Function at 0x140013c90
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov r10d, dword [0x1401430f0]
movzx esi, dl
mov rdx, qword [0x140140500]
movzx r15d, r8w
cmp r10d, 1
jne 0x140013ce0
cmp byte [0x140143138], 0
jne 0x140013ce0
movzx eax, sil
lea rax, [rax + rax*2]
cmp qword [rdx + rax*8], 0
jne 0x140013ce0
xor r11b, r11b
jmp 0x140013ce3
mov r11b, 1
mov byte [rbp + 0x108], r11b
mov qword [rsp + 0x1c8], rdi
test r9b, r9b
je 0x140013d15
movzx eax, sil
mov edi, 1
lea rcx, [rax + rax*2]
movzx eax, r11b
cmp byte [rdx + rcx*8 + 0xc], 0
cmovne eax, edi
jmp 0x140014982
cmp qword [0x140140540], 0
movzx eax, byte [rbp + 0x110]
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x1b0], r14
je 0x140013d44
test al, al
jne 0x140013d44
test r11b, r11b
je 0x140013d44
mov r14b, 1
jmp 0x140013d47
xor r14b, r14b
movzx edi, byte [0x14013f65f]
xor ebx, ebx
cmp r10d, 1
jne 0x140013e60
cmp byte [0x140143136], bl
je 0x140013d6a
test al, al
jne 0x140013e60
mov r8b, 1
mov byte [rsp + 0x40], r8b
cmp sil, 0xe7
je 0x140013dc0
mov rax, qword [0x1401430f8]
mov r8, qword [0x140143100]
movzx ecx, sil
movzx edx, byte [rcx + rax]
test dl, dl
jne 0x140013d9f
movzx eax, r15w
movzx edx, byte [rax + r8]
test dl, dl
je 0x140013dbd
movzx ecx, dl
shr dl, 2
shr cl, 1
and dl, 1
and cl, 1
je 0x140013def
test dl, dl
jne 0x140013df9
test dil, 0x30
jne 0x140013df9
test dl, dl
jne 0x140013df3
mov r8b, 1
movzx eax, sil
add eax, 0xffffffdf
cmp eax, 0x84
ja case.0x140013ded.41
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x149a4]
mov ecx, dword [rdx + rax*4 + 0x14998]
add rcx, rdx
jmp rcx
test dl, dl
je 0x140013df9
test dil, 0x30
jne 0x140013dbd
mov r10d, 4
movzx eax, r15w
mov dword [0x1401430f0], r10d
cmp byte [rax + r8], bl
mov byte [0x140143110], sil
setne byte [0x140143116]
mov word [0x140143112], r15w
mov word [0x140143114], bx
test cl, cl
je 0x140013e3c
mov byte [0x140143117], 1
test dil, 0x30
jne 0x140013e42
mov byte [0x140143117], bl
test r14b, r14b
jne 0x140013dbd
cmp byte [0x140143fd0], bl
jne 0x140013dbd
movzx eax, r11b
jmp 0x140014972
xor r8b, r8b
mov byte [rsp + 0x40], r8b
jmp 0x140013dc0
mov al, 1
jmp 0x140014972
test r14b, r14b
je case.0x140013ded.41
mov edx, dword [0x14013e218]
test edx, edx
je 0x140013e9a
mov word [0x14013e220], bx
mov edx, ebx
mov dword [0x14013e218], ebx
jmp 0x140013e9a
mov edx, dword [0x14013e218]
test dil, dil
je 0x140013ecb
cmp r10d, 1
jne 0x140013ead
cmp byte [0x140143137], bl
jne 0x140013ecb
cmp dil, 0x10
je 0x140013ecb
cmp dil, 0x20
je 0x140013ecb
cmp dil, 0x30
je 0x140013ecb
test dil, 0xc
je 0x140013f2e
test dil, 3
je 0x140013f2e
cmp sil, 8
jne 0x140013f37
test dil, dil
jne 0x140013f37
test r8b, r8b
je 0x140013f09
cmp r10d, 1
jne 0x140013f09
cmp byte [0x140143134], bl
je 0x140013f09
mov eax, dword [0x140143148]
test eax, eax
je 0x140013f09
dec eax
mov dword [0x140143148], eax
movsxd rcx, eax
mov rax, qword [0x140143140]
mov word [rax + rcx*2], bx
test r14b, r14b
je 0x140013f28
test edx, edx
je 0x140013f28
dec edx
lea rcx, [0x14013e220]
movsxd rax, edx
mov dword [0x14013e218], edx
mov word [rcx + rax*2], bx
mov byte [0x140143fd0], bl
movzx eax, r11b
jmp 0x140014972
mov qword [rsp + 0x1c0], r12
mov qword [rsp + 0x1b8], r13
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r12, rax
call fcn.1400236b0
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp qword [0x140143fe0], r12
mov qword [rsp + 0x68], rax
je 0x140013fa8
lea rdx, [rbp + 0x70]
mov r8d, 0x1c
mov rcx, r12
mov qword [0x140143fe0], r12
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.ApplicationFrameWindow
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
sete dil
mov byte [0x140143fd8], dil
jmp 0x140013faf
movzx edi, byte [0x140143fd8]
lea rcx, [rsp + 0x70]
lea rdx, [0x14013f740]
mov r8d, 0x100
call sub.MSVCR100.dll_memcpy
movzx r13d, byte [0x140143fd0]
test r13b, r13b
je 0x14001407e
test dil, dil
je 0x14001407e
cmp sil, 0xe7
je 0x14001407e
movzx eax, byte [0x140143fd6]
neg al
movzx eax, byte [0x140143fd7]
sbb dl, dl
and dl, 0x20
neg al
sbb cl, cl
and cl, 9
or dl, cl
lea rcx, [rsp + 0x70]
call fcn.1400232d0
mov rdi, qword [rsp + 0x68]
movzx edx, word [0x140143fd4]
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x70]
movzx ecx, r13b
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
jle 0x140014076
movzx edx, word [0x140143fd4]
movzx ecx, byte [0x140143fd0]
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov byte [0x140143fd0], bl
jmp 0x140014083
mov rdi, qword [rsp + 0x68]
movzx edx, byte [0x14013f65f]
lea rcx, [rsp + 0x70]
call fcn.1400232d0
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400140a9
or byte [rbp - 0x7c], 1
jmp 0x1400140ad
and byte [rbp - 0x7c], 0xfe
mov r13, qword [rbp + 0xf0]
cmp sil, 0xe7
jne 0x1400140d2
mov eax, 1
movzx ecx, r15w
movzx edi, sil
mov dword [rsp + 0x4c], eax
mov word [rsp + 0x44], cx
jmp 0x140014121
cmp dword [0x14013f8d0], ebx
mov edx, dword [r13 + 4]
mov qword [rsp + 0x30], rdi
mov eax, ebx
setne al
movzx edi, sil
mov dword [rsp + 0x28], eax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x70]
mov ecx, edi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov dword [rsp + 0x4c], eax
test eax, eax
jne 0x14001411c
movzx eax, byte [rbp + 0x108]
jmp 0x140014962
movzx ecx, word [rsp + 0x44]
cmp byte [0x140143fd0], bl
setne byte [rsp + 0x50]
test eax, eax
jns 0x1400141af
movzx r14d, byte [rbp + 0x108]
test r14b, r14b
je 0x1400141a6
movzx eax, byte [0x14013f65f]
mov byte [0x140143fd0], sil
mov word [0x140143fd4], r15w
test al, 0x30
setne byte [0x140143fd6]
test al, 3
je 0x14001416b
mov byte [0x140143fd7], 1
test al, 0xc
jne 0x140014171
mov byte [0x140143fd7], bl
cmp dword [0x14013f8d0], ebx
mov rax, qword [rsp + 0x68]
mov edx, dword [r13 + 4]
mov qword [rsp + 0x30], rax
setne bl
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x70]
mov ecx, edi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
movzx eax, r14b
jmp 0x140014962
test byte [0x14013f65f], 3
jne 0x1400141d7
mov eax, 0xa
cmp cx, 0xd
jne 0x1400141ca
mov ecx, eax
mov word [rsp + 0x44], ax
cmp word [rsp + 0x46], 0xd
jne 0x1400141d7
mov word [rsp + 0x46], ax
xor sil, sil
test r14b, r14b
je 0x14001440d
cmp r12, qword [0x14013e210]
lea r15, [0x14013e220]
je 0x140014205
mov qword [0x14013e210], r12
mov word [0x14013e220], bx
mov edx, ebx
jmp 0x140014257
mov edx, dword [0x14013e218]
mov eax, 0x5a
sub eax, edx
cmp eax, 3
jge 0x140014257
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x14013e27a]
repne scasw ax, word [rdi]
lea rdx, [0x14013e27a]
not rcx
dec rcx
mov dword [0x14013e218], ecx
lea eax, [rcx + 1]
mov rcx, r15
movsxd r8, eax
add r8, r8
call qword [sym.imp.MSVCR100.dll_memmove]
movzx ecx, word [rsp + 0x44]
mov edx, dword [0x14013e218]
mov edi, dword [rsp + 0x4c]
movsxd rax, edx
inc edx
mov word [r15 + rax*2], cx
mov dword [0x14013e218], edx
cmp edi, 1
jle 0x140014285
movzx eax, word [rsp + 0x46]
movsxd rcx, edx
inc edx
mov word [r15 + rcx*2], ax
mov dword [0x14013e218], edx
movsxd rax, edx
mov word [r15 + rax*2], bx
test edx, edx
je 0x140014411
cmp dword [0x14014053c], ebx
mov edi, ebx
mov dword [rsp + 0x60], ebx
jbe 0x14001440d
mov r14, rbx
nop word [rax + rax]
mov rax, qword [0x140140540]
mov r13, qword [r14 + rax]
cmp byte [r13 + 0x37], bl
jne 0x1400143f4
movzx eax, byte [r13 + 0x36]
cmp byte [r13 + 0x3e], bl
je 0x140014305
cmp edx, eax
jle 0x1400143f4
movsxd rax, edx
lea rcx, str._____:____.___n__t
movzx edx, word [r15 + rax*2 - 2]
call qword [sym.imp.MSVCR100.dll_wcschr]
test rax, rax
je 0x1400143ee
movsxd rdx, dword [0x14013e218]
lea r12, [r15 + rdx*2 - 4]
jmp 0x140014315
cmp edx, eax
jl 0x1400143f4
movsxd rax, edx
lea r12, [r15 + rax*2 - 2]
mov rcx, qword [r13 + 0x10]
movzx eax, byte [r13 + 0x36]
lea rsi, [rcx + rax*2 - 2]
cmp byte [r13 + 0x3a], bl
je 0x140014349
cmp rsi, rcx
jb 0x140014384
nop
movzx eax, word [rsi]
cmp word [r12], ax
jne 0x140014384
sub rsi, 2
sub r12, 2
cmp rsi, rcx
jae 0x140014330
jmp 0x140014384
cmp rsi, rcx
jb 0x140014384
nop
movzx ecx, word [rsi]
call qword [sym.imp.USER32.dll_CharLowerW]
movzx ecx, word [r12]
mov rdi, rax
call qword [sym.imp.USER32.dll_CharLowerW]
cmp ax, di
jne 0x14001437a
sub rsi, 2
sub r12, 2
cmp rsi, qword [r13 + 0x10]
jae 0x140014350
mov edx, dword [0x14013e218]
mov edi, dword [rsp + 0x60]
cmp rsi, qword [r13 + 0x10]
jae 0x1400143f4
cmp byte [r13 + 0x3f], bl
jne 0x1400143d8
cmp r12, r15
jb 0x1400143d8
movzx ecx, word [r12]
mov word [rsp + 0x58], cx
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x1400143ee
mov r9d, 1
lea rax, [rsp + 0x64]
lea r8, [rsp + 0x58]
lea edx, [r9 + 3]
mov ecx, 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
test eax, eax
je 0x1400143d8
test byte [rsp + 0x64], 1
jne 0x1400143ee
mov rdx, qword [r13 + 8]
mov rcx, qword [r13 + 0x20]
call fcn.140016f80
test rax, rax
jne 0x1400144f8
mov edx, dword [0x14013e218]
inc edi
add r14, 8
cmp edi, dword [0x14014053c]
mov dword [rsp + 0x60], edi
jb 0x1400142b0
xor sil, sil
mov edi, dword [rsp + 0x4c]
cmp byte [rsp + 0x50], 0
movzx r15d, byte [rbp + 0x108]
je 0x14001449c
test r15b, r15b
je 0x14001449c
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x100
call sub.MSVCR100.dll_memset
movzx edx, byte [0x140143fd6]
movzx eax, byte [0x140143fd7]
neg dl
sbb dl, dl
and dl, 0x20
neg al
sbb cl, cl
and cl, 9
or dl, cl
lea rcx, [rsp + 0x70]
call fcn.1400232d0
mov rax, qword [rsp + 0x68]
movzx edx, word [0x140143fd4]
movzx ecx, byte [0x140143fd0]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 0x108]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov byte [0x140143fd0], 0
cmp byte [rsp + 0x40], 0
je 0x14001495e
cmp dword [0x1401430f0], 1
jne 0x14001495e
test sil, sil
jne 0x14001495e
mov r13d, ebx
mov r12, rbx
movsxd r14, edi
test edi, edi
jle 0x1400147c4
nop
cmp byte [0x140143135], 0
je 0x14001472c
movzx edx, word [rsp + r12*2 + 0x44]
mov rcx, qword [0x140143108]
call qword [sym.imp.MSVCR100.dll_wcschr]
mov rdi, rax
jmp 0x14001476d
mov rdi, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0x118]
movabs rax, 0xffffffff003c2c17
mov rdi, qword [rdi + 0x10]
add rdx, 4
add rax, rdi
cmp rax, 0x66
ja 0x14001454e
movzx ecx, byte [r13 + 0x35]
mov eax, 0xffc3d44d
sub eax, edi
cmp eax, ecx
jg 0x14001454e
mov edi, dword [rsp + 0x4c]
xor sil, sil
test rdx, rdx
je 0x140014411
mov eax, 0x69
mov word [rdx], ax
jmp 0x140014411
cmp byte [r13 + 0x3b], bl
jne 0x14001455f
mov edx, dword [0x14013e218]
jmp 0x14001466e
movsxd rdx, dword [0x14013e218]
lea rsi, [r15 + rdx*2]
cmp byte [r13 + 0x3e], bl
je 0x140014574
sub rsi, 2
movzx eax, byte [r13 + 0x36]
mov rdi, rsi
xor r15b, r15b
add rax, rax
xor r14b, r14b
mov r12d, ebx
sub rdi, rax
cmp rdi, rsi
jae 0x140014667
mov ebx, 1
nop dword [rax]
movzx ecx, word [rdi]
call qword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x1400145ba
movzx ecx, word [rdi]
call qword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
je 0x1400145d9
test r15b, r15b
jne 0x1400145d6
movzx ecx, word [rdi]
movzx r15d, bl
call qword [sym.imp.USER32.dll_IsCharUpperW]
movzx r14d, r14b
test eax, eax
cmovne r14d, ebx
inc r12d
add rdi, 2
cmp rdi, rsi
jb 0x1400145a0
mov ebx, 0
test r12d, r12d
je 0x140014661
cmp r12d, 1
jne 0x14001460b
mov edx, dword [0x14013e218]
neg r14b
lea r15, [0x14013e220]
sbb r12d, r12d
and r12d, 2
jmp 0x140014671
test r14b, r14b
je 0x140014661
movzx eax, byte [r13 + 0x36]
mov rdi, rsi
mov r12d, 2
add rax, rax
sub rdi, rax
cmp rdi, rsi
jae 0x140014648
nop dword [rax]
movzx ecx, word [rdi]
call qword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x140014645
add rdi, r12
cmp rdi, rsi
jb 0x140014630
cmp rdi, rsi
mov edx, dword [0x14013e218]
mov r10d, 1
lea r15, [0x14013e220]
cmove r12d, r10d
jmp 0x140014677
mov edx, dword [0x14013e218]
lea r15, [0x14013e220]
mov r12d, ebx
mov r10d, 1
movzx r9d, byte [r13 + 0x3c]
test r9b, r9b
jne 0x140014687
cmp byte [r13 + 0x3d], r9b
je 0x140014696
xor r14b, r14b
mov sil, 1
mov byte [rbp + 0x108], r14b
jmp 0x140014699
xor sil, sil
mov rax, qword [rbp + 0x120]
movzx edi, byte [r13 + 0x3e]
mov ecx, dword [rsp + 0x60]
mov qword [rax], rcx
test dil, dil
je 0x1400146bc
movsxd rax, edx
movzx r8d, word [r15 + rax*2 - 2]
jmp 0x1400146bf
mov r8d, ebx
movzx ecx, r12w
movzx eax, r8w
shl ecx, 0x10
or ecx, eax
cmp qword [r13 + 0x18], 0
mov rax, qword [rbp + 0x128]
movsxd rcx, ecx
mov qword [rax], rcx
je 0x1400146fe
test dil, dil
je 0x1400146fa
movsxd rax, edx
mov edx, r10d
movzx eax, word [r15 + rax*2 - 2]
mov word [0x14013e220], ax
jmp 0x140014711
mov edx, ebx
jmp 0x140014711
test r9b, r9b
je 0x140014711
movzx eax, byte [r13 + 0x36]
sub edx, eax
test dil, dil
je 0x140014711
dec edx
cmp byte [r13 + 0x40], 0
cmovne edx, ebx
movsxd rax, edx
mov dword [0x14013e218], edx
mov word [r15 + rax*2], bx
jmp 0x14001440d
movzx ecx, word [rsp + r12*2 + 0x44]
mov rdi, qword [0x140143108]
call qword [sym.imp.USER32.dll_CharLowerW]
movzx ecx, word [rdi]
movzx esi, ax
call qword [sym.imp.USER32.dll_CharLowerW]
movzx ecx, ax
cmp ecx, esi
je 0x14001476d
cmp word [rdi], 0
je 0x140014776
movzx ecx, word [rdi + 2]
add rdi, 2
call qword [sym.imp.USER32.dll_CharLowerW]
movzx ecx, ax
cmp ecx, esi
jne 0x140014752
test rdi, rdi
jne 0x140014820
movsxd rax, dword [0x140143148]
cmp eax, dword [0x14014314c]
je 0x1400147c4
movzx ecx, word [rsp + r12*2 + 0x44]
mov rdx, rax
mov rax, qword [0x140143140]
mov word [rax + rdx*2], cx
mov eax, dword [0x140143148]
inc r12
inc eax
inc r13d
mov dword [0x140143148], eax
movsxd rcx, eax
mov rax, qword [0x140143140]
mov word [rax + rcx*2], bx
cmp r12, r14
jl 0x1400144d0
cmp byte [0x140143139], 0
je 0x14001488f
cmp byte [0x140143135], 0
je 0x14001484d
cmp dword [0x140143120], 0
jbe 0x14001493e
mov rdi, rbx
nop word [rax + rax]
mov rax, qword [0x140143118]
mov rcx, qword [0x140143140]
mov rdx, qword [rdi + rax]
call qword [sym.imp.MSVCR100.dll_wcsstr]
test rax, rax
jne 0x14001483e
inc ebx
add rdi, 8
cmp ebx, dword [0x140143120]
jb 0x1400147f0
jmp 0x14001493e
movsxd rax, r13d
mov dword [0x1401430f0], 4
movzx ecx, word [rsp + rax*2 + 0x44]
mov word [0x140143114], cx
jmp 0x14001495e
mov dword [0x1401430f0], 3
jmp 0x14001495e
cmp dword [0x140143120], 0
jbe 0x14001493e
mov rdi, rbx
nop dword [rax]
mov rdx, qword [0x140143118]
mov rcx, qword [0x140143140]
mov rdx, qword [rdi + rdx]
call fcn.1400e0d30
test rax, rax
jne 0x14001483e
inc ebx
add rdi, 8
cmp ebx, dword [0x140143120]
jb 0x140014860
jmp 0x14001493e
cmp byte [0x140143135], 0
je 0x1400148f8
mov r9d, dword [0x140143120]
test r9d, r9d
je 0x14001493e
mov r8, qword [0x140143118]
mov r10, qword [0x140143140]
nop word [rax + rax]
mov rdi, qword [r8]
mov rax, r10
sub rdi, r10
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x1400148e3
add rax, 2
test ecx, ecx
jne 0x1400148d0
test edx, edx
je 0x14001483e
inc ebx
add r8, 8
cmp ebx, r9d
jb 0x1400148c0
jmp 0x14001493e
cmp dword [0x140143120], 0
jbe 0x14001493e
mov rdi, rbx
nop word [rax + rax]
mov rdx, qword [0x140143118]
mov rcx, qword [0x140143140]
mov rdx, qword [rdi + rdx]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001483e
inc ebx
add rdi, 8
cmp ebx, dword [0x140143120]
jb 0x140014910
mov ecx, dword [0x1401430f0]
mov eax, dword [0x14014314c]
mov edx, 5
cmp dword [0x140143148], eax
cmovge ecx, edx
mov dword [0x1401430f0], ecx
movzx eax, r15b
mov r13, qword [rsp + 0x1b8]
mov r12, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1f8]
mov r14, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x1c8]
add rsp, 0x1d0
pop r15
pop rsi
pop rbp
ret