Function at 0x14001c570
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rcx, [0x140125f28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x8a0
call fcn.14002661c
mov qword [rsp + 0x50], rax
xor ebx, ebx
test rax, rax
je 0x14001c5b2
mov qword [rax + 0x880], rbx
mov qword [rax + 0x888], rbx
jmp 0x14001c5b5
mov rax, rbx
mov qword [0x140126778], rax
xor edx, edx
mov r8d, 0x8a0
mov rcx, rax
call fcn.140054b10
mov rcx, qword [0x140126778]
add rcx, 0x38
call fcn.140014990
mov rcx, qword [0x140126778]
lea rdx, [rcx + 0x440]
add rcx, 0x38
call fcn.140014950
mov rax, qword [0x140126778]
mov dword [rax + 0x43c], 1
mov rcx, qword [0x140126778]
add rcx, 0x880
call fcn.140014f90
mov rcx, qword [0x140126778]
add rcx, 8
call fcn.14001bf80
xor ecx, ecx
call fcn.14001dc40
mov ecx, 0xc
call fcn.14001dcc0
xor edx, edx
lea ecx, [rdx + 8]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140126920], eax
xor edx, edx
lea ecx, [rdx + 0x11]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140126924], eax
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140126928], eax
xor edx, edx
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x14012692c], eax
xor edx, edx
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140126930], eax
xor edx, edx
lea ecx, [rdx + 0x56]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140126938], eax
xor edx, edx
lea ecx, [rdx + 0x2d]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x140126934], eax
mov edx, 0x12
lea rcx, str.00000409
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov qword [0x140126760], rax
mov edx, 0x12
lea rcx, str.0000042a
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
mov edx, 0x3ff
movzx ecx, ax
and cx, dx
cmp cx, 0x2a
cmovne rax, rbx
mov qword [0x140126768], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [0x140126770], rax
mov dword [0x14012693c], ebx
call fcn.1400bd830
mov rax, qword [0x140126778]
mov qword [0x140126948], rax
lea rax, [0x140020ea0]
mov qword [0x140126940], rax
cmp byte [0x140125f14], 0
je 0x14001c823
cmp qword [0x140128ab8], 0
jne 0x14001c7ee
mov edx, 2
lea r8d, [rdx + 0x3e]
lea rcx, str.unikey_log.txt
call fcn.14002a118
test rax, rax
je 0x14001c7ee
mov r8d, 1
mov rdx, rax
lea rcx, [0x140128a38]
call fcn.14001f400
lea rdx, [rsp + 0x28]
lea rcx, [0x140128a38]
call fcn.140022750
nop
mov rcx, rax
call fcn.14001a040
mov rdx, rax
lea rcx, [0x140128a38]
call fcn.14001f6f0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001c7ca
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14001c7ca
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov rax, qword [0x140128a30]
movsxd rcx, dword [rax + 4]
lea rax, [0x140128a30]
add rcx, rax
mov edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, ebx
jmp 0x14001c816
mov rax, qword [0x140128a30]
movsxd rcx, dword [rax + 4]
lea rax, [0x140128a30]
add rcx, rax
mov eax, dword [rcx + 0x10]
or eax, 2
mov edx, eax
or edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, eax
xor r8d, r8d
add rsp, 0x40
pop rbx
jmp fcn.140020ee0
add rsp, 0x40
pop rbx
ret