Function at 0x140178870
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, r8
mov ebx, ecx
mov rbp, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdx, rax
mov rax, qword [0x1403d4360]
test rax, rax
je 0x1401788b5
cmp qword [rax], rdx
je 0x140178917
mov rax, qword [0x1403d4368]
mov qword [0x1403d4360], 0
test rax, rax
jne 0x1401788d9
jmp 0x1401788de
mov rax, qword [rax + 0x28]
test rax, rax
je 0x1401788de
cmp qword [rax], rdx
jne 0x1401788d0
lea rdx, str._s___u_:_Refreshing_locale_cache._n
mov r9d, 0x270
mov ecx, 1
lea r8, str.keycode_to_unicode
call qword [case.0x140177f95.0]
call fcn.1401777c0
mov rdx, qword [0x1403d4360]
xor eax, eax
test rdx, rdx
je 0x140178b10
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rdx
mov r9d, 0x27e
lea r8, str.keycode_to_unicode
lea rdx, str._s___u_:_Using_keyboard_layout__p._n
mov ecx, 2
call qword [case.0x140177f95.0]
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x36], ax
mov rax, qword [0x1403d4360]
mov r14, qword [rax + 0x10]
mov r15, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
movzx ecx, byte [r14]
mov qword [rsp + 0x38], rax
test cl, cl
je 0x140178bb5
mov byte [rsp + 0x35], 0
mov rdi, qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r12d, r12d
xor r13d, r13d
jmp 0x140178995
movzx ecx, byte [r14 + 2]
add r14, 2
test cl, cl
je 0x1401789d0
call rdi
test ax, ax
jns 0x140178988
movzx eax, byte [r14]
cmp al, 0x10
je 0x140178b28
cmp al, 0x11
je 0x140178b38
cmp al, 0x12
mov eax, 1
cmove r12d, eax
movzx ecx, byte [r14 + 2]
add r14, 2
test cl, cl
jne 0x140178995
nop dword [rax + rax]
cmp byte [rsp + 0x35], 0
movzx edi, r13b
je 0x1401789e4
lea eax, [rdi + 3]
test r12b, r12b
cmovne edi, eax
movzx r14d, byte [rsp + 0x36]
movzx r12d, word [0x1401d04e4]
xor eax, eax
and r14d, 1
jmp 0x140178a0d
add r15, 0x10
test r11d, r11d
je 0x140178aa0
movzx r11d, byte [r15 + 9]
mov rcx, qword [r15]
lea edx, [r11 - 2]
mov r8d, edx
shr r8d, 0x1f
add r8d, edx
sar r8d, 1
test rcx, rcx
je 0x140178a00
cmp edi, r8d
jge 0x140178a00
lea r10d, [r8 + 1]
movzx edx, byte [rcx]
mov r8, r10
add r10, r10
jmp 0x140178a4a
add rcx, r10
movzx edx, byte [rcx]
test dl, dl
je 0x140178a00
cmp edx, ebx
jne 0x140178a40
cmp byte [rcx + 1], 1
jne 0x140178a5d
test r14b, r14b
jne 0x140178b87
movsxd rdx, edi
movzx r10d, word [rcx + rdx*2 + 2]
cmp r10w, 0xf001
je 0x140178b48
cmp r10w, 0xf000
je 0x140178a00
test rsi, rsi
je 0x140178a00
mov word [rbp], r10w
mov eax, 1
add r15, 0x10
test r11d, r11d
jne 0x140178a0d
nop word cs:[rax + rax]
cmp r12w, 0xf000
je 0x140178b10
mov rdi, qword [rsp + 0x38]
mov ecx, dword [rdi]
test ecx, ecx
je 0x140178b10
add rdi, 8
mov r8d, eax
mov rdx, rdi
jmp 0x140178aca
mov ecx, dword [rdx]
add rdx, 8
test ecx, ecx
je 0x140178b10
test rsi, rsi
je 0x140178ac0
cmp word [rbp], cx
jne 0x140178ac0
shr ecx, 0x10
cmp word [0x1401d04e4], cx
jne 0x140178ac0
mov ecx, 0xfffff000
mov word [0x1401d04e4], cx
cmp rax, rsi
ja 0x140178ac0
movzx r10d, word [rdx - 4]
test eax, eax
je 0x140178ac0
xor ecx, ecx
mov r9d, ecx
add ecx, 1
mov byte [rbp + r9], r10b
cmp ecx, r8d
jb 0x140178afd
jmp 0x140178ac0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r13d, 1
jmp 0x140178988
mov byte [rsp + 0x35], 1
jmp 0x140178988
cmp r12w, 0xf000
je 0x140178b98
cmp rsi, 1
jbe 0x140178a00
movzx eax, r12b
shl r12d, 8
mov r8d, 0xfffff000
add eax, r12d
mov word [0x1401d04e4], r8w
mov r12d, 0xfffff000
mov word [rbp], ax
mov eax, 2
jmp 0x140178a00
test edi, edi
jle 0x140178bbf
test r13b, r13b
je 0x140178bbf
sub edi, 1
jmp 0x140178a5d
movsxd r8, r8d
add rdx, rdx
lea rdx, [rdx + r8*2]
movzx r12d, word [rcx + rdx + 2]
mov word [0x1401d04e4], r12w
jmp 0x140178a00
xor r13d, r13d
xor edi, edi
jmp 0x1401789e4
add edi, 1
jmp 0x140178a5d