Function at 0x427ce0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov rbx, rcx
mov qword [rsp + 0x38], rdi
xor ecx, ecx
mov esi, r8d
mov rbp, rdx
mov qword [rsp + 0x30], r12
mov rdi, r9
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx r10d, ax
movzx r11d, ax
and r10w, 0xfff
cmp r10w, 0x412
mov r10, r12
sete cl
and r10d, 0xfff
cmp r10, 0x412
sete dl
cmp esi, 0x100
ja 0x427d78
cmp esi, 0x100
je 0x427daf
cmp esi, 0x87
jne 0x4281d3
mov eax, dword [rbx + 0x3108]
neg eax
sbb rax, rax
and eax, 4
or rax, 3
jmp 0x427fe6
cmp esi, 0x105
ja 0x4281b2
cmp esi, 0x105
je 0x428004
mov eax, esi
sub eax, 0x101
je 0x428004
sub eax, 1
je 0x427fdc
cmp eax, 2
jne 0x4281d3
cmp dword [rbx + 0x3108], 0
jne 0x427e01
cmp rdi, 0xd
je 0x427dc4
cmp rdi, 9
jne 0x427e01
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rbp
mov r11w, ax
shr r11d, 0xf
and r11d, 1
movsxd rbx, r11d
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
lea edx, [r9 + 0x28]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x427fe6
mov eax, dword [rbx + 0x48]
xor esi, esi
lea ecx, [rax - 1]
cmp ecx, eax
jae 0x427e2e
lea rax, [rcx + rcx*2]
add rax, rax
cmp dword [rbx + rax*8 + 0xf0], 1
jne 0x427e2e
lea rax, [rcx + rcx*2 + 0xf]
add rax, rax
movzx r8d, byte [rbx + rax*8 + 0x28]
jmp 0x427e31
mov r8d, esi
mov eax, dword [rbx + 0x48]
xor dx, dx
lea ecx, [rax - 1]
cmp ecx, eax
jae 0x427e57
lea rcx, [rcx + rcx*2]
add rcx, rcx
cmp dword [rbx + rcx*8 + 0xf0], 1
jne 0x427e57
movzx edx, word [rbx + rcx*8 + 0xf8]
cmp dword [rbx + 0x48], esi
je 0x427e6a
test r8d, r8d
je 0x427e6a
cmp di, dx
je 0x427fdc
mov ecx, 0x14
mov qword [rbx + 0xe0], r12
mov word [rbx + 0xe8], r11w
mov dword [rbx + 0x50], 1
mov dword [rbx + 0xdc], 2
call qword [sym.imp.USER32.dll_GetKeyState]
mov bp, ax
mov ecx, 0x10
and ebp, 1
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, di
mov r11w, ax
add ecx, 0xffffffa5
shr r11d, 0xf
and r11d, 1
cmp ecx, 2
mov dword [rbx + 0x4c], r11d
jbe 0x4281a2
cmp dword [rbx + 0x3108], esi
je 0x4281a2
cmp dword [rbx + 0x48], 0x100
je 0x4281a2
mov eax, dword [rbx + 0x48]
cmp eax, 0x100
jae 0x427fc3
mov edx, dword [rsp + 0x80]
lea rcx, [rax + rax*2]
xor eax, eax
add rcx, rcx
mov qword [rbx + rcx*8 + 0xf0], rax
mov qword [rbx + rcx*8 + 0xf8], rax
mov qword [rbx + rcx*8 + 0x100], rax
mov qword [rbx + rcx*8 + 0x108], rax
mov qword [rbx + rcx*8 + 0x110], rax
mov qword [rbx + rcx*8 + 0x118], rax
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov dword [rbx + rcx*8 + 0xf0], 1
mov eax, dword [rbx + 0x48]
lea rax, [rax + rax*2 + 0xf]
add rax, rax
mov byte [rbx + rax*8 + 0x28], 1
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov byte [rbx + rcx*8 + 0x119], r11b
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov byte [rbx + rcx*8 + 0x11a], bpl
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov qword [rbx + rcx*8 + 0x108], rdx
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov dword [rbx + rcx*8 + 0xfc], esi
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov word [rbx + rcx*8 + 0xf8], di
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov dword [rbx + rcx*8 + 0xfc], 2
add dword [rbx + 0x48], 1
mov r9d, dword [rbx + 0x48]
mov r8d, 1
movzx edx, di
sub r9d, 1
mov rcx, rbx
call fcn.004279c0
movabs rax, 1
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
test dl, dl
mov rbp, qword [rsp + 0x80]
jne 0x428014
test cl, cl
je 0x42802d
cmp rdi, 0xe5
jne 0x42802d
mov ecx, 0x80000000
mov rax, rbp
and rax, rcx
cmp rax, rcx
je 0x427fdc
mov ecx, 0x14
mov qword [rbx + 0xe0], r12
mov word [rbx + 0xe8], r11w
mov dword [rbx + 0x50], 1
mov dword [rbx + 0xdc], 2
call qword [sym.imp.USER32.dll_GetKeyState]
mov r12w, ax
mov ecx, 0x10
and r12d, 1
call qword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
mov r11w, ax
shr r11d, 0xf
and r11d, 1
mov dword [rbx + 0x4c], r11d
je 0x428082
mov dword [rbx + 0x4c], esi
mov ecx, dword [rbx + 0x48]
test ecx, ecx
jne 0x428093
cmp di, 0xd
je 0x4281a2
movzx eax, di
add eax, 0xffffffa5
cmp eax, 2
jbe 0x4281a2
cmp dword [rbx + 0x3108], esi
je 0x4281a2
cmp ecx, 0x100
je 0x4281a2
mov eax, dword [rbx + 0x48]
mov edx, dword [rbx + 0x4c]
cmp eax, 0x100
jae 0x428187
lea rcx, [rax + rax*2]
xor eax, eax
add rcx, rcx
mov qword [rbx + rcx*8 + 0xf0], rax
mov qword [rbx + rcx*8 + 0xf8], rax
mov qword [rbx + rcx*8 + 0x100], rax
mov qword [rbx + rcx*8 + 0x108], rax
mov qword [rbx + rcx*8 + 0x110], rax
mov qword [rbx + rcx*8 + 0x118], rax
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov dword [rbx + rcx*8 + 0xf0], 1
mov eax, dword [rbx + 0x48]
lea rax, [rax + rax*2 + 0xf]
add rax, rax
mov byte [rbx + rax*8 + 0x28], sil
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov byte [rbx + rcx*8 + 0x119], dl
mov eax, dword [rbx + 0x48]
mov edx, ebp
lea rcx, [rax + rax*2]
add rcx, rcx
mov byte [rbx + rcx*8 + 0x11a], r12b
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov qword [rbx + rcx*8 + 0x108], rdx
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov dword [rbx + rcx*8 + 0xfc], esi
mov eax, dword [rbx + 0x48]
lea rcx, [rax + rax*2]
add rcx, rcx
mov word [rbx + rcx*8 + 0xf8], di
add dword [rbx + 0x48], 1
mov r9d, dword [rbx + 0x48]
xor r8d, r8d
movzx edx, di
sub r9d, 1
mov rcx, rbx
call fcn.004279c0
jmp 0x427fdc
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x427fdc
mov eax, esi
sub eax, 0x106
je 0x427fdc
sub eax, 0xb
je 0x427fdc
cmp eax, 0xf4
je 0x427dfa
mov rax, qword [rsp + 0x80]
mov rcx, qword [rbx + 0x3100]
mov r9, rdi
mov r8d, esi
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
jmp 0x427fe6