Function at 0x406e60
Capabilities:
Get keyboard layout
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov dl, byte [esp + 8]
mov ecx, dword [0x4c8ee0]
sub esp, 0x18c
push ebx
push ebp
mov ebp, dword [0x4ca5d8]
push edi
mov di, word [esp + 0x1a4]
cmp ebp, 1
jne 0x406ea6
cmp byte [0x4ca608], 0
jne 0x406ea6
movzx eax, dl
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + ecx], 0
jne 0x406ea6
xor bl, bl
mov byte [esp + 0xf], bl
jmp 0x406eaf
mov byte [esp + 0xf], 1
mov bl, byte [esp + 0xf]
cmp byte [esp + 0x1a8], 0
je 0x406edb
movzx eax, dl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ecx + 4], 0
mov al, 1
jne 0x407979
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x18c
ret
cmp dword [0x4c9ea8], 0
je 0x406ef7
cmp byte [esp + 0x1ac], 0
jne 0x406ef7
mov byte [esp + 0x10], 1
test bl, bl
jne 0x406efc
mov byte [esp + 0x10], 0
mov bl, byte [0x4c84a5]
push esi
cmp ebp, 1
jne 0x406fea
cmp byte [0x4ca606], 0
je 0x406f23
cmp byte [esp + 0x1b0], 0
jne 0x406fea
mov byte [esp + 0x15], 1
cmp dl, 0xe7
je 0x406fcb
mov ecx, dword [0x4ca5dc]
mov esi, dword [0x4ca5e0]
movzx eax, dl
mov al, byte [eax + ecx]
test al, al
jne 0x406f51
movzx eax, di
mov al, byte [eax + esi]
test al, al
je 0x406fcb
mov cl, al
shr al, 2
shr cl, 1
and al, 1
and cl, 1
je 0x406ff1
test al, al
jne 0x406f75
test bl, 0x30
jne 0x406f75
test al, al
je 0x406fcb
test bl, 0x30
jne 0x406fcb
movzx eax, di
mov ebp, 4
mov dword [0x4ca5d8], ebp
cmp byte [eax + esi], 0
mov byte [0x4ca5e8], dl
setne al
mov byte [0x4ca5ee], al
xor eax, eax
mov word [0x4ca5ea], di
mov word [0x4ca5ec], ax
test cl, cl
je 0x406fb4
mov byte [0x4ca5ef], 1
test bl, 0x30
jne 0x406fb9
mov byte [0x4ca5ef], al
cmp byte [esp + 0x14], al
jne 0x406fcb
cmp byte [0x4cb2e4], al
je 0x40798d
movzx eax, dl
mov dword [esp + 0x20], eax
add eax, 0xffffffdf
cmp eax, 0x84
ja case.0x406fe3.41
movzx ecx, byte [eax + 0x4079e4]
jmp dword [ecx*4 + 0x4079d8]
mov byte [esp + 0x15], 0
jmp 0x406fcb
test al, al
je 0x406f75
jmp 0x406f70
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x18c
ret
cmp byte [esp + 0x14], 0
je case.0x406fe3.41
mov ecx, dword [0x4c71f4]
test ecx, ecx
je 0x407030
xor eax, eax
xor ecx, ecx
mov word [0x4c71f8], ax
mov dword [0x4c71f4], ecx
jmp 0x407030
mov ecx, dword [0x4c71f4]
test bl, bl
je 0x407063
cmp ebp, 1
jne 0x407042
cmp byte [0x4ca607], 0
jne 0x407063
cmp bl, 0x10
je 0x407063
cmp bl, 0x20
je 0x407063
cmp bl, 0x30
je 0x407063
test bl, 0xc
je 0x40798d
test bl, 3
je 0x40798d
cmp dl, 8
jne 0x4070d5
test bl, bl
jne 0x4070d5
cmp byte [esp + 0x15], bl
je 0x40709a
cmp ebp, 1
jne 0x40709a
cmp byte [0x4ca604], bl
je 0x40709a
mov eax, dword [0x4ca610]
test eax, eax
je 0x40709a
mov esi, dword [0x4ca60c]
dec eax
xor edx, edx
mov dword [0x4ca610], eax
mov word [esi + eax*2], dx
cmp byte [esp + 0x14], 0
je 0x4070b6
test ecx, ecx
je 0x4070b6
dec ecx
xor eax, eax
mov dword [0x4c71f4], ecx
mov word [ecx*2 + 0x4c71f8], ax
cmp byte [0x4cb2e4], 0
je 0x4070c6
mov byte [0x4cb2e4], 0
mov al, byte [esp + 0x13]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18c
ret
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
xor esi, esi
mov dword [esp + 0x28], edi
test edi, edi
je 0x40711a
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push edi
call ebx
lea ecx, [esp + 0x34]
mov esi, eax
push ecx
push esi
mov dword [esp + 0x3c], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x40711a
mov eax, dword [esp + 0x40]
test eax, eax
je 0x40711a
push 0
push eax
call ebx
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebp, eax
mov dword [esp + 0x30], ebp
cmp dword [0x4cb2f0], edi
je 0x407164
push 0x1c
lea edx, [esp + 0x168]
push edx
push edi
mov dword [0x4cb2f0], edi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0x164]
push str.ApplicationFrameWindow
push eax
call fcn.0048db09
add esp, 8
test eax, eax
sete byte [0x4cb2ec]
mov bl, byte [0x4cb2e4]
mov ecx, 0x40
mov esi, 0x4c84c8
lea edi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_ToUnicodeEx]
test bl, bl
je 0x407201
cmp byte [0x4cb2ec], 0
je 0x407201
cmp byte [esp + 0x1a4], 0xe7
je 0x407201
mov al, byte [0x4cb2ea]
mov cl, byte [0x4cb2eb]
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x64]
call fcn.004119d0
push ebp
push 0
push 2
lea edx, [esp + 0x24]
push edx
mov eax, ecx
movzx ecx, word [0x4cb2e8]
push eax
movzx edx, bl
push ecx
push edx
call esi
test eax, eax
jle 0x4071fa
movzx edx, word [0x4cb2e8]
push ebp
push 0
push 2
lea eax, [esp + 0x24]
push eax
movzx eax, byte [0x4cb2e4]
lea ecx, [esp + 0x74]
push ecx
push edx
push eax
call esi
mov byte [0x4cb2e4], 0
mov al, byte [0x4c84a5]
lea ecx, [esp + 0x64]
call fcn.004119d0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x407222
or byte [esp + 0x78], 1
jmp 0x407227
and byte [esp + 0x78], 0xfe
cmp byte [esp + 0x1a4], 0xe7
jne 0x407249
mov cx, word [esp + 0x1a8]
mov eax, 1
mov dword [esp + 0x2c], eax
mov word [esp + 0x18], cx
jmp 0x407280
xor edx, edx
cmp dword [0x4c8638], edx
push ebp
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x68]
push edx
mov edx, dword [esp + 0x1a8]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x34]
push eax
push ecx
call esi
mov dword [esp + 0x2c], eax
test eax, eax
je 0x40798d
cmp byte [0x4cb2e4], 0
setne byte [esp + 0x27]
test eax, eax
jns 0x407319
mov bl, byte [esp + 0x13]
test bl, bl
je 0x407976
mov ax, word [esp + 0x1a8]
mov dl, byte [esp + 0x1a4]
mov word [0x4cb2e8], ax
mov al, byte [0x4c84a5]
test al, 0x30
setne cl
mov byte [0x4cb2e4], dl
mov byte [0x4cb2ea], cl
test al, 3
je 0x4072da
mov byte [0x4cb2eb], 1
test al, 0xc
jne 0x4072e1
mov byte [0x4cb2eb], 0
xor edx, edx
cmp dword [0x4c8638], edx
push ebp
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x68]
push edx
mov edx, dword [esp + 0x1a8]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x34]
push eax
push ecx
call esi
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x18c
ret
test byte [0x4c84a5], 3
jne 0x407349
mov eax, 0xd
cmp word [esp + 0x18], ax
jne 0x407338
mov edx, 0xa
mov word [esp + 0x18], dx
cmp word [esp + 0x1a], ax
jne 0x407349
mov eax, 0xa
mov word [esp + 0x1a], ax
cmp byte [esp + 0x14], 0
mov byte [esp + 0x17], 0
je 0x407726
mov eax, dword [esp + 0x28]
cmp eax, dword [0x4c71f0]
je 0x407375
xor ecx, ecx
mov dword [0x4c71f0], eax
mov word [0x4c71f8], cx
jmp 0x4073c1
mov ecx, dword [0x4c71f4]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x4073c1
mov eax, 0x4c7252
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407390
sub eax, edx
sar eax, 1
mov dword [0x4c71f4], eax
lea eax, [eax + eax + 2]
push eax
push 0x4c7252
push 0x4c71f8
call fcn.0048e580
mov ecx, dword [0x4c71f4]
add esp, 0xc
mov dx, word [esp + 0x18]
mov word [ecx*2 + 0x4c71f8], dx
inc ecx
cmp dword [esp + 0x2c], 1
mov dword [0x4c71f4], ecx
jle 0x4073f0
mov ax, word [esp + 0x1a]
mov word [ecx*2 + 0x4c71f8], ax
inc ecx
mov dword [0x4c71f4], ecx
xor edx, edx
mov word [ecx*2 + 0x4c71f8], dx
test ecx, ecx
je 0x407726
mov dword [esp + 0x28], edx
cmp dword [0x4c9eac], edx
jbe 0x407726
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
jmp 0x407420
mov eax, dword [0x4c9ea8]
mov edx, dword [esp + 0x28]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x1f], 0
jne 0x407540
cmp byte [ebp + 0x26], 0
je 0x407475
movzx eax, byte [ebp + 0x1e]
cmp ecx, eax
jle 0x407540
movzx eax, word [ecx*2 + 0x4c71f6]
push eax
push str._____:____.___n__t
call fcn.0048e8e1
add esp, 8
test eax, eax
je 0x40753a
mov ecx, dword [0x4c71f4]
lea edi, [ecx*2 + 0x4c71f4]
jmp 0x407488
movzx edx, byte [ebp + 0x1e]
cmp ecx, edx
jl 0x407540
lea edi, [ecx*2 + 0x4c71f6]
cmp byte [ebp + 0x22], 0
movzx edx, byte [ebp + 0x1e]
mov eax, dword [ebp + 4]
lea esi, [eax + edx*2 - 2]
je 0x4074b4
cmp esi, eax
jb 0x4074f6
lea ecx, [ecx]
mov dx, word [edi]
cmp dx, word [esi]
jne 0x4074f6
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x4074a0
jmp 0x4074f6
cmp esi, eax
jb 0x4074f6
jmp 0x4074c6
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
movzx eax, word [esi]
push eax
call ebx
movzx ecx, word [edi]
push ecx
mov dword [esp + 0x24], eax
call ebx
mov ecx, dword [esp + 0x20]
cmp ax, cx
jne 0x4074ea
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 4]
jae 0x4074c0
mov ecx, dword [0x4c71f4]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
cmp esi, dword [ebp + 4]
jae 0x407540
cmp byte [ebp + 0x27], 0
jne 0x407519
cmp edi, 0x4c71f8
jb 0x407519
movzx edx, word [edi]
push edx
call fcn.00407a70
add esp, 4
test al, al
jne 0x40753a
mov eax, dword [ebp]
test eax, eax
je 0x407525
mov eax, dword [eax + 4]
jmp 0x40752a
mov eax, 0x4ac2b4
mov esi, dword [ebp + 0xc]
push eax
call fcn.00409a10
add esp, 4
test eax, eax
jne 0x40755a
mov ecx, dword [0x4c71f4]
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, dword [0x4c9eac]
jb 0x407420
jmp 0x407726
movzx eax, byte [ebp + 0x1d]
mov edx, dword [esp + 0x1a0]
mov ecx, dword [esp + 0x1b4]
push eax
mov eax, dword [edx + 0x10]
add ecx, 4
call fcn.0040a650
add esp, 4
test al, al
je 0x407726
cmp byte [ebp + 0x23], 0
jne 0x407590
xor edi, edi
jmp 0x40766d
cmp byte [ebp + 0x26], 0
mov ebx, dword [0x4c71f4]
lea ebx, [ebx*2 + 0x4c71f8]
je 0x4075a6
sub ebx, 2
movzx eax, byte [ebp + 0x1e]
add eax, eax
mov esi, ebx
sub esi, eax
mov dword [esp + 0x20], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x14], 0
cmp esi, ebx
jae 0x407616
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
lea esp, [esp]
movzx ecx, word [esi]
push ecx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x4075e8
movzx edx, word [esi]
push edx
call edi
test eax, eax
je 0x407607
cmp byte [esp + 0x16], 0
jne 0x407603
movzx eax, word [esi]
push eax
mov byte [esp + 0x1a], 1
call edi
test eax, eax
je 0x407603
mov byte [esp + 0x14], 1
inc dword [esp + 0x20]
add esi, 2
cmp esi, ebx
jb 0x4075d0
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40761a
xor edi, edi
jmp 0x40766d
cmp eax, 1
jne 0x40762d
movzx edi, byte [esp + 0x14]
neg edi
sbb edi, edi
and edi, 2
jmp 0x40766d
cmp byte [esp + 0x14], 0
jne 0x407638
xor edi, edi
jmp 0x40766d
movzx ecx, byte [ebp + 0x1e]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov edi, 2
cmp esi, ebx
jae 0x407666
jmp 0x407650
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x407664
add esi, edi
cmp esi, ebx
jb 0x407650
cmp esi, ebx
jne 0x40766d
mov edi, 1
mov dl, byte [ebp + 0x24]
test dl, dl
jne 0x407679
cmp byte [ebp + 0x25], dl
je 0x407683
mov byte [esp + 0x13], 0
mov byte [esp + 0x17], 1
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov al, byte [ebp + 0x26]
test al, al
je 0x4076a7
mov ecx, dword [0x4c71f4]
movzx ecx, word [ecx*2 + 0x4c71f6]
jmp 0x4076a9
xor ecx, ecx
movzx esi, di
movzx ecx, cx
shl esi, 0x10
or esi, ecx
mov ecx, dword [esp + 0x1bc]
mov dword [ecx], esi
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp word [esi], cx
je 0x4076f3
test al, al
je 0x4076eb
mov edx, dword [0x4c71f4]
mov ax, word [edx*2 + 0x4c71f6]
mov word [0x4c71f8], ax
mov dword [0x4c71f4], 1
jmp 0x40770b
mov dword [0x4c71f4], ecx
jmp 0x40770b
test dl, dl
je 0x40770b
movzx edx, byte [ebp + 0x1e]
sub dword [0x4c71f4], edx
test al, al
je 0x40770b
dec dword [0x4c71f4]
cmp byte [ebp + 0x28], cl
je 0x407716
mov dword [0x4c71f4], ecx
mov ecx, dword [0x4c71f4]
xor eax, eax
mov word [ecx*2 + 0x4c71f8], ax
cmp byte [esp + 0x27], 0
mov bl, byte [esp + 0x13]
je 0x407798
test bl, bl
je 0x407798
push 0x100
lea edx, [esp + 0x68]
push 0
push edx
call fcn.004969e0
mov al, byte [0x4cb2ea]
mov cl, byte [0x4cb2eb]
add esp, 0xc
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x64]
call fcn.004119d0
mov edx, dword [esp + 0x30]
push edx
movzx edx, word [0x4cb2e8]
push 0
push 2
lea eax, [esp + 0x3c]
push eax
movzx eax, byte [0x4cb2e4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov byte [0x4cb2e4], 0
cmp byte [esp + 0x15], 0
je 0x407976
cmp dword [0x4ca5d8], 1
jne 0x407976
cmp byte [esp + 0x17], 0
jne 0x407976
mov edi, dword [esp + 0x2c]
xor esi, esi
test edi, edi
jle 0x40783a
jmp 0x4077d0
cmp byte [0x4ca605], 0
mov ecx, dword [0x4ca5e4]
je 0x4077f0
movzx eax, word [esp + esi*2 + 0x18]
push eax
push ecx
call fcn.0048e8e1
add esp, 8
jmp 0x4077fa
mov ax, word [esp + esi*2 + 0x18]
call fcn.00474c20
test eax, eax
jne 0x40788a
mov eax, dword [0x4ca610]
cmp eax, dword [0x4ca614]
je 0x40783a
mov dx, word [esp + esi*2 + 0x18]
mov ecx, dword [0x4ca60c]
mov word [ecx + eax*2], dx
mov eax, dword [0x4ca610]
mov ecx, dword [0x4ca60c]
inc eax
xor edx, edx
inc esi
mov dword [0x4ca610], eax
mov word [ecx + eax*2], dx
cmp esi, edi
jl 0x4077d0
xor esi, esi
cmp byte [0x4ca609], 0
je 0x4078f6
cmp byte [0x4ca605], 0
je 0x4078c4
cmp dword [0x4ca5f4], esi
jbe 0x40795e
mov edi, edi
mov eax, dword [0x4ca5f0]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4ca60c]
push eax
push ecx
call fcn.0048e908
add esp, 8
test eax, eax
jne 0x4078ad
inc esi
cmp esi, dword [0x4ca5f4]
jb 0x407860
jmp 0x40795e
mov dx, word [esp + esi*2 + 0x18]
pop esi
pop edi
pop ebp
mov al, bl
mov dword [0x4ca5d8], 4
mov word [0x4ca5ec], dx
pop ebx
add esp, 0x18c
ret
pop esi
pop edi
pop ebp
mov al, bl
mov dword [0x4ca5d8], 3
pop ebx
add esp, 0x18c
ret
cmp dword [0x4ca5f4], esi
jbe 0x40795e
mov edx, dword [0x4ca60c]
mov eax, dword [0x4ca5f0]
mov eax, dword [eax + esi*4]
push edx
call fcn.00474c70
add esp, 4
test eax, eax
jne 0x4078ad
inc esi
cmp esi, dword [0x4ca5f4]
jb 0x4078d0
jmp 0x40795e
cmp byte [0x4ca605], 0
je 0x40799c
mov ebx, dword [0x4ca5f4]
test ebx, ebx
je 0x40795a
mov edi, dword [0x4ca60c]
mov ebp, dword [0x4ca5f0]
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40794c
test dx, dx
je 0x407948
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40794c
add eax, 4
add ecx, 4
test dx, dx
jne 0x407926
xor eax, eax
jmp 0x407951
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407983
inc esi
cmp esi, ebx
jb 0x407920
mov bl, byte [esp + 0x13]
mov ecx, dword [0x4ca614]
cmp dword [0x4ca610], ecx
jl 0x407976
mov dword [0x4ca5d8], 5
mov al, bl
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18c
ret
mov dword [0x4ca5d8], 3
mov al, byte [esp + 0x13]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18c
ret
cmp dword [0x4ca5f4], esi
jbe 0x40795e
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea ebx, [ebx]
mov ecx, dword [0x4ca5f0]
mov edx, dword [ecx + esi*4]
mov eax, dword [0x4ca60c]
push edx
push eax
call edi
test eax, eax
je 0x4078ad
inc esi
cmp esi, dword [0x4ca5f4]
jb 0x4079b0
jmp 0x40795e