Function at 0x14001e3e0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov word [rsp + 0x18], r8w
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
movzx eax, byte [rbp + 0xf8]
mov r15, r9
movzx r13d, byte [rsp + 0x32]
movzx ebx, al
mov r14, qword [rsp + 0x48]
movzx edi, r8w
movzx esi, dl
mov edx, dword [rbp + 0x118]
mov dword [rsp + 0x38], eax
movzx eax, si
or ax, r8w
je 0x14001ebc0
test edx, edx
mov qword [rsp + 0x208], r12
mov eax, 0xffc3d44d
cmovne eax, edx
mov dword [rsp + 0x3c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x140135008]
sete r12b
cmp dword [0x140137580], 0
je 0x14001e472
mov byte [rsp + 0x31], 1
test r12b, r12b
je 0x14001e477
mov byte [rsp + 0x31], 0
cmp dword [0x140137580], 1
je 0x14001e485
test r12b, r12b
je 0x14001e48c
mov byte [rbp + 0x110], 0
test sil, sil
jne 0x14001e49e
movzx ecx, di
call fcn.140023560
movzx esi, al
jmp 0x14001e4b8
test di, di
jne 0x14001e4b8
xor edx, edx
movzx ecx, sil
call fcn.140022f70
movzx edi, ax
mov word [rbp + 0x100], ax
movzx eax, di
lea rdx, [0x140000000]
xor edi, edi
shr ax, 8
test al, al
mov ecx, edi
setne cl
cmp dword [0x140137580], 2
mov dword [rsp + 0x40], ecx
jne case.default.0x14001e4f6
movzx eax, sil
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001e4f6
cdqe
mov ecx, dword [rdx + rax*4 + 0x1ebd4]
add rcx, rdx
jmp rcx
mov sil, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x14001e4f6
mov sil, reloc.WSOCK32.dll_recv
jmp case.default.0x14001e4f6
mov sil, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r15, r15
je 0x14001e690
movzx ebx, word [rbp + 0x100]
xor r8d, r8d
movzx edx, bx
movzx ecx, sil
call fcn.1400216b0
test al, al
je 0x14001e614
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r14d, dword [rbp + 0xf0]
test r14d, r14d
jne 0x14001e54e
movzx eax, sil
or byte [rsp + rax + 0x60], 0x80
jmp 0x14001e55d
cmp r14d, 1
jne 0x14001e55d
movzx eax, sil
and byte [rsp + rax + 0x60], 0x7f
movzx eax, sil
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001e582
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1ebec]
add rcx, rdx
jmp rcx
test byte [rbp + 2], 0x80
jne 0x14001e5a2
test byte [rbp + 3], 0x80
jne 0x14001e5a2
and byte [rsp + 0x71], 0x7f
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x14001e61b
or byte [rsp + 0x71], 0x80
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x14001e61b
test byte [rbp], 0x80
jne 0x14001e5d2
test byte [rbp + 1], 0x80
jne 0x14001e5d2
and byte [rsp + 0x70], 0x7f
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x14001e61b
or byte [rsp + 0x70], 0x80
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x14001e61b
test byte [rbp + 4], 0x80
jne 0x14001e602
test byte [rbp + 5], 0x80
jne 0x14001e602
and byte [rsp + 0x72], 0x7f
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x14001e61b
or byte [rsp + 0x72], 0x80
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x14001e61b
mov r14d, dword [rbp + 0xf0]
mov eax, ebx
movzx edi, sil
shl eax, 0x10
movsxd rbx, eax
cmp r14d, 1
je 0x14001e645
mov r9, rbx
mov r8d, edi
or r9, 1
mov edx, 0x100
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0x110], 0
je 0x14001e668
cmp r14d, 2
jne 0x14001e668
mov rcx, qword [0x14012fc08]
mov ecx, dword [rcx + 0x84]
call fcn.140020720
jmp 0x14001e671
test r14d, r14d
je 0x14001eb8f
mov r9d, 0xc0000001
mov r8, rdi
or r9, rbx
mov edx, 0x101
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001eb8f
cmp byte [0x14013408f], dil
mov eax, dword [rbp + 0xf0]
mov dword [0x1401374b0], eax
mov byte [0x1401372dc], sil
je 0x14001e6d4
cmp sil, 0x12
je 0x14001e6b9
lea eax, [rsi + 0x5c]
cmp al, 1
ja 0x14001e6d4
test r12b, r12b
jne 0x14001e6d4
xor ecx, ecx
mov byte [rsp + 0x34], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14013408f], dil
jmp 0x14001e6d9
mov byte [rsp + 0x34], dil
movzx r11d, byte [rsp + 0x31]
lea rax, [0x140137568]
test r12b, r12b
lea r15, [rsp + 0x50]
cmove r15, rax
mov qword [rsp + 0x48], r15
cmp sil, 0xa5
jne 0x14001e87d
test r11b, r11b
jne 0x14001e87d
cmp qword [0x140134268], rdi
je 0x14001e87d
mov byte [rsp + 0x30], 1
mov r13b, 1
mov byte [rbp + 0xf8], r13b
test r12b, r12b
jne 0x14001e737
mov r14, qword [0x140137560]
jmp 0x14001e7e2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, edi
test rax, rax
je 0x14001e77b
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x48
mov ecx, eax
mov ebx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14001e77b
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x14001e77b
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r9, [0x1401374c0]
mov byte [rsp + 0x30], 1
mov rdx, r9
mov byte [rbp + 0xf8], r13b
mov r14, rax
mov ecx, edi
nop
mov r8, qword [rdx]
test r8, r8
je 0x14001e7bc
cmp r8, r14
je 0x14001e83f
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x14001e7a0
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, r14
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.1400219e0
mov dword [rbx + 8], eax
mov qword [rbx], r14
mov dword [r15], eax
cmp dword [r15], edi
je 0x14001e84c
movzx r10d, byte [rsp + 0x30]
mov byte [rbp + 0xf8], dil
mov r13d, dword [rsp + 0x3c]
movzx r15d, word [rbp + 0x100]
xor cl, cl
movzx r11d, byte [rsp + 0x31]
mov byte [rsp + 0x33], cl
test r12b, r12b
jne 0x14001e8dd
mov eax, dword [0x140137580]
cmp eax, 2
je 0x14001e8dd
cmp qword [0x140134268], rdi
je 0x14001e837
cmp eax, 1
jne 0x14001e8dd
mov r12b, 1
jmp 0x14001e8e0
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x14001e7df
mov ecx, 0xa2
mov byte [rsp + 0x32], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r10d, byte [rsp + 0x30]
shr eax, 0xf
and al, r13b
mov r13d, dword [rsp + 0x3c]
mov dword [rsp + 0x38], eax
mov dword [0x140135000], r13d
jmp 0x14001e7f9
xor r10b, r10b
mov byte [rbp + 0xf8], dil
mov byte [rsp + 0x30], r10b
mov byte [rsp + 0x32], r13b
mov byte [rsp + 0x38], bl
test r11b, r11b
je 0x14001e7f4
movzx r15d, word [rbp + 0x100]
xor r8d, r8d
movzx edx, r15w
movzx ecx, sil
call fcn.1400216b0
xor dl, dl
mov byte [rsp + 0x32], r13b
mov r13d, dword [rsp + 0x3c]
movzx ecx, al
mov byte [rbp + 0xf8], dl
mov byte [rsp + 0x33], al
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x30], r10b
jmp 0x14001e80d
xor r12b, r12b
mov eax, dword [rbp + 0xf0]
cmp eax, 1
je 0x14001ea0e
test r11b, r11b
je 0x14001e915
mov r9d, dword [rsp + 0x40]
movzx r8d, r15w
movzx edx, sil
mov dword [rsp + 0x20], r13d
call fcn.140020160
mov rbx, qword [rsp + 0x48]
jmp 0x14001e9f2
mov rbx, qword [rsp + 0x48]
test r10b, r10b
je 0x14001e92b
cmp dword [rbx], 3
jne 0x14001e92b
mov dword [0x140134ffc], r13d
mov r8d, dword [rsp + 0x40]
movzx edx, r15b
mov r9d, r13d
movzx ecx, sil
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x140134ffc], edi
cmp byte [rbp + 0xf8], dil
je 0x14001e9f2
cmp dword [0x140135000], edi
mov byte [rbp + 0xf8], dil
je 0x14001e9cd
lea r8, [0x1401374c0]
mov dword [0x140135000], edi
mov rax, r8
mov ecx, edi
mov rdx, qword [rax]
test rdx, rdx
je 0x14001e98d
cmp rdx, r14
je 0x14001e9b2
inc ecx
add rax, 0x10
cmp ecx, 0xa
jl 0x14001e975
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
movsxd rcx, eax
mov eax, 4
add rcx, rcx
mov qword [r8 + rcx*8], r14
mov dword [r8 + rcx*8 + 8], 4
jmp 0x14001e9f0
movsxd rcx, ecx
add rcx, rcx
mov eax, dword [r8 + rcx*8 + 8]
test eax, eax
jne 0x14001e9f0
mov eax, 4
mov dword [r8 + rcx*8 + 8], eax
jmp 0x14001e9f0
cmp byte [rsp + 0x38], dil
jne 0x14001e9f2
movzx ecx, byte [rsp + 0x32]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
mov rcx, r14
sar edx, 0xf
add edx, 4
call fcn.140021bd0
mov dword [rbx], eax
test r12b, r12b
je 0x14001ea06
movzx r8d, r15w
movzx edx, sil
xor ecx, ecx
call fcn.140020930
mov eax, dword [rbp + 0xf0]
jmp 0x14001ea13
mov rbx, qword [rsp + 0x48]
cmp byte [rbp + 0x110], dil
je 0x14001ea4b
cmp eax, 2
jne 0x14001ea4b
cmp dword [0x140137580], 2
mov rax, qword [0x14012fc08]
jne 0x14001ea3e
mov ecx, dword [rax + 0x88]
call fcn.140020720
jmp 0x14001ea53
mov ecx, dword [rax + 0x84]
call fcn.140020720
jmp 0x14001ea53
test eax, eax
je 0x14001eb76
mov ecx, dword [rsp + 0x40]
or ecx, 2
cmp byte [rsp + 0x31], dil
je 0x14001ea80
mov r9d, ecx
mov dword [rsp + 0x20], r13d
movzx ecx, byte [rsp + 0x33]
movzx r8d, r15w
movzx edx, sil
call fcn.140020160
jmp 0x14001eb4b
cmp byte [rsp + 0x30], dil
je 0x14001ea93
cmp dword [rbx], 3
jne 0x14001ea93
mov dword [0x140134ff8], r13d
mov r8d, ecx
mov r9d, r13d
movzx ecx, sil
movzx edx, r15b
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x140134ff8], edi
cmp byte [rbp + 0xf8], dil
je 0x14001eb4b
cmp dword [0x140135000], edi
je 0x14001eb26
lea rdx, [0x1401374c0]
mov dword [0x140135000], edi
mov rax, rdx
mov rcx, qword [rax]
test rcx, rcx
je 0x14001eaea
cmp rcx, r14
je 0x14001eb0d
inc edi
add rax, 0x10
cmp edi, 0xa
jl 0x14001ead2
cmp edi, 0xa
mov eax, 9
cmovl eax, edi
cdqe
add rax, rax
mov qword [rdx + rax*8], r14
mov dword [rdx + rax*8 + 8], 4
mov eax, 4
jmp 0x14001eb49
movsxd rcx, edi
add rcx, rcx
mov eax, dword [rdx + rcx*8 + 8]
test eax, eax
jne 0x14001eb49
mov eax, 4
mov dword [rdx + rcx*8 + 8], eax
jmp 0x14001eb49
cmp byte [rsp + 0x38], dil
je 0x14001eb4b
movzx ecx, byte [rsp + 0x32]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
sar eax, 0xf
mov rcx, r14
and eax, 1
lea edx, [rax + 3]
call fcn.140021bd0
mov dword [rbx], eax
cmp dword [rbx], 0
je 0x14001eb62
mov eax, 0x138
cmp r15w, ax
jne 0x14001eb62
and byte [0x14013746c], 0xfe
test r12b, r12b
je 0x14001eb76
movzx r8d, r15w
movzx edx, sil
mov cl, 1
call fcn.140020930
cmp byte [rsp + 0x34], 0
je 0x14001eb8f
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14013408f], 1
cmp byte [rbp + 0x110], 0
mov r12, qword [rsp + 0x208]
je 0x14001ebc0
cmp dword [0x140137580], 2
mov rax, qword [0x14012fc08]
jne 0x14001ebb8
mov ecx, dword [rax + 0x80]
jmp 0x14001ebbb
mov ecx, dword [rax + 0x7c]
call fcn.140020720
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret