Function at 0x14004adc0
Capabilities:
Get keyboard layout

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x190
lea rdi, [rsp + 0x30]
mov ecx, 0x58
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a0]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov byte [rsp + 0x168], 0
mov byte [rsp + 0x169], 0
xor eax, eax
mov word [rsp + 0x58], ax
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x150], 2
cmp qword [rsp + 0x150], 4
jae 0x14004ae42
jmp 0x14004ae47
call fcn.1401357e0
xor eax, eax
mov rcx, qword [rsp + 0x150]
mov word [rsp + rcx + 0x94], ax
movzx eax, byte [rsp + 0x1b0]
test eax, eax
je 0x14004ae7f
mov rax, qword [rsp + 0x1a0]
movzx eax, byte [rax + 0x64]
test eax, eax
je 0x14004ae7f
mov byte [rsp + 0x16a], 1
jmp 0x14004ae87
mov byte [rsp + 0x16a], 0
movzx eax, byte [rsp + 0x16a]
mov byte [rsp + 0x104], al
mov rax, qword [rsp + 0x1a0]
add rax, 0x74
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x1a0]
add rax, 0x174
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x118], rax
jmp 0x14004aee6
mov rax, qword [rsp + 0x118]
add rax, 2
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
test eax, eax
je 0x14004b3ff
mov byte [rsp + 0x54], 0
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 4
jae 0x14004af1c
jmp 0x14004af21
call fcn.1401357e0
xor eax, eax
mov rcx, qword [rsp + 0x158]
mov word [rsp + rcx + 0x94], ax
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0x7b
je 0x14004af63
cmp dword [rsp + 0x16c], 0x7d
je 0x14004af5e
jmp 0x14004b1c6
jmp 0x14004aed2
mov rax, qword [rsp + 0x118]
add rax, 2
mov qword [rsp + 0x118], rax
mov dx, 0x7d
mov rcx, qword [rsp + 0x118]
call fcn.14018b180
mov qword [rsp + 0x120], rax
cmp qword [rsp + 0x120], 0
jne 0x14004afa0
jmp 0x14004aed2
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x120]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x14004b004
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x120]
movzx eax, word [rcx + rax]
cmp eax, 0x7d
jne 0x14004afff
mov rax, qword [rsp + 0x120]
add rax, 2
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x78], 1
jmp 0x14004b004
jmp 0x14004aed2
cmp qword [rsp + 0x78], 1
jne 0x14004b049
movzx eax, byte [rsp + 0x104]
test eax, eax
je 0x14004b02d
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
jmp 0x14004aed2
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x118]
movzx ecx, word [rcx]
mov word [rsp + rax + 0x94], cx
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0xc0]
call fcn.14001e9a0
mov rax, qword [rsp + 0x78]
shl rax, 1
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0x40
jae 0x14004b080
jmp 0x14004b085
call fcn.1401357e0
xor eax, eax
mov rcx, qword [rsp + 0x160]
mov word [rsp + rcx + 0xc0], ax
mov byte [rsp + 0x168], 1
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x64], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8b, 1
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0xc0]
call fcn.14003e390
mov byte [rsp + 0x54], al
movzx eax, byte [rsp + 0x54]
test eax, eax
je 0x14004b195
mov eax, 2
imul rax, rax, 0
movzx ecx, word [rsp + rax + 0xc0]
call fcn.1400349f0
movzx eax, ax
cmp eax, 0x56
jne 0x14004b128
mov eax, 2
imul rax, rax, 1
movzx ecx, word [rsp + rax + 0xc0]
call fcn.1400349f0
movzx eax, ax
cmp eax, 0x4b
jne 0x14004b128
mov dword [rsp + 0x170], 1
jmp 0x14004b133
mov dword [rsp + 0x170], 0
mov byte [rsp + 0x169], 1
movzx eax, byte [rsp + 0x170]
mov byte [rsp + 0x30], al
cmp byte [rsp + 0x169], 0
jne 0x14004b15d
lea rcx, str.vk_by_number
call fcn.1401352a0
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x14004b193
mov dl, 1
movzx ecx, byte [rsp + 0x54]
call fcn.14003ef60
mov word [rsp + 0x58], ax
movzx eax, word [rsp + 0x58]
test eax, eax
je 0x14004b193
movzx eax, word [rsp + 0x58]
btc eax, 8
mov word [rsp + 0x58], ax
mov byte [rsp + 0x54], 0
jmp 0x14004b1b4
mov byte [rsp + 0x168], 1
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0xc0]
call fcn.14003dec0
mov word [rsp + 0x58], ax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x118], rax
jmp 0x14004b23e
movzx eax, byte [rsp + 0x104]
test eax, eax
je 0x14004b1e7
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
jmp 0x14004aed2
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x118]
movzx ecx, word [rcx]
mov word [rsp + rax + 0x94], cx
mov byte [rsp + 0x64], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8b, 1
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x94]
call fcn.14003e390
mov byte [rsp + 0x54], al
mov byte [rsp + 0x169], 1
mov byte [rsp + 0x30], 0
movzx eax, byte [rsp + 0x54]
test eax, eax
je 0x14004b39b
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x94]
test eax, eax
je 0x14004b2e6
movzx eax, byte [rsp + 0x1b0]
test eax, eax
je 0x14004b2e6
mov eax, 2
imul rax, rax, 0
movzx ecx, word [rsp + rax + 0x94]
call qword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x14004b2e6
movzx eax, byte [rsp + 0x64]
and eax, 0x30
test eax, eax
je 0x14004b2bd
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x108]
movzx eax, byte [rcx + rax]
or eax, 1
movzx ecx, byte [rsp + 0x54]
mov rdx, qword [rsp + 0x108]
mov byte [rdx + rcx], al
jmp 0x14004b2e1
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x108]
movzx eax, byte [rcx + rax]
or eax, 2
movzx ecx, byte [rsp + 0x54]
mov rdx, qword [rsp + 0x108]
mov byte [rdx + rcx], al
jmp 0x14004b39b
movzx eax, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x108]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 0x1b8]
not ecx
and eax, ecx
movzx ecx, byte [rsp + 0x1c0]
or eax, ecx
movzx ecx, byte [rsp + 0x54]
mov rdx, qword [rsp + 0x108]
mov byte [rdx + rcx], al
movzx eax, byte [rsp + 0x1b8]
test eax, eax
je 0x14004b39b
cmp byte [rsp + 0x169], 0
jne 0x14004b33f
lea rcx, str.vk_by_number
call fcn.1401352a0
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x14004b39b
xor edx, edx
movzx ecx, byte [rsp + 0x54]
call fcn.14003ef60
mov word [rsp + 0x128], ax
movzx eax, word [rsp + 0x128]
test eax, eax
je 0x14004b39b
movzx eax, word [rsp + 0x128]
movzx ecx, byte [rsp + 0x1b8]
not ecx
mov rdx, qword [rsp + 0x110]
movzx eax, byte [rdx + rax]
and eax, ecx
movzx ecx, word [rsp + 0x128]
mov rdx, qword [rsp + 0x110]
mov byte [rdx + rcx], al
movzx eax, word [rsp + 0x58]
test eax, eax
jne 0x14004b3c3
cmp byte [rsp + 0x168], 0
jne 0x14004b3ba
lea rcx, str.sc_by_number
call fcn.1401352a0
movzx eax, byte [rsp + 0x44]
test eax, eax
je 0x14004b3fa
movzx eax, word [rsp + 0x58]
mov rcx, qword [rsp + 0x110]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 0x1b8]
not ecx
and eax, ecx
movzx ecx, byte [rsp + 0x1c0]
or eax, ecx
movzx ecx, word [rsp + 0x58]
mov rdx, qword [rsp + 0x110]
mov byte [rdx + rcx], al
jmp 0x14004aed2
cmp dword [rsp + 0x80], 0
je 0x14004b673
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x30]
cmp dword [rsp + 0x80], eax
jbe 0x14004b497
mov rax, qword [rsp + 0x1a0]
cmp dword [rax + 0x30], 0
je 0x14004b440
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rax + 0x28]
call fcn.1401a7da0
mov eax, dword [rsp + 0x80]
lea eax, [rax + rax + 2]
mov eax, eax
mov ecx, eax
call fcn.1401a7dd0
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x178]
mov qword [rax + 0x28], rcx
cmp qword [rsp + 0x178], 0
jne 0x14004b485
call fcn.140021290
jmp 0x14004b6b8
mov rax, qword [rsp + 0x1a0]
mov ecx, dword [rsp + 0x80]
mov dword [rax + 0x30], ecx
mov rax, qword [rsp + 0x1a0]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x138], rax
jmp 0x14004b4d1
mov rax, qword [rsp + 0x138]
add rax, 2
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
movzx eax, word [rax]
test eax, eax
je 0x14004b614
mov rax, qword [rsp + 0x138]
movzx eax, word [rax]
mov dword [rsp + 0x180], eax
cmp dword [rsp + 0x180], 0x7b
je 0x14004b513
cmp dword [rsp + 0x180], 0x7d
je 0x14004b5e0
jmp 0x14004b5e5
mov rax, qword [rsp + 0x138]
add rax, 2
mov dx, 0x7d
mov rcx, rax
call fcn.14018b180
mov qword [rsp + 0x140], rax
cmp qword [rsp + 0x140], 0
je 0x14004b5e0
mov rax, qword [rsp + 0x138]
add rax, 2
cmp qword [rsp + 0x140], rax
jne 0x14004b586
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x140]
movzx eax, word [rcx + rax]
cmp eax, 0x7d
jne 0x14004b586
mov rax, qword [rsp + 0x140]
add rax, 2
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x138]
add rax, 4
cmp qword [rsp + 0x140], rax
jne 0x14004b5d0
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x138]
movzx eax, word [rdx + rax]
mov word [rcx], ax
mov rax, qword [rsp + 0x130]
add rax, 2
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x138], rax
jmp 0x14004b4bd
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x138]
movzx ecx, word [rcx]
mov word [rax], cx
mov rax, qword [rsp + 0x130]
add rax, 2
mov qword [rsp + 0x130], rax
jmp 0x14004b4bd
mov rax, qword [rsp + 0x1a0]
mov rax, qword [rax + 0x28]
cmp qword [rsp + 0x130], rax
ja 0x14004b664
lea rax, str.dst___EndChars
mov qword [rsp + 0x28], rax
lea rax, [0x1402774b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, pe_nt_image_headers64
lea rdx, [0x1402774c0]
mov ecx, 2
call fcn.1401a71f0
cmp eax, 1
jne 0x14004b664
int3
xor eax, eax
mov rcx, qword [rsp + 0x130]
mov word [rcx], ax
jmp 0x14004b6b3
movzx eax, byte [rsp + 0x1b0]
test eax, eax
je 0x14004b6b3
mov rax, qword [rsp + 0x1a0]
cmp dword [rax + 0x30], 0
je 0x14004b6a0
mov rax, qword [rsp + 0x1a0]
mov rax, qword [rax + 0x28]
xor ecx, ecx
mov word [rax], cx
jmp 0x14004b6b3
mov rax, qword [rsp + 0x1a0]
lea rcx, [0x1402774b8]
mov qword [rax + 0x28], rcx
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WSOCK32.dll_connect
call fcn.140134a00
mov rax, rdi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140135520
add rsp, 0x190
pop rdi
ret