Function at 0x406f70
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x4c8efc]
sub esp, 0x120
push ebx
mov bl, byte [esp + 0x12c]
push ebp
mov bp, word [esp + 0x134]
push edi
mov edi, dword [0x4ca610]
cmp edi, 1
jne 0x406fb6
cmp byte [0x4ca640], 0
jne 0x406fb6
movzx eax, bl
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + ecx], 0
mov byte [esp + 0xe], 0
je 0x406fbb
mov byte [esp + 0xe], 1
cmp byte [esp + 0x13c], 0
je 0x406fe9
movzx eax, bl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ecx + 4], 0
mov al, 1
jne 0x4079c0
mov al, byte [esp + 0xe]
pop edi
pop ebp
pop ebx
add esp, 0x120
ret
cmp dword [0x4c9ec4], 0
je 0x407001
test dl, dl
jne 0x407001
mov byte [esp + 0xf], 1
cmp byte [esp + 0xe], dl
jne 0x407006
mov byte [esp + 0xf], 0
mov al, byte [0x4c84c5]
push esi
cmp edi, 1
jne 0x4070e8
cmp byte [0x4ca63e], 0
je 0x407026
test dl, dl
jne 0x4070e8
mov byte [esp + 0x14], 1
cmp bl, 0xe7
je 0x4070c7
mov edx, dword [0x4ca614]
mov esi, dword [0x4ca618]
movzx ecx, bl
mov cl, byte [ecx + edx]
test cl, cl
jne 0x407054
movzx ecx, bp
mov cl, byte [ecx + esi]
test cl, cl
je 0x4070c7
mov dl, cl
shr cl, 2
shr dl, 1
and cl, 1
and dl, 1
je 0x4070ef
test cl, cl
jne 0x407077
test al, 0x30
jne 0x407077
test cl, cl
je 0x4070c7
test al, 0x30
jne 0x4070c7
movzx ecx, bp
mov edi, 4
mov dword [0x4ca610], edi
cmp byte [ecx + esi], 0
mov byte [0x4ca620], bl
setne cl
mov byte [0x4ca626], cl
xor ecx, ecx
mov word [0x4ca622], bp
mov word [0x4ca624], cx
test dl, dl
je 0x4070b7
mov byte [0x4ca627], 1
test al, 0x30
jne 0x4070bd
mov byte [0x4ca627], cl
cmp byte [esp + 0x13], cl
je 0x4079bb
movzx ebx, byte [esp + 0x138]
lea ecx, [ebx - 0x21]
cmp ecx, 0x84
ja case.0x4070e1.41
movzx edx, byte [ecx + 0x4079d8]
jmp dword [edx*4 + 0x4079cc]
mov byte [esp + 0x14], 0
jmp 0x4070c7
test cl, cl
je 0x407077
jmp 0x407073
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x120
ret
cmp byte [esp + 0x13], 0
je case.0x4070e1.41
mov ecx, dword [0x4c7214]
test ecx, ecx
je 0x40712d
xor ecx, ecx
mov word [0x4c7218], cx
mov dword [0x4c7214], ecx
jmp 0x40712d
mov ecx, dword [0x4c7214]
test al, al
je 0x407157
cmp edi, 1
jne 0x40713f
cmp byte [0x4ca63f], 0
jne 0x407157
cmp al, 0x10
je 0x407157
cmp al, 0x20
je 0x407157
test al, 0xc
je 0x4079bb
test al, 3
je 0x4079bb
cmp byte [esp + 0x138], 8
jne 0x4071d2
test al, al
jne 0x4071d2
cmp byte [esp + 0x14], al
je 0x407193
cmp edi, 1
jne 0x407193
cmp byte [0x4ca63c], al
je 0x407193
mov eax, dword [0x4ca648]
test eax, eax
je 0x407193
mov esi, dword [0x4ca644]
dec eax
xor edx, edx
mov dword [0x4ca648], eax
mov word [esi + eax*2], dx
cmp byte [esp + 0x13], 0
je 0x4071af
test ecx, ecx
je 0x4071af
dec ecx
xor eax, eax
mov dword [0x4c7214], ecx
mov word [ecx*2 + 0x4c7218], ax
cmp byte [0x4cb300], 0
je 0x4079bb
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
mov byte [0x4cb300], 0
pop ebx
add esp, 0x120
ret
mov ecx, 0x40
mov esi, 0x4c84e8
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
call fcn.00411af0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4071fe
or byte [esp + 0x44], 1
jmp 0x407203
and byte [esp + 0x44], 0xfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
test ebp, ebp
je 0x40721a
push 0
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x40721c
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp byte [esp + 0x138], 0xe7
mov edi, dword [sym.imp.USER32.dll_ToUnicodeEx]
mov esi, eax
mov dword [esp + 0x2c], esi
jne 0x407251
mov cx, word [esp + 0x13c]
mov eax, 1
mov dword [esp + 0x28], eax
mov word [esp + 0x18], cx
jmp 0x407284
xor edx, edx
cmp dword [0x4c8658], edx
push esi
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x13c]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
push eax
push ebx
call edi
mov dword [esp + 0x28], eax
test eax, eax
je 0x4079bb
cmp byte [0x4cb300], 0
mov cl, byte [esp + 0x138]
je 0x4072a3
cmp cl, 9
je 0x4072a3
mov byte [esp + 0x17], 1
cmp cl, 0x1b
jne 0x4072a8
mov byte [esp + 0x17], 0
test eax, eax
jns 0x407328
cmp byte [esp + 0x12], 0
je 0x4079bb
mov al, byte [0x4c84c5]
test al, 0x30
mov byte [0x4cb300], cl
mov cx, word [esp + 0x13c]
setne dl
mov word [0x4cb304], cx
mov byte [0x4cb306], dl
test al, 3
je 0x4072eb
mov byte [0x4cb307], 1
test al, 0xc
jne 0x4072f2
mov byte [0x4cb307], 0
xor eax, eax
cmp dword [0x4c8658], eax
push esi
setne al
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x13c]
push 2
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
push ebx
call edi
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x120
ret
test byte [0x4c84c5], 3
jne 0x407358
mov eax, 0xd
cmp word [esp + 0x18], ax
jne 0x407347
mov edx, 0xa
mov word [esp + 0x18], dx
cmp word [esp + 0x1a], ax
jne 0x407358
mov eax, 0xa
mov word [esp + 0x1a], ax
cmp byte [esp + 0x13], 0
mov byte [esp + 0x15], 0
je 0x407726
cmp ebp, dword [0x4c7210]
je 0x407381
xor ecx, ecx
mov dword [0x4c7210], ebp
mov word [0x4c7218], cx
jmp 0x4073d1
mov ecx, dword [0x4c7214]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x4073d1
mov eax, 0x4c7272
lea edx, [eax + 2]
jmp 0x4073a0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4073a0
sub eax, edx
sar eax, 1
mov dword [0x4c7214], eax
lea eax, [eax + eax + 2]
push eax
push 0x4c7272
push 0x4c7218
call fcn.0048e470
mov ecx, dword [0x4c7214]
add esp, 0xc
mov dx, word [esp + 0x18]
mov word [ecx*2 + 0x4c7218], dx
inc ecx
cmp dword [esp + 0x28], 1
mov dword [0x4c7214], ecx
jle 0x407400
mov ax, word [esp + 0x1a]
mov word [ecx*2 + 0x4c7218], ax
inc ecx
mov dword [0x4c7214], ecx
xor edx, edx
mov word [ecx*2 + 0x4c7218], dx
test ecx, ecx
je 0x407726
mov dword [esp + 0x24], edx
cmp dword [0x4c9ec8], edx
jbe 0x407726
mov eax, dword [0x4c9ec4]
mov edx, dword [esp + 0x24]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x27], 0
jne 0x407542
cmp byte [ebp + 0x2f], 0
je 0x407477
movzx eax, byte [ebp + 0x26]
cmp ecx, eax
jle 0x407542
movzx eax, word [ecx*2 + 0x4c7216]
push eax
push 0x4c48f0
call fcn.0048e7d1
add esp, 8
test eax, eax
je 0x40753c
mov ecx, dword [0x4c7214]
lea edi, [ecx*2 + 0x4c7214]
jmp 0x40748a
movzx edx, byte [ebp + 0x26]
cmp ecx, edx
jl 0x407542
lea edi, [ecx*2 + 0x4c7216]
cmp byte [ebp + 0x2a], 0
movzx edx, byte [ebp + 0x26]
mov eax, dword [ebp + 4]
lea esi, [eax + edx*2 - 2]
je 0x4074b4
cmp esi, eax
jb 0x4074f0
nop
mov dx, word [edi]
cmp dx, word [esi]
jne 0x4074f0
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x4074a0
jmp 0x4074f0
cmp esi, eax
jb 0x4074f0
jmp 0x4074c0
movzx eax, word [esi]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
push eax
call ebx
movzx ecx, word [edi]
push ecx
mov dword [esp + 0x24], eax
call ebx
mov ecx, dword [esp + 0x20]
cmp ax, cx
jne 0x4074ea
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 4]
jae 0x4074c0
mov ecx, dword [0x4c7214]
cmp esi, dword [ebp + 4]
jae 0x407542
cmp byte [ebp + 0x30], 0
jne 0x407511
cmp edi, 0x4c7218
jb 0x407511
movzx edx, word [edi]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x40753c
mov eax, dword [ebp]
test eax, eax
je 0x40751d
mov eax, dword [eax + 4]
jmp 0x407522
mov eax, 0x4a1838
mov edx, dword [ebp + 0xc]
mov bl, byte [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x10]
call fcn.004099a0
add esp, 8
test eax, eax
jne 0x40755c
mov ecx, dword [0x4c7214]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [0x4c9ec8]
jb 0x407422
jmp 0x407726
movzx edx, byte [ebp + 0x25]
mov ecx, dword [esp + 0x144]
mov eax, dword [esp + 0x134]
mov eax, dword [eax + 0x10]
add ecx, 4
push edx
call fcn.0040a480
add esp, 4
test al, al
je 0x407726
xor edi, edi
cmp byte [ebp + 0x2b], 0
je 0x40766d
cmp byte [ebp + 0x2f], 0
mov ebx, dword [0x4c7214]
lea ebx, [ebx*2 + 0x4c7218]
je 0x4075a7
sub ebx, 2
movzx ecx, byte [ebp + 0x26]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov dword [esp + 0x20], edi
mov byte [esp + 0x16], 0
mov byte [esp + 0x13], 0
cmp esi, ebx
jae 0x407616
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
lea esp, [esp]
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x4075e8
movzx eax, word [esi]
push eax
call edi
test eax, eax
je 0x407607
cmp byte [esp + 0x16], 0
jne 0x407603
movzx ecx, word [esi]
push ecx
mov byte [esp + 0x1a], 1
call edi
test eax, eax
je 0x407603
mov byte [esp + 0x13], 1
inc dword [esp + 0x20]
add esi, 2
cmp esi, ebx
jb 0x4075d0
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40761a
xor edi, edi
jmp 0x40766d
cmp eax, 1
jne 0x40762d
movzx edi, byte [esp + 0x13]
neg edi
sbb edi, edi
and edi, 2
jmp 0x40766d
cmp byte [esp + 0x13], 0
jne 0x407638
xor edi, edi
jmp 0x40766d
movzx edx, byte [ebp + 0x26]
add edx, edx
mov esi, ebx
sub esi, edx
mov edi, 2
cmp esi, ebx
jae 0x407666
jmp 0x407650
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x407664
add esi, edi
cmp esi, ebx
jb 0x407650
cmp esi, ebx
jne 0x40766d
mov edi, 1
mov dl, byte [ebp + 0x2c]
test dl, dl
jne 0x407679
cmp byte [ebp + 0x2d], dl
je 0x407683
mov byte [esp + 0x12], 0
mov byte [esp + 0x15], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x148]
mov dword [ecx], eax
mov al, byte [ebp + 0x2f]
test al, al
je 0x4076a7
mov ecx, dword [0x4c7214]
movzx ecx, word [ecx*2 + 0x4c7216]
jmp 0x4076a9
xor ecx, ecx
movzx esi, di
movzx ecx, cx
shl esi, 0x10
or esi, ecx
mov ecx, dword [esp + 0x14c]
mov dword [ecx], esi
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp word [esi], cx
je 0x4076f3
test al, al
je 0x4076eb
mov edx, dword [0x4c7214]
mov ax, word [edx*2 + 0x4c7216]
mov word [0x4c7218], ax
mov dword [0x4c7214], 1
jmp 0x40770b
mov dword [0x4c7214], ecx
jmp 0x40770b
test dl, dl
je 0x40770b
movzx edx, byte [ebp + 0x26]
sub dword [0x4c7214], edx
test al, al
je 0x40770b
dec dword [0x4c7214]
cmp byte [ebp + 0x31], cl
je 0x407716
mov dword [0x4c7214], ecx
mov ecx, dword [0x4c7214]
xor eax, eax
mov word [ecx*2 + 0x4c7218], ax
cmp byte [esp + 0x17], 0
je 0x407799
cmp byte [esp + 0x12], 0
mov bl, byte [0x4cb300]
mov byte [0x4cb300], 0
je 0x407799
push 0x100
lea edx, [esp + 0x34]
push 0
push edx
call fcn.004968d0
mov al, byte [0x4cb306]
mov cl, byte [0x4cb307]
add esp, 0xc
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x30]
call fcn.00411af0
mov edx, dword [esp + 0x2c]
push edx
movzx edx, word [0x4cb304]
push 0
push 2
lea eax, [esp + 0x38]
push eax
push ecx
movzx eax, bl
push edx
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp byte [esp + 0x14], 0
je 0x4079bb
cmp dword [0x4ca610], 1
jne 0x4079bb
cmp byte [esp + 0x15], 0
jne 0x4079bb
mov edi, dword [esp + 0x28]
xor esi, esi
test edi, edi
jle 0x40783a
jmp 0x4077d0
cmp byte [0x4ca63d], 0
mov ecx, dword [0x4ca61c]
je 0x4077f0
movzx eax, word [esp + esi*2 + 0x18]
push eax
push ecx
call fcn.0048e7d1
add esp, 8
jmp 0x4077fa
mov ax, word [esp + esi*2 + 0x18]
call fcn.00474ba0
test eax, eax
jne 0x40788a
mov eax, dword [0x4ca648]
cmp eax, dword [0x4ca64c]
je 0x40783a
mov dx, word [esp + esi*2 + 0x18]
mov ecx, dword [0x4ca644]
mov word [ecx + eax*2], dx
mov eax, dword [0x4ca648]
mov ecx, dword [0x4ca644]
inc eax
xor edx, edx
inc esi
mov dword [0x4ca648], eax
mov word [ecx + eax*2], dx
cmp esi, edi
jl 0x4077d0
xor esi, esi
cmp byte [0x4ca641], 0
je 0x407909
cmp byte [0x4ca63d], 0
je 0x4078c8
cmp dword [0x4ca62c], esi
jbe 0x4079a3
mov edi, edi
mov eax, dword [0x4ca628]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4ca644]
push eax
push ecx
call fcn.0048e7f8
add esp, 8
test eax, eax
jne 0x4078af
inc esi
cmp esi, dword [0x4ca62c]
jb 0x407860
jmp 0x4079a3
mov dx, word [esp + esi*2 + 0x18]
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
mov dword [0x4ca610], 4
mov word [0x4ca624], dx
pop ebx
add esp, 0x120
ret
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
mov dword [0x4ca610], 3
pop ebx
add esp, 0x120
ret
cmp dword [0x4ca62c], esi
jbe 0x4079a3
jmp 0x4078e0
mov edx, dword [0x4ca644]
mov eax, dword [0x4ca628]
mov eax, dword [eax + esi*4]
push edx
call fcn.00474bf0
add esp, 4
test eax, eax
jne 0x4078af
inc esi
cmp esi, dword [0x4ca62c]
jb 0x4078e0
jmp 0x4079a3
cmp byte [0x4ca63d], 0
je 0x40796f
mov ebp, dword [0x4ca62c]
test ebp, ebp
je 0x4079a3
mov edi, dword [0x4ca644]
mov ebx, dword [0x4ca628]
lea esp, [esp]
mov ecx, dword [ebx + esi*4]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40795b
test dx, dx
je 0x407957
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40795b
add eax, 4
add ecx, 4
test dx, dx
jne 0x407935
xor eax, eax
jmp 0x407960
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4078af
inc esi
cmp esi, ebp
jb 0x407930
jmp 0x4079a3
cmp dword [0x4ca62c], esi
jbe 0x4079a3
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea ecx, [ecx]
mov ecx, dword [0x4ca628]
mov edx, dword [ecx + esi*4]
mov eax, dword [0x4ca644]
push edx
push eax
call edi
test eax, eax
je 0x4078af
inc esi
cmp esi, dword [0x4ca62c]
jb 0x407980
mov ecx, dword [0x4ca64c]
cmp dword [0x4ca648], ecx
jl 0x4079bb
mov dword [0x4ca610], 5
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x120
ret