Function at 0x406f70
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x14c
push ebx
push ebp
push esi
mov esi, dword [0x4ae970]
mov bl, dl
mov edx, dword [0x4adb14]
mov dword [esp + 0x18], ecx
push edi
cmp esi, 1
jne 0x406faa
cmp byte [0x4ae9a0], 0
jne 0x406faa
movzx eax, bl
lea eax, [eax + eax*4]
cmp dword [edx + eax*4], 0
jne 0x406faa
xor cl, cl
jmp 0x406fac
mov cl, 1
cmp byte [esp + 0x164], 0
mov byte [esp + 0x13], cl
je 0x406fdd
movzx eax, bl
mov esi, 1
movzx ecx, cl
lea eax, [eax + eax*4]
cmp byte [edx + eax*4 + 8], 0
cmovne ecx, esi
mov al, cl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
cmp dword [0x4adb40], 0
mov al, byte [esp + 0x168]
je 0x406ff9
test al, al
jne 0x406ff9
test cl, cl
je 0x406ff9
mov bh, 1
jmp 0x406ffb
xor bh, bh
mov dl, byte [0x4ad9f5]
cmp esi, 1
jne 0x4070da
cmp byte [0x4ae99e], 0
je 0x40701b
test al, al
jne 0x4070da
mov dh, 1
mov byte [esp + 0x19], dh
cmp bl, 0xe7
je 0x4070e0
mov eax, dword [0x4ae974]
mov di, word [esp + 0x160]
mov ebp, dword [0x4ae978]
movzx ecx, bl
mov al, byte [ecx + eax]
test al, al
jne 0x407055
movzx eax, di
mov al, byte [eax + ebp]
test al, al
je 0x4070e0
mov cl, al
shr al, 2
shr cl, 1
and al, 1
and cl, 1
je 0x407072
test al, al
jne 0x40707b
test dl, 0x30
jne 0x40707b
test al, al
je 0x4070e0
jmp 0x407076
test al, al
je 0x40707b
test dl, 0x30
jne 0x4070e0
movzx eax, di
mov esi, 4
mov dword [0x4ae970], esi
cmp byte [eax + ebp], 0
mov byte [0x4ae980], bl
setne byte [0x4ae985]
mov word [0x4ae982], di
mov byte [0x4ae984], 0
test cl, cl
je 0x4070b8
mov byte [0x4ae986], 1
test dl, 0x30
jne 0x4070bf
mov byte [0x4ae986], 0
test bh, bh
jne 0x4070e0
cmp byte [0x4afc08], bh
jne 0x4070e0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
xor dh, dh
mov byte [esp + 0x19], dh
movzx eax, bl
mov dword [esp + 0x28], eax
add eax, 0xffffffdf
cmp eax, 0x84
ja case.0x4070f8.41
movzx eax, byte [eax + 0x407a0c]
jmp dword [eax*4 + 0x407a00]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
test bh, bh
je case.0x4070f8.41
mov ecx, dword [0x4ad238]
test ecx, ecx
je 0x407131
xor ecx, ecx
mov byte [0x4ad240], 0
mov dword [0x4ad238], ecx
jmp 0x407131
mov ecx, dword [0x4ad238]
test dl, dl
je 0x407164
cmp esi, 1
jne 0x407143
cmp byte [0x4ae99f], 0
jne 0x407164
cmp dl, 0x10
je 0x407164
cmp dl, 0x20
je 0x407164
cmp dl, 0x30
je 0x407164
test dl, 0xc
je 0x4070cb
test dl, 3
je 0x4070cb
cmp bl, 8
jne 0x4071c4
test dl, dl
jne 0x4071c4
test dh, dh
je 0x407198
cmp esi, 1
jne 0x407198
cmp byte [0x4ae99c], dl
je 0x407198
mov edx, dword [0x4ae9a8]
test edx, edx
je 0x407198
mov eax, dword [0x4ae9a4]
dec edx
mov dword [0x4ae9a8], edx
mov byte [eax + edx], 0
test bh, bh
je 0x4071ae
test ecx, ecx
je 0x4071ae
dec ecx
mov dword [0x4ad238], ecx
mov byte [ecx + 0x4ad240], 0
mov byte [0x4afc08], 0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov edx, ebp
call fcn.00411f10
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [esp + 0x20], eax
cmp dword [0x4afc04], ebp
je 0x407218
push 0x1c
lea eax, [esp + 0x40]
mov dword [0x4afc04], ebp
push eax
push ebp
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [esp + 0x3c]
push str.ApplicationFrameWindow
push eax
call fcn.00484212
add esp, 8
test eax, eax
sete al
mov byte [0x4afc00], al
jmp 0x40721d
mov al, byte [0x4afc00]
cmp byte [0x4afc08], 0
lea edi, [esp + 0x58]
mov ecx, 0x40
mov esi, 0x4ad9f8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_ToAsciiEx]
je 0x4072b7
test al, al
je 0x4072b7
cmp bl, 0xe7
je 0x4072b7
mov dl, byte [0x4afbfe]
lea ecx, [esp + 0x58]
mov al, byte [0x4afbff]
neg dl
sbb dl, dl
and dl, 0x20
neg al
sbb al, al
and al, 9
or dl, al
call fcn.00411b20
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x14]
push edi
push 0
push eax
lea eax, [esp + 0x64]
push eax
movzx eax, word [0x4afbfc]
push eax
movzx eax, byte [0x4afc08]
push eax
call esi
test eax, eax
jle 0x4072ae
push edi
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x64]
push eax
movzx eax, word [0x4afbfc]
push eax
movzx eax, byte [0x4afc08]
push eax
call esi
mov byte [0x4afc08], 0
jmp 0x4072bb
mov edi, dword [esp + 0x20]
mov dl, byte [0x4ad9f5]
lea ecx, [esp + 0x58]
call fcn.00411b20
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4072dd
or byte [esp + 0x6c], 1
jmp 0x4072e2
and byte [esp + 0x6c], 0xfe
cmp bl, 0xe7
jne 0x407313
push 0
push 0
push 3
lea eax, [esp + 0x20]
push eax
push 1
lea eax, [esp + 0x174]
push eax
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
jmp 0x40733c
mov esi, dword [esp + 0x28]
xor eax, eax
cmp dword [0x4acfb0], eax
push edi
mov edi, dword [esp + 0x20]
setne al
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x64]
push eax
push dword [edi + 4]
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [esp + 0x24], eax
test eax, eax
je 0x4070cb
cmp byte [0x4afc08], 0
setne byte [esp + 0x2c]
test eax, eax
jns 0x4073c9
mov bh, byte [esp + 0x13]
test bh, bh
je 0x4073bc
mov eax, dword [esp + 0x160]
mov word [0x4afbfc], ax
mov al, byte [0x4ad9f5]
test al, 0x30
mov byte [0x4afc08], bl
setne byte [0x4afbfe]
test al, 3
je 0x407390
mov byte [0x4afbff], 1
test al, 0xc
jne 0x407397
mov byte [0x4afbff], 0
mov eax, dword [esp + 0x20]
push eax
xor eax, eax
cmp dword [0x4acfb0], eax
setne al
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x64]
push eax
push dword [edi + 4]
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov al, bh
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
test byte [0x4ad9f5], 3
jne 0x4073f9
cmp byte [esp + 0x14], 0xd
mov edx, 0xa
movzx ecx, byte [esp + 0x14]
cmove ecx, edx
cmp byte [esp + 0x15], 0xd
mov byte [esp + 0x14], cl
movzx ecx, byte [esp + 0x15]
cmove ecx, edx
mov byte [esp + 0x15], cl
mov byte [esp + 0x1b], 0
test bh, bh
je 0x40778a
cmp ebp, dword [0x4ad234]
je 0x40741f
mov dword [0x4ad234], ebp
xor ecx, ecx
mov byte [0x4ad240], 0
jmp 0x40746b
mov ecx, dword [0x4ad238]
mov eax, 0x5a
sub eax, ecx
cmp eax, 3
jge 0x40746b
mov ecx, 0x4ad26d
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407440
sub ecx, edx
mov dword [0x4ad238], ecx
lea eax, [ecx + 1]
push eax
push 0x4ad26d
push 0x4ad240
call fcn.00484fa0
mov ecx, dword [0x4ad238]
add esp, 0xc
mov al, byte [esp + 0x14]
mov ebp, dword [esp + 0x24]
mov byte [ecx + 0x4ad240], al
inc ecx
mov dword [0x4ad238], ecx
cmp ebp, 1
jle 0x407496
mov al, byte [esp + 0x15]
mov byte [ecx + 0x4ad240], al
inc ecx
mov dword [0x4ad238], ecx
mov byte [ecx + 0x4ad240], 0
test ecx, ecx
je 0x40778e
xor ebx, ebx
mov dword [esp + 0x28], ebx
cmp dword [0x4adb44], ebx
jbe 0x40778e
jmp 0x4074c0
mov eax, dword [0x4adb40]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x38], ebp
cmp byte [ebp + 0x23], 0
jne 0x4075ae
cmp byte [ebp + 0x2a], 0
movzx eax, byte [ebp + 0x22]
je 0x407513
cmp ecx, eax
jle 0x4075ae
movsx eax, byte [ecx + 0x4ad23f]
push eax
push str._____:____.___n__t
call fcn.004855e4
add esp, 8
test eax, eax
je 0x4075a8
mov ecx, dword [0x4ad238]
lea edi, [ecx + 0x4ad23e]
jmp 0x407521
cmp ecx, eax
jl 0x4075ae
lea edi, [ecx + 0x4ad23f]
mov edx, dword [ebp + 8]
movzx eax, byte [ebp + 0x22]
lea esi, [edx - 1]
add esi, eax
cmp byte [ebp + 0x26], 0
je 0x407545
cmp esi, edx
jb 0x40757b
mov al, byte [edi]
cmp al, byte [esi]
jne 0x40757b
dec esi
dec edi
cmp esi, edx
jae 0x407537
jmp 0x40757b
cmp esi, edx
jb 0x40757b
lea esp, [esp]
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
movzx ecx, byte [edi]
mov ebx, eax
push ecx
call dword [sym.imp.USER32.dll_CharLowerA]
cmp al, bl
jne 0x407571
dec esi
dec edi
cmp esi, dword [ebp + 8]
jae 0x407550
mov ecx, dword [0x4ad238]
mov ebx, dword [esp + 0x28]
cmp esi, dword [ebp + 8]
jae 0x4075ae
cmp byte [ebp + 0x2b], 0
jne 0x407599
cmp edi, 0x4ad240
jb 0x407599
mov cl, byte [edi]
call fcn.00407aa0
test al, al
jne 0x4075a8
mov edx, dword [ebp + 4]
mov ecx, dword [ebp + 0x10]
call fcn.00409bb0
test eax, eax
jne 0x4075c4
mov ecx, dword [0x4ad238]
inc ebx
mov dword [esp + 0x28], ebx
cmp ebx, dword [0x4adb44]
jb 0x4074c0
jmp 0x40778a
mov eax, dword [esp + 0x16c]
mov edx, dword [esp + 0x1c]
add eax, 4
mov cl, byte [ebp + 0x21]
push eax
mov edx, dword [edx + 0x10]
call fcn.0040a830
add esp, 4
test al, al
je 0x40778a
cmp byte [ebp + 0x27], 0
mov edx, dword [0x4ad238]
je 0x4076fc
cmp byte [ebp + 0x2a], 0
lea ebx, [edx + 0x4ad240]
mov dword [esp + 0x34], ebx
je 0x40760e
dec ebx
mov dword [esp + 0x34], ebx
xor eax, eax
mov esi, ebx
mov byte [esp + 0x1a], al
xor ecx, ecx
xor al, al
xor edi, edi
mov dword [esp + 0x1c], eax
movzx eax, byte [ebp + 0x22]
sub esi, eax
mov eax, ebx
sub eax, esi
cmp esi, ebx
cmova eax, ecx
mov dword [esp + 0x30], eax
test eax, eax
je 0x4076fc
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerA]
test eax, eax
jne 0x40765d
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharUpperA]
test eax, eax
je 0x407681
cmp byte [esp + 0x1a], 0
jne 0x407680
movzx eax, byte [esi]
push eax
mov byte [esp + 0x1e], 1
call dword [sym.imp.USER32.dll_IsCharUpperA]
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
inc ebp
inc edi
inc esi
cmp edi, dword [esp + 0x30]
jb 0x407641
mov dword [esp + 0x1c], ebx
test ebp, ebp
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x30], ebp
mov ebp, dword [esp + 0x38]
je 0x4076f6
cmp dword [esp + 0x30], 1
mov eax, dword [esp + 0x1c]
jne 0x4076bc
mov edx, dword [0x4ad238]
xor edi, edi
test al, al
mov ecx, 2
cmovne edi, ecx
jmp 0x4076fe
test al, al
je 0x4076f6
movzx eax, byte [ebp + 0x22]
mov esi, ebx
sub esi, eax
mov edi, 2
cmp esi, ebx
jae 0x4076e6
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerA]
test eax, eax
jne 0x4076e4
inc esi
cmp esi, ebx
jb 0x4076d1
cmp esi, ebx
mov edx, dword [0x4ad238]
mov eax, 1
cmove edi, eax
jmp 0x4076fe
mov edx, dword [0x4ad238]
xor edi, edi
mov bh, byte [ebp + 0x28]
test bh, bh
jne 0x40770a
cmp byte [ebp + 0x29], bh
je 0x407714
mov byte [esp + 0x13], 0
mov byte [esp + 0x1b], 1
mov eax, dword [esp + 0x170]
mov bl, byte [ebp + 0x2a]
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
test bl, bl
je 0x407731
movsx eax, byte [edx + 0x4ad23f]
jmp 0x407733
xor eax, eax
movzx ecx, di
shl ecx, 0x10
movzx eax, ax
or ecx, eax
cmp dword [ebp + 0xc], 0
mov eax, dword [esp + 0x174]
mov dword [eax], ecx
je 0x407767
test bl, bl
je 0x407763
mov al, byte [edx + 0x4ad23f]
mov edx, 1
mov byte [0x4ad240], al
jmp 0x407776
xor edx, edx
jmp 0x407776
test bh, bh
je 0x407776
movzx eax, byte [ebp + 0x22]
sub edx, eax
test bl, bl
je 0x407776
dec edx
xor eax, eax
cmp byte [ebp + 0x2c], al
cmovne edx, eax
mov dword [0x4ad238], edx
mov byte [edx + 0x4ad240], al
mov ebp, dword [esp + 0x24]
cmp byte [esp + 0x2c], 0
mov bl, byte [esp + 0x13]
je 0x407802
test bl, bl
je 0x407802
push 0x100
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.0048e820
mov dl, byte [0x4afbfe]
lea ecx, [esp + 0x64]
mov al, byte [0x4afbff]
add esp, 0xc
neg dl
sbb dl, dl
and dl, 0x20
neg al
sbb al, al
and al, 9
or dl, al
call fcn.00411b20
mov eax, dword [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x64]
push eax
movzx eax, word [0x4afbfc]
push eax
movzx eax, byte [0x4afc08]
push eax
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov byte [0x4afc08], 0
cmp byte [esp + 0x19], 0
je 0x4079f0
cmp dword [0x4ae970], 1
jne 0x4079f0
cmp byte [esp + 0x1b], 0
jne 0x4079f0
xor esi, esi
test ebp, ebp
jle 0x40789b
jmp 0x407830
lea edi, [esp + 0x14]
add edi, esi
cmp byte [0x4ae99d], 0
je 0x407853
movzx eax, byte [edi]
push eax
push dword [0x4ae97c]
call fcn.004855e4
add esp, 8
jmp 0x407860
mov dl, byte [edi]
mov ecx, dword [0x4ae97c]
call fcn.00471be0
test eax, eax
jne 0x4078e8
mov edx, dword [0x4ae9a8]
cmp edx, dword [0x4ae9ac]
je 0x40789b
mov eax, dword [0x4ae9a4]
inc esi
mov cl, byte [edi]
mov byte [eax + edx], cl
mov ecx, dword [0x4ae9a8]
mov eax, dword [0x4ae9a4]
inc ecx
mov dword [0x4ae9a8], ecx
mov byte [eax + ecx], 0
cmp esi, ebp
jl 0x407830
xor esi, esi
cmp byte [0x4ae9a1], 0
je 0x407956
cmp byte [0x4ae99d], 0
je 0x40791f
cmp dword [0x4ae98c], esi
jbe 0x4079d1
nop
mov eax, dword [0x4ae988]
push dword [eax + esi*4]
push dword [0x4ae9a4]
call fcn.00485696
add esp, 8
test eax, eax
jne 0x407908
inc esi
cmp esi, dword [0x4ae98c]
jb 0x4078c0
jmp 0x4079d1
mov al, byte [esp + esi + 0x14]
mov byte [0x4ae984], al
mov al, bl
mov dword [0x4ae970], 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
mov dword [0x4ae970], 3
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
cmp dword [0x4ae98c], esi
jbe 0x4079d1
jmp 0x407930
mov edx, dword [0x4ae988]
mov ecx, dword [0x4ae9a4]
mov edx, dword [edx + esi*4]
call fcn.00471c30
test eax, eax
jne 0x407908
inc esi
cmp esi, dword [0x4ae98c]
jb 0x407930
jmp 0x4079d1
cmp byte [0x4ae99d], 0
je 0x407999
cmp dword [0x4ae98c], esi
jbe 0x4079d1
jmp 0x407970
mov eax, dword [0x4ae988]
push dword [eax + esi*4]
push dword [0x4ae9a4]
call fcn.0048440c
add esp, 8
test eax, eax
je 0x407908
inc esi
cmp esi, dword [0x4ae98c]
jb 0x407970
jmp 0x4079d1
cmp dword [0x4ae98c], esi
jbe 0x4079d1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x4079b0
mov eax, dword [0x4ae988]
push dword [eax + esi*4]
push dword [0x4ae9a4]
call edi
test eax, eax
je 0x407908
inc esi
cmp esi, dword [0x4ae98c]
jb 0x4079b0
mov eax, dword [0x4ae9a8]
mov edx, 5
mov ecx, dword [0x4ae970]
cmp eax, dword [0x4ae9ac]
cmovge ecx, edx
mov dword [0x4ae970], ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x14c
ret