Function at 0x14001b090
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r14
sub rsp, 0x158
movzx ebx, cl
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea edx, [rbx - 0x41]
mov r14, rax
cmp dl, 0x19
ja 0x14001b38d
mov qword [rsp + 0x180], rbp
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x148], rdi
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x140], r15
call fcn.1400e1940
xor ebp, ebp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebp
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 2
xor edx, edx
lea ecx, [rbp + 0x6e]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x178]
cmp eax, 2
mov dword [rsp + 0x28], ebp
movzx edi, bp
mov dword [rsp + 0x20], 2
cmove di, word [rsp + 0x178]
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov r15d, eax
test eax, eax
jns 0x14001b175
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x170]
mov dword [rsp + 0x28], ebp
lea r8, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x20], 2
lea ecx, [rbp + 0x6e]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test di, di
je 0x14001b35a
mov qword [rsp + 0x150], rsi
cmp di, 0xa
jne 0x14001b19c
movzx edx, byte [rsp + 0x170]
mov r9b, SafeArrayDestroy
jmp 0x14001b26b
mov rdx, r14
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx r9, ax
mov r8, r9
shr r8, 8
cmp r8b, 0xff
jne 0x14001b217
cmp r9b, 0xff
jne 0x14001b217
movzx esi, di
test esi, 0xffffff80
jne 0x14001b352
mov edx, 0x103
mov ecx, esi
call fcn.1400e8e20
test eax, eax
je 0x14001b352
mov edx, 2
mov ecx, esi
call fcn.1400e8e20
mov edx, 1
movzx edi, dil
mov ecx, esi
mov ebx, eax
call fcn.1400e8e20
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx r9d, cl
cmove r9d, edi
test r8b, 0x38
jne 0x14001b352
movzx edx, byte [rsp + 0x170]
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x14001b238
or dl, 8
jmp 0x14001b254
test r8b, 2
je 0x14001b246
test dl, 3
jne 0x14001b246
or dl, 1
test r8b, 4
je 0x14001b254
test dl, 0xc
jne 0x14001b254
or dl, 4
test r8b, 1
je 0x14001b262
test dl, 0x30
jne 0x14001b262
or dl, 0x10
test r9b, r9b
je 0x14001b352
movzx ecx, dl
movzx r8d, dl
movzx r10d, dl
movzx ebx, dl
movzx r11d, dl
movzx eax, dl
and cl, 0xf0
and r8b, 0xe0
and r10b, 0xfe
shl cl, 3
and bl, 0xfc
shl r8b, 2
and r11b, 0xf8
shl r10b, 6
and al, 0xc0
shl bl, 5
movzx edi, dl
shl r11b, 4
add al, al
shl dil, 7
and dl, 0x80
mov byte [rsp + 0xe0], cl
mov byte [rsp + 0xe1], r8b
mov byte [rsp + 0xe2], dil
mov byte [rsp + 0xe3], r10b
mov byte [rsp + 0xe4], bl
mov byte [rsp + 0xe5], r11b
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x9c], dl
test cl, cl
jne 0x14001b2fb
test r8b, r8b
jne 0x14001b2fb
xor al, al
jmp 0x14001b2fd
mov al, 0x80
mov byte [rsp + 0x50], al
test dil, dil
jne 0x14001b30f
test r10b, r10b
jne 0x14001b30f
xor al, al
jmp 0x14001b311
mov al, 0x80
mov byte [rsp + 0x51], al
test bl, bl
jne 0x14001b322
test r11b, r11b
jne 0x14001b322
xor al, al
jmp 0x14001b324
mov al, 0x80
movzx ecx, r9b
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x170]
mov dword [rsp + 0x28], ebp
xor edx, edx
mov dword [rsp + 0x20], 2
mov byte [rsp + 0x52], al
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x148]
test r15d, r15d
mov r15, qword [rsp + 0x140]
je 0x14001b377
movzx ebp, word [rsp + 0x178]
movzx eax, bp
mov rbp, qword [rsp + 0x180]
add rsp, 0x158
pop r14
pop rbx
ret
mov ecx, ebx
mov r8, r14
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
add rsp, 0x158
pop r14
pop rbx
ret