Function at 0x140010ed0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x4f]
sub rsp, 0xb8
mov rax, qword [0x140056040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140010f14
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140010f14
movzx eax, byte [0x14007f9e4]
jmp 0x140010f2f
cmp byte [0x14007f9e4], 0
sete al
mov byte [0x14007f9e4], al
test al, al
je 0x140010f2f
mov byte [0x14007d1e0], 1
xor edi, edi
test al, al
je 0x140010f8a
cmp byte [0x14007d1e0], dil
je 0x140010f72
cmp dword [0x14007fa40], edi
jne 0x140010f52
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14007fa40], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14007fa40]
cmp eax, 0x3e8
jbe 0x140010f72
mov byte [0x14007d1e0], dil
mov dword [0x14007fa40], edi
mov rcx, qword [0x14007f9e8]
call fcn.140001bc0
mov rcx, qword [0x14007f9e8]
call fcn.140007830
cmp byte [0x14007d22e], dil
je 0x140010f9c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [0x14007da10], rdi
je 0x140011512
mov ecx, 0xb7cd98
call fcn.1400138c0
test eax, eax
je 0x140011512
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], r14
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm7
call fcn.14000e430
cmp byte [0x14007d215], dil
je 0x140011063
cmp byte [0x14007fa95], dil
jne 0x14001100c
mov ecx, 0x8d6114
call fcn.140013bf0
movss dword [0x14007fa90], xmm0
mov rax, qword [0x14007da10]
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x21], rax
lea rax, [rbp + 0xf]
mov qword [rbp - 0x39], rax
mov dword [rbp + 0xf], 0x3e4ccccd
mov qword [rbp - 0x29], 4
mov dword [rbp - 0x19], edi
mov qword [rbp - 0x14], rdi
mov qword [rbp - 0xc], rdi
mov qword [rbp - 4], rdi
mov word [rbp + 4], di
mov byte [rbp + 6], dil
mov byte [rbp - 0x15], 1
mov qword [rbp - 0x31], 0x8d6114
call fcn.140013550
mov byte [0x14007fa95], 1
jmp 0x140011085
cmp byte [0x14007fa95], dil
je 0x140011085
movss xmm1, dword [0x14007fa90]
mov ecx, 0x8d6114
call fcn.140013b00
mov byte [0x14007fa95], dil
cmp byte [0x14007d203], dil
mov qword [rsp + 0xb0], r15
je 0x140011131
cmp byte [0x14007fa54], dil
jne 0x1400111b4
mov r14d, 0x1caab
lea rsi, [0x14007f830]
lea r15, [0x14007f9c0]
nop dword [rax + rax]
imul eax, r14d, 0x70
mov ecx, eax
mov ebx, eax
call fcn.1400138c0
mov dword [rsi], eax
lea rcx, [rbp - 0x39]
mov rax, qword [0x14007da10]
mov qword [rbp - 0x21], rax
lea rax, [rbp + 0xf]
mov qword [rbp - 0x39], rax
mov dword [rbp + 0xf], 3
mov qword [rbp - 0x29], 4
mov dword [rbp - 0x19], edi
mov qword [rbp - 0x14], rdi
mov qword [rbp - 0xc], rdi
mov qword [rbp - 4], rdi
mov word [rbp + 4], di
mov byte [rbp + 6], dil
mov byte [rbp - 0x15], 1
mov qword [rbp - 0x31], rbx
call fcn.140013550
inc r14d
add rsi, 4
cmp rsi, r15
jne 0x1400110c0
mov byte [0x14007fa54], 1
jmp 0x1400111b4
cmp byte [0x14007fa54], dil
je 0x1400111b4
mov ebx, edi
lea rsi, [0x14007f830]
lea r15, [0x14007f9c0]
nop word [rax + rax]
mov eax, dword [rsi]
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], eax
mov rax, qword [0x14007da10]
mov qword [rbp - 0x21], rax
lea eax, [rbx + 0x1caab]
imul eax, eax, 0x70
mov qword [rbp - 0x29], 4
mov dword [rbp - 0x19], edi
mov qword [rbp - 0x14], rdi
mov qword [rbp - 0xc], rdi
mov qword [rbp - 0x31], rax
lea rax, [rbp + 0xf]
mov qword [rbp - 0x39], rax
mov qword [rbp - 4], rdi
mov word [rbp + 4], di
mov byte [rbp + 6], dil
mov byte [rbp - 0x15], 1
call fcn.140013550
add rsi, 4
lea ebx, [rbx + 1]
cmp rsi, r15
jne 0x140011150
mov byte [0x14007fa54], dil
call fcn.140010760
call fcn.140010a10
cmp byte [0x14007d202], dil
je 0x140011227
mov ecx, 0xba18fc
call fcn.1400138c0
mov ecx, eax
test eax, eax
je 0x140011227
mov rax, qword [0x14007da10]
add ecx, 0x428
mov qword [rbp - 0x21], rax
lea rax, [rbp + 0xf]
mov qword [rbp - 0x31], rcx
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x39], rax
mov dword [rbp + 0xf], 0x10
mov qword [rbp - 0x29], 1
mov dword [rbp - 0x19], edi
mov qword [rbp - 0x14], rdi
mov qword [rbp - 0xc], rdi
mov qword [rbp - 4], rdi
mov word [rbp + 4], di
mov byte [rbp + 6], dil
mov byte [rbp - 0x15], 1
call fcn.140013550
cmp byte [0x14007d225], dil
jne 0x140011242
cmp byte [0x14007d224], dil
jne 0x140011242
cmp byte [0x14007d226], dil
je 0x140011247
call fcn.140008b80
cmp byte [0x14007d220], dil
jne 0x140011259
cmp byte [0x14007d221], dil
je 0x14001125e
call fcn.14000a7b0
cmp byte [0x14007d222], dil
jne 0x140011270
cmp byte [0x14007d223], dil
je 0x140011275
call fcn.140008750
cmp byte [0x14007d1fe], dil
je 0x140011371
mov ecx, 0xb74494
call fcn.1400138c0
mov ecx, eax
mov ebx, eax
call fcn.1400138c0
lea ecx, [rbx + 4]
mov r15d, eax
call fcn.1400138c0
mov r14d, eax
xor sil, sil
nop word [rax + rax]
mov rax, qword [0x14007da10]
mov qword [rbp - 0x21], rax
lea rax, [rbp + 7]
movzx ebx, sil
mov byte [rbp + 7], dil
mov qword [rbp - 0x29], 1
mov dword [rbp - 0x19], 0x1000000
lea ecx, [rbx + r14]
mov qword [rbp - 0x15], rdi
mov qword [rbp - 0x31], rcx
lea rcx, [rbp - 0x39]
mov qword [rbp - 0xd], rdi
mov qword [rbp - 5], rdi
mov dword [rbp + 3], edi
mov qword [rbp - 0x39], rax
call fcn.140013550
movzx eax, byte [rbp + 7]
dec al
cmp al, 0x7e
ja 0x140011364
imul ecx, ebx, 0xa18
add ecx, 0x4f8
add ecx, r15d
mov ebx, ecx
call fcn.1400138c0
mov rax, qword [0x14007da10]
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x21], rax
lea rax, [rbp + 0xf]
mov qword [rbp - 0x39], rax
mov dword [rbp + 0xf], 1
mov qword [rbp - 0x29], 4
mov dword [rbp - 0x19], edi
mov qword [rbp - 0x14], rdi
mov qword [rbp - 0xc], rdi
mov qword [rbp - 4], rdi
mov word [rbp + 4], di
mov byte [rbp + 6], dil
mov byte [rbp - 0x15], 1
mov qword [rbp - 0x31], rbx
call fcn.140013550
inc sil
cmp sil, 0x6e
jb 0x1400112b0
cmp byte [0x14007d1ff], dil
mov r15, qword [rsp + 0xb0]
je 0x14001143d
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400113a2
mov dword [0x14007da18], 1
jmp 0x1400113aa
cmp dword [0x14007da18], edi
je 0x1400113e7
cmp dword [0x14007fa3c], edi
jne 0x1400113be
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14007fa3c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14007fa3c]
cmp eax, 0x3e8
jbe 0x1400113df
mov dword [0x14007da18], edi
mov dword [0x14007fa3c], edi
jmp 0x1400113e7
cmp dword [0x14007da18], edi
jne 0x14001143d
mov ecx, dword [0x14007f9f8]
mov rax, qword [0x14007da10]
add ecx, 0x46c
mov qword [rbp - 0x21], rax
lea rax, [rbp + 0xf]
mov qword [rbp - 0x31], rcx
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], 3
mov qword [rbp - 0x29], 1
mov dword [rbp - 0x19], edi
mov qword [rbp - 0x14], rdi
mov qword [rbp - 0xc], rdi
mov qword [rbp - 4], rdi
mov word [rbp + 4], di
mov byte [rbp + 6], dil
mov byte [rbp - 0x15], 1
mov qword [rbp - 0x39], rax
call fcn.140013550
cmp byte [0x14007d200], dil
je 0x14001144b
call fcn.14000f790
cmp byte [0x14007d201], dil
je 0x140011469
mov ecx, 0x52
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140011469
call fcn.140009be0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movdqa xmm6, xmmword [0x14004fb70]
lea r14, [0x14007da30]
movss xmm7, dword [0x14004f818]
mov esi, eax
mov ebx, edi
nop word [rax + rax]
mov eax, esi
movsxd rcx, edi
sub eax, ebx
shl rcx, 8
sub eax, 0x41
movdqa xmmword [rbp - 0x49], xmm6
xorps xmm2, xmm2
lea r9, [rbp - 0x49]
add rcx, r14
movaps xmm1, xmm7
cvtsi2ss xmm2, rax
call fcn.140007650
inc edi
add ebx, 0xf
cmp ebx, 0x12c
jl 0x1400114a0
cmp byte [0x14007d217], 0
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
mov r14, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
je 0x14001150d
call fcn.14000d740
call fcn.14000fb00
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140044810
add rsp, 0xb8
pop rdi
pop rbp
ret