Function at 0x14003f290
Capabilities:
Check for foreground window switch
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140143010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rbx
lea rcx, [0x14015e248]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x14015e248]
xor ecx, ecx
mov dword [0x14015e66c], eax
mov eax, dword [0x14015e24c]
mov dword [0x14015e640], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, 1
mov dword [0x14015e364], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x14015e368], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [0x14015e258]
call qword [sym.imp.USER32.dll_GetWindowRect]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rdi
je 0x14003f560
mov eax, dword [0x14015e260]
sub eax, dword [0x14015e258]
cmp dword [0x14015e364], eax
jne 0x14003f560
mov eax, dword [0x14015e264]
sub eax, dword [0x14015e25c]
cmp dword [0x14015e368], eax
jne 0x14003f560
mov ecx, dword [0x14015e32c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
je 0x14003f560
cmp byte [0x14015e334], 0
mov qword [rsp + 0x58], rsi
je 0x14003f396
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea ecx, [rbx + 0x17]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
lea ecx, [rbx + 0x3b]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
mov esi, 3
nop dword [rax + rax]
mov edi, 0xa
nop word [rax + rax]
mov edx, dword [0x14015e330]
mov ecx, dword [0x14015e320]
call qword [sym.imp.USER32.dll_SetCursorPos]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x201
call qword [sym.imp.USER32.dll_PostMessageA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x202
call qword [sym.imp.USER32.dll_PostMessageA]
add dword [0x14015e320], 5
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x201
call qword [sym.imp.USER32.dll_PostMessageA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x202
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rdi, rbx
jne 0x14003f3c0
add dword [0x14015e330], 5
mov eax, dword [0x14015e324]
mov dword [0x14015e320], eax
sub rsi, rbx
jne 0x14003f3b0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x201
call qword [sym.imp.USER32.dll_PostMessageA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x202
call qword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [rdi + 0x3c]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
lea r8d, [rdi + 2]
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea ecx, [rdi + 4]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
cmp byte [0x14015e335], dil
mov rsi, qword [rsp + 0x58]
je 0x14003f501
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
lea r8d, [rdi + 2]
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x14015e324]
mov ecx, 0x37
mov dword [0x14015e320], eax
mov eax, dword [0x14015e338]
mov dword [0x14015e330], eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14003f556
xor r9d, r9d
xor edx, edx
movzx ecx, bl
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
inc ebx
cmp ebx, 0x100
jl 0x14003f524
cmp byte [0x14015e328], 0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
je 0x14003f5b5
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14003f5b5
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x30]
mov dword [0x14015e320], eax
mov dword [0x14015e324], eax
mov eax, dword [rsp + 0x34]
mov dword [0x14015e330], eax
mov dword [0x14015e338], eax
mov byte [0x14015e328], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c9100
add rsp, 0x48
ret