Function at 0x1400100c0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movzx ebx, dl
mov r14, r9
movzx eax, bx
movzx edi, r8w
or ax, r8w
mov r15d, ecx
je 0x1400106fa
mov qword [r11 + 8], rsi
mov eax, 0xffc3d44d
mov qword [r11 - 0x30], r12
mov qword [r11 - 0x38], r13
mov r13d, dword [rbp + 0xb8]
test r13d, r13d
cmove r13d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1400f0de0]
sete sil
cmp dword [0x1400f2d8c], 0
je 0x140010134
mov byte [rbp + 0x98], 1
test sil, sil
je 0x14001013b
mov byte [rbp + 0x98], 0
cmp dword [0x1400f2d8c], 1
je 0x140010149
test sil, sil
je 0x140010150
mov byte [rbp + 0xb0], 0
test bl, bl
jne 0x140010161
movzx ecx, di
call fcn.140013ac0
movzx ebx, al
jmp 0x140010173
test di, di
jne 0x140010173
xor edx, edx
movzx ecx, bl
call fcn.1400137e0
movzx edi, ax
xor r12d, r12d
lea rdx, [0x140000000]
mov ecx, r12d
movzx eax, di
shr ax, 8
test al, al
setne cl
cmp dword [0x1400f2d8c], 2
mov dword [rsp + 0x40], ecx
jne case.default.0x1400101b2
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x1400101b2
cdqe
mov ecx, dword [rdx + rax*4 + 0x1070c]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x1400101b2
mov bl, reloc.OLEAUT32.dll_SafeArrayGetDim
jmp case.default.0x1400101b2
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r14, r14
je 0x140010334
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140012a80
test al, al
je 0x14001027e
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test r15d, r15d
jne 0x1400101f7
movzx eax, bl
or byte [rsp + rax + 0x50], 0x80
jmp 0x140010205
cmp r15d, 1
jne 0x140010205
movzx eax, bl
and byte [rsp + rax + 0x50], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x140010225
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x10724]
add rcx, rdx
jmp rcx
test byte [rbp - 0xe], 0x80
jne 0x14001023a
test byte [rbp - 0xd], 0x80
jne 0x14001023a
and byte [rsp + 0x61], 0x7f
jmp case.default.0x140010225
or byte [rsp + 0x61], 0x80
jmp case.default.0x140010225
test byte [rbp - 0x10], 0x80
jne 0x140010254
test byte [rbp - 0xf], 0x80
jne 0x140010254
and byte [rsp + 0x60], 0x7f
jmp case.default.0x140010225
or byte [rsp + 0x60], 0x80
jmp case.default.0x140010225
test byte [rbp - 0xc], 0x80
jne 0x14001026e
test byte [rbp - 0xb], 0x80
jne 0x14001026e
and byte [rsp + 0x62], 0x7f
jmp case.default.0x140010225
or byte [rsp + 0x62], 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
cmp r15d, 1
je 0x1400102a6
mov r9, rdi
movzx r8d, bl
or r9, 1
mov edx, 0x100
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xb0], r12b
je 0x14001030b
cmp r15d, 2
jne 0x14001030b
mov rax, qword [0x1400ebaa8]
mov ecx, dword [rax + 0x84]
test ecx, ecx
js 0x140010314
mov eax, dword [0x1400f2d8c]
test eax, eax
je 0x1400102ee
cmp eax, r15d
jne 0x140010314
test ecx, ecx
jle 0x140010314
mov dword [rsp + 0x20], ecx
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
xor edx, edx
call fcn.140011770
jmp 0x140010314
mov edx, 1
mov dword [0x1400ebaa0], r12d
call fcn.140001800
mov dword [0x1400ebaa0], 1
jmp 0x140010314
test r15d, r15d
je 0x1400106b9
mov r9d, 0xc0000001
movzx r8d, bl
or r9, rdi
mov edx, 0x101
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400106b9
cmp byte [0x1400eff0f], r12b
mov dword [0x1400f51f0], r15d
mov byte [0x1400f2d98], bl
je 0x140010369
cmp bl, 0x12
je 0x140010356
lea eax, [rbx + 0x5c]
cmp al, 1
ja 0x140010369
test sil, sil
jne 0x140010369
xor ecx, ecx
mov byte [rsp + 0x34], 1
call fcn.14002ee50
jmp 0x14001036e
mov byte [rsp + 0x34], r12b
movzx r10d, byte [rbp + 0x98]
lea rax, [0x1400f51f4]
test sil, sil
lea r14, [rsp + 0x44]
cmove r14, rax
cmp bl, 0xa5
jne 0x140010438
test r10b, r10b
jne 0x140010438
cmp qword [0x1400eff20], r12
je 0x140010438
mov al, 1
mov byte [rsp + 0x32], al
mov byte [rbp + 0xa0], al
test sil, sil
jne 0x1400103c7
mov rax, qword [0x1400f51f8]
mov qword [rsp + 0x38], rax
jmp 0x1400103fe
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400103e0
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r12d, eax
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
mov qword [rsp + 0x38], rax
xor edx, edx
mov r12, rax
call fcn.140012e10
mov dword [r14], eax
cmp dword [r14], 0
je 0x140010410
mov byte [rbp + 0xa0], 0
mov r11b, 1
jmp 0x140010486
mov ecx, 0xa2
mov byte [rsp + 0x30], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [0x1400f0cac], r13d
mov r11b, 1
movzx r12d, ax
shr r12d, 0xf
and r12b, 1
jmp 0x140010499
xor r11b, r11b
mov byte [rsp + 0x32], r11b
mov byte [rbp + 0xa0], r11b
test r10b, r10b
je 0x14001047c
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140012a80
movzx r12d, byte [rbp + 0x98]
movzx ecx, al
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0x98]
mov byte [rsp + 0x30], al
jmp 0x1400104a3
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0x98]
movzx r12d, byte [rbp + 0x98]
mov byte [rsp + 0x30], al
movzx r10d, byte [rbp + 0x98]
xor cl, cl
mov byte [rsp + 0x31], cl
test sil, sil
jne 0x1400104cb
mov eax, dword [0x1400f2d8c]
cmp eax, 2
je 0x1400104cb
cmp qword [0x1400eff20], 0
je 0x1400104c6
cmp eax, 1
jne 0x1400104cb
mov sil, 1
jmp 0x1400104ce
xor sil, sil
mov byte [rsp + 0x33], sil
cmp r15d, 1
je 0x140010594
test r10b, r10b
je 0x1400104fd
mov r9d, dword [rsp + 0x40]
movzx r8d, di
movzx edx, bl
mov dword [rsp + 0x20], r13d
call fcn.140011770
jmp 0x140010581
test r11b, r11b
je 0x140010516
mov eax, dword [0x1400f0ca8]
cmp dword [r14], 3
cmove eax, r13d
mov dword [0x1400f0ca8], eax
mov r8d, dword [rsp + 0x40]
movzx edx, dil
mov r9d, r13d
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
xor eax, eax
mov dword [0x1400f0ca8], eax
cmp byte [rbp + 0xa0], al
je 0x140010581
cmp dword [0x1400f0cac], eax
mov byte [rbp + 0xa0], al
je 0x140010554
mov dword [0x1400f0cac], eax
lea edx, [rax + 4]
jmp 0x140010574
test r12b, r12b
jne 0x140010581
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
and ax, cx
neg ax
sbb edx, edx
add edx, 4
mov rcx, qword [rsp + 0x38]
call fcn.140012e10
mov dword [r14], eax
test sil, sil
je 0x140010594
movzx r8d, di
movzx edx, bl
xor ecx, ecx
call fcn.140011df0
cmp byte [rbp + 0xb0], 0
je 0x1400105cd
cmp r15d, 2
jne 0x1400105cd
cmp dword [0x1400f2d8c], r15d
mov rax, qword [0x1400ebaa8]
jne 0x1400105c0
mov ecx, dword [rax + 0x88]
call fcn.140011d00
jmp 0x1400105d6
mov ecx, dword [rax + 0x84]
call fcn.140011d00
jmp 0x1400105d6
test r15d, r15d
je 0x1400106ab
mov ecx, dword [rsp + 0x40]
or ecx, 2
cmp byte [rbp + 0x98], 0
je 0x140010601
mov r9d, ecx
mov dword [rsp + 0x20], r13d
movzx ecx, byte [rsp + 0x31]
movzx r8d, di
movzx edx, bl
call fcn.140011770
jmp 0x14001067f
cmp byte [rsp + 0x32], 0
je 0x14001061c
mov eax, dword [0x1400f0ca4]
cmp dword [r14], 3
cmove eax, r13d
mov dword [0x1400f0ca4], eax
mov r8d, ecx
mov r9d, r13d
movzx ecx, bl
movzx edx, dil
call qword [sym.imp.USER32.dll_keybd_event]
xor esi, esi
mov dword [0x1400f0ca4], esi
cmp byte [rbp + 0xa0], sil
je 0x14001067f
cmp dword [0x1400f0cac], esi
je 0x140010653
mov dword [0x1400f0cac], esi
lea edx, [rsi + 4]
jmp 0x140010672
test r12b, r12b
je 0x14001067f
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
setne sil
lea edx, [rsi + 3]
mov rcx, qword [rsp + 0x38]
call fcn.140012e10
mov dword [r14], eax
cmp dword [r14], 0
je 0x140010696
mov eax, 0x138
cmp di, ax
jne 0x140010696
and byte [0x1400f51d6], 0xfe
cmp byte [rsp + 0x33], 0
je 0x1400106ab
movzx r8d, di
movzx edx, bl
mov cl, 1
call fcn.140011df0
cmp byte [rsp + 0x34], 0
je 0x1400106b9
mov cl, 1
call fcn.14002ee50
cmp byte [rbp + 0xb0], 0
mov r13, qword [rsp + 0x150]
mov r12, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x190]
je 0x1400106fa
cmp dword [0x1400f2d8c], 2
mov rax, qword [0x1400ebaa8]
jne 0x1400106f2
mov ecx, dword [rax + 0x80]
jmp 0x1400106f5
mov ecx, dword [rax + 0x7c]
call fcn.140011d00
add rsp, 0x160
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret