Function at 0x140044070
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
mov rbp, rcx
shr r9d, 0x18
and r9b, 1
movzx r14d, r8b
neg r9b
sbb ebx, ebx
and ebx, 0x100
add ebx, r14d
cmp byte [rsp + 0x230], 0
jne 0x1400440d9
mov r8d, ebx
call fcn.140043a20
jmp 0x14004454f
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x30], rax
xor edi, edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xb0]
xor edx, edx
mov ecx, r14d
call fcn.1400b0c40
movsxd r12, eax
cmp r12d, 1
jne 0x140044173
cmp ebx, 0x6e
jne 0x140044173
movzx eax, word [rsp + 0x88]
cmp ax, 0x2c
jne 0x140044151
mov r9d, 0xffac
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call fcn.140043c80
jmp 0x14004454f
cmp ax, 0x2e
jne 0x140044173
mov r9d, 0xffae
mov r8d, WSASetLastError
mov rdx, rsi
mov rcx, rbp
call fcn.140043c80
jmp 0x14004454f
mov edx, ebx
lea rcx, [0x14023b610]
call fcn.1400435f0
mov r13d, eax
test eax, eax
je 0x1400441b9
mov r9d, ebx
lea r8, str.mapped_key:_extendedVkey_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
mov r9d, r13d
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call fcn.140043c80
jmp 0x14004454f
test r12d, r12d
jns 0x1400441de
mov r9d, ebx
lea r8, str.ToAscii_Unicode_dead_key__1_:_extendedVkey_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
jmp 0x14004454f
test r12d, r12d
jle 0x1400443e3
movzx ecx, word [rsp + 0x88]
cmp ecx, 0x20
jb 0x1400443e3
call fcn.1400606c0
test eax, eax
je 0x1400443e3
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], reloc.COMCTL32.dll_InitCommonControls
mov r13d, edi
mov dword [rsp + 0x6c], edi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], 0x111
mov r14d, edi
mov dword [rsp + 0x4c], edi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], reloc.WS2_32.dll_select
mov r15d, edi
mov dword [rsp + 0x5c], edi
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], 0x112
mov dword [rsp + 0x7c], edi
test byte [rsp + 0xc1], 0x80
je 0x1400442a9
test byte [rsp + 0xc2], 0x80
je 0x1400442a9
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.140043880
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.140043880
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140043880
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.140043880
mov r13d, dword [rsp + 0x6c]
mov r14d, dword [rsp + 0x4c]
mov r15d, dword [rsp + 0x5c]
test r12, r12
jle 0x1400442f2
nop
mov r9d, ebx
lea r8, str.ToAscii_Unicode_key__1_:_extendedVkey_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
movzx ecx, word [rsp + rdi*2 + 0x88]
call fcn.1400606c0
mov r9d, eax
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call fcn.140043c80
add rdi, 1
cmp rdi, r12
jl 0x1400442b0
mov ebx, dword [rsp + 0x7c]
test ebx, ebx
je 0x14004432d
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsp + 0x78]
lea r8, str.fake_press_extendedVkey_0x_x__keysym_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
mov rcx, qword [rsp + 0x70]
mov r11, qword [rcx]
mov r8b, 1
mov edx, ebx
call qword [r11 + reloc.WS2_32.dll_htonl]
nop
test r15d, r15d
je 0x140044367
mov dword [rsp + 0x20], r15d
mov r9d, dword [rsp + 0x58]
lea r8, str.fake_press_extendedVkey_0x_x__keysym_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
mov rcx, qword [rsp + 0x50]
mov r11, qword [rcx]
mov r8b, 1
mov edx, r15d
call qword [r11 + reloc.WS2_32.dll_htonl]
nop
test r14d, r14d
je 0x1400443a1
mov dword [rsp + 0x20], r14d
mov r9d, dword [rsp + 0x48]
lea r8, str.fake_press_extendedVkey_0x_x__keysym_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
mov rcx, qword [rsp + 0x40]
mov r11, qword [rcx]
mov r8b, 1
mov edx, r14d
call qword [r11 + reloc.WS2_32.dll_htonl]
nop
test r13d, r13d
je 0x14004454f
mov dword [rsp + 0x20], r13d
mov r9d, dword [rsp + 0x68]
lea r8, str.fake_press_extendedVkey_0x_x__keysym_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
mov rcx, qword [rsp + 0x60]
mov r11, qword [rcx]
mov r8b, 1
mov edx, r13d
call qword [r11 + reloc.WS2_32.dll_htonl]
jmp 0x14004454f
mov byte [rsp + 0x153], dil
mov byte [rsp + 0x152], dil
mov byte [rsp + 0xc1], dil
mov byte [rsp + 0x155], dil
mov byte [rsp + 0x154], dil
mov byte [rsp + 0xc2], dil
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xb0]
xor edx, edx
mov ecx, r14d
call fcn.1400b0c40
mov r12d, eax
test eax, eax
jns 0x1400444c2
mov r9d, ebx
lea r8, str.ToAscii_Unicode_dead_key__2_:_extendedVkey_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xb0]
xor edx, edx
lea ecx, [rdx + 0x20]
call fcn.1400b0c40
mov r12d, eax
test eax, eax
jns 0x1400444c2
mov r9d, ebx
lea r8, str.ToAscii_Unicode_dead_key__3_:_extendedVkey_0x_x___giving_up_
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
jmp 0x14004454f
test r12d, r12d
jle 0x140044534
movzx ecx, word [rsp + 0x88]
cmp ecx, 0x20
jb 0x140044534
call fcn.1400606c0
test eax, eax
je 0x140044534
movsxd r12, r12d
test r12, r12
jle 0x14004454f
nop
nop
nop
mov r9d, ebx
lea r8, str.ToAscii_Unicode_key__2___no_ctrl_alt_:_extendedVkey_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
movzx ecx, word [rsp + rdi*2 + 0x88]
call fcn.1400606c0
mov r9d, eax
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call fcn.140043c80
add rdi, 1
cmp rdi, r12
jl 0x1400444f0
jmp 0x14004454f
mov r9d, ebx
lea r8, str.no_chars_regardless_of_control_and_alt:_extendedVkey_0x_x
mov edx, 0x78
lea rcx, [0x14023b5f0]
call fcn.140002f40
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14011f1c0
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret