Function at 0x412cfd
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov bl, byte [ebp + 0xc]
movzx ax, bl
or eax, dword [ebp + 0x10]
test ax, ax
je 0x4131fe
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
jne 0x412d2a
mov dword [ebp + 0x1c], 0xffc3d44d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x467248]
mov eax, dword [0x469480]
sete byte [ebp - 1]
cmp eax, edi
je 0x412d4d
cmp byte [ebp - 1], 0
mov byte [ebp - 2], 1
je 0x412d51
mov byte [ebp - 2], 0
cmp eax, 1
je 0x412d5c
cmp byte [ebp - 1], 0
je 0x412d60
mov byte [ebp + 0x18], 0
test bl, bl
jne 0x412d73
push dword [ebp + 0x10]
call fcn.00413dd9
mov bl, al
mov byte [ebp + 0xc], bl
jmp 0x412d86
cmp word [ebp + 0x10], di
jne 0x412d87
push edi
push dword [ebp + 0xc]
call fcn.00413e9c
pop ecx
mov dword [ebp + 0x10], eax
pop ecx
mov al, byte [ebp + 0x11]
neg al
sbb eax, eax
neg eax
cmp dword [0x469480], 2
mov dword [ebp - 0x10], eax
je 0x412da5
cmp byte [0x468399], 0
je 0x412dc6
cmp bl, 0xa0
jb 0x412dc6
cmp bl, 0xa1
jbe 0x412dc1
cmp bl, 0xa3
jbe 0x412dbd
cmp bl, 0xa5
ja 0x412dc6
mov bl, 0x12
jmp 0x412dc3
mov bl, 0x11
jmp 0x412dc3
mov bl, 0x10
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x14], edi
je 0x412eef
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00413201
add esp, 0xc
test al, al
je 0x412e89
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [ebp + 8], edi
mov cl, 0x80
mov dl, 0x7f
jne 0x412e0a
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
or byte [eax], cl
jmp 0x412e1c
cmp dword [ebp + 8], 1
jne 0x412e1c
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
and byte [eax], dl
cmp bl, 0xa0
jb 0x412e7c
cmp bl, 0xa1
jbe 0x412e64
cmp bl, 0xa3
jbe 0x412e4a
cmp bl, 0xa5
ja 0x412e7c
test byte [ebp - 0x78], cl
jne 0x412e42
test byte [ebp - 0x77], cl
jne 0x412e42
and byte [ebp - 0x10a], dl
jmp 0x412e7c
or byte [ebp - 0x10a], cl
jmp 0x412e7c
test byte [ebp - 0x7a], cl
jne 0x412e5c
test byte [ebp - 0x79], cl
jne 0x412e5c
and byte [ebp - 0x10b], dl
jmp 0x412e7c
or byte [ebp - 0x10b], cl
jmp 0x412e7c
test byte [ebp - 0x7c], cl
jne 0x412e76
test byte [ebp - 0x7b], cl
jne 0x412e76
and byte [ebp - 0x10c], dl
jmp 0x412e7c
or byte [ebp - 0x10c], cl
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, word [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
shl esi, 0x10
cmp dword [ebp + 8], 1
je 0x412eb0
mov eax, esi
or eax, 1
push eax
movzx eax, bl
push eax
push 0x100
push dword [ebp + 0x14]
call edi
cmp byte [ebp + 0x18], 0
je 0x412eca
cmp dword [ebp + 8], 2
jne 0x412eca
mov eax, dword [0x465108]
push dword [eax + 0x64]
call fcn.004123cc
pop ecx
cmp dword [ebp + 8], 0
je 0x4131d9
movzx eax, byte [ebp + 0xc]
or esi, 0xc0000001
push esi
push eax
push 0x101
push dword [ebp + 0x14]
call edi
jmp 0x4131d9
cmp byte [0x467c8a], 0
mov eax, dword [ebp + 8]
mov dword [0x469424], eax
mov byte [0x469428], bl
je 0x412f75
cmp bl, 0x12
je 0x412f15
cmp bl, 0xa4
je 0x412f15
cmp bl, 0xa5
jne 0x412f75
cmp byte [ebp - 1], 0
jne 0x412f75
cmp byte [0x46839b], 0
je 0x412f75
push edi
mov byte [ebp - 5], 1
call fcn.0041ad7b
pop ecx
cmp byte [ebp - 1], 0
lea esi, [ebp - 0x1c]
jne 0x412f3d
mov esi, 0x46941c
cmp bl, 0xa5
mov dword [ebp - 0xc], esi
jne 0x412f57
cmp byte [ebp - 2], 0
jne 0x412f57
cmp dword [0x467388], edi
mov byte [ebp - 3], 1
jne 0x412f5b
mov byte [ebp - 3], 0
mov al, byte [ebp - 3]
test al, al
mov byte [ebp - 4], al
je 0x412fae
cmp byte [ebp - 1], 0
jne 0x412f7b
mov eax, dword [0x469420]
mov dword [ebp - 0x14], eax
jmp 0x412fa6
mov byte [ebp - 5], 0
jmp 0x412f2f
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
je 0x412f8f
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x412f91
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edi
push eax
mov dword [ebp - 0x14], eax
call fcn.004132da
pop ecx
pop ecx
mov dword [esi], eax
cmp dword [esi], edi
je 0x412fcd
mov byte [ebp - 4], 0
mov bl, byte [ebp + 0xf]
xor edi, edi
cmp byte [ebp - 2], 0
je 0x412ffb
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00413201
add esp, 0xc
mov byte [ebp - 0x18], al
jmp 0x412fff
cmp byte [0x4683a2], 0
sete bl
dec bl
and bl, 0x91
add bl, 0x11
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x1c]
mov dword [0x46737c], eax
jmp 0x412fb1
mov byte [ebp - 0x18], 0
cmp byte [ebp - 1], 0
jne 0x413022
mov eax, dword [0x469480]
cmp eax, 2
je 0x413022
cmp dword [0x467388], edi
je 0x41301c
cmp eax, 1
jne 0x413022
mov byte [ebp - 1], 1
jmp 0x413026
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
je 0x4130f0
cmp byte [ebp - 2], 0
je 0x413055
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00411d6c
add esp, 0x14
jmp 0x4130c7
cmp byte [ebp - 3], 0
je 0x41306b
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x41306b
mov eax, dword [ebp + 0x1c]
mov dword [0x467380], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x467380], edi
je 0x4130c7
cmp dword [0x46737c], edi
mov byte [ebp - 4], 0
je 0x41309b
mov dword [0x46737c], edi
push 4
jmp 0x4130b8
cmp byte [ebp - 6], 0
jne 0x4130c7
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
add eax, 4
push eax
push dword [ebp - 0x14]
call fcn.004132da
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp + 0xc], 0x90
jne 0x4130db
cmp byte [0x468399], 0
je 0x4130db
call fcn.00415d55
cmp byte [ebp - 1], 0
je 0x4130f0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00415d7e
add esp, 0xc
cmp byte [ebp + 0x18], 0
je 0x413119
cmp dword [ebp + 8], 2
jne 0x413119
cmp dword [0x469480], 2
mov eax, dword [0x465108]
jne 0x41310f
mov eax, dword [eax + 0x68]
jmp 0x413112
mov eax, dword [eax + 0x64]
push eax
call fcn.004123cc
pop ecx
cmp dword [ebp + 8], edi
je 0x4131cb
or dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
je 0x413145
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00411d6c
add esp, 0x14
jmp 0x4131b5
cmp byte [ebp - 3], 0
je 0x41315b
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x41315b
mov eax, dword [ebp + 0x1c]
mov dword [0x467384], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x467384], edi
je 0x4131b5
cmp dword [0x46737c], edi
je 0x413187
mov dword [0x46737c], edi
push 4
jmp 0x4131a6
cmp byte [ebp - 6], 0
je 0x4131b5
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
neg eax
add eax, 3
push eax
push dword [ebp - 0x14]
call fcn.004132da
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp - 1], 0
je 0x4131cb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
call fcn.00415d7e
add esp, 0xc
cmp byte [ebp - 5], 0
je 0x4131d9
push 1
call fcn.0041ad7b
pop ecx
cmp byte [ebp + 0x18], 0
pop edi
pop esi
je 0x4131fe
cmp dword [0x469480], 2
mov eax, dword [0x465108]
jne 0x4131f4
mov eax, dword [eax + 0x60]
jmp 0x4131f7
mov eax, dword [eax + 0x5c]
push eax
call fcn.004123cc
pop ecx
pop ebx
leave
ret