Function at 0x1400336d0
Capabilities:
Get keyboard layout

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
lea rdi, [rsp + 0x30]
mov ecx, 0x44
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x150]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor eax, eax
mov word [rsp + 0x34], ax
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x54], 0
mov rcx, qword [rsp + 0x150]
call fcn.14002d7b0
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x150]
cmp qword [rsp + 0xd8], rax
jne 0x140033771
mov rax, qword [rsp + 0x150]
movzx eax, word [rax]
test eax, eax
je 0x140033771
mov rax, qword [rsp + 0xd8]
add rax, 2
mov qword [rsp + 0xd8], rax
movzx eax, byte [rsp + 0x158]
test eax, eax
jne 0x14003388a
mov rax, qword [rsp + 0xd8]
movzx eax, word [rax]
cmp eax, 0x20
je 0x1400337a5
mov rax, qword [rsp + 0xd8]
movzx eax, word [rax]
cmp eax, 9
jne 0x14003388a
mov rcx, qword [rsp + 0xd8]
call fcn.140034a80
lea rdx, [0x140271a60]
mov rcx, rax
call fcn.1401a7920
test eax, eax
jne 0x14003388a
movzx eax, byte [rsp + 0x168]
test eax, eax
je 0x1400337df
mov eax, 1
jmp 0x140033c06
cmp qword [rsp + 0x160], 0
je 0x1400337f6
mov rax, qword [rsp + 0x160]
mov byte [rax + 0x16], 1
mov r8d, SafeArrayAllocDescriptor
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x90]
call fcn.1400ff430
mov rax, qword [rsp + 0x150]
mov rcx, qword [rsp + 0xd8]
sub rcx, rax
mov rax, rcx
sar rax, 1
cmp rax, 0x20
jae 0x140033878
mov rax, qword [rsp + 0x150]
mov rcx, qword [rsp + 0xd8]
sub rcx, rax
mov rax, rcx
sar rax, 1
shl rax, 1
mov qword [rsp + 0x108], rax
cmp qword [rsp + 0x108], 0x40
jae 0x140033861
jmp 0x140033866
call fcn.1401357e0
xor eax, eax
mov rcx, qword [rsp + 0x108]
mov word [rsp + rcx + 0x90], ax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x150], rax
jmp 0x1400338e2
movzx eax, byte [rsp + 0x168]
test eax, eax
je 0x1400338c9
mov rax, qword [rsp + 0xd8]
movzx eax, word [rax]
test eax, eax
je 0x1400338b2
mov dword [rsp + 0x118], 0
jmp 0x1400338bd
mov dword [rsp + 0x118], 1
mov eax, dword [rsp + 0x118]
jmp 0x140033c06
mov rax, qword [rsp + 0xd8]
movzx eax, word [rax]
test eax, eax
je 0x1400338e2
mov eax, 4
jmp 0x140033c06
cmp qword [rsp + 0x160], 0
je 0x140033903
mov rax, qword [rsp + 0x160]
add rax, 0x12
mov qword [rsp + 0x120], rax
jmp 0x140033913
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8b, 1
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0x150]
call fcn.14003e390
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x140033a3e
movzx eax, byte [rsp + 0x158]
test eax, eax
je 0x1400339ab
movzx eax, byte [rsp + 0x30]
cmp eax, 0x9c
jl 0x1400339a9
movzx eax, byte [rsp + 0x30]
cmp eax, 0x9f
jg 0x1400339a9
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
lea rcx, [0x140271a68]
call fcn.140022f20
jmp 0x140033c06
jmp 0x1400339ff
cmp qword [rsp + 0x160], 0
je 0x1400339ff
mov r8d, 2
lea rdx, [0x140271a98]
mov rcx, qword [rsp + 0x150]
call fcn.1401a82a0
test eax, eax
jne 0x1400339e1
mov dword [rsp + 0x128], 1
jmp 0x1400339ec
mov dword [rsp + 0x128], 0
mov rax, qword [rsp + 0x160]
movzx ecx, byte [rsp + 0x128]
mov byte [rax + 0x17], cl
movzx ecx, byte [rsp + 0x30]
call fcn.140028280
mov byte [rsp + 0x54], al
movzx eax, byte [rsp + 0x44]
and eax, 0x30
test eax, eax
je 0x140033a39
movzx eax, byte [rsp + 0x30]
cmp eax, 0x41
jl 0x140033a39
movzx eax, byte [rsp + 0x30]
cmp eax, 0x5a
jg 0x140033a39
movzx eax, byte [rsp + 0x44]
and eax, 0xffffffcf
mov byte [rsp + 0x44], al
jmp 0x140033b3a
xor edx, edx
mov rcx, qword [rsp + 0x150]
call fcn.14003dec0
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x34]
test eax, eax
jne 0x140033b3a
mov r8b, 1
lea rdx, [rsp + 0x64]
mov rcx, qword [rsp + 0x150]
call fcn.1400a3170
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x34]
test eax, eax
jne 0x140033ae0
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x150]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x140033ac2
movzx eax, byte [0x14032217c]
test eax, eax
jne 0x140033ac2
cmp qword [rsp + 0x160], 0
jne 0x140033abb
mov eax, 3
jmp 0x140033c06
xor eax, eax
jmp 0x140033c06
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
lea rcx, str.Invalid_key_name.
call fcn.140022f20
jmp 0x140033c06
movzx eax, byte [rsp + 0x158]
test eax, eax
je 0x140033b08
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
lea rcx, str.Unsupported_prefix_key.
call fcn.140022f20
jmp 0x140033c06
mov eax, dword [0x1403222c4]
inc eax
mov dword [0x1403222c4], eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], 4
movzx eax, byte [rsp + 0x64]
mov byte [rsp + 0x30], al
movsxd rax, dword [rsp + 0x64]
lea rcx, [0x1403222c8]
mov byte [rcx + rax], 1
movzx eax, byte [rsp + 0x54]
test eax, eax
je 0x140033b4e
mov rax, qword [rsp + 0xf8]
mov byte [rax], 2
movzx eax, byte [rsp + 0x158]
test eax, eax
je 0x140033b88
cmp qword [rsp + 0x160], 0
je 0x140033b86
mov rax, qword [rsp + 0x160]
movzx ecx, byte [rsp + 0x30]
mov byte [rax + 0x11], cl
mov rax, qword [rsp + 0x160]
movzx ecx, word [rsp + 0x34]
mov word [rax + 0xa], cx
jmp 0x140033c01
cmp qword [rsp + 0x160], 0
je 0x140033c01
mov rax, qword [rsp + 0x160]
movzx ecx, byte [rsp + 0x30]
mov byte [rax + 0x10], cl
mov rax, qword [rsp + 0x160]
movzx ecx, word [rsp + 0x34]
mov word [rax + 8], cx
movzx eax, byte [rsp + 0x44]
and eax, 0xd5
movzx ecx, al
call fcn.140036cd0
mov rcx, qword [rsp + 0x160]
mov ecx, dword [rcx]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x160]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x44]
and eax, 0x2a
mov rcx, qword [rsp + 0x160]
movzx ecx, byte [rcx + 0xe]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x160]
mov byte [rcx + 0xe], al
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WSOCK32.dll_connect
call fcn.140134a00
mov rax, rdi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140135520
add rsp, 0x140
pop rdi
ret