Function at 0x1400113e0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
movzx ebx, dl
mov r15, r9
movzx eax, bx
movzx edi, r8w
or ax, r8w
mov esi, ecx
je 0x140011a15
mov eax, dword [rbp + 0xc8]
mov ecx, 0xffc3d44d
mov qword [r11 + 8], r12
test eax, eax
mov qword [r11 - 0x30], r13
cmovne ecx, eax
mov qword [r11 - 0x38], r14
mov dword [rsp + 0x38], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x140135364]
sete r14b
cmp dword [0x140137320], 0
je 0x140011451
test r14b, r14b
jne 0x140011451
mov r12b, 1
jmp 0x140011454
xor r12b, r12b
cmp dword [0x140137320], 1
mov byte [rsp + 0x30], r12b
je 0x140011467
test r14b, r14b
je 0x14001146e
mov byte [rbp + 0xc0], 0
test bl, bl
jne 0x14001147f
movzx ecx, di
call fcn.140015470
movzx ebx, al
jmp 0x140011491
test di, di
jne 0x140011491
xor edx, edx
movzx ecx, bl
call fcn.140015190
movzx edi, ax
xor r13d, r13d
lea rdx, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
mov ecx, r13d
movzx eax, di
shr ax, 8
test al, al
setne cl
cmp dword [0x140137320], 2
mov dword [rsp + 0x48], ecx
jne case.default.0x1400114d0
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x1400114d0
cdqe
mov ecx, dword [rdx + rax*4 + 0x11a24]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x1400114d0
mov bl, reloc.OLEAUT32.dll_SafeArrayGetDim
jmp case.default.0x1400114d0
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r15, r15
je 0x14001160b
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140014370
test al, al
je 0x14001159a
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test esi, esi
jne 0x140011514
movzx eax, bl
or byte [rsp + rax + 0x60], 0x80
jmp 0x140011521
cmp esi, 1
jne 0x140011521
movzx eax, bl
and byte [rsp + rax + 0x60], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x140011541
lea rdx, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
cdqe
mov ecx, dword [rdx + rax*4 + 0x11a3c]
add rcx, rdx
jmp rcx
test byte [rbp + 2], 0x80
jne 0x140011556
test byte [rbp + 3], 0x80
jne 0x140011556
and byte [rsp + 0x71], 0x7f
jmp case.default.0x140011541
or byte [rsp + 0x71], 0x80
jmp case.default.0x140011541
test byte [rbp], 0x80
jne 0x140011570
test byte [rbp + 1], 0x80
jne 0x140011570
and byte [rsp + 0x70], 0x7f
jmp case.default.0x140011541
or byte [rsp + 0x70], 0x80
jmp case.default.0x140011541
test byte [rbp + 4], 0x80
jne 0x14001158a
test byte [rbp + 5], 0x80
jne 0x14001158a
and byte [rsp + 0x72], 0x7f
jmp case.default.0x140011541
or byte [rsp + 0x72], 0x80
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
cmp esi, 1
je 0x1400115c1
mov r9, rdi
movzx r8d, bl
or r9, 1
mov edx, 0x100
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xc0], r13b
je 0x1400115e3
cmp esi, 2
jne 0x1400115e3
mov rax, qword [0x14012fa58]
mov ecx, dword [rax + 0x84]
call fcn.140013430
jmp 0x1400115eb
test esi, esi
je 0x1400119d4
mov r9d, 0xc0000001
movzx r8d, bl
or r9, rdi
mov edx, 0x101
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400119d4
cmp byte [0x140134437], r13b
mov dword [0x14013a478], esi
mov byte [0x140135362], bl
je 0x14001163f
cmp bl, 0x12
je 0x14001162c
lea eax, [rbx + 0x5c]
cmp al, 1
ja 0x14001163f
test r14b, r14b
jne 0x14001163f
xor ecx, ecx
mov byte [rsp + 0x34], 1
call fcn.140040880
jmp 0x140011644
mov byte [rsp + 0x34], r13b
test r14b, r14b
lea rax, [0x14013a47c]
lea r15, [rsp + 0x4c]
cmove r15, rax
cmp bl, 0xa5
jne 0x14001170e
test r12b, r12b
jne 0x14001170e
cmp qword [0x140134450], r13
je 0x14001170e
mov al, 1
mov byte [rsp + 0x33], al
mov byte [rbp + 0xa8], al
test r14b, r14b
jne 0x140011695
mov rax, qword [0x14013a480]
mov qword [rsp + 0x40], rax
jmp 0x1400116cd
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400116ad
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1400116b0
mov eax, r13d
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r12, rax
call fcn.140014780
mov dword [r15], eax
cmp dword [r15], r13d
je 0x1400116e1
mov byte [rbp + 0xa8], r13b
mov r10b, 1
jmp 0x140011762
mov ecx, 0xa2
mov byte [rbp + 0xb0], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r12d, ax
mov r10b, 1
mov eax, dword [rsp + 0x38]
shr r12d, 0xf
and r12b, 1
mov dword [0x140135228], eax
jmp 0x140011777
xor r10b, r10b
mov byte [rsp + 0x33], r10b
mov byte [rbp + 0xa8], r10b
test r12b, r12b
je 0x140011758
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140014370
movzx r12d, byte [rbp + 0xa8]
movzx ecx, al
mov byte [rsp + 0x32], al
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
movzx eax, byte [rbp + 0xa8]
mov byte [rbp + 0xb0], al
jmp 0x14001177d
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
movzx eax, byte [rbp + 0xa8]
movzx r12d, byte [rbp + 0xa8]
mov byte [rbp + 0xb0], al
xor cl, cl
mov byte [rsp + 0x32], cl
test r14b, r14b
jne 0x1400117a2
mov eax, dword [0x140137320]
cmp eax, 2
je 0x1400117a2
cmp qword [0x140134450], r13
je 0x14001179b
cmp eax, 1
jne 0x1400117a2
mov byte [rsp + 0x31], 1
jmp 0x1400117a7
mov byte [rsp + 0x31], r13b
mov r14d, 0x8000
cmp esi, 1
je 0x1400118a2
cmp byte [rsp + 0x30], r13b
je 0x1400117f9
mov eax, dword [rsp + 0x38]
movzx r8d, di
mov r9d, dword [rsp + 0x48]
movzx edx, bl
mov dword [rsp + 0x20], eax
call fcn.140012d00
mov r14, qword [rsp + 0x40]
cmp byte [rsp + 0x31], r13b
je 0x1400118a7
movzx r8d, di
movzx edx, bl
xor ecx, ecx
call fcn.1400136a0
jmp 0x1400118a7
test r10b, r10b
je 0x140011813
mov eax, dword [0x140135224]
cmp dword [r15], 3
cmove eax, dword [rsp + 0x38]
mov dword [0x140135224], eax
mov r9d, dword [rsp + 0x38]
movzx edx, dil
mov r8d, dword [rsp + 0x48]
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x140135224], r13d
cmp byte [rbp + 0xa8], r13b
je 0x1400117d6
cmp dword [0x140135228], r13d
mov byte [rbp + 0xa8], r13b
je 0x14001186b
mov r14, qword [rsp + 0x40]
mov edx, 4
mov rcx, r14
mov dword [0x140135228], r13d
call fcn.140014780
mov dword [r15], eax
jmp 0x1400117db
test r12b, r12b
jne 0x1400117d6
movzx ecx, byte [rbp + 0xb0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, r14w
mov r14, qword [rsp + 0x40]
neg ax
mov rcx, r14
sbb edx, edx
add edx, 4
call fcn.140014780
mov dword [r15], eax
jmp 0x1400117db
mov r14, qword [rsp + 0x40]
cmp byte [rbp + 0xc0], r13b
je 0x1400118de
cmp esi, 2
jne 0x1400118de
cmp dword [0x140137320], esi
mov rax, qword [0x14012fa58]
jne 0x1400118d1
mov ecx, dword [rax + 0x88]
call fcn.140013430
jmp 0x1400118e6
mov ecx, dword [rax + 0x84]
call fcn.140013430
jmp 0x1400118e6
test esi, esi
je 0x1400119c6
mov ecx, dword [rsp + 0x48]
or ecx, 2
cmp byte [rsp + 0x30], r13b
je 0x140011915
mov eax, dword [rsp + 0x38]
mov r9d, ecx
movzx ecx, byte [rsp + 0x32]
movzx r8d, di
movzx edx, bl
mov dword [rsp + 0x20], eax
call fcn.140012d00
jmp 0x14001199a
cmp byte [rsp + 0x33], r13b
je 0x140011931
mov eax, dword [0x140135220]
cmp dword [r15], 3
cmove eax, dword [rsp + 0x38]
mov dword [0x140135220], eax
mov r9d, dword [rsp + 0x38]
mov r8d, ecx
movzx ecx, bl
movzx edx, dil
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x140135220], r13d
cmp byte [rbp + 0xa8], r13b
je 0x14001199a
cmp dword [0x140135228], r13d
je 0x14001196d
mov dword [0x140135228], r13d
mov edx, 4
jmp 0x14001198f
test r12b, r12b
je 0x14001199a
movzx ecx, byte [rbp + 0xb0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
setne r13b
lea edx, [r13 + 3]
mov rcx, r14
call fcn.140014780
mov dword [r15], eax
cmp dword [r15], 0
je 0x1400119b1
mov eax, 0x138
cmp di, ax
jne 0x1400119b1
and byte [0x14013a45e], 0xfe
cmp byte [rsp + 0x31], 0
je 0x1400119c6
movzx r8d, di
movzx edx, bl
mov cl, 1
call fcn.1400136a0
cmp byte [rsp + 0x34], 0
je 0x1400119d4
mov cl, 1
call fcn.140040880
cmp byte [rbp + 0xc0], 0
mov r14, qword [rsp + 0x160]
mov r13, qword [rsp + 0x168]
mov r12, qword [rsp + 0x1a0]
je 0x140011a15
cmp dword [0x140137320], 2
mov rax, qword [0x14012fa58]
jne 0x140011a0d
mov ecx, dword [rax + 0x80]
jmp 0x140011a10
mov ecx, dword [rax + 0x7c]
call fcn.140013430
add rsp, 0x170
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret