Function at 0x140007cf0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov word [rsp + 0x18], r8w
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0xf8]
sub rsp, 0x1f8
mov r10, qword [0x140105db8]
xor r11b, r11b
movzx ebx, dl
mov rax, rcx
mov esi, 1
test r10, r10
je 0x140007d9a
movabs rdi, 0xffffffff003c2c17
cmp dword [r10], esi
jne 0x140007d91
movzx ecx, byte [r10 + 0x5c]
test cl, cl
je 0x140007d5e
mov rdx, qword [rax + 0x10]
lea rax, [rdx + rdi]
cmp rax, 0x66
ja 0x140007d5e
dec cl
mov eax, 0xffc3d44d
movzx ecx, cl
sub eax, edx
cmp eax, ecx
jle 0x140007d8a
test r9b, r9b
je 0x140007d7d
movzx eax, r8w
cmp byte [rax + r10 + 0x174], 0
jl 0x140007dc6
movzx eax, bl
cmp byte [rax + r10 + 0x74], 0
jl 0x140007daf
cmp byte [r10 + 0x5f], 0
movzx r11d, r11b
cmovne r11d, esi
mov rax, qword [rbp + 0x120]
mov r10, qword [r10 + 8]
test r10, r10
jne 0x140007d32
test r9b, r9b
je 0x140007de1
movzx eax, sil
add rsp, 0x1f8
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, bl
and byte [rax + r10 + 0x74], 0x7f
xor al, al
add rsp, 0x1f8
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, r8w
and byte [rax + r10 + 0x174], 0x7f
xor al, al
add rsp, 0x1f8
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, byte [0x140106bb4]
xor edi, edi
mov qword [rsp + 0x228], r12
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1e8], r14
mov qword [rsp + 0x1e0], r15
movzx r15d, sil
test al, 0xcf
je 0x140007e2b
test r11b, r11b
jne 0x140007e2b
test al, 0xc
movzx r15d, sil
setne cl
test al, 3
setne al
test al, cl
cmove r15d, edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
mov r14d, edi
test rax, rax
je 0x140007e75
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x48
mov ecx, eax
mov r14d, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x140007e75
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140007e75
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp qword [0x140109b78], r12
mov r13, rax
je 0x140007ec9
mov r8d, 0x1c
mov qword [0x140109b78], r12
lea rdx, [rbp + 0xa0]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.ApplicationFrameWindow
lea rcx, [rbp + 0xa0]
call fcn.1400abda0
test eax, eax
sete r8b
mov byte [0x140109b75], r8b
jmp 0x140007ed1
movzx r8d, byte [0x140109b75]
xor eax, eax
mov word [rsp + 0x40], di
mov dword [rsp + 0x42], eax
lea rcx, [0x140106bc0]
lea rax, [rsp + 0x50]
mov edx, 2
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, rsi
jne 0x140007ef0
movzx r14d, byte [0x140109b74]
test r14b, r14b
je 0x140007ff3
test r8b, r8b
je 0x140007ff3
cmp bl, 0xe7
je 0x140007ff3
movzx eax, byte [0x140109b72]
neg al
movzx eax, byte [0x140109b73]
sbb dl, dl
and dl, 0x20
neg al
sbb cl, cl
and cl, 9
or dl, cl
lea rcx, [rsp + 0x50]
call fcn.140015a00
movzx edx, word [0x140109b70]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r13
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], edi
movzx ecx, r14b
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
jle 0x140007fec
movzx edx, word [0x140109b70]
lea r9, [rsp + 0x40]
movzx ecx, byte [0x140109b74]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov byte [0x140109b74], dil
movzx edx, byte [0x140106bb4]
lea rcx, [rsp + 0x50]
call fcn.140015a00
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14000801b
or byte [rsp + 0x64], sil
jmp 0x140008020
and byte [rsp + 0x64], 0xfe
mov r14, qword [rbp + 0x120]
cmp bl, 0xe7
jne 0x14000803b
movzx eax, word [r14 + 4]
mov word [rsp + 0x40], ax
jmp 0x1400080c0
test r15b, r15b
je 0x14000809f
mov edx, dword [r14 + 4]
lea r9, [rsp + 0x40]
mov eax, edi
mov qword [rsp + 0x30], r13
cmp dword [0x140105d80], eax
lea r8, [rsp + 0x50]
movzx ecx, bl
setne al
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test byte [0x140106bb4], 3
mov esi, eax
jne 0x1400080a1
cmp word [rsp + 0x40], 0xd
mov eax, 0xa
jne 0x140008090
mov word [rsp + 0x40], ax
cmp word [rsp + 0x42], 0xd
jne 0x1400080a1
mov word [rsp + 0x42], ax
jmp 0x1400080a1
mov esi, edi
cmp bl, 8
jne 0x1400080c0
test esi, esi
je 0x1400080c0
cmp byte [0x140109b75], dil
je 0x1400080be
mov esi, edi
mov byte [0x140109b74], sil
jmp 0x1400080c0
dec esi
movzx r8d, word [rbp + 0x130]
lea r9, [rsp + 0x40]
movzx edx, bl
mov dword [rsp + 0x20], esi
mov rcx, r14
call fcn.1400087a0
test al, al
je 0x14000821d
movzx r14d, byte [0x140109b74]
test r14b, r14b
je 0x1400080fa
test esi, esi
jle 0x1400080fa
mov r15b, 1
jmp 0x1400080fd
xor r15b, r15b
test esi, esi
jns 0x140008175
movzx eax, word [rbp + 0x130]
lea r9, [rsp + 0x40]
mov word [0x140109b70], ax
lea r8, [rsp + 0x50]
movzx eax, byte [0x140106bb4]
test al, 0x30
mov qword [rsp + 0x30], r13
mov byte [0x140109b74], bl
setne byte [0x140109b72]
test al, 0xc
setne cl
test al, 3
setne al
test al, cl
mov rax, qword [rbp + 0x120]
movzx ecx, bl
setne byte [0x140109b73]
cmp dword [0x140105d80], edi
mov edx, dword [rax + 4]
setne dil
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
jmp 0x14000829b
cmp dword [0x140106d58], edi
je 0x140008229
cmp byte [rbp + 0x140], dil
jne 0x140008229
cmp bl, 8
je 0x1400081b2
sub bl, 0x21
cmp bl, 7
ja 0x1400081da
cmp dword [0x140105fbc], edi
je 0x1400081da
mov word [0x140105fd0], di
mov dword [0x140105fbc], edi
jmp 0x1400081da
cmp byte [0x140106bb4], dil
jne 0x1400081da
mov eax, dword [0x140105fbc]
test eax, eax
je 0x1400081da
dec eax
lea rcx, [0x140105fd0]
mov dword [0x140105fbc], eax
cdqe
mov word [rcx + rax*2], di
test esi, esi
jle 0x140008229
mov rax, qword [rbp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x120]
mov r9, r12
mov qword [rsp + 0x30], rax
mov r8d, esi
mov rax, qword [rbp + 0x150]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x148]
mov qword [rsp + 0x20], rax
call fcn.1400082d0
test al, al
jne 0x140008221
xor al, al
jmp 0x14000829d
movzx r14d, byte [0x140109b74]
test r15b, r15b
je 0x14000829b
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.1400aad30
movzx eax, byte [0x140109b72]
neg al
movzx eax, byte [0x140109b73]
sbb dl, dl
and dl, 0x20
neg al
sbb cl, cl
and cl, 9
or dl, cl
lea rcx, [rsp + 0x50]
call fcn.140015a00
movzx edx, word [0x140109b70]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], r13
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], edi
movzx ecx, r14b
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov byte [0x140109b74], dil
mov al, 1
mov r14, qword [rsp + 0x1e8]
mov r13, qword [rsp + 0x1f0]
mov r12, qword [rsp + 0x228]
mov r15, qword [rsp + 0x1e0]
add rsp, 0x1f8
pop rdi
pop rsi
pop rbx
pop rbp
ret