Function at 0x1400a6130
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x30
mov r14, rdx
mov rbx, rcx
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400a6150
cmp ax, 9
jne 0x1400a6156
add rbx, 2
jmp 0x1400a6141
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
test ax, ax
je 0x1400a63a6
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
jne 0x1400a6187
mov word [rdx + 2], ax
mov al, 1
mov byte [rdx], 0
jmp 0x1400a63a8
mov byte [rdx], 1
xor sil, sil
mov edx, 0x2b
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
je 0x1400a6269
lea rdi, [rbp - 2]
cmp rdi, rbx
jbe 0x1400a61c8
nop dword [rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400a61bf
cmp ax, 9
jne 0x1400a61c8
sub rdi, 2
cmp rdi, rbx
ja 0x1400a61b0
sub rdi, rbx
lea rdx, str.Ctrl
sar rdi, 1
mov rcx, rbx
inc rdi
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400a61ec
mov al, 1
jmp 0x1400a6224
mov r8, rdi
lea rdx, [0x1400e28a0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400a6207
mov al, 4
jmp 0x1400a6224
mov r8, rdi
lea rdx, str.Shift
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400a63a6
mov al, reloc.OLEAUT32.dll_SafeArrayGetDim
or sil, al
lea rbx, [rbp + 2]
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400a623f
cmp ax, 9
jne 0x1400a6245
add rbx, 2
jmp 0x1400a6230
test ax, ax
je 0x1400a63a6
mov edx, 0x2b
lea rcx, [rbx + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
jne 0x1400a61a4
xor ecx, ecx
cmp word [rbx + 2], cx
jne 0x1400a635f
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbx]
mov rbp, rax
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdi, rax
cmp ax, 0xa
jne 0x1400a629a
mov cl, 0xd
movzx eax, cl
jmp 0x1400a637a
mov rdx, rbp
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rcx, ax
mov r8, rcx
shr r8, 8
cmp r8b, 0xff
jne 0x1400a630d
cmp cl, 0xff
jne 0x1400a630d
movzx ebp, di
test ebp, 0xffffff80
jne 0x1400a6313
mov edx, 0x103
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x1400a6313
mov edx, 2
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov edx, 1
movzx edi, dil
mov ecx, ebp
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx ecx, cl
cmove ecx, edi
test r8b, 0x38
je 0x1400a631a
xor cl, cl
movzx eax, cl
jmp 0x1400a637a
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x1400a632a
or sil, 8
jmp 0x1400a634a
test r8b, 2
je 0x1400a633a
test sil, 3
jne 0x1400a633a
or sil, 1
test r8b, 4
je 0x1400a634a
test sil, 0xc
jne 0x1400a634a
or sil, 4
test r8b, 1
je 0x1400a635a
test sil, 0x30
jne 0x1400a635a
or sil, 0x10
movzx eax, cl
jmp 0x1400a637a
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14001b010
movzx eax, al
mov word [r14 + 2], ax
test sil, 1
je 0x1400a6389
or byte [r14], 8
test sil, 4
je 0x1400a6393
or byte [r14], 0x10
test sil, 0x10
je 0x1400a639d
or byte [r14], 4
cmp ax, 0
setne al
jmp 0x1400a63a8
xor al, al
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret