Function at 0x14002ddc0
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xb8
xor ebx, ebx
mov rax, rcx
mov dword [rbp - 0x69], ebx
movzx r14d, bx
mov word [rbp - 0x6b], bx
mov edi, ebx
test r8b, r8b
je 0x14002de0d
cmp byte [rcx + 0x64], bl
je 0x14002de0d
mov r13b, 1
jmp 0x14002de10
xor r13b, r13b
lea r15, [rcx + 0x74]
mov byte [rbp - 0x70], r13b
add rcx, 0x174
mov qword [rbp - 0x59], r15
mov rsi, rdx
mov qword [rbp - 0x61], rcx
cmp word [rdx], bx
je 0x14002e42b
movzx r12d, byte [rbp + 0x6f]
nop dword [rax + rax]
mov word [rbp - 0x6d], bx
movzx eax, word [rsi]
cmp ax, 0x7b
je 0x14002df75
cmp ax, 0x7d
je 0x14002e31d
test r13b, r13b
je 0x14002de6a
inc edi
mov dword [rbp - 0x69], edi
jmp 0x14002e31d
xor ecx, ecx
mov word [rbp - 0x6d], ax
mov byte [rbp - 0x71], 0
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp word [rbp - 0x6d], 0
jne 0x14002de8e
xor bl, bl
xor r12b, r12b
xor r13b, r13b
jmp 0x14002e1e4
movzx r8d, word [rbp - 0x6b]
test r8w, r8w
jne 0x14002deba
movzx ecx, word [rbp - 0x6d]
lea rdx, [rbp - 0x71]
mov r9b, 1
mov r8, rax
call fcn.140024160
xor r12b, r12b
movzx ebx, al
xor r13b, r13b
jmp 0x14002e1e4
movzx edx, word [rbp - 0x6d]
mov r9d, 0xffdf
movzx eax, dx
and ax, r9w
lea ecx, [rdx - 0x61]
cmp cx, 0x19
cmovbe dx, ax
cmp dx, 0x56
jne 0x14002df24
movzx eax, r8w
lea ecx, [r8 - 0x61]
and ax, r9w
cmp cx, 0x19
cmovbe r8w, ax
cmp r8w, 0x4b
jne 0x14002df24
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x69]
call fcn.1400ce848
movzx ecx, al
mov rax, qword [rbp - 0x51]
cmp word [rax], 0
cmove ebx, ecx
xor r12b, r12b
xor r13b, r13b
jmp 0x14002e1e4
lea r12, str.Numpad0
mov rdi, rbx
mov rbx, r12
mov rcx, qword [rbx]
lea rdx, [rbp - 0x6d]
call fcn.1400c8244
test eax, eax
je 0x14002df61
inc rdi
lea rax, [0x140129c70]
add rbx, 0x10
cmp rbx, rax
jl 0x14002df31
xor bl, bl
xor r12b, r12b
xor r13b, r13b
jmp 0x14002e1e4
add rdi, rdi
movzx ebx, byte [r12 + rdi*8 + 8]
xor r12b, r12b
xor r13b, r13b
jmp 0x14002e1e4
add rsi, 2
mov edx, 0x7d
mov rcx, rsi
call fcn.1400c42b8
mov r15, rax
test rax, rax
je 0x14002e31d
mov rbx, rax
sub rbx, rsi
sar rbx, 1
jne 0x14002dfb3
add r15, 2
cmp word [r15], 0x7d
jne 0x14002e31b
mov ebx, 1
jmp 0x14002dfb9
cmp rbx, 1
jne 0x14002dfcf
test r13b, r13b
je 0x14002dfc8
inc edi
mov dword [rbp - 0x69], edi
jmp 0x14002e31b
movzx eax, word [rsi]
mov word [rbp - 0x6d], ax
add rbx, rbx
lea rcx, [rbp - 0x31]
mov r8, rbx
mov rdx, rsi
call fcn.1400e5b10
xor esi, esi
xor ecx, ecx
mov word [rbp + rbx - 0x31], si
xor r13b, r13b
mov byte [rbp - 0x71], sil
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbp - 0x31]
test cx, cx
jne 0x14002e007
xor bl, bl
jmp 0x14002e0ad
movzx edx, word [rbp - 0x2f]
test dx, dx
jne 0x14002e028
mov r9b, 1
lea rdx, [rbp - 0x71]
mov r8, rax
call fcn.140024160
movzx r8d, al
jmp 0x14002e0ce
lea eax, [rcx - 0x61]
mov r8d, 0xffdf
cmp ax, 0x19
ja 0x14002e03b
and cx, r8w
cmp cx, 0x56
jne 0x14002e07a
lea eax, [rdx - 0x61]
cmp ax, 0x19
ja 0x14002e04e
and dx, r8w
cmp dx, 0x4b
jne 0x14002e07a
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x2d]
call fcn.1400ce848
movzx ecx, al
mov r8d, esi
mov rax, qword [rbp - 0x49]
cmp word [rax], si
cmove r8d, ecx
jmp 0x14002e0ce
mov rdi, rsi
lea rbx, str.Numpad0
mov rcx, qword [rbx]
lea rdx, [rbp - 0x31]
call fcn.1400c8244
test eax, eax
je 0x14002e0be
inc rdi
lea rax, [0x140129c70]
add rbx, 0x10
cmp rbx, rax
jl 0x14002e084
xor bl, bl
movzx ecx, word [rbp - 0x31]
test cx, cx
jne 0x14002e13b
mov r14d, esi
jmp 0x14002e1dd
add rdi, rdi
lea rax, str.Numpad0
movzx r8d, byte [rax + rdi*8 + 8]
movzx ebx, r8b
test r8b, r8b
je 0x14002e0a9
movzx ecx, word [rbp - 0x31]
mov edx, 0xffdf
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14002e0ec
and cx, dx
cmp cx, 0x56
jne 0x14002e110
movzx ecx, word [rbp - 0x2f]
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14002e102
and cx, dx
cmp cx, 0x4b
jne 0x14002e110
mov r12b, 1
jmp 0x14002e1dd
mov dl, 1
movzx ecx, r8b
xor r12b, r12b
call fcn.140024b70
movzx r14d, ax
test ax, ax
je 0x14002e1dd
mov eax, 0x100
xor r14w, ax
xor bl, bl
jmp 0x14002e1dd
lea r14, str.NumpadEnter
mov rdi, r14
nop word [rax + rax]
mov rcx, qword [rdi]
lea rdx, [rbp - 0x31]
call fcn.1400c8244
test eax, eax
je 0x14002e1d4
inc rsi
lea rax, str.Numpad0
add rdi, 0x10
cmp rdi, rax
jl 0x14002e150
movzx ecx, word [rbp - 0x31]
mov edx, 0xffdf
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14002e188
and cx, dx
cmp cx, 0x53
jne 0x14002e1c3
movzx ecx, word [rbp - 0x2f]
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14002e19e
and cx, dx
cmp cx, 0x43
jne 0x14002e1c3
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x2d]
call fcn.1400ce848
mov ecx, eax
mov rax, qword [rbp - 0x41]
cmp word [rax], 0
je 0x14002e1cb
xor eax, eax
movzx r14d, ax
jmp 0x14002e1dd
mov r13b, 1
movzx r14d, cx
jmp 0x14002e1dd
add rsi, rsi
movzx r14d, word [r14 + rsi*8 + 8]
mov rsi, r15
mov r15, qword [rbp - 0x59]
test bl, bl
je 0x14002e219
movzx ecx, word [rbp - 0x6d]
test cx, cx
je 0x14002e285
cmp byte [rbp + 0x6f], 0
je 0x14002e285
call qword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x14002e285
test byte [rbp - 0x71], 0x30
movzx ecx, bl
sete al
inc al
or byte [r15 + rcx], al
movzx edx, byte [rbp + 0x7f]
movzx r9d, byte [rbp + 0x77]
mov rcx, qword [rbp - 0x61]
test r14w, r14w
jne 0x14002e235
test r13b, r13b
je 0x14002e318
movzx eax, r14w
movzx ebx, r9b
add rcx, rax
not bl
movzx eax, byte [rcx]
and al, bl
or al, dl
mov byte [rcx], al
test r9b, r9b
je 0x14002e318
test r13b, r13b
jne 0x14002e318
movzx edx, r14w
movzx ecx, r14w
sub edx, 0x45
je 0x14002e30f
sub edx, 0xf1
je 0x14002e27b
cmp edx, 0xf
jne 0x14002e2e4
mov edx, 0xff
and cx, dx
jmp 0x14002e2e9
movzx r9d, byte [rbp + 0x77]
movzx edx, byte [rbp + 0x7f]
movzx edi, r9b
movzx ecx, bl
not dil
movzx eax, byte [rcx + r15]
and al, dil
or al, dl
mov byte [rcx + r15], al
test r9b, r9b
je 0x14002e222
test r12b, r12b
jne 0x14002e222
xor edx, edx
movzx ecx, bl
call fcn.140024b70
mov rcx, qword [rbp - 0x61]
movzx r9d, byte [rbp + 0x77]
movzx edx, byte [rbp + 0x7f]
test ax, ax
je 0x14002e226
movzx eax, ax
and byte [rax + rcx], dil
jmp 0x14002e226
mov edx, 0xff
bt cx, 8
jae 0x14002e2fb
and cx, dx
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test al, al
je 0x14002e318
jmp 0x14002e311
mov al, reloc.WSOCK32.dll_send
movzx eax, al
and byte [rax + r15], bl
mov edi, dword [rbp - 0x69]
xor ebx, ebx
mov r15, qword [rbp - 0x59]
add rsi, 2
movzx r13d, byte [rbp - 0x70]
cmp word [rsi], 0
jne 0x14002de40
mov r12, qword [rbp + 0x67]
test edi, edi
je 0x14002e422
mov rbx, qword [rbp + 0x5f]
mov eax, dword [rbx + 0x30]
cmp edi, eax
jbe 0x14002e3a1
test eax, eax
je 0x14002e358
mov rcx, qword [rbx + 0x28]
call fcn.1400c83c0
lea ecx, [rdi*2 + 2]
call fcn.1400c83d4
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x14002e39e
mov rax, qword [0x140131838]
lea rdx, str.Out_of_memory.
mov qword [rsp + 0x28], rax
lea rcx, [0x1401319c0]
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.14000fec0
jmp 0x14002e44f
mov dword [rbx + 0x30], edi
movzx eax, word [r12]
mov rbx, qword [rbx + 0x28]
test ax, ax
je 0x14002e41b
nop
cmp ax, 0x7b
je 0x14002e3ca
cmp ax, 0x7d
je 0x14002e40c
movzx eax, word [r12]
mov word [rbx], ax
add rbx, 2
jmp 0x14002e40c
lea rdi, [r12 + 2]
mov edx, 0x7d
mov rcx, rdi
call fcn.1400c42b8
mov rcx, rax
test rax, rax
je 0x14002e40c
cmp rax, rdi
jne 0x14002e3f5
add rax, 2
cmp word [rax], 0x7d
cmove rcx, rax
lea rax, [r12 + 4]
cmp rcx, rax
jne 0x14002e409
movzx eax, word [rdi]
mov word [rbx], ax
add rbx, 2
mov r12, rcx
movzx eax, word [r12 + 2]
add r12, 2
test ax, ax
jne 0x14002e3b0
xor eax, eax
mov word [rbx], ax
jmp 0x14002e44a
mov rax, qword [rbp + 0x5f]
movzx r8d, byte [rbp + 0x6f]
test r8b, r8b
je 0x14002e44a
cmp dword [rax + 0x30], 0
je 0x14002e43f
mov rax, qword [rax + 0x28]
mov word [rax], bx
jmp 0x14002e44a
lea rcx, [0x140104c70]
mov qword [rax + 0x28], rcx
mov eax, 1
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret