Function at 0x14008cc30
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r12, [0x140260a80]
xor edx, edx
mov rcx, r12
mov r8d, 0xff
mov esi, eax
call sub.VCRUNTIME140.dll_memset
xor r15d, r15d
mov rbx, r12
mov edi, r15d
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rbx]
test ax, ax
jns 0x14008cc7f
test ecx, ecx
jne 0x14008cc86
mov dword [rbx], 1
jmp 0x14008cc86
test ecx, ecx
je 0x14008cc86
mov dword [rbx], r15d
inc edi
add rbx, 4
cmp edi, 0xff
jl 0x14008cc64
cmp byte [0x14025d3d1], r15b
je 0x14008cf2c
mov qword [rsp + 0x50], rbp
lea rbp, [0x140000000]
mov qword [rsp + 0x60], r14
lea r14, [0x1402609a0]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov ebx, r15d
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsxd rdx, ebx
mov ecx, dword [r12 + rdx*4]
test ax, ax
jns 0x14008ccf9
test ecx, ecx
jne case.0x14008cd74.160
mov dword [r12 + rdx*4], 1
jmp case.0x14008cd74.160
test ecx, ecx
je case.0x14008cd74.160
mov dword [r12 + rdx*4], r15d
movzx edx, bl
mov ecx, edx
sub ecx, 1
je case.0x14008cd74.160
sub ecx, 1
je case.0x14008cd74.160
cmp ecx, 2
je case.0x14008cd74.160
mov rax, qword [0x14025dc10]
cmp byte [rax], r15b
je 0x14008cd51
mov ecx, edx
sub ecx, 0x10
je case.0x14008cd74.160
sub ecx, 0x90
je case.0x14008cd74.160
cmp ecx, 1
je case.0x14008cd74.160
mov rax, qword [0x14025dc08]
cmp byte [rax], r15b
je 0x14008cd76
lea eax, [rdx - 0xa0]
cmp eax, 5
ja case.default.0x14008cd74
cdqe
mov ecx, dword [rbp + rax*4 + 0x8cf40]
add rcx, rbp
jmp rcx
mov ecx, edx
sub ecx, 0x10
je case.0x14008cd74.160
sub ecx, 1
je case.0x14008cd74.160
cmp ecx, 1
je case.0x14008cd74.160
test bl, bl
je case.0x14008cd74.160
cmp qword [0x140260980], r15
mov byte [0x140260e7c], dl
je 0x14008ce39
cmp dl, 8
jne 0x14008cde5
movzx eax, byte [0x140260991]
test al, al
je case.0x14008cd74.160
lea rcx, [rax - 1]
cmp rcx, 9
jae 0x14008cf38
add al, 0xff
mov byte [rcx + rbp + 0x260988], r15b
mov byte [0x140260991], al
jmp case.0x14008cd74.160
movzx r8d, byte [0x140260991]
mov rax, r15
test r8b, r8b
je 0x14008ce15
nop word [rax + rax]
cmp byte [rax + rbp + 0x260988], dl
je case.0x14008cd74.160
inc rax
cmp rax, r8
jl 0x14008ce00
cmp r8b, 8
jb 0x14008ce25
cmp dl, 0x1b
je 0x14008ce25
cmp dl, 0xd
jne case.0x14008cd74.160
mov byte [r8 + rbp + 0x260988], dl
inc r8b
mov byte [0x140260991], r8b
jmp case.0x14008cd74.160
movzx ecx, byte [0x1402609a8]
mov rax, r15
test rcx, rcx
je 0x14008ce56
cmp byte [rax + r14], dl
je case.0x14008cd74.160
inc rax
cmp rax, rcx
jl 0x14008ce48
cmp byte [0x1402609a8], 8
jae case.0x14008cd74.160
mov rax, qword [0x14025dc18]
mov esi, edi
mov byte [rcx + r14], dl
movzx ecx, byte [0x1402609a8]
inc cl
mov byte [0x1402609a8], cl
cmp byte [rax], r15b
jne case.0x14008cd74.160
cmp dl, 0xd
je case.0x14008cd74.160
cmp dl, 0x1b
je case.0x14008cd74.160
movzx r8d, cl
xor r9d, r9d
mov rcx, r14
lea rdx, [r8 + r14]
call fcn.1400807c0
inc ebx
cmp ebx, 0xff
jl 0x14008ccd0
sub edi, esi
cmp edi, 0x64
jbe 0x14008ced9
cmp byte [0x1402609a8], r15b
jbe 0x14008ced0
mov rax, qword [0x1402609a0]
mov qword [0x140260998], rax
mov byte [0x1402609a8], r15b
xor eax, eax
mov qword [0x1402609a0], rax
cmp qword [0x140260980], r15
jne 0x14008ceff
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x58]
lea rcx, [0x14025d3d8]
call fcn.14008c9a0
mov byte [0x140260e7c], r15b
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x140260a68]
cmp byte [0x14025d3d1], r15b
jne 0x14008ccc0
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140090640
int3