Function at 0x1400a6260
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x30
mov r14, rdx
mov rbx, rcx
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400a6280
cmp ax, 9
jne 0x1400a6286
add rbx, 2
jmp 0x1400a6271
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
test ax, ax
je 0x1400a64d6
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
jne 0x1400a62b7
mov word [rdx + 2], ax
mov al, 1
mov byte [rdx], 0
jmp 0x1400a64d8
mov byte [rdx], 1
xor sil, sil
mov edx, 0x2b
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
je 0x1400a6399
lea rdi, [rbp - 2]
cmp rdi, rbx
jbe 0x1400a62f8
nop dword [rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400a62ef
cmp ax, 9
jne 0x1400a62f8
sub rdi, 2
cmp rdi, rbx
ja 0x1400a62e0
sub rdi, rbx
lea rdx, str.Ctrl
sar rdi, 1
mov rcx, rbx
inc rdi
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400a631c
mov al, 1
jmp 0x1400a6354
mov r8, rdi
lea rdx, [0x1400e28b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400a6337
mov al, 4
jmp 0x1400a6354
mov r8, rdi
lea rdx, str.Shift
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400a64d6
mov al, reloc.OLEAUT32.dll_SafeArrayGetDim
or sil, al
lea rbx, [rbp + 2]
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400a636f
cmp ax, 9
jne 0x1400a6375
add rbx, 2
jmp 0x1400a6360
test ax, ax
je 0x1400a64d6
mov edx, 0x2b
lea rcx, [rbx + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
jne 0x1400a62d4
xor ecx, ecx
cmp word [rbx + 2], cx
jne 0x1400a648f
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbx]
mov rbp, rax
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdi, rax
cmp ax, 0xa
jne 0x1400a63ca
mov cl, 0xd
movzx eax, cl
jmp 0x1400a64aa
mov rdx, rbp
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rcx, ax
mov r8, rcx
shr r8, 8
cmp r8b, 0xff
jne 0x1400a643d
cmp cl, 0xff
jne 0x1400a643d
movzx ebp, di
test ebp, 0xffffff80
jne 0x1400a6443
mov edx, 0x103
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x1400a6443
mov edx, 2
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov edx, 1
movzx edi, dil
mov ecx, ebp
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx ecx, cl
cmove ecx, edi
test r8b, 0x38
je 0x1400a644a
xor cl, cl
movzx eax, cl
jmp 0x1400a64aa
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x1400a645a
or sil, 8
jmp 0x1400a647a
test r8b, 2
je 0x1400a646a
test sil, 3
jne 0x1400a646a
or sil, 1
test r8b, 4
je 0x1400a647a
test sil, 0xc
jne 0x1400a647a
or sil, 4
test r8b, 1
je 0x1400a648a
test sil, 0x30
jne 0x1400a648a
or sil, 0x10
movzx eax, cl
jmp 0x1400a64aa
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14001b0c0
movzx eax, al
mov word [r14 + 2], ax
test sil, 1
je 0x1400a64b9
or byte [r14], 8
test sil, 4
je 0x1400a64c3
or byte [r14], 0x10
test sil, 0x10
je 0x1400a64cd
or byte [r14], 4
cmp ax, 0
setne al
jmp 0x1400a64d8
xor al, al
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret