Function at 0x1400486e0
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbx
push r14
push r15
mov eax, 0x8180
call fcn.1400decd0
sub rsp, rax
xor r14d, r14d
mov r15, rcx
cmp byte [rcx], 0x3e
jne 0x1400487b0
mov rcx, qword [0x140138780]
lea rdx, str.hLMmphY8L3sT2pEGnXbgZOsAFDS7FEENyDGLISrfOZlmy3P1EbybEgwTYll3lfaY2NPADqn7bAO3Wt9jIcSiQBpHLUMCrlQ7gtqz
call fcn.1400a6ae0
mov r9, qword [0x140138778]
test rax, rax
mov rdx, qword [0x140138770]
mov eax, r14d
setne bl
cmp byte [r15 + 1], 3
movzx ecx, bl
cmova rax, qword [0x1401386d8]
xor cl, 1
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x68]
mov byte [rsp + 0x38], bl
mov qword [rsp + 0x30], rax
mov rax, qword [0x140138780]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], cl
lea rcx, [0x1401395c0]
call fcn.1400422c0
test eax, eax
jne 0x1400487b0
test bl, bl
je 0x1400487a0
mov rcx, qword [0x140134400]
lea rdx, str.ERROR
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.1400ab090
mov r14d, eax
mov eax, r14d
add rsp, 0x8180
pop r15
pop r14
pop rbx
ret
movzx eax, byte [r15]
mov qword [rsp + 0x8170], rsi
mov qword [rsp + 0x8168], rdi
mov qword [rsp + 0x8160], r12
mov qword [rsp + 0x8158], r13
movaps xmmword [rsp + 0x8140], xmm6
cmp al, 0x5d
jne 0x140048963
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, qword [0x140138770]
mov r9b, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.140014c80
mov byte [rsp + 0x81b0], al
test al, al
jne 0x140048858
mov rcx, qword [0x140138770]
lea rdx, [rsp + 0x60]
xor r8d, r8d
call fcn.14006ea50
mov dword [rsp + 0x58], eax
test eax, eax
je 0x140048834
add eax, 0xfffffff4
cmp eax, 0x1f
jbe 0x140048863
mov rcx, qword [0x140134400]
lea rdx, [0x14010c7dc]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.1400ab090
jmp 0x140049054
mov eax, dword [rsp + 0x81a0]
mov dword [rsp + 0x58], eax
mov rsi, qword [0x140138778]
mov r13b, 1
mov byte [rsp + 0x81a0], r14b
mov r12d, r14d
mov dword [rsp + 0x54], 1
mov byte [rsp + 0x81a8], r13b
movzx eax, word [rsi]
mov dword [rsp + 0x50], r14d
test ax, ax
je 0x140048946
movsd xmm6, qword [0x14011bb68]
lea rdi, [rsi + 2]
movzx ebx, ax
test ebx, 0xffffff80
jne 0x1400488c3
mov edx, 2
mov ecx, ebx
call fcn.1400cb124
test eax, eax
je 0x1400488c3
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x44
je 0x14004891c
cmp eax, 0x4c
je 0x140048915
cmp eax, 0x54
jne 0x140048924
mov rcx, rdi
xor r13b, r13b
call fcn.14000f010
mov rcx, rdi
test al, al
je 0x140048905
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400cc568
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
cvttsd2si r12d, xmm0
jmp 0x140048924
call fcn.1400d0710
mulsd xmm0, xmm6
cvttsd2si r12d, xmm0
jmp 0x140048924
mov dword [rsp + 0x54], r14d
jmp 0x140048924
mov byte [rsp + 0x81a0], 1
movzx eax, word [rsi + 2]
add rsi, 2
add rdi, 2
test ax, ax
jne 0x1400488a5
mov byte [rsp + 0x81a8], r13b
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x130]
mov dword [rsp + 0x120], r14d
mov qword [rsp + 0x110], rax
jmp 0x140048a6b
mov rcx, qword [0x140138770]
mov rbx, qword [0x140138780]
cmp al, 0x3e
je 0x14004897f
cmp al, 0x5c
je 0x140048987
cmp word [rbx], r14w
jne 0x140048991
cmp al, 0x5c
jne 0x140048a24
cmp word [rcx], r14w
je 0x140048a24
xor r13b, r13b
cmp al, 0x5c
mov byte [rsp + 0x81a8], r13b
cmove rbx, rcx
mov rcx, rbx
call fcn.14000f010
mov rcx, rbx
test al, al
je 0x1400489c6
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400cc568
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
jmp 0x1400489cb
call fcn.1400d0710
movzx eax, byte [rsp + 0x81a0]
mov ecx, dword [rsp + 0x81a0]
mulsd xmm0, qword [0x14011bb68]
mov byte [rsp + 0x81b0], al
movzx eax, byte [rsp + 0x81a0]
mov byte [rsp + 0x81a0], al
mov eax, dword [rsp + 0x81a0]
cvttsd2si r12d, xmm0
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], r12d
cmp r12d, 1
jge 0x140048a6b
mov r12d, 0x1f4
mov dword [rsp + 0x50], r12d
jmp 0x140048a6b
movzx eax, byte [rsp + 0x81a0]
mov r13b, 1
mov byte [rsp + 0x81b0], al
mov r12d, r14d
mov eax, dword [rsp + 0x81a0]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x81a0]
mov byte [rsp + 0x81a0], al
mov eax, dword [rsp + 0x81a0]
mov dword [rsp + 0x54], eax
mov byte [rsp + 0x81a8], r13b
mov dword [rsp + 0x50], r14d
cmp byte [r15], 0x3e
mov qword [rsp + 0x8178], rbp
je 0x140048a98
mov rcx, qword [0x140134400]
lea rdx, [0x1400ee234]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.1400ab090
cmp byte [r15], 0x5c
jne 0x140048ab8
mov edx, 1
mov rcx, r15
call fcn.140030470
mov byte [rsp + 0x81b8], 1
cmp eax, 1
je 0x140048ac0
mov byte [rsp + 0x81b8], r14b
mov ebp, r14d
lea rdi, [rsp + 0x130]
mov ecx, 0x4001
cmp byte [r15 + 1], bpl
jbe 0x140048b6a
mov rsi, r14
lea r13, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
lea r12, [0x140117ad8]
nop dword [rax + rax]
test ecx, ecx
jne 0x140048afb
mov qword [rsp + rsi + 0x70], r12
jmp 0x140048b4d
mov rdx, qword [rsi + r13 + 0x138770]
movsxd rbx, ecx
mov rcx, rdi
mov qword [rsp + rsi + 0x70], rdi
lea r8, [rbx - 1]
call fcn.1400cc9b8
or rax, 0xffffffffffffffff
mov word [rdi + rbx*2 - 2], r14w
cmp word [rdi + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x140048b21
lea rdi, [rdi + rax*2]
add rdi, 2
lea rcx, [rsp + 0x130]
mov rax, rdi
sub rax, rcx
mov ecx, 0x4001
sar rax, 1
sub ecx, eax
movzx eax, byte [r15 + 1]
inc ebp
add rsi, 8
cmp ebp, eax
jl 0x140048af0
mov r12d, dword [rsp + 0x50]
movzx r13d, byte [rsp + 0x81a8]
mov esi, dword gs:[0x48]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbp, qword [rsp + 0x68]
xorps xmm6, xmm6
mov rdi, qword [rsp + 0x78]
mov ebx, eax
mov r11, qword [0x14012fa58]
lea r9, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
mov rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
mov r10, qword [rsp + 0x70]
nop word [rax + rax]
movzx eax, byte [r15]
add eax, 0xffffffc2
cmp eax, 0x3e
ja case.0x140048bd6.69
cdqe
movzx eax, byte [r9 + rax + 0x490ac]
mov ecx, dword [r9 + rax*4 + 0x4908c]
add rcx, r9
jmp rcx
movzx eax, byte [r15 + 1]
lea rcx, [0x140117ad8]
cmp al, 4
mov dword [rsp + 0x40], r14d
mov r10, rcx
mov qword [rsp + 0x38], r14
cmova r10, rdx
mov byte [rsp + 0x30], 1
cmp al, 3
mov byte [rsp + 0x28], r14b
mov r9, rcx
mov qword [rsp + 0x20], r10
cmova r9, r8
mov rdx, rcx
cmp al, 1
mov r8, rcx
mov rcx, r11
cmova r8, rdi
test al, al
cmovne rdx, qword [rsp + 0x70]
call fcn.1400ac870
test rax, rax
je case.0x140048bd6.69
mov rax, qword [0x14012fa58]
cmp dword [rax + 0x74], 0xffffffff
jle 0x140049026
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140139538], eax
jne 0x140048fe8
mov rax, qword [0x14012fa58]
mov edx, 1
mov ecx, dword [rax + 0x74]
call fcn.1400018b0
mov eax, 1
jmp 0x14004904c
movzx eax, byte [r15 + 1]
lea rcx, [0x140117ad8]
cmp al, 4
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], r14
cmova rcx, rdx
mov byte [rsp + 0x30], r14b
cmp al, 3
mov byte [rsp + 0x28], r14b
lea rdx, [0x140117ad8]
mov qword [rsp + 0x20], rcx
mov r9, rdx
mov rcx, r11
cmova r9, r8
cmp al, 1
mov r8, rdx
cmova r8, rdi
test al, al
cmovne rdx, r10
call fcn.1400ac870
test rax, rax
jne case.0x140048bd6.69
mov rax, qword [0x14012fa58]
cmp dword [rax + 0x74], 0xffffffff
jle 0x140049026
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140139538], eax
mov rax, qword [0x14012fa58]
mov ecx, dword [rax + 0x74]
jne 0x140048ff2
mov edx, 1
call fcn.1400018b0
mov eax, 1
jmp 0x14004904c
movzx eax, byte [r15 + 1]
lea rcx, [0x140117ad8]
cmp al, 4
mov byte [rsp + 0x28], 1
cmova rcx, rdx
cmp al, 3
lea rdx, [0x140117ad8]
mov qword [rsp + 0x20], rcx
mov r9, rdx
mov rcx, r11
cmova r9, r8
cmp al, 1
mov r8, rdx
cmova r8, rdi
test al, al
cmovne rdx, r10
call fcn.1400ac6a0
test rax, rax
jne 0x140048cd0
jmp case.0x140048bd6.69
movzx eax, byte [r15 + 1]
lea rcx, [0x140117ad8]
cmp al, 4
mov byte [rsp + 0x28], 1
cmova rcx, rdx
cmp al, 3
lea rdx, [0x140117ad8]
mov qword [rsp + 0x20], rcx
mov r9, rdx
mov rcx, r11
cmova r9, r8
cmp al, 1
mov r8, rdx
cmova r8, rdi
test al, al
cmovne rdx, r10
call fcn.1400ac6a0
test rax, rax
je 0x140048cd0
jmp case.0x140048bd6.69
cmp byte [rsp + 0x81b8], r14b
je 0x140048dd0
call qword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
jne 0x140049026
jmp case.0x140048bd6.69
mov ecx, SafeArrayDestroy
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140049026
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140049026
jmp case.0x140048bd6.69
movzx edi, byte [rsp + 0x81b0]
test dil, dil
je 0x140048eb8
mov ecx, dword [rsp + 0x54]
sub ecx, 1
je 0x140048e2c
cmp ecx, 1
movzx ecx, dil
je 0x140048e24
call qword [sym.imp.USER32.dll_GetKeyState]
jmp 0x140048e9f
call qword [sym.imp.USER32.dll_GetKeyState]
jmp 0x140048ea2
lea eax, [rdi - 1]
cmp al, 5
ja 0x140048e39
cmp dil, 3
jne 0x140048e40
lea eax, [rdi + 0x66]
cmp al, 5
ja 0x140048e5b
cmp qword [0x140134448], r14
je 0x140048e95
movzx eax, dil
movzx eax, byte [rax + r9 + 0x135230]
shr al, 7
jmp 0x140048ea4
cmp qword [0x140134450], r14
je 0x140048e95
xor edx, edx
xor r8d, r8d
movzx ecx, dil
call fcn.140014370
test al, al
je 0x140048e7d
mov cl, 1
call fcn.140014120
movzx eax, dil
lea rdx, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
movzx eax, byte [rax + rdx + 0x135230]
shr al, 7
jmp 0x140048ea4
movzx ecx, dil
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
cmp al, byte [rsp + 0x81a0]
je 0x140049026
mov rdi, qword [rsp + 0x78]
jmp case.0x140048bd6.69
mov edx, dword [rsp + 0x60]
lea r8, [rsp + 0x110]
mov ecx, dword [rsp + 0x58]
xor r9d, r9d
call fcn.14006ee60
ucomisd xmm0, xmm6
jp 0x140048edc
jne 0x140048edc
xor eax, eax
jmp 0x140048ede
mov al, 1
cmp al, byte [rsp + 0x81a0]
je 0x140049026
mov rdi, qword [rsp + 0x78]
jmp case.0x140048bd6.69
test rbp, rbp
je 0x14004900f
lea rdx, [rsp + 0x5c]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x5c], 0x103
jne 0x140048fff
cmp dword [0x140139538], esi
jne 0x140048fc2
test r13b, r13b
jne 0x140048f3d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rbx + r12]
sub ecx, eax
cmp ecx, 5
jle 0x140048fc7
mov edx, 1
mov ecx, 0x8000012f
call fcn.1400018b0
test al, al
je 0x140048b87
mov r11, qword [0x14012fa58]
lea r9, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
mov rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
mov r10, qword [rsp + 0x70]
cmp byte [r11 + 0x139], r14b
je 0x140048bb0
movsxd rcx, dword [0x1401373ec]
lea r9, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
mov qword [r9 + rcx*8 + 0x137a40], r15
mov dword [r9 + rcx*4 + 0x137400], ebx
inc ecx
mov dword [0x1401373ec], ecx
cmp ecx, 0x190
jl 0x140048bb0
mov dword [0x1401373ec], r14d
jmp 0x140048b95
test r13b, r13b
jne 0x140048fd8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rbx + r12]
sub ecx, eax
cmp ecx, 5
jle 0x14004902d
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140048b87
mov rcx, qword [0x14012fa58]
mov ecx, dword [rcx + 0x74]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x14004904c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rsp + 0x5c]
jmp 0x140049014
mov dword [rsp + 0x5c], r14d
mov rcx, qword [0x140134400]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
movsxd rdx, r14d
call fcn.140001380
mov eax, 1
jmp 0x14004904c
mov rcx, qword [0x140134400]
lea rdx, [0x14010c7dc]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.1400ab090
mov rbp, qword [rsp + 0x8178]
mov r12, qword [rsp + 0x8160]
mov rdi, qword [rsp + 0x8168]
mov rsi, qword [rsp + 0x8170]
mov r13, qword [rsp + 0x8158]
movaps xmm6, xmmword [rsp + 0x8140]
add rsp, 0x8180
pop r15
pop r14
pop rbx
ret