Function at 0x14002c09c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
push r14
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14002c0b1
sub rsp, 0x28
call fcn.1400ac690
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400ac730
add rsp, 0x10
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400ac730
add rsp, 0x10
mov qword [rsp + 0x38], 0x1a4
mov qword [rsp + 0x40], 0xa0
push qword [0x14067ca68]
pop rcx
call fcn.14008cc04
mov r15, rax
push qword [0x14067ca68]
pop rcx
call fcn.14008c77c
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x38]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x48], r15
push qword [0x14067ca68]
pop rcx
call fcn.14008cca4
mov r15, rax
push qword [0x14067ca68]
pop rcx
call fcn.14008cd24
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x40]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x50], r15
push rcx
sub rsp, 0x28
call fcn.1400ac3b0
add rsp, 0x28
pop rcx
push rax
movabs rax, 0x80000004
push rax
mov rcx, qword [0x14067c838]
push rcx
sub rsp, 0x28
call fcn.1400ac3b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400ac400
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400ac400
add rsp, 0x28
call fcn.1400ac610
push qword [rsp + 0x58]
push qword [rsp + 0x58]
push qword [rsp + 0x78]
push qword [rsp + 0x78]
push 1
push rax
call fcn.1400ac5e0
mov rdx, rax
pop rax
add qword [rsp + 0x28], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14008c804
add rsp, 0x38
pop rcx
push rax
sub rsp, 0x28
call fcn.14005a378
add rsp, 0x28
pop rax
push qword [rsp + 0x30]
push 0x50
push 0x17c
push 0xa
push 0xf
push 3
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14008792c
add rsp, 0x30
push qword [0x14067c6c0]
push 0x1e
push 0x14a
push 0x6e
push 0x2d
push 7
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140084310
add rsp, 0x30
call fcn.14003eaa4
call fcn.14008cd1c
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14002c46f
call fcn.140090ba8
mov rax, rax
push rax
mov r15, 1
cmp r15, qword [rsp]
jne 0x14002c46c
push qword [rsp + 0x60]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x14002c46b
sub rsp, 0x20
call fcn.140090b70
add rsp, 0x20
mov rax, rax
push rax
mov r15, 7
cmp r15, qword [rsp]
jne 0x14002c46a
push qword [rsp + 0x40]
movabs rcx, str.0xC004F074
pop rdx
sub rsp, 0x28
call fcn.1400ac550
add rsp, 0x28
or rax, rax
je 0x14002c363
sub rsp, 8
movabs rax, str.https:__msfreemicrosoft.ru_viewtopic.php_p55p55
push rax
pop rcx
sub rsp, 0x20
call fcn.14007b038
add rsp, 0x28
jmp 0x14002c464
push qword [rsp + 0x40]
movabs rcx, str.0xC004F035
pop rdx
sub rsp, 0x28
call fcn.1400ac550
add rsp, 0x28
or rax, rax
je 0x14002c3a6
sub rsp, 8
movabs rax, str.https:__msfreemicrosoft.ru_viewtopic.php_p56p56
push rax
pop rcx
sub rsp, 0x20
call fcn.14007b038
add rsp, 0x28
jmp 0x14002c464
push qword [rsp + 0x40]
movabs rcx, str.0xC004E015
pop rdx
sub rsp, 0x28
call fcn.1400ac550
add rsp, 0x28
or rax, rax
je 0x14002c3e6
sub rsp, 8
movabs rax, str.https:__msfreemicrosoft.ru_viewtopic.php_p57p57
push rax
pop rcx
sub rsp, 0x20
call fcn.14007b038
add rsp, 0x28
jmp 0x14002c464
push qword [rsp + 0x40]
movabs rcx, str.0x80040154
pop rdx
sub rsp, 0x28
call fcn.1400ac550
add rsp, 0x28
or rax, rax
je 0x14002c426
sub rsp, 8
movabs rax, str.https:__msfreemicrosoft.ru_viewtopic.php_p58p58
push rax
pop rcx
sub rsp, 0x20
call fcn.14007b038
add rsp, 0x28
jmp 0x14002c464
push qword [rsp + 0x40]
movabs rcx, str.0xC004F038
pop rdx
sub rsp, 0x28
call fcn.1400ac550
add rsp, 0x28
or rax, rax
je 0x14002c464
sub rsp, 8
movabs rax, str.https:__msfreemicrosoft.ru_viewtopic.php_p65p65
push rax
pop rcx
sub rsp, 0x20
call fcn.14007b038
add rsp, 0x28
add rsp, 0x18
jmp 0x14002c4d1
pop rax
pop rax
pop rax
jmp 0x14002c47a
push 1
pop rcx
call fcn.14008cdb4
push 0x1b
pop rcx
call sub.USER32.DLL_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002c4a3
call fcn.14008cddc
mov r15, rax
cmp r15, 1
jne 0x14002c4a3
call fcn.14003eaa4
jmp 0x14002c4d1
push 0xd
pop rcx
call sub.USER32.DLL_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14002c4cc
call fcn.14008cddc
mov r15, rax
cmp r15, 1
jne 0x14002c4cc
call fcn.14003eaa4
jmp 0x14002c4d1
jmp 0x14002c2b9
push 1
pop rcx
call fcn.14008c334
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400ac700
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400ac700
add rsp, 0x28
pop rax
add rsp, 0x68
pop r14
pop r15
ret