Function at 0x180147bd0
Capabilities:
Get keyboard layout

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rax + 8], r12
mov ebp, r8d
mov qword [rax + 0x10], r13
mov esi, edx
xor r13d, r13d
mov r15d, ecx
cmp dword [0x180350b70], r13d
lea r12d, [r13 + 1]
jne 0x180147ceb
cmp dword [0x180350cac], r13d
je 0x180147d91
call fcn.1800656d0
xor ecx, ecx
mov word [rsp + 0x9a], r13w
mov r14, rax
mov dword [rsp + 0x9c], r13d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, r15b
lea edx, [r13 + 4]
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edx, dword [0x180350cac]
lea r8, [rsp + 0x98]
mov rcx, r14
mov word [rsp + 0x98], ax
call fcn.180065c00
lea ecx, [r13 + 0x64]
call fcn.1800da930
lea ecx, [rbp + 0x64]
cmp eax, 0x60
jg 0x180147c76
mov ecx, ebp
call fcn.1800da930
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x180350cac]
lea r8, [rsp + 0x98]
mov rcx, r14
mov word [rsp + 0x9a], r12w
call fcn.180065c00
test r14, r14
je 0x180147ceb
mov rbx, r14
mov edi, 0x14
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x180147cbf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180147cce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x10
sub rdi, r12
jne 0x180147cb0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x180350b70], r12d
jne 0x180147d91
xor ecx, ecx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x2c], 8
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx edi, r15b
mov edx, 4
mov r8, rax
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov r8d, 0x28
mov word [rsp + 0x28], r13w
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2a], ax
mov ecx, r12d
mov qword [rsp + 0x38], r13
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x64
lea ebx, [rbp + 0x64]
call fcn.1800da930
mov ecx, ebx
cmp eax, 0x60
jg 0x180147d65
mov ecx, ebp
call fcn.1800da930
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rsp + 0x2c], 0xa
lea rdx, [rsp + 0x20]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x180147d98
lea ebx, [rbp + 0x64]
movzx edi, r15b
cmp dword [0x180350b70], 2
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
jne 0x180147e53
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edx, 4
mov ecx, edi
mov r8, rax
mov r14, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov rcx, qword [0x180350b20]
movzx edx, r15w
movzx r15d, dl
mov edx, 0x100
movzx r9d, ax
mov r8d, r15d
shl r9, 0x10
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0x64
call fcn.1800da930
mov ecx, ebx
cmp eax, 0x60
jg 0x180147e0c
mov ecx, ebp
call fcn.1800da930
lea ecx, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, r14
mov edx, 4
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ecx, 0x4000
mov r8, r15
sub ax, cx
mov edx, 0x101
mov rcx, qword [0x180350b20]
movzx r9d, ax
shl r9, 0x10
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageA]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret