Function at 0x140022c64
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400f3290
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], __WSAFDIsSet
push 0
pop rcx
call fcn.1400d812c
mov r15, rax
push 0
pop rcx
call fcn.1400d8518
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push 0
pop rcx
call fcn.1400d81cc
mov r15, rax
push 0
pop rcx
call fcn.1400d8570
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x141ef55f8]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push 0x5d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400d7b04
add rsp, 0x40
sub rsp, 8
push reloc.WS2_32.dll_inet_addr
push 0x64
pop rcx
sub rsp, 0x20
call fcn.1400e89ec
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push SafeArrayGetLBound
push SafeArrayGetLBound
push 0x60
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400d01d4
add rsp, 0x40
sub rsp, 8
push reloc.WS2_32.dll_inet_addr
push 0x62
pop rcx
sub rsp, 0x20
call fcn.1400e89ec
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push reloc.msi.dll_MsiGetActiveDatabase
push SafeArrayGetLBound
push 0x5e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400d01d4
add rsp, 0x40
sub rsp, 8
push reloc.WS2_32.dll_inet_addr
push 0x63
pop rcx
sub rsp, 0x20
call fcn.1400e89ec
add rsp, 0x20
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x4b
push SafeArrayGetLBound
push 0x5f
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400d01d4
add rsp, 0x40
push qword [0x141ef5850]
push socket
push 0xaa
push 0x78
push SafeArrayGetLBound
push 0x61
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400ccd78
add rsp, 0x30
call fcn.14005e7e5
call fcn.1400d7acc
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140022f5a
call fcn.1400dc61c
mov rax, rax
push rax
mov r15, 0x5d
cmp r15, qword [rsp]
jne 0x140022f57
push qword [rsp + 0x68]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x140022f53
sub rsp, 0x20
call fcn.1400dc600
add rsp, 0x20
mov rax, rax
push rax
mov r15, 0x60
cmp r15, qword [rsp]
jne 0x140022f12
sub rsp, 8
movabs rax, 0x1401c5ec6
push rax
pop rcx
sub rsp, 0x20
call fcn.1400a2d24
add rsp, 0x28
add rsp, 0x18
jmp 0x140022fbc
mov r15, 0x5e
cmp r15, qword [rsp]
jne 0x140022f2a
add rsp, 0x18
jmp 0x140022fbc
mov r15, 0x5f
cmp r15, qword [rsp]
jne 0x140022f3f
add rsp, 0x18
jmp 0x140022fbc
mov r15, 0x61
cmp r15, qword [rsp]
jne 0x140022f52
add rsp, 0x18
jmp 0x140022fbc
pop rax
add rsp, 8
pop rax
jmp 0x140022f65
push 0x5d
pop rcx
call fcn.1400d7aa4
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x140022f8e
call fcn.1400d8600
mov r15, rax
cmp r15, 0x5d
jne 0x140022f8e
call fcn.14005e7e5
jmp 0x140022fbc
push recvfrom
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x140022fb7
call fcn.1400d8600
mov r15, rax
cmp r15, 0x5d
jne 0x140022fb7
call fcn.14005e7e5
jmp 0x140022fbc
jmp 0x140022e87
push 0x5d
pop rcx
call fcn.1400d77a4
xor rax, rax
add rsp, 0x48
pop r14
pop r15
ret