Function at 0x42b3b0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov rbx, rcx
mov qword [rsp + 0x38], rdi
xor ecx, ecx
mov rsi, r9
mov rbp, rdx
mov qword [rsp + 0x30], r12
mov edi, r8d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx r10d, ax
movzx r11d, ax
and r10w, 0xfff
cmp r10w, 0x412
mov r10, r12
sete cl
and r10d, 0xfff
cmp r10, 0x412
sete dl
cmp edi, 0x100
ja 0x42b448
cmp edi, 0x100
je 0x42b47f
cmp edi, 0x87
jne 0x42b7a2
mov eax, dword [rbx + 0x59a0]
neg eax
sbb rax, rax
and eax, 4
or rax, 3
jmp 0x42b6ef
cmp edi, 0x105
ja 0x42b781
cmp edi, 0x105
je 0x42b70d
mov eax, edi
sub eax, 0x101
je 0x42b70d
sub eax, 1
je 0x42b6e5
cmp eax, 2
jne 0x42b7a2
cmp dword [rbx + 0x59a0], 0
jne 0x42b4d1
cmp rsi, 0xd
je 0x42b494
cmp rsi, 9
jne 0x42b4d1
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rbp
mov r11w, ax
shr r11d, 0xf
and r11d, 1
movsxd rbx, r11d
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
lea edx, [r9 + 0x28]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x42b6ef
mov eax, dword [rbx + 0x28e0]
lea ecx, [rax - 1]
cmp ecx, eax
jae 0x42b502
lea rax, [rcx + rcx*2]
add rax, rax
cmp dword [rbx + rax*8 + 0x2988], 1
jne 0x42b502
lea rax, [rcx + rcx*2 + 0xf]
add rax, rax
movzx r8d, byte [rbx + rax*8 + 0x28c0]
jmp 0x42b505
xor r8d, r8d
mov eax, dword [rbx + 0x28e0]
xor dx, dx
lea ecx, [rax - 1]
cmp ecx, eax
jae 0x42b52e
lea rcx, [rcx + rcx*2]
add rcx, rcx
cmp dword [rbx + rcx*8 + 0x2988], 1
jne 0x42b52e
movzx edx, word [rbx + rcx*8 + 0x2990]
cmp eax, 0
je 0x42b541
test r8d, r8d
je 0x42b541
cmp si, dx
je 0x42b6e5
mov ecx, 0x14
mov qword [rbx + 0x2978], r12
mov word [rbx + 0x2980], r11w
mov dword [rbx + 0x28e8], 1
mov dword [rbx + 0x2974], 2
call qword [sym.imp.USER32.dll_GetKeyState]
mov di, ax
mov ecx, 0x10
and edi, 1
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, si
mov r11w, ax
add ecx, 0xffffffa5
shr r11d, 0xf
and r11d, 1
cmp ecx, 2
mov dword [rbx + 0x28e4], r11d
jbe 0x42b771
cmp dword [rbx + 0x59a0], 0
je 0x42b771
cmp dword [rbx + 0x28e0], 0x100
je 0x42b771
mov eax, dword [rbx + 0x28e0]
cmp eax, 0x100
jae 0x42b6c9
mov edx, dword [rsp + 0x80]
lea rcx, [rax + rax*2]
xor eax, eax
add rcx, rcx
mov qword [rbx + rcx*8 + 0x2988], rax
mov qword [rbx + rcx*8 + 0x2990], rax
mov qword [rbx + rcx*8 + 0x2998], rax
mov qword [rbx + rcx*8 + 0x29a0], rax
mov qword [rbx + rcx*8 + 0x29a8], rax
mov qword [rbx + rcx*8 + 0x29b0], rax
mov eax, dword [rbx + 0x28e0]
lea rcx, [rax + rax*2]
add rcx, rcx
mov dword [rbx + rcx*8 + 0x2988], 1
mov eax, dword [rbx + 0x28e0]
lea rax, [rax + rax*2 + 0xf]
add rax, rax
mov byte [rbx + rax*8 + 0x28c0], 1
mov eax, dword [rbx + 0x28e0]
lea rcx, [rax + rax*2]
add rcx, rcx
mov byte [rbx + rcx*8 + 0x29b1], r11b
mov eax, dword [rbx + 0x28e0]
lea rcx, [rax + rax*2]
add rcx, rcx
mov byte [rbx + rcx*8 + 0x29b2], dil
mov eax, dword [rbx + 0x28e0]
lea rcx, [rax + rax*2]
add rcx, rcx
mov qword [rbx + rcx*8 + 0x29a0], rdx
mov eax, dword [rbx + 0x28e0]
lea rcx, [rax + rax*2]
add rcx, rcx
mov dword [rbx + rcx*8 + 0x2994], 0
mov eax, dword [rbx + 0x28e0]
lea rcx, [rax + rax*2]
add rcx, rcx
mov word [rbx + rcx*8 + 0x2990], si
mov eax, dword [rbx + 0x28e0]
lea rcx, [rax + rax*2]
add rcx, rcx
mov dword [rbx + rcx*8 + 0x2994], 2
add dword [rbx + 0x28e0], 1
mov r9d, dword [rbx + 0x28e0]
mov r8d, 1
movzx edx, si
sub r9d, 1
mov rcx, rbx
call fcn.0042b120
movabs rax, 1
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
test dl, dl
mov r8, qword [rsp + 0x80]
jne 0x42b71d
test cl, cl
je 0x42b736
cmp rsi, 0xe5
jne 0x42b736
mov ecx, 0x80000000
mov rax, r8
and rax, rcx
cmp rax, rcx
je 0x42b6e5
mov word [rsp + 0x28], r11w
xor r9d, r9d
movzx edx, si
mov rcx, rbx
mov qword [rsp + 0x20], r12
call fcn.0042acb0
test eax, eax
je 0x42b771
mov r9d, dword [rbx + 0x28e0]
xor r8d, r8d
movzx edx, si
sub r9d, 1
mov rcx, rbx
call fcn.0042b120
jmp 0x42b6e5
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x42b6e5
mov eax, edi
sub eax, 0x106
je 0x42b6e5
sub eax, 0xb
je 0x42b6e5
cmp eax, 0xf4
je 0x42b4ca
mov rax, qword [rsp + 0x80]
mov rcx, qword [rbx + 0x5998]
mov r9, rsi
mov r8d, edi
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
jmp 0x42b6ef