Function at 0x412140
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x114
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
mov al, byte [esp + 0x11c]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x412236
push ebx
push ebp
push 0x100
lea edx, [esp + 0x24]
push 0
push edx
call fcn.004961e0
mov ebp, dword [sym.imp.USER32.dll_ToUnicodeEx]
add esp, 0xc
push edi
xor ebx, ebx
push ebx
push 2
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push 0x6e
call ebp
cmp eax, 2
jne 0x41219f
movzx ebx, word [esp + 0x10]
movzx ecx, byte [esp + 0x124]
push edi
push 0
push 2
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push ecx
call ebp
mov dword [esp + 0x18], eax
test eax, eax
jns 0x4121d8
push edi
push 0
push 2
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push 0x6e
call ebp
test bx, bx
je 0x412216
push esi
mov ecx, edi
lea esi, [esp + 0x13]
mov eax, ebx
call fcn.004123c0
mov bl, al
pop esi
test bl, bl
je 0x412216
mov al, byte [esp + 0xf]
lea ecx, [esp + 0x20]
call fcn.00411a90
push edi
push 0
push 2
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
movzx eax, bl
push 0
push eax
call ebp
cmp dword [esp + 0x18], 0
pop ebp
pop ebx
je 0x41222c
movzx eax, word [esp + 8]
pop edi
add esp, 0x114
ret
xor eax, eax
pop edi
add esp, 0x114
ret
push edi
movzx ecx, al
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
pop edi
add esp, 0x114
ret

Function at 0x4123c0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp ax, 0xa
jne 0x4123c9
mov al, 0xd
ret
push ecx
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx eax, ax
mov edx, eax
shr edx, 8
cmp dl, 0xff
jne 0x4123e5
cmp al, 0xff
jne 0x4123e5
xor al, al
ret
test dl, 0x38
jne 0x4123e2
test esi, esi
je 0x412430
mov cl, dl
and cl, 6
cmp cl, 6
jne 0x4123fd
or byte [esi], 8
jmp 0x41241f
test dl, 2
je 0x41240e
mov cl, byte [esi]
test cl, 3
jne 0x41240e
or cl, 1
mov byte [esi], cl
test dl, 4
je 0x41241f
mov cl, byte [esi]
test cl, 0xc
jne 0x41241f
or cl, 4
mov byte [esi], cl
test dl, 1
je 0x412430
mov cl, byte [esi]
test cl, 0x30
jne 0x412430
or cl, 0x10
mov byte [esi], cl
ret

Function at 0x412a60
Capabilities:
Log keystrokes

Disassembly:
movzx ecx, bx
mov eax, ecx
cmp eax, 0x11c
jg 0x412abd
je 0x412aba
sub eax, 0x1d
cmp eax, 0x36
ja case.0x412ace.286
movzx eax, byte [eax + 0x412b64]
jmp dword [eax*4 + 0x412b18]
mov al, 0xa0
ret
mov al, 0xa2
ret
mov al, 0xa4
ret
mov al, 0x6a
ret
mov al, 0x6d
ret
mov al, 0x6b
ret
mov al, 0x2e
ret
mov al, 0xc
ret
mov al, 0x2d
ret
mov al, 0x26
ret
mov al, 0x28
ret
mov al, 0x25
ret
mov al, 0x27
ret
mov al, 0x24
ret
mov al, 0x23
ret
mov al, 0x21
ret
mov al, 0x22
ret
mov al, 0x13
ret
mov al, 0xd
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x412ace.286
movzx edx, byte [eax + 0x412bc0]
jmp dword [edx*4 + 0x412b9c]
mov al, 0xa1
ret
mov al, 0xa3
ret
mov al, 0xa5
ret
mov al, 0x5b
ret
mov al, 0x5c
ret
mov al, 0x90
ret
mov al, 0x6f
ret
mov al, 0x5d
ret
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
test ebx, 0x100
je 0x412b0d
movzx eax, cl
push 1
or eax, 0xe000
push eax
call esi
test eax, eax
jne 0x412b15
movzx ecx, bl
push 1
push ecx
call esi
pop esi
ret