Function at 0x140001000
Capabilities:
Check if file exists
Check mutex on windows
Get file attributes
Log keystrokes via application hook
Read .ini file

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, qword [rdx + 8]
test rbx, rbx
jne 0x14000109c
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
cmp byte [rax + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001043
lea rax, [rsp + 0x50]
mov byte [rcx + rax - 3], 0x69
lea rax, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
cmp byte [rax + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001064
lea rax, [rsp + 0x50]
mov byte [rcx + rax - 2], 0x6e
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140001085
mov byte [rsp + rax + 0x4f], 0x69
lea rbx, [rsp + 0x50]
jmp 0x1400010cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400010cf
mov r9d, 0x34
lea r8, str.CapsWitch
lea rdx, str.Unable_to_open_specified_settings_file__n_nStart_anyway_with_default_settings_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x1400011e4
mov r9, rbx
lea rdx, str.EmulatedKeystroke
mov r8d, 1
lea rcx, str.general
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, rbx
lea rdx, str.HideMultiInstanceError
lea rcx, str.general
mov byte [0x1400050ac], al
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, rbx
lea rdx, str.AltCapsToDisable
lea rcx, str.general
mov byte [0x1400050ad], al
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, rbx
lea rdx, str.UseSoundIndication
lea rcx, str.general
mov byte [0x1400050ae], al
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
movsx ecx, byte [0x1400050ac]
mov byte [0x1400050af], al
sub ecx, 2
je 0x14000118b
cmp ecx, 1
je 0x140001173
mov qword [0x1400050b0], 0xa4
jmp 0x140001196
mov qword [0x1400050b0], 0x5b
mov qword [0x1400050b8], 0x20
jmp 0x1400011a1
mov qword [0x1400050b0], 0x11
mov qword [0x1400050b8], 0x10
lea r8, str.CapsWitch
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400011ee
cmp byte [0x1400050ad], 0
jne 0x1400011e4
mov r9d, 0x30
lea r8, str.CapsWitch
lea rdx, str.Another_instance_of_the_program_is_already_running__n_nThis_instance_will_be_terminated.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x14000128d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor r9d, r9d
lea rdx, [0x1400012b0]
mov r8, rax
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1400056c8], rax
test rax, rax
jne 0x14000123a
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.CapsWitch
lea rdx, str.Error_calling__SetWindowsHookEx_...__
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0xffffffff
jmp 0x14000128d
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x14000127e
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140001251
mov rcx, qword [0x1400056c8]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140001870
add rsp, 0x170
pop rbx
ret