Function at 0x406970
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x4c18c0]
sub esp, 0x11c
push ebx
push edi
mov edi, dword [0x4c2fa8]
mov bl, al
cmp edi, 1
jne 0x4069a8
cmp byte [0x4c2fd4], 0
jne 0x4069a8
movzx eax, bl
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + ecx], 0
mov byte [esp + 0xa], 0
je 0x4069ad
mov byte [esp + 0xa], 1
cmp byte [esp + 0x130], 0
je 0x4069da
movzx eax, bl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ecx + 4], 0
mov al, 1
jne 0x4073d2
mov al, byte [esp + 0xa]
pop edi
pop ebx
add esp, 0x11c
ret
cmp dword [0x4c288c], 0
je 0x4069f2
test dl, dl
jne 0x4069f2
mov byte [esp + 0xb], 1
cmp byte [esp + 0xa], dl
jne 0x4069f7
mov byte [esp + 0xb], 0
mov al, byte [0x4c0d19]
push esi
cmp edi, 1
jne 0x406ac8
cmp byte [0x4c2fd2], 0
je 0x406a17
test dl, dl
jne 0x406ac8
mov edx, dword [0x4c2fac]
mov esi, dword [0x4c2fb0]
movzx ecx, bl
mov cl, byte [ecx + edx]
mov byte [esp + 0x12], 1
test cl, cl
jne 0x406a45
movzx ecx, word [esp + 0x130]
mov cl, byte [ecx + esi]
test cl, cl
je 0x406acd
mov dl, cl
shr cl, 2
shr dl, 1
and cl, 1
and dl, 1
je 0x406aea
test cl, cl
jne 0x406a68
test al, 0x30
jne 0x406a68
test cl, cl
je 0x406acd
test al, 0x30
jne 0x406acd
movzx ecx, word [esp + 0x130]
mov edi, 4
mov dword [0x4c2fa8], edi
cmp byte [ecx + esi], 0
mov byte [0x4c2fb4], bl
setne cl
mov byte [0x4c2fb8], cl
mov cx, word [esp + 0x130]
mov word [0x4c2fb6], cx
test dl, dl
je 0x406aac
mov byte [0x4c2fb9], 1
test al, 0x30
jne 0x406ab3
mov byte [0x4c2fb9], 0
cmp byte [esp + 0xf], 0
jne 0x406acd
mov al, byte [esp + 0xe]
pop esi
pop edi
pop ebx
add esp, 0x11c
ret
mov byte [esp + 0x12], 0
push ebp
movzx ebp, bl
lea ecx, [ebp - 0x21]
cmp ecx, 0x84
ja case.0x406ae3.41
movzx edx, byte [ecx + 0x4073e8]
jmp dword [edx*4 + 0x4073dc]
test cl, cl
je 0x406a68
jmp 0x406a64
pop ebp
pop esi
pop edi
mov al, 1
pop ebx
add esp, 0x11c
ret
cmp byte [esp + 0x13], 0
je case.0x406ae3.41
mov ecx, dword [0x4bfa6c]
test ecx, ecx
je 0x406b2c
xor ecx, ecx
mov word [0x4bfa70], cx
mov dword [0x4bfa6c], ecx
jmp 0x406b2c
mov ecx, dword [0x4bfa6c]
test al, al
je 0x406b56
cmp edi, 1
jne 0x406b3e
cmp byte [0x4c2fd3], 0
jne 0x406b56
cmp al, 0x10
je 0x406b56
cmp al, 0x20
je 0x406b56
test al, 0xc
je 0x4073cc
test al, 3
je 0x4073cc
cmp bl, 8
jne 0x406bcc
test al, al
jne 0x406bcc
cmp byte [esp + 0x16], al
je 0x406b8d
cmp edi, 1
jne 0x406b8d
cmp byte [0x4c2fd0], al
je 0x406b8d
mov eax, dword [0x4c2fdc]
test eax, eax
je 0x406b8d
mov esi, dword [0x4c2fd8]
dec eax
xor edx, edx
mov dword [0x4c2fdc], eax
mov word [esi + eax*2], dx
cmp byte [esp + 0x13], 0
je 0x406ba9
test ecx, ecx
je 0x406ba9
dec ecx
xor eax, eax
mov dword [0x4bfa6c], ecx
mov word [ecx*2 + 0x4bfa70], ax
cmp byte [0x4c3c3c], 0
je 0x4073cc
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
mov byte [0x4c3c3c], 0
pop ebx
add esp, 0x11c
ret
mov ecx, 0x40
mov esi, 0x4c0d40
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x2c]
call fcn.00411070
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x406bf8
or byte [esp + 0x40], 1
jmp 0x406bfd
and byte [esp + 0x40], 0xfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x406c14
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x406c16
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor ecx, ecx
cmp dword [0x4c0e94], ecx
push eax
setne cl
lea edx, [esp + 0x20]
lea eax, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x138]
push 2
push edx
mov edx, dword [ecx + 4]
push eax
push edx
push ebp
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov edi, eax
mov dword [esp + 0x24], edi
test edi, edi
je 0x4073cc
cmp byte [0x4c3c3c], 0
je 0x406c6e
cmp bl, 9
je 0x406c6e
mov byte [esp + 0x15], 1
cmp bl, 0x1b
jne 0x406c73
mov byte [esp + 0x15], 0
test edi, edi
jns 0x406ccc
cmp byte [esp + 0x15], 0
jne 0x406ccc
cmp byte [esp + 0x12], 0
je 0x406cbf
mov ax, word [esp + 0x134]
mov word [0x4c3c40], ax
mov al, byte [0x4c0d19]
test al, 0x30
setne cl
mov byte [0x4c3c3c], bl
mov byte [0x4c3c42], cl
test al, 3
je 0x406cb8
mov byte [0x4c3c43], 1
test al, 0xc
jne 0x406cbf
mov byte [0x4c3c43], 0
pop ebp
pop esi
pop edi
xor al, al
pop ebx
add esp, 0x11c
ret
test byte [0x4c0d19], 3
jne 0x406cfc
mov eax, 0xd
cmp word [esp + 0x1c], ax
jne 0x406ceb
mov edx, 0xa
mov word [esp + 0x1c], dx
cmp word [esp + 0x1e], ax
jne 0x406cfc
mov eax, 0xa
mov word [esp + 0x1e], ax
cmp byte [esp + 0x13], 0
mov byte [esp + 0x17], 0
je 0x4070ad
cmp esi, dword [0x4bfa68]
je 0x406d25
xor ecx, ecx
mov dword [0x4bfa68], esi
mov word [0x4bfa70], cx
jmp 0x406d71
mov ecx, dword [0x4bfa6c]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x406d71
mov eax, 0x4bfaca
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406d40
sub eax, edx
sar eax, 1
mov dword [0x4bfa6c], eax
lea eax, [eax + eax + 2]
push eax
push 0x4bfaca
push 0x4bfa70
call fcn.004827f0
mov ecx, dword [0x4bfa6c]
add esp, 0xc
mov dx, word [esp + 0x1c]
mov word [ecx*2 + 0x4bfa70], dx
inc ecx
mov dword [0x4bfa6c], ecx
cmp edi, 1
jle 0x406d9e
mov ax, word [esp + 0x1e]
mov word [ecx*2 + 0x4bfa70], ax
inc ecx
mov dword [0x4bfa6c], ecx
xor edx, edx
mov word [ecx*2 + 0x4bfa70], dx
test ecx, ecx
je 0x4070ad
mov dword [esp + 0x28], edx
cmp dword [0x4c2890], edx
jbe 0x4070ad
mov eax, dword [0x4c288c]
mov edx, dword [esp + 0x28]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x26], 0
jne 0x406ee1
cmp byte [ebp + 0x2e], 0
je 0x406e15
movzx eax, byte [ebp + 0x25]
cmp ecx, eax
jle 0x406ee1
movzx eax, word [ecx*2 + 0x4bfa6e]
push eax
push str._____:____.___n__t
call fcn.00482b51
add esp, 8
test eax, eax
je 0x406edb
mov ecx, dword [0x4bfa6c]
lea edi, [ecx*2 + 0x4bfa6c]
jmp 0x406e28
movzx edx, byte [ebp + 0x25]
cmp ecx, edx
jl 0x406ee1
lea edi, [ecx*2 + 0x4bfa6e]
cmp byte [ebp + 0x29], 0
movzx edx, byte [ebp + 0x25]
mov eax, dword [ebp + 4]
lea esi, [eax + edx*2 - 2]
je 0x406e54
cmp esi, eax
jb 0x406e90
lea ecx, [ecx]
mov dx, word [edi]
cmp dx, word [esi]
jne 0x406e90
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x406e40
jmp 0x406e90
cmp esi, eax
jb 0x406e90
jmp 0x406e60
movzx eax, word [edi]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
push eax
call ebx
movzx ecx, word [esi]
push ecx
mov dword [esp + 0x1c], eax
call ebx
mov ecx, dword [esp + 0x18]
cmp cx, ax
jne 0x406e8a
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 4]
jae 0x406e60
mov ecx, dword [0x4bfa6c]
cmp esi, dword [ebp + 4]
jae 0x406ee1
cmp byte [ebp + 0x2f], 0
jne 0x406eb1
cmp edi, 0x4bfa70
jb 0x406eb1
movzx edx, word [edi]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x406edb
mov eax, dword [ebp]
test eax, eax
je 0x406ebc
mov eax, dword [eax]
jmp 0x406ec1
mov eax, 0x4a5c64
mov ecx, dword [ebp + 0xc]
mov bl, byte [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x10]
call fcn.004091b0
add esp, 8
test eax, eax
jne 0x406efb
mov ecx, dword [0x4bfa6c]
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, dword [0x4c2890]
jb 0x406dc0
jmp 0x4070a9
xor edi, edi
cmp byte [ebp + 0x2a], 0
je 0x406fdd
cmp byte [ebp + 0x2e], 0
mov ebx, dword [0x4bfa6c]
lea ebx, [ebx*2 + 0x4bfa70]
je 0x406f1d
sub ebx, 2
movzx ecx, byte [ebp + 0x25]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov dword [esp + 0x18], edi
mov byte [esp + 0x14], 0
mov byte [esp + 0x13], 0
cmp esi, ebx
jae 0x406f86
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
nop
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x406f58
movzx eax, word [esi]
push eax
call edi
test eax, eax
je 0x406f77
cmp byte [esp + 0x14], 0
jne 0x406f73
movzx ecx, word [esi]
push ecx
mov byte [esp + 0x18], 1
call edi
test eax, eax
je 0x406f73
mov byte [esp + 0x13], 1
inc dword [esp + 0x18]
add esi, 2
cmp esi, ebx
jb 0x406f40
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x406f8a
xor edi, edi
jmp 0x406fdd
cmp eax, 1
jne 0x406f9d
movzx edi, byte [esp + 0x13]
neg edi
sbb edi, edi
and edi, 2
jmp 0x406fdd
cmp byte [esp + 0x13], 0
jne 0x406fa8
xor edi, edi
jmp 0x406fdd
movzx edx, byte [ebp + 0x25]
add edx, edx
mov esi, ebx
sub esi, edx
mov edi, 2
cmp esi, ebx
jae 0x406fd6
jmp 0x406fc0
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x406fd4
add esi, edi
cmp esi, ebx
jb 0x406fc0
cmp esi, ebx
jne 0x406fdd
mov edi, 1
mov dl, byte [ebp + 0x2b]
test dl, dl
jne 0x406fe9
cmp byte [ebp + 0x2c], dl
je 0x406ff3
mov byte [esp + 0x12], 0
mov byte [esp + 0x17], 1
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0x28]
mov dword [ecx], eax
mov cl, byte [ebp + 0x2e]
test cl, cl
je 0x407016
mov eax, dword [0x4bfa6c]
movzx eax, word [eax*2 + 0x4bfa6e]
jmp 0x40702d
cmp byte [esp + 0x15], 0
je 0x40702b
cmp byte [esp + 0x17], 0
je 0x40702b
mov eax, 1
jmp 0x40702d
xor eax, eax
movzx esi, di
movzx eax, ax
shl esi, 0x10
or esi, eax
mov eax, dword [esp + 0x140]
mov dword [eax], esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp word [esi], ax
je 0x407077
test cl, cl
je 0x407070
mov ecx, dword [0x4bfa6c]
mov dx, word [ecx*2 + 0x4bfa6e]
mov word [0x4bfa70], dx
mov dword [0x4bfa6c], 1
jmp 0x40708f
mov dword [0x4bfa6c], eax
jmp 0x40708f
test dl, dl
je 0x40708f
movzx edx, byte [ebp + 0x25]
sub dword [0x4bfa6c], edx
test cl, cl
je 0x40708f
dec dword [0x4bfa6c]
cmp byte [ebp + 0x30], al
je 0x407099
mov dword [0x4bfa6c], eax
mov ecx, dword [0x4bfa6c]
xor eax, eax
mov word [ecx*2 + 0x4bfa70], ax
mov edi, dword [esp + 0x24]
cmp byte [esp + 0x15], 0
je 0x4071cc
cmp byte [esp + 0x12], 0
mov al, byte [0x4c3c3c]
mov byte [esp + 0x18], al
mov byte [0x4c3c3c], 0
je 0x4071cc
mov cl, byte [0x4c0d19]
mov byte [0x4bfc2e], al
xor al, al
test cl, 0x10
je 0x4070ed
mov al, 0xa0
mov byte [esp + 0x24], al
jmp 0x4070ff
test cl, 0x20
je 0x4070fa
mov al, 0xa1
mov byte [esp + 0x24], al
jmp 0x4070ff
mov byte [esp + 0x24], 0xa0
mov esi, dword [esp + 0x24]
test al, al
mov al, byte [0x4c3c42]
setne cl
mov byte [esp + 0x14], cl
cmp al, cl
je 0x407131
push 0xffc3d44d
xor edx, edx
push 0
test al, al
sete dl
push 0
push 0
push esi
push edx
call fcn.0040e9a0
add esp, 0x18
cmp byte [0x4c3c43], 0
je 0x407274
test byte [0x4c0d19], 8
jne 0x407274
push 0xffc3d44d
push 0
push 0
push 0
push 0xa5
push 0
mov bl, 1
call fcn.0040e9a0
add esp, 0x18
movzx eax, word [0x4c3c40]
mov ecx, dword [esp + 0x18]
push 0xffc3d44e
push 0
push 0
push eax
push ecx
push 2
call fcn.0040e9a0
add esp, 0x18
test bl, bl
je 0x4071a5
push 0xffc3d44d
push 0
push 0
push 0
push 0xa5
push 1
call fcn.0040e9a0
add esp, 0x18
mov al, byte [0x4c3c42]
cmp al, byte [esp + 0x14]
je 0x4071cc
push 0xffc3d44d
xor edx, edx
push 0
test al, al
setne dl
push 0
push 0
push esi
push edx
call fcn.0040e9a0
add esp, 0x18
cmp byte [esp + 0x16], 0
je 0x4073cc
cmp dword [0x4c2fa8], 1
jne 0x4073cc
cmp byte [esp + 0x17], 0
jne 0x4073cc
mov eax, dword [0x4c2fdc]
cmp eax, dword [0x4c2fe0]
jge 0x407222
mov ecx, dword [0x4c2fd8]
mov dx, word [esp + 0x1c]
mov word [ecx + eax*2], dx
mov eax, dword [0x4c2fdc]
mov edx, dword [0x4c2fd8]
inc eax
xor ecx, ecx
mov dword [0x4c2fdc], eax
mov word [edx + eax*2], cx
cmp edi, 1
jle 0x40725a
mov eax, dword [0x4c2fdc]
cmp eax, dword [0x4c2fe0]
jge 0x40725a
mov ecx, dword [0x4c2fd8]
mov dx, word [esp + 0x1e]
mov word [ecx + eax*2], dx
mov eax, dword [0x4c2fdc]
mov edx, dword [0x4c2fd8]
inc eax
xor ecx, ecx
mov dword [0x4c2fdc], eax
mov word [edx + eax*2], cx
mov edi, dword [0x4c2fc0]
test edi, edi
jne 0x40727b
mov eax, dword [0x4c2fe0]
cmp dword [0x4c2fdc], eax
jmp 0x4073c0
xor bl, bl
jmp 0x407167
xor esi, esi
cmp byte [0x4c2fd5], 0
je 0x407319
cmp byte [0x4c2fd1], 0
je 0x4072e4
test edi, edi
je 0x4073b4
jmp 0x4072a0
mov ecx, dword [0x4c2fbc]
mov eax, dword [ecx + esi*4]
mov edx, dword [0x4c2fd8]
push eax
push edx
call fcn.00482b78
add esp, 8
test eax, eax
jne 0x4072cb
inc esi
cmp esi, dword [0x4c2fc0]
jb 0x4072a0
jmp 0x4073b4
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
mov dword [0x4c2fa8], 3
pop ebx
add esp, 0x11c
ret
test edi, edi
je 0x4073b4
lea esp, [esp]
mov eax, dword [0x4c2fd8]
mov ecx, dword [0x4c2fbc]
push eax
mov eax, dword [ecx + esi*4]
call fcn.00467560
add esp, 4
test eax, eax
jne 0x4072cb
inc esi
cmp esi, dword [0x4c2fc0]
jb 0x4072f0
jmp 0x4073b4
cmp byte [0x4c2fd1], 0
je 0x40737a
test edi, edi
je 0x4073b4
mov ebx, dword [0x4c2fd8]
mov ebp, dword [0x4c2fbc]
mov ecx, dword [ebp + esi*4]
mov eax, ebx
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407366
test dx, dx
je 0x407362
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407366
add eax, 4
add ecx, 4
test dx, dx
jne 0x407340
xor eax, eax
jmp 0x40736b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4072cb
inc esi
cmp esi, edi
jb 0x407336
jmp 0x4073b4
test edi, edi
je 0x4073b4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x407390
mov edx, dword [0x4c2fbc]
mov eax, dword [edx + esi*4]
mov ecx, dword [0x4c2fd8]
push eax
push ecx
call edi
test eax, eax
je 0x4072cb
inc esi
cmp esi, dword [0x4c2fc0]
jb 0x407390
mov edx, dword [0x4c2fe0]
cmp dword [0x4c2fdc], edx
jl 0x4073cc
mov dword [0x4c2fa8], 5
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x11c
ret