Function at 0x11188c60
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 8]
mov dword [ebp - 0x158], eax
xor eax, eax
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], al
mov dword [ebp - 0x15c], 1
cmp ecx, 0x202
ja 0x111896f8
cmp ecx, 0x200
jae 0x1118971e
lea eax, [ecx - 0x100]
cmp eax, 6
ja case.0x1118970e.518
movzx eax, byte [eax + 0x111897d0]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
jmp dword [eax*4 + 0x111897c4]
mov ecx, dword [ebp + 0x10]
mov ebx, ecx
sar ebx, 0x10
sar ecx, 0x18
and ebx, 0xff
test cl, 1
je 0x11188d6a
mov edx, ebx
and edx, 0x7f
mov dword [ebp - 0x14c], 1
cmp dl, 0x45
jne 0x11188d74
mov dword [ebp - 0x14c], 0
and ecx, 0x80
mov dword [ebp - 0x148], ecx
xor eax, eax
jmp 0x11188d90
movzx edx, byte [edi + eax + 0x30d]
cmp ebx, edx
je 0x11189199
inc eax
cmp eax, 3
jl 0x11188d90
lea eax, [ebx - 0x1d]
cmp eax, 0x1b
ja case.0x11188db9.30
movzx eax, byte [eax + 0x111897ec]
jmp dword [eax*4 + 0x111897d8]
cmp dword [ebp - 0x14c], 0
jne case.0x11188db9.30
mov eax, 1
jmp 0x11188e22
cmp dword [ebp - 0x14c], 0
jne case.0x11188db9.30
mov eax, 2
jmp 0x11188e22
test ecx, ecx
je 0x11188dfb
cmp dword [edi + 0x2fc], 0
je 0x11188dfb
mov dword [edi + 0x2fc], 0
xor ebx, ebx
jmp case.0x11188db9.30
mov eax, 4
jmp 0x11188e22
test ecx, ecx
je 0x11188e1d
cmp dword [edi + 0x2f8], 0
je 0x11188e1d
mov dword [edi + 0x2f8], 0
xor ebx, ebx
jmp case.0x11188db9.30
mov eax, 8
test ecx, ecx
je 0x11188e30
not eax
and dword [edi + 0x2e4], eax
jmp case.0x11188db9.30
or dword [edi + 0x2e4], eax
cmp dword [edi + 0x2e4], 0
je 0x11188e72
mov ecx, dword [ebp - 0x154]
push 0
push 7
push str.Hotkeys
push str.View
call fcn.110bbc00
test eax, eax
je 0x11188e6c
mov ecx, eax
and ecx, dword [edi + 0x2e4]
cmp ecx, eax
je 0x111891b4
mov ecx, dword [ebp - 0x148]
test byte [edi + 0xc4], 2
je 0x111891a1
cmp dword [edi + 0x164], 0
jne 0x11189237
cmp dword [ebp + 0xc], 0x13
jne 0x11188f2b
mov ecx, dword [ebp - 0x154]
push 0
push 0
push str.SendPauseKey
push str.View
call fcn.110bbc00
test eax, eax
jne 0x11188f25
cmp dword [ebp - 0x148], eax
jne 0x11188ecc
xor edx, edx
cmp dword [edi + 0x2e8], edx
sete dl
mov dword [edi + 0x2e8], edx
cmp dword [edi + 0x2e8], 0
je 0x11188edc
xor ebx, ebx
jmp 0x1118907a
push 1
push 0
lea eax, [ebp - 0x140]
push 0xe1
push eax
mov esi, edi
call fcn.111801b0
mov ecx, dword [ebp - 0x148]
push 1
push 0
or ecx, 0x1d
push ecx
lea edx, [ebp - 0x140]
push edx
call fcn.111801b0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
add esp, 0x20
mov dword [ebp - 0x14c], 0
jmp case.0x11188f4b.2
mov ecx, dword [ebp - 0x148]
cmp dword [edi + 0x2e8], 0
jne 0x111893fe
lea eax, [ebx - 1]
cmp eax, 0x6f
ja case.0x11188f4b.2
movzx eax, byte [eax + 0x11189820]
jmp dword [eax*4 + 0x11189808]
test ecx, ecx
jne case.0x11188f4b.2
mov ecx, 0x1d
mov edx, 0x8011
mov eax, edi
call fcn.11175070
mov dword [edi + 0x2fc], 1
jmp case.0x11188f4b.2
test ecx, ecx
jne case.0x11188f4b.2
mov ecx, 0x38
mov edx, 0x8012
mov eax, edi
call fcn.11175070
mov dword [edi + 0x2f8], 1
jmp case.0x11188f4b.2
mov edx, dword [edi + 0x2e4]
and edx, 0xc
cmp dl, 0xc
jne case.0x11188f4b.2
test ecx, ecx
jne case.0x11188f4b.2
push ecx
push ecx
mov ecx, dword [ebp - 0x154]
push str.DisableCtrlAltEsc
push str.View
call fcn.110bbc00
test eax, eax
jne case.0x11188f4b.2
mov ecx, dword [ebp - 0x158]
push 3
lea ebx, [eax + 0x53]
mov eax, dword [ecx]
mov eax, dword [eax + 0x48]
push 2
lea edx, [ebp - 0x150]
push edx
mov dword [ebp - 0x150], 0x43
call eax
jmp 0x1118907a
cmp dword [ebp - 0x14c], 0
je case.0x11188f4b.2
test ecx, ecx
jne case.0x11188f4b.2
mov ecx, 1
mov edx, 0x801b
mov eax, edi
call fcn.11175070
mov edx, ebx
or edx, 0xc000
mov ecx, ebx
mov eax, edi
mov dword [edi + 0x300], 1
call fcn.11175070
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
or eax, 1
mov dword [edi + 0x304], eax
mov dword [edi + 0x308], eax
mov byte [edi + 0x30c], bl
jmp case.0x11188f4b.2
test ecx, ecx
je 0x11189061
xor ebx, ebx
jmp 0x1118907a
mov dword [ebp - 0x148], 1
cmp ebx, 0x45
je 0x111890b1
cmp ebx, 0x3a
je 0x111890b1
cmp ebx, 0x46
je 0x111890b1
cmp dword [edi + 0x2e8], 0
jne 0x111890a5
cmp byte [edi + 0x2ec], 0
jne 0x111890a5
push 1
push 0x105
push 0x100
push 0
lea ecx, [ebp - 0x178]
push ecx
call esi
jmp 0x111890b9
mov dword [ebp - 0x150], 0
jmp 0x111890bf
xor eax, eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
mov eax, dword [ebp - 0x148]
cmp eax, 1
jne 0x11189107
mov ecx, dword [ebp - 0x14c]
push eax
push ecx
lea edx, [ebp - 0x140]
push ebx
push edx
mov esi, edi
call fcn.111801b0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov dword [ebp - 0x148], 0x80
mov eax, dword [ebp - 0x148]
add esp, 0x10
cmp byte [edi + 0x2ec], 0
je 0x11189132
mov eax, dword [ebp + 0xc]
push eax
call fcn.11175110
add esp, 4
test al, al
je 0x1118912c
mov dword [ebp - 0x15c], 0
jmp 0x1118915a
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 0x14c]
push ecx
push edx
or eax, ebx
push eax
lea eax, [ebp - 0x140]
push eax
mov esi, edi
call fcn.111801b0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
add esp, 0x10
cmp dword [ebp - 0x150], 0
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x170]
mov dword [ebp + 0x10], ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], eax
jne case.0x11188d33.256
mov eax, dword [ebp - 0x15c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov byte [edi + eax + 0x30d], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x154]
push 0
push 0
push str.FullScreen
push str.View
mov dword [edi + 0x2e4], 0
call fcn.110bbd40
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0xc02a0001
push 0x10
mov esi, eax
push 0x101
push esi
call edi
push 0xc0360001
push 0x10
push 0x101
push esi
call edi
push 0xc01d0001
push 0x11
push 0x101
push esi
call edi
push 0xc0380001
push 0x12
push 0x101
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0x104
jne 0x111891a1
mov eax, dword [ebp + 0xc]
cmp eax, 0x70
jb 0x11189251
cmp eax, 0x7b
jbe 0x11189267
cmp eax, 0x21
jb 0x1118925b
cmp eax, 0x28
jbe 0x11189267
add eax, 0xffffffd3
cmp eax, 1
ja 0x111891a1
mov dword [ebp + 0xc], 0
cmp dword [edi + 0x2e8], 0
jne 0x111891a1
cmp byte [edi + 0x2ec], 0
je 0x11189511
cmp dword [edi + 0x314], 0
mov byte [ebp - 0x143], 0
mov byte [ebp - 0x142], 0
mov byte [ebp - 0x141], 0
je 0x11189320
cmp dword [edi + 0x310], 0
je 0x11189320
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
test esi, esi
je 0x11189320
mov ecx, dword [ebp + 0xc]
push esi
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx ebx, ax
mov edx, ebx
shr edx, 8
test dl, 6
jne 0x11189320
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp + 0x10]
push esi
push 4
push 0xa
lea ecx, [ebp - 0x18]
push ecx
sar eax, 0x10
lea edx, [ebp - 0x118]
push edx
movzx ecx, al
movzx edx, bl
push ecx
push edx
mov word [ebp - 0x107], 0x8080
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 1
jne 0x11189320
movzx eax, word [ebp - 0x18]
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 0xc]
cmp esi, 0x7f
ja 0x1118943e
cmp dword [edi + 0x310], 0
je 0x111893d5
push esi
call dword [sym.imp.MSVCR100.dll_isalpha]
add esp, 4
test eax, eax
je 0x111893d5
test byte [edi + 0xc4], 2
je 0x111893d2
mov ecx, dword [edi + 8]
push 0
push 0
push str.AutoClip
push str.View
call fcn.110bbc00
test eax, eax
je 0x111893d2
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
call eax
test dword [eax + 4], 0x4000
je 0x111893d2
mov ecx, dword [edi + 0x10]
push 0
push str.DisableClipBoard
call fcn.110c51b0
test eax, eax
je 0x111893d2
mov ecx, dword [edi + 0x10]
push 0x59
call fcn.110c6fe0
test al, al
jne 0x111893d2
mov ebx, dword [sym.imp.MSVCR100.dll_tolower]
push esi
call ebx
cmp eax, 0x78
push esi
sete byte [ebp - 0x141]
call ebx
cmp eax, 0x63
push esi
sete byte [ebp - 0x142]
call ebx
add esp, 0xc
cmp eax, 0x76
sete byte [ebp - 0x143]
and esi, 0x1f
lea ecx, [ebp - 0x140]
push ecx
push 0xff
call fcn.111752b0
lea edx, [ebp - 0x140]
push edx
and esi, 0xff
push esi
call fcn.111752b0
add esp, 0x10
jmp 0x1118947d
test ecx, ecx
jne 0x11189425
cmp ebx, 0xf
je 0x11189425
mov eax, 1
mov dword [edi + 0x2e8], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi + 0x2e8], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x140]
push eax
push 0xfe
call fcn.111752b0
mov edx, esi
lea ecx, [ebp - 0x140]
shr edx, 8
push ecx
and edx, 0xff
push edx
call fcn.111752b0
lea eax, [ebp - 0x140]
push eax
and esi, 0xff
push esi
call fcn.111752b0
add esp, 0x18
test byte [edi + 0xc4], 2
je 0x111894fb
cmp byte [ebp - 0x143], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x111894b8
push 0
push 0
push 6
call fcn.111bb9f0
add esp, 0xc
test eax, eax
jne 0x111894b8
mov ecx, dword [edi + 0x68]
push eax
push 0x1045
push 0x111
push ecx
call esi
mov eax, dword [edi + 0x10]
lea edx, [ebp - 0x140]
push edx
push eax
push edi
call fcn.111752d0
add esp, 0xc
cmp byte [ebp - 0x142], 0
jne 0x111894de
cmp byte [ebp - 0x141], 0
je 0x111894fb
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [edi + 0x68]
push 0
push 0x1046
push 0x111
push ecx
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x164], 0
jne 0x11189530
test dword [ebp + 0x10], 0xff0000
jne case.0x1118970e.518
jmp 0x11189530
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
jmp 0x11189540
push 1
push 0x101
push 0x100
push 0
lea edx, [ebp - 0x178]
push edx
call esi
test eax, eax
jne 0x111895a9
push 1
push 0x105
push 0x104
push eax
lea eax, [ebp - 0x178]
push eax
call esi
test eax, eax
jne 0x111895a9
push 1
push 0x103
push 0x103
push eax
lea ecx, [ebp - 0x178]
push ecx
call esi
test eax, eax
jne 0x111895a9
push 1
push 0x107
push 0x107
push eax
lea edx, [ebp - 0x178]
push edx
call esi
test eax, eax
je 0x111895b4
lea eax, [ebp - 0x178]
push eax
call ebx
jmp 0x11189540
push 1
push 0x102
push 0x102
push 0
lea ecx, [ebp - 0x178]
push ecx
call esi
test eax, eax
jne 0x111895e9
push 1
push 0x106
push 0x106
push eax
lea edx, [ebp - 0x178]
push edx
call esi
test eax, eax
je 0x11189609
cmp dword [edi + 0x164], 0
mov ebx, 1
jne 0x1118960b
test dword [ebp - 0x16c], 0xff0000
jne 0x11189530
jmp 0x1118960b
xor ebx, ebx
mov ecx, dword [ebp - 0x158]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
cmp dword [edi + 0x164], 0
je 0x11189642
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
push edi
lea esi, [ebp - 0x140]
call fcn.11175240
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
add esp, 8
jmp 0x111896c7
test dword [ebp - 0x16c], 0xff0000
jne 0x111896c7
mov ecx, dword [edi + 8]
push 0
push 0
push str.DisableWMCHAR
push str.View
call fcn.110bbc00
test eax, eax
jne 0x111896c7
lea eax, [ebp - 0x140]
push eax
push 0xff
call fcn.111752b0
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x140]
push ecx
and eax, 0xff
push eax
call fcn.111752b0
add esp, 0x10
test ebx, ebx
je 0x1118969f
cmp word [ebp - 0x13e], 0x10
jb 0x111896c7
test byte [edi + 0xc4], 2
je 0x111896be
mov eax, dword [edi + 0x10]
lea edx, [ebp - 0x140]
push edx
push eax
push edi
call fcn.111752d0
add esp, 0xc
jmp 0x111896c7
xor ecx, ecx
mov word [ebp - 0x13e], cx
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x16c]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
test ebx, ebx
jne 0x11189530
mov eax, dword [ebp - 0x15c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
lea eax, [ecx - 0x204]
cmp eax, 0x3c
ja case.0x1118970e.518
movzx ecx, byte [eax + 0x1118989c]
jmp dword [ecx*4 + 0x11189890]
mov ecx, dword [ebp + 8]
cmp ecx, 0x200
je 0x1118972d
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ecx, dword [edi + 0x6c]
push 1
push 0x20e
push 0x200
push ecx
lea edx, [ebp - 0x178]
push edx
call esi
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push 1
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
push edx
push edi
call fcn.11188890
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebp - 0x170]
add esp, 0x14
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
test ebx, ebx
jne 0x11189733
mov eax, dword [ebp - 0x15c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
mov ecx, edi
call fcn.1117a9e0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x15c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret