Function at 0x1400b57b0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x30
mov r14, rdx
mov rbx, rcx
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400b57d0
cmp ax, 9
jne 0x1400b57d6
add rbx, 2
jmp 0x1400b57c1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
test ax, ax
je 0x1400b5a26
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
jne 0x1400b5807
mov word [rdx + 2], ax
mov al, 1
mov byte [rdx], 0
jmp 0x1400b5a28
mov byte [rdx], 1
xor sil, sil
mov edx, 0x2b
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
je 0x1400b58e9
lea rdi, [rbp - 2]
cmp rdi, rbx
jbe 0x1400b5848
nop dword [rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400b583f
cmp ax, 9
jne 0x1400b5848
sub rdi, 2
cmp rdi, rbx
ja 0x1400b5830
sub rdi, rbx
lea rdx, str.Ctrl
sar rdi, 1
mov rcx, rbx
inc rdi
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400b586c
mov al, 1
jmp 0x1400b58a4
mov r8, rdi
lea rdx, [0x1401054f0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400b5887
mov al, 4
jmp 0x1400b58a4
mov r8, rdi
lea rdx, str.Shift
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400b5a26
mov al, reloc.WSOCK32.dll_recv
or sil, al
lea rbx, [rbp + 2]
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400b58bf
cmp ax, 9
jne 0x1400b58c5
add rbx, 2
jmp 0x1400b58b0
test ax, ax
je 0x1400b5a26
mov edx, 0x2b
lea rcx, [rbx + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
jne 0x1400b5824
xor ecx, ecx
cmp word [rbx + 2], cx
jne 0x1400b59df
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbx]
mov rbp, rax
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdi, rax
cmp ax, 0xa
jne 0x1400b591a
mov cl, 0xd
movzx eax, cl
jmp 0x1400b59fa
mov rdx, rbp
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rcx, ax
mov r8, rcx
shr r8, 8
cmp r8b, 0xff
jne 0x1400b598d
cmp cl, 0xff
jne 0x1400b598d
movzx ebp, di
test ebp, 0xffffff80
jne 0x1400b5993
mov edx, 0x103
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x1400b5993
mov edx, 2
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov edx, 1
movzx edi, dil
mov ecx, ebp
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx ecx, cl
cmove ecx, edi
test r8b, 0x38
je 0x1400b599a
xor cl, cl
movzx eax, cl
jmp 0x1400b59fa
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x1400b59aa
or sil, 8
jmp 0x1400b59ca
test r8b, 2
je 0x1400b59ba
test sil, 3
jne 0x1400b59ba
or sil, 1
test r8b, 4
je 0x1400b59ca
test sil, 0xc
jne 0x1400b59ca
or sil, 4
test r8b, 1
je 0x1400b59da
test sil, 0x30
jne 0x1400b59da
or sil, 0x10
movzx eax, cl
jmp 0x1400b59fa
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140024050
movzx eax, al
mov word [r14 + 2], ax
test sil, 1
je 0x1400b5a09
or byte [r14], 8
test sil, 4
je 0x1400b5a13
or byte [r14], 0x10
test sil, 0x10
je 0x1400b5a1d
or byte [r14], 4
cmp ax, 0
setne al
jmp 0x1400b5a28
xor al, al
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret