Function at 0x1400180fa
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400bc5a0
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], __WSAFDIsSet
call fcn.140096ecc
movabs rbp, 0x1404b114c
mov rax, rbp
push rax
push 0x23
pop rcx
pop rdx
call fcn.1400b2454
movabs rbp, 0x1404b1c8a
mov rax, rbp
push rax
push 0x24
pop rcx
pop rdx
call fcn.1400b2454
movabs rbp, 0x1404b2788
mov rax, rbp
push rax
push 0x25
pop rcx
pop rdx
call fcn.1400b2454
push 0x23
pop rcx
call fcn.140019abc
push 0x24
pop rcx
call fcn.140019abc
push 0x25
pop rcx
call fcn.140019abc
push 0
pop rcx
call fcn.1400a6834
mov r15, rax
push 0
pop rcx
call fcn.1400a6e08
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push 0
pop rcx
call fcn.1400a67bc
mov r15, rax
push 0
pop rcx
call fcn.1400a6e60
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x1404bbf58]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push 0x1e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a6904
add rsp, 0x40
sub rsp, 8
push qword [rsp + 0x38]
push qword [rsp + 0x38]
push 0
push 0
push 0xffffffffffffffff
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009c0fc
add rsp, 0x30
mov qword [rsp + 0x48], rax
push 0x4d
push 0x4d
push 0x4d
pop rcx
pop rdx
pop r8
call fcn.1400b1e7c
mov rax, rax
push rax
push 2
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
call fcn.14009b308
push 0x25
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push 0x1a
push 0xaa
push SafeArrayGetLBound
push SafeArrayGetLBound
push 0x21
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a4278
add rsp, 0x30
push 0x23
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push 0x1a
push 0xaa
push reloc.msi.dll_MsiGetActiveDatabase
push SafeArrayGetLBound
push 0x1f
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a4278
add rsp, 0x30
push 0x24
pop rcx
call fcn.1400b2620
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x4b
push SafeArrayGetLBound
push 0x20
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a4278
add rsp, 0x30
push qword [0x1404bc250]
push socket
push 0xaa
push 0x78
push SafeArrayGetLBound
push 0x22
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a1d5c
add rsp, 0x30
call fcn.14002bcda
push 0x258
pop rcx
call fcn.1400a5e1c
call fcn.1400a67b4
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x1400184d9
call fcn.1400a8318
mov rax, rax
push rax
mov r15, 0x1e
cmp r15, qword [rsp]
jne 0x1400184d6
push qword [rsp + 0x78]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x1400184d2
sub rsp, 0x20
call fcn.1400a82fc
add rsp, 0x20
mov rax, rax
push rax
mov r15, 0x21
cmp r15, qword [rsp]
jne 0x140018457
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14006f0e8
add rsp, 0x28
add rsp, 0x18
jmp 0x14001853b
mov r15, 0x1f
cmp r15, qword [rsp]
jne 0x14001848c
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14006f0e8
add rsp, 0x28
add rsp, 0x18
jmp 0x14001853b
mov r15, 0x20
cmp r15, qword [rsp]
jne 0x1400184be
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14006f0e8
add rsp, 0x28
add rsp, 0x18
jmp 0x14001853b
mov r15, 0x22
cmp r15, qword [rsp]
jne 0x1400184d1
add rsp, 0x18
jmp 0x14001853b
pop rax
add rsp, 8
pop rax
jmp 0x1400184e4
push 0x1e
pop rcx
call fcn.1400a6de0
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14001850d
call fcn.1400a6d8c
mov r15, rax
cmp r15, 0x1e
jne 0x14001850d
call fcn.14002bcda
jmp 0x14001853b
push recvfrom
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x140018536
call fcn.1400a6d8c
mov r15, rax
cmp r15, 0x1e
jne 0x140018536
call fcn.14002bcda
jmp 0x14001853b
jmp 0x1400183cc
push 0x1e
pop rcx
call fcn.1400a6144
xor rax, rax
add rsp, 0x50
pop r14
pop r15
pop rbp
ret