Function at 0x4105f0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov dl, byte [esp + 8]
mov ecx, dword [0x4e895c]
sub esp, 0x15c
push ebx
push ebp
mov ebp, dword [0x4ea190]
push edi
mov di, word [esp + 0x174]
cmp ebp, 1
jne 0x410633
cmp byte [0x4ea1c0], 0
jne 0x410633
movzx eax, dl
lea eax, [eax + eax*4]
cmp dword [ecx + eax*4], 0
jne 0x410633
xor bl, bl
mov byte [esp + 0xf], bl
jmp 0x41063c
mov byte [esp + 0xf], 1
mov bl, byte [esp + 0xf]
cmp byte [esp + 0x178], 0
je 0x410665
movzx eax, dl
lea edx, [eax + eax*4]
cmp byte [ecx + edx*4 + 8], 0
mov al, 1
jne 0x4110c9
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x15c
ret
cmp dword [0x4e898c], 0
je 0x410681
cmp byte [esp + 0x17c], 0
jne 0x410681
mov byte [esp + 0x10], 1
test bl, bl
jne 0x410686
mov byte [esp + 0x10], 0
mov bl, byte [0x4e7ee7]
push esi
cmp ebp, 1
jne 0x410774
cmp byte [0x4ea1be], 0
je 0x4106ad
cmp byte [esp + 0x180], 0
jne 0x410774
mov byte [esp + 0x15], 1
cmp dl, 0xe7
je 0x410755
mov ecx, dword [0x4ea194]
mov esi, dword [0x4ea198]
movzx eax, dl
mov al, byte [eax + ecx]
test al, al
jne 0x4106db
movzx eax, di
mov al, byte [eax + esi]
test al, al
je 0x410755
mov cl, al
shr al, 2
shr cl, 1
and al, 1
and cl, 1
je 0x41077b
test al, al
jne 0x4106ff
test bl, 0x30
jne 0x4106ff
test al, al
je 0x410755
test bl, 0x30
jne 0x410755
movzx eax, di
mov ebp, 4
mov dword [0x4ea190], ebp
cmp byte [eax + esi], 0
mov byte [0x4ea1a0], dl
setne al
mov byte [0x4ea1a6], al
xor eax, eax
mov word [0x4ea1a2], di
mov word [0x4ea1a4], ax
test cl, cl
je 0x41073e
mov byte [0x4ea1a7], 1
test bl, 0x30
jne 0x410743
mov byte [0x4ea1a7], al
cmp byte [esp + 0x14], al
jne 0x410755
cmp byte [0x4eaed8], al
je 0x4110dd
movzx eax, dl
mov dword [esp + 0x20], eax
add eax, 0xffffffdf
cmp eax, 0x84
ja case.0x41076d.41
movzx ecx, byte [eax + 0x411134]
jmp dword [ecx*4 + 0x411128]
mov byte [esp + 0x15], 0
jmp 0x410755
test al, al
je 0x4106ff
jmp 0x4106fa
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret
cmp byte [esp + 0x14], 0
je case.0x41076d.41
mov ecx, dword [0x4e6bbc]
test ecx, ecx
je 0x4107ba
xor eax, eax
xor ecx, ecx
mov word [0x4e6bc0], ax
mov dword [0x4e6bbc], ecx
jmp 0x4107ba
mov ecx, dword [0x4e6bbc]
test bl, bl
je 0x4107ed
cmp ebp, 1
jne 0x4107cc
cmp byte [0x4ea1bf], 0
jne 0x4107ed
cmp bl, 0x10
je 0x4107ed
cmp bl, 0x20
je 0x4107ed
cmp bl, 0x30
je 0x4107ed
test bl, 0xc
je 0x4110dd
test bl, 3
je 0x4110dd
cmp dl, 8
jne 0x41085f
test bl, bl
jne 0x41085f
cmp byte [esp + 0x15], bl
je 0x410824
cmp ebp, 1
jne 0x410824
cmp byte [0x4ea1bc], bl
je 0x410824
mov eax, dword [0x4ea1c8]
test eax, eax
je 0x410824
mov esi, dword [0x4ea1c4]
dec eax
xor edx, edx
mov dword [0x4ea1c8], eax
mov word [esi + eax*2], dx
cmp byte [esp + 0x14], 0
je 0x410840
test ecx, ecx
je 0x410840
dec ecx
xor eax, eax
mov dword [0x4e6bbc], ecx
mov word [ecx*2 + 0x4e6bc0], ax
cmp byte [0x4eaed8], 0
je 0x410850
mov byte [0x4eaed8], 0
mov al, byte [esp + 0x13]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x15c
ret
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov ecx, esi
mov dword [esp + 0x28], esi
call fcn.0041bf80
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebp, eax
mov dword [esp + 0x30], ebp
cmp dword [0x4eaee4], esi
je 0x4108bd
push 0x1c
lea ecx, [esp + 0x138]
push ecx
push esi
mov dword [0x4eaee4], esi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea edx, [esp + 0x134]
push str.ApplicationFrameWindow
push edx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
sete byte [0x4eaee0]
mov bl, byte [0x4eaed8]
mov ecx, 0x40
mov esi, 0x4e7f10
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_ToUnicodeEx]
test bl, bl
je 0x41095a
cmp byte [0x4eaee0], 0
je 0x41095a
cmp byte [esp + 0x174], 0xe7
je 0x41095a
mov al, byte [0x4eaede]
mov cl, byte [0x4eaedf]
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x34]
call fcn.0041baf0
push ebp
push 0
push 2
lea edx, [esp + 0x24]
push edx
mov eax, ecx
movzx ecx, word [0x4eaedc]
push eax
movzx edx, bl
push ecx
push edx
call esi
test eax, eax
jle 0x410953
movzx edx, word [0x4eaedc]
push ebp
push 0
push 2
lea eax, [esp + 0x24]
push eax
movzx eax, byte [0x4eaed8]
lea ecx, [esp + 0x44]
push ecx
push edx
push eax
call esi
mov byte [0x4eaed8], 0
mov al, byte [0x4e7ee7]
lea ecx, [esp + 0x34]
call fcn.0041baf0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x41097b
or byte [esp + 0x48], 1
jmp 0x410980
and byte [esp + 0x48], 0xfe
cmp byte [esp + 0x174], 0xe7
jne 0x4109a2
mov cx, word [esp + 0x178]
mov eax, 1
mov dword [esp + 0x2c], eax
mov word [esp + 0x18], cx
jmp 0x4109d9
xor edx, edx
cmp dword [0x4e8080], edx
push ebp
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x178]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x34]
push eax
push ecx
call esi
mov dword [esp + 0x2c], eax
test eax, eax
je 0x4110dd
cmp byte [0x4eaed8], 0
setne byte [esp + 0x27]
test eax, eax
jns 0x410a72
mov bl, byte [esp + 0x13]
test bl, bl
je 0x4110c6
mov ax, word [esp + 0x178]
mov dl, byte [esp + 0x174]
mov word [0x4eaedc], ax
mov al, byte [0x4e7ee7]
test al, 0x30
setne cl
mov byte [0x4eaed8], dl
mov byte [0x4eaede], cl
test al, 3
je 0x410a33
mov byte [0x4eaedf], 1
test al, 0xc
jne 0x410a3a
mov byte [0x4eaedf], 0
xor edx, edx
cmp dword [0x4e8080], edx
push ebp
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x178]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x34]
push eax
push ecx
call esi
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x15c
ret
test byte [0x4e7ee7], 3
jne 0x410aa2
mov eax, 0xd
cmp word [esp + 0x18], ax
jne 0x410a91
mov edx, 0xa
mov word [esp + 0x18], dx
cmp word [esp + 0x1a], ax
jne 0x410aa2
mov eax, 0xa
mov word [esp + 0x1a], ax
cmp byte [esp + 0x14], 0
mov byte [esp + 0x17], 0
je 0x410e73
mov eax, dword [esp + 0x28]
cmp eax, dword [0x4e6bb8]
je 0x410ace
xor ecx, ecx
mov dword [0x4e6bb8], eax
mov word [0x4e6bc0], cx
jmp 0x410b22
mov ecx, dword [0x4e6bbc]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x410b22
mov eax, 0x4e6c1a
lea edx, [eax + 2]
jmp 0x410af0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410af0
sub eax, edx
sar eax, 1
mov dword [0x4e6bbc], eax
lea eax, [eax + eax + 2]
push eax
push 0x4e6c1a
push 0x4e6bc0
call dword [sym.imp.MSVCR100.dll_memmove]
mov ecx, dword [0x4e6bbc]
add esp, 0xc
mov dx, word [esp + 0x18]
mov word [ecx*2 + 0x4e6bc0], dx
inc ecx
cmp dword [esp + 0x2c], 1
mov dword [0x4e6bbc], ecx
jle 0x410b51
mov ax, word [esp + 0x1a]
mov word [ecx*2 + 0x4e6bc0], ax
inc ecx
mov dword [0x4e6bbc], ecx
xor edx, edx
mov word [ecx*2 + 0x4e6bc0], dx
test ecx, ecx
je 0x410e73
mov dword [esp + 0x28], edx
cmp dword [0x4e8990], edx
jbe 0x410e73
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
lea esp, [esp]
mov eax, dword [0x4e898c]
mov edx, dword [esp + 0x28]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x23], 0
jne 0x410c92
cmp byte [ebp + 0x2a], 0
je 0x410bd6
movzx eax, byte [ebp + 0x22]
cmp ecx, eax
jle 0x410c92
movzx eax, word [ecx*2 + 0x4e6bbe]
push eax
push str._____:____.___n__t
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 8
test eax, eax
je 0x410c8c
mov ecx, dword [0x4e6bbc]
lea edi, [ecx*2 + 0x4e6bbc]
jmp 0x410be9
movzx edx, byte [ebp + 0x22]
cmp ecx, edx
jl 0x410c92
lea edi, [ecx*2 + 0x4e6bbe]
cmp byte [ebp + 0x26], 0
movzx edx, byte [ebp + 0x22]
mov eax, dword [ebp + 8]
lea esi, [eax + edx*2 - 2]
je 0x410c14
cmp esi, eax
jb 0x410c56
mov edi, edi
mov dx, word [edi]
cmp dx, word [esi]
jne 0x410c56
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x410c00
jmp 0x410c56
cmp esi, eax
jb 0x410c56
jmp 0x410c26
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
movzx eax, word [esi]
push eax
call ebx
movzx ecx, word [edi]
push ecx
mov dword [esp + 0x24], eax
call ebx
mov ecx, dword [esp + 0x20]
cmp ax, cx
jne 0x410c4a
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 8]
jae 0x410c20
mov ecx, dword [0x4e6bbc]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
cmp esi, dword [ebp + 8]
jae 0x410c92
cmp byte [ebp + 0x2b], 0
jne 0x410c79
cmp edi, 0x4e6bc0
jb 0x410c79
movzx edx, word [edi]
push edx
call fcn.004111c0
add esp, 4
test al, al
jne 0x410c8c
mov eax, dword [ebp + 4]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004133b0
add esp, 4
test eax, eax
jne 0x410cac
mov ecx, dword [0x4e6bbc]
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, dword [0x4e8990]
jb 0x410b80
jmp 0x410e73
movzx edx, byte [ebp + 0x21]
mov ecx, dword [esp + 0x184]
mov eax, dword [esp + 0x170]
mov eax, dword [eax + 0x10]
add ecx, 4
push edx
call fcn.00413f80
add esp, 4
test al, al
je 0x410e73
cmp byte [ebp + 0x27], 0
jne 0x410ce2
xor edi, edi
jmp 0x410dbd
cmp byte [ebp + 0x2a], 0
mov ebx, dword [0x4e6bbc]
lea ebx, [ebx*2 + 0x4e6bc0]
je 0x410cf8
sub ebx, 2
movzx ecx, byte [ebp + 0x22]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov dword [esp + 0x20], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x14], 0
cmp esi, ebx
jae 0x410d66
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
mov edi, edi
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x410d38
movzx eax, word [esi]
push eax
call edi
test eax, eax
je 0x410d57
cmp byte [esp + 0x16], 0
jne 0x410d53
movzx ecx, word [esi]
push ecx
mov byte [esp + 0x1a], 1
call edi
test eax, eax
je 0x410d53
mov byte [esp + 0x14], 1
inc dword [esp + 0x20]
add esi, 2
cmp esi, ebx
jb 0x410d20
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x410d6a
xor edi, edi
jmp 0x410dbd
cmp eax, 1
jne 0x410d7d
movzx edi, byte [esp + 0x14]
neg edi
sbb edi, edi
and edi, 2
jmp 0x410dbd
cmp byte [esp + 0x14], 0
jne 0x410d88
xor edi, edi
jmp 0x410dbd
movzx edx, byte [ebp + 0x22]
add edx, edx
mov esi, ebx
sub esi, edx
mov edi, 2
cmp esi, ebx
jae 0x410db6
jmp 0x410da0
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x410db4
add esi, edi
cmp esi, ebx
jb 0x410da0
cmp esi, ebx
jne 0x410dbd
mov edi, 1
mov dl, byte [ebp + 0x28]
test dl, dl
jne 0x410dc9
cmp byte [ebp + 0x29], dl
je 0x410dd3
mov byte [esp + 0x13], 0
mov byte [esp + 0x17], 1
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x188]
mov dword [ecx], eax
mov al, byte [ebp + 0x2a]
test al, al
je 0x410df7
mov ecx, dword [0x4e6bbc]
movzx ecx, word [ecx*2 + 0x4e6bbe]
jmp 0x410df9
xor ecx, ecx
movzx esi, di
movzx ecx, cx
shl esi, 0x10
or esi, ecx
mov ecx, dword [esp + 0x18c]
mov dword [ecx], esi
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
je 0x410e40
test al, al
je 0x410e38
mov edx, dword [0x4e6bbc]
mov ax, word [edx*2 + 0x4e6bbe]
mov word [0x4e6bc0], ax
mov dword [0x4e6bbc], 1
jmp 0x410e58
mov dword [0x4e6bbc], ecx
jmp 0x410e58
test dl, dl
je 0x410e58
movzx edx, byte [ebp + 0x22]
sub dword [0x4e6bbc], edx
test al, al
je 0x410e58
dec dword [0x4e6bbc]
cmp byte [ebp + 0x2c], cl
je 0x410e63
mov dword [0x4e6bbc], ecx
mov ecx, dword [0x4e6bbc]
xor eax, eax
mov word [ecx*2 + 0x4e6bc0], ax
cmp byte [esp + 0x27], 0
mov bl, byte [esp + 0x13]
je 0x410ee5
test bl, bl
je 0x410ee5
push 0x100
lea edx, [esp + 0x38]
push 0
push edx
call sub.MSVCR100.dll_memset
mov al, byte [0x4eaede]
mov cl, byte [0x4eaedf]
add esp, 0xc
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x34]
call fcn.0041baf0
mov edx, dword [esp + 0x30]
push edx
movzx edx, word [0x4eaedc]
push 0
push 2
lea eax, [esp + 0x3c]
push eax
movzx eax, byte [0x4eaed8]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov byte [0x4eaed8], 0
cmp byte [esp + 0x15], 0
je 0x4110c6
cmp dword [0x4ea190], 1
jne 0x4110c6
cmp byte [esp + 0x17], 0
jne 0x4110c6
mov edi, dword [esp + 0x2c]
xor esi, esi
test edi, edi
jle 0x410f87
mov ebp, dword [sym.imp.MSVCR100.dll_wcschr]
jmp 0x410f20
cmp byte [0x4ea1bd], 0
mov ecx, dword [0x4ea19c]
je 0x410f3d
movzx eax, word [esp + esi*2 + 0x18]
push eax
push ecx
call ebp
add esp, 8
jmp 0x410f47
mov ax, word [esp + esi*2 + 0x18]
call fcn.0049ec10
test eax, eax
jne 0x410fd8
mov eax, dword [0x4ea1c8]
cmp eax, dword [0x4ea1cc]
je 0x410f87
mov dx, word [esp + esi*2 + 0x18]
mov ecx, dword [0x4ea1c4]
mov word [ecx + eax*2], dx
mov eax, dword [0x4ea1c8]
mov ecx, dword [0x4ea1c4]
inc eax
xor edx, edx
inc esi
mov dword [0x4ea1c8], eax
mov word [ecx + eax*2], dx
cmp esi, edi
jl 0x410f20
xor esi, esi
cmp byte [0x4ea1c1], 0
je 0x411046
cmp byte [0x4ea1bd], 0
je 0x411012
cmp dword [0x4ea1ac], esi
jbe 0x4110ae
mov edi, dword [sym.imp.MSVCR100.dll_wcsstr]
mov eax, dword [0x4ea1a8]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4ea1c4]
push eax
push ecx
call edi
add esp, 8
test eax, eax
jne 0x410ffb
inc esi
cmp esi, dword [0x4ea1ac]
jb 0x410fb1
jmp 0x4110ae
mov dx, word [esp + esi*2 + 0x18]
pop esi
pop edi
pop ebp
mov al, bl
mov dword [0x4ea190], 4
mov word [0x4ea1a4], dx
pop ebx
add esp, 0x15c
ret
pop esi
pop edi
pop ebp
mov al, bl
mov dword [0x4ea190], 3
pop ebx
add esp, 0x15c
ret
cmp dword [0x4ea1ac], esi
jbe 0x4110ae
mov edi, edi
mov edx, dword [0x4ea1c4]
mov eax, dword [0x4ea1a8]
mov eax, dword [eax + esi*4]
push edx
call fcn.0049ec60
add esp, 4
test eax, eax
jne 0x410ffb
inc esi
cmp esi, dword [0x4ea1ac]
jb 0x411020
jmp 0x4110ae
cmp byte [0x4ea1bd], 0
je 0x4110ec
mov ebx, dword [0x4ea1ac]
test ebx, ebx
je 0x4110aa
mov edi, dword [0x4ea1c4]
mov ebp, dword [0x4ea1a8]
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41109c
test dx, dx
je 0x411098
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41109c
add eax, 4
add ecx, 4
test dx, dx
jne 0x411076
xor eax, eax
jmp 0x4110a1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4110d3
inc esi
cmp esi, ebx
jb 0x411070
mov bl, byte [esp + 0x13]
mov ecx, dword [0x4ea1cc]
cmp dword [0x4ea1c8], ecx
jl 0x4110c6
mov dword [0x4ea190], 5
mov al, bl
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x15c
ret
mov dword [0x4ea190], 3
mov al, byte [esp + 0x13]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x15c
ret
cmp dword [0x4ea1ac], esi
jbe 0x4110ae
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea ebx, [ebx]
mov ecx, dword [0x4ea1a8]
mov edx, dword [ecx + esi*4]
mov eax, dword [0x4ea1c4]
push edx
push eax
call edi
test eax, eax
je 0x410ffb
inc esi
cmp esi, dword [0x4ea1ac]
jb 0x411100
jmp 0x4110ae