Function at 0x140003767
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push r15
push r14
mov rax, 0xa
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140003781
sub rsp, 0x28
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14000cfb0
add rsp, 0x10
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14000cfb0
add rsp, 0x10
push qword [rsp + 0x28]
movabs rcx, 0x140011028
pop rdx
call fcn.14000ceb0
or rax, rax
jne 0x1400037fb
push qword [rsp + 0x28]
push 0
pop rcx
pop rdx
call sub.USER32.DLL_FindWindowW
mov qword [rsp + 0x90], rax
push qword [rsp + 0x90]
pop rcx
call sub.USER32.DLL_IsWindow
mov r15, rax
and r15, r15
jne 0x14000381d
xor rax, rax
jmp 0x1400044ea
push 0
sub rsp, 8
sub rsp, 0x20
call sub.USER32.DLL_GetForegroundWindow
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.DLL_GetWindowThreadProcessId
mov qword [rsp + 0x38], rax
push 0
push qword [rsp + 0x98]
pop rcx
pop rdx
call sub.USER32.DLL_GetWindowThreadProcessId
mov qword [rsp + 0x40], rax
mov r15, qword [rsp + 0x38]
cmp r15, qword [rsp + 0x40]
je 0x14000387d
push 1
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
call sub.USER32.DLL_AttachThreadInput
push qword [rsp + 0x90]
pop rcx
call sub.USER32.DLL_SetForegroundWindow
push 0x3e8
pop rcx
call sub.KERNEL32.dll_Sleep
push 0
push 2
push 0
push 0x12
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push 0x11
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push 0x10
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push 0x5b
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
mov qword [rsp + 0x48], 1
jmp 0x14000391c
push qword [rsp + 0x30]
pop rcx
call fcn.1400059f0
cmp rax, qword [rsp + 0x48]
jl 0x140004440
mov qword [rsp + 0x50], 0
push qword [0x140013c20]
sub rsp, 8
push qword [0x140013c20]
push 1
push qword [rsp + 0x68]
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400053d0
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.14000ccf0
push qword [rsp + 0x58]
movabs rcx, 0x140011610
pop rdx
call fcn.14000ceb0
or rax, rax
je 0x140004317
mov r15, qword [rsp + 0x48]
inc r15
mov rax, r15
push rax
movabs rax, 0x140011614
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call fcn.140005240
mov r15, rax
mov r14, qword [rsp + 0x48]
inc r14
sub r15, r14
mov qword [rsp + 0x60], r15
push qword [0x140013c20]
sub rsp, 8
push qword [0x140013c20]
push qword [rsp + 0x78]
mov r15, qword [rsp + 0x68]
inc r15
mov rax, r15
push rax
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400053d0
add rsp, 0x28
lea rcx, [rsp + 0x70]
pop rdx
call fcn.14000ccf0
push qword [rsp + 0x68]
movabs rdx, str.ALTDOWN
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003a5f
sub rsp, 8
push 0
push 0
push 0
push 0x12
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.DLL_keybd_event
add rsp, 0x28
jmp 0x14000419c
movabs rdx, str.ALTUP
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003aaf
sub rsp, 8
push 0
push 2
push 0
push 0x12
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.DLL_keybd_event
add rsp, 0x28
jmp 0x14000419c
movabs rdx, str.BACKSPACE
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003add
mov qword [rsp + 0x58], 8
jmp 0x14000419c
movabs rdx, str.CONTROLDOWN
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003b2d
sub rsp, 8
push 0
push 0
push 0
push 0x11
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.DLL_keybd_event
add rsp, 0x28
jmp 0x14000419c
movabs rdx, str.CONTROLUP
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003b7d
sub rsp, 8
push 0
push 2
push 0
push 0x11
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.DLL_keybd_event
add rsp, 0x28
jmp 0x14000419c
movabs rdx, str.DELAY
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003bc2
mov qword [rsp + 0x58], 0
sub rsp, 8
push 0x3e8
pop rcx
sub rsp, 0x20
call sub.KERNEL32.dll_Sleep
add rsp, 0x28
jmp 0x14000419c
movabs rdx, str.DELETE
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003bf0
mov qword [rsp + 0x58], 0x2e
jmp 0x14000419c
movabs rdx, str.DOWN
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003c1e
mov qword [rsp + 0x58], 0x28
jmp 0x14000419c
movabs rdx, 0x140011c78
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003c4c
mov qword [rsp + 0x58], 0x23
jmp 0x14000419c
movabs rdx, 0x140011b0c
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003c7a
mov qword [rsp + 0x58], 0xd
jmp 0x14000419c
movabs rdx, str.ESCAPE
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003ca8
mov qword [rsp + 0x58], 0x1b
jmp 0x14000419c
movabs rdx, 0x140011c42
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003cd6
mov qword [rsp + 0x58], 0x70
jmp 0x14000419c
movabs rdx, 0x140011c48
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003d04
mov qword [rsp + 0x58], 0x71
jmp 0x14000419c
movabs rdx, 0x140011c4e
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003d32
mov qword [rsp + 0x58], 0x72
jmp 0x14000419c
movabs rdx, 0x140011c54
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003d60
mov qword [rsp + 0x58], 0x73
jmp 0x14000419c
movabs rdx, 0x140011c5a
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003d8e
mov qword [rsp + 0x58], 0x74
jmp 0x14000419c
movabs rdx, 0x140011c60
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003dbc
mov qword [rsp + 0x58], 0x75
jmp 0x14000419c
movabs rdx, 0x140011c66
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003dea
mov qword [rsp + 0x58], 0x76
jmp 0x14000419c
movabs rdx, 0x140011c6c
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003e18
mov qword [rsp + 0x58], 0x77
jmp 0x14000419c
movabs rdx, 0x140011c72
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003e46
mov qword [rsp + 0x58], 0x78
jmp 0x14000419c
movabs rdx, 0x140011e66
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003e74
mov qword [rsp + 0x58], 0x79
jmp 0x14000419c
movabs rdx, 0x140011e7a
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003ea2
mov qword [rsp + 0x58], 0x7a
jmp 0x14000419c
movabs rdx, 0x140011e82
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003ed0
mov qword [rsp + 0x58], 0x7b
jmp 0x14000419c
movabs rdx, str.HOME
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003efe
mov qword [rsp + 0x58], 0x24
jmp 0x14000419c
movabs rdx, 0x140011c80
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003f2c
mov qword [rsp + 0x58], 0x2d
jmp 0x14000419c
movabs rdx, str.LEFT
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003f5a
mov qword [rsp + 0x58], 0x25
jmp 0x14000419c
movabs rdx, str.PAGEDOWN
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003f88
mov qword [rsp + 0x58], 0x22
jmp 0x14000419c
movabs rdx, str.PAGEUP
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003fb6
mov qword [rsp + 0x58], 0x21
jmp 0x14000419c
movabs rdx, str.PRINTSCREEN
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140003fe4
mov qword [rsp + 0x58], 0x2c
jmp 0x14000419c
movabs rdx, str.RIGHT
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140004012
mov qword [rsp + 0x58], 0x27
jmp 0x14000419c
movabs rdx, str.SCROLL
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140004040
mov qword [rsp + 0x58], 0x91
jmp 0x14000419c
movabs rdx, str.SPACE
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x14000406e
mov qword [rsp + 0x58], 0x20
jmp 0x14000419c
movabs rdx, str.SHIFTDOWN
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x1400040c7
mov qword [rsp + 0x78], 1
sub rsp, 8
push 0
push 0
push 0
push 0x10
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.DLL_keybd_event
add rsp, 0x28
jmp 0x14000419c
movabs rdx, str.SHIFTUP
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x14000411d
mov qword [rsp + 0x78], 0
sub rsp, 8
push 0
push 2
push 0
push 0x10
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.DLL_keybd_event
add rsp, 0x28
jmp 0x14000419c
movabs rdx, 0x14001220a
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140004148
mov qword [rsp + 0x58], 9
jmp 0x14000419c
movabs rdx, 0x140011b20
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x140004173
mov qword [rsp + 0x58], 0x26
jmp 0x14000419c
movabs rdx, str.WINDOWS
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14000ceb0
add rsp, 0x28
or rax, rax
je 0x14000419c
mov qword [rsp + 0x58], 0x5b
pop rax
push qword [0x140013c20]
sub rsp, 8
push qword [0x140013c20]
push 3
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140005890
add rsp, 0x28
add qword [0x140013c20], 2
movabs rcx, 0x1400122e8
pop rdx
mov qword [0x140013c20], rdx
add rdx, qword [0x140013c30]
call fcn.14000ceb0
or rax, rax
jne 0x1400042b2
push qword [0x140013c20]
sub rsp, 8
push qword [0x140013c20]
push 7
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140005890
add rsp, 0x28
add qword [0x140013c20], 2
movabs rcx, str.CONTROL
pop rdx
mov qword [0x140013c20], rdx
add rdx, qword [0x140013c30]
call fcn.14000ceb0
or rax, rax
jne 0x1400042b2
push qword [0x140013c20]
sub rsp, 8
push qword [0x140013c20]
push 5
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140005890
add rsp, 0x28
add qword [0x140013c20], 2
movabs rcx, 0x140011618
pop rdx
mov qword [0x140013c20], rdx
add rdx, qword [0x140013c30]
call fcn.14000ceb0
or rax, rax
jne 0x1400042b2
mov rax, 1
jmp 0x1400042b5
xor rax, rax
and rax, rax
je 0x140004300
mov r15, qword [rsp + 0x50]
and r15, r15
je 0x140004300
push 0
push 0
push 0
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
mov r15, qword [rsp + 0x48]
add r15, qword [rsp + 0x60]
inc r15
mov qword [rsp + 0x48], r15
jmp 0x140004435
movsxd r15, dword [0x140013a68]
and r15, r15
jle 0x140004334
movsxd rax, dword [0x140013a68]
mov rax, rax
push rax
pop rcx
call sub.KERNEL32.dll_Sleep
push 0
pop rcx
call sub.USER32.DLL_GetKeyboardLayout
mov rax, rax
push rax
sub rsp, 8
push qword [rsp + 0x68]
pop rcx
sub rsp, 0x20
call fcn.140005f30
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.DLL_VkKeyScanExW
mov qword [rsp + 0x50], rax
mov r15, qword [rsp + 0x50]
cmp r15, 0x12f
jle 0x14000438a
mov r15, qword [rsp + 0x70]
and r15, r15
jne 0x14000438a
mov rax, 1
jmp 0x14000438d
xor rax, rax
and rax, rax
je 0x1400043b1
push 0
push 0
push 0
push 0x10
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 0
push 0
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
mov r15, qword [rsp + 0x50]
cmp r15, 0x12f
jle 0x14000440e
mov r15, qword [rsp + 0x70]
and r15, r15
jne 0x14000440e
mov rax, 1
jmp 0x140004411
xor rax, rax
and rax, rax
je 0x140004435
push 0
push 2
push 0
push 0x10
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
inc qword [rsp + 0x48]
jno 0x14000391c
mov r15, qword [rsp + 0x38]
cmp r15, qword [rsp + 0x40]
je 0x140004462
push 0
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
call sub.USER32.DLL_AttachThreadInput
push 0
push 2
push 0
push 0x12
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push 0x11
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push 0x10
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push 0x5b
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.DLL_keybd_event
mov rax, 1
jmp 0x1400044ea
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14000cf80
add rsp, 0x28
mov rcx, qword [rsp + 0x70]
sub rsp, 0x28
call fcn.14000cf80
add rsp, 0x28
mov rcx, qword [rsp + 0x60]
sub rsp, 0x28
call fcn.14000cf80
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14000cf80
add rsp, 0x28
pop rax
add rsp, 0x78
pop r14
pop r15
ret