Function at 0x1400b3780
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x310], rbx
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rax, r8
mov qword [rsp + 0x50], rax
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov esi, ebx
mov r15d, 7
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
xor r8d, r8d
lea rdx, [0x140201084]
mov rcx, rax
call fcn.140003290
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x40]
call fcn.14018f1e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xc0]
call fcn.14018f1e0
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
setne al
test al, al
jne 0x1400b3865
mov r8, qword [rbp - 0x70]
cmp r8, 8
jb 0x1400b385e
inc r8
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x78]
call fcn.140003900
xor al, al
jmp 0x1400b3d7d
mov byte [rbp - 0x2c], 0
mov word [rsp + 0x68], bx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r13, rax
test rax, rax
je 0x1400b3842
mov qword [rsp + 0x48], rbx
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x58], rax
mov r12, qword [rbp - 0x68]
test rax, rax
je 0x1400b3d48
nop dword [rax]
mov rcx, qword [r14 + 0x10]
lea eax, [rsi + 2]
cmp eax, ecx
jge 0x1400b3d48
cmp rcx, rsi
jbe 0x1400b3d3b
cmp qword [r14 + 0x18], 8
jb 0x1400b38c4
mov rax, qword [r14]
jmp 0x1400b38c7
mov rax, r14
movzx r8d, word [rax + rsi*2]
mov edx, 1
lea rcx, [rbp - 0x68]
call fcn.14002c260
lea rdx, [rbp - 0x68]
mov r12, qword [rbp - 0x68]
mov r15, qword [rbp - 0x50]
cmp r15, 8
cmovae rdx, r12
mov r8d, 1
mov rbx, qword [rbp - 0x58]
cmp rbx, r8
cmovb r8, rbx
test r8, r8
je 0x1400b393f
lea rcx, [0x140201200]
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x1400b3928
add rdx, 2
add rcx, 2
sub r8, 1
jne 0x1400b3910
jmp 0x1400b393f
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
mov eax, 0xffffffff
cmovb r8d, eax
jmp 0x1400b3942
xor r8d, r8d
test r8d, r8d
jne 0x1400b3955
cmp rbx, 1
jne 0x1400b3955
inc rsi
jmp 0x1400b3d07
lea rcx, [rsi + 1]
cmp qword [r14 + 0x10], rcx
jbe 0x1400b3d2e
cmp qword [r14 + 0x18], 8
jb 0x1400b396f
mov rax, qword [r14]
jmp 0x1400b3972
mov rax, r14
movzx r8d, word [rax + rcx*2]
mov edx, 1
lea rcx, [rsp + 0x78]
call fcn.14002c260
lea rcx, [rsi + 2]
cmp qword [r14 + 0x10], rcx
jbe 0x1400b3d21
cmp qword [r14 + 0x18], 8
jb 0x1400b39a0
mov rax, qword [r14]
jmp 0x1400b39a3
mov rax, r14
movzx r8d, word [rax + rcx*2]
mov edx, 1
lea rcx, [rsp + 0x78]
call fcn.140009d70
lea rdx, [rbp - 0x68]
cmp r15, 8
cmovae rdx, r12
mov r8d, 1
cmp rbx, r8
cmovb r8, rbx
test r8, r8
je 0x1400b3a13
lea rcx, [0x14020266c]
nop dword [rax]
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x1400b39f8
add rdx, 2
add rcx, 2
sub r8, 1
jne 0x1400b39e0
jmp 0x1400b3a13
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
mov r10d, 0xffffffff
cmovb r8d, r10d
xor r9d, r9d
jmp 0x1400b3a1d
xor r9d, r9d
or r10d, 0xffffffff
mov r8d, r9d
test r8d, r8d
jne 0x1400b3a36
cmp rbx, 1
jne 0x1400b3a36
mov word [rbp - 0x30], 0x101
mov byte [rbp - 0x2e], bl
jmp 0x1400b3bec
lea rcx, [rbp - 0x68]
cmp r15, 8
cmovae rcx, r12
mov r8d, 1
cmp rbx, r8
cmovb r8, rbx
test r8, r8
je 0x1400b3a8a
lea rdx, [0x140202670]
nop dword [rax + rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400b3a78
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x1400b3a60
jmp 0x1400b3a8a
mov r8d, 1
movzx eax, word [rdx]
cmp word [rcx], ax
cmovb r8d, r10d
jmp 0x1400b3a8d
mov r8d, r9d
test r8d, r8d
jne 0x1400b3aa6
cmp rbx, 1
jne 0x1400b3aa6
mov word [rbp - 0x30], 0x181
mov byte [rbp - 0x2e], bl
jmp 0x1400b3bec
lea rcx, [rbp - 0x68]
cmp r15, 8
cmovae rcx, r12
mov r8d, 1
cmp rbx, r8
cmovb r8, rbx
test r8, r8
je 0x1400b3afa
lea rdx, [0x140202674]
nop dword [rax + rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400b3ae8
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x1400b3ad0
jmp 0x1400b3afa
mov r8d, 1
movzx eax, word [rdx]
cmp word [rcx], ax
cmovb r8d, r10d
jmp 0x1400b3afd
mov r8d, r9d
test r8d, r8d
jne 0x1400b3b17
cmp rbx, 1
jne 0x1400b3b17
mov word [rbp - 0x30], 0x8101
mov byte [rbp - 0x2e], 0x81
jmp 0x1400b3bec
lea rcx, [rbp - 0x68]
cmp r15, 8
cmovae rcx, r12
mov r8d, 1
cmp rbx, r8
cmovb r8, rbx
test r8, r8
je 0x1400b3b6a
lea rdx, [0x140202678]
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400b3b58
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x1400b3b40
jmp 0x1400b3b6a
mov r8d, 1
movzx eax, word [rdx]
cmp word [rcx], ax
cmovb r8d, r10d
jmp 0x1400b3b6d
mov r8d, r9d
test r8d, r8d
jne 0x1400b3b84
cmp rbx, 1
jne 0x1400b3b84
mov word [rbp - 0x30], 0x8181
mov byte [rbp - 0x2e], 0x81
jmp 0x1400b3bec
lea rcx, [rbp - 0x68]
cmp r15, 8
cmovae rcx, r12
mov r8d, 1
cmp rbx, r8
cmovb r8, rbx
test r8, r8
je 0x1400b3bda
lea rdx, [0x14020267c]
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400b3bc8
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x1400b3bb0
jmp 0x1400b3bda
mov r8d, 1
movzx eax, word [rdx]
cmp word [rcx], ax
cmovb r8d, r10d
jmp 0x1400b3bdd
mov r8d, r9d
test r8d, r8d
jne 0x1400b3bec
cmp rbx, 1
je 0x1400b3d03
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x70]
lea rdx, [0x140202680]
call fcn.1400b6a00
test eax, eax
je 0x1400b3d07
cmp qword [rdi + 0xc0], 0
sete al
mov r8, qword [rsp + 0x70]
test al, al
jne 0x1400b3c61
cmp r8, 0x39
ja 0x1400b3c3f
movabs rax, 0x200000010008000
bt rax, r8
jb 0x1400b3c61
cmp r8, 0x35
mov eax, 0x135
cmove r8, rax
mov qword [rsp + 0x70], r8
mov rcx, r8
call fcn.14014d210
mov rbx, rax
test rax, rax
jne 0x1400b3c83
movzx ecx, r8b
mov r8, r13
mov edx, 1
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ebx, eax
test rbx, rbx
je 0x1400b3d07
mov r8, qword [rsp + 0x70]
movzx edx, r8b
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x40]
mov ecx, ebx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
movsxd rdi, eax
test eax, eax
je 0x1400b3cfe
movzx r8d, word [rsp + 0x68]
mov edx, 1
mov rcx, qword [rsp + 0x50]
call fcn.140009d70
cmp edi, 1
jge 0x1400b3cfe
movzx eax, byte [rsp + 0x70]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x68]
lea r8, [rbp + 0xc0]
mov edx, eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov rdi, qword [rsp + 0x40]
add rsi, 3
mov rdx, qword [rsp + 0x48]
inc rdx
mov qword [rsp + 0x48], rdx
cmp rdx, qword [rsp + 0x58]
jne 0x1400b38a0
jmp 0x1400b3d48
lea rcx, [0x1401e3a20]
call fcn.140161f38
int3
lea rcx, [0x1401e3a20]
call fcn.140161f38
int3
lea rcx, [0x1401e3a20]
call fcn.140161f38
nop
cmp r15, 8
jb 0x1400b3d5f
lea r8, [r15 + 1]
mov rdx, r12
lea rcx, [rbp - 0x68]
call fcn.140003900
nop
mov r8, qword [rbp - 0x70]
cmp r8, 8
jb 0x1400b3d7b
inc r8
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x78]
call fcn.140003900
mov al, 1
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140185a60
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret