Function at 0x406a10
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x4c1a28]
sub esp, 0x11c
push ebx
push edi
mov edi, dword [0x4c3110]
mov bl, al
cmp edi, 1
jne 0x406a48
cmp byte [0x4c313c], 0
jne 0x406a48
movzx eax, bl
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + ecx], 0
mov byte [esp + 0xa], 0
je 0x406a4d
mov byte [esp + 0xa], 1
cmp byte [esp + 0x130], 0
je 0x406a7a
movzx eax, bl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ecx + 4], 0
mov al, 1
jne 0x407472
mov al, byte [esp + 0xa]
pop edi
pop ebx
add esp, 0x11c
ret
cmp dword [0x4c29f4], 0
je 0x406a92
test dl, dl
jne 0x406a92
mov byte [esp + 0xb], 1
cmp byte [esp + 0xa], dl
jne 0x406a97
mov byte [esp + 0xb], 0
mov al, byte [0x4c0e71]
push esi
cmp edi, 1
jne 0x406b68
cmp byte [0x4c313a], 0
je 0x406ab7
test dl, dl
jne 0x406b68
mov edx, dword [0x4c3114]
mov esi, dword [0x4c3118]
movzx ecx, bl
mov cl, byte [ecx + edx]
mov byte [esp + 0x12], 1
test cl, cl
jne 0x406ae5
movzx ecx, word [esp + 0x130]
mov cl, byte [ecx + esi]
test cl, cl
je 0x406b6d
mov dl, cl
shr cl, 2
shr dl, 1
and cl, 1
and dl, 1
je 0x406b8a
test cl, cl
jne 0x406b08
test al, 0x30
jne 0x406b08
test cl, cl
je 0x406b6d
test al, 0x30
jne 0x406b6d
movzx ecx, word [esp + 0x130]
mov edi, 4
mov dword [0x4c3110], edi
cmp byte [ecx + esi], 0
mov byte [0x4c311c], bl
setne cl
mov byte [0x4c3120], cl
mov cx, word [esp + 0x130]
mov word [0x4c311e], cx
test dl, dl
je 0x406b4c
mov byte [0x4c3121], 1
test al, 0x30
jne 0x406b53
mov byte [0x4c3121], 0
cmp byte [esp + 0xf], 0
jne 0x406b6d
mov al, byte [esp + 0xe]
pop esi
pop edi
pop ebx
add esp, 0x11c
ret
mov byte [esp + 0x12], 0
push ebp
movzx ebp, bl
lea ecx, [ebp - 0x21]
cmp ecx, 0x84
ja case.0x406b83.41
movzx edx, byte [ecx + 0x407488]
jmp dword [edx*4 + 0x40747c]
test cl, cl
je 0x406b08
jmp 0x406b04
pop ebp
pop esi
pop edi
mov al, 1
pop ebx
add esp, 0x11c
ret
cmp byte [esp + 0x13], 0
je case.0x406b83.41
mov ecx, dword [0x4bfbc4]
test ecx, ecx
je 0x406bcc
xor ecx, ecx
mov word [0x4bfbc8], cx
mov dword [0x4bfbc4], ecx
jmp 0x406bcc
mov ecx, dword [0x4bfbc4]
test al, al
je 0x406bf6
cmp edi, 1
jne 0x406bde
cmp byte [0x4c313b], 0
jne 0x406bf6
cmp al, 0x10
je 0x406bf6
cmp al, 0x20
je 0x406bf6
test al, 0xc
je 0x40746c
test al, 3
je 0x40746c
cmp bl, 8
jne 0x406c6c
test al, al
jne 0x406c6c
cmp byte [esp + 0x16], al
je 0x406c2d
cmp edi, 1
jne 0x406c2d
cmp byte [0x4c3138], al
je 0x406c2d
mov eax, dword [0x4c3144]
test eax, eax
je 0x406c2d
mov esi, dword [0x4c3140]
dec eax
xor edx, edx
mov dword [0x4c3144], eax
mov word [esi + eax*2], dx
cmp byte [esp + 0x13], 0
je 0x406c49
test ecx, ecx
je 0x406c49
dec ecx
xor eax, eax
mov dword [0x4bfbc4], ecx
mov word [ecx*2 + 0x4bfbc8], ax
cmp byte [0x4c3fbc], 0
je 0x40746c
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
mov byte [0x4c3fbc], 0
pop ebx
add esp, 0x11c
ret
mov ecx, 0x40
mov esi, 0x4c0e98
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x2c]
call fcn.004111a0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x406c98
or byte [esp + 0x40], 1
jmp 0x406c9d
and byte [esp + 0x40], 0xfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x406cb4
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x406cb6
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor ecx, ecx
cmp dword [0x4c0ffc], ecx
push eax
setne cl
lea edx, [esp + 0x20]
lea eax, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x138]
push 2
push edx
mov edx, dword [ecx + 4]
push eax
push edx
push ebp
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov edi, eax
mov dword [esp + 0x24], edi
test edi, edi
je 0x40746c
cmp byte [0x4c3fbc], 0
je 0x406d0e
cmp bl, 9
je 0x406d0e
mov byte [esp + 0x15], 1
cmp bl, 0x1b
jne 0x406d13
mov byte [esp + 0x15], 0
test edi, edi
jns 0x406d6c
cmp byte [esp + 0x15], 0
jne 0x406d6c
cmp byte [esp + 0x12], 0
je 0x406d5f
mov ax, word [esp + 0x134]
mov word [0x4c3fc0], ax
mov al, byte [0x4c0e71]
test al, 0x30
setne cl
mov byte [0x4c3fbc], bl
mov byte [0x4c3fc2], cl
test al, 3
je 0x406d58
mov byte [0x4c3fc3], 1
test al, 0xc
jne 0x406d5f
mov byte [0x4c3fc3], 0
pop ebp
pop esi
pop edi
xor al, al
pop ebx
add esp, 0x11c
ret
test byte [0x4c0e71], 3
jne 0x406d9c
mov eax, 0xd
cmp word [esp + 0x1c], ax
jne 0x406d8b
mov edx, 0xa
mov word [esp + 0x1c], dx
cmp word [esp + 0x1e], ax
jne 0x406d9c
mov eax, 0xa
mov word [esp + 0x1e], ax
cmp byte [esp + 0x13], 0
mov byte [esp + 0x17], 0
je 0x40714d
cmp esi, dword [0x4bfbc0]
je 0x406dc5
xor ecx, ecx
mov dword [0x4bfbc0], esi
mov word [0x4bfbc8], cx
jmp 0x406e11
mov ecx, dword [0x4bfbc4]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x406e11
mov eax, 0x4bfc22
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406de0
sub eax, edx
sar eax, 1
mov dword [0x4bfbc4], eax
lea eax, [eax + eax + 2]
push eax
push 0x4bfc22
push 0x4bfbc8
call fcn.00486da0
mov ecx, dword [0x4bfbc4]
add esp, 0xc
mov dx, word [esp + 0x1c]
mov word [ecx*2 + 0x4bfbc8], dx
inc ecx
mov dword [0x4bfbc4], ecx
cmp edi, 1
jle 0x406e3e
mov ax, word [esp + 0x1e]
mov word [ecx*2 + 0x4bfbc8], ax
inc ecx
mov dword [0x4bfbc4], ecx
xor edx, edx
mov word [ecx*2 + 0x4bfbc8], dx
test ecx, ecx
je 0x40714d
mov dword [esp + 0x28], edx
cmp dword [0x4c29f8], edx
jbe 0x40714d
mov eax, dword [0x4c29f4]
mov edx, dword [esp + 0x28]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x26], 0
jne 0x406f81
cmp byte [ebp + 0x2e], 0
je 0x406eb5
movzx eax, byte [ebp + 0x25]
cmp ecx, eax
jle 0x406f81
movzx eax, word [ecx*2 + 0x4bfbc6]
push eax
push 0x4bd420
call fcn.00487101
add esp, 8
test eax, eax
je 0x406f7b
mov ecx, dword [0x4bfbc4]
lea edi, [ecx*2 + 0x4bfbc4]
jmp 0x406ec8
movzx edx, byte [ebp + 0x25]
cmp ecx, edx
jl 0x406f81
lea edi, [ecx*2 + 0x4bfbc6]
cmp byte [ebp + 0x29], 0
movzx edx, byte [ebp + 0x25]
mov eax, dword [ebp + 4]
lea esi, [eax + edx*2 - 2]
je 0x406ef4
cmp esi, eax
jb 0x406f30
lea ecx, [ecx]
mov dx, word [edi]
cmp dx, word [esi]
jne 0x406f30
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x406ee0
jmp 0x406f30
cmp esi, eax
jb 0x406f30
jmp 0x406f00
movzx eax, word [edi]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
push eax
call ebx
movzx ecx, word [esi]
push ecx
mov dword [esp + 0x1c], eax
call ebx
mov ecx, dword [esp + 0x18]
cmp cx, ax
jne 0x406f2a
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 4]
jae 0x406f00
mov ecx, dword [0x4bfbc4]
cmp esi, dword [ebp + 4]
jae 0x406f81
cmp byte [ebp + 0x2f], 0
jne 0x406f51
cmp edi, 0x4bfbc8
jb 0x406f51
movzx edx, word [edi]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x406f7b
mov eax, dword [ebp]
test eax, eax
je 0x406f5c
mov eax, dword [eax]
jmp 0x406f61
mov eax, 0x4a596c
mov ecx, dword [ebp + 0xc]
mov bl, byte [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x10]
call fcn.00409260
add esp, 8
test eax, eax
jne 0x406f9b
mov ecx, dword [0x4bfbc4]
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, dword [0x4c29f8]
jb 0x406e60
jmp 0x407149
xor edi, edi
cmp byte [ebp + 0x2a], 0
je 0x40707d
cmp byte [ebp + 0x2e], 0
mov ebx, dword [0x4bfbc4]
lea ebx, [ebx*2 + 0x4bfbc8]
je 0x406fbd
sub ebx, 2
movzx ecx, byte [ebp + 0x25]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov dword [esp + 0x18], edi
mov byte [esp + 0x14], 0
mov byte [esp + 0x13], 0
cmp esi, ebx
jae 0x407026
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
nop
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x406ff8
movzx eax, word [esi]
push eax
call edi
test eax, eax
je 0x407017
cmp byte [esp + 0x14], 0
jne 0x407013
movzx ecx, word [esi]
push ecx
mov byte [esp + 0x18], 1
call edi
test eax, eax
je 0x407013
mov byte [esp + 0x13], 1
inc dword [esp + 0x18]
add esi, 2
cmp esi, ebx
jb 0x406fe0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40702a
xor edi, edi
jmp 0x40707d
cmp eax, 1
jne 0x40703d
movzx edi, byte [esp + 0x13]
neg edi
sbb edi, edi
and edi, 2
jmp 0x40707d
cmp byte [esp + 0x13], 0
jne 0x407048
xor edi, edi
jmp 0x40707d
movzx edx, byte [ebp + 0x25]
add edx, edx
mov esi, ebx
sub esi, edx
mov edi, 2
cmp esi, ebx
jae 0x407076
jmp 0x407060
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x407074
add esi, edi
cmp esi, ebx
jb 0x407060
cmp esi, ebx
jne 0x40707d
mov edi, 1
mov dl, byte [ebp + 0x2b]
test dl, dl
jne 0x407089
cmp byte [ebp + 0x2c], dl
je 0x407093
mov byte [esp + 0x12], 0
mov byte [esp + 0x17], 1
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0x28]
mov dword [ecx], eax
mov cl, byte [ebp + 0x2e]
test cl, cl
je 0x4070b6
mov eax, dword [0x4bfbc4]
movzx eax, word [eax*2 + 0x4bfbc6]
jmp 0x4070cd
cmp byte [esp + 0x15], 0
je 0x4070cb
cmp byte [esp + 0x17], 0
je 0x4070cb
mov eax, 1
jmp 0x4070cd
xor eax, eax
movzx esi, di
movzx eax, ax
shl esi, 0x10
or esi, eax
mov eax, dword [esp + 0x140]
mov dword [eax], esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp word [esi], ax
je 0x407117
test cl, cl
je 0x407110
mov ecx, dword [0x4bfbc4]
mov dx, word [ecx*2 + 0x4bfbc6]
mov word [0x4bfbc8], dx
mov dword [0x4bfbc4], 1
jmp 0x40712f
mov dword [0x4bfbc4], eax
jmp 0x40712f
test dl, dl
je 0x40712f
movzx edx, byte [ebp + 0x25]
sub dword [0x4bfbc4], edx
test cl, cl
je 0x40712f
dec dword [0x4bfbc4]
cmp byte [ebp + 0x30], al
je 0x407139
mov dword [0x4bfbc4], eax
mov ecx, dword [0x4bfbc4]
xor eax, eax
mov word [ecx*2 + 0x4bfbc8], ax
mov edi, dword [esp + 0x24]
cmp byte [esp + 0x15], 0
je 0x40726c
cmp byte [esp + 0x12], 0
mov al, byte [0x4c3fbc]
mov byte [esp + 0x18], al
mov byte [0x4c3fbc], 0
je 0x40726c
mov cl, byte [0x4c0e71]
mov byte [0x4bfd86], al
xor al, al
test cl, 0x10
je 0x40718d
mov al, 0xa0
mov byte [esp + 0x24], al
jmp 0x40719f
test cl, 0x20
je 0x40719a
mov al, 0xa1
mov byte [esp + 0x24], al
jmp 0x40719f
mov byte [esp + 0x24], 0xa0
mov esi, dword [esp + 0x24]
test al, al
mov al, byte [0x4c3fc2]
setne cl
mov byte [esp + 0x14], cl
cmp al, cl
je 0x4071d1
push 0xffc3d44d
xor edx, edx
push 0
test al, al
sete dl
push 0
push 0
push esi
push edx
call fcn.0040eaa0
add esp, 0x18
cmp byte [0x4c3fc3], 0
je 0x407314
test byte [0x4c0e71], 8
jne 0x407314
push 0xffc3d44d
push 0
push 0
push 0
push 0xa5
push 0
mov bl, 1
call fcn.0040eaa0
add esp, 0x18
movzx eax, word [0x4c3fc0]
mov ecx, dword [esp + 0x18]
push 0xffc3d44e
push 0
push 0
push eax
push ecx
push 2
call fcn.0040eaa0
add esp, 0x18
test bl, bl
je 0x407245
push 0xffc3d44d
push 0
push 0
push 0
push 0xa5
push 1
call fcn.0040eaa0
add esp, 0x18
mov al, byte [0x4c3fc2]
cmp al, byte [esp + 0x14]
je 0x40726c
push 0xffc3d44d
xor edx, edx
push 0
test al, al
setne dl
push 0
push 0
push esi
push edx
call fcn.0040eaa0
add esp, 0x18
cmp byte [esp + 0x16], 0
je 0x40746c
cmp dword [0x4c3110], 1
jne 0x40746c
cmp byte [esp + 0x17], 0
jne 0x40746c
mov eax, dword [0x4c3144]
cmp eax, dword [0x4c3148]
jge 0x4072c2
mov ecx, dword [0x4c3140]
mov dx, word [esp + 0x1c]
mov word [ecx + eax*2], dx
mov eax, dword [0x4c3144]
mov edx, dword [0x4c3140]
inc eax
xor ecx, ecx
mov dword [0x4c3144], eax
mov word [edx + eax*2], cx
cmp edi, 1
jle 0x4072fa
mov eax, dword [0x4c3144]
cmp eax, dword [0x4c3148]
jge 0x4072fa
mov ecx, dword [0x4c3140]
mov dx, word [esp + 0x1e]
mov word [ecx + eax*2], dx
mov eax, dword [0x4c3144]
mov edx, dword [0x4c3140]
inc eax
xor ecx, ecx
mov dword [0x4c3144], eax
mov word [edx + eax*2], cx
mov edi, dword [0x4c3128]
test edi, edi
jne 0x40731b
mov eax, dword [0x4c3148]
cmp dword [0x4c3144], eax
jmp 0x407460
xor bl, bl
jmp 0x407207
xor esi, esi
cmp byte [0x4c313d], 0
je 0x4073b9
cmp byte [0x4c3139], 0
je 0x407384
test edi, edi
je 0x407454
jmp 0x407340
mov ecx, dword [0x4c3124]
mov eax, dword [ecx + esi*4]
mov edx, dword [0x4c3140]
push eax
push edx
call fcn.00487128
add esp, 8
test eax, eax
jne 0x40736b
inc esi
cmp esi, dword [0x4c3128]
jb 0x407340
jmp 0x407454
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
mov dword [0x4c3110], 3
pop ebx
add esp, 0x11c
ret
test edi, edi
je 0x407454
lea esp, [esp]
mov eax, dword [0x4c3140]
mov ecx, dword [0x4c3124]
push eax
mov eax, dword [ecx + esi*4]
call fcn.0046b920
add esp, 4
test eax, eax
jne 0x40736b
inc esi
cmp esi, dword [0x4c3128]
jb 0x407390
jmp 0x407454
cmp byte [0x4c3139], 0
je 0x40741a
test edi, edi
je 0x407454
mov ebx, dword [0x4c3140]
mov ebp, dword [0x4c3124]
mov ecx, dword [ebp + esi*4]
mov eax, ebx
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407406
test dx, dx
je 0x407402
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407406
add eax, 4
add ecx, 4
test dx, dx
jne 0x4073e0
xor eax, eax
jmp 0x40740b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40736b
inc esi
cmp esi, edi
jb 0x4073d6
jmp 0x407454
test edi, edi
je 0x407454
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x407430
mov edx, dword [0x4c3124]
mov eax, dword [edx + esi*4]
mov ecx, dword [0x4c3140]
push eax
push ecx
call edi
test eax, eax
je 0x40736b
inc esi
cmp esi, dword [0x4c3128]
jb 0x407430
mov edx, dword [0x4c3148]
cmp dword [0x4c3144], edx
jl 0x40746c
mov dword [0x4c3110], 5
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x11c
ret