Function at 0x140149e50
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov word [rsp + 8], cx
sub rsp, 0x128
mov eax, 0x4831
mov word [rsp + 0x30], ax
mov dword [rsp + 0x38], 0xfd7275e2
cmp dword [rsp + 0x38], 0x60a8abf3
jb 0x14014a363
mov eax, dword [rsp + 0x38]
or eax, 0xca3313a8
cmp eax, 0x3eaa6d04
jne 0x140149f1b
movzx ecx, word [rsp + 0x130]
call fcn.140149e50
mov r8d, 1
mov edx, 0x8d
mov ecx, 0xd0
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x589bbf72
je 0x140149ecb
jmp 0x140149efe
mov eax, 0x3a75
mov word [rsp + 0x130], ax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x38]
xor eax, 0x6663cd55
mov dword [rsp + 0x38], eax
jmp 0x140149f1b
mov r8d, 0x5c
lea rdx, [rsp + 0x98]
mov ecx, 0x1e
call qword [sym.imp.USER32.dll_SendInput]
mov dword [rsp + 0x44], eax
movsx eax, word [rsp + 0x130]
add eax, 0x3728
mov word [rsp + 0x30], ax
movsx eax, word [rsp + 0x30]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x3728
je 0x140149f53
cmp dword [rsp + 0x54], 0x53aa
je 0x14014a269
jmp 0x14014a27f
movsx eax, word [rsp + 0x30]
sub eax, 0x7ba1
movsx ecx, word [rsp + 0x130]
cmp eax, ecx
jne 0x140149fb0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x48], eax
lea rax, str.discolour_Clove_Pedology
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, 0x7c
mov edx, 0xc9
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x44]
movzx ecx, al
mov eax, dword [rsp + 0x48]
shr eax, cl
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x34], 0xa1
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x3ed1ce37
je 0x140149fdd
cmp dword [rsp + 0x58], 0xe24a9d4d
je 0x14014a030
jmp 0x14014a04e
mov edx, 0xd0
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.USER32.dll_SetMenuContextHelpId]
mov dword [rsp + 0x4c], eax
call fcn.140149a00
movzx eax, byte [rsp + 0x34]
or eax, 0x7e
mov byte [rsp + 0x34], al
lea rdx, str.solvable_figureheads
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
jmp 0x14014a04e
call qword [sym.imp.USER32.dll_GetKBCodePage]
mov dword [rsp + 0x44], eax
movsx eax, word [rsp + 0x40]
movsx ecx, word [rsp + 0x130]
shl eax, cl
mov word [rsp + 0x30], ax
movabs rax, 0x5b7370c2bdd9fbd6
mov qword [rsp + 0x88], rax
movzx eax, word [rsp + 0x130]
mov word [rsp + 0x3c], ax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
movabs rax, 0x67f3d54d54932bca
cmp qword [rsp + 0x80], rax
je 0x14014a0df
movabs rax, 0xf989ef0b1179aa5c
cmp qword [rsp + 0x80], rax
je 0x14014a0aa
jmp 0x14014a14d
lea rcx, str.Babies_Blabs
call qword [sym.imp.USER32.dll_CharLowerW]
mov qword [rsp + 0xc0], rax
movzx eax, word [rsp + 0x3c]
mov word [rsp + 0x130], ax
movsx eax, word [rsp + 0x3c]
movsx ecx, word [rsp + 0x30]
and eax, ecx
mov word [rsp + 0x40], ax
jmp 0x14014a14d
mov r8, qword [rsp + 0xa8]
lea rdx, str.disclaimers_Metamorphism_Forested_cigaret_thanks
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_SetPropW]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x48]
ja 0x14014a14d
movsx eax, word [rsp + 0x30]
movsx ecx, word [rsp + 0x40]
sub eax, ecx
mov word [rsp + 0x3c], ax
movzx ecx, word [rsp + 0x3c]
call fcn.140149e50
movzx eax, word [rsp + 0x3c]
mov word [rsp + 0x130], ax
mov ecx, 0x87
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x50], 0x21ca50dc
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0x21ca50dc
je 0x14014a1e7
cmp dword [rsp + 0x5c], 0x6e914aa2
je 0x14014a180
jmp 0x14014a227
movzx eax, byte [rsp + 0x34]
add eax, 0xfd
mov byte [rsp + 0x34], al
movsx eax, word [rsp + 0x3c]
movsx ecx, word [rsp + 0x130]
and eax, ecx
movsx ecx, word [rsp + 0x30]
movsx edx, word [rsp + 0x40]
add ecx, edx
cmp eax, ecx
jl 0x14014a1c4
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x34]
sub eax, 0x83
mov byte [rsp + 0x34], al
jmp 0x14014a227
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xd8], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
movabs rax, 0x76217d2e32b43b13
mov qword [rsp + 0xe0], rax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x130], ax
mov r8d, reloc.SHELL32.dll_ILCloneFirst
lea rdx, [rsp + 0xa8]
mov cx, 0xf4
call qword [sym.imp.USER32.dll_CharNextExA]
mov qword [rsp + 0xe8], rax
jmp 0x14014a27f
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x38]
mov dx, 0x6e
mov cl, reloc.SHELL32.dll_PathMakeUniqueName
call fcn.14014b010
nop
movsx eax, word [rsp + 0x30]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x11e1
je 0x14014a294
jmp 0x14014a296
jmp 0x14014a29e
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x44], eax
movsx eax, word [rsp + 0x130]
sub eax, 0x560
mov word [rsp + 0x30], ax
movsx eax, word [rsp + 0x130]
and eax, 0x5ab1
movsx ecx, word [rsp + 0x30]
cmp eax, ecx
jl 0x14014a2c8
jmp 0x14014a2ee
mov eax, dword [rsp + 0x44]
sub eax, 0xa9cd43ac
cmp eax, dword [rsp + 0x38]
jae 0x14014a2ee
mov edx, 0xc8
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_GetMenuItemID]
mov dword [rsp + 0x48], eax
movzx ecx, word [rsp + 0x130]
call fcn.140149e50
mov r9d, ILFindChild
xor r8d, r8d
mov edx, 0xe4
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov dword [rsp + 0x4c], eax
movsx eax, word [rsp + 0x130]
add eax, 0x30d5
mov word [rsp + 0x30], ax
movzx ecx, word [rsp + 0x30]
call fcn.140149e50
mov ecx, 0x6d
call qword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov qword [rsp + 0xf8], rax
mov eax, dword [rsp + 0x44]
add eax, 0x673402ac
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x130], ax
jmp 0x14014a389
mov eax, dword [rsp + 0x38]
sub eax, 0x1cfe182e
cmp eax, 0x7dfcefa4
ja 0x14014a389
mov eax, dword [rsp + 0x38]
shr eax, 0x19
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
shl eax, 4
mov dword [rsp + 0x38], eax
call fcn.140149a00
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x108]
mov r8d, 0x94
mov edx, 0xe0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x38]
add eax, 0x478eec1e
mov dword [rsp + 0x38], eax
call fcn.140149a00
mov eax, dword [rsp + 0x38]
and eax, 0xed039688
mov dword [rsp + 0x38], eax
mov edx, 0x63
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rsp + 0x110], rax
mov eax, 0xe0
add rsp, 0x128
ret