Function at 0x140023b70
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r14
sub rsp, 0x158
movzx ebx, cl
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea edx, [rbx - 0x41]
mov r14, rax
cmp dl, 0x19
ja 0x140023e70
mov qword [rsp + 0x180], rbp
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x148], rdi
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x140], r15
call sub.VCRUNTIME140.dll_memset
xor ebp, ebp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebp
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 2
xor edx, edx
lea ecx, [rbp + 0x6e]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x178]
cmp eax, 2
mov dword [rsp + 0x28], ebp
movzx edi, bp
mov dword [rsp + 0x20], 2
cmove di, word [rsp + 0x178]
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov r15d, eax
test eax, eax
jns 0x140023c55
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x170]
mov dword [rsp + 0x28], ebp
lea r8, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x20], 2
lea ecx, [rbp + 0x6e]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test di, di
je 0x140023e3d
mov qword [rsp + 0x150], rsi
cmp di, 0xa
jne 0x140023c7c
movzx edx, byte [rsp + 0x170]
mov r9b, ntohs
jmp 0x140023d4e
mov rdx, r14
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx r9, ax
mov r8, r9
shr r8, 8
cmp r8b, 0xff
jne 0x140023cfa
cmp r9b, 0xff
jne 0x140023cfa
movzx esi, di
test esi, 0xffffff80
jne 0x140023e35
mov edx, 0x103
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x140023e35
mov edx, 2
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov edx, 1
movzx edi, dil
mov ecx, esi
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx r9d, cl
cmove r9d, edi
test r8b, 0x38
jne 0x140023e35
movzx edx, byte [rsp + 0x170]
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x140023d1b
or dl, 8
jmp 0x140023d37
test r8b, 2
je 0x140023d29
test dl, 3
jne 0x140023d29
or dl, 1
test r8b, 4
je 0x140023d37
test dl, 0xc
jne 0x140023d37
or dl, 4
test r8b, 1
je 0x140023d45
test dl, 0x30
jne 0x140023d45
or dl, 0x10
test r9b, r9b
je 0x140023e35
movzx ecx, dl
movzx r8d, dl
movzx r10d, dl
movzx ebx, dl
movzx r11d, dl
movzx eax, dl
and cl, 0xf0
and r8b, 0xe0
and r10b, 0xfe
shl cl, 3
and bl, 0xfc
shl r8b, 2
and r11b, 0xf8
shl r10b, 6
and al, 0xc0
shl bl, 5
movzx edi, dl
shl r11b, 4
add al, al
shl dil, 7
and dl, 0x80
mov byte [rsp + 0xe0], cl
mov byte [rsp + 0xe1], r8b
mov byte [rsp + 0xe2], dil
mov byte [rsp + 0xe3], r10b
mov byte [rsp + 0xe4], bl
mov byte [rsp + 0xe5], r11b
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x9c], dl
test cl, cl
jne 0x140023dde
test r8b, r8b
jne 0x140023dde
xor al, al
jmp 0x140023de0
mov al, 0x80
mov byte [rsp + 0x50], al
test dil, dil
jne 0x140023df2
test r10b, r10b
jne 0x140023df2
xor al, al
jmp 0x140023df4
mov al, 0x80
mov byte [rsp + 0x51], al
test bl, bl
jne 0x140023e05
test r11b, r11b
jne 0x140023e05
xor al, al
jmp 0x140023e07
mov al, 0x80
movzx ecx, r9b
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x170]
mov dword [rsp + 0x28], ebp
xor edx, edx
mov dword [rsp + 0x20], 2
mov byte [rsp + 0x52], al
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x148]
test r15d, r15d
mov r15, qword [rsp + 0x140]
je 0x140023e5a
movzx ebp, word [rsp + 0x178]
movzx eax, bp
mov rbp, qword [rsp + 0x180]
add rsp, 0x158
pop r14
pop rbx
ret
mov ecx, ebx
mov r8, r14
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
add rsp, 0x158
pop r14
pop rbx
ret