Function at 0x18009d070
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov rdx, qword [0x18021f398]
mov rax, qword [0x18021f3a0]
movsxd rcx, dword [0x180223308]
sub rax, rdx
sar rax, 3
cmp rax, rcx
jbe 0x18009d3d7
movzx eax, byte [reloc.WS2_32.dll_accept]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
movsxd rsi, dword [rdx + rcx*8 + 4]
mov qword [rsp + 0x48], rdi
movsxd rdi, dword [rdx + rcx*8]
mov qword [rsp + 0x20], r14
mov r14d, 4
test al, al
jne 0x18009d27e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x204
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword gs:[0x58]
mov ecx, dword [0x180221e98]
mov rbx, qword [rax + rcx*8]
add rbx, r14
mov eax, dword [rbx]
cmp dword [0x1802246a8], eax
jle 0x18009d12e
lea rcx, [0x1802246a8]
call fcn.180142eb0
cmp dword [0x1802246a8], 0xffffffff
jne 0x18009d12e
lea rcx, [0x1802246a8]
mov byte [0x1802246ac], 0
call fcn.180142e50
mov eax, dword [rbx]
cmp dword [0x1802246b0], eax
jle 0x18009d17d
lea rcx, [0x1802246b0]
call fcn.180142eb0
cmp dword [0x1802246b0], 0xffffffff
jne 0x18009d17d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1802246b0]
mov qword [0x180222f30], rax
call fcn.180142e50
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
imul rcx, rdi, 0xffffffffffffd8f0
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rcx
xor ecx, ecx
call qword [0x180222f30]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x205
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rbx]
cmp dword [0x1802246a8], eax
jle 0x18009d1f9
lea rcx, [0x1802246a8]
call fcn.180142eb0
cmp dword [0x1802246a8], 0xffffffff
jne 0x18009d1f9
lea rcx, [0x1802246a8]
mov byte [0x1802246ac], 0
call fcn.180142e50
mov eax, dword [rbx]
cmp dword [0x1802246b0], eax
jle 0x18009d248
lea rcx, [0x1802246b0]
call fcn.180142eb0
cmp dword [0x1802246b0], 0xffffffff
jne 0x18009d248
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1802246b0]
mov qword [0x180222f30], rax
call fcn.180142e50
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
imul rcx, rsi, 0xffffffffffffd8f0
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rcx
xor ecx, ecx
call qword [0x180222f30]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
movzx eax, byte [reloc.WS2_32.dll_accept]
mov rsi, qword [rsp + 0x40]
test al, al
je 0x18009d3bd
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x205
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x204
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword gs:[0x58]
mov edx, dword [0x180221e98]
mov rbx, qword [rax + rdx*8]
mov eax, dword [rbx + r14]
cmp dword [0x1802246a8], eax
jle 0x18009d308
lea rcx, [0x1802246a8]
call fcn.180142eb0
cmp dword [0x1802246a8], 0xffffffff
jne 0x18009d308
lea rcx, [0x1802246a8]
mov byte [0x1802246ac], 0
call fcn.180142e50
mov eax, dword [rbx + r14]
cmp dword [0x1802246b0], eax
jle 0x18009d359
lea rcx, [0x1802246b0]
call fcn.180142eb0
cmp dword [0x1802246b0], 0xffffffff
jne 0x18009d359
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1802246b0]
mov qword [0x180222f30], rax
call fcn.180142e50
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea eax, [rdi*4]
xor ecx, ecx
movsxd rdx, eax
imul rax, rdx, 0xffffffffffffd8f0
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call qword [0x180222f30]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18009d3bd
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x205
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
inc dword [0x180222f78]
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
call fcn.180024d40
int3