Function at 0x47a370
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0
mov edi, ecx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [esp + 0x14]
mov esi, eax
test ecx, ecx
jne 0x47a39a
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
and ecx, 0xff
add ecx, 0xfffffff9
xor eax, eax
cmp ecx, 9
ja case.0x47a4f6.73
xor edx, edx
mov dl, byte [ecx + 0x47a648]
jmp dword [edx*4 + 0x47a634]
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov cx, word [edx]
add ecx, 0xffffff9f
cmp ecx, 0x14
ja case.0x47a4f6.73
xor edx, edx
mov dl, byte [ecx + 0x47a670]
jmp dword [edx*4 + 0x47a654]
cmp esi, 0x2b
jne case.0x47a4f6.73
pop edi
mov eax, 0xf9
pop esi
ret 0xc
cmp esi, 0x27
jne case.0x47a4f6.73
pop edi
mov eax, 0xf2
pop esi
ret 0xc
cmp esi, 0x28
jne case.0x47a4f6.73
pop edi
mov eax, 0xe0
pop esi
ret 0xc
cmp esi, 0x1a
jne case.0x47a4f6.73
mov dl, byte [edi + 0x122]
xor eax, eax
test dl, dl
setne al
pop edi
add eax, 0xe8
pop esi
ret 0xc
cmp esi, 0xd
jne case.0x47a4f6.73
pop edi
mov eax, 0xec
pop esi
ret 0xc
cmp esi, 0x27
jne case.0x47a4f6.73
pop edi
mov eax, 0xe7
pop esi
ret 0xc
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov cx, word [edx]
add ecx, 0xffffff9f
cmp ecx, 0x14
ja case.0x47a4f6.73
xor edx, edx
mov dl, byte [ecx + 0x47a69c]
jmp dword [edx*4 + 0x47a688]
cmp esi, 3
jne 0x47a48d
pop edi
mov eax, 0xe9
pop esi
ret 0xc
cmp esi, 8
jne case.0x47a4f6.73
pop edi
mov eax, 0xe8
pop esi
ret 0xc
cmp esi, 0xa
jne case.0x47a4f6.73
pop edi
mov eax, 0xe7
pop esi
ret 0xc
cmp esi, 0xb
jne case.0x47a4f6.73
pop edi
mov eax, 0xe0
pop esi
ret 0xc
cmp esi, 0x27
jne case.0x47a4f6.73
pop edi
mov eax, 0xf9
pop esi
ret 0xc
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov cx, word [edx]
add ecx, 0xffffffbf
cmp ecx, 0x40
ja case.0x47a4f6.73
xor edx, edx
mov dl, byte [ecx + 0x47a6d8]
jmp dword [edx*4 + 0x47a6b4]
cmp esi, 0x1a
jne case.0x47a4f6.73
pop edi
mov eax, 0xfc
pop esi
ret 0xc
cmp esi, 0x1a
jne case.0x47a4f6.73
pop edi
mov eax, 0xdc
pop esi
ret 0xc
cmp esi, 0x27
jne case.0x47a4f6.73
pop edi
mov eax, 0xf6
pop esi
ret 0xc
cmp esi, 0x27
jne case.0x47a4f6.73
pop edi
mov eax, 0xd6
pop esi
ret 0xc
cmp esi, 0x28
jne case.0x47a4f6.73
pop edi
mov eax, 0xe4
pop esi
ret 0xc
cmp esi, 0x28
jne case.0x47a4f6.73
pop edi
mov eax, 0xc4
pop esi
ret 0xc
cmp esi, 0xc
jne case.0x47a4f6.73
pop edi
mov eax, 0xdf
pop esi
ret 0xc
cmp esi, 0x29
jne case.0x47a4f6.73
pop edi
mov eax, 0xb0
pop esi
ret 0xc
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov cx, word [edx]
add ecx, 0xffffffdf
cmp ecx, 0x4e
ja case.0x47a4f6.73
xor edx, edx
mov dl, byte [ecx + 0x47a740]
jmp dword [edx*4 + 0x47a71c]
cmp esi, 0xd
jne case.0x47a4f6.73
pop edi
mov eax, 0xa1
pop esi
ret 0xc
cmp esi, 0x27
jne case.0x47a4f6.73
pop edi
mov eax, 0xf1
pop esi
ret 0xc
cmp esi, 0x27
jne case.0x47a4f6.73
pop edi
mov eax, 0xd1
pop esi
ret 0xc
cmp esi, 0x2b
jne case.0x47a4f6.73
pop edi
mov eax, 0xe7
pop esi
ret 0xc
cmp esi, 0x2b
jne case.0x47a4f6.73
pop edi
mov eax, 0xc7
pop esi
ret 0xc
cmp esi, 0xd
jne case.0x47a4f6.73
pop edi
mov eax, 0xbf
pop esi
ret 0xc
cmp esi, 0x29
jne case.0x47a4f6.73
pop edi
mov eax, 0xba
pop esi
ret 0xc
cmp esi, 0x29
jne case.0x47a4f6.73
mov eax, 0xaa
pop edi
pop esi
ret 0xc