Function at 0x14002a0d3
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], 0x96
push 0
pop rcx
call fcn.1400cfd30
mov r15, rax
push 0
pop rcx
call fcn.1400d011c
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push 0
pop rcx
call fcn.1400cfdd0
mov r15, rax
push 0
pop rcx
call fcn.1400d0174
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x140b36a58]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push 0x60
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400cf708
add rsp, 0x40
sub rsp, 8
push 0xb
push 0x67
pop rcx
sub rsp, 0x20
call fcn.1400df154
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 0x63
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c7c38
add rsp, 0x40
sub rsp, 8
push 0xb
push 0x65
pop rcx
sub rsp, 0x20
call fcn.1400df154
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 0x61
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c7c38
add rsp, 0x40
sub rsp, 8
push 0xb
push 0x66
pop rcx
sub rsp, 0x20
call fcn.1400df154
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 0x62
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c7c38
add rsp, 0x40
push qword [0x140b36ce0]
push 0x14
push 0xaa
push 0x78
push 0xf
push 0x64
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c465c
add rsp, 0x30
call fcn.140060866
call fcn.1400cf6d0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14002a403
call fcn.1400d400c
mov rax, rax
push rax
mov r15, 0x60
cmp r15, qword [rsp]
jne 0x14002a400
push qword [rsp + 0x68]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x14002a3fc
sub rsp, 0x20
call fcn.1400d3ff0
add rsp, 0x20
mov rax, rax
push rax
mov r15, 0x63
cmp r15, qword [rsp]
jne 0x14002a381
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14009c8c4
add rsp, 0x28
add rsp, 0x18
jmp 0x14002a465
mov r15, 0x61
cmp r15, qword [rsp]
jne 0x14002a3b6
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14009c8c4
add rsp, 0x28
add rsp, 0x18
jmp 0x14002a465
mov r15, 0x62
cmp r15, qword [rsp]
jne 0x14002a3e8
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14009c8c4
add rsp, 0x28
add rsp, 0x18
jmp 0x14002a465
mov r15, 0x64
cmp r15, qword [rsp]
jne 0x14002a3fb
add rsp, 0x18
jmp 0x14002a465
pop rax
add rsp, 8
pop rax
jmp 0x14002a40e
push 0x60
pop rcx
call fcn.1400cf6a8
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002a437
call fcn.1400d0204
mov r15, rax
cmp r15, 0x60
jne 0x14002a437
call fcn.140060866
jmp 0x14002a465
push 0xd
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002a460
call fcn.1400d0204
mov r15, rax
cmp r15, 0x60
jne 0x14002a460
call fcn.140060866
jmp 0x14002a465
jmp 0x14002a2f6
push 0x60
pop rcx
call fcn.1400cf3a8
xor rax, rax
add rsp, 0x48
pop r14
pop r15
ret