Function at 0x140063ea0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140129080]
xor rax, rsp
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [0x14020b610], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea rcx, [rsp + 0x20]
mov dword [0x14020b388], eax
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [0x14020b958], 0
mov esi, dword [rsp + 0x20]
mov ebp, dword [rsp + 0x24]
jne 0x140064197
cmp dword [reloc.WS2_32.dll_accept], 0x3c
jg 0x140063f29
cmp dword [0x14020fd94], 0
jne 0x140063f29
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14020fd94], eax
mov ecx, dword [reloc.XINPUT1_3.dll_Ordinal_2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test ax, ax
jns 0x1400640e4
cmp byte [0x14020b95e], bl
je 0x14006425d
cmp byte [0x14020fdcf], bl
je 0x1400640e4
cmp byte [0x1401d9fd9], bl
je 0x1400640e4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x3e8
cdq
idiv dword [reloc.WS2_32.dll_accept]
add eax, dword [0x14020fd94]
cmp ecx, eax
jbe 0x1400640e4
cmp byte [0x14020fbad], bl
je 0x14006403b
mov eax, dword [0x14020b610]
mov r9d, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
cmp esi, eax
jne 0x140063fc4
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
cmp ebp, eax
jne 0x140063fc4
mov ecx, 1
mov dword [reloc.WS2_32.dll_accept], ecx
jmp 0x140063fca
mov ecx, dword [reloc.WS2_32.dll_accept]
cmp byte [reloc.WS2_32.dll_accept], bl
jne 0x140063fef
cmp esi, r8d
je 0x140063fef
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
cmp ebp, eax
je 0x140063fef
mov dword [reloc.WS2_32.dll_accept], 1
jmp 0x140063ff7
test ecx, ecx
je 0x1400640e4
cmp byte [reloc.WS2_32.dll_accept], bl
je 0x1400640e4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
movzx ecx, byte [0x14020fde6]
movzx eax, byte [0x14020fe5d]
test cl, cl
je 0x140064077
test al, al
je 0x140064033
mov byte [reloc.WS2_32.dll_accept], bl
test cl, cl
je 0x140064077
test al, al
jmp 0x14006406f
cmp byte [reloc.WS2_32.dll_accept], bl
mov dword [reloc.WS2_32.dll_accept], 1
je 0x140064061
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [0x14020fde6], bl
je 0x140064077
cmp byte [0x14020fe5d], bl
je 0x140064077
mov byte [reloc.WS2_32.dll_accept], bl
movzx eax, byte [0x14020fd14]
test al, al
jne 0x14006409d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
movzx eax, byte [0x14020fd14]
cmp byte [0x14020b95e], bl
je 0x1400640de
cmp byte [0x14020fdcf], bl
je 0x1400640de
cmp byte [0x1401da0a5], bl
je 0x1400640de
test al, al
je 0x1400640de
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400640de
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x14020fd94], ebx
cmp byte [0x14020b95e], bl
je 0x14006425d
cmp byte [0x14020fdcf], bl
je 0x14006425d
cmp byte [0x1401d9fd9], bl
je 0x14006425d
mov ecx, dword [reloc.XINPUT1_3.dll_Ordinal_2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14006425d
cmp dword [reloc.WS2_32.dll_accept], ebx
je 0x140064139
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [0x14020fe5d], bl
je 0x140064148
mov byte [reloc.WS2_32.dll_accept], 1
cmp byte [0x14020fbad], bl
je 0x140064156
mov dword [reloc.WS2_32.dll_accept], ebx
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14006425d
cmp byte [0x1401db19f], bl
je 0x140064181
call fcn.1400630a0
mov dword [reloc.WS2_32.dll_accept], ebx
jmp 0x14006425d
mov ecx, reloc.WLDAP32.dll_Ordinal_30
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [reloc.WS2_32.dll_accept], ebx
jmp 0x14006425d
cmp byte [0x1401d9fd9], 0
je 0x14006425d
cmp byte [0x14020b95e], 0
je 0x14006425d
cmp dword [reloc.WS2_32.dll_accept], 0x3c
jg 0x1400641cf
cmp dword [0x14020fd94], 0
jne 0x1400641cf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14020fd94], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x3e8
cdq
idiv dword [reloc.WS2_32.dll_accept]
add eax, dword [0x14020fd94]
cmp ecx, eax
jbe 0x14006425d
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140064255
cmp byte [0x1401db13f], 0
je 0x140064255
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140064255
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [reloc.XINPUT1_3.dll_Ordinal_2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140064255
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
xor ebx, ebx
mov dword [0x14020fd94], ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d4090
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret