Function at 0x7ff6f9ce39a0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
xor edi, edi
xor ecx, ecx
call sub.user32.dll_GetKeyboardLayout
mov rsi, rax
xchg qword [0x7ff6f9d20610], rax
cmp rsi, rax
je 0x7ff6f9ce3cb1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x61], 0x8080
movaps xmmword [rsp + 0x240], xmm0
movaps xmmword [rsp + 0x230], xmm0
movaps xmmword [rsp + 0x220], xmm0
movaps xmmword [rsp + 0x210], xmm0
movaps xmmword [rsp + 0x200], xmm0
movaps xmmword [rsp + 0x1f0], xmm0
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmmword [rsp + 0x1d0], xmm0
movaps xmmword [rsp + 0x1c0], xmm0
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x190], xmm0
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x170], xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x150], xmm0
lea rbx, [rsp + 0x40]
lea r15, [rsp + 0x50]
xor ebp, ebp
nop dword [rax]
test bpl, bpl
jne 0x7ff6f9ce3cce
lea r12d, [rdi + 1]
cmp edi, 0xff
setae bpl
mov eax, 0xff
cmovae r12d, eax
mov word [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
mov ecx, edi
xor edx, edx
lea r8, [rsp + 0x150]
mov r9, rbx
call sub.user32.dll_ToUnicodeEx
mov r13d, 0x110000
mov r14d, 0x110000
test eax, eax
jle 0x7ff6f9ce3bc8
movzx eax, word [rsp + 0x40]
movzx r14d, ax
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x7ff6f9ce3bc0
cmp r14d, 0xdbff
mov r14d, 0x110000
ja 0x7ff6f9ce3bc8
movzx ecx, word [rsp + 0x42]
lea edx, [rcx + 0x2000]
movzx edx, dx
mov r14d, 0x110000
cmp edx, 0xfc00
jb 0x7ff6f9ce3bc8
add eax, 0x2800
movzx eax, ax
add ecx, 0x2400
movzx r14d, cx
shl rax, 0x1a
shl r14, 0x10
or r14, rax
movabs rax, 0x100000000
add r14, rax
jmp 0x7ff6f9ce3bc4
shl r14, 0x10
shr r14, 0x10
mov word [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
mov ecx, edi
xor edx, edx
mov r8, r15
mov r9, rbx
call sub.user32.dll_ToUnicodeEx
test eax, eax
jle 0x7ff6f9ce3c7b
movzx eax, word [rsp + 0x40]
movzx ecx, ax
mov edx, eax
and edx, 0xf800
cmp edx, 0xd800
jne 0x7ff6f9ce3c70
cmp ecx, 0xdbff
ja 0x7ff6f9ce3c7b
movzx ecx, word [rsp + 0x42]
lea edx, [rcx + 0x2000]
movzx edx, dx
cmp edx, 0xfc00
jb 0x7ff6f9ce3c7b
add eax, 0x2800
movzx eax, ax
add ecx, 0x2400
movzx r13d, cx
shl rax, 0x1a
shl r13, 0x10
or r13, rax
movabs rax, 0x100000000
add r13, rax
jmp 0x7ff6f9ce3c77
shl rcx, 0x10
mov r13, rcx
shr r13, 0x10
mov edi, r12d
cmp r14d, r13d
je 0x7ff6f9ce3ae0
mov edi, r12d
cmp r14d, 0x110000
je 0x7ff6f9ce3ae0
mov edi, r12d
cmp r13d, 0x110000
je 0x7ff6f9ce3ae0
mov al, 1
xchg byte [0x7ff6f9d20618], al
jmp 0x7ff6f9ce3cbc
movzx eax, byte [0x7ff6f9d20618]
test al, al
je 0x7ff6f9ce3cd6
mov ecx, 0xa5
call sub.user32.dll_GetKeyState
test ax, ax
setns bl
jmp 0x7ff6f9ce3cd8
xor eax, eax
xchg byte [0x7ff6f9d20618], al
mov bl, 1
mov ecx, 0x10
call sub.user32.dll_GetKeyState
movzx esi, ax
shr esi, 0xf
lea edi, [rsi*4]
mov ecx, 0x11
call sub.user32.dll_GetKeyState
lea ebp, [rsi*4 + 0x20]
test bl, bl
cmove ebp, edi
test ax, ax
cmovns ebp, edi
lea esi, [rbp + 0x100]
test bl, bl
cmove esi, ebp
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
cmovns esi, ebp
mov ecx, 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
js 0x7ff6f9ce3d4c
mov ecx, 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
js 0x7ff6f9ce3d4c
and esi, 0xf7ff
jmp 0x7ff6f9ce3d52
or esi, 0x800
mov eax, esi
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret