Function at 0x14000a210
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling
Register raw input devices

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x60], ecx
mov ebx, 1
mov dword [r11 - 0x48], 0x20001
mov dword [r11 - 0x44], 0x100
xor ebp, ebp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], 0xfffffffffffffffd
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Message
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0xc8], rax
mov r8d, 0x10
mov edx, ebx
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rcx, [rsp + 0x88]
call fcn.14000bd00
mov rdx, rax
call fcn.14000c6f0
lea rcx, [rsp + 0x88]
call fcn.14000d890
mov rax, qword [0x14005db60]
sub rax, qword [0x14005db58]
sub rax, 0x98
cmp rax, 0x98
jae 0x14000a315
lea rcx, str._drvscan__primary_input_device_has_been_selected_n
call fcn.140001350
lea rcx, str._drvscan__Press_F10_to_stop_monitoring_._._._n
call fcn.140001350
mov rdi, rbp
mov qword [rsp + 0x70], rbp
mov r15, rbp
mov r13d, ebp
mov rsi, rbp
mov qword [rsp + 0x68], rbp
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000a68f
mov r14d, 4
mov rax, qword gs:[0x58]
add r14, qword [rax]
mov qword [rsp + 0x80], r14
mov ebx, 0x20
nop word [rax + rax]
mov r12d, ebp
test rsi, rsi
jne 0x14000a3ae
mov esi, 0x18
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14000a3ae
cmp dword [rsp + 0xa0], 0
cmovne rsi, rbx
mov qword [rsp + 0x68], rsi
mov rbx, r15
mov rbp, 0xffffffffffffffff
nop dword [rax + rax]
mov eax, r15d
sub eax, ebx
add eax, r13d
mov dword [rsp + 0xa4], eax
mov r8d, 0x18
lea rdx, [rsp + 0xa4]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetRawInputBuffer]
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x14000a406
add r12d, eax
mov ecx, dword [rbx + 4]
add rbx, 7
add rbx, rcx
and rbx, 0xfffffffffffffff8
add eax, 0xffffffff
jne 0x14000a3f1
jmp 0x14000a3c0
test r15, r15
je 0x14000a41b
cmp eax, 0xffffffff
jne 0x14000a447
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000a447
mov edx, r13d
add edx, 0x60
cmovb rdx, rbp
mov rcx, r15
call fcn.1400256b0
test rax, rax
je 0x14000a447
mov rcx, rax
sub rcx, r15
add rbx, rcx
mov r15, rax
add r13d, 0x60
jmp 0x14000a3c0
mov eax, dword [r14]
cmp dword [0x14005dbe8], eax
mov ebp, 0
jle 0x14000a495
lea rcx, [0x14005dbe8]
call fcn.14001a7a8
cmp dword [0x14005dbe8], 0xffffffff
jne 0x14000a495
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa8]
mov qword [0x14005dbd8], rax
lea rcx, [0x14005dbe8]
call fcn.14001a73c
mov eax, dword [r14]
cmp dword [0x14005dbc0], eax
jle 0x14000a4de
lea rcx, [0x14005dbc0]
call fcn.14001a7a8
cmp dword [0x14005dbc0], 0xffffffff
jne 0x14000a4de
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xb0]
mov qword [0x14005dbf8], rax
lea rcx, [0x14005dbc0]
call fcn.14001a73c
mov eax, dword [r14]
cmp dword [0x14005dbe0], eax
jle 0x14000a528
lea rcx, [0x14005dbe0]
call fcn.14001a7a8
cmp dword [0x14005dbe0], 0xffffffff
jne 0x14000a528
mov ecx, dword [0x14005dbf8]
mov eax, 0x3b9aca00
test ecx, ecx
je 0x14000a516
xor edx, edx
div ecx
call fcn.14000adf0
mov dword [0x14005dbe4], eax
lea rcx, [0x14005dbe0]
call fcn.14001a73c
mov eax, dword [r14]
cmp dword [0x14005dbc8], eax
jle 0x14000a56b
lea rcx, [0x14005dbc8]
call fcn.14001a7a8
cmp dword [0x14005dbc8], 0xffffffff
jne 0x14000a56b
mov ecx, dword [0x14005dbe4]
xor edx, edx
mov eax, 0x3b9aca00
div rcx
mov qword [0x14005dc00], rax
lea rcx, [0x14005dbc8]
call fcn.14001a73c
mov eax, dword [r14]
cmp dword [0x14005dbc4], eax
jle 0x14000a5af
lea rcx, [0x14005dbc4]
call fcn.14001a7a8
cmp dword [0x14005dbc4], 0xffffffff
jne 0x14000a5af
mov ecx, dword [0x14005dbe4]
xor edx, edx
mov rax, qword [0x14005dbf8]
div rcx
mov dword [0x14005dbcc], eax
lea rcx, [0x14005dbc4]
call fcn.14001a73c
lea rcx, [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xb8]
sub rax, qword [0x14005dbd8]
imul rax, qword [0x14005dc00]
mov ecx, dword [0x14005dbcc]
xor edx, edx
div rcx
mov r14, rax
mov qword [rsp + 0x78], rax
test r12d, r12d
je 0x14000a669
sub rax, rdi
cmp r12d, 1
jbe 0x14000a60f
cmp rax, 0x5f5e100
ja 0x14000a60f
mov esi, r12d
xor edx, edx
div rsi
mov rbp, rax
test rax, rax
jne 0x14000a61b
jmp 0x14000a615
mov rdi, r14
mov esi, r12d
cmp r12d, 1
ja 0x14000a65f
mov rbx, r15
cmp qword [rsp + 0x70], 0
je 0x14000a65f
mov r14d, dword [rsp + 0x60]
nop dword [rax + rax]
add rdi, rbp
cmp dword [rbx], 0
jne 0x14000a646
mov r8, rbx
mov rdx, rdi
mov ecx, r14d
call fcn.14000a7f0
mov eax, dword [rbx + 4]
add rbx, 7
add rbx, rax
and rbx, 0xfffffffffffffff8
sub rsi, 1
jne 0x14000a630
mov r14, qword [rsp + 0x78]
mov rdi, r14
mov qword [rsp + 0x70], r14
xor ebp, ebp
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x80]
mov ebx, 0x20
je 0x14000a370
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14001a6e0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret