Function at 0x14001e530
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movzx edi, dl
mov r14, r9
movzx eax, di
movzx r12d, r8w
or ax, r8w
mov r13d, ecx
je 0x14001ec5b
mov eax, dword [rbp + 0xb8]
mov ecx, 0xffc3d44d
mov qword [r11 + 8], rbx
test eax, eax
mov qword [r11 - 0x30], rsi
cmovne ecx, eax
mov qword [r11 - 0x38], r15
mov dword [rsp + 0x38], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1401149f4]
sete r15b
cmp dword [0x140117f14], 0
je 0x14001e5a3
test r15b, r15b
jne 0x14001e5a3
mov bl, 1
jmp 0x14001e5a5
xor bl, bl
cmp dword [0x140117f14], 1
mov byte [rsp + 0x30], bl
je 0x14001e5b7
test r15b, r15b
je 0x14001e5be
mov byte [rbp + 0xb0], 0
test dil, dil
jne 0x14001e5d1
movzx ecx, r12w
call fcn.140023100
movzx edi, al
jmp 0x14001e5e6
test r12w, r12w
jne 0x14001e5e6
xor edx, edx
movzx ecx, dil
call fcn.140022cc0
movzx r12d, ax
xor esi, esi
lea rdx, [0x140000000]
mov ecx, esi
movzx eax, r12w
shr ax, 8
test al, al
setne cl
cmp dword [0x140117f14], 2
mov dword [rsp + 0x48], ecx
jne case.default.0x14001e625
movzx eax, dil
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001e625
cdqe
mov ecx, dword [rdx + rax*4 + 0x1ec6c]
add rcx, rdx
jmp rcx
mov dil, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x14001e625
mov dil, reloc.WSOCK32.dll_recv
jmp case.default.0x14001e625
mov dil, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r14, r14
je 0x14001e76e
xor r8d, r8d
movzx edx, r12w
movzx ecx, dil
call fcn.140021580
test al, al
je 0x14001e6f9
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test r13d, r13d
jne 0x14001e670
movzx eax, dil
or byte [rsp + rax + 0x50], 0x80
jmp 0x14001e67f
cmp r13d, 1
jne 0x14001e67f
movzx eax, dil
and byte [rsp + rax + 0x50], 0x7f
movzx eax, dil
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001e6a0
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1ec84]
add rcx, rdx
jmp rcx
test byte [rbp - 0xe], 0x80
jne 0x14001e6b5
test byte [rbp - 0xd], 0x80
jne 0x14001e6b5
and byte [rsp + 0x61], 0x7f
jmp case.default.0x14001e6a0
or byte [rsp + 0x61], 0x80
jmp case.default.0x14001e6a0
test byte [rbp - 0x10], 0x80
jne 0x14001e6cf
test byte [rbp - 0xf], 0x80
jne 0x14001e6cf
and byte [rsp + 0x60], 0x7f
jmp case.default.0x14001e6a0
or byte [rsp + 0x60], 0x80
jmp case.default.0x14001e6a0
test byte [rbp - 0xc], 0x80
jne 0x14001e6e9
test byte [rbp - 0xb], 0x80
jne 0x14001e6e9
and byte [rsp + 0x62], 0x7f
jmp case.default.0x14001e6a0
or byte [rsp + 0x62], 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, r12w
shl eax, 0x10
movsxd rbx, eax
cmp r13d, 1
je 0x14001e722
mov r9, rbx
movzx r8d, dil
or r9, 1
mov edx, 0x100
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xb0], sil
je 0x14001e745
cmp r13d, 2
jne 0x14001e745
mov rax, qword [0x1401101f0]
mov ecx, dword [rax + 0x84]
call fcn.1400205c0
jmp 0x14001e74e
test r13d, r13d
je 0x14001ec1a
mov r9d, 0xc0000001
movzx r8d, dil
or r9, rbx
mov edx, 0x101
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001ec1a
cmp byte [0x140113b32], sil
mov dword [0x140117e50], r13d
mov byte [0x140117e54], dil
je 0x14001e7ad
cmp dil, 0x12
je 0x14001e792
lea eax, [rdi + 0x5c]
cmp al, 1
ja 0x14001e7ad
test r15b, r15b
jne 0x14001e7ad
xor ecx, ecx
mov byte [rsp + 0x34], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140113b32], sil
jmp 0x14001e7b2
mov byte [rsp + 0x34], sil
test r15b, r15b
lea rax, [0x140117f00]
lea r10, [rsp + 0x4c]
cmove r10, rax
mov qword [rsp + 0x40], r10
cmp dil, 0xa5
jne 0x14001e8b9
test bl, bl
jne 0x14001e8b9
cmp qword [0x140113a80], rsi
je 0x14001e8b9
mov byte [rsp + 0x32], 1
mov byte [rbp + 0x98], 1
test r15b, r15b
jne 0x14001e806
mov r14, qword [0x140117e58]
mov eax, dword [r10]
jmp 0x14001e872
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
call fcn.140021890
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r9, [0x140117e60]
mov ecx, esi
mov rdx, r9
mov r14, rax
nop dword [rax + rax]
mov r8, qword [rdx]
test r8, r8
je 0x14001e848
cmp r8, r14
je 0x14001e882
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x14001e830
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, r14
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.140021900
mov dword [rbx + 8], eax
mov qword [rbx], r14
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
test eax, eax
je 0x14001e88f
mov byte [rbp + 0x98], sil
mov r11b, 1
jmp 0x14001e8ff
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x14001e86b
mov ecx, 0xa2
mov byte [rbp + 0xa0], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov r11b, 1
mov eax, dword [rsp + 0x38]
shr ebx, 0xf
and bl, 1
mov dword [0x1401148bc], eax
jmp 0x14001e913
xor r11b, r11b
mov byte [rbp + 0x98], sil
mov byte [rsp + 0x32], r11b
test bl, bl
je 0x14001e8fa
xor r8d, r8d
movzx edx, r12w
movzx ecx, dil
call fcn.140021580
mov r14, qword [rsp + 0x40]
movzx ecx, al
movzx eax, byte [rbp + 0x98]
movzx ebx, byte [rbp + 0x98]
mov byte [rbp + 0xa0], al
jmp 0x14001e91a
mov r14, qword [rsp + 0x40]
movzx eax, byte [rbp + 0x98]
movzx ebx, byte [rbp + 0x98]
mov byte [rbp + 0xa0], al
mov r10, qword [rsp + 0x40]
xor cl, cl
mov byte [rsp + 0x31], cl
test r15b, r15b
jne 0x14001e941
mov eax, dword [0x140117f14]
cmp eax, 2
je 0x14001e941
cmp qword [0x140113a80], rsi
je 0x14001e93c
cmp eax, 1
jne 0x14001e941
mov r15b, 1
jmp 0x14001e944
xor r15b, r15b
mov byte [rsp + 0x33], r15b
cmp r13d, 1
je 0x14001ea7c
cmp byte [rsp + 0x30], sil
je 0x14001e979
mov eax, dword [rsp + 0x38]
movzx r8d, r12w
mov r9d, dword [rsp + 0x48]
movzx edx, dil
mov dword [rsp + 0x20], eax
call fcn.14001ff30
jmp 0x14001ea68
test r11b, r11b
je 0x14001e993
mov eax, dword [0x1401148b8]
cmp dword [r10], 3
cmove eax, dword [rsp + 0x38]
mov dword [0x1401148b8], eax
mov r9d, dword [rsp + 0x38]
movzx edx, r12b
mov r8d, dword [rsp + 0x48]
movzx ecx, dil
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x1401148b8], esi
cmp byte [rbp + 0x98], sil
je 0x14001ea68
cmp dword [0x1401148bc], esi
mov byte [rbp + 0x98], sil
je 0x14001ea38
lea r8, [0x140117e60]
mov dword [0x1401148bc], esi
mov rax, r8
mov ecx, esi
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x14001e9f8
cmp rdx, r14
je 0x14001ea1d
inc ecx
add rax, 0x10
cmp ecx, 0xa
jl 0x14001e9e0
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
movsxd rcx, eax
mov eax, 4
add rcx, rcx
mov qword [r8 + rcx*8], r14
mov dword [r8 + rcx*8 + 8], 4
jmp 0x14001ea61
movsxd rcx, ecx
add rcx, rcx
mov eax, dword [r8 + rcx*8 + 8]
test eax, eax
jne 0x14001ea61
mov eax, 4
mov dword [r8 + rcx*8 + 8], eax
jmp 0x14001ea61
test bl, bl
jne 0x14001ea68
movzx ecx, byte [rbp + 0xa0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
and ax, cx
mov rcx, r14
neg ax
sbb edx, edx
add edx, 4
call fcn.140021af0
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
test r15b, r15b
je 0x14001ea7c
movzx r8d, r12w
movzx edx, dil
xor ecx, ecx
call fcn.140020820
cmp byte [rbp + 0xb0], sil
je 0x14001eab5
cmp r13d, 2
jne 0x14001eab5
cmp dword [0x140117f14], r13d
mov rax, qword [0x1401101f0]
jne 0x14001eaa8
mov ecx, dword [rax + 0x88]
call fcn.1400205c0
jmp 0x14001eabe
mov ecx, dword [rax + 0x84]
call fcn.1400205c0
jmp 0x14001eabe
test r13d, r13d
je 0x14001ec01
mov ecx, dword [rsp + 0x48]
or ecx, 2
cmp byte [rsp + 0x30], sil
je 0x14001eaee
mov eax, dword [rsp + 0x38]
mov r9d, ecx
movzx ecx, byte [rsp + 0x31]
movzx r8d, r12w
movzx edx, dil
mov dword [rsp + 0x20], eax
call fcn.14001ff30
jmp 0x14001ebcf
mov r15, qword [rsp + 0x40]
cmp byte [rsp + 0x32], sil
je 0x14001eb0f
mov eax, dword [0x1401148b4]
cmp dword [r15], 3
cmove eax, dword [rsp + 0x38]
mov dword [0x1401148b4], eax
mov r9d, dword [rsp + 0x38]
mov r8d, ecx
movzx ecx, dil
movzx edx, r12b
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x1401148b4], esi
cmp byte [rbp + 0x98], sil
je 0x14001ebcf
cmp dword [0x1401148bc], esi
je 0x14001eba4
lea rdx, [0x140117e60]
mov dword [0x1401148bc], esi
mov rax, rdx
mov rcx, qword [rax]
test rcx, rcx
je 0x14001eb68
cmp rcx, r14
je 0x14001eb8b
inc esi
add rax, 0x10
cmp esi, 0xa
jl 0x14001eb50
cmp esi, 0xa
mov eax, 9
cmovl eax, esi
cdqe
add rax, rax
mov qword [rdx + rax*8], r14
mov dword [rdx + rax*8 + 8], 4
mov eax, 4
jmp 0x14001ebcc
movsxd rcx, esi
add rcx, rcx
mov eax, dword [rdx + rcx*8 + 8]
test eax, eax
jne 0x14001ebcc
mov eax, 4
mov dword [rdx + rcx*8 + 8], eax
jmp 0x14001ebcc
test bl, bl
je 0x14001ebcf
movzx ecx, byte [rbp + 0xa0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
mov rcx, r14
setne sil
lea edx, [rsi + 3]
call fcn.140021af0
mov dword [r15], eax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0
je 0x14001ebeb
mov eax, 0x138
cmp r12w, ax
jne 0x14001ebeb
and byte [0x140117f10], 0xfe
cmp byte [rsp + 0x33], 0
je 0x14001ec01
movzx r8d, r12w
movzx edx, dil
mov cl, 1
call fcn.140020820
cmp byte [rsp + 0x34], 0
je 0x14001ec1a
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140113b32], 1
cmp byte [rbp + 0xb0], 0
mov r15, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x190]
je 0x14001ec5b
cmp dword [0x140117f14], 2
mov rax, qword [0x1401101f0]
jne 0x14001ec53
mov ecx, dword [rax + 0x80]
jmp 0x14001ec56
mov ecx, dword [rax + 0x7c]
call fcn.1400205c0
add rsp, 0x160
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret