Function at 0x1400d9d50
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x70
test dword [rcx + 0x3c], 0x20000000
mov rbx, rcx
mov r14d, r9d
lea rcx, [rsp + 0x40]
mov ebp, r8d
mov r15, rdx
je 0x1400d9d89
call qword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x1400d9d8e
call fcn.140091270
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r12d, r12d
mov ecx, 0x10
test ax, ax
sets r12b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r13d, dword [rsp + 0xc0]
xor ecx, ecx
test ax, ax
mov eax, dword [rsp + 0xd8]
sets cl
mov r9d, r13d
mov edx, r12d
mov dword [rsp + 0xa0], ecx
mov r8d, ecx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.1400da950
mov esi, eax
test r12d, r12d
jne 0x1400d9e01
cdq
xor eax, edx
cmp eax, edx
jne 0x1400d9df6
xor eax, eax
jmp 0x1400da0a4
mov eax, dword [rsp + 0xe0]
xor edx, edx
jmp 0x1400d9e1e
test dword [rbx + 0x3c], 0x80000
mov eax, dword [rsp + 0xe0]
jne 0x1400d9e19
test eax, eax
jne 0x1400d9e19
xor edx, edx
jmp 0x1400d9e1e
mov edx, 1
test r12d, r12d
jne 0x1400d9e34
test byte [rbx + 0x3c], 2
jne 0x1400d9e2d
test eax, eax
je 0x1400d9e34
mov ecx, 1
jmp 0x1400d9e36
xor ecx, ecx
mov r8d, 0x800
test r14d, r14d
je 0x1400d9e54
mov eax, dword [rbx + 0x7c]
test al, 1
je 0x1400d9e54
test r8d, eax
je 0x1400d9e54
mov eax, 1
jmp 0x1400d9e56
xor eax, eax
mov qword [rsp + 0xa8], rdi
test r13d, r13d
jne 0x1400d9e82
test ecx, ecx
jne 0x1400d9ed5
test eax, eax
jne 0x1400d9ed5
test edx, edx
jne 0x1400d9ed5
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jge 0x1400d9ed5
xor eax, eax
jmp 0x1400da09c
mov edi, dword [rsp + 0xd0]
mov rcx, rbx
mov edx, edi
call fcn.1400dc9b0
mov ecx, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jl 0x1400d9ece
test edi, edi
je 0x1400d9ed5
test dword [rbx + 0x3c], 0x10000000
je 0x1400d9ed5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, dword [rbx + 0x74]
mov ecx, dword [rbx + 0xa0]
mov edx, eax
call fcn.140009a50
test eax, eax
je 0x1400d9ed5
inc dword [rbx + 0xa4]
xor eax, eax
jmp 0x1400da09c
test r15, r15
je 0x1400d9eed
test dword [rbx + 0x3c], 0x10000
je 0x1400d9eed
xor edx, edx
mov rcx, r15
call fcn.1400f0e20
mov edi, ebp
mov eax, ebp
and ebp, 0xc0000
shr edi, 2
and eax, 0x30000
and edi, 0x400000
or edi, eax
shr edi, 2
or edi, ebp
shr edi, 0xe
cmp dword [rsp + 0xa0], 0
je 0x1400d9f1c
or edi, 4
test r12d, r12d
je 0x1400d9f24
or edi, 8
mov ebp, 0x1000
test r14d, r14d
jne 0x1400d9f45
cmp qword [rbx + 0x58], 0
jne 0x1400d9f45
test r13d, r13d
jne 0x1400d9f45
test dword [rbx + 0x3c], ebp
jne 0x1400d9f45
lea r14d, [r13 + 1]
neg esi
call fcn.1400f02e0
xor r12d, r12d
cmp r15, rax
mov eax, dword [rbx + 0xa4]
mov ecx, r12d
sete cl
test eax, eax
je 0x1400d9f6c
inc eax
mov dword [rbx + 0xa4], r12d
imul esi, eax
test edi, edi
je 0x1400d9f76
test byte [rbx + 0x3c], 4
jne 0x1400d9f7d
mov eax, dword [rbx + 0x3c]
test al, 1
je 0x1400d9fc6
movzx ecx, word [rsp + 0x44]
movzx eax, word [rsp + 0x40]
movzx r9d, si
shl ecx, 0x10
shl r9d, 0x10
mov r8d, 0x20e
or rcx, rax
movzx eax, di
mov rdx, r15
or r9, rax
mov eax, 0x20a
test r14d, r14d
mov qword [rsp + 0x20], rcx
lea rcx, [0x140295650]
cmovne r8d, eax
call fcn.140097760
jmp 0x1400da077
bt eax, 0x15
jae 0x1400d9fd0
test ecx, ecx
jne 0x1400d9fd5
test r13d, r13d
je 0x1400da019
mov r9d, 0x28
test r14d, r14d
mov eax, 0x800
cmovne ebp, eax
lea r8, [rsp + 0x48]
lea rcx, [0x140295650]
lea edx, [r9 - 0x27]
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], r12d
call fcn.140097a90
jmp 0x1400da077
movzx ecx, word [rsp + 0x44]
movzx eax, word [rsp + 0x40]
movzx r9d, si
shl ecx, 0x10
shl r9d, 0x10
mov r8d, 0x20e
or rcx, rax
movzx eax, di
mov rdx, r15
or r9, rax
mov eax, 0x20a
test r14d, r14d
cmovne r8d, eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xc8
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rcx
lea rcx, [0x140295650]
call fcn.140097950
add dword [rbx + 0x94], esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x9c], r12d
mov dword [rbx + 0xa0], eax
mov eax, dword [rbx + 0x60]
mov dword [rbx + 0x60], r12d
cdq
xor eax, edx
sub eax, edx
mov rdi, qword [rsp + 0xa8]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rsi
ret