Function at 0x140029cd2
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], 0x96
push 0
pop rcx
call fcn.1400cfd30
mov r15, rax
push 0
pop rcx
call fcn.1400d011c
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push 0
pop rcx
call fcn.1400cfdd0
mov r15, rax
push 0
pop rcx
call fcn.1400d0174
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x140b365c0]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push 0x60
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400cf708
add rsp, 0x40
sub rsp, 8
push 0xb
push 0x67
pop rcx
sub rsp, 0x20
call fcn.1400df154
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 0x63
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c7c38
add rsp, 0x40
sub rsp, 8
push 0xb
push 0x65
pop rcx
sub rsp, 0x20
call fcn.1400df154
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 0x61
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c7c38
add rsp, 0x40
sub rsp, 8
push 0xb
push 0x66
pop rcx
sub rsp, 0x20
call fcn.1400df154
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 0x62
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c7c38
add rsp, 0x40
push qword [0x140b36848]
push 0x14
push 0xaa
push 0x78
push 0xf
push 0x64
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c465c
add rsp, 0x30
call fcn.14006023f
call fcn.1400cf6d0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14002a002
call fcn.1400d400c
mov rax, rax
push rax
mov r15, 0x60
cmp r15, qword [rsp]
jne 0x140029fff
push qword [rsp + 0x68]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x140029ffb
sub rsp, 0x20
call fcn.1400d3ff0
add rsp, 0x20
mov rax, rax
push rax
mov r15, 0x63
cmp r15, qword [rsp]
jne 0x140029f80
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14009c8c4
add rsp, 0x28
add rsp, 0x18
jmp 0x14002a064
mov r15, 0x61
cmp r15, qword [rsp]
jne 0x140029fb5
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14009c8c4
add rsp, 0x28
add rsp, 0x18
jmp 0x14002a064
mov r15, 0x62
cmp r15, qword [rsp]
jne 0x140029fe7
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14009c8c4
add rsp, 0x28
add rsp, 0x18
jmp 0x14002a064
mov r15, 0x64
cmp r15, qword [rsp]
jne 0x140029ffa
add rsp, 0x18
jmp 0x14002a064
pop rax
add rsp, 8
pop rax
jmp 0x14002a00d
push 0x60
pop rcx
call fcn.1400cf6a8
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002a036
call fcn.1400d0204
mov r15, rax
cmp r15, 0x60
jne 0x14002a036
call fcn.14006023f
jmp 0x14002a064
push 0xd
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002a05f
call fcn.1400d0204
mov r15, rax
cmp r15, 0x60
jne 0x14002a05f
call fcn.14006023f
jmp 0x14002a064
jmp 0x140029ef5
push 0x60
pop rcx
call fcn.1400cf3a8
xor rax, rax
add rsp, 0x48
pop r14
pop r15
ret