Function at 0x14018f4d0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r12, r8
mov r14d, ecx
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdx, qword [0x1403c63e0]
test rdx, rdx
je 0x14018f513
cmp qword [rdx], rax
je 0x14018f588
mov rdx, qword [0x1403c63e8]
mov qword [0x1403c63e0], 0
test rdx, rdx
jne 0x14018f539
jmp 0x14018f53e
mov rdx, qword [rdx + 0x28]
test rdx, rdx
je 0x14018f53e
cmp qword [rdx], rax
jne 0x14018f530
mov r9d, 0x270
lea r8, global___func__.12
mov ecx, 1
lea rdx, str._s___u_:_Refreshing_locale_cache._n
call qword [dbg.default_logger]
call dbg.refresh_locale_list
mov rax, qword [0x1403c63e0]
xor r11d, r11d
test rax, rax
jne 0x14018f585
mov rax, r11
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rax]
mov r9d, 0x27e
mov ecx, 2
mov qword [rsp + 0x20], rax
lea r8, global___func__.12
lea rdx, str._s___u_:_Using_keyboard_layout__p._n
call qword [dbg.default_logger]
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x36], ax
mov rax, qword [0x1403c63e0]
mov r13, qword [rax + 0x10]
mov rbx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
movzx ecx, byte [r13]
mov qword [rsp + 0x38], rax
test cl, cl
je 0x14018f857
mov byte [rsp + 0x35], 0
mov rsi, qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r15d, r15d
xor ebp, ebp
jmp 0x14018f605
movzx ecx, byte [r13 + 2]
add r13, 2
test cl, cl
je 0x14018f640
call rsi
test ax, ax
jns 0x14018f5f8
movzx eax, byte [r13]
cmp al, 0x10
je 0x14018f760
cmp al, 0x11
je 0x14018f770
cmp al, 0x12
sete al
movzx ecx, byte [r13 + 2]
add r13, 2
or r15d, eax
test cl, cl
jne 0x14018f605
nop word cs:[rax + rax]
and ebp, r15d
movzx eax, byte [rsp + 0x35]
movzx ebp, bpl
lea r9d, [rbp + rbp*2]
add r9d, eax
movzx r13d, byte [rsp + 0x36]
movzx esi, word [0x1401b9b64]
xor r11d, r11d
and r13d, 1
jmp 0x14018f68d
add rbx, 0x10
test r8d, r8d
je 0x14018f720
movzx r8d, byte [rbx + 9]
lea ecx, [r8 - 2]
mov eax, ecx
shr eax, 0x1f
add eax, ecx
sar eax, 1
mov ecx, eax
mov rax, qword [rbx]
test rax, rax
je 0x14018f680
cmp r9d, ecx
jge 0x14018f680
lea r15d, [rcx + 1]
mov rcx, r15
add r15, r15
jmp 0x14018f6c8
add rax, r15
cmp byte [rax], 0
je 0x14018f680
movzx ebp, byte [rax]
cmp ebp, r14d
jne 0x14018f6c0
cmp byte [rax + 1], 1
jne 0x14018f6df
test r13b, r13b
jne 0x14018f801
movsxd rbp, r9d
movzx r15d, word [rax + rbp*2 + 2]
cmp r15w, 0xf001
je 0x14018f7c8
cmp r15w, 0xf000
je 0x14018f680
test r12, r12
je 0x14018f680
mov word [rdi], r15w
mov r11d, 1
add rbx, 0x10
test r8d, r8d
jne 0x14018f68d
nop dword [rax]
cmp si, 0xf000
je 0x14018f571
mov rsi, qword [rsp + 0x38]
mov eax, dword [rsi]
test eax, eax
je 0x14018f571
add rsi, 8
mov rbx, rsi
test r12, r12
jne 0x14018f7be
nop word cs:[rax + rax]
mov edx, dword [rbx]
add rbx, 8
test edx, edx
jne 0x14018f750
jmp 0x14018f571
mov byte [rsp + 0x35], 1
jmp 0x14018f5f8
mov ebp, 1
jmp 0x14018f5f8
shr eax, 0x10
cmp word [0x1401b9b64], ax
jne 0x14018f7b0
mov eax, 0xfffff000
mov word [0x1401b9b64], ax
cmp r12, r11
jae 0x14018f832
nop word cs:[rax + rax]
nop dword [rax]
mov eax, dword [rbx]
add rbx, 8
test eax, eax
je 0x14018f571
cmp word [rdi], ax
jne 0x14018f7b0
jmp 0x14018f780
cmp si, 0xf000
je 0x14018f816
cmp r12, 1
jbe 0x14018f680
movzx eax, sil
shl esi, 8
mov ecx, 0xfffff000
mov r11d, 2
add eax, esi
mov word [0x1401b9b64], cx
mov esi, 0xfffff000
mov word [rdi], ax
jmp 0x14018f680
test r9d, r9d
jle 0x14018f864
cmp byte [rsp + 0x35], 0
je 0x14018f864
sub r9d, 1
jmp 0x14018f6df
movsxd rcx, ecx
add rbp, rbp
lea rcx, [rbp + rcx*2]
movzx esi, word [rax + rcx + 2]
mov word [0x1401b9b64], si
jmp 0x14018f680
movzx edx, word [rbx - 4]
mov ecx, r11d
test r11d, r11d
je 0x14018f7b0
xor eax, eax
mov r8d, eax
add eax, 1
mov byte [rdi + r8], dl
cmp eax, ecx
jb 0x14018f844
jmp 0x14018f7b0
mov byte [rsp + 0x35], 0
xor r9d, r9d
jmp 0x14018f654
add r9d, 1
jmp 0x14018f6df