Function at 0x18013f660
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r13d, r13d
mov edi, r8d
cmp dword [0x18033c814], r13d
mov esi, edx
movzx r14d, cl
mov ebx, 0x300
lea r12d, [r13 + 1]
jne 0x18013f7e4
cmp dword [0x18033c944], r13d
je 0x18013fb42
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdx, rax
movzx ecx, r14b
mov r15, rax
call qword [sym.imp.USER32.dll_VkKeyScanExA]
movsx r12d, ax
call fcn.18005eff0
test bx, r12w
mov word [rbp + 0x4a], r13w
mov rbx, rax
mov dword [rbp + 0x4c], r13d
mov r8, r15
lea edx, [r13 + 4]
je 0x18013f792
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edx, dword [0x18033c944]
lea r8, [rbp + 0x48]
mov rcx, rbx
mov word [rbp + 0x48], ax
call fcn.18005f520
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, r12b
lea edx, [r13 + 4]
mov r8, r15
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edx, dword [0x18033c944]
lea r8, [rbp + 0x48]
mov rcx, rbx
mov word [rbp + 0x48], ax
call fcn.18005f520
lea r8d, [rdi + 0x64]
mov edx, edi
mov ecx, esi
call fcn.1800dddb0
mov edx, dword [0x18033c944]
lea r8, [rbp + 0x48]
mov r12d, 1
mov rcx, rbx
mov word [rbp + 0x4a], r12w
call fcn.18005f520
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [r13 + 4]
mov r8, r15
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov word [rbp + 0x48], ax
jmp 0x18013f7c5
movzx ecx, r12b
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edx, dword [0x18033c944]
lea r8, [rbp + 0x48]
mov rcx, rbx
mov word [rbp + 0x48], ax
call fcn.18005f520
lea r8d, [rdi + 0x64]
mov edx, edi
mov ecx, esi
call fcn.1800dddb0
mov r12d, 1
mov edx, dword [0x18033c944]
lea r8, [rbp + 0x48]
mov rcx, rbx
mov word [rbp + 0x4a], r12w
call fcn.18005f520
mov rcx, rbx
call fcn.18005f1f0
cmp dword [0x18033c814], 1
jne 0x18013f95d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdx, rax
movzx ecx, r14b
mov rbx, rax
call qword [sym.imp.USER32.dll_VkKeyScanExA]
mov qword [rbp - 0x30], 1
mov r8, rbx
movsx r15d, ax
mov edx, 4
mov eax, 0x300
mov word [rbp - 0x28], r13w
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r13
mov dword [rbp - 0x24], 8
mov qword [rbp - 0x18], r13
test ax, r15w
je 0x18013f900
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov r8d, 0x28
lea rdx, [rbp - 0x30]
mov ecx, r12d
mov word [rbp - 0x26], ax
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, r15b
mov r8, rbx
mov edx, 4
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov r8d, 0x28
lea rdx, [rbp - 0x30]
mov ecx, r12d
mov word [rbp - 0x26], ax
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x64
call fcn.1800d38c0
lea ecx, [rdi + 0x64]
cmp eax, 0x60
jg 0x18013f8b1
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rbp - 0x24], 0xa
lea rdx, [rbp - 0x30]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 4
mov r8, rbx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov word [rbp - 0x26], ax
jmp 0x18013f943
movzx ecx, r15b
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov r8d, 0x28
lea rdx, [rbp - 0x30]
mov ecx, r12d
mov word [rbp - 0x26], ax
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x64
call fcn.1800d38c0
lea ecx, [rdi + 0x64]
cmp eax, 0x60
jg 0x18013f935
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rbp - 0x24], 0xa
lea rdx, [rbp - 0x30]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [0x18033c814], 2
jne 0x18013fb42
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdx, rax
movzx ecx, r14b
mov r15, rax
call qword [sym.imp.USER32.dll_VkKeyScanExA]
movzx ebx, ax
mov eax, 0x300
test ax, bx
je 0x18013fab6
mov edx, 4
mov qword [rbp - 0x30], 1
mov r8, r15
mov word [rbp - 0x28], r13w
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r13
lea ecx, [rdx + 0xc]
mov dword [rbp - 0x24], 8
mov qword [rbp - 0x18], r13
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov r8d, 0x28
lea rdx, [rbp - 0x30]
mov ecx, r12d
mov word [rbp - 0x26], ax
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, bx
xor edx, edx
movzx r14d, al
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov rcx, qword [0x18033c6e8]
mov edx, pe_nt_image_headers64
movzx r9d, ax
shl r9, 0x10
movzx ebx, bl
or r9, 1
mov r8d, ebx
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0x64
call fcn.1800d38c0
lea ecx, [rdi + 0x64]
cmp eax, 0x60
jg 0x18013fa35
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, 0x4000
mov r8, rbx
sub ax, cx
mov edx, 0x101
mov rcx, qword [0x18033c6e8]
movzx r9d, ax
shl r9, 0x10
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
mov dword [rbp - 0x24], 0xa
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
lea rdx, [rbp - 0x30]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x18013fb42
movsx eax, bx
xor edx, edx
movzx r14d, al
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov rcx, qword [0x18033c6e8]
mov edx, pe_nt_image_headers64
movzx r9d, ax
shl r9, 0x10
movzx ebx, bl
or r9, 1
mov r8d, ebx
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0x64
call fcn.1800d38c0
lea ecx, [rdi + 0x64]
cmp eax, 0x60
jg 0x18013fb00
mov ecx, edi
call fcn.1800d38c0
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, 0x4000
mov r8, rbx
sub ax, cx
mov edx, 0x101
mov rcx, qword [0x18033c6e8]
movzx r9d, ax
shl r9, 0x10
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageA]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret