Function at 0x14008cc70
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r12, [0x140260a80]
xor edx, edx
mov rcx, r12
mov r8d, 0xff
mov esi, eax
call sub.VCRUNTIME140.dll_memset
xor r15d, r15d
mov rbx, r12
mov edi, r15d
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rbx]
test ax, ax
jns 0x14008ccbf
test ecx, ecx
jne 0x14008ccc6
mov dword [rbx], 1
jmp 0x14008ccc6
test ecx, ecx
je 0x14008ccc6
mov dword [rbx], r15d
inc edi
add rbx, 4
cmp edi, 0xff
jl 0x14008cca4
cmp byte [0x14025d3d1], r15b
je 0x14008cf6c
mov qword [rsp + 0x50], rbp
lea rbp, [0x140000000]
mov qword [rsp + 0x60], r14
lea r14, [0x1402609a0]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov ebx, r15d
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsxd rdx, ebx
mov ecx, dword [r12 + rdx*4]
test ax, ax
jns 0x14008cd39
test ecx, ecx
jne case.0x14008cdb4.160
mov dword [r12 + rdx*4], 1
jmp case.0x14008cdb4.160
test ecx, ecx
je case.0x14008cdb4.160
mov dword [r12 + rdx*4], r15d
movzx edx, bl
mov ecx, edx
sub ecx, 1
je case.0x14008cdb4.160
sub ecx, 1
je case.0x14008cdb4.160
cmp ecx, 2
je case.0x14008cdb4.160
mov rax, qword [0x14025dc10]
cmp byte [rax], r15b
je 0x14008cd91
mov ecx, edx
sub ecx, 0x10
je case.0x14008cdb4.160
sub ecx, 0x90
je case.0x14008cdb4.160
cmp ecx, 1
je case.0x14008cdb4.160
mov rax, qword [0x14025dc08]
cmp byte [rax], r15b
je 0x14008cdb6
lea eax, [rdx - 0xa0]
cmp eax, 5
ja case.default.0x14008cdb4
cdqe
mov ecx, dword [rbp + rax*4 + 0x8cf80]
add rcx, rbp
jmp rcx
mov ecx, edx
sub ecx, 0x10
je case.0x14008cdb4.160
sub ecx, 1
je case.0x14008cdb4.160
cmp ecx, 1
je case.0x14008cdb4.160
test bl, bl
je case.0x14008cdb4.160
cmp qword [0x140260980], r15
mov byte [0x140260e7c], dl
je 0x14008ce79
cmp dl, 8
jne 0x14008ce25
movzx eax, byte [0x140260991]
test al, al
je case.0x14008cdb4.160
lea rcx, [rax - 1]
cmp rcx, 9
jae 0x14008cf78
add al, 0xff
mov byte [rcx + rbp + 0x260988], r15b
mov byte [0x140260991], al
jmp case.0x14008cdb4.160
movzx r8d, byte [0x140260991]
mov rax, r15
test r8b, r8b
je 0x14008ce55
nop word [rax + rax]
cmp byte [rax + rbp + 0x260988], dl
je case.0x14008cdb4.160
inc rax
cmp rax, r8
jl 0x14008ce40
cmp r8b, 8
jb 0x14008ce65
cmp dl, 0x1b
je 0x14008ce65
cmp dl, 0xd
jne case.0x14008cdb4.160
mov byte [r8 + rbp + 0x260988], dl
inc r8b
mov byte [0x140260991], r8b
jmp case.0x14008cdb4.160
movzx ecx, byte [0x1402609a8]
mov rax, r15
test rcx, rcx
je 0x14008ce96
cmp byte [rax + r14], dl
je case.0x14008cdb4.160
inc rax
cmp rax, rcx
jl 0x14008ce88
cmp byte [0x1402609a8], 8
jae case.0x14008cdb4.160
mov rax, qword [0x14025dc18]
mov esi, edi
mov byte [rcx + r14], dl
movzx ecx, byte [0x1402609a8]
inc cl
mov byte [0x1402609a8], cl
cmp byte [rax], r15b
jne case.0x14008cdb4.160
cmp dl, 0xd
je case.0x14008cdb4.160
cmp dl, 0x1b
je case.0x14008cdb4.160
movzx r8d, cl
xor r9d, r9d
mov rcx, r14
lea rdx, [r8 + r14]
call fcn.1400807a0
inc ebx
cmp ebx, 0xff
jl 0x14008cd10
sub edi, esi
cmp edi, 0x64
jbe 0x14008cf19
cmp byte [0x1402609a8], r15b
jbe 0x14008cf10
mov rax, qword [0x1402609a0]
mov qword [0x140260998], rax
mov byte [0x1402609a8], r15b
xor eax, eax
mov qword [0x1402609a0], rax
cmp qword [0x140260980], r15
jne 0x14008cf3f
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x58]
lea rcx, [0x14025d3d8]
call fcn.14008c9e0
mov byte [0x140260e7c], r15b
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x140260a68]
cmp byte [0x14025d3d1], r15b
jne 0x14008cd00
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140090680
int3