Function at 0x14002de80
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc0
xor r13d, r13d
mov rax, rcx
mov dword [rbp - 0x69], r13d
movzx r12d, r13w
mov word [rbp - 0x6b], r13w
mov edi, r13d
test r8b, r8b
je 0x14002ded1
cmp byte [rcx + 0x64], dil
je 0x14002ded1
mov sil, 1
jmp 0x14002ded4
xor sil, sil
lea r15, [rcx + 0x74]
mov byte [rbp - 0x6f], sil
add rcx, 0x174
mov qword [rsp + 0xb8], rbx
mov r14, rdx
mov qword [rbp - 0x59], r15
mov qword [rbp - 0x61], rcx
cmp word [rdx], di
je 0x14002e541
mov ebx, 0xffdf
nop dword [rax]
nop dword [rax + rax]
mov word [rbp - 0x6d], r13w
movzx eax, word [r14]
cmp ax, 0x7b
je 0x14002e05c
cmp ax, 0x7d
je 0x14002e43d
test sil, sil
je 0x14002df3c
inc edi
mov dword [rbp - 0x69], edi
jmp 0x14002e43d
xor ecx, ecx
mov word [rbp - 0x6d], ax
mov byte [rbp - 0x70], 0
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp word [rbp - 0x6d], 0
jne 0x14002df65
xor dil, dil
xor sil, sil
mov byte [rbp - 0x71], dil
xor r13b, r13b
jmp 0x14002e2fd
movzx r8d, word [rbp - 0x6b]
test r8w, r8w
jne 0x14002df95
movzx ecx, word [rbp - 0x6d]
lea rdx, [rbp - 0x70]
mov r9b, 1
mov r8, rax
call fcn.140024180
xor dil, dil
movzx esi, al
mov byte [rbp - 0x71], dil
xor r13b, r13b
jmp 0x14002e2fd
movzx edx, word [rbp - 0x6d]
movzx ecx, dx
and cx, bx
lea eax, [rdx - 0x61]
cmp ax, 0x19
cmova cx, dx
cmp cx, 0x56
jne 0x14002dffd
movzx ecx, r8w
lea eax, [r8 - 0x61]
and cx, bx
cmp ax, 0x19
cmova cx, r8w
cmp cx, 0x4b
jne 0x14002dffd
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x69]
call fcn.1400d0618
movzx ecx, al
mov esi, r13d
mov rax, qword [rbp - 0x51]
cmp word [rax], 0
cmove esi, ecx
xor dil, dil
mov byte [rbp - 0x71], dil
xor r13b, r13b
jmp 0x14002e2fd
lea rsi, str.Numpad0
mov rdi, r13
mov rbx, rsi
nop word [rax + rax]
mov rcx, qword [rbx]
lea rdx, [rbp - 0x6d]
call fcn.1400ca01c
test eax, eax
je 0x14002e045
inc rdi
lea rax, [0x14012cc70]
add rbx, 0x10
cmp rbx, rax
jl 0x14002e010
xor dil, dil
xor sil, sil
mov byte [rbp - 0x71], dil
xor r13b, r13b
jmp 0x14002e2fd
add rdi, rdi
movzx esi, byte [rsi + rdi*8 + 8]
xor dil, dil
mov byte [rbp - 0x71], dil
xor r13b, r13b
jmp 0x14002e2fd
add r14, 2
mov edx, 0x7d
mov rcx, r14
call fcn.1400c50a4
mov r15, rax
test rax, rax
je 0x14002e43d
mov rbx, rax
sub rbx, r14
sar rbx, 1
jne 0x14002e09a
add r15, 2
cmp word [r15], 0x7d
jne 0x14002e438
mov ebx, 1
jmp 0x14002e0a0
cmp rbx, 1
jne 0x14002e0b7
test sil, sil
je 0x14002e0af
inc edi
mov dword [rbp - 0x69], edi
jmp 0x14002e438
movzx eax, word [r14]
mov word [rbp - 0x6d], ax
add rbx, rbx
lea rcx, [rbp - 0x31]
mov r8, rbx
mov rdx, r14
call fcn.1400e78c0
xor r14d, r14d
xor r13b, r13b
xor ecx, ecx
mov word [rbp + rbx - 0x31], r14w
mov byte [rbp - 0x70], r13b
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx r10d, word [rbp - 0x31]
test r10w, r10w
jne 0x14002e0f7
xor sil, sil
mov r12d, r14d
jmp 0x14002e2f2
movzx edx, word [rbp - 0x2f]
movzx ecx, r10w
test dx, dx
jne 0x14002e11b
mov r9b, 1
lea rdx, [rbp - 0x70]
mov r8, rax
call fcn.140024180
movzx esi, al
jmp 0x14002e1c1
mov ebx, 0xffdf
lea eax, [r10 - 0x61]
and cx, bx
cmp ax, 0x19
cmova cx, r10w
cmp cx, 0x56
jne 0x14002e172
movzx ecx, dx
lea eax, [rdx - 0x61]
and cx, bx
cmp ax, 0x19
cmova cx, dx
cmp cx, 0x4b
jne 0x14002e172
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x2d]
call fcn.1400d0618
movzx ecx, al
mov esi, r14d
mov rax, qword [rbp - 0x49]
cmp word [rax], si
cmove esi, ecx
jmp 0x14002e1c6
lea rsi, str.Numpad0
mov rdi, r14
mov rbx, rsi
nop
mov rcx, qword [rbx]
lea rdx, [rbp - 0x31]
call fcn.1400ca01c
test eax, eax
je 0x14002e1b9
inc rdi
lea rax, [0x14012cc70]
add rbx, 0x10
cmp rbx, rax
jl 0x14002e180
xor sil, sil
cmp word [rbp - 0x31], r14w
jne 0x14002e23d
mov r12d, r14d
jmp 0x14002e2f2
add rdi, rdi
movzx esi, byte [rsi + rdi*8 + 8]
mov ebx, 0xffdf
test sil, sil
je 0x14002e1a6
movzx edx, word [rbp - 0x31]
movzx ecx, dx
and cx, bx
lea eax, [rdx - 0x61]
cmp ax, 0x19
cmova cx, dx
cmp cx, 0x56
jne 0x14002e20d
movzx edx, word [rbp - 0x2f]
movzx ecx, dx
and cx, bx
lea eax, [rdx - 0x61]
cmp ax, 0x19
cmova cx, dx
cmp cx, 0x4b
jne 0x14002e20d
mov dil, 1
mov byte [rbp - 0x71], dil
jmp 0x14002e2f6
xor dil, dil
mov dl, 1
movzx ecx, sil
mov byte [rbp - 0x71], dil
call fcn.140024b70
movzx r12d, ax
test ax, ax
je 0x14002e2f6
mov eax, 0x100
xor r12w, ax
xor sil, sil
jmp 0x14002e2f6
lea r12, str.NumpadEnter
mov rdi, r14
mov rbx, r12
nop word [rax + rax]
mov rcx, qword [rbx]
lea rdx, [rbp - 0x31]
call fcn.1400ca01c
test eax, eax
je 0x14002e2e9
inc rdi
lea rax, str.Numpad0
add rbx, 0x10
cmp rbx, rax
jl 0x14002e250
movzx ecx, word [rbp - 0x31]
lea eax, [rcx - 0x61]
cmp ax, 0x19
mov eax, ecx
ja 0x14002e289
and eax, 0xffffffdf
cmp ax, 0x53
jne 0x14002e2e3
movzx edx, word [rbp - 0x2f]
mov r8d, 0xffdf
movzx ecx, dx
and cx, r8w
lea eax, [rdx - 0x61]
cmp ax, 0x19
cmova cx, dx
cmp cx, 0x43
jne 0x14002e2e3
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x2d]
call fcn.1400d0618
movzx edi, byte [rbp - 0x71]
mov ecx, eax
mov rax, qword [rbp - 0x41]
cmp word [rax], r14w
je 0x14002e2da
movzx r12d, r14w
jmp 0x14002e2f6
mov r13b, 1
movzx r12d, cx
jmp 0x14002e2f6
movzx r12d, r14w
jmp 0x14002e2f2
add rdi, rdi
movzx r12d, word [r12 + rdi*8 + 8]
movzx edi, byte [rbp - 0x71]
mov r14, r15
mov r15, qword [rbp - 0x59]
test sil, sil
je 0x14002e334
movzx ecx, word [rbp - 0x6d]
test cx, cx
je 0x14002e3a0
cmp byte [rbp + 0x6f], 0
je 0x14002e3a0
call qword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x14002e3a0
test byte [rbp - 0x70], 0x30
movzx ecx, sil
sete al
inc al
or byte [r15 + rcx], al
movzx edx, byte [rbp + 0x7f]
movzx r9d, byte [rbp + 0x77]
mov rcx, qword [rbp - 0x61]
test r12w, r12w
jne 0x14002e350
test r13b, r13b
je 0x14002e432
movzx eax, r12w
movzx ebx, r9b
add rcx, rax
not bl
movzx eax, byte [rcx]
and al, bl
or al, dl
mov byte [rcx], al
test r9b, r9b
je 0x14002e432
test r13b, r13b
jne 0x14002e432
movzx edx, r12w
movzx ecx, r12w
sub edx, 0x45
je 0x14002e429
sub edx, 0xf1
je 0x14002e396
cmp edx, 0xf
jne 0x14002e3fe
mov edx, 0xff
and cx, dx
jmp 0x14002e403
movzx r9d, byte [rbp + 0x77]
movzx edx, byte [rbp + 0x7f]
movzx ebx, r9b
movzx ecx, sil
not bl
movzx eax, bl
and al, byte [rcx + r15]
or al, dl
mov byte [rcx + r15], al
test r9b, r9b
je 0x14002e33d
test dil, dil
jne 0x14002e33d
xor edx, edx
movzx ecx, sil
call fcn.140024b70
mov rcx, qword [rbp - 0x61]
movzx r9d, byte [rbp + 0x77]
movzx edx, byte [rbp + 0x7f]
test ax, ax
je 0x14002e341
movzx eax, ax
and byte [rax + rcx], bl
jmp 0x14002e341
mov edx, 0xff
bt cx, 8
jae 0x14002e415
and cx, dx
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test al, al
je 0x14002e432
jmp 0x14002e42b
mov al, reloc.WSOCK32.dll_send
movzx eax, al
and byte [rax + r15], bl
mov edi, dword [rbp - 0x69]
xor r13d, r13d
mov ebx, 0xffdf
mov r15, qword [rbp - 0x59]
add r14, 2
movzx esi, byte [rbp - 0x6f]
cmp word [r14], 0
jne 0x14002df10
test edi, edi
je 0x14002e538
mov rbx, qword [rbp + 0x5f]
mov eax, dword [rbx + 0x30]
cmp edi, eax
jbe 0x14002e4bb
test eax, eax
je 0x14002e474
mov rcx, qword [rbx + 0x28]
call fcn.1400ca198
lea ecx, [rdi*2 + 2]
call fcn.1400ca1ac
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x14002e4b8
mov rax, qword [0x140134898]
lea rdx, str.Out_of_memory.
mov qword [rsp + 0x28], rax
lea rcx, [0x140134a20]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
call fcn.14000fb70
jmp 0x14002e566
mov dword [rbx + 0x30], edi
mov rsi, qword [rbp + 0x67]
mov rbx, qword [rbx + 0x28]
movzx eax, word [rsi]
test ax, ax
je 0x14002e532
nop dword [rax + rax]
cmp ax, 0x7b
je 0x14002e4e5
cmp ax, 0x7d
je 0x14002e525
mov word [rbx], ax
add rbx, 2
jmp 0x14002e525
lea rdi, [rsi + 2]
mov edx, 0x7d
mov rcx, rdi
call fcn.1400c50a4
mov rcx, rax
test rax, rax
je 0x14002e525
cmp rax, rdi
jne 0x14002e50f
add rax, 2
cmp word [rax], 0x7d
cmove rcx, rax
lea rax, [rsi + 4]
cmp rcx, rax
jne 0x14002e522
movzx eax, word [rdi]
mov word [rbx], ax
add rbx, 2
mov rsi, rcx
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14002e4d0
mov word [rbx], r13w
jmp 0x14002e561
mov rax, qword [rbp + 0x5f]
movzx r8d, byte [rbp + 0x6f]
test r8b, r8b
je 0x14002e561
cmp dword [rax + 0x30], 0
je 0x14002e556
mov rax, qword [rax + 0x28]
mov word [rax], r13w
jmp 0x14002e561
lea rcx, [0x140106cb0]
mov qword [rax + 0x28], rcx
mov eax, 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret