Function at 0x140023f00
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r14
sub rsp, 0x158
movzx ebx, cl
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea edx, [rbx - 0x41]
mov r14, rax
cmp dl, 0x19
ja 0x1400241fd
mov qword [rsp + 0x180], rbp
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x148], rdi
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x140], r15
call fcn.1400f1130
xor ebp, ebp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebp
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 2
xor edx, edx
lea ecx, [rbp + 0x6e]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x178]
cmp eax, 2
mov dword [rsp + 0x28], ebp
movzx edi, bp
mov dword [rsp + 0x20], 2
cmove di, word [rsp + 0x178]
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov r15d, eax
test eax, eax
jns 0x140023fe5
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x170]
mov dword [rsp + 0x28], ebp
lea r8, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x20], 2
lea ecx, [rbp + 0x6e]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test di, di
je 0x1400241ca
mov qword [rsp + 0x150], rsi
cmp di, 0xa
jne 0x14002400c
movzx edx, byte [rsp + 0x170]
mov r9b, ntohs
jmp 0x1400240db
mov rdx, r14
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx r9, ax
mov r8, r9
shr r8, 8
cmp r8b, 0xff
jne 0x140024087
cmp r9b, 0xff
jne 0x140024087
movzx esi, di
test esi, 0xffffff80
jne 0x1400241c2
mov edx, 0x103
mov ecx, esi
call fcn.1400fc354
test eax, eax
je 0x1400241c2
mov edx, 2
mov ecx, esi
call fcn.1400fc354
mov edx, 1
movzx edi, dil
mov ecx, esi
mov ebx, eax
call fcn.1400fc354
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx r9d, cl
cmove r9d, edi
test r8b, 0x38
jne 0x1400241c2
movzx edx, byte [rsp + 0x170]
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x1400240a8
or dl, 8
jmp 0x1400240c4
test r8b, 2
je 0x1400240b6
test dl, 3
jne 0x1400240b6
or dl, 1
test r8b, 4
je 0x1400240c4
test dl, 0xc
jne 0x1400240c4
or dl, 4
test r8b, 1
je 0x1400240d2
test dl, 0x30
jne 0x1400240d2
or dl, 0x10
test r9b, r9b
je 0x1400241c2
movzx ecx, dl
movzx r8d, dl
movzx r10d, dl
movzx ebx, dl
movzx r11d, dl
movzx eax, dl
and cl, 0xf0
and r8b, 0xe0
and r10b, 0xfe
shl cl, 3
and bl, 0xfc
shl r8b, 2
and r11b, 0xf8
shl r10b, 6
and al, 0xc0
shl bl, 5
movzx edi, dl
shl r11b, 4
add al, al
shl dil, 7
and dl, 0x80
mov byte [rsp + 0xe0], cl
mov byte [rsp + 0xe1], r8b
mov byte [rsp + 0xe2], dil
mov byte [rsp + 0xe3], r10b
mov byte [rsp + 0xe4], bl
mov byte [rsp + 0xe5], r11b
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x9c], dl
test cl, cl
jne 0x14002416b
test r8b, r8b
jne 0x14002416b
xor al, al
jmp 0x14002416d
mov al, 0x80
mov byte [rsp + 0x50], al
test dil, dil
jne 0x14002417f
test r10b, r10b
jne 0x14002417f
xor al, al
jmp 0x140024181
mov al, 0x80
mov byte [rsp + 0x51], al
test bl, bl
jne 0x140024192
test r11b, r11b
jne 0x140024192
xor al, al
jmp 0x140024194
mov al, 0x80
movzx ecx, r9b
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x170]
mov dword [rsp + 0x28], ebp
xor edx, edx
mov dword [rsp + 0x20], 2
mov byte [rsp + 0x52], al
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x148]
test r15d, r15d
mov r15, qword [rsp + 0x140]
je 0x1400241e7
movzx ebp, word [rsp + 0x178]
movzx eax, bp
mov rbp, qword [rsp + 0x180]
add rsp, 0x158
pop r14
pop rbx
ret
mov ecx, ebx
mov r8, r14
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
add rsp, 0x158
pop r14
pop rbx
ret