Function at 0x1801fa350
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor esi, esi
movzx ebx, cl
lea eax, [rcx - 0x70]
mov rdi, rdx
mov ebp, esi
cmp al, 0xb
ja 0x1801fa38f
lea r9d, [rbx - 0x6f]
lea r8, [0x1803d3e50]
jmp 0x1801fa3c9
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x1801fa3a2
mov r9d, ebx
lea r8, [0x1803e03ec]
jmp 0x1801fa3c9
lea eax, [rcx - 0x60]
cmp al, 9
ja 0x1801fa3b6
lea r9d, [rbx - 0x60]
lea r8, str.Num_d
jmp 0x1801fa3c9
sub cl, 0x30
cmp cl, 9
ja 0x1801fa3dd
lea r9d, [rbx - 0x30]
lea r8, [0x1803d2580]
mov ebx, 8
mov rcx, rdi
mov edx, ebx
call fcn.1801890e0
jmp 0x1801fa707
lea eax, [rbx - 0x25]
cmp eax, 0x98
ja case.0x1801fa406.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x1fa794]
mov ecx, dword [rdx + rax*4 + 0x1fa76c]
add rcx, rdx
jmp rcx
mov ebx, 8
lea r8, [0x1803d24a0]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
nop dword [rax]
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa420
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], si
mov eax, 0x8007007a
cmovne eax, esi
jmp 0x1801fa707
mov ebx, 8
lea r8, [0x1803df0d8]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa472
jmp 0x1801fa443
mov ebx, 8
lea r8, [0x1803d0510]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa4b0
jmp 0x1801fa443
mov ebx, 8
lea r8, [0x1803cf950]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa4f0
jmp 0x1801fa443
mov ebx, 8
lea r8, [0x1803e03e0]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa540
jmp 0x1801fa443
mov ebx, 8
lea r8, [0x1803e03e8]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa590
jmp 0x1801fa443
mov ebx, 8
lea r8, [0x1803e03d4]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa5e0
jmp 0x1801fa443
mov ebx, 8
lea r8, [0x1803e03d8]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa630
jmp 0x1801fa443
mov ebx, 8
lea r8, [0x1803e03d0]
mov edx, ebx
sub r8, rdi
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffff6]
test rax, rax
je 0x1801fa443
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1801fa443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801fa680
jmp 0x1801fa443
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov ecx, ebx
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xa0
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
shl ebx, 0x10
lea rdx, [rsp + 0x20]
mov ecx, ebx
mov r8d, 0x50
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
jle 0x1801fa742
mov ebx, 8
lea r8, [rsp + 0x20]
mov edx, ebx
mov rcx, rdi
call fcn.1800c68a0
test eax, eax
je 0x1801fa712
cmp eax, 0x8007007a
jne 0x1801fa742
test rdi, rdi
je 0x1801fa73f
mov rax, rbx
nop word [rax + rax]
cmp word [rdi], si
je 0x1801fa72f
add rdi, 2
sub rax, 1
jne 0x1801fa720
test rax, rax
je 0x1801fa73f
sub rbx, rax
mov rbp, rbx
test rax, rax
jne 0x1801fa742
mov rbp, rsi
test ebp, ebp
cmovne esi, ebp
mov eax, esi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret