Function at 0x14002bba8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400b3bf0
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], __WSAFDIsSet
push qword [0x1406478f4]
pop rcx
call fcn.140092c28
mov r15, rax
push qword [0x1406478f4]
pop rcx
call fcn.140093124
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push qword [0x1406478f4]
pop rcx
call fcn.140092cc8
mov r15, rax
push qword [0x1406478f4]
pop rcx
call fcn.140093658
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x140647394]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400931ac
add rsp, 0x40
push reloc.WS2_32.dll_ioctlsocket
pop rcx
call fcn.1400a7910
mov rax, rax
push rax
push 0x1a
push 0xaa
push reloc.WS2_32.dll_ntohs
push reloc.WS2_32.dll_ntohs
push 6
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14008bf54
add rsp, 0x30
push 8
pop rcx
call fcn.1400a7910
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x2d
push reloc.WS2_32.dll_ntohs
push 4
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14008bf54
add rsp, 0x30
push 9
pop rcx
call fcn.1400a7910
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x4b
push reloc.WS2_32.dll_ntohs
push 5
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14008bf54
add rsp, 0x30
push qword [0x1406478bc]
push reloc.WS2_32.dll_sendto
push 0xaa
push 0x78
push reloc.WS2_32.dll_ntohs
push 7
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14008a190
add rsp, 0x30
call fcn.14004709a
call fcn.140093044
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14002bea5
call fcn.140096f98
mov rax, rax
push rax
xor r15, r15
cmp r15, qword [rsp]
jne 0x14002bea2
push qword [rsp + 0x68]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x14002be9e
sub rsp, 0x20
call fcn.140096f60
add rsp, 0x20
mov rax, rax
push rax
mov r15, 6
cmp r15, qword [rsp]
jne 0x14002be23
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.140081208
add rsp, 0x28
add rsp, 0x18
jmp 0x14002bf05
mov r15, 4
cmp r15, qword [rsp]
jne 0x14002be58
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.140081208
add rsp, 0x28
add rsp, 0x18
jmp 0x14002bf05
mov r15, 5
cmp r15, qword [rsp]
jne 0x14002be8a
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.140081208
add rsp, 0x28
add rsp, 0x18
jmp 0x14002bf05
mov r15, 7
cmp r15, qword [rsp]
jne 0x14002be9d
add rsp, 0x18
jmp 0x14002bf05
pop rax
add rsp, 8
pop rax
jmp 0x14002beb0
push 0
pop rcx
call fcn.1400936e8
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002bed8
call fcn.140093710
mov r15, rax
and r15, r15
jne 0x14002bed8
call fcn.14004709a
jmp 0x14002bf05
push reloc.WS2_32.dll_listen
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002bf00
call fcn.140093710
mov r15, rax
and r15, r15
jne 0x14002bf00
call fcn.14004709a
jmp 0x14002bf05
jmp 0x14002bd9c
push 0
pop rcx
call fcn.140092834
xor rax, rax
add rsp, 0x48
pop r14
pop r15
ret