Function at 0x489540
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov eax, dword [0x7fec58]
test eax, eax
jne 0x489588
push 0
mov dword [0x7fec58], 1
call dword [sym.imp.USER32.DLL_GetKeyboardLayout]
and eax, 0x3ff
cmp eax, 7
je 0x489579
cmp eax, 0xc
je 0x489579
cmp eax, 0x13
je 0x489579
cmp eax, 0xa
je 0x489579
cmp eax, 0x10
jne 0x489588
mov dword [0x558918], 0
jmp 0x489760
mov eax, dword [0x558918]
test eax, eax
je 0x489583
jmp 0x4895a0
xor eax, eax
mov al, byte [esp + 6]
cmp eax, 0x7f
jle 0x4895ae
xor eax, eax
ret
mov ecx, dword [esp + 4]
xor edx, edx
mov dl, byte [eax + 0x558898]
shr ecx, 0x18
and ecx, 1
mov eax, edx
test ecx, ecx
jne 0x489618
lea ecx, [eax - 0x84]
cmp ecx, 0xf
ja case.0x48962b.19
jmp dword [ecx*4 + 0x489658]
mov eax, 0xa3
ret
mov eax, 0xa4
ret
mov eax, 0xa5
ret
mov eax, 0xa6
ret
mov eax, 0xa8
ret
mov eax, 0xa9
ret
mov eax, 0xaa
ret
mov eax, 0xab
ret
mov eax, 0xad
ret
mov eax, 0xae
ret
lea ecx, [eax - 0xd]
cmp ecx, 0xa5
ja case.0x48962b.19
xor edx, edx
mov dl, byte [ecx + 0x4896b4]
jmp dword [edx*4 + 0x489698]
mov eax, 0xb2
ret
mov eax, 0xac
ret
mov eax, 0xaf
ret
mov eax, 0xb1
ret
mov eax, 0x8c
ret
mov eax, 0x8b
ret
push esi
mov esi, dword [esp + 8]
sar esi, 0x10
push edi
mov edi, dword [sym.imp.USER32.DLL_MapVirtualKeyA]
and esi, 0x7f
push 1
push esi
call edi
lea ecx, [eax - 8]
cmp ecx, 0x9b
ja case.0x48978e.58
xor edx, edx
mov dl, byte [ecx + 0x489a40]
jmp dword [edx*4 + 0x489974]
pop edi
mov eax, 0xd
pop esi
ret
pop edi
mov eax, 0x7f
pop esi
ret
pop edi
mov eax, 0x89
pop esi
ret
pop edi
mov eax, 0x8c
pop esi
ret
pop edi
mov eax, 0x8a
pop esi
ret
pop edi
mov eax, 0x8d
pop esi
ret
pop edi
mov eax, 0x88
pop esi
ret
pop edi
mov eax, 0x81
pop esi
ret
pop edi
mov eax, 0x84
pop esi
ret
pop edi
mov eax, 0x85
pop esi
ret
pop edi
mov eax, 0x86
pop esi
ret
pop edi
mov eax, 0x87
pop esi
ret
pop edi
mov eax, 0x92
pop esi
ret
pop edi
mov eax, 0x91
pop esi
ret
pop edi
mov eax, 0x90
pop esi
ret
pop edi
mov eax, 0x93
pop esi
ret
pop edi
mov eax, 0x8e
pop esi
ret
pop edi
mov eax, 0x8f
pop esi
ret
pop edi
mov eax, 0x94
pop esi
ret
pop edi
mov eax, 0x95
pop esi
ret
pop edi
mov eax, 0x96
pop esi
ret
pop edi
mov eax, 0x97
pop esi
ret
pop edi
mov eax, 0x98
pop esi
ret
pop edi
mov eax, 0x99
pop esi
ret
pop edi
mov eax, 0x9a
pop esi
ret
pop edi
mov eax, 0x9b
pop esi
ret
pop edi
mov eax, 0x9c
pop esi
ret
pop edi
mov eax, 0x9d
pop esi
ret
pop edi
mov eax, 0x9e
pop esi
ret
pop edi
mov eax, 0x9f
pop esi
ret
pop edi
mov eax, 0x83
pop esi
ret
pop edi
mov eax, 0xad
pop esi
ret
pop edi
mov eax, 0xa9
pop esi
ret
pop edi
mov eax, 0xaa
pop esi
ret
pop edi
mov eax, 0xab
pop esi
ret
pop edi
mov eax, 0xa6
pop esi
ret
pop edi
mov eax, 0xa7
pop esi
ret
pop edi
mov eax, 0xa8
pop esi
ret
pop edi
mov eax, 0xa3
pop esi
ret
pop edi
mov eax, 0xa4
pop esi
ret
pop edi
mov eax, 0xa5
pop esi
ret
pop edi
mov eax, 0xb3
pop esi
ret
pop edi
mov eax, 0xb1
pop esi
ret
pop edi
mov eax, 0xb4
pop esi
ret
pop edi
mov eax, 0xb0
pop esi
ret
pop edi
mov eax, 0xae
pop esi
ret
pop edi
mov eax, 0xaf
pop esi
ret
pop edi
mov eax, 0xec
pop esi
ret
pop edi
mov eax, 0xed
pop esi
ret
pop edi
mov eax, 0xee
pop esi
ret
push 2
push eax
call edi
mov edi, eax
mov eax, dword [0x56a90c]
and edi, 0xff
cmp eax, 1
jle 0x489949
push 1
push edi
call fcn.0051c6f8
add esp, 8
jmp 0x489954
mov eax, dword [str.________________________________H]
mov al, byte [eax + edi*2]
and eax, 1
test eax, eax
je 0x489963
push edi
call fcn.0051bd27
add esp, 4
mov edi, eax
cmp esi, 0x29
jne 0x48996d
mov edi, 0x60
mov eax, edi
pop edi
pop esi
ret