Function at 0x1401670c0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
xor r15d, r15d
xor ecx, ecx
call sub.user32.dll_GetKeyboardLayout
mov rsi, rax
xchg qword [0x140222408], rax
cmp rsi, rax
jne 0x140167100
movzx eax, byte [0x140222410]
test al, al
jne 0x1401673b3
jmp 0x1401673cd
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x61], 0x8080
movaps xmmword [rsp + 0x240], xmm0
movaps xmmword [rsp + 0x230], xmm0
movaps xmmword [rsp + 0x220], xmm0
movaps xmmword [rsp + 0x210], xmm0
movaps xmmword [rsp + 0x200], xmm0
movaps xmmword [rsp + 0x1f0], xmm0
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmmword [rsp + 0x1d0], xmm0
movaps xmmword [rsp + 0x1c0], xmm0
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x190], xmm0
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x170], xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x150], xmm0
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x50]
xor r13d, r13d
nop
test r13b, 1
jne 0x1401673c5
lea r12d, [r15 + 1]
cmp r15d, 0xff
setae r13b
mov eax, 0xff
cmovae r12d, eax
mov word [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
mov ecx, r15d
xor edx, edx
lea r8, [rsp + 0x150]
mov r9, rbx
call sub.user32.dll_ToUnicodeEx
mov ebp, 0x110000
mov edi, 0x110000
test eax, eax
jle 0x1401672e2
movzx eax, word [rsp + 0x40]
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x1401672e0
cmp eax, 0xdbff
ja 0x1401672e2
movzx ecx, word [rsp + 0x42]
lea edx, [rcx + 0x2000]
movzx edx, dx
cmp edx, 0xfc00
jb 0x1401672e2
and eax, 0x3ff
and ecx, 0x3ff
shl rax, 0x1a
shl rcx, 0x10
movabs rdx, 0x100000000
add rax, rdx
or rax, rcx
shr rax, 0x10
nop word cs:[rax + rax]
mov edi, eax
mov word [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
mov ecx, r15d
xor edx, edx
mov r8, r14
mov r9, rbx
call sub.user32.dll_ToUnicodeEx
test eax, eax
jle 0x140167382
movzx eax, word [rsp + 0x40]
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x140167380
cmp eax, 0xdbff
ja 0x140167382
movzx ecx, word [rsp + 0x42]
lea edx, [rcx + 0x2000]
movzx edx, dx
cmp edx, 0xfc00
jb 0x140167382
and eax, 0x3ff
and ecx, 0x3ff
shl rax, 0x1a
shl rcx, 0x10
movabs rdx, 0x100000000
add rax, rdx
or rax, rcx
shr rax, 0x10
nop word cs:[rax + rax]
mov ebp, eax
mov r15d, r12d
cmp edi, ebp
je 0x140167210
mov r15d, r12d
cmp edi, 0x110000
je 0x140167210
mov r15d, r12d
cmp ebp, 0x110000
je 0x140167210
mov al, 1
xchg byte [0x140222410], al
mov ecx, 0xa5
call sub.user32.dll_GetKeyState
test ax, ax
setns bl
jmp 0x1401673cf
xor eax, eax
xchg byte [0x140222410], al
mov bl, 1
mov ecx, 0x10
call sub.user32.dll_GetKeyState
movzx esi, ax
shr esi, 0xf
lea edi, [rsi*4]
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
lea r14d, [rsi*4 + 0x20]
cmovns r14d, edi
test bl, bl
cmove r14d, edi
mov ecx, 0x12
call sub.user32.dll_GetKeyState
lea esi, [r14 + 0x100]
test ax, ax
cmovns esi, r14d
test bl, bl
cmove esi, r14d
mov ecx, 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
js 0x140167449
mov ecx, 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
js 0x140167449
and esi, 0xf7ff
jmp 0x14016744f
or esi, 0x800
mov eax, esi
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret