Function at 0x14001fed0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [r11 - 0xc8]
sub rsp, 0x1a0
movzx ebx, dl
mov r14, r9
mov edx, dword [rbp + 0xf8]
movzx eax, bx
or ax, r8w
movzx edi, r8w
mov esi, ecx
je 0x140020395
mov qword [r11 + 8], r12
test edx, edx
mov eax, 0xffc3d44d
mov qword [r11 - 0x30], r13
cmovne eax, edx
mov qword [r11 - 0x38], r15
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x140125e98]
sete r15b
cmp dword [0x140128014], 0
je 0x14001ff43
test r15b, r15b
jne 0x14001ff43
mov r13b, 1
jmp 0x14001ff46
xor r13b, r13b
cmp dword [0x140128014], 1
mov byte [rbp + 0xd8], r13b
je 0x14001ff5b
test r15b, r15b
je 0x14001ff62
mov byte [rbp + 0xf0], 0
test bl, bl
jne 0x14001ffad
mov edx, edi
movzx ecx, di
sub edx, 0x45
je 0x14001ffa9
mov eax, 0xff
sub edx, 0xf1
je 0x14001ff82
cmp edx, 0xf
jne 0x14001ff85
and cx, ax
bt cx, 8
jae 0x14001ff97
and cx, ax
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
jmp 0x14001ffbf
mov bl, reloc.WSOCK32.dll_send
jmp 0x14001ffbf
test di, di
jne 0x14001ffbf
xor edx, edx
movzx ecx, bl
call fcn.1400241a0
movzx edi, ax
xor r12d, r12d
lea rdx, [0x140000000]
movzx eax, di
shr ax, 8
test al, al
setne r12b
cmp dword [0x140128014], 2
jne case.default.0x14001fff8
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001fff8
cdqe
mov ecx, dword [rdx + rax*4 + 0x203a4]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x14001fff8
mov bl, reloc.WSOCK32.dll_recv
jmp case.default.0x14001fff8
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r14, r14
je 0x140020134
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140022cb0
test al, al
je 0x1400200c2
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test esi, esi
jne 0x14002003c
movzx eax, bl
or byte [rsp + rax + 0x40], 0x80
jmp 0x140020049
cmp esi, 1
jne 0x140020049
movzx eax, bl
and byte [rsp + rax + 0x40], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x140020069
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x203bc]
add rcx, rdx
jmp rcx
test byte [rbp - 0x1e], 0x80
jne 0x14002007e
test byte [rbp - 0x1d], 0x80
jne 0x14002007e
and byte [rsp + 0x51], 0x7f
jmp case.default.0x140020069
or byte [rsp + 0x51], 0x80
jmp case.default.0x140020069
test byte [rbp - 0x20], 0x80
jne 0x140020098
test byte [rbp - 0x1f], 0x80
jne 0x140020098
and byte [rsp + 0x50], 0x7f
jmp case.default.0x140020069
or byte [rsp + 0x50], 0x80
jmp case.default.0x140020069
test byte [rbp - 0x1c], 0x80
jne 0x1400200b2
test byte [rbp - 0x1b], 0x80
jne 0x1400200b2
and byte [rsp + 0x52], 0x7f
jmp case.default.0x140020069
or byte [rsp + 0x52], 0x80
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
movzx ebx, bl
cmp esi, 1
je 0x1400200eb
mov r9, rdi
mov r8d, ebx
or r9, 1
mov edx, 0x100
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xf0], 0
je 0x14002010d
cmp esi, 2
jne 0x14002010d
mov rax, qword [0x14011f188]
mov ecx, dword [rax + 0xa0]
call fcn.140021cb0
jmp 0x140020115
test esi, esi
je 0x140020351
mov r9d, 0xc0000001
mov r8, rbx
or r9, rdi
mov edx, 0x101
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140020351
mov dword [0x140127f50], esi
mov byte [0x140127f54], bl
test r15b, r15b
je 0x14002019f
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r14d, r14d
test rax, rax
je 0x14002018c
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x48
mov ecx, eax
mov r14d, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14002018c
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14002018c
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
call fcn.1400231d0
jmp 0x1400201a5
mov eax, dword [0x140128000]
mov r10, qword [0x140125d78]
mov dword [rsp + 0x34], eax
cmp bl, 0xa5
jne 0x1400201ef
test eax, eax
je 0x1400201ef
test r13b, r13b
jne 0x1400201ef
test r10, r10
je 0x1400201ef
mov r11b, 1
mov byte [rbp + 0xe0], r11b
xor r13b, r13b
xor r11b, r11b
mov byte [rbp + 0xe0], r11b
test r13b, r13b
je 0x1400201cd
xor r8d, r8d
movzx edx, di