Function at 0x14014a980
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov word [rsp + 8], cx
sub rsp, 0x128
mov eax, 0x4831
mov word [rsp + 0x30], ax
mov dword [rsp + 0x38], 0xfd7275e2
cmp dword [rsp + 0x38], 0x60a8abf3
jb 0x14014ae93
mov eax, dword [rsp + 0x38]
or eax, 0xca3313a8
cmp eax, 0x3eaa6d04
jne 0x14014aa4b
movzx ecx, word [rsp + 0x130]
call fcn.14014a980
mov r8d, 1
mov edx, 0x8d
mov ecx, 0xd0
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x589bbf72
je 0x14014a9fb
jmp 0x14014aa2e
mov eax, 0x3a75
mov word [rsp + 0x130], ax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x38]
xor eax, 0x6663cd55
mov dword [rsp + 0x38], eax
jmp 0x14014aa4b
mov r8d, 0x5c
lea rdx, [rsp + 0x98]
mov ecx, 0x1e
call qword [sym.imp.USER32.dll_SendInput]
mov dword [rsp + 0x44], eax
movsx eax, word [rsp + 0x130]
add eax, 0x3728
mov word [rsp + 0x30], ax
movsx eax, word [rsp + 0x30]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x3728
je 0x14014aa83
cmp dword [rsp + 0x54], 0x53aa
je 0x14014ad99
jmp 0x14014adaf
movsx eax, word [rsp + 0x30]
sub eax, 0x7ba1
movsx ecx, word [rsp + 0x130]
cmp eax, ecx
jne 0x14014aae0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x48], eax
lea rax, str.discolour_Clove_Pedology
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, 0x7c
mov edx, 0xc9
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x44]
movzx ecx, al
mov eax, dword [rsp + 0x48]
shr eax, cl
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x34], 0xa1
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x3ed1ce37
je 0x14014ab0d
cmp dword [rsp + 0x58], 0xe24a9d4d
je 0x14014ab60
jmp 0x14014ab7e
mov edx, 0xd0
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.USER32.dll_SetMenuContextHelpId]
mov dword [rsp + 0x4c], eax
call fcn.14014a530
movzx eax, byte [rsp + 0x34]
or eax, 0x7e
mov byte [rsp + 0x34], al
lea rdx, str.solvable_figureheads
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
jmp 0x14014ab7e
call qword [sym.imp.USER32.dll_GetKBCodePage]
mov dword [rsp + 0x44], eax
movsx eax, word [rsp + 0x40]
movsx ecx, word [rsp + 0x130]
shl eax, cl
mov word [rsp + 0x30], ax
movabs rax, 0x5b7370c2bdd9fbd6
mov qword [rsp + 0x88], rax
movzx eax, word [rsp + 0x130]
mov word [rsp + 0x3c], ax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
movabs rax, 0x67f3d54d54932bca
cmp qword [rsp + 0x80], rax
je 0x14014ac0f
movabs rax, 0xf989ef0b1179aa5c
cmp qword [rsp + 0x80], rax
je 0x14014abda
jmp 0x14014ac7d
lea rcx, str.Babies_Blabs
call qword [sym.imp.USER32.dll_CharLowerW]
mov qword [rsp + 0xc0], rax
movzx eax, word [rsp + 0x3c]
mov word [rsp + 0x130], ax
movsx eax, word [rsp + 0x3c]
movsx ecx, word [rsp + 0x30]
and eax, ecx
mov word [rsp + 0x40], ax
jmp 0x14014ac7d
mov r8, qword [rsp + 0xa8]
lea rdx, str.disclaimers_Metamorphism_Forested_cigaret_thanks
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_SetPropW]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x48]
ja 0x14014ac7d
movsx eax, word [rsp + 0x30]
movsx ecx, word [rsp + 0x40]
sub eax, ecx
mov word [rsp + 0x3c], ax
movzx ecx, word [rsp + 0x3c]
call fcn.14014a980
movzx eax, word [rsp + 0x3c]
mov word [rsp + 0x130], ax
mov ecx, 0x87
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x50], 0x21ca50dc
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0x21ca50dc
je 0x14014ad17
cmp dword [rsp + 0x5c], 0x6e914aa2
je 0x14014acb0
jmp 0x14014ad57
movzx eax, byte [rsp + 0x34]
add eax, 0xfd
mov byte [rsp + 0x34], al
movsx eax, word [rsp + 0x3c]
movsx ecx, word [rsp + 0x130]
and eax, ecx
movsx ecx, word [rsp + 0x30]
movsx edx, word [rsp + 0x40]
add ecx, edx
cmp eax, ecx
jl 0x14014acf4
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x34]
sub eax, 0x83
mov byte [rsp + 0x34], al
jmp 0x14014ad57
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xd8], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
movabs rax, 0x76217d2e32b43b13
mov qword [rsp + 0xe0], rax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x130], ax
mov r8d, ILIsParent
lea rdx, [rsp + 0xa8]
mov cx, 0xf4
call qword [sym.imp.USER32.dll_CharNextExA]
mov qword [rsp + 0xe8], rax
jmp 0x14014adaf
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x38]
mov dx, 0x6e
mov cl, reloc.SHELL32.dll_PathMakeUniqueName
call fcn.14014bb40
nop
movsx eax, word [rsp + 0x30]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x11e1
je 0x14014adc4
jmp 0x14014adc6
jmp 0x14014adce
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x44], eax
movsx eax, word [rsp + 0x130]
sub eax, 0x560
mov word [rsp + 0x30], ax
movsx eax, word [rsp + 0x130]
and eax, 0x5ab1
movsx ecx, word [rsp + 0x30]
cmp eax, ecx
jl 0x14014adf8
jmp 0x14014ae1e
mov eax, dword [rsp + 0x44]
sub eax, 0xa9cd43ac
cmp eax, dword [rsp + 0x38]
jae 0x14014ae1e
mov edx, 0xc8
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_GetMenuItemID]
mov dword [rsp + 0x48], eax
movzx ecx, word [rsp + 0x130]
call fcn.14014a980
mov r9d, ILCombine
xor r8d, r8d
mov edx, 0xe4
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov dword [rsp + 0x4c], eax
movsx eax, word [rsp + 0x130]
add eax, 0x30d5
mov word [rsp + 0x30], ax
movzx ecx, word [rsp + 0x30]
call fcn.14014a980
mov ecx, 0x6d
call qword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov qword [rsp + 0xf8], rax
mov eax, dword [rsp + 0x44]
add eax, 0x673402ac
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x130], ax
jmp 0x14014aeb9
mov eax, dword [rsp + 0x38]
sub eax, 0x1cfe182e
cmp eax, 0x7dfcefa4
ja 0x14014aeb9
mov eax, dword [rsp + 0x38]
shr eax, 0x19
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
shl eax, 4
mov dword [rsp + 0x38], eax
call fcn.14014a530
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x108]
mov r8d, 0x94
mov edx, 0xe0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x38]
add eax, 0x478eec1e
mov dword [rsp + 0x38], eax
call fcn.14014a530
mov eax, dword [rsp + 0x38]
and eax, 0xed039688
mov dword [rsp + 0x38], eax
mov edx, 0x63
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rsp + 0x110], rax
mov eax, 0xe0
add rsp, 0x128
ret