Function at 0x410525
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov bl, byte [ebp + 0xc]
movzx ax, bl
or eax, dword [ebp + 0x10]
test ax, ax
je 0x410a24
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
jne 0x410552
mov dword [ebp + 0x1c], 0xffc3d44d
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
cmp eax, dword [0x465130]
mov eax, dword [0x466f78]
sete byte [ebp - 1]
cmp eax, edi
je 0x410577
cmp byte [ebp - 1], 0
mov byte [ebp - 2], 1
je 0x41057b
mov byte [ebp - 2], 0
cmp eax, 1
je 0x410586
cmp byte [ebp - 1], 0
je 0x41058a
mov byte [ebp + 0x18], 0
test bl, bl
jne 0x41059d
push dword [ebp + 0x10]
call fcn.004115a8
mov bl, al
mov byte [ebp + 0xc], bl
jmp 0x4105b0
cmp word [ebp + 0x10], di
jne 0x4105b1
push edi
push dword [ebp + 0xc]
call fcn.0041166b
pop ecx
mov dword [ebp + 0x10], eax
pop ecx
mov al, byte [ebp + 0x11]
neg al
sbb eax, eax
neg eax
cmp dword [0x466f78], 2
mov dword [ebp - 0x10], eax
je 0x4105cf
cmp byte [0x466341], 0
je 0x4105f0
cmp bl, 0xa0
jb 0x4105f0
cmp bl, 0xa1
jbe 0x4105eb
cmp bl, 0xa3
jbe 0x4105e7
cmp bl, 0xa5
ja 0x4105f0
mov bl, 0x12
jmp 0x4105ed
mov bl, 0x11
jmp 0x4105ed
mov bl, 0x10
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x14], edi
je 0x410717
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00410a27
add esp, 0xc
test al, al
je 0x4106b3
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [ebp + 8], edi
mov cl, 0x80
mov dl, 0x7f
jne 0x410634
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
or byte [eax], cl
jmp 0x410646
cmp dword [ebp + 8], 1
jne 0x410646
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
and byte [eax], dl
cmp bl, 0xa0
jb 0x4106a6
cmp bl, 0xa1
jbe 0x41068e
cmp bl, 0xa3
jbe 0x410674
cmp bl, 0xa5
ja 0x4106a6
test byte [ebp - 0x78], cl
jne 0x41066c
test byte [ebp - 0x77], cl
jne 0x41066c
and byte [ebp - 0x10a], dl
jmp 0x4106a6
or byte [ebp - 0x10a], cl
jmp 0x4106a6
test byte [ebp - 0x7a], cl
jne 0x410686
test byte [ebp - 0x79], cl
jne 0x410686
and byte [ebp - 0x10b], dl
jmp 0x4106a6
or byte [ebp - 0x10b], cl
jmp 0x4106a6
test byte [ebp - 0x7c], cl
jne 0x4106a0
test byte [ebp - 0x7b], cl
jne 0x4106a0
and byte [ebp - 0x10c], dl
jmp 0x4106a6
or byte [ebp - 0x10c], cl
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, word [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
shl esi, 0x10
cmp dword [ebp + 8], 1
je 0x4106da
mov eax, esi
or eax, 1
push eax
movzx eax, bl
push eax
push pe_nt_image_headers32
push dword [ebp + 0x14]
call edi
cmp byte [ebp + 0x18], 0
je 0x4106f2
cmp dword [ebp + 8], 2
jne 0x4106f2
push dword [0x46519c]
call fcn.0040fc03
pop ecx
cmp dword [ebp + 8], 0
je 0x410a02
movzx eax, byte [ebp + 0xc]
or esi, 0xc0000001
push esi
push eax
push 0x101
push dword [ebp + 0x14]
call edi
jmp 0x410a02
cmp byte [0x465c32], 0
mov eax, dword [ebp + 8]
mov dword [0x466f1c], eax
mov byte [0x466f20], bl
je 0x4107a1
cmp bl, 0x12
je 0x41073d
cmp bl, 0xa4
je 0x41073d
cmp bl, 0xa5
jne 0x4107a1
cmp byte [0x466343], 0
je 0x4107a1
call esi
cmp eax, dword [0x465c44]
jne 0x4107a1
push edi
mov byte [ebp - 5], 1
call fcn.00418254
pop ecx
cmp byte [ebp - 1], 0
lea esi, [ebp - 0x1c]
jne 0x410769
mov esi, 0x466f14
cmp bl, 0xa5
mov dword [ebp - 0xc], esi
jne 0x410783
cmp byte [ebp - 2], 0
jne 0x410783
cmp dword [0x465338], edi
mov byte [ebp - 3], 1
jne 0x410787
mov byte [ebp - 3], 0
mov al, byte [ebp - 3]
test al, al
mov byte [ebp - 4], al
je 0x4107da
cmp byte [ebp - 1], 0
jne 0x4107a7
mov eax, dword [0x466f18]
mov dword [ebp - 0x14], eax
jmp 0x4107d2
mov byte [ebp - 5], 0
jmp 0x41075b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
je 0x4107bb
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x4107bd
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edi
push eax
mov dword [ebp - 0x14], eax
call fcn.00410b00
pop ecx
pop ecx
mov dword [esi], eax
cmp dword [esi], edi
je 0x4107f9
mov byte [ebp - 4], 0
mov bl, byte [ebp + 0xf]
xor edi, edi
cmp byte [ebp - 2], 0
je 0x410827
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00410a27
add esp, 0xc
mov byte [ebp - 0x18], al
jmp 0x41082b
cmp byte [0x466349], 0
sete bl
dec bl
and bl, 0x91
add bl, 0x11
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x1c]
mov dword [0x46532c], eax
jmp 0x4107dd
mov byte [ebp - 0x18], 0
cmp byte [ebp - 1], 0
jne 0x41084e
mov eax, dword [0x466f78]
cmp eax, 2
je 0x41084e
cmp dword [0x465338], edi
je 0x410848
cmp eax, 1
jne 0x41084e
mov byte [ebp - 1], 1
jmp 0x410852
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
je 0x41091c
cmp byte [ebp - 2], 0
je 0x410881
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.0040f612
add esp, 0x14
jmp 0x4108f3
cmp byte [ebp - 3], 0
je 0x410897
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x410897
mov eax, dword [ebp + 0x1c]
mov dword [0x465330], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x465330], edi
je 0x4108f3
cmp dword [0x46532c], edi
mov byte [ebp - 4], 0
je 0x4108c7
mov dword [0x46532c], edi
push 4
jmp 0x4108e4
cmp byte [ebp - 6], 0
jne 0x4108f3
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
add eax, 4
push eax
push dword [ebp - 0x14]
call fcn.00410b00
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp + 0xc], 0x90
jne 0x410907
cmp byte [0x466341], 0
je 0x410907
call fcn.00413316
cmp byte [ebp - 1], 0
je 0x41091c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0041333f
add esp, 0xc
cmp byte [ebp + 0x18], 0
je 0x410942
cmp dword [ebp + 8], 2
jne 0x410942
cmp dword [0x466f78], 2
mov eax, dword [0x4651a0]
je 0x41093b
mov eax, dword [0x46519c]
push eax
call fcn.0040fc03
pop ecx
cmp dword [ebp + 8], edi
je 0x4109f4
or dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
je 0x41096e
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.0040f612
add esp, 0x14
jmp 0x4109de
cmp byte [ebp - 3], 0
je 0x410984
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x410984
mov eax, dword [ebp + 0x1c]
mov dword [0x465334], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x465334], edi
je 0x4109de
cmp dword [0x46532c], edi
je 0x4109b0
mov dword [0x46532c], edi
push 4
jmp 0x4109cf
cmp byte [ebp - 6], 0
je 0x4109de
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
neg eax
add eax, 3
push eax
push dword [ebp - 0x14]
call fcn.00410b00
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp - 1], 0
je 0x4109f4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
call fcn.0041333f
add esp, 0xc
cmp byte [ebp - 5], 0
je 0x410a02
push 1
call fcn.00418254
pop ecx
cmp byte [ebp + 0x18], 0
pop edi
pop esi
je 0x410a24
cmp dword [0x466f78], 2
mov eax, dword [0x465198]
je 0x410a1d
mov eax, dword [0x465194]
push eax
call fcn.0040fc03
pop ecx
pop ebx
leave
ret