Function at 0x140010030
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movzx ebx, dl
mov r14, r9
movzx eax, bx
movzx edi, r8w
or ax, r8w
mov r15d, ecx
je 0x14001066a
mov qword [r11 + 8], rsi
mov eax, 0xffc3d44d
mov qword [r11 - 0x30], r12
mov qword [r11 - 0x38], r13
mov r13d, dword [rbp + 0xb8]
test r13d, r13d
cmove r13d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1400f2420]
sete sil
cmp dword [0x1400f43cc], 0
je 0x1400100a4
mov byte [rbp + 0x98], 1
test sil, sil
je 0x1400100ab
mov byte [rbp + 0x98], 0
cmp dword [0x1400f43cc], 1
je 0x1400100b9
test sil, sil
je 0x1400100c0
mov byte [rbp + 0xb0], 0
test bl, bl
jne 0x1400100d1
movzx ecx, di
call fcn.140013a30
movzx ebx, al
jmp 0x1400100e3
test di, di
jne 0x1400100e3
xor edx, edx
movzx ecx, bl
call fcn.140013750
movzx edi, ax
xor r12d, r12d
lea rdx, [0x140000000]
mov ecx, r12d
movzx eax, di
shr ax, 8
test al, al
setne cl
cmp dword [0x1400f43cc], 2
mov dword [rsp + 0x40], ecx
jne case.default.0x140010122
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x140010122
cdqe
mov ecx, dword [rdx + rax*4 + 0x1067c]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x140010122
mov bl, reloc.OLEAUT32.dll_SafeArrayGetDim
jmp case.default.0x140010122
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r14, r14
je 0x1400102a4
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.1400129f0
test al, al
je 0x1400101ee
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test r15d, r15d
jne 0x140010167
movzx eax, bl
or byte [rsp + rax + 0x50], 0x80
jmp 0x140010175
cmp r15d, 1
jne 0x140010175
movzx eax, bl
and byte [rsp + rax + 0x50], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x140010195
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x10694]
add rcx, rdx
jmp rcx
test byte [rbp - 0xe], 0x80
jne 0x1400101aa
test byte [rbp - 0xd], 0x80
jne 0x1400101aa
and byte [rsp + 0x61], 0x7f
jmp case.default.0x140010195
or byte [rsp + 0x61], 0x80
jmp case.default.0x140010195
test byte [rbp - 0x10], 0x80
jne 0x1400101c4
test byte [rbp - 0xf], 0x80
jne 0x1400101c4
and byte [rsp + 0x60], 0x7f
jmp case.default.0x140010195
or byte [rsp + 0x60], 0x80
jmp case.default.0x140010195
test byte [rbp - 0xc], 0x80
jne 0x1400101de
test byte [rbp - 0xb], 0x80
jne 0x1400101de
and byte [rsp + 0x62], 0x7f
jmp case.default.0x140010195
or byte [rsp + 0x62], 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
cmp r15d, 1
je 0x140010216
mov r9, rdi
movzx r8d, bl
or r9, 1
mov edx, 0x100
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xb0], r12b
je 0x14001027b
cmp r15d, 2
jne 0x14001027b
mov rax, qword [0x1400edaa8]
mov ecx, dword [rax + 0x84]
test ecx, ecx
js 0x140010284
mov eax, dword [0x1400f43cc]
test eax, eax
je 0x14001025e
cmp eax, r15d
jne 0x140010284
test ecx, ecx
jle 0x140010284
mov dword [rsp + 0x20], ecx
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
xor edx, edx
call fcn.1400116e0
jmp 0x140010284
mov edx, 1
mov dword [0x1400edaa0], r12d
call fcn.140001800
mov dword [0x1400edaa0], 1
jmp 0x140010284
test r15d, r15d
je 0x140010629
mov r9d, 0xc0000001
movzx r8d, bl
or r9, rdi
mov edx, 0x101
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140010629
cmp byte [0x1400f154f], r12b
mov dword [0x1400f6828], r15d
mov byte [0x1400f43d8], bl
je 0x1400102d9
cmp bl, 0x12
je 0x1400102c6
lea eax, [rbx + 0x5c]
cmp al, 1
ja 0x1400102d9
test sil, sil
jne 0x1400102d9
xor ecx, ecx
mov byte [rsp + 0x34], 1
call fcn.140030b70
jmp 0x1400102de
mov byte [rsp + 0x34], r12b
movzx r10d, byte [rbp + 0x98]
lea rax, [0x1400f682c]
test sil, sil
lea r14, [rsp + 0x44]
cmove r14, rax
cmp bl, 0xa5
jne 0x1400103a8
test r10b, r10b
jne 0x1400103a8
cmp qword [0x1400f1560], r12
je 0x1400103a8
mov al, 1
mov byte [rsp + 0x32], al
mov byte [rbp + 0xa0], al
test sil, sil
jne 0x140010337
mov rax, qword [0x1400f6830]
mov qword [rsp + 0x38], rax
jmp 0x14001036e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140010350
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r12d, eax
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
mov qword [rsp + 0x38], rax
xor edx, edx
mov r12, rax
call fcn.140012d80
mov dword [r14], eax
cmp dword [r14], 0
je 0x140010380
mov byte [rbp + 0xa0], 0
mov r11b, 1
jmp 0x1400103f6
mov ecx, 0xa2
mov byte [rsp + 0x30], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [0x1400f22ec], r13d
mov r11b, 1
movzx r12d, ax
shr r12d, 0xf
and r12b, 1
jmp 0x140010409
xor r11b, r11b
mov byte [rsp + 0x32], r11b
mov byte [rbp + 0xa0], r11b
test r10b, r10b
je 0x1400103ec
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.1400129f0
movzx r12d, byte [rbp + 0x98]
movzx ecx, al
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0x98]
mov byte [rsp + 0x30], al
jmp 0x140010413
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0x98]
movzx r12d, byte [rbp + 0x98]
mov byte [rsp + 0x30], al
movzx r10d, byte [rbp + 0x98]
xor cl, cl
mov byte [rsp + 0x31], cl
test sil, sil
jne 0x14001043b
mov eax, dword [0x1400f43cc]
cmp eax, 2
je 0x14001043b
cmp qword [0x1400f1560], 0
je 0x140010436
cmp eax, 1
jne 0x14001043b
mov sil, 1
jmp 0x14001043e
xor sil, sil
mov byte [rsp + 0x33], sil
cmp r15d, 1
je 0x140010504
test r10b, r10b
je 0x14001046d
mov r9d, dword [rsp + 0x40]
movzx r8d, di
movzx edx, bl
mov dword [rsp + 0x20], r13d
call fcn.1400116e0
jmp 0x1400104f1
test r11b, r11b
je 0x140010486
mov eax, dword [0x1400f22e8]
cmp dword [r14], 3
cmove eax, r13d
mov dword [0x1400f22e8], eax
mov r8d, dword [rsp + 0x40]
movzx edx, dil
mov r9d, r13d
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
xor eax, eax
mov dword [0x1400f22e8], eax
cmp byte [rbp + 0xa0], al
je 0x1400104f1
cmp dword [0x1400f22ec], eax
mov byte [rbp + 0xa0], al
je 0x1400104c4
mov dword [0x1400f22ec], eax
lea edx, [rax + 4]
jmp 0x1400104e4
test r12b, r12b
jne 0x1400104f1
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
and ax, cx
neg ax
sbb edx, edx
add edx, 4
mov rcx, qword [rsp + 0x38]
call fcn.140012d80
mov dword [r14], eax
test sil, sil
je 0x140010504
movzx r8d, di
movzx edx, bl
xor ecx, ecx
call fcn.140011d60
cmp byte [rbp + 0xb0], 0
je 0x14001053d
cmp r15d, 2
jne 0x14001053d
cmp dword [0x1400f43cc], r15d
mov rax, qword [0x1400edaa8]
jne 0x140010530
mov ecx, dword [rax + 0x88]
call fcn.140011c70
jmp 0x140010546
mov ecx, dword [rax + 0x84]
call fcn.140011c70
jmp 0x140010546
test r15d, r15d
je 0x14001061b
mov ecx, dword [rsp + 0x40]
or ecx, 2
cmp byte [rbp + 0x98], 0
je 0x140010571
mov r9d, ecx
mov dword [rsp + 0x20], r13d
movzx ecx, byte [rsp + 0x31]
movzx r8d, di
movzx edx, bl
call fcn.1400116e0
jmp 0x1400105ef
cmp byte [rsp + 0x32], 0
je 0x14001058c
mov eax, dword [0x1400f22e4]
cmp dword [r14], 3
cmove eax, r13d
mov dword [0x1400f22e4], eax
mov r8d, ecx
mov r9d, r13d
movzx ecx, bl
movzx edx, dil
call qword [sym.imp.USER32.dll_keybd_event]
xor esi, esi
mov dword [0x1400f22e4], esi
cmp byte [rbp + 0xa0], sil
je 0x1400105ef
cmp dword [0x1400f22ec], esi
je 0x1400105c3
mov dword [0x1400f22ec], esi
lea edx, [rsi + 4]
jmp 0x1400105e2
test r12b, r12b
je 0x1400105ef
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
setne sil
lea edx, [rsi + 3]
mov rcx, qword [rsp + 0x38]
call fcn.140012d80
mov dword [r14], eax
cmp dword [r14], 0
je 0x140010606
mov eax, 0x138
cmp di, ax
jne 0x140010606
and byte [0x1400f680e], 0xfe
cmp byte [rsp + 0x33], 0
je 0x14001061b
movzx r8d, di
movzx edx, bl
mov cl, 1
call fcn.140011d60
cmp byte [rsp + 0x34], 0
je 0x140010629
mov cl, 1
call fcn.140030b70
cmp byte [rbp + 0xb0], 0
mov r13, qword [rsp + 0x150]
mov r12, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x190]
je 0x14001066a
cmp dword [0x1400f43cc], 2
mov rax, qword [0x1400edaa8]
jne 0x140010662
mov ecx, dword [rax + 0x80]
jmp 0x140010665
mov ecx, dword [rax + 0x7c]
call fcn.140011c70
add rsp, 0x160
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret