Function at 0x41c300
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
shr ebx, 0x10
mov dword [ebp - 0x210], eax
mov byte [ebp - 0x20c], 0
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyNameTextA]
test bl, 2
je 0x41c3e7
push 0
push 0x11
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call edi
cmp byte [ebp - 0x108], 0
je 0x41c3a4
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x41c376
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c386
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x41c3c9
lea ecx, [ebp - 0x20c]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41c3b0
mov eax, dword [str.Ctrl]
mov dword [ecx], eax
mov al, byte [0x4745d0]
mov byte [ecx + 4], al
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41c3d0
mov eax, dword [0x4745d4]
mov dword [edi], eax
mov edi, dword [sym.imp.USER32.dll_GetKeyNameTextA]
test bl, 4
je 0x41c489
push 0
push 0x12
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call edi
cmp byte [ebp - 0x108], 0
je 0x41c453
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x41c425
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c435
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x41c471
lea edi, [ebp - 0x20c]
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41c460
mov eax, dword [0x4745d8]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41c478
mov eax, dword [0x4745d4]
mov dword [edi], eax
test bl, 1
je 0x41c538
push 0
push 0x10
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp byte [ebp - 0x108], 0
je 0x41c4fe
lea edx, [ebp - 0x108]
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x41c4d0
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c4e0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x41c520
lea ecx, [ebp - 0x20c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41c505
mov eax, dword [str.Shift]
mov dword [ecx], eax
mov ax, word [0x4745e0]
mov word [ecx + 4], ax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41c527
mov eax, dword [0x4745d4]
mov dword [edi], eax
test bl, 8
je 0x41c5d9
push 0
push 0x5b
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp byte [ebp - 0x108], 0
je 0x41c5a8
lea edx, [ebp - 0x108]
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x41c580
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c590
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41c5c1
lea edi, [ebp - 0x20c]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41c5b0
mov eax, dword [0x4745e4]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41c5c8
mov eax, dword [0x4745d4]
mov dword [edi], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov eax, dword [ebp + 8]
push 0
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
push 0x104
or eax, 0x200
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x41c614
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c624
push dword [ebp + 0x10]
mov ecx, edx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
push dword [ebp - 0x210]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041a8b0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042bd08
mov esp, ebp
pop ebp
ret