Function at 0x140022964
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
sub rsp, 0x28
call fcn.1400bc5a0
push SafeArrayPutElement
pop rcx
call fcn.140018085
and rax, rax
je 0x140022a13
lea rbp, [0x1404bc530]
mov r15, qword [rbp + 0x10]
cmp r15, 8
jne 0x1400229d5
push SafeArrayPutElement
pop rcx
call fcn.14009d020
mov r15, rax
push reloc.OLEAUT32.dll_SafeArrayGetLBound
pop rcx
call fcn.1400b2620
cmp r15, rax
je 0x1400229d3
push reloc.OLEAUT32.dll_SafeArrayGetLBound
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.14009cae8
jmp 0x140022a0e
push SafeArrayPutElement
pop rcx
call fcn.14009d020
mov r15, rax
push reloc.WS2_32.dll_inet_addr
pop rcx
call fcn.1400b2620
cmp r15, rax
je 0x140022a0e
push reloc.WS2_32.dll_inet_addr
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.14009cae8
jmp 0x140022a98
lea rbp, [0x1404bc530]
mov r15, qword [rbp + 0x10]
cmp r15, 8
jne 0x140022a5f
push SafeArrayPutElement
pop rcx
call fcn.14009d020
mov r15, rax
push reloc.OLEAUT32.dll_SafeArrayGetLBound
pop rcx
call fcn.1400b2620
cmp r15, rax
je 0x140022a5d
push reloc.OLEAUT32.dll_SafeArrayGetLBound
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.14009cae8
jmp 0x140022a98
push SafeArrayPutElement
pop rcx
call fcn.14009d020
mov r15, rax
push reloc.WS2_32.dll_ioctlsocket
pop rcx
call fcn.1400b2620
cmp r15, rax
je 0x140022a98
push reloc.WS2_32.dll_ioctlsocket
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.14009cae8
push reloc.WS2_32.dll_socket
pop rcx
call fcn.140018085
and rax, rax
je 0x140022ae3
push reloc.WS2_32.dll_socket
pop rcx
call fcn.14009d020
mov r15, rax
push recvfrom
pop rcx
call fcn.1400b2620
cmp r15, rax
je 0x140022ae1
push recvfrom
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push reloc.WS2_32.dll_socket
pop rcx
pop rdx
call fcn.14009cae8
jmp 0x140022b1c
push reloc.WS2_32.dll_socket
pop rcx
call fcn.14009d020
mov r15, rax
push recvfrom
pop rcx
call fcn.1400b2620
cmp r15, rax
je 0x140022b1c
push recvfrom
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push reloc.WS2_32.dll_socket
pop rcx
pop rdx
call fcn.14009cae8
push SafeArrayPutElement
pop rcx
call fcn.140018085
and rax, rax
je 0x140022b67
push SafeArrayPutElement
pop rcx
call fcn.14009d020
mov r15, rax
push reloc.OLEAUT32.dll_SafeArrayGetElemsize
pop rcx
call fcn.1400b2620
cmp r15, rax
je 0x140022b65
push reloc.OLEAUT32.dll_SafeArrayGetElemsize
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.14009cae8
jmp 0x140022ba0
push SafeArrayPutElement
pop rcx
call fcn.14009d020
mov r15, rax
push reloc.WS2_32.dll_recv
pop rcx
call fcn.1400b2620
cmp r15, rax
je 0x140022ba0
push reloc.WS2_32.dll_recv
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.14009cae8
push qword [0x1404bc1f0]
pop rcx
call fcn.14004dcb4
and rax, rax
je 0x140022bb6
xor rax, rax
jmp 0x140022bbd
mov rax, 1
and rax, rax
je 0x140022bcf
mov qword [0x1404bc1f0], 0
jmp 0x140022bcf
push MsiGetPropertyW
pop rcx
call fcn.140018085
and rax, rax
je 0x140022c81
call fcn.1400a82e0
mov r15, rax
and r15, r15
jne 0x140022c81
lea rbp, [0x1404bc530]
mov r15, qword [rbp + 8]
cmp r15, 3
je 0x140022c18
lea rbp, [0x1404bc530]
mov r15, qword [rbp + 8]
cmp r15, 5
je 0x140022c18
jmp 0x140022c21
mov rax, 1
jmp 0x140022c24
xor rax, rax
and rax, rax
je 0x140022c2e
call fcn.14002c9d7
push qword [0x1404bc168]
push 0xffffffffffffffff
push 0x4c
pop rcx
pop rdx
pop r8
call fcn.14009d104
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xb1
sub rsp, 8
push 0x4c
pop rcx
sub rsp, 0x20
call fcn.14009ce68
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
call fcn.14002bcda
mov r15, qword [0x1404bc1b0]
and r15, r15
jle 0x140022cff
mov r15, qword [0x1404bbd98]
push 0
push 1
push 0
push 0x4d
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400a45a0
cmp r15, rax
jne 0x140022ce5
mov r15, qword [0x1404bbda8]
push 1
push 1
push 0
push 0x4d
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400a45a0
cmp r15, rax
jne 0x140022ce5
jmp 0x140022cee
mov rax, 1
jmp 0x140022cf1
xor rax, rax
and rax, rax
je 0x140022cff
mov rax, 1
jmp 0x140022d02
xor rax, rax
and rax, rax
je 0x140022d53
push 0
push 1
push 0
push 0x4d
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400a45a0
mov qword [0x1404bbd98], rax
push 1
push 1
push 0
push 0x4d
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400a45a0
mov qword [0x1404bbda8], rax
lea rbp, [0x1404bc530]
mov r15, qword [rbp + 8]
cmp r15, 5
jne 0x140022e17
push reloc.OLEAUT32.dll_SafeArrayGetElemsize
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x140022e17
push rcx
sub rsp, 0x28
call main
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call main
add rsp, 0x28
pop rcx
push rax
push 0x5f
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14009cd54
add rsp, 0x28
call fcn.1400bc470
movabs rcx, 0x1402791b4
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.1400bc4a0
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.1400bc3b0
or rax, rax
je 0x140022e00
movabs rax, str.Clear_Log
push rax
push 0x5f
pop rcx
pop rdx
call fcn.14009cc78
jmp 0x140022e17
movabs rax, 0x1402791b4
push rax
push 0x5f
pop rcx
pop rdx
call fcn.14009cc78
xor rax, rax
add rsp, 0x28
pop r15
pop rbp
ret