Function at 0x1400bd160
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x30
mov r14, rdx
mov rbx, rcx
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400bd180
cmp ax, 9
jne 0x1400bd186
add rbx, 2
jmp 0x1400bd171
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
test ax, ax
je 0x1400bd3c7
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
jne 0x1400bd1b7
mov word [rdx + 2], ax
mov al, 1
mov byte [rdx], 0
jmp 0x1400bd3c9
mov byte [rdx], 1
xor sil, sil
mov edx, 0x2b
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
je 0x1400bd299
lea rdi, [rbp - 2]
cmp rdi, rbx
jbe 0x1400bd1f8
nop dword [rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400bd1ef
cmp ax, 9
jne 0x1400bd1f8
sub rdi, 2
cmp rdi, rbx
ja 0x1400bd1e0
sub rdi, rbx
lea rdx, str.Ctrl
sar rdi, 1
mov rcx, rbx
inc rdi
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400bd21e
or sil, 1
jmp 0x1400bd25a
mov r8, rdi
lea rdx, [0x14010f540]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400bd23b
or sil, 4
jmp 0x1400bd25a
mov r8, rdi
lea rdx, str.Shift
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400bd3c7
or sil, 0x10
lea rbx, [rbp + 2]
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400bd26f
cmp ax, 9
jne 0x1400bd275
add rbx, 2
jmp 0x1400bd260
test ax, ax
je 0x1400bd3c7
mov edx, 0x2b
lea rcx, [rbx + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbp, rax
test rax, rax
jne 0x1400bd1d4
xor ecx, ecx
cmp word [rbx + 2], cx
jne 0x1400bd37f
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbx]
mov rbp, rax
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdi, rax
cmp ax, 0xa
jne 0x1400bd2c7
mov bl, 0xd
jmp 0x1400bd39a
mov rdx, rbp
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rbx, ax
mov rcx, rbx
shr rcx, 8
cmp cl, 0xff
jne 0x1400bd338
cmp bl, 0xff
jne 0x1400bd338
movzx ebp, di
test ebp, 0xffffff80
jne 0x1400bd33d
mov edx, 0x103
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x1400bd33d
mov edx, 2
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
movzx edx, di
mov ecx, 0xffdf
and dx, cx
mov ecx, ebp
test eax, eax
cmovne di, dx
mov edx, 1
movzx ebx, dil
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
setne cl
test cl, 0x38
je 0x1400bd341
xor bl, bl
jmp 0x1400bd39a
movzx eax, cl
and al, 6
cmp al, 6
jne 0x1400bd350
or sil, 8
jmp 0x1400bd36e
test cl, 2
je 0x1400bd35f
test sil, 3
jne 0x1400bd35f
or sil, 1
test cl, 4
je 0x1400bd36e
test sil, 0xc
jne 0x1400bd36e
or sil, 4
test cl, 1
je 0x1400bd39a
test sil, 0x30
jne 0x1400bd39a
or sil, 0x10
jmp 0x1400bd39a
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140025360
movzx ebx, al
movzx eax, bl
mov word [r14 + 2], ax
test sil, 1
je 0x1400bd3ac
or byte [r14], 8
test sil, 4
je 0x1400bd3b6
or byte [r14], 0x10
test sil, 0x10
je 0x1400bd3c0
or byte [r14], 4
test bl, bl
setne al
jmp 0x1400bd3c9
xor al, al
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret