Function at 0x180021508
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r15d, r15d
mov rbx, rcx
mov word [rax + 0x20], r15w
mov rcx, rdx
mov eax, r9d
mov r14d, r9d
neg eax
mov ebp, r8d
mov r13, rdx
mov edi, r15d
sbb rsi, rsi
not rsi
and rsi, 0xffffffffc0000000
call fcn.18001bec4
mov dword [rsp + 0x40], eax
lea rcx, [0x180035500]
mov edx, r15d
cmp dword [rcx], ebp
je 0x18002195e
inc edx
add rcx, 4
cmp edx, 3
jb 0x180021561
lea eax, [rbp - 0x20]
cmp eax, 0x5e
jbe 0x1800215ba
lea eax, [rbp - 0xa0]
cmp eax, 0x5f
jbe 0x1800215ba
lea rdx, [0x180034450]
mov eax, r15d
mov rcx, rdx
cmp dword [rcx], ebp
je 0x1800215a5
inc eax
add rcx, 0xc
cmp eax, 0x61
jb 0x180021594
jmp 0x1800215ba
lea rcx, [rax + rax*2]
movzx edi, byte [rdx + rcx*4 + 4]
cmp dword [rdx + rcx*4 + 8], r15d
je 0x1800215ba
bts rsi, 0x18
mov ecx, ebp
call fcn.1800213a4
xor edx, edx
mov rcx, r13
movzx r12d, ax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r8, [rsp + 0xb8]
movzx edx, r12w
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.180021158
mov qword [rsp + 0x50], rax
mov rbp, rax
test edi, edi
jne 0x180021779
mov rdx, r13
mov rcx, rbx
call fcn.180021124
test eax, eax
je 0x180021635
test rbp, rbp
je 0x18002161f
movzx edi, byte [rsp + 0xb8]
jmp 0x18002162d
xor edx, edx
mov cl, r12b
call qword [sym.imp.USER32.dll_VkKeyScanExA]
movzx edi, al
test edi, edi
jne 0x180021779
mov eax, dword [rbx + 0x280]
test eax, eax
jne 0x180021650
cmp dword [rbx + 0x284], r15d
je 0x180021672
test eax, eax
je 0x180021713
mov rax, qword [rbx + 0x38]
cmp byte [rax + 0x1c], r15b
jge 0x180021713
cmp byte [rax + 0x1e], r15b
jne 0x180021713
cmp byte [rax + 0x1d], r15b
jne 0x180021713
test r14d, r14d
je 0x18002195e
test r12w, r12w
je 0x18002195e
mov rax, qword [rbx + 0x38]
mov rcx, rsi
mov r14d, 0x20000000
or rcx, r14
cmp byte [rax + 0x1e], r15b
movzx r15d, r12w
cmovge rcx, rsi
xor edx, edx
mov rsi, rcx
mov r13, rcx
movzx ecx, r12w
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, eax
mov ecx, 0xff
and dx, cx
xor eax, eax
mov rcx, qword [rbx + 0x38]
mov dword [rsp + 0xb8], edx
cmp byte [rcx + 0x1e], al
jge 0x1800216d7
lea ebp, [rax + 1]
cmp byte [rcx + 0x1d], al
jge 0x1800216d9
mov ebp, eax
cmp dword [rsp + 0x40], eax
jne 0x1800216e8
lea ebp, [rbp*4 + 0x102]
jmp 0x180021706
or rsi, r14
mov dword [rbx + 0x280], 1
cmp byte [rcx + 0x1e], al
lea ebp, [rbp*4 + 0x100]
mov r15, rax
cmovge rsi, r13
mov r13, qword [rsp + 0xa8]
jmp 0x18002183c
movzx r15d, word [rsp + 0xb8]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, 0xff
and ax, cx
mov rcx, qword [rbx + 0x38]
mov word [rsp + 0xb8], ax
xor eax, eax
cmp byte [rcx + 0x1e], al
jge 0x18002174a
lea ebp, [rax + 1]
cmp byte [rcx + 0x1d], al
jge 0x18002174c
mov ebp, eax
test r14d, r14d
je 0x180021767
mov dword [rbx + 0x284], 1
lea ebp, [rbp*4 + 0x100]
jmp 0x18002183c
mov dword [rbx + 0x284], eax
lea ebp, [rbp*4 + 0x101]
jmp 0x18002183c
test r14d, r14d
je 0x18002178b
mov r8d, r14d
mov edx, edi
mov rcx, rbx
call fcn.180021978
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, 0xff
and ax, cx
mov word [rsp + 0xb8], ax
mov rax, qword [rbx + 0x38]
cmp byte [rax + 0x1e], r15b
jge 0x1800217ba
mov ebp, 1
cmp byte [rax + 0x1d], r15b
jge 0x1800217bd
mov ebp, r15d
test r14d, r14d
je 0x1800217d5
mov dword [rbx + 0x280], 1
lea ebp, [rbp*4 + 0x100]
jmp 0x1800217e3
mov dword [rbx + 0x280], r15d
lea ebp, [rbp*4 + 0x101]
test r14d, r14d
jne 0x1800217f5
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.180021978
mov rcx, qword [rbx + 0x38]
mov rax, rsi
mov r14d, 0x20000000
or rax, r14
cmp byte [rcx + 0x1e], r15b
cmovge rax, rsi
mov rsi, rax
cmp edi, 0xa0
jb 0x180021837
cmp edi, 0xa1
jbe 0x180021832
lea eax, [rdi - 0xa4]
cmp eax, 1
ja 0x180021837
mov edi, 0x12
jmp 0x180021837
mov edi, 0x10
mov r15d, edi
xor eax, eax
cmp dword [rcx + 0x164], eax
je 0x1800218a5
mov rdx, qword [rsp + 0x48]
movzx ecx, r12w
call qword [sym.imp.USER32.dll_VkKeyScanExW]
mov r8, qword [rsp + 0x48]
movzx edx, r12w
movzx ecx, ax
call fcn.180021050
test eax, eax
jne 0x1800218a5
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x1800218a5
mov rax, qword [rbx + 0x38]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov r8d, 6
mov dword [rsp + 0x28], 0x3e8
mov rcx, r13
mov dword [rsp + 0x20], 2
mov edx, dword [rax + 0x150]
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov edx, edi
mov rcx, rbx
call fcn.180021324
test eax, eax
jne 0x18002195e
cmp dword [rbx + 0x278], eax
jne 0x1800218c9
mov edx, edi
mov rcx, rbx
call fcn.180021264
cmp dword [rbx + 0x278], 0
jne 0x180021957
test eax, eax
je 0x180021901
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rbx + 0x288]
cmp ecx, 0x1f4
jb 0x180021957
mov rdx, r13
mov dword [rbx + 0x288], eax
mov rcx, rbx
call fcn.180021124
mov rax, qword [rbx + 0x38]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], 0x3e8
mov rcx, r13
mov dword [rsp + 0x20], 2
mov edx, dword [rax + 0x150]
lea r8d, [r9 + 3]
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
movzx r9d, word [rsp + 0xb8]
mov r8, r15
shl r9, 0x10
mov edx, ebp
or r9, rsi
mov rcx, r13
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageA]
and dword [rbx + 0x278], 0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret