Function at 0x10026959
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
neg edi
sbb edi, edi
and edi, 0x40000000
xor bl, bl
mov esi, eax
add edi, 0xc0000000
mov byte [ebp - 8], bl
xor al, al
mov edx, dword [ebp + 0xc]
movzx ecx, al
cmp dword [ecx*8 + 0x1004dbe0], edx
je 0x10026995
inc al
cmp al, 0x58
jb 0x1002697e
jmp 0x100269b2
movzx eax, al
cmp byte [eax*8 + 0x1004dbe5], 0
mov bl, byte [eax*8 + 0x1004dbe4]
mov byte [ebp - 8], bl
je 0x100269b2
or edi, 0x1000000
movzx eax, bl
mov dword [ebp - 4], eax
cmp eax, 0xfe50
jl 0x100269ca
cmp eax, 0xfe60
jle 0x10026c2a
push 0xffffffffffffffff
push dword [esi + 0x7b8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test bl, bl
je 0x10026a4e
push dword [ebp + 0x10]
mov al, bl
call fcn.1002664a
mov ebx, dword [ebp - 4]
pop ecx
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test al, al
je 0x100269ff
movzx eax, al
shl eax, 0x10
or edi, eax
mov eax, dword [esi + 0x1c]
test byte [eax + 0x1a], 0x80
je 0x10026a12
test byte [eax + 0x19], 0x80
jne 0x10026a12
mov al, 1
jmp 0x10026a14
xor al, al
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
je 0x10026a30
test al, al
setne cl
mov byte [esi + 0x7e7], 1
lea ecx, [ecx*4 + 0x100]
jmp 0x10026a43
test al, al
setne cl
mov byte [esi + 0x7e7], 0
lea ecx, [ecx*4 + 0x101]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 4], ebx
jmp 0x10026b7c
mov al, byte [esi + 0x7e7]
test al, al
jne 0x10026a68
cmp byte [esi + 0x7e8], al
je 0x10026a89
test al, al
je 0x10026b3c
mov eax, dword [esi + 0x1c]
test byte [eax + 0x18], 0x80
je 0x10026b3c
cmp byte [eax + 0x1a], 0
jne 0x10026b3c
cmp byte [eax + 0x19], 0
jne 0x10026b3c
cmp dword [ebp + 0x10], 0
je 0x10026b2b
push dword [ebp + 0xc]
call fcn.10026705
movzx ebx, ax
pop ecx
test bx, bx
je 0x10026b2b
mov eax, dword [esi + 0x1c]
test byte [eax + 0x1a], 0x80
je 0x10026ab7
or edi, 0x20000000
cmp byte [eax + 0x197], 0
mov ecx, ebx
mov dword [ebp - 4], ecx
mov dword [ebp + 0x10], 0x102
je 0x10026b7c
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx eax, ax
cmp eax, 0xffffffff
je 0x10026b06
push dword [ebp - 0xc]
push ebx
push eax
call fcn.10026878
add esp, 0xc
test al, al
jne 0x10026b7c
push 0
push ebx
call fcn.100268ce
pop ecx
pop ecx
test eax, eax
je 0x10026b7c
push eax
mov eax, dword [esi + 0x1c]
push 6
push dword [eax + 0x193]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10026b7c
push dword [esi + 0x7b8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x10026c2a
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.10026705
movzx eax, ax
pop ecx
push eax
call fcn.100268ce
cmp dword [ebp + 0x10], 0
pop ecx
pop ecx
je 0x10026b6e
mov byte [esi + 0x7e8], 1
mov dword [ebp + 0x10], 0x100
jmp 0x10026b7c
mov byte [esi + 0x7e8], 0
mov dword [ebp + 0x10], 0x101
push dword [esi + 0x7b8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 8]
mov eax, esi
call fcn.1002678e
pop ecx
test al, al
je 0x10026bc4
cmp byte [esi + 0x7e4], 0
je 0x10026c2a
cmp byte [esi + 0x748], 0
mov eax, esi
jne 0x10026bbd
call fcn.1002a29d
mov byte [esi + 0x748], 1
jmp 0x10026c2a
call fcn.1002a2ee
jmp 0x10026c2a
push dword [ebp - 8]
mov ecx, esi
call fcn.10026818
pop ecx
test al, al
je 0x10026bf4
cmp byte [esi + 0x7e6], 0
je 0x10026c2a
mov eax, dword [esi + 0x1c]
push 1
push 6
push dword [eax + 0x193]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10026c2a
cmp byte [esi + 0x7e5], 0
jne 0x10026c23
mov eax, dword [esi + 0x1c]
push 0
push 3
push dword [eax + 0x193]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [esi + 0x7e5], 0
pop edi
pop esi
pop ebx
leave
ret