Function at 0x140063220
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x140129080]
xor rax, rsp
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [0x14020b610], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea rcx, [rsp + 0x20]
mov dword [0x14020b388], eax
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [0x14020fe81], 0
xorps xmm6, xmm6
mov ebx, dword [rsp + 0x20]
mov esi, dword [rsp + 0x24]
je 0x14006352f
mov ecx, dword [str.15d8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400632c9
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x1400632b9
cmp byte [0x1401db13d], 0
je 0x1400632c9
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x1400632c9
cmp byte [0x1401db13d], 0
je 0x1400632c9
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [reloc.WLDAP32.dll_Ordinal_50]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140063304
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x1400632f4
cmp byte [0x1401db13d], 0
je 0x140063304
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x140063304
cmp byte [0x1401db13d], 0
je 0x140063304
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [0x1401d8d00]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14006333f
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x14006332f
cmp byte [0x1401db13d], 0
je 0x14006333f
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x14006333f
cmp byte [0x1401db13d], 0
je 0x14006333f
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [0x1401d8e34]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14006337a
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x14006336a
cmp byte [0x1401db13d], 0
je 0x14006337a
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x14006337a
cmp byte [0x1401db13d], 0
je 0x14006337a
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [0x1401d8dac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400633b5
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x1400633a5
cmp byte [0x1401db13d], 0
je 0x1400633b5
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x1400633b5
cmp byte [0x1401db13d], 0
je 0x1400633b5
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [0x1401d9080]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400633f0
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x1400633e0
cmp byte [0x1401db13d], 0
je 0x1400633f0
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x1400633f0
cmp byte [0x1401db13d], 0
je 0x1400633f0
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [0x1401d8e2c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14006342b
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x14006341b
cmp byte [0x1401db13d], 0
je 0x14006342b
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x14006342b
cmp byte [0x1401db13d], 0
je 0x14006342b
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [0x1401d8db8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140063466
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x140063456
cmp byte [0x1401db13d], 0
je 0x140063466
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x140063466
cmp byte [0x1401db13d], 0
je 0x140063466
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [reloc.WS2_32.dll_gethostname]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400634a1
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x140063491
cmp byte [0x1401db13d], 0
je 0x1400634a1
mov byte [reloc.WS2_32.dll_accept], 1
jmp 0x1400634a1
cmp byte [0x1401db13d], 0
je 0x1400634a1
mov byte [reloc.WS2_32.dll_accept], 0
mov eax, dword [0x14020b610]
cdq
sub eax, edx
sar eax, 1
cmp ebx, eax
jne 0x1400634d2
mov eax, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x1400634d2
mov byte [0x1401db13d], 1
mov dword [0x14020fd78], 0
jmp 0x1400634e1
movss xmm0, dword [0x14020fd78]
ucomiss xmm0, xmm6
jp 0x1400634f9
jne 0x1400634f9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [0x14020fd78], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movss xmm0, dword [0x14020fd78]
xorps xmm1, xmm1
addss xmm0, dword [0x140116870]
mov eax, eax
cvtsi2ss xmm1, rax
comiss xmm1, xmm0
jbe 0x14006352f
mov byte [0x1401db13d], 0
mov dword [0x14020fd78], 0
cmp byte [0x14020b958], 0
jne 0x140063b43
cmp dword [reloc.WS2_32.dll_accept], 0x3c
jg 0x14006355a
cmp dword [0x14020fd88], 0
jne 0x14006355a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14020fd88], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x3e8
cdq
idiv dword [reloc.WS2_32.dll_accept]
add eax, dword [0x14020fd88]
cmp ecx, eax
jbe 0x1400639c2
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14006392d
cmp byte [0x14020fdf4], 0
je 0x1400635a1
mov byte [0x14020b38f], 1
cmp byte [0x14020fe5d], 0
je 0x1400635ba
cmp byte [0x14020fde6], 0
jne 0x1400635ba
mov byte [reloc.WS2_32.dll_accept], 0
cmp byte [0x14020fe81], 0
jne 0x1400635ca
mov byte [reloc.WS2_32.dll_accept], 1
cmp byte [0x14020fdf0], 0
je 0x14006392d
cmp byte [0x14020fdcf], 0
je 0x14006392d
cmp byte [0x1401da0a5], 0
je 0x14006392d
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14006392d
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14006392d
cmp byte [0x14020fbad], 0
je 0x140063670
mov eax, dword [0x14020b610]
mov r8d, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cmp ebx, eax
jne 0x140063642
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x140063642
mov dword [reloc.WS2_32.dll_accept], 1
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x140063667
cmp ebx, ecx
je 0x140063667
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
je 0x140063667
mov dword [reloc.WS2_32.dll_accept], 1
jmp 0x140063670
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x1400636aa
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400636aa
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400636aa
xor r9d, r9d
xor r8d, r8d
mov edx, 0x201
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x202
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [0x14020fde4], 0
je 0x140063752
cmp byte [0x14020fa9e], 0
je 0x140063752
cmp byte [0x14020fbad], 0
jne 0x140063752
movss xmm0, dword [0x14020fdac]
ucomiss xmm0, xmm6
jp 0x1400636f8
jne 0x1400636f8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [0x14020fdac], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movd xmm0, dword [0x1401d8e28]
xorps xmm1, xmm1
cvtdq2ps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm1, rax
addss xmm0, dword [0x14020fdac]
comiss xmm1, xmm0
jbe 0x140063752
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x14020fdac], 0
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x140063807
cmp byte [0x14020fde4], 0
je 0x140063807
cmp byte [0x14020fa9e], 0
je 0x140063807
cmp byte [0x14020fbad], 0
je 0x140063807
movss xmm0, dword [0x14020fdac]
ucomiss xmm0, xmm6
jp 0x1400637ad
jne 0x1400637ad
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [0x14020fdac], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movd xmm0, dword [0x1401d8e28]
xorps xmm1, xmm1
cvtdq2ps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm1, rax
addss xmm0, dword [0x14020fdac]
comiss xmm1, xmm0
jbe 0x140063807
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x14020fdac], 0
cmp byte [0x14020b95e], 0
jne 0x14006392d
cmp byte [0x14020fa9e], 0
je 0x14006392d
cmp byte [0x14020fdf4], 0
jne 0x1400638fa
mov ecx, dword [reloc.XINPUT1_3.dll_Ordinal_2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400638f1
cmp dword [0x14020fda4], 5
jle 0x140063860
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
movss xmm0, dword [0x14020fd98]
ucomiss xmm0, xmm6
jp 0x140063887
jne 0x140063887
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [0x14020fd98], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movd xmm0, dword [0x14020fda4]
xorps xmm1, xmm1
cvtdq2ps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm1, rax
addss xmm0, dword [0x14020fd98]
comiss xmm1, xmm0
jbe 0x1400638e1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x14020fd98], 0
cmp byte [0x14020fbab], 0
je 0x1400638f1
mov byte [reloc.WS2_32.dll_accept], 0
cmp byte [0x14020b95e], 0
jne 0x14006392d
cmp byte [0x14020fa9e], 0
je 0x14006392d
mov ecx, dword [reloc.XINPUT1_3.dll_Ordinal_2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14006392d
cmp byte [0x14020fbab], al
je 0x140063923
mov byte [reloc.WS2_32.dll_accept], 1
mov dword [0x14020fd98], 0
xor ebx, ebx
cmp byte [0x14020fdf0], bl
mov dword [0x14020fd88], ebx
je 0x1400639c2
cmp byte [0x14020fdcf], bl
je 0x1400639c2
cmp byte [0x1401da0a5], bl
je 0x1400639c2
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140063993
cmp byte [0x14020fe5d], bl
je 0x140063971
mov byte [reloc.WS2_32.dll_accept], 1
cmp byte [0x14020fa9e], bl
je 0x14006397f
mov dword [0x14020fd98], ebx
cmp byte [0x14020fde4], bl
je 0x14006398d
mov dword [0x14020fdac], ebx
mov dword [reloc.WS2_32.dll_accept], ebx
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400639c2
cmp byte [0x1401db19f], bl
je 0x1400639b1
call fcn.1400630a0
jmp 0x1400639bc
mov ecx, reloc.WLDAP32.dll_Ordinal_30
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [reloc.WS2_32.dll_accept], ebx
cmp byte [0x14020fdf4], 0
je 0x140063ac5
cmp byte [0x14020b38f], 0
je 0x140063ac5
cmp byte [0x14020fa9e], 0
je 0x140063ac5
cmp byte [0x14020b95e], 0
jne 0x140063ac5
mov ecx, dword [reloc.XINPUT1_3.dll_Ordinal_2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140063aae
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140210020], eax
jle 0x140063a54
lea rcx, [0x140210020]
call fcn.1400d4400
cmp dword [0x140210020], 0xffffffff
jne 0x140063a54
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x140210020]
mov dword [0x14021002c], eax
call fcn.1400d4394
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14021002c]
cmp eax, dword [0x14020fda4]
jbe 0x140063a9c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14021002c], eax
cmp byte [0x14020fbab], 0
je 0x140063ac5
mov byte [reloc.WS2_32.dll_accept], 0
jmp 0x140063ac5
cmp byte [0x14020fbab], 0
mov byte [0x14020b38f], 0
je 0x140063ac5
mov byte [reloc.WS2_32.dll_accept], 1
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x140063b36
cmp byte [0x14020fe81], 0
je 0x140063b36
cmp byte [0x14020fdf0], 0
je 0x140063b36
cmp byte [0x14020fdcf], 0
je 0x140063b36
cmp byte [0x1401da0a5], 0
je 0x140063b36
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140063b36
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140063b29
cmp byte [0x14020fbaa], 0
je 0x140063b29
xor r9d, r9d
xor r8d, r8d
mov edx, 0x201
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor al, al
mov byte [0x14020fbaa], al
jmp 0x140063d1c
mov al, 1
mov byte [0x14020fbaa], al
jmp 0x140063d1c
cmp byte [0x1401da0a5], 0
je 0x140063d1c
cmp byte [0x14020fdf0], 0
je 0x140063d1c
cmp dword [reloc.WS2_32.dll_accept], 0x3c
jg 0x140063b7b
cmp dword [0x14020fd88], 0
jne 0x140063b7b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14020fd88], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x3e8
cdq
idiv dword [reloc.WS2_32.dll_accept]
add eax, dword [0x14020fd88]
cmp ecx, eax
jbe 0x140063c00
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140063bf8
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140063bf8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x201
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x202
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140063bf8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x202
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor ebx, ebx
mov dword [0x14020fd88], ebx
cmp byte [0x14020fa9e], 0
je 0x140063d1c
cmp byte [0x14020fde4], 0
jne 0x140063c81
mov ecx, dword [reloc.XINPUT1_3.dll_Ordinal_2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140063c81
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movd xmm0, dword [0x14020fda4]
xorps xmm1, xmm1
cvtdq2ps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm1, rax
addss xmm0, dword [0x14020fd98]
comiss xmm1, xmm0
jbe 0x140063c81
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x14020fd98], 0
cmp byte [0x14020fa9e], 0
je 0x140063d1c
cmp byte [0x14020fde4], 0
je 0x140063d1c
movss xmm0, dword [0x14020fdac]
ucomiss xmm0, xmm6
jp 0x140063cc2
jne 0x140063cc2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [0x14020fdac], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movd xmm0, dword [0x1401d8e28]
xorps xmm1, xmm1
cvtdq2ps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm1, rax
addss xmm0, dword [0x14020fdac]
comiss xmm1, xmm0
jbe 0x140063d1c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x14020fdac], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d4090
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret