Function at 0x1400b55a0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x30
mov r14, rdx
mov rbx, rcx
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400b55c0
cmp ax, 9
jne 0x1400b55c6
add rbx, 2
jmp 0x1400b55b1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
test ax, ax
je 0x1400b5816
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
jne 0x1400b55f7
mov word [rdx + 2], ax
mov al, 1
mov byte [rdx], 0
jmp 0x1400b5818
mov byte [rdx], 1
xor sil, sil
mov edx, 0x2b
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
je 0x1400b56d9
lea rdi, [rbp - 2]
cmp rdi, rbx
jbe 0x1400b5638
nop dword [rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400b562f
cmp ax, 9
jne 0x1400b5638
sub rdi, 2
cmp rdi, rbx
ja 0x1400b5620
sub rdi, rbx
lea rdx, str.Ctrl
sar rdi, 1
mov rcx, rbx
inc rdi
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400b565c
mov al, 1
jmp 0x1400b5694
mov r8, rdi
lea rdx, [0x1401054e0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400b5677
mov al, 4
jmp 0x1400b5694
mov r8, rdi
lea rdx, str.Shift
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400b5816
mov al, reloc.WSOCK32.dll_recv
or sil, al
lea rbx, [rbp + 2]
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400b56af
cmp ax, 9
jne 0x1400b56b5
add rbx, 2
jmp 0x1400b56a0
test ax, ax
je 0x1400b5816
mov edx, 0x2b
lea rcx, [rbx + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
jne 0x1400b5614
xor ecx, ecx
cmp word [rbx + 2], cx
jne 0x1400b57cf
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbx]
mov rbp, rax
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdi, rax
cmp ax, 0xa
jne 0x1400b570a
mov cl, 0xd
movzx eax, cl
jmp 0x1400b57ea
mov rdx, rbp
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rcx, ax
mov r8, rcx
shr r8, 8
cmp r8b, 0xff
jne 0x1400b577d
cmp cl, 0xff
jne 0x1400b577d
movzx ebp, di
test ebp, 0xffffff80
jne 0x1400b5783
mov edx, 0x103
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x1400b5783
mov edx, 2
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov edx, 1
movzx edi, dil
mov ecx, ebp
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx ecx, cl
cmove ecx, edi
test r8b, 0x38
je 0x1400b578a
xor cl, cl
movzx eax, cl
jmp 0x1400b57ea
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x1400b579a
or sil, 8
jmp 0x1400b57ba
test r8b, 2
je 0x1400b57aa
test sil, 3
jne 0x1400b57aa
or sil, 1
test r8b, 4
je 0x1400b57ba
test sil, 0xc
jne 0x1400b57ba
or sil, 4
test r8b, 1
je 0x1400b57ca
test sil, 0x30
jne 0x1400b57ca
or sil, 0x10
movzx eax, cl
jmp 0x1400b57ea
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140023fb0
movzx eax, al
mov word [r14 + 2], ax
test sil, 1
je 0x1400b57f9
or byte [r14], 8
test sil, 4
je 0x1400b5803
or byte [r14], 0x10
test sil, 0x10
je 0x1400b580d
or byte [r14], 4
cmp ax, 0
setne al
jmp 0x1400b5818
xor al, al
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret