Function at 0x14001b1d0
Capabilities:
Get keyboard layout

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x440
xor ebp, ebp
lea r14, [r9 + 0x12]
mov byte [rax + 0x18], bpl
mov rdi, r9
movzx r15d, r8b
mov r12, rdx
mov rsi, rcx
test r9, r9
jne 0x14001b20a
lea r14, [rax + 0x20]
test r15b, r15b
jne 0x14001b2b6
mov r8, rsi
test rsi, rsi
je 0x14001b2b6
movzx edx, word [rcx]
test dx, dx
je 0x14001b2b6
mov r9d, SafeArrayAllocDescriptor
nop dword [rax]
nop word [rax + rax]
lea rcx, [0x140110770]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x14001b272
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001b250
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14001b240
jmp 0x14001b2b6
test r8, r8
je 0x14001b2b6
mov rbx, r8
nop word [rax + rax]
movzx eax, word [r8]
cmp ax, r9w
je 0x14001b290
cmp ax, 9
jne 0x14001b296
add r8, 2
jmp 0x14001b280
lea rdx, [0x14010f8a8]
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14001b2b6
test rdi, rdi
je 0x14001b2b3
mov byte [rdi + 0x16], 1
mov word [rbx], bp
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r8b, 1
lea rdx, [rsp + 0x480]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140025360
movzx ebx, al
test al, al
je 0x14001b3cc
test r15b, r15b
je 0x14001b365
lea ecx, [rbx + 0x64]
cmp cl, 3
ja 0x14001b388
cmp byte [rsp + 0x490], bpl
je 0x14001b325
mov rcx, qword [0x140132a80]
lea rdx, reloc.WSOCK32.dll_gethostbyaddr
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
call fcn.1400dc860
xor eax, eax
jmp 0x14001b511
mov r9, rsi
lea r8, str.__s__is_not_allowed_as_a_prefix_key.
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.1400d6690
mov r8, r12
lea rdx, [rsp + 0x40]
lea rcx, [0x140136060]
call fcn.140064aa0
test rdi, rdi
jne 0x14001b485
mov eax, 4
jmp 0x14001b511
test rdi, rdi
je 0x14001b388
mov r8d, 2
lea rdx, [0x1401107cc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
sete al
mov byte [rdi + 0x17], al
lea eax, [rbx - 1]
cmp al, 5
ja 0x14001b394
cmp bl, 3
jne 0x14001b39b
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x14001b39f
mov cl, 1
jmp 0x14001b3a1
xor cl, cl
movzx r9d, byte [rsp + 0x480]
test r9b, 0x30
je 0x14001b3bb
lea eax, [rbx - 0x41]
cmp al, 0x19
ja 0x14001b3bb
and r9b, 0xcf
test cl, cl
je 0x14001b4af
mov byte [r14], 2
jmp 0x14001b4af
xor edx, edx
mov rcx, rsi
call fcn.140025240
movzx ebp, ax
test ax, ax
jne 0x14001b4a6
mov r8b, 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140099790
movzx ebp, ax
test ax, ax
jne 0x14001b48c
cmp byte [rsp + 0x490], al
je 0x14001b430
mov rcx, qword [0x140132a80]
lea rdx, [0x1401107d4]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
call fcn.1400dc860
xor eax, eax
jmp 0x14001b511
cmp word [rsi + 2], 0
jne 0x14001b44f
cmp byte [0x140136c40], 0
jne 0x14001b44f
test rdi, rdi
jne 0x14001b485
mov eax, 3
jmp 0x14001b511
test rdi, rdi
je 0x14001b485
mov r9, rsi
lea r8, [0x1401107d8]
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.1400d6690
lea r8, [0x1400f97e4]
lea rdx, [rsp + 0x40]
lea rcx, [0x140136060]
call fcn.140064aa0
xor eax, eax
jmp 0x14001b511
movsxd rbx, dword [rsp + 0x30]
lea rcx, [0x140133ae8]
inc dword [0x140133b04]
mov byte [r14], 4
mov byte [rbx + rcx], 1
movzx r9d, byte [rsp + 0x480]
test rdi, rdi
je 0x14001b50c
test r15b, r15b
je 0x14001b4c2
mov byte [rdi + 0x11], bl
mov word [rdi + 0xa], bp
jmp 0x14001b50c
movzx r8d, r9b
mov byte [rdi + 0x10], bl
and r8b, 0xd5
mov word [rdi + 8], bp
movzx eax, r8b
and al, 0xc0
neg al
sbb ecx, ecx
and ecx, 8
mov edx, ecx
or edx, 1
test r8b, 0xc
cmove edx, ecx
mov ecx, edx
or ecx, 4
test r8b, 0x30
cmove ecx, edx
mov eax, ecx
or eax, 2
test r8b, 3
cmove eax, ecx
and r9b, 0x2a
or dword [rdi], eax
or byte [rdi + 0xe], r9b
mov eax, 1
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret