Function at 0x10004bc1
Capabilities:
Create thread
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x10
mov eax, ecx
mov dword [esp + 4], edx
push ebx
push ebp
mov dword [esp + 0x14], eax
mov ebp, 0xc0000000
mov eax, dword [eax]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [eax + 0x28]
xor eax, eax
cmp dword [esp + 0x28], eax
cmovne ebp, eax
xor bl, bl
mov byte [esp + 0x13], bl
cmp esi, 0xfe50
jb 0x10004c03
cmp esi, 0xfe60
jbe 0x10004f90
xor cl, cl
movzx eax, cl
cmp dword [eax*4 + 0x1003c0f4], esi
je 0x10004f90
inc cl
cmp cl, 3
jb 0x10004c05
xor al, al
movzx ecx, al
cmp dword [ecx*8 + 0x1003c100], esi
je 0x10004c32
inc al
cmp al, 0x58
jb 0x10004c1e
jmp 0x10004c4d
cmp byte [ecx*8 + 0x1003c105], 0
mov bl, byte [ecx*8 + 0x1003c104]
mov byte [esp + 0x13], bl
je 0x10004c4d
or ebp, 0x1000000
push 0x2710
push dword [edi + 0x508]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x18], eax
test bl, bl
jne 0x10004dcf
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.10004b1b
test al, al
je 0x10004c9a
mov ecx, esi
call fcn.10004817
mov ecx, eax
call fcn.10004b04
mov bl, al
mov byte [esp + 0x13], bl
test bl, bl
jne 0x10004dcf
cmp byte [edi + 0x537], 0
jne 0x10004ce7
cmp byte [edi + 0x538], 0
je 0x10004cfc
and dword [esp + 0x24], 0
mov ecx, esi
call fcn.10004817
lea edx, [esp + 0x24]
mov ecx, eax
call fcn.10004a84
cmp dword [esp + 0x28], 0
je 0x10004db9
mov esi, dword [esp + 0x24]
mov ebx, 0x100
mov byte [edi + 0x538], 1
mov dword [esp + 0x28], esi
jmp 0x10004e29
mov eax, dword [edi + 0x20]
cmp byte [eax + 0x18], 0
jge 0x10004cac
cmp byte [eax + 0x1a], 0
jne 0x10004cac
cmp byte [eax + 0x19], 0
jne 0x10004cac
cmp dword [esp + 0x28], 0
je 0x10004da8
mov ecx, esi
call fcn.10004817
movzx eax, ax
mov dword [esp + 0x24], eax
test ax, ax
je 0x10004da8
mov ecx, dword [edi + 0x20]
cmp byte [ecx + 0x1a], 0
jge 0x10004d2d
or ebp, 0x20000000
cmp byte [ecx + 0x197], 0
mov ebx, 0x102
movzx esi, ax
mov dword [esp + 0x28], esi
je 0x10004e29
push 0
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
push esi
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_VkKeyScanExW]
push esi
mov esi, dword [esp + 0x28]
mov edx, esi
movzx ecx, ax
call fcn.100049e6
pop ecx
test al, al
jne 0x10004e29
xor edx, edx
mov ecx, esi
call fcn.10004a84
test eax, eax
je 0x10004e29
push eax
mov eax, dword [edi + 0x20]
push 6
push dword [eax + 0x193]
push dword [esp + 0x20]
call dword [esp + 0x28]
jmp 0x10004e29
push dword [edi + 0x508]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x10004f90
mov eax, dword [esp + 0x24]
mov ebx, 0x101
mov byte [edi + 0x538], 0
mov dword [esp + 0x28], eax
jmp 0x10004e29
mov esi, dword [esp + 0x28]
mov dl, bl
push esi
mov ecx, edi
call fcn.10004723
pop ecx
movzx eax, bl
push 0
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test al, al
je 0x10004dfa
movzx eax, al
shl eax, 0x10
or ebp, eax
mov eax, dword [edi + 0x20]
cmp byte [eax + 0x1a], 0
jge 0x10004e13
cmp byte [eax + 0x19], 0
jl 0x10004e13
mov ebx, 0x104
lea eax, [ebx + 1]
jmp 0x10004e1b
mov ebx, 0x100
lea eax, [ebx + 1]
test esi, esi
cmove ebx, eax
setne al
mov byte [edi + 0x537], al
push dword [edi + 0x508]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [edi + 0xf6c], 0
je 0x10004ec9
cmp ebx, 0x100
jne 0x10004ec9
lea eax, [edi + 0xf54]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0xf50]
add ecx, 8
mov esi, dword [edi + 0xf6c]
mov dword [esp + 0x24], eax
call fcn.10004b39
mov edx, eax
test esi, esi
je 0x10004ebc
mov al, byte [esp + 0x13]
cmp edx, dword [esi + 4]
jne 0x10004e89
movzx ecx, al
cmp ecx, dword [esi + 8]
je 0x10004e92
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x10004e7c
jmp 0x10004ebc
push 8
pop ecx
call fcn.1001cda8
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
xor ecx, ecx
push ecx
push ecx
push eax
push 0x10004b6b
push ecx
push ecx
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
call fcn.1001cef9
lea eax, [edi + 0xf54]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dl, byte [esp + 0x13]
mov ecx, edi
call fcn.10004899
test al, al
je 0x10004f0d
cmp byte [edi + 0x534], 0
je 0x10004f90
cmp byte [edi + 0x498], 0
mov ecx, edi
jne 0x10004f01
call fcn.10008680
mov byte [edi + 0x498], 1
jmp 0x10004f90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x100086de
cmp byte [edi + 0x535], 0
jne 0x10004f89
mov dl, byte [esp + 0x13]
mov ecx, edi
call fcn.10004939
test al, al
je 0x10004f64
mov esi, dword [esp + 0x1c]
mov esi, dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
je 0x10004f43
mov ecx, eax
sub ecx, dword [esi + 0x28]
cmp ecx, 0x1f4
jb 0x10004f89
mov dword [esi + 0x28], eax
cmp byte [edi + 0x536], 0
je 0x10004f64
mov eax, dword [edi + 0x20]
push 1
push 6
push dword [eax + 0x193]
push dword [esp + 0x20]
call dword [esp + 0x28]
mov eax, dword [edi + 0x20]
push 0
push 3
push dword [eax + 0x193]
push dword [esp + 0x20]
call dword [esp + 0x28]
push ebp
push dword [esp + 0x2c]
push ebx
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [edi + 0x535], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0
push 0
push 0xe2ad
push dword [ecx + 0x49c]
call dword [sym.imp.USER32.dll_SendMessageA]
ret