Function at 0x14001f8c0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [r11 - 0xc8]
sub rsp, 0x1a0
movzx ebx, dl
mov r14, r9
mov edx, dword [rbp + 0xf8]
movzx eax, bx
or ax, r8w
movzx edi, r8w
mov esi, ecx
je 0x14001fd69
mov qword [r11 - 0x30], r13
test edx, edx
mov eax, 0xffc3d44d
mov qword [r11 - 0x38], r15
cmovne eax, edx
mov qword [r11 + 8], r12
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x14012afb0]
sete r15b
cmp dword [0x14012d170], 0
je 0x14001f933
test r15b, r15b
jne 0x14001f933
mov r12b, 1
jmp 0x14001f936
xor r12b, r12b
cmp dword [0x14012d170], 1
mov byte [rbp + 0xd8], r12b
je 0x14001f94b
test r15b, r15b
je 0x14001f952
mov byte [rbp + 0xf0], 0
test bl, bl
jne 0x14001f99d
mov edx, edi
movzx ecx, di
sub edx, 0x45
je 0x14001f999
mov eax, 0xff
sub edx, 0xf1
je 0x14001f972
cmp edx, 0xf
jne 0x14001f975
and cx, ax
bt cx, 8
jae 0x14001f987
and cx, ax
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
jmp 0x14001f9af
mov bl, reloc.WSOCK32.dll_send
jmp 0x14001f9af
test di, di
jne 0x14001f9af
xor edx, edx
movzx ecx, bl
call fcn.140023bd0
movzx edi, ax
xor r13d, r13d
lea rdx, [0x140000000]
movzx eax, di
shr ax, 8
test al, al
setne r13b
cmp dword [0x14012d170], 2
jne case.default.0x14001f9e8
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001f9e8
cdqe
mov ecx, dword [rdx + rax*4 + 0x1fd78]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x14001f9e8
mov bl, reloc.WSOCK32.dll_recv
jmp case.default.0x14001f9e8
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r14, r14
je 0x14001fb23
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140022700
test al, al
je 0x14001fab2
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test esi, esi
jne 0x14001fa2c
movzx eax, bl
or byte [rsp + rax + 0x40], 0x80
jmp 0x14001fa39
cmp esi, 1
jne 0x14001fa39
movzx eax, bl
and byte [rsp + rax + 0x40], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001fa59
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1fd90]
add rcx, rdx
jmp rcx
test byte [rbp - 0x1e], 0x80
jne 0x14001fa6e
test byte [rbp - 0x1d], 0x80
jne 0x14001fa6e
and byte [rsp + 0x51], 0x7f
jmp case.default.0x14001fa59
or byte [rsp + 0x51], 0x80
jmp case.default.0x14001fa59
test byte [rbp - 0x20], 0x80
jne 0x14001fa88
test byte [rbp - 0x1f], 0x80
jne 0x14001fa88
and byte [rsp + 0x50], 0x7f
jmp case.default.0x14001fa59
or byte [rsp + 0x50], 0x80
jmp case.default.0x14001fa59
test byte [rbp - 0x1c], 0x80
jne 0x14001faa2
test byte [rbp - 0x1b], 0x80
jne 0x14001faa2
and byte [rsp + 0x52], 0x7f
jmp case.default.0x14001fa59
or byte [rsp + 0x52], 0x80
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
cmp esi, 1
je 0x14001fad9
mov r9, rdi
movzx r8d, bl
or r9, 1
mov edx, 0x100
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xf0], 0
je 0x14001fafb
cmp esi, 2
jne 0x14001fafb
mov rcx, qword [0x1401241d8]
mov ecx, dword [rcx + 0xa0]
call fcn.1400216c0
jmp 0x14001fb03
test esi, esi
je 0x14001fd25
mov r9d, 0xc0000001
movzx r8d, bl
or r9, rdi
mov edx, 0x101
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001fd25
mov dword [0x14012d0a8], esi
mov byte [0x14012c66c], bl
test r15b, r15b
je 0x14001fb8e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r14d, r14d
test rax, rax
je 0x14001fb7b
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x48
mov ecx, eax
mov r14d, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14001fb7b
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14001fb7b
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
call fcn.140022c20
jmp 0x14001fb94
mov eax, dword [0x14012d158]
mov r10, qword [0x14012ae58]
mov dword [rsp + 0x34], eax
cmp bl, 0xa5
jne 0x14001fbe5
cmp eax, 3
jne 0x14001fbe5
test r12b, r12b
jne 0x14001fbe5
test r10, r10
je 0x14001fbe5
movzx r11d, byte [rbp + 0xd8]
mov r12b, 1
xor cl, cl
mov byte [rbp + 0xe0], cl
test r15b, r15b
jne 0x14001fc08
mov eax, dword [0x14012d170]
cmp eax, 2
je 0x14001fc08
test r10, r10
je 0x14001fbe0
cmp eax, 1
jne 0x14001fc08
mov r14b, 1
jmp 0x14001fc0b
movzx r11d, byte [rbp + 0xd8]
xor r12b, r12b
test r11b, r11b
je 0x14001fbbe
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140022700
movzx ecx, al
jmp 0x14001fbc0
xor r14b, r14b
mov r15d, dword [rsp + 0x30]
cmp esi, 1
je 0x14001fc6c
test r11b, r11b
je 0x14001fc30
mov r9d, r13d
mov dword [rsp + 0x20], r15d
movzx r8d, di
movzx edx, bl
call fcn.140021100
jmp 0x14001fc59
test r12b, r12b
je 0x14001fc3c
mov dword [0x14012ae60], r15d
mov r9d, r15d
mov r8d, r13d
movzx edx, dil
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x14012ae60], 0
test r14b, r14b
je 0x14001fc6c
movzx r8d, di
movzx edx, bl
xor ecx, ecx
call fcn.1400218d0
cmp byte [rbp + 0xf0], 0
je 0x14001fca3
cmp esi, 2
jne 0x14001fca3
cmp dword [0x14012d170], esi
mov rax, qword [0x1401241d8]
jne 0x14001fc96
mov ecx, dword [rax + 0xa4]
call fcn.1400216c0
jmp 0x14001fca7
mov ecx, dword [rax + 0xa0]
call fcn.1400216c0
jmp 0x14001fca7
test esi, esi
je 0x14001fd25
or r13d, 2
cmp byte [rbp + 0xd8], 0
je 0x14001fcd1
movzx ecx, byte [rbp + 0xe0]
mov r9d, r13d
movzx r8d, di
mov dword [rsp + 0x20], r15d
movzx edx, bl
call fcn.140021100
jmp 0x14001fcfa
test r12b, r12b
je 0x14001fcdd
mov dword [0x14012ae60], r15d
mov r9d, r15d
mov r8d, r13d
movzx edx, dil
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x14012ae60], 0
cmp dword [rsp + 0x34], 3
jne 0x14001fd12
mov eax, 0x138
cmp di, ax
jne 0x14001fd12
and byte [0x14012d064], 0xfe
test r14b, r14b
je 0x14001fd25
movzx r8d, di
movzx edx, bl
mov cl, 1
call fcn.1400218d0
cmp byte [rbp + 0xf0], 0
mov r15, qword [rsp + 0x190]
mov r13, qword [rsp + 0x198]
mov r12, qword [rsp + 0x1d0]
je 0x14001fd69
cmp dword [0x14012d170], 2
mov rax, qword [0x1401241d8]
jne 0x14001fd5e
mov ecx, dword [rax + 0x9c]
jmp 0x14001fd64
mov ecx, dword [rax + 0x98]
call fcn.1400216c0
add rsp, 0x1a0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret