Function at 0x4163d0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
push ebx
mov dword [esp + 0xc], edx
mov bl, byte [esp + 0xc]
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, bl
mov edi, ecx
or ax, si
mov dword [esp + 0x18], edi
je 0x416907
test edx, edx
mov eax, 0xffc3d44d
cmovne eax, edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4ea204]
sete bh
cmp dword [0x4eba58], 0
je 0x41642e
mov byte [esp + 0x10], 1
test bh, bh
je 0x416433
mov byte [esp + 0x10], 0
cmp dword [0x4eba58], 1
je 0x416440
test bh, bh
je 0x416444
mov byte [ebp + 0x10], 0
mov edx, dword [ebp + 8]
test bl, bl
jne 0x416494
movzx ecx, dx
movzx eax, dx
sub ecx, 0x45
je 0x41648c
sub ecx, 0xf1
je 0x416463
sub ecx, 0xf
jne 0x416466
movzx eax, dl
test eax, 0x100
je 0x416475
movzx eax, al
or eax, 0xe000
push 3
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebp + 8]
mov bl, al
mov byte [esp + 0x14], bl
jmp 0x4164a8
mov bl, 0x13
mov byte [esp + 0x14], bl
jmp 0x4164a8
test dx, dx
jne 0x4164a8
xor dl, dl
mov cl, bl
call fcn.004199a0
movzx edx, ax
mov dword [ebp + 8], edx
mov eax, edx
mov byte [esp + 0x24], dl
xor ecx, ecx
shr eax, 8
test al, al
setne cl
cmp dword [0x4eba58], 2
mov dword [esp + 0x20], ecx
jne case.default.0x4164d2
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x4164d2
jmp dword [eax*4 + 0x416910]
mov bl, 0x11
jmp 0x4164e3
mov bl, 0x10
jmp 0x4164e3
mov bl, 0x12
mov byte [esp + 0x14], bl
cmp dword [ebp + 0xc], 0
je 0x416668
push 0
mov cl, bl
call fcn.00418c20
add esp, 4
test al, al
je 0x416601
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test edi, edi
jne 0x41651e
movzx eax, bl
or byte [esp + eax + 0x28], 0x80
jmp 0x41652b
cmp edi, 1
jne 0x41652b
movzx eax, bl
and byte [esp + eax + 0x28], 0x7f
movzx edi, bl
lea eax, [edi - 0xa0]
cmp eax, 5
ja case.default.0x41653d
jmp dword [eax*4 + 0x416928]
test byte [esp + 0xca], 0x80
jne 0x416570
test byte [esp + 0xcb], 0x80
jne 0x416570
and byte [esp + 0x39], 0x7f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x416604
or byte [esp + 0x39], 0x80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x416604
test byte [esp + 0xc8], 0x80
jne 0x4165ae
test byte [esp + 0xc9], 0x80
jne 0x4165ae
and byte [esp + 0x38], 0x7f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x416604
or byte [esp + 0x38], 0x80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x416604
test byte [esp + 0xcc], 0x80
jne 0x4165ec
test byte [esp + 0xcd], 0x80
jne 0x4165ec
and byte [esp + 0x3a], 0x7f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x416604
or byte [esp + 0x3a], 0x80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x416604
movzx edi, bl
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
movzx esi, dx
shl esi, 0x10
cmp eax, 1
je 0x41662e
mov eax, esi
or eax, 1
push eax
push edi
push 0x100
push dword [ebp + 0xc]
call ebx
mov eax, dword [esp + 0x18]
cmp byte [ebp + 0x10], 0
je 0x416649
cmp eax, 2
jne 0x416649
mov ecx, dword [0x4e59a0]
mov ecx, dword [ecx + 0x74]
call fcn.00417e80
jmp 0x416651
test eax, eax
je 0x4168dc
or esi, 0xc0000001
push esi
push edi
push 0x101
push dword [ebp + 0xc]
call ebx
jmp 0x4168dc
cmp byte [0x4e9eec], 0
mov dword [0x4eb9e0], edi
mov byte [0x4eb9e4], bl
je 0x416717
cmp bl, 0x12
je 0x416694
cmp bl, 0xa4
je 0x416694
cmp bl, 0xa5
jne 0x416717
test bh, bh
jne 0x416717
push 0
mov byte [esp + 0x17], 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e9eec], bh
mov eax, dword [0x4eba3c]
mov ecx, dword [0x4ea0ec]
mov dword [esp + 0x18], eax
cmp bl, 0xa5
jne 0x41677d
test eax, eax
mov al, byte [esp + 0x10]
je 0x416781
test al, al
jne 0x416781
test ecx, ecx
je 0x416781
mov byte [esp + 0x11], 1
mov esi, dword [ebp + 8]
xor dh, dh
mov byte [esp + 0x12], dh
test bh, bh
jne 0x4167b0
mov eax, dword [0x4eba58]
cmp eax, 2
je 0x4167b0
test ecx, ecx
je 0x416710
cmp eax, 1
jne 0x4167b0
mov bh, 1
jmp 0x4167b2
mov byte [esp + 0x13], 0
test bh, bh
je 0x4166ab
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
test eax, eax
je 0x41676a
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [esp + 0x128], 0x30
lea eax, [esp + 0x128]
push eax
push esi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x41676a
mov eax, dword [esp + 0x134]
test eax, eax
je 0x41676a
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
call fcn.00418f60
jmp 0x4166b0
mov al, byte [esp + 0x10]
mov byte [esp + 0x11], 0
test al, al
je 0x4166e4
mov esi, dword [ebp + 8]
mov cl, bl
push 0
mov edx, esi
call fcn.00418c20
mov ecx, dword [0x4ea0ec]
add esp, 4
mov dh, al
mov byte [esp + 0x12], al
jmp 0x4166ed
xor bh, bh
cmp edi, 1
je 0x416819
cmp byte [esp + 0x10], 0
je 0x4167d5
push dword [esp + 0x1c]
mov dl, bl
mov cl, dh
push dword [esp + 0x24]
push esi
call fcn.00417930
add esp, 0xc
jmp 0x416808
mov ecx, dword [esp + 0x1c]
mov eax, dword [0x4ea0f0]
cmp byte [esp + 0x11], 0
push ecx
push dword [esp + 0x24]
cmovne eax, ecx
push dword [esp + 0x2c]
mov dword [0x4ea0f0], eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [0x4ea0f0], 0
test bh, bh
je 0x416819
push esi
mov dl, bl
xor cl, cl
call fcn.00418050
add esp, 4
cmp byte [ebp + 0x10], 0
je 0x416845
cmp edi, 2
jne 0x416845
mov eax, dword [0x4e59a0]
cmp dword [0x4eba58], edi
jne 0x41683b
mov ecx, dword [eax + 0x78]
call fcn.00417e80
jmp 0x416849
mov ecx, dword [eax + 0x74]
call fcn.00417e80
jmp 0x416849
test edi, edi
je 0x4168c6
mov ecx, dword [esp + 0x20]
or ecx, 2
cmp byte [esp + 0x10], 0
je 0x41686d
push dword [esp + 0x1c]
mov dl, bl
push ecx
mov cl, byte [esp + 0x1a]
push esi
call fcn.00417930
add esp, 0xc
jmp 0x41689d
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4ea0f0]
cmp byte [esp + 0x11], 0
push edx
push ecx
push dword [esp + 0x2c]
cmovne eax, edx
push dword [esp + 0x20]
mov dword [0x4ea0f0], eax
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [0x4ea0f0], 0
cmp dword [esp + 0x18], 0
je 0x4168b5
mov eax, 0x138
cmp si, ax
jne 0x4168b5
and byte [0x4eba4c], 0xfe
test bh, bh
je 0x4168c6
push esi
mov dl, bl
mov cl, 1
call fcn.00418050
add esp, 4
cmp byte [esp + 0x13], 0
je 0x4168dc
push 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e9eec], 1
cmp byte [ebp + 0x10], 0
je 0x416907
cmp dword [0x4eba58], 2
mov eax, dword [0x4e59a0]
jne 0x4168ff
mov ecx, dword [eax + 0x70]
call fcn.00417e80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x6c]
call fcn.00417e80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret