Function at 0x14002c4e3
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400c8640
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], __WSAFDIsSet
push qword [0x1416813d0]
pop rcx
call fcn.1400a3b70
mov r15, rax
push qword [0x1416813d0]
pop rcx
call fcn.1400a406c
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push qword [0x1416813d0]
pop rcx
call fcn.1400a3c10
mov r15, rax
push qword [0x1416813d0]
pop rcx
call fcn.1400a46b4
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x141680e80]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a40f4
add rsp, 0x40
push reloc.WS2_32.dll_ioctlsocket
pop rcx
call fcn.1400bad74
mov rax, rax
push rax
push 0x1a
push 0xaa
push reloc.WS2_32.dll_ntohs
push reloc.WS2_32.dll_ntohs
push 6
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009d038
add rsp, 0x30
push 8
pop rcx
call fcn.1400bad74
mov rax, rax
push rax
push 0x1a
push 0xaa
push reloc.msi.dll_MsiGetActiveDatabase
push reloc.WS2_32.dll_ntohs
push 4
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009d038
add rsp, 0x30
push 9
pop rcx
call fcn.1400bad74
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x4b
push reloc.WS2_32.dll_ntohs
push 5
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009d038
add rsp, 0x30
push qword [0x141681398]
push reloc.WS2_32.dll_sendto
push 0xaa
push 0x78
push reloc.WS2_32.dll_ntohs
push 7
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009b2e0
add rsp, 0x30
call fcn.14004e3ed
call fcn.1400a3f8c
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14002c7a6
call fcn.1400a86c8
mov rax, rax
push rax
xor r15, r15
cmp r15, qword [rsp]
jne 0x14002c7a3
push qword [rsp + 0x68]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x14002c79f
sub rsp, 0x20
call fcn.1400a8690
add rsp, 0x20
mov rax, rax
push rax
mov r15, 6
cmp r15, qword [rsp]
jne 0x14002c75e
sub rsp, 8
movabs rax, 0x1401e0ef6
push rax
pop rcx
sub rsp, 0x20
call fcn.140091aa8
add rsp, 0x28
add rsp, 0x18
jmp 0x14002c806
mov r15, 4
cmp r15, qword [rsp]
jne 0x14002c776
add rsp, 0x18
jmp 0x14002c806
mov r15, 5
cmp r15, qword [rsp]
jne 0x14002c78b
add rsp, 0x18
jmp 0x14002c806
mov r15, 7
cmp r15, qword [rsp]
jne 0x14002c79e
add rsp, 0x18
jmp 0x14002c806
pop rax
add rsp, 8
pop rax
jmp 0x14002c7b1
push 0
pop rcx
call fcn.1400a4744
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002c7d9
call fcn.1400a45a0
mov r15, rax
and r15, r15
jne 0x14002c7d9
call fcn.14004e3ed
jmp 0x14002c806
push reloc.WS2_32.dll_listen
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002c801
call fcn.1400a45a0
mov r15, rax
and r15, r15
jne 0x14002c801
call fcn.14004e3ed
jmp 0x14002c806
jmp 0x14002c6d7
push 0
pop rcx
call fcn.1400a37a4
xor rax, rax
add rsp, 0x48
pop r14
pop r15
ret