Function at 0x140028043
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
push r14
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140028058
sub rsp, 0x28
call fcn.1400bd210
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400bd2b0
add rsp, 0x10
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400bd2b0
add rsp, 0x10
mov qword [rsp + 0x38], 0x1a4
mov qword [rsp + 0x40], 0xa0
push qword [0x14079fb4c]
pop rcx
call fcn.140099ccc
mov r15, rax
push qword [0x14079fb4c]
pop rcx
call fcn.14009a1c8
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x38]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x48], r15
push qword [0x14079fb4c]
pop rcx
call fcn.140099d6c
mov r15, rax
push qword [0x14079fb4c]
pop rcx
call fcn.14009a6fc
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x40]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x50], r15
push rcx
sub rsp, 0x28
call fcn.1400bcf30
add rsp, 0x28
pop rcx
push rax
movabs rax, 0x80000004
push rax
mov rcx, qword [0x14079f8cc]
push rcx
sub rsp, 0x28
call fcn.1400bcf30
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400bcf80
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400bcf80
add rsp, 0x28
call fcn.1400bd190
push qword [rsp + 0x58]
push qword [rsp + 0x58]
push qword [rsp + 0x78]
push qword [rsp + 0x78]
push 1
push rax
call fcn.1400bd160
mov rdx, rax
pop rax
add qword [rsp + 0x28], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009a250
add rsp, 0x38
pop rcx
push rax
sub rsp, 0x28
call fcn.140066f00
add rsp, 0x28
pop rax
push qword [rsp + 0x30]
push 0x50
push 0x17c
push reloc.WS2_32.dll_ioctlsocket
push reloc.WS2_32.dll_ntohs
push 3
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009496c
add rsp, 0x30
push qword [0x14079f73c]
push 0x1e
push 0x14a
push WSASetLastError
push reloc.msi.dll_MsiGetActiveDatabase
push 7
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400911ec
add rsp, 0x30
call fcn.140042a4f
call fcn.14009a0e8
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x140028419
call fcn.14009e478
mov rax, rax
push rax
mov r15, 1
cmp r15, qword [rsp]
jne 0x140028416
push qword [rsp + 0x60]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x140028412
sub rsp, 0x20
call fcn.14009e440
add rsp, 0x20
mov rax, rax
push rax
mov r15, 7
cmp r15, qword [rsp]
jne 0x140028411
push qword [rsp + 0x40]
movabs rcx, str.0xC004F074
pop rdx
sub rsp, 0x28
call fcn.1400bd0d0
add rsp, 0x28
or rax, rax
je 0x14002830a
sub rsp, 8
movabs rax, str.https:__msfree.su_index.php_threads_514_
push rax
pop rcx
sub rsp, 0x20
call fcn.1400875e8
add rsp, 0x28
jmp 0x14002840b
push qword [rsp + 0x40]
movabs rcx, str.0xC004F035
pop rdx
sub rsp, 0x28
call fcn.1400bd0d0
add rsp, 0x28
or rax, rax
je 0x14002834d
sub rsp, 8
movabs rax, str.https:__msfree.su_index.php_threads_515_
push rax
pop rcx
sub rsp, 0x20
call fcn.1400875e8
add rsp, 0x28
jmp 0x14002840b
push qword [rsp + 0x40]
movabs rcx, str.0xC004E015
pop rdx
sub rsp, 0x28
call fcn.1400bd0d0
add rsp, 0x28
or rax, rax
je 0x14002838d
sub rsp, 8
movabs rax, 0x1401e5198
push rax
pop rcx
sub rsp, 0x20
call fcn.1400875e8
add rsp, 0x28
jmp 0x14002840b
push qword [rsp + 0x40]
movabs rcx, str.0x80040154
pop rdx
sub rsp, 0x28
call fcn.1400bd0d0
add rsp, 0x28
or rax, rax
je 0x1400283cd
sub rsp, 8
movabs rax, str.https:__msfree.su_index.php_threads_517_
push rax
pop rcx
sub rsp, 0x20
call fcn.1400875e8
add rsp, 0x28
jmp 0x14002840b
push qword [rsp + 0x40]
movabs rcx, str.0xC004F038
pop rdx
sub rsp, 0x28
call fcn.1400bd0d0
add rsp, 0x28
or rax, rax
je 0x14002840b
sub rsp, 8
movabs rax, str.https:__msfree.su_index.php_threads_519_
push rax
pop rcx
sub rsp, 0x20
call fcn.1400875e8
add rsp, 0x28
add rsp, 0x18
jmp 0x14002847b
pop rax
add rsp, 8
pop rax
jmp 0x140028424
push 1
pop rcx
call fcn.14009a78c
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002844d
call fcn.14009a7b4
mov r15, rax
cmp r15, 1
jne 0x14002844d
call fcn.140042a4f
jmp 0x14002847b
push reloc.WS2_32.dll_listen
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x140028476
call fcn.14009a7b4
mov r15, rax
cmp r15, 1
jne 0x140028476
call fcn.140042a4f
jmp 0x14002847b
jmp 0x140028260
push 1
pop rcx
call fcn.1400998d8
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400bd280
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400bd280
add rsp, 0x28
pop rax
add rsp, 0x68
pop r14
pop r15
ret