Function at 0x140183cc0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, r8
mov r15d, ecx
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdx, qword [0x140404fc0]
test rdx, rdx
je 0x140183d03
cmp qword [rdx], rax
je 0x140183d77
mov rdx, qword [0x140404fc8]
mov qword [0x140404fc0], 0
test rdx, rdx
jne 0x140183d29
jmp 0x140183d2e
mov rdx, qword [rdx + 0x28]
test rdx, rdx
je 0x140183d2e
cmp qword [rdx], rax
jne 0x140183d20
mov r9d, 0x270
lea r8, str.keycode_to_unicode
lea rdx, str._s___u_:_Refreshing_locale_cache._n
xor esi, esi
mov ecx, 1
call qword [case.0x1401833e5.0]
call fcn.140182c30
mov rax, qword [0x140404fc0]
test rax, rax
jne 0x140183d74
mov rax, rsi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rax]
mov r9d, 0x27e
mov ecx, 2
mov qword [rsp + 0x20], rax
lea r8, str.keycode_to_unicode
lea rdx, str._s___u_:_Using_keyboard_layout__p._n
call qword [case.0x1401833e5.0]
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x36], ax
mov rax, qword [0x140404fc0]
mov r14, qword [rax + 0x10]
mov rbx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
movzx ecx, byte [r14]
mov qword [rsp + 0x38], rax
test cl, cl
je 0x140184020
mov byte [rsp + 0x35], 0
mov rsi, qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r12d, r12d
xor r13d, r13d
jmp 0x140183df5
movzx ecx, byte [r14 + 2]
add r14, 2
test cl, cl
je 0x140183e30
call rsi
test ax, ax
jns 0x140183de8
movzx eax, byte [r14]
cmp al, 0x10
je 0x140183f40
cmp al, 0x11
je 0x140183f50
cmp al, 0x12
mov eax, 1
cmove r12d, eax
movzx ecx, byte [r14 + 2]
add r14, 2
test cl, cl
jne 0x140183df5
nop dword [rax + rax]
cmp byte [rsp + 0x35], 0
movzx r8d, r13b
je 0x140183e46
lea eax, [r8 + 3]
test r12b, r12b
cmovne r8d, eax
movzx r11d, word [0x1401c3954]
xor esi, esi
jmp 0x140183e65
add rbx, 0x10
test r9d, r9d
je 0x140183f00
movzx r9d, byte [rbx + 9]
lea ecx, [r9 - 2]
mov eax, ecx
shr eax, 0x1f
add eax, ecx
sar eax, 1
mov ecx, eax
mov rax, qword [rbx]
test rax, rax
je 0x140183e58
cmp r8d, ecx
jge 0x140183e58
lea r14d, [rcx + 1]
mov rcx, r14
add r14, r14
jmp 0x140183ea0
add rax, r14
cmp byte [rax], 0
je 0x140183e58
movzx r12d, byte [rax]
cmp r12d, r15d
jne 0x140183e98
cmp byte [rax + 1], 1
jne 0x140183eba
test byte [rsp + 0x36], 1
jne 0x140183fdc
movsxd r12, r8d
movzx r14d, word [rax + r12*2 + 2]
cmp r14w, 0xf001
je 0x140183fa0
cmp r14w, 0xf000
je 0x140183e58
test rbp, rbp
je 0x140183e58
mov word [rdi], r14w
mov esi, 1
add rbx, 0x10
test r9d, r9d
jne 0x140183e65
nop word cs:[rax + rax]
cmp r11w, 0xf000
je 0x140183d60
mov rbx, qword [rsp + 0x38]
mov eax, dword [rbx]
test eax, eax
je 0x140183d60
add rbx, 8
test rbp, rbp
jne 0x140183f96
nop dword [rax]
mov edx, dword [rbx]
add rbx, 8
test edx, edx
jne 0x140183f28
jmp 0x140183d60
mov r13d, 1
jmp 0x140183de8
mov byte [rsp + 0x35], 1
jmp 0x140183de8
shr eax, 0x10
cmp word [0x1401c3954], ax
jne 0x140183f88
mov eax, 0xfffff000
mov word [0x1401c3954], ax
cmp rbp, rsi
jae 0x14018400c
nop dword [rax]
mov eax, dword [rbx]
add rbx, 8
test eax, eax
je 0x140183d60
cmp word [rdi], ax
jne 0x140183f88
jmp 0x140183f60
cmp r11w, 0xf000
je 0x140183fef
cmp rbp, 1
jbe 0x140183e58
movzx eax, r11b
shl r11d, 8
mov ecx, 0xfffff000
mov esi, 2
add eax, r11d
mov word [0x1401c3954], cx
mov r11d, 0xfffff000
mov word [rdi], ax
jmp 0x140183e58
test r8d, r8d
jle 0x14018402b
test r13b, r13b
je 0x14018402b
sub r8d, 1
jmp 0x140183eba
movsxd rcx, ecx
add r12, r12
lea rcx, [r12 + rcx*2]
movzx r11d, word [rax + rcx + 2]
mov word [0x1401c3954], r11w
jmp 0x140183e58
movzx edx, word [rbx - 4]
mov r8, rsi
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x140183f88
xor r13d, r13d
xor r8d, r8d
jmp 0x140183e46
add r8d, 1
jmp 0x140183eba