Function at 0x14001824c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400bd990
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], __WSAFDIsSet
call fcn.140096f2c
movabs rbp, 0x1404af512
mov rax, rbp
push rax
push 0x23
pop rcx
pop rdx
call fcn.1400b3844
movabs rbp, 0x1404b0050
mov rax, rbp
push rax
push 0x24
pop rcx
pop rdx
call fcn.1400b3844
movabs rbp, 0x1404b0b4e
mov rax, rbp
push rax
push 0x25
pop rcx
pop rdx
call fcn.1400b3844
push 0x23
pop rcx
call fcn.140019c0e
push 0x24
pop rcx
call fcn.140019c0e
push 0x25
pop rcx
call fcn.140019c0e
push 0
pop rcx
call fcn.1400a6894
mov r15, rax
push 0
pop rcx
call fcn.1400a6e68
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push 0
pop rcx
call fcn.1400a681c
mov r15, rax
push 0
pop rcx
call fcn.1400a6ec0
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x1404ba494]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push reloc.ODBC32.dll_SQLFetchScroll
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a6964
add rsp, 0x40
sub rsp, 8
push qword [rsp + 0x38]
push qword [rsp + 0x38]
push 0
push 0
push 0xffffffffffffffff
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14009c15c
add rsp, 0x30
mov qword [rsp + 0x48], rax
push 0x4d
push 0x4d
push 0x4d
pop rcx
pop rdx
pop r8
call fcn.1400b326c
mov rax, rax
push rax
push 2
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
call fcn.14009b368
push 0x25
pop rcx
call fcn.1400b3a10
mov rax, rax
push rax
push SQLFetchScroll
push 0xaa
push SafeArrayGetLBound
push SafeArrayGetLBound
push 0x21
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a42d8
add rsp, 0x30
push 0x23
pop rcx
call fcn.1400b3a10
mov rax, rax
push rax
push SQLFetchScroll
push 0xaa
push reloc.msi.dll_MsiGetActiveDatabase
push SafeArrayGetLBound
push reloc.ODBC32.dll_SQLFreeHandle
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a42d8
add rsp, 0x30
push 0x24
pop rcx
call fcn.1400b3a10
mov rax, rax
push rax
push SQLFetchScroll
push 0xaa
push reloc.ODBC32.dll_SQLSetEnvAttr
push SafeArrayGetLBound
push 0x20
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a42d8
add rsp, 0x30
push qword [0x1404ba78c]
push reloc.ODBC32.dll_SQLRowCount
push 0xaa
push 0x78
push SafeArrayGetLBound
push 0x22
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400a1dbc
add rsp, 0x30
call fcn.14002bd10
push 0x258
pop rcx
call fcn.1400a5e7c
call fcn.1400a6814
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x14001862b
call fcn.1400a8378
mov rax, rax
push rax
mov r15, reloc.ODBC32.dll_SQLFetchScroll
cmp r15, qword [rsp]
jne 0x140018628
push qword [rsp + 0x78]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x140018624
sub rsp, 0x20
call fcn.1400a835c
add rsp, 0x20
mov rax, rax
push rax
mov r15, 0x21
cmp r15, qword [rsp]
jne 0x1400185a9
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14006f148
add rsp, 0x28
add rsp, 0x18
jmp 0x14001868d
mov r15, reloc.ODBC32.dll_SQLFreeHandle
cmp r15, qword [rsp]
jne 0x1400185de
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14006f148
add rsp, 0x28
add rsp, 0x18
jmp 0x14001868d
mov r15, 0x20
cmp r15, qword [rsp]
jne 0x140018610
sub rsp, 8
movabs rax, str.https:__msfree.su_donaties_donations.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14006f148
add rsp, 0x28
add rsp, 0x18
jmp 0x14001868d
mov r15, 0x22
cmp r15, qword [rsp]
jne 0x140018623
add rsp, 0x18
jmp 0x14001868d
pop rax
add rsp, 8
pop rax
jmp 0x140018636
push reloc.ODBC32.dll_SQLFetchScroll
pop rcx
call fcn.1400a6e40
push SQLFreeHandle
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14001865f
call fcn.1400a6dec
mov r15, rax
cmp r15, 0x1e
jne 0x14001865f
call fcn.14002bd10
jmp 0x14001868d
push reloc.ODBC32.dll_SQLFetch
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x140018688
call fcn.1400a6dec
mov r15, rax
cmp r15, 0x1e
jne 0x140018688
call fcn.14002bd10
jmp 0x14001868d
jmp 0x14001851e
push reloc.ODBC32.dll_SQLFetchScroll
pop rcx
call fcn.1400a61a4
xor rax, rax
add rsp, 0x50
pop r14
pop r15
pop rbp
ret