Function at 0x14001ecb0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov word [rax + 0x10], dx
push rbx
push rbp
push rdi
push r13
push r14
sub rsp, 0x80
mov qword [rax + 0x20], rsi
mov qword [rax - 0x30], r12
movzx r12d, cl
mov qword [rax - 0x38], r15
movzx edi, r8b
lea eax, [r12 - 1]
or dil, r9b
movzx ebp, r9b
mov byte [rsp + 0xc0], r9b
movzx esi, dx
mov byte [rsp + 0xb0], dil
cmp al, 5
ja 0x14001ed01
cmp cl, 3
jne 0x14001ed0a
lea eax, [r12 + 0x66]
cmp al, 5
ja 0x14001ed0f
mov r15b, 1
jmp 0x14001ed12
xor r15b, r15b
mov eax, dword [rsp + 0xd0]
mov r13, qword [rsp + 0xe8]
movzx ebx, byte [rsp + 0xe0]
mov r14d, 0x8000
test eax, eax
jle 0x14001f019
mov ebp, dword [rsp + 0xd8]
mov r14d, eax
cmp dword [0x14012b780], 0
jne 0x14001edab
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rcx, qword [0x1401255c8]
sub eax, dword [0x14012d1a4]
cmp eax, dword [rcx + 0x118]
jbe 0x14001edb2
xor eax, eax
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.DLL_PeekMessageW]
test eax, eax
je 0x14001ed9f
xor eax, eax
or ecx, 0xffffffff
lea edx, [rax + 1]
mov dword [0x140125594], eax
call fcn.140001b60
mov dword [0x140125594], 1
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x14012d1a4], eax
mov rcx, qword [0x1401255c8]
test bl, bl
jne 0x14001ef96
movzx eax, byte [rcx + 0x136]
test al, al
je 0x14001edd1
movzx eax, al
mov esi, 0xffc3d44d
sub esi, eax
jmp 0x14001edd6
mov esi, 0xffc3d44f
cmp dword [0x14012b780], 0
je 0x14001edeb
movzx ebx, byte [0x14012990f]
jmp 0x14001ef64
cmp qword [0x14012ac08], 0
je 0x14001ee01
movzx ebx, byte [0x14012aab1]
jmp 0x14001ef64
mov ecx, 0xa0
xor bl, bl
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, 0x8000
movzx ebx, bl
test cx, ax
mov eax, reloc.OLEAUT32.DLL_SafeArrayGetDim
mov ecx, 0xa1
cmovne ebx, eax
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14001ee39
or bl, 0x20
mov ecx, 0xa2
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14001ee51
or bl, 1
mov ecx, 0xa3
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14001ee69
or bl, 2
mov ecx, 0xa4
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14001ee81
or bl, 4
mov ecx, 0xa5
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14001ee99
or bl, 8
mov ecx, 0x5b
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14001eeb1
or bl, 0x40
mov ecx, 0x5c
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14001eec9
or bl, 0x80
cmp qword [0x14012ac08], 0
je 0x14001ef64
movzx edi, bl
not dil
and dil, byte [0x14012aab1]
cmp byte [0x14012aab6], 0
je 0x14001ef0a
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x14012976c]
cmp eax, 0x14
jae 0x14001ef0a
movzx eax, byte [0x14012aab6]
not al
and dil, al
test dil, dil
je 0x14001ef5c
movzx edx, byte [0x14012aab3]
movzx eax, dil
lea rcx, [0x14012ab00]
not al
and byte [0x14012aab1], al
and byte [0x14012aab2], al
and dl, al
mov byte [0x14012aab3], dl
call fcn.140022460
mov rcx, qword [0x140129900]
test rcx, rcx
je 0x14001ef5c
test byte [rcx + 0xc], dil
mov eax, 0
cmovne rcx, rax
mov qword [0x140129900], rcx
movzx edi, byte [rsp + 0xb0]
xor r9d, r9d
mov r8, r13
movzx edx, bl
movzx ecx, dil
mov dword [rsp + 0x28], esi
mov byte [rsp + 0x20], 1
call fcn.140021a90
mov rcx, qword [0x1401255c8]
movzx ebx, byte [rsp + 0xe0]
movzx esi, word [rsp + 0xb8]
test r15b, r15b
je 0x14001efd9
test r13, r13
jne 0x14001efd9
movzx eax, byte [rcx + 0x12f]
movzx ecx, byte [rsp + 0x100]
mov r8d, dword [rsp + 0xf8]
mov edx, dword [rsp + 0xf0]
mov byte [rsp + 0x30], cl
lea r9d, [r13 + 1]
movzx ecx, r12b
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call fcn.140020a20
jmp 0x14001f002
movzx eax, byte [rcx + 0x136]
mov ecx, 0xffc3d44d
mov r9, r13
sub ecx, eax
movzx r8d, si
movzx edx, r12b
mov dword [rsp + 0x28], ecx
mov ecx, ebp
mov byte [rsp + 0x20], 1
call fcn.14001f7c0
dec r14
jne 0x14001ed41
movzx ebp, byte [rsp + 0xc0]
mov r14d, 0x8000
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xc8]
test bl, bl
jne 0x14001f1c3
cmp dword [0x14012b780], 0
je 0x14001f048
movzx ebx, byte [0x14012990f]
jmp 0x14001f199
cmp qword [0x14012ac08], 0
je 0x14001f05e
movzx ebx, byte [0x14012aab1]
jmp 0x14001f199
mov ecx, 0xa0
xor bl, bl
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
movzx ebx, bl
mov ecx, 0xa1
test r14w, ax
mov eax, reloc.OLEAUT32.DLL_SafeArrayGetDim
cmovne ebx, eax
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
test r14w, ax
je 0x14001f08e
or bl, 0x20
mov ecx, 0xa2
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
test r14w, ax
je 0x14001f0a2
or bl, 1
mov ecx, 0xa3
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
test r14w, ax
je 0x14001f0b6
or bl, 2
mov ecx, 0xa4
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
test r14w, ax
je 0x14001f0ca
or bl, 4
mov ecx, 0xa5
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
test r14w, ax
je 0x14001f0de
or bl, 8
mov ecx, 0x5b
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
test r14w, ax
je 0x14001f0f2
or bl, 0x40
mov ecx, 0x5c
call qword [sym.imp.USER32.DLL_GetAsyncKeyState]
test r14w, ax
je 0x14001f106
or bl, 0x80
cmp qword [0x14012ac08], 0
je 0x14001f199
movzx edi, bl
not dil
and dil, byte [0x14012aab1]
cmp byte [0x14012aab6], 0
je 0x14001f147
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x14012976c]
cmp eax, 0x14
jae 0x14001f147
movzx eax, byte [0x14012aab6]
not al
and dil, al
test dil, dil
je 0x14001f199
movzx edx, byte [0x14012aab3]
movzx eax, dil
lea rcx, [0x14012ab00]
not al
and byte [0x14012aab1], al
and byte [0x14012aab2], al
and dl, al
mov byte [0x14012aab3], dl
call fcn.140022460
mov rcx, qword [0x140129900]
test rcx, rcx
je 0x14001f199
test byte [rcx + 0xc], dil
mov eax, 0
cmovne rcx, rax
mov qword [0x140129900], rcx
not bpl
and bpl, bl
and bpl, 0xcc
je 0x14001f1c3
mov r9b, 1
mov r8, r13
movzx edx, bpl
xor ecx, ecx
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
call fcn.140021a90
add rsp, 0x80
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret