Function at 0x14001c480
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rcx, [0x140124e78]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x8a0
call fcn.14002652c
mov qword [rsp + 0x50], rax
xor ebx, ebx
test rax, rax
je 0x14001c4c2
mov qword [rax + 0x880], rbx
mov qword [rax + 0x888], rbx
jmp 0x14001c4c5
mov rax, rbx
mov qword [0x1401256c8], rax
xor edx, edx
mov r8d, 0x8a0
mov rcx, rax
call fcn.140054a20
mov rcx, qword [0x1401256c8]
add rcx, 0x38
call fcn.1400148a0
mov rcx, qword [0x1401256c8]
lea rdx, [rcx + 0x440]
add rcx, 0x38
call fcn.140014860
mov rax, qword [0x1401256c8]
mov dword [rax + 0x43c], 1
mov rcx, qword [0x1401256c8]
add rcx, 0x880
call fcn.140014ea0
mov rcx, qword [0x1401256c8]
add rcx, 8
call fcn.14001be90
xor ecx, ecx
call fcn.14001db50
mov ecx, 0xc
call fcn.14001dbd0
xor edx, edx
lea ecx, [rdx + 8]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140125870], eax
xor edx, edx
lea ecx, [rdx + 0x11]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140125874], eax
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140125878], eax
xor edx, edx
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x14012587c], eax
xor edx, edx
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140125880], eax
xor edx, edx
lea ecx, [rdx + 0x56]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140125888], eax
xor edx, edx
lea ecx, [rdx + 0x2d]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140125884], eax
mov edx, 0x12
lea rcx, str.00000409
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov qword [0x1401256b0], rax
mov edx, 0x12
lea rcx, str.0000042a
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov edx, 0x3ff
movzx ecx, ax
and cx, dx
cmp cx, 0x2a
cmovne rax, rbx
mov qword [0x1401256b8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [0x1401256c0], rax
mov dword [0x14012588c], ebx
call fcn.1400bd740
mov rax, qword [0x1401256c8]
mov qword [0x140125898], rax
lea rax, [0x140020db0]
mov qword [0x140125890], rax
cmp byte [0x140124e64], 0
je 0x14001c733
cmp qword [0x140127a08], 0
jne 0x14001c6fe
mov edx, 2
lea r8d, [rdx + 0x3e]
lea rcx, str.unikey_log.txt
call fcn.14002a028
test rax, rax
je 0x14001c6fe
mov r8d, 1
mov rdx, rax
lea rcx, [0x140127988]
call fcn.14001f310
lea rdx, [rsp + 0x28]
lea rcx, [0x140127988]
call fcn.140022660
nop
mov rcx, rax
call fcn.140019f50
mov rdx, rax
lea rcx, [0x140127988]
call fcn.14001f600
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001c6da
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14001c6da
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov rax, qword [0x140127980]
movsxd rcx, dword [rax + 4]
lea rax, [0x140127980]
add rcx, rax
mov edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, ebx
jmp 0x14001c726
mov rax, qword [0x140127980]
movsxd rcx, dword [rax + 4]
lea rax, [0x140127980]
add rcx, rax
mov eax, dword [rcx + 0x10]
or eax, 2
mov edx, eax
or edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, eax
xor r8d, r8d
add rsp, 0x40
pop rbx
jmp fcn.140020df0
add rsp, 0x40
pop rbx
ret