Function at 0x140023c10
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r14
sub rsp, 0x158
movzx ebx, cl
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea edx, [rbx - 0x41]
mov r14, rax
cmp dl, 0x19
ja 0x140023f10
mov qword [rsp + 0x180], rbp
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x148], rdi
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x140], r15
call sub.VCRUNTIME140.dll_memset
xor ebp, ebp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebp
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 2
xor edx, edx
lea ecx, [rbp + 0x6e]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x178]
cmp eax, 2
mov dword [rsp + 0x28], ebp
movzx edi, bp
mov dword [rsp + 0x20], 2
cmove di, word [rsp + 0x178]
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov r15d, eax
test eax, eax
jns 0x140023cf5
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x170]
mov dword [rsp + 0x28], ebp
lea r8, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x20], 2
lea ecx, [rbp + 0x6e]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test di, di
je 0x140023edd
mov qword [rsp + 0x150], rsi
cmp di, 0xa
jne 0x140023d1c
movzx edx, byte [rsp + 0x170]
mov r9b, ntohs
jmp 0x140023dee
mov rdx, r14
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx r9, ax
mov r8, r9
shr r8, 8
cmp r8b, 0xff
jne 0x140023d9a
cmp r9b, 0xff
jne 0x140023d9a
movzx esi, di
test esi, 0xffffff80
jne 0x140023ed5
mov edx, 0x103
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x140023ed5
mov edx, 2
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov edx, 1
movzx edi, dil
mov ecx, esi
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx r9d, cl
cmove r9d, edi
test r8b, 0x38
jne 0x140023ed5
movzx edx, byte [rsp + 0x170]
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x140023dbb
or dl, 8
jmp 0x140023dd7
test r8b, 2
je 0x140023dc9
test dl, 3
jne 0x140023dc9
or dl, 1
test r8b, 4
je 0x140023dd7
test dl, 0xc
jne 0x140023dd7
or dl, 4
test r8b, 1
je 0x140023de5
test dl, 0x30
jne 0x140023de5
or dl, 0x10
test r9b, r9b
je 0x140023ed5
movzx ecx, dl
movzx r8d, dl
movzx r10d, dl
movzx ebx, dl
movzx r11d, dl
movzx eax, dl
and cl, 0xf0
and r8b, 0xe0
and r10b, 0xfe
shl cl, 3
and bl, 0xfc
shl r8b, 2
and r11b, 0xf8
shl r10b, 6
and al, 0xc0
shl bl, 5
movzx edi, dl
shl r11b, 4
add al, al
shl dil, 7
and dl, 0x80
mov byte [rsp + 0xe0], cl
mov byte [rsp + 0xe1], r8b
mov byte [rsp + 0xe2], dil
mov byte [rsp + 0xe3], r10b
mov byte [rsp + 0xe4], bl
mov byte [rsp + 0xe5], r11b
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x9c], dl
test cl, cl
jne 0x140023e7e
test r8b, r8b
jne 0x140023e7e
xor al, al
jmp 0x140023e80
mov al, pe_nt_image_headers64
mov byte [rsp + 0x50], al
test dil, dil
jne 0x140023e92
test r10b, r10b
jne 0x140023e92
xor al, al
jmp 0x140023e94
mov al, pe_nt_image_headers64
mov byte [rsp + 0x51], al
test bl, bl
jne 0x140023ea5
test r11b, r11b
jne 0x140023ea5
xor al, al
jmp 0x140023ea7
mov al, pe_nt_image_headers64
movzx ecx, r9b
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x170]
mov dword [rsp + 0x28], ebp
xor edx, edx
mov dword [rsp + 0x20], 2
mov byte [rsp + 0x52], al
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x148]
test r15d, r15d
mov r15, qword [rsp + 0x140]
je 0x140023efa
movzx ebp, word [rsp + 0x178]
movzx eax, bp
mov rbp, qword [rsp + 0x180]
add rsp, 0x158
pop r14
pop rbx
ret
mov ecx, ebx
mov r8, r14
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
add rsp, 0x158
pop r14
pop rbx
ret