Function at 0x140039690
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1b0
mov rax, qword [0x1401043b8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov ebp, r8d
movzx esi, dx
mov rdi, rcx
mov rcx, qword [rcx + 0x218]
lea rdx, str.processKeyEvent___function_called:_virtKey___4.4x__addKeyData___x
mov r8d, esi
mov r9d, ebp
call fcn.14006b2b0
cmp byte [rdi + 0x220], 0
je 0x1400396fc
cmp si, 0x5b
je 0x1400396e4
cmp si, 0x5c
jne 0x1400396fc
mov rcx, qword [rdi + 0x218]
lea rdx, str.Ignoring_the_Win_key_event
call fcn.14006b2b0
jmp 0x140039c41
mov rcx, qword [rdi + 0x218]
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1a8], r12
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x198], r14
mov r14d, ebp
shr r14d, 0x1f
lea rdx, str.down___u
mov qword [rsp + 0x190], r15
not r14b
and r14b, 1
movzx r8d, r14b
mov dword [rsp + 0x44], r14d
call fcn.14006b2b0
test byte [rdi + 0x1b2], 0x80
jne 0x140039765
test byte [rdi + 0x1b3], 0x80
jne 0x140039765
xor r13b, r13b
jmp 0x140039768
mov r13b, 1
test byte [rdi + 0x1b4], 0x80
jne 0x14003977f
test byte [rdi + 0x1b5], 0x80
jne 0x14003977f
xor r12b, r12b
jmp 0x140039782
mov r12b, 1
test byte [rdi + 0x1b0], 0x80
jne 0x14003979e
test byte [rdi + 0x1b1], 0x80
jne 0x14003979e
xor r15b, r15b
mov byte [rsp + 0x40], r15b
jmp 0x1400397a6
mov r15b, 1
mov byte [rsp + 0x40], r15b
mov ecx, shutdown
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edx, r15b
movzx r9d, r12b
movzx ebx, ax
movzx r8d, r13b
and bl, 1
movzx ecx, bl
mov dword [rsp + 0x28], ecx
mov rcx, qword [rdi + 0x218]
mov dword [rsp + 0x20], edx
lea rdx, str.ctrl___u__alt___u__shift___u__caps_toggled___u
call fcn.14006b2b0
movzx eax, si
movzx r11d, r14b
neg r11b
movzx ecx, al
sbb dl, dl
and dl, 0x80
test bl, bl
setne al
shr ebp, 0x18
mov byte [rcx + rdi + 0x10], dl
and bpl, 1
mov byte [rdi + 0x24], al
cmp sil, 0x11
jne 0x140039817
test bpl, bpl
setne sil
add sil, 0xa2
cmp sil, 0x12
jne 0x140039828
test bpl, bpl
setne sil
add sil, 0xa4
cmp sil, 0x10
jne 0x140039839
test bpl, bpl
setne sil
add sil, 0xa0
movzx ebx, sil
xor esi, esi
mov byte [rbx + rdi + 0x110], dl
lea rdx, [0x1400d11e0]
mov eax, esi
mov rcx, rdx
cmp byte [rcx], bl
je 0x140039bdc
inc eax
add rcx, 8
cmp eax, 0x49
jb 0x140039852
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx r15d, bx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rdi + 0x10]
xor edx, edx
mov ecx, r15d
mov dword [rsp + 0x28], esi
mov rbp, rax
mov dword [rsp + 0x20], shutdown
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov ebx, eax
test eax, eax
jle 0x1400398c6
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x50]
lea r8, [rdi + 0x10]
xor edx, edx
mov ecx, r15d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], shutdown
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov ebx, eax
mov rcx, qword [rdi + 0x218]
lea rdx, str.ToUnicodeEx___return__d
mov r8d, ebx
call fcn.14006b2b0
cmp ebx, 1
jne 0x1400398f0
cmp byte [rdi + 0x213], sil
jne 0x140039c19
jmp 0x1400398f9
cmp ebx, 1
jle 0x140039a78
test r13b, r13b
je 0x14003990b
test r12b, r12b
je 0x14003990b
mov al, 1
mov byte [rsp + 0x41], al
jmp 0x140039911
xor al, al
mov byte [rsp + 0x41], al
test r13b, r13b
je 0x140039920
test r12b, r12b
jne 0x140039920
mov r15b, 1
jmp 0x140039923
xor r15b, r15b
test al, al
je 0x140039942
mov rcx, qword [rdi + 0x218]
lea rdx, str.Release_the_ctrl_and_alt_modifiers_before_send_the_key_event_s_
call fcn.14006b2b0
mov rcx, rdi
call fcn.14003a710
movsxd rax, ebx
mov rbp, rsi
mov qword [rsp + 0x48], rax
test ebx, ebx
jle 0x140039a4d
mov r13d, dword [rsp + 0x44]
mov r14d, 0xa0
lea r12, [0x140105aa0]
test r15b, r15b
je 0x1400399ce
movzx eax, word [rsp + rbp*2 + 0x50]
cmp ax, 0x20
jae 0x1400399ce
cmp ax, 1
jb 0x1400399ad
cmp ax, 0x1a
ja 0x1400399ad
cmp byte [rsp + 0x40], sil
jne 0x1400399ad
mov rcx, qword [rdi + 0x218]
movzx r8d, ax
lea rdx, str.The__u_char_is_a_control_symbol_then_it_will_be_increased_by_96_to__u
lea r9d, [r8 + 0x60]
call fcn.14006b2b0
add word [rsp + rbp*2 + 0x50], 0x60
jmp 0x1400399ce
mov rcx, qword [rdi + 0x218]
movzx r8d, ax
lea rdx, str.The__u_char_is_a_control_symbol_then_it_will_be_increased_by_64_to__u
lea r9d, [r8 + 0x40]
call fcn.14006b2b0
add word [rsp + rbp*2 + 0x50], 0x40
movzx edx, word [rsp + rbp*2 + 0x50]
cmp dx, 0x20
jb 0x1400399df
cmp dx, 0x7e
jbe 0x1400399ec
movzx eax, dx
sub ax, r14w
cmp ax, 0x5f
ja 0x1400399f1
movzx ebx, dx
jmp 0x140039a19
mov ecx, esi
mov rax, rsi
cmp word [r12 + rax*4 + 2], dx
je 0x140039a14
inc ecx
inc rax
cmp ecx, 0x2f6
jb 0x1400399f6
movzx ebx, dx
bts ebx, 0x18
jmp 0x140039a19
movzx ebx, word [r12 + rax*4]
mov rcx, qword [rdi + 0x218]
lea rdx, str.Sending_the__4.4x_rfb_symbol
mov r8d, ebx
call fcn.14006b2b0
mov r11, qword [rdi]
movzx r8d, r13b
mov edx, ebx
mov rcx, rdi
call qword [r11 + reloc.WS2_32.dll_htonl]
inc rbp
cmp rbp, qword [rsp + 0x48]
jl 0x140039967
cmp byte [rsp + 0x41], sil
je 0x140039c19
mov rcx, qword [rdi + 0x218]
lea rdx, str.Restore_the_ctrl_and_alt_modifiers_after_send_the_key_event_s_
call fcn.14006b2b0
mov rcx, rdi
call fcn.14003a820
jmp 0x140039c19
test ebx, ebx
jne 0x140039bb1
mov rcx, qword [rdi + 0x218]
lea rdx, str.Was_get_a_not_printable_symbol_then_try_get_a_printable_with_turned_off_the_ctrl_and_alt_modifiers
call fcn.14006b2b0
lea rcx, [rsp + 0x80]
lea rdx, [rdi + 0x10]
mov r8d, 0x100
call fcn.14007ad70
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x80]
xor edx, edx
mov ecx, r15d
mov dword [rsp + 0x28], esi
mov byte [rsp + 0x122], sil
mov byte [rsp + 0x123], sil
mov byte [rsp + 0x91], sil
mov byte [rsp + 0x124], sil
mov byte [rsp + 0x125], sil
mov byte [rsp + 0x92], sil
mov dword [rsp + 0x20], shutdown
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov rcx, qword [rdi + 0x218]
lea rdx, str.ToUnicodeEx___without_ctrl_and_alt_return__d
mov r8d, eax
mov ebx, eax
call fcn.14006b2b0
cmp ebx, 1
jne 0x140039c19
movzx ecx, word [rsp + 0x50]
cmp cx, 0x20
jb 0x140039b35
cmp cx, 0x7e
jbe 0x140039b48
mov r14d, 0xa0
movzx eax, cx
sub ax, r14w
cmp ax, 0x5f
ja 0x140039b5e
mov rax, qword [rdi]
mov r8d, dword [rsp + 0x44]
movzx edx, cx
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140039c19
lea rax, [0x140105aa2]
cmp word [rax], cx
je 0x140039b92
inc esi
add rax, 4
cmp esi, 0x2f6
jb 0x140039b65
mov rax, qword [rdi]
mov r8d, dword [rsp + 0x44]
movzx edx, cx
bts edx, 0x18
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140039c19
mov r8d, dword [rsp + 0x44]
movsxd rax, esi
lea r12, [0x140105aa0]
movzx edx, word [r12 + rax*4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140039c19
cmp ebx, 0xffffffff
jne 0x140039c19
mov r13d, dword [rsp + 0x44]
test r13b, r13b
je 0x140039c19
mov rcx, qword [rdi + 0x218]
lea rdx, str.Dead_key_pressed__wait_for_a_char_event
call fcn.14006b2b0
mov byte [rdi + 0x213], 1
jmp 0x140039c19
mov ebx, dword [rdx + rax*8 + 4]
cmp ebx, 0xff0d
jne 0x140039bf3
mov eax, 0xff8d
test bpl, bpl
cmovne ebx, eax
mov rcx, qword [rdi + 0x218]
lea rdx, str.The_key_has_been_mapped_to_the__4.4x_rfb_symbol
mov r8d, ebx
call fcn.14006b2b0
mov r11, qword [rdi]
movzx r8d, r14b
mov edx, ebx
mov rcx, rdi
call qword [r11 + reloc.WS2_32.dll_htonl]
mov r14, qword [rsp + 0x198]
mov r13, qword [rsp + 0x1a0]
mov r12, qword [rsp + 0x1a8]
mov rbx, qword [rsp + 0x1e8]
mov r15, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140078e40
add rsp, 0x1b0
pop rdi
pop rsi
pop rbp
ret