x14000379d
mov ecx, WSAAsyncSelect
mov word [rax], cx
add rax, 2
mov word [rax], di
lea rdx, [rbp + 0xa0]
movsxd rax, esi
mov ecx, 0x49
shl rax, 5
add rdx, rax
mov dword [rsp + 0x64], ecx
inc esi
mov dword [r14 + 0x44], ecx
movzx eax, cl
lea rcx, [0x14012d6a4]
mov word [0x14012d6a4], ax
mov dword [rdx + 0x10], edi
mov rdi, qword [rsp + 0x50]
mov qword [rdx], rcx
mov ecx, dword [rsp + 0x64]
movsxd rax, esi
shl rax, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rax + 0xb0], r10d
mov qword [rbp + rax + 0xa0], rdi
jmp 0x140003b9b
cmp qword [rsp + 0x50], rdi
mov edx, 3
mov qword [rsp + 0x50], rdi
cmovne edx, r10d
mov dword [r14 + 0x44], edx
mov rax, qword [rbp - 0x74]
mov qword [r14 + 0x50], rax
test r8, r8
je 0x1400039e0
test r15, r15
mov r15, qword [rbp - 0x68]
je 0x140003940
movzx ecx, byte [r15 + 8]
mov dword [rbp - 0x38], 0x80000000
sub ecx, 9
je 0x1400038bf
sub ecx, r10d
je 0x140003890
sub ecx, r10d
je 0x140003865
cmp ecx, 6
jne 0x1400038ee
xor r8d, r8d
mov edx, 0x419
jmp 0x1400038e1
mov rcx, qword [r15]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400038ee
mov qword [rbp - 0x38], rax
mov edx, 0x1104
mov r8d, 1
jmp 0x1400038e1
mov rcx, qword [r15]
mov r9, r10
mov edx, 0x100c
mov r8, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, eax
cmp r8, 0xffffffffffffffff
je 0x1400038ee
mov dword [rbp - 0x38], 2
mov edx, 0x100e
jmp 0x1400038e1
mov rcx, qword [r15]
xor r9d, r9d
xor r8d, r8d
mov edx, OleCreatePictureIndirect
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
je 0x1400038ee
mov r8, rax
mov edx, 0x198
mov rcx, qword [r15]
lea r9, [rbp - 0x38]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rbp - 0x38], 0x80000000
mov rcx, qword [r15]
jne 0x140003906
lea rdx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x140003918
mov r9d, 2
lea r8, [rbp - 0x38]
xor edx, edx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rbp - 0x38]
mov ecx, dword [rbp - 0x34]
mov dword [r14 + 0x50], eax
mov eax, dword [rbp - 0x2c]
sub eax, ecx
jns 0x14000392b
inc eax
sar eax, 1
mov r10d, 1
add eax, 2
add eax, ecx
mov dword [r14 + 0x54], eax
mov edx, dword [r14 + 0x44]
movzx ecx, byte [r15 + 8]
sub ecx, 9
je 0x1400039d3
sub ecx, 1
je 0x1400039af
cmp ecx, 1
jne 0x1400039e4
mov rcx, qword [r15]
cmp edx, 1
jne 0x14000397f
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov qword [rsp + 0x50], rdi
jmp 0x1400039e4
mov rax, qword [rbp - 0x74]
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, qword [r15]
lea r9, [rbp + 0x10]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov qword [rsp + 0x50], rdi
jmp 0x1400039e4
mov r9, r10
mov edx, 0x100c
mov r8, 0xffffffffffffffff
mov rcx, qword [r15]
call qword [sym.imp.USER32.dll_SendMessageW]
inc eax
movsxd rdi, eax
mov qword [rsp + 0x50], rdi
jmp 0x1400039e4
xor r9d, r9d
mov edx, OleCreatePictureIndirect
xor r8d, r8d
jmp 0x1400039be
mov r15, qword [rbp - 0x68]
mov rcx, qword [r13 + 8]
lea rdx, [rbp + 0x170]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x170]
lea r8d, [rsi + 1]
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0x174]
sub dword [r14 + 0x54], eax
movsxd rdx, esi
shl rdx, 5
test r15, r15
je 0x140003a1e
mov rcx, qword [r15]
jmp 0x140003a25
lea rcx, [0x1400ef7e4]
xor r9d, r9d
lea esi, [r8 + 1]
mov r10d, 1
test r15, r15
mov eax, r9d
setne al
mov dword [rbp + rdx + 0xb0], eax
mov qword [rbp + rdx + 0xa0], rcx
mov ecx, r9d
movsxd rdx, esi
inc esi
shl rdx, 5
movsxd rax, r8d
shl rax, 5
mov dword [rbp + rax + 0xb0], r10d
mov qword [rbp + rax + 0xa0], rdi
mov eax, dword [r14 + 0x44]
cmp eax, 3
mov dword [rbp + rdx + 0xb0], r10d
sete cl
mov qword [rbp + rdx + 0xa0], rcx
movsxd rax, dword [r14 + 0x50]
movsxd rcx, esi
inc esi
shl rcx, 5
mov dword [rbp + rcx + 0xb0], r10d
mov qword [rbp + rcx + 0xa0], rax
movsxd rax, dword [r14 + 0x54]
movsxd rcx, esi
shl rcx, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rcx + 0xb0], r10d
mov qword [rbp + rcx + 0xa0], rax
mov ecx, dword [rsp + 0x64]
jmp 0x140003b9e
mov dword [r14 + 0x44], r10d
cmp ecx, 8
jne 0x140003b92
mov r15d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
movsxd rax, esi
inc esi
shl rax, 5
mov dword [r14 + 0x50], r15d
movsxd rdi, esi
inc esi
shl rdi, 5
mov dword [rbp + rax + 0xb0], r10d
mov qword [rbp + rax + 0xa0], rcx
cmp byte [r13 + 0x110], 0
movzx eax, r15w
je 0x140003b33
mov r8d, dword [0x14012af94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
cdqe
mov qword [rbp + rdi + 0xa0], rax
mov eax, r15d
mov dword [rbp + rdi + 0xb0], r10d
movsxd rdi, esi
inc esi
shl rdi, 5
shr eax, 0x10
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x60], esi
je 0x140003b7c
mov r8d, dword [0x14012af94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
mov ecx, dword [rsp + 0x64]
cdqe
mov qword [rbp + rdi + 0xa0], rax
mov dword [rbp + rdi + 0xb0], r10d
mov r15, qword [rbp - 0x68]
mov rdi, qword [rsp + 0x50]
xor r9d, r9d
cmp byte [rbp + 0x2418], 0
je 0x140003e79
cmp byte [r15 + 8], 0x17
jne 0x140003e79
xor edx, edx
lea rcx, [rbp + 0x2e8]
mov r8d, 0x10b0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r15]
lea eax, [rdi - 1]
lea r9, [rbp + 0x2e0]
mov dword [rbp + 0x2e4], eax
xor r8d, r8d
mov dword [rbp + 0x2e0], ntohs
mov edx, 0x703
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140003edb
cmp word [rbp + 0x350], 0
lea rax, [rbp + 0x2f0]
mov rcx, qword [0x140127a38]
lea rdx, [rbp + 0x350]
cmove rdx, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [r9 - 1]
call fcn.1400d3350
mov rdi, qword [0x140127a38]
inc dword [rsp + 0x60]
movsxd rsi, esi
shl rsi, 5
cmp byte [rdi + 0x23], 0
jne 0x140003c4c
mov rdi, qword [rdi + 0x10]
test byte [rdi + 0x21], 8
je 0x140003c5a
mov rcx, rdi
call fcn.140001620
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x140003ddc
test byte [rdi + 0x21], 4
je 0x140003c74
mov rdx, rdi
call fcn.140060a30
mov rcx, qword [rdi + 8]
xor eax, eax
mov dword [rbp + rsi + 0xb0], eax
mov qword [rbp + rsi + 0xa0], rcx
jmp 0x140003edb
mov dword [r14 + 0x44], 5
lea rdx, [rbp + 0x180]
mov rax, qword [rbp - 0x74]
mov qword [r14 + 0x50], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x180]
mov edx, 0xffffffec
sub dword [r14 + 0x50], eax
mov eax, dword [rbp + 0x184]
sub dword [r14 + 0x54], eax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
and eax, 0xffffffef
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
movsxd rdi, esi
mov rcx, r12
shl rdi, 5
inc esi
call fcn.1400a37f0
mov r15, qword [rbp - 0x68]
mov dword [rbp + rdi + 0xb0], 6
mov qword [rbp + rdi + 0xa0], rax
test r15, r15
je 0x140003d1f
mov rdx, qword [r15]
mov r8d, 1
jmp 0x140003d2b
xor eax, eax
lea rdx, [0x1400ef7e4]
mov r8d, eax
mov ecx, dword [rsp + 0x60]
add ecx, 2
movsxd rax, esi
shl rax, 5
movsxd rdi, ecx
shl rdi, 5
lea esi, [rcx + 1]
mov dword [rbp + rax + 0xb0], r8d
mov qword [rbp + rax + 0xa0], rdx
cmp byte [r13 + 0x110], 0
mov eax, dword [r14 + 0x50]
je 0x140003d75
mov r8d, dword [0x14012af94]
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
cdqe
mov r10d, 1
mov dword [rbp + rdi + 0xb0], r10d
mov qword [rbp + rdi + 0xa0], rax
mov eax, dword [r14 + 0x54]
movsxd rdi, esi
inc esi
shl rdi, 5
cmp byte [r13 + 0x110], 0
mov dword [rsp + 0x60], esi
je 0x140003dc1
mov r8d, dword [0x14012af94]
lea edx, [r10 + 0x5f]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r10d, 1
mov ecx, dword [rsp + 0x64]
cdqe
mov qword [rbp + rdi + 0xa0], rax
mov dword [rbp + rdi + 0xb0], r10d
jmp 0x140003b96
cmp al, 2
jne 0x140003e5f
mov rcx, qword [0x14012bc60]
test rcx, rcx
jne 0x140003e66
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140003e2e
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rcx, [0x1400ef7e4]
lea rax, [0x1400ef7d8]
cmovne rcx, rax
xor eax, eax
mov dword [rbp + rsi + 0xb0], eax
mov qword [rbp + rsi + 0xa0], rcx
jmp 0x140003edb
xor edx, edx
call fcn.140007250
mov edx, 0xffffffff
lea rcx, [0x1400ef7e4]
cmp rax, rdx
cmovne rcx, qword [0x14012bc58]
xor eax, eax
mov dword [rbp + rsi + 0xb0], eax
mov qword [rbp + rsi + 0xa0], rcx
jmp 0x140003edb
lea rcx, [0x140129f30]
xor eax, eax
mov qword [rbp + rsi + 0xa0], rcx
mov dword [rbp + rsi + 0xb0], eax
jmp 0x140003edb
cmp word [rbp + 0x70], 0
je 0x140003ea1
movsxd rax, esi
lea rdx, [rbp + 0x70]
shl rax, 5
inc esi
mov dword [rsp + 0x60], esi
mov dword [rbp + rax + 0xb0], r9d
mov qword [rbp + rax + 0xa0], rdx
cmp ecx, 8
je 0x140003ec9
cmp ecx, 5
je 0x140003ec9
mov rcx, qword [0x140127a38]
lea rdx, [rbp + 0x70]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d3350
jmp 0x140003edb
mov rcx, qword [0x140127a38]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rdi
call fcn.140001580
mov rax, qword [r13 + 8]
mov rdi, qword [rbp - 0x20]
movzx esi, byte [rbp + 0x2418]
mov qword [r14 + 0xf8], rax
add dword [r13 + 0x34], 2
mov eax, dword [rbp - 0x18]
mov dword [r14 + 0x70], eax
mov rax, qword [rsp + 0x50]
mov qword [r14 + 0x48], rax
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x58], r13
test rdi, rdi
je 0x140003f18
mov byte [rdi], 1
jmp 0x140003f22
test sil, sil
je 0x140003f22
or byte [r15 + 9], 4
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
jne 0x140003f3e
call fcn.1400079d0
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x140003f58
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
add rcx, 0x18
lea rax, [0x1400ef7f8]
mov qword [0x140126968], rcx
lea r9, [rbp + 0xa0]
xor r14d, r14d
lea r8, str.call
mov dword [rsp + 0x30], r14d
mov rdx, rbx
mov qword [rcx + 8], rax
lea rax, [rbp + 0x90]
mov qword [rcx], r14
mov dword [rcx + 0x10], r14d
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1400b8b70
sub qword [0x140126968], 0x18
cmp qword [r13 + 8], r14
je 0x14000404a
mov eax, dword [rsp + 0x64]
test rdi, rdi
je 0x140003ffa
mov byte [rdi], r14b
cmp eax, 6
jne 0x140004004
cmp qword [rbp + 0x90], r14
jne 0x14000404a
mov rcx, rbx
call fcn.1400bcce0
test eax, eax
jne 0x140003fe7
test rbx, rbx
jne 0x14000404a
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x14000404a
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14000404a
test sil, sil
je 0x140004004
and byte [r15 + 9], 0xfb
cmp eax, 5
jne 0x14000404a
mov rcx, qword [rbp + 0xc0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
mov qword [r13 + 0xa0], r14
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffec
or eax, 0x10
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, 0xffffffff
add dword [r13 + 0x34], eax
jne 0x1400046f7
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 0x130
mov rcx, r13
call fcn.1400ec0a0
jmp 0x1400046f7
test r13, r13
je 0x14000409b
mov rax, qword [r13 + 8]
mov qword [r14 + 0xf8], rax
mov eax, 1
mov dword [r14 + 0x44], eax
add dword [r13 + 0x34], 2
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x58], r13
lea rax, [0x14012b6a8]
mov dword [rbp + 0x20], edi
lea rcx, [0x14012afc0]
mov qword [rbp + 0x10], rax
call fcn.14007af20
mov dword [rbp + 0x60], edi
lea ecx, [rax + 1]
mov eax, 1
mov qword [rbp + 0x30], rcx
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
mov dword [rbp + 0x40], eax
lea rax, [0x14012b8b2]
mov qword [rbp + 0x50], rax
jne 0x1400040ee
call fcn.1400079d0
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x140004108
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
add rcx, 0x18
mov dword [rsp + 0x30], edi
mov qword [0x140126968], rcx
lea rax, str.Menu
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x10]
lea r8, str.call
mov dword [rsp + 0x20], 3
mov qword [rcx], rdi
mov rdx, rbx
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edi
mov rcx, rbx
call fcn.1400b8b70
sub qword [0x140126968], 0x18
test r13, r13
je 0x1400046f7
mov eax, 0xffffffff
add dword [r13 + 0x34], eax
jne 0x1400046f7
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 0x130
mov rcx, r13
call fcn.1400ec0a0
jmp 0x1400046f7
mov rax, qword [rbp - 0x50]
mov rbx, qword [rbp]
mov qword [r14 + 0xf8], rax
movzx eax, byte [rbx + 0x35]
mov byte [r14 + 0x136], al
mov r9, qword [rbx]
mov rcx, r9
call fcn.1400bcce0
test eax, eax
je 0x1400041b5
cmp eax, 1
jne 0x1400041c3
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x1400041c3
movzx ecx, byte [rax]
jmp 0x1400041c5
xor cl, cl
movzx eax, byte [rbx + 0x39]
cmp byte [rbx + 0x38], al
jb 0x1400041e8
add cl, 0x32
cmp cl, 0x14
ja 0x1400046f7
mov eax, 0x10fc01
bt eax, ecx
jae 0x1400046f7
mov byte [0x14012bb6e], dil
xor r9d, r9d
inc byte [rbx + 0x38]
xor r8d, r8d
mov rdx, qword [0x14012bac0]
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.1400bcc20
dec byte [rbx + 0x38]
jmp 0x1400046f7
call qword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x140004246
mov ecx, ntohs
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14000423f
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14000423f
lea edx, [rax + 2]
jmp 0x140004249
mov edx, 1
jmp 0x140004249
mov rdx, rdi
mov rcx, qword [0x140127a38]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [r14 + 0x48], rdx
call fcn.140001580
mov rax, qword [r14 + 0x48]
mov ebx, 1
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x10], rax
mov byte [0x14012bb30], bl
jne 0x14000428e
call fcn.1400079d0
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x1400042a8
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
add rcx, 0x18
lea rax, [0x1400ef868]
mov qword [0x140126968], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], edi
mov rax, qword [0x14012bb18]
test rax, rax
je 0x1400042df
mov rcx, rax
call fcn.140001880
mov rax, qword [0x14012bb18]
cmp qword [rsp + 0x78], rdi
jne 0x140004303
test rax, rax
lea rdx, [rbp + 0x10]
mov r9d, edi
lea rcx, [0x14012bae8]
sete r9b
mov r8d, ebx
call fcn.1400bcd90
sub qword [0x140126968], 0x18
mov byte [0x14012bb30], dil
jmp 0x1400046f7
mov rdi, qword [rbp - 0x48]
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
mov dword [rbp + 0x20], 6
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x10], rax
jne 0x140004346
call fcn.1400079d0
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x140004360
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x140126968], rcx
lea r9, [rbp + 0x10]
xor esi, esi
lea r8, str.call
mov dword [rsp + 0x30], esi
mov rdx, rbx
mov qword [rcx + 8], rax
mov eax, 1
mov qword [rcx], rsi
mov dword [rcx + 0x10], esi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call fcn.1400b8b70
sub qword [0x140126968], 0x18
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x1400046f9
mov rcx, qword [rbp - 0x80]
mov edx, 1
mov rax, qword [rbp - 0x48]
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], edx
mov dword [rbp + 0x60], edx
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
movzx eax, cl
sar rcx, 0x10
mov qword [rbp + 0x30], rax
movzx eax, cx
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126970]
mov qword [rbp + 0x50], rax
jne 0x14000440d
call fcn.1400079d0
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x140004427
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 3
add rcx, 0x18
lea rax, str.InputHook
mov qword [0x140126968], rcx
lea r8, str.call
mov rdx, rbx
mov dword [rcx + 0x10], edi
mov qword [rcx + 8], rax
mov qword [rcx], rdi
mov rcx, rbx
call fcn.1400b8b70
sub qword [0x140126968], 0x18
jmp 0x1400046f7
mov rax, qword [rbp - 0x80]
mov rcx, qword [0x140126968]
mov word [rbp - 0x14], ax
sar rax, 0x10
cmp rcx, qword [0x140126970]
mov word [rbp - 0x12], ax
mov rax, qword [rbp - 0x48]
mov word [rbp - 0x10], di
mov dword [rbp + 0x20], 6
mov dword [rbp + 0x40], edi
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x14]
mov qword [rbp + 0x30], rax
jne 0x1400044c5
call fcn.1400079d0
mov rcx, qword [0x140126968]
cmp rcx, qword [0x140126960]
jb 0x1400044df
mov rax, qword [0x14012b690]
mov qword [rcx], rax
mov rcx, qword [0x140126968]
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
jmp 0x14000443c
mov rax, qword [rbp - 8]
movzx eax, byte [rax + 0x10]
add al, 0x64
cmp al, 3
ja 0x14000450e
mov eax, dword [rbp - 0x80]
mov qword [r14 + 0x48], rax
cmp byte [0x14012d5cc], dil
mov r15, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x50]
mov qword [r14 + 0xf8], rbx
movzx eax, byte [r15 + 0x24]
mov byte [r14 + 0x136], al
jne 0x1400046f7
cmp dword [0x140128aa4], edi
jne 0x14000454a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140128aa4], eax
inc dword [0x14012d5c8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [0x14012d5c8]
mov ecx, eax
sub ecx, dword [0x140128aa4]
cmp r9d, dword [0x140125c34]
mov r8d, dword [0x140125c30]
mov dword [0x140128aa0], eax
jbe 0x140004589
cmp ecx, r8d
jae 0x140004589
mov ebx, 1
mov edx, ebx
jmp 0x140004590
mov edx, edi
mov ebx, 1
test edx, edx
je 0x140004676
mov dword [rsp + 0x20], ecx
lea r8, str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea rcx, [rbp + 0x13a0]
mov edx, 0x800
call fcn.1400ce300
movzx edx, word [0x140128a9c]
mov r9d, edi
cmp di, dx
jae 0x140004613
mov r8, rdi
nop word [rax + rax]
mov rax, qword [0x140128a88]
mov rcx, qword [rax + r8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x140004604
nop dword [rax]
nop dword [rax + rax]
mov byte [rax + 0x27], dil
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400045f0
movzx edx, word [0x140128a9c]
inc r9d
movzx eax, dx
add r8, 8
cmp r9d, eax
jl 0x1400045d0
xor r8d, r8d
mov byte [0x14012d5cc], 1
movaps xmm3, xmm6
mov dword [0x1401241f4], edi
lea rcx, [rbp + 0x13a0]
mov qword [rsp + 0x20], rdi
lea edx, [r8 + 4]
call fcn.1400d58f0
cmp eax, 7
jne 0x140004652
xor r8d, r8d
lea edx, [rax - 3]
lea rcx, [0x14012afc0]
call fcn.140038210
mov eax, dword [0x140128aa0]
mov dword [0x140128aa4], eax
mov dword [0x1401241f4], ebx
mov byte [0x14012d5cc], dil
mov dword [0x14012d5c8], edi
jmp 0x1400046f7
cmp ecx, r8d
jbe 0x140004687
mov dword [0x14012d5c8], edi
mov dword [0x140128aa4], eax
mov r14, qword [rbp - 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, r15
movzx eax, byte [r14 + 0xf]
mov byte [0x14012bb6e], al
inc byte [r15 + 0x22]
mov rdx, qword [0x14012bac0]
call fcn.1400bcc20
dec byte [r15 + 0x22]
test eax, eax
jne 0x1400046c2
mov byte [r15 + 0x27], dil
jmp 0x1400046f7
cmp byte [r15 + 0x27], dil
je 0x1400046f7
mov byte [r15 + 0x27], dil
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [r15 + 0x18]
cmp eax, 0x3e8
ja 0x1400046f7
movzx r8d, word [r14 + 4]
xor r9d, r9d
mov rcx, qword [0x140127a60]
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
lea rcx, [rbp + 0x1e0]
call fcn.140005730
cmp dword [rbp + 0x2408], 0
movsxd r15, dword [rbp + 0x2400]
mov r12d, dword [rsp + 0x44]
mov rbx, r15
movzx r14d, byte [rbp + 0x2410]
mov edi, dword [rsp + 0x40]
je 0x140001c80
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r14b, r14b
jne 0x140004755
movsxd r15, dword [rbp + 0x2400]
mov ecx, dword [rbp - 0x60]
mov rbx, r15
sub ecx, eax
add ecx, r15d
cmp ecx, 5
jg 0x140001c80
jmp 0x14000475c
mov r15d, dword [rbp + 0x2400]
movsxd rbx, r15d
cmp rbx, 0xffffffffffffffff
jle 0x140004772
mov qword [0x14012bbb0], rsi
mov dword [0x14012bbc0], eax
mov r14b, 1
mov dword [0x14012bbc4], eax
mov byte [rbp + 0x2410], r14b
mov byte [rsp + 0x48], 1
mov r12d, dword [rsp + 0x44]
jmp 0x140001c75
mov rcx, qword [0x140124200]
mov byte [rcx + 0x128], 0
jmp 0x1400047a8
mov rcx, qword [0x140124200]
mov rdx, qword [0x140127a20]
test rdx, rdx
je 0x1400047e5
mov rcx, qword [0x140127a60]
lea r8, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov r12d, dword [rsp + 0x44]
movzx r14d, byte [rbp + 0x2410]
movsxd rbx, r15d
test eax, eax
jne 0x140001c80
mov rcx, qword [0x140124200]
mov byte [rcx + 0x128], 1
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x124], eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140002bc3
cmp rbx, 0xffffffffffffffff
jle 0x140004828
xor ebx, ebx
mov dword [0x14012bbc0], eax
mov qword [0x14012bbb0], rbx
jmp 0x14000482a
xor ebx, ebx
cmp byte [rsp + 0x49], 0
mov dword [0x14012bbc4], eax
movzx eax, byte [0x14012787f]
cmovne eax, ebx
cmp byte [rsp + 0x4a], 0
mov byte [0x14012787f], al
je 0x140002abb
mov eax, dword [0x140127a68]
dec eax
mov dword [0x140127a68], eax
test r15d, r15d
jle 0x140002abb
test eax, eax
jne 0x140002abb
cmp dword [0x14012bb4c], eax
jne 0x140002abb
cmp dword [0x140128a84], eax
jne 0x140002abb
cmp byte [0x14012787e], al
je 0x140002abb
mov rcx, qword [0x140127a60]
lea edx, [rax + 9]
call qword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x14012787e]
test eax, eax
cmovne ecx, ebx
jmp 0x140002ab5