Function at 0x140023e72
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400bd210
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], __WSAFDIsSet
push qword [0x14079fb4c]
pop rcx
call fcn.140099ccc
mov r15, rax
push qword [0x14079fb4c]
pop rcx
call fcn.14009a1c8
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push qword [0x14079fb4c]
pop rcx
call fcn.140099d6c
mov r15, rax
push qword [0x14079fb4c]
pop rcx
call fcn.14009a6fc
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x14079f5d4]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009a250
add rsp, 0x40
push reloc.WS2_32.dll_ioctlsocket
pop rcx
call fcn.1400b0508
mov rax, rax
push rax
push 0x1a
push 0xaa
push reloc.WS2_32.dll_ntohs
push reloc.WS2_32.dll_ntohs
push 6
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140092fb0
add rsp, 0x30
push 8
pop rcx
call fcn.1400b0508
mov rax, rax
push rax
push 0x1a
push 0xaa
push reloc.msi.dll_MsiGetActiveDatabase
push reloc.WS2_32.dll_ntohs
push 4
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140092fb0
add rsp, 0x30
push 9
pop rcx
call fcn.1400b0508
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x4b
push reloc.WS2_32.dll_ntohs
push 5
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140092fb0
add rsp, 0x30
push qword [0x14079fb14]
push reloc.WS2_32.dll_sendto
push 0xaa
push 0x78
push reloc.WS2_32.dll_ntohs
push 7
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400911ec
add rsp, 0x30
call fcn.140042a4f
call fcn.14009a0e8
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14002416f
call fcn.14009e478
mov rax, rax
push rax
xor r15, r15
cmp r15, qword [rsp]
jne 0x14002416c
push qword [rsp + 0x68]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x140024168
sub rsp, 0x20
call fcn.14009e440
add rsp, 0x20
mov rax, rax
push rax
mov r15, 6
cmp r15, qword [rsp]
jne 0x1400240ed
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.1400875e8
add rsp, 0x28
add rsp, 0x18
jmp 0x1400241cf
mov r15, 4
cmp r15, qword [rsp]
jne 0x140024122
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.1400875e8
add rsp, 0x28
add rsp, 0x18
jmp 0x1400241cf
mov r15, 5
cmp r15, qword [rsp]
jne 0x140024154
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.1400875e8
add rsp, 0x28
add rsp, 0x18
jmp 0x1400241cf
mov r15, 7
cmp r15, qword [rsp]
jne 0x140024167
add rsp, 0x18
jmp 0x1400241cf
pop rax
add rsp, 8
pop rax
jmp 0x14002417a
push 0
pop rcx
call fcn.14009a78c
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x1400241a2
call fcn.14009a7b4
mov r15, rax
and r15, r15
jne 0x1400241a2
call fcn.140042a4f
jmp 0x1400241cf
push reloc.WS2_32.dll_listen
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x1400241ca
call fcn.14009a7b4
mov r15, rax
and r15, r15
jne 0x1400241ca
call fcn.140042a4f
jmp 0x1400241cf
jmp 0x140024066
push 0
pop rcx
call fcn.1400998d8
xor rax, rax
add rsp, 0x48
pop r14
pop r15
ret