Function at 0x140010f70
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movzx ebx, dl
mov r15, r9
movzx eax, bx
movzx edi, r8w
or ax, r8w
mov esi, ecx
je 0x14001158a
mov qword [r11 + 8], r12
mov eax, 0xffc3d44d
mov qword [r11 - 0x30], r13
mov r13d, dword [rbp + 0xb8]
test r13d, r13d
mov qword [r11 - 0x38], r14
cmove r13d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x140101df0]
sete r14b
cmp dword [0x140103d9c], 0
je 0x140010fe2
mov byte [rbp + 0x98], 1
test r14b, r14b
je 0x140010fe9
mov byte [rbp + 0x98], 0
cmp dword [0x140103d9c], 1
je 0x140010ff7
test r14b, r14b
je 0x140010ffe
mov byte [rbp + 0xb0], 0
test bl, bl
jne 0x14001100f
movzx ecx, di
call fcn.140014e10
movzx ebx, al
jmp 0x140011021
test di, di
jne 0x140011021
xor edx, edx
movzx ecx, bl
call fcn.140014b30
movzx edi, ax
xor r12d, r12d
lea rdx, [0x140000000]
mov ecx, r12d
movzx eax, di
shr ax, 8
test al, al
setne cl
cmp dword [0x140103d9c], 2
mov dword [rsp + 0x40], ecx
jne case.default.0x140011060
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x140011060
cdqe
mov ecx, dword [rdx + rax*4 + 0x11598]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x140011060
mov bl, reloc.OLEAUT32.dll_SafeArrayGetDim
jmp case.default.0x140011060
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r15, r15
je 0x14001119b
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140013cb0
test al, al
je 0x14001112a
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test esi, esi
jne 0x1400110a4
movzx eax, bl
or byte [rsp + rax + 0x50], 0x80
jmp 0x1400110b1
cmp esi, 1
jne 0x1400110b1
movzx eax, bl
and byte [rsp + rax + 0x50], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x1400110d1
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x115b0]
add rcx, rdx
jmp rcx
test byte [rbp - 0xe], 0x80
jne 0x1400110e6
test byte [rbp - 0xd], 0x80
jne 0x1400110e6
and byte [rsp + 0x61], 0x7f
jmp case.default.0x1400110d1
or byte [rsp + 0x61], 0x80
jmp case.default.0x1400110d1
test byte [rbp - 0x10], 0x80
jne 0x140011100
test byte [rbp - 0xf], 0x80
jne 0x140011100
and byte [rsp + 0x60], 0x7f
jmp case.default.0x1400110d1
or byte [rsp + 0x60], 0x80
jmp case.default.0x1400110d1
test byte [rbp - 0xc], 0x80
jne 0x14001111a
test byte [rbp - 0xb], 0x80
jne 0x14001111a
and byte [rsp + 0x62], 0x7f
jmp case.default.0x1400110d1
or byte [rsp + 0x62], 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
cmp esi, 1
je 0x140011151
mov r9, rdi
movzx r8d, bl
or r9, 1
mov edx, 0x100
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xb0], r12b
je 0x140011173
cmp esi, 2
jne 0x140011173
mov rax, qword [0x1400fcaa8]
mov ecx, dword [rax + 0x84]
call fcn.140012e10
jmp 0x14001117b
test esi, esi
je 0x140011549
mov r9d, 0xc0000001
movzx r8d, bl
or r9, rdi
mov edx, 0x101
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140011549
cmp byte [0x140100f17], r12b
mov dword [0x140106200], esi
mov byte [0x140103da8], bl
je 0x1400111cf
cmp bl, 0x12
je 0x1400111bc
lea eax, [rbx + 0x5c]
cmp al, 1
ja 0x1400111cf
test r14b, r14b
jne 0x1400111cf
xor ecx, ecx
mov byte [rsp + 0x34], 1
call fcn.140035410
jmp 0x1400111d4
mov byte [rsp + 0x34], r12b
movzx r10d, byte [rbp + 0x98]
lea rax, [0x140106204]
test r14b, r14b
lea r15, [rsp + 0x44]
cmove r15, rax
cmp bl, 0xa5
jne 0x14001129e
test r10b, r10b
jne 0x14001129e
cmp qword [0x140100f28], r12
je 0x14001129e
mov al, 1
mov byte [rsp + 0x33], al
mov byte [rbp + 0xa0], al
test r14b, r14b
jne 0x14001122d
mov rax, qword [0x140106208]
mov qword [rsp + 0x38], rax
jmp 0x140011264
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140011246
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r12d, eax
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
mov qword [rsp + 0x38], rax
xor edx, edx
mov r12, rax
call fcn.140014110
mov dword [r15], eax
cmp dword [r15], 0
je 0x140011276
mov byte [rbp + 0xa0], 0
mov r11b, 1
jmp 0x1400112ec
mov ecx, 0xa2
mov byte [rsp + 0x30], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [0x140101cbc], r13d
mov r11b, 1
movzx r12d, ax
shr r12d, 0xf
and r12b, 1
jmp 0x1400112ff
xor r11b, r11b
mov byte [rsp + 0x33], r11b
mov byte [rbp + 0xa0], r11b
test r10b, r10b
je 0x1400112e2
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140013cb0
movzx r12d, byte [rbp + 0x98]
movzx ecx, al
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0x98]
mov byte [rsp + 0x30], al
jmp 0x140011309
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0x98]
movzx r12d, byte [rbp + 0x98]
mov byte [rsp + 0x30], al
movzx r10d, byte [rbp + 0x98]
xor cl, cl
mov byte [rsp + 0x32], cl
test r14b, r14b
jne 0x140011333
mov eax, dword [0x140103d9c]
cmp eax, 2
je 0x140011333
cmp qword [0x140100f28], 0
je 0x14001132c
cmp eax, 1
jne 0x140011333
mov byte [rsp + 0x31], 1
jmp 0x140011338
mov byte [rsp + 0x31], 0
mov r14d, 0x8000
cmp esi, 1
je 0x140011424
test r10b, r10b
je 0x140011385
mov r9d, dword [rsp + 0x40]
movzx r8d, di
movzx edx, bl
mov dword [rsp + 0x20], r13d
call fcn.140012880
mov r14, qword [rsp + 0x38]
cmp byte [rsp + 0x31], 0
je 0x140011429
movzx r8d, di
movzx edx, bl
xor ecx, ecx
call fcn.140013020
jmp 0x140011429
test r11b, r11b
je 0x14001139e
mov eax, dword [0x140101cb8]
cmp dword [r15], 3
cmove eax, r13d
mov dword [0x140101cb8], eax
mov r8d, dword [rsp + 0x40]
movzx edx, dil
mov r9d, r13d
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
xor eax, eax
mov dword [0x140101cb8], eax
cmp byte [rbp + 0xa0], al
je 0x140011362
cmp dword [0x140101cbc], eax
mov byte [rbp + 0xa0], al
je 0x1400113ef
mov r14, qword [rsp + 0x38]
lea edx, [rax + 4]
mov rcx, r14
mov dword [0x140101cbc], eax
call fcn.140014110
mov dword [r15], eax
jmp 0x140011367
test r12b, r12b
jne 0x140011362
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, r14w
mov r14, qword [rsp + 0x38]
neg ax
mov rcx, r14
sbb edx, edx
add edx, 4
call fcn.140014110
mov dword [r15], eax
jmp 0x140011367
mov r14, qword [rsp + 0x38]
cmp byte [rbp + 0xb0], 0
je 0x140011460
cmp esi, 2
jne 0x140011460
cmp dword [0x140103d9c], esi
mov rax, qword [0x1400fcaa8]
jne 0x140011453
mov ecx, dword [rax + 0x88]
call fcn.140012e10
jmp 0x140011468
mov ecx, dword [rax + 0x84]
call fcn.140012e10
jmp 0x140011468
test esi, esi
je 0x14001153b
mov ecx, dword [rsp + 0x40]
or ecx, 2
cmp byte [rbp + 0x98], 0
je 0x140011493
mov r9d, ecx
mov dword [rsp + 0x20], r13d
movzx ecx, byte [rsp + 0x32]
movzx r8d, di
movzx edx, bl
call fcn.140012880
jmp 0x14001150f
cmp byte [rsp + 0x33], 0
je 0x1400114ae
mov eax, dword [0x140101cb4]
cmp dword [r15], 3
cmove eax, r13d
mov dword [0x140101cb4], eax
mov r8d, ecx
mov r9d, r13d
movzx ecx, bl
movzx edx, dil
call qword [sym.imp.USER32.dll_keybd_event]
xor esi, esi
mov dword [0x140101cb4], esi
cmp byte [rbp + 0xa0], sil
je 0x14001150f
cmp dword [0x140101cbc], esi
je 0x1400114e5
mov dword [0x140101cbc], esi
lea edx, [rsi + 4]
jmp 0x140011504
test r12b, r12b
je 0x14001150f
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
setne sil
lea edx, [rsi + 3]
mov rcx, r14
call fcn.140014110
mov dword [r15], eax
cmp dword [r15], 0
je 0x140011526
mov eax, 0x138
cmp di, ax
jne 0x140011526
and byte [0x1401061e6], 0xfe
cmp byte [rsp + 0x31], 0
je 0x14001153b
movzx r8d, di
movzx edx, bl
mov cl, 1
call fcn.140013020
cmp byte [rsp + 0x34], 0
je 0x140011549
mov cl, 1
call fcn.140035410
cmp byte [rbp + 0xb0], 0
mov r14, qword [rsp + 0x150]
mov r13, qword [rsp + 0x158]
mov r12, qword [rsp + 0x190]
je 0x14001158a
cmp dword [0x140103d9c], 2
mov rax, qword [0x1400fcaa8]
jne 0x140011582
mov ecx, dword [rax + 0x80]
jmp 0x140011585
mov ecx, dword [rax + 0x7c]
call fcn.140012e10
add rsp, 0x160
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret