Function at 0x1400215d0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov word [rsp + 0x18], r8w
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
movzx eax, byte [rbp + 0xf8]
mov r15, r9
movzx r13d, byte [rsp + 0x32]
movzx ebx, al
mov r14, qword [rsp + 0x48]
movzx esi, r8w
movzx edi, dl
mov edx, dword [rbp + 0x118]
mov dword [rsp + 0x38], eax
movzx eax, di
or ax, r8w
je 0x140021dae
test edx, edx
mov qword [rsp + 0x208], r12
mov eax, 0xffc3d44d
cmovne eax, edx
mov dword [rsp + 0x3c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x140133a78]
sete r12b
cmp dword [0x140136fcc], 0
je 0x140021662
mov byte [rsp + 0x31], 1
test r12b, r12b
je 0x140021667
mov byte [rsp + 0x31], 0
cmp dword [0x140136fcc], 1
je 0x140021675
test r12b, r12b
je 0x14002167c
mov byte [rbp + 0x110], 0
test dil, dil
jne 0x14002168e
movzx ecx, si
call fcn.140026810
movzx edi, al
jmp 0x1400216a8
test si, si
jne 0x1400216a8
xor edx, edx
movzx ecx, dil
call fcn.140026220
movzx esi, ax
mov word [rbp + 0x100], ax
movzx eax, si
lea rdx, [0x140000000]
xor esi, esi
shr ax, 8
test al, al
mov ecx, esi
setne cl
cmp dword [0x140136fcc], 2
mov dword [rsp + 0x40], ecx
jne case.default.0x1400216e6
movzx eax, dil
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x1400216e6
cdqe
mov ecx, dword [rdx + rax*4 + 0x21dc0]
add rcx, rdx
jmp rcx
mov dil, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x1400216e6
mov dil, reloc.WSOCK32.dll_recv
jmp case.default.0x1400216e6
mov dil, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r15, r15
je 0x140021877
movzx ebx, word [rbp + 0x100]
xor r8d, r8d
movzx edx, bx
movzx ecx, dil
call fcn.140024880
test al, al
je 0x140021801
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov esi, dword [rbp + 0xf0]
test esi, esi
jne 0x14002173c
movzx eax, dil
or byte [rsp + rax + 0x60], 0x80
jmp 0x14002174a
cmp esi, 1
jne 0x14002174a
movzx eax, dil
and byte [rsp + rax + 0x60], 0x7f
movzx eax, dil
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14002176f
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x21dd8]
add rcx, rdx
jmp rcx
test byte [rbp + 2], 0x80
jne 0x14002178f
test byte [rbp + 3], 0x80
jne 0x14002178f
and byte [rsp + 0x71], 0x7f
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140021807
or byte [rsp + 0x71], 0x80
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140021807
test byte [rbp], 0x80
jne 0x1400217bf
test byte [rbp + 1], 0x80
jne 0x1400217bf
and byte [rsp + 0x70], 0x7f
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140021807
or byte [rsp + 0x70], 0x80
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140021807
test byte [rbp + 4], 0x80
jne 0x1400217ef
test byte [rbp + 5], 0x80
jne 0x1400217ef
and byte [rsp + 0x72], 0x7f
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140021807
or byte [rsp + 0x72], 0x80
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140021807
mov esi, dword [rbp + 0xf0]
mov eax, ebx
shl eax, 0x10
movsxd rbx, eax
cmp esi, 1
je 0x14002182d
mov r9, rbx
movzx r8d, dil
or r9, 1
mov edx, 0x100
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0x110], 0
je 0x14002184f
cmp esi, 2
jne 0x14002184f
mov rcx, qword [0x14012f240]
mov ecx, dword [rcx + 0x84]
call fcn.140023890
jmp 0x140021857
test esi, esi
je 0x140021d7d
mov r9d, 0xc0000001
movzx r8d, dil
or r9, rbx
mov edx, 0x101
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140021d7d
cmp byte [0x14013290a], sil
mov eax, dword [rbp + 0xf0]
mov dword [0x140136f10], eax
mov byte [0x140136044], dil
je 0x1400218bb
cmp dil, 0x12
je 0x1400218a0
lea eax, [rdi + 0x5c]
cmp al, 1
ja 0x1400218bb
test r12b, r12b
jne 0x1400218bb
xor ecx, ecx
mov byte [rsp + 0x34], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14013290a], sil
jmp 0x1400218c0
mov byte [rsp + 0x34], sil
movzx r11d, byte [rsp + 0x31]
lea rax, [0x140136f14]
test r12b, r12b
lea r15, [rsp + 0x50]
cmove r15, rax
mov qword [rsp + 0x48], r15
cmp dil, 0xa5
jne 0x140021a62
test r11b, r11b
jne 0x140021a62
cmp qword [0x140132ae0], rsi
je 0x140021a62
mov byte [rsp + 0x30], 1
mov r13b, 1
mov byte [rbp + 0xf8], r13b
test r12b, r12b
jne 0x14002191e
mov r14, qword [0x140136fc0]
jmp 0x1400219c7
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, esi
test rax, rax
je 0x140021962
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x48
mov ecx, eax
mov ebx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x140021962
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x140021962
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r9, [0x140136f20]
mov byte [rsp + 0x30], 1
mov rdx, r9
mov byte [rbp + 0xf8], r13b
mov r14, rax
mov ecx, esi
mov r8, qword [rdx]
test r8, r8
je 0x1400219a1
cmp r8, r14
je 0x140021a24
inc ecx
add rdx, 0x10
cmp ecx, 0xa
jl 0x140021985
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
mov rcx, r14
movsxd rbx, eax
shl rbx, 4
add rbx, r9
call fcn.140024bb0
mov dword [rbx + 8], eax
mov qword [rbx], r14
mov dword [r15], eax
cmp dword [r15], esi
je 0x140021a31
movzx r10d, byte [rsp + 0x30]
mov byte [rbp + 0xf8], sil
mov r13d, dword [rsp + 0x3c]
movzx r15d, word [rbp + 0x100]
xor cl, cl
movzx r11d, byte [rsp + 0x31]
mov byte [rsp + 0x33], cl
test r12b, r12b
jne 0x140021ac2
mov eax, dword [0x140136fcc]
cmp eax, 2
je 0x140021ac2
cmp qword [0x140132ae0], rsi
je 0x140021a1c
cmp eax, 1
jne 0x140021ac2
mov r12b, 1
jmp 0x140021ac5
movsxd rax, ecx
add rax, rax
mov eax, dword [r9 + rax*8 + 8]
jmp 0x1400219c4
mov ecx, 0xa2
mov byte [rsp + 0x32], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r10d, byte [rsp + 0x30]
shr eax, 0xf
and al, r13b
mov r13d, dword [rsp + 0x3c]
mov dword [rsp + 0x38], eax
mov dword [0x140133948], r13d
jmp 0x1400219de
xor r10b, r10b
mov byte [rbp + 0xf8], sil
mov byte [rsp + 0x30], r10b
mov byte [rsp + 0x32], r13b
mov byte [rsp + 0x38], bl
test r11b, r11b
je 0x1400219d9
movzx r15d, word [rbp + 0x100]
xor r8d, r8d
movzx edx, r15w
movzx ecx, dil
call fcn.140024880
xor dl, dl
mov byte [rsp + 0x32], r13b
mov r13d, dword [rsp + 0x3c]
movzx ecx, al
mov byte [rbp + 0xf8], dl
mov byte [rsp + 0x33], al
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x30], r10b
jmp 0x1400219f2
xor r12b, r12b
mov eax, dword [rbp + 0xf0]
cmp eax, 1
je 0x140021bf9
test r11b, r11b
je 0x140021afa
mov r9d, dword [rsp + 0x40]
movzx r8d, r15w
movzx edx, dil
mov dword [rsp + 0x20], r13d
call fcn.140023200
mov rbx, qword [rsp + 0x48]
jmp 0x140021bdd
mov rbx, qword [rsp + 0x48]
test r10b, r10b
je 0x140021b10
cmp dword [rbx], 3
jne 0x140021b10
mov dword [0x140133944], r13d
mov r8d, dword [rsp + 0x40]
movzx edx, r15b
mov r9d, r13d
movzx ecx, dil
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x140133944], esi
cmp byte [rbp + 0xf8], sil
je 0x140021bdd
cmp dword [0x140133948], esi
mov byte [rbp + 0xf8], sil
je 0x140021bb8
lea r8, [0x140136f20]
mov dword [0x140133948], esi
mov rax, r8
mov ecx, esi
nop word [rax + rax]
mov rdx, qword [rax]
test rdx, rdx
je 0x140021b78
cmp rdx, r14
je 0x140021b9d
inc ecx
add rax, 0x10
cmp ecx, 0xa
jl 0x140021b60
cmp ecx, 0xa
mov eax, 9
cmovl eax, ecx
movsxd rcx, eax
mov eax, 4
add rcx, rcx
mov qword [r8 + rcx*8], r14
mov dword [r8 + rcx*8 + 8], 4
jmp 0x140021bdb
movsxd rcx, ecx
add rcx, rcx
mov eax, dword [r8 + rcx*8 + 8]
test eax, eax
jne 0x140021bdb
mov eax, 4
mov dword [r8 + rcx*8 + 8], eax
jmp 0x140021bdb
cmp byte [rsp + 0x38], sil
jne 0x140021bdd
movzx ecx, byte [rsp + 0x32]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
mov rcx, r14
sar edx, 0xf
add edx, 4
call fcn.140024da0
mov dword [rbx], eax
test r12b, r12b
je 0x140021bf1
movzx r8d, r15w
movzx edx, dil
xor ecx, ecx
call fcn.140023af0
mov eax, dword [rbp + 0xf0]
jmp 0x140021bfe
mov rbx, qword [rsp + 0x48]
cmp byte [rbp + 0x110], sil
je 0x140021c36
cmp eax, 2
jne 0x140021c36
cmp dword [0x140136fcc], 2
mov rax, qword [0x14012f240]
jne 0x140021c29
mov ecx, dword [rax + 0x88]
call fcn.140023890
jmp 0x140021c3e
mov ecx, dword [rax + 0x84]
call fcn.140023890
jmp 0x140021c3e
test eax, eax
je 0x140021d64
mov ecx, dword [rsp + 0x40]
or ecx, 2
cmp byte [rsp + 0x31], sil
je 0x140021c6b
mov r9d, ecx
mov dword [rsp + 0x20], r13d
movzx ecx, byte [rsp + 0x33]
movzx r8d, r15w
movzx edx, dil
call fcn.140023200
jmp 0x140021d39
cmp byte [rsp + 0x30], sil
je 0x140021c7e
cmp dword [rbx], 3
jne 0x140021c7e
mov dword [0x140133940], r13d
mov r8d, ecx
mov r9d, r13d
movzx ecx, dil
movzx edx, r15b
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x140133940], esi
cmp byte [rbp + 0xf8], sil
je 0x140021d39
cmp dword [0x140133948], esi
je 0x140021d14
lea rdx, [0x140136f20]
mov dword [0x140133948], esi
mov rax, rdx
nop dword [rax]
mov rcx, qword [rax]
test rcx, rcx
je 0x140021cd8
cmp rcx, r14
je 0x140021cfb
inc esi
add rax, 0x10
cmp esi, 0xa
jl 0x140021cc0
cmp esi, 0xa
mov eax, 9
cmovl eax, esi
cdqe
add rax, rax
mov qword [rdx + rax*8], r14
mov dword [rdx + rax*8 + 8], 4
mov eax, 4
jmp 0x140021d37
movsxd rcx, esi
add rcx, rcx
mov eax, dword [rdx + rcx*8 + 8]
test eax, eax
jne 0x140021d37
mov eax, 4
mov dword [rdx + rcx*8 + 8], eax
jmp 0x140021d37
cmp byte [rsp + 0x38], sil
je 0x140021d39
movzx ecx, byte [rsp + 0x32]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
sar eax, 0xf
mov rcx, r14
and eax, 1
lea edx, [rax + 3]
call fcn.140024da0
mov dword [rbx], eax
cmp dword [rbx], 0
je 0x140021d50
mov eax, 0x138
cmp r15w, ax
jne 0x140021d50
and byte [0x140136d18], 0xfe
test r12b, r12b
je 0x140021d64
movzx r8d, r15w
movzx edx, dil
mov cl, 1
call fcn.140023af0
cmp byte [rsp + 0x34], 0
je 0x140021d7d
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14013290a], 1
cmp byte [rbp + 0x110], 0
mov r12, qword [rsp + 0x208]
je 0x140021dae
cmp dword [0x140136fcc], 2
mov rax, qword [0x14012f240]
jne 0x140021da6
mov ecx, dword [rax + 0x80]
jmp 0x140021da9
mov ecx, dword [rax + 0x7c]
call fcn.140023890
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret