Function at 0x18013fb60
Capabilities:
Get keyboard layout

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rax + 8], r12
mov ebp, r8d
mov qword [rax + 0x10], r13
mov esi, edx
xor r13d, r13d
mov r15d, ecx
cmp dword [0x18033c814], r13d
lea r12d, [r13 + 1]
jne 0x18013fc7b
cmp dword [0x18033c944], r13d
je 0x18013fd21
call fcn.18005eff0
xor ecx, ecx
mov word [rsp + 0x9a], r13w
mov r14, rax
mov dword [rsp + 0x9c], r13d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, r15b
lea edx, [r13 + 4]
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edx, dword [0x18033c944]
lea r8, [rsp + 0x98]
mov rcx, r14
mov word [rsp + 0x98], ax
call fcn.18005f520
lea ecx, [r13 + 0x64]
call fcn.1800d38c0
lea ecx, [rbp + 0x64]
cmp eax, 0x60
jg 0x18013fc06
mov ecx, ebp
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x18033c944]
lea r8, [rsp + 0x98]
mov rcx, r14
mov word [rsp + 0x9a], r12w
call fcn.18005f520
test r14, r14
je 0x18013fc7b
mov rbx, r14
mov edi, 0x14
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x18013fc4f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18013fc5e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x10
sub rdi, r12
jne 0x18013fc40
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x18033c814], r12d
jne 0x18013fd21
xor ecx, ecx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x2c], 8
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx edi, r15b
mov edx, 4
mov r8, rax
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov r8d, 0x28
mov word [rsp + 0x28], r13w
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2a], ax
mov ecx, r12d
mov qword [rsp + 0x38], r13
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x64
lea ebx, [rbp + 0x64]
call fcn.1800d38c0
mov ecx, ebx
cmp eax, 0x60
jg 0x18013fcf5
mov ecx, ebp
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rsp + 0x2c], 0xa
lea rdx, [rsp + 0x20]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x18013fd28
lea ebx, [rbp + 0x64]
movzx edi, r15b
cmp dword [0x18033c814], 2
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
jne 0x18013fde3
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edx, 4
mov ecx, edi
mov r8, rax
mov r14, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov rcx, qword [0x18033c6e8]
movzx edx, r15w
movzx r15d, dl
mov edx, pe_nt_image_headers64
movzx r9d, ax
mov r8d, r15d
shl r9, 0x10
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0x64
call fcn.1800d38c0
mov ecx, ebx
cmp eax, 0x60
jg 0x18013fd9c
mov ecx, ebp
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, r14
mov edx, 4
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ecx, 0x4000
mov r8, r15
sub ax, cx
mov edx, 0x101
mov rcx, qword [0x18033c6e8]
movzx r9d, ax
shl r9, 0x10
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageA]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret