Function at 0x406b60
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x4c4924]
sub esp, 0x120
push ebx
mov bl, byte [esp + 0x12c]
push ebp
mov ebp, dword [0x4c600c]
push edi
mov di, word [esp + 0x138]
cmp ebp, 1
jne 0x406ba6
cmp byte [0x4c6038], 0
jne 0x406ba6
movzx eax, bl
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + ecx], 0
mov byte [esp + 0xe], 0
je 0x406bab
mov byte [esp + 0xe], 1
cmp byte [esp + 0x13c], 0
je 0x406bd9
movzx eax, bl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ecx + 4], 0
mov al, 1
jne 0x407562
mov al, byte [esp + 0xe]
pop edi
pop ebp
pop ebx
add esp, 0x120
ret
cmp dword [0x4c58ec], 0
je 0x406bf1
test dl, dl
jne 0x406bf1
mov byte [esp + 0xf], 1
cmp byte [esp + 0xe], dl
jne 0x406bf6
mov byte [esp + 0xf], 0
mov al, byte [0x4c3ee5]
push esi
cmp ebp, 1
jne 0x406cc8
cmp byte [0x4c6036], 0
je 0x406c16
test dl, dl
jne 0x406cc8
mov edx, dword [0x4c6010]
mov esi, dword [0x4c6014]
movzx ecx, bl
mov cl, byte [ecx + edx]
mov byte [esp + 0x14], 1
test cl, cl
jne 0x406c3b
movzx ecx, di
mov cl, byte [ecx + esi]
test cl, cl
je 0x406ca7
mov dl, cl
shr cl, 2
shr dl, 1
and cl, 1
and dl, 1
je 0x406ccf
test cl, cl
jne 0x406c5e
test al, 0x30
jne 0x406c5e
test cl, cl
je 0x406ca7
test al, 0x30
jne 0x406ca7
movzx ecx, di
mov ebp, 4
mov dword [0x4c600c], ebp
cmp byte [ecx + esi], 0
mov byte [0x4c6018], bl
setne cl
mov byte [0x4c601c], cl
mov word [0x4c601a], di
test dl, dl
je 0x406c95
mov byte [0x4c601d], 1
test al, 0x30
jne 0x406c9c
mov byte [0x4c601d], 0
cmp byte [esp + 0x13], 0
je 0x40755d
movzx ebx, byte [esp + 0x138]
lea ecx, [ebx - 0x21]
cmp ecx, 0x84
ja case.0x406cc1.41
movzx edx, byte [ecx + 0x407578]
jmp dword [edx*4 + 0x40756c]
mov byte [esp + 0x14], 0
jmp 0x406ca7
test cl, cl
je 0x406c5e
jmp 0x406c5a
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x120
ret
cmp byte [esp + 0x13], 0
je case.0x406cc1.41
mov ecx, dword [0x4c2c3c]
test ecx, ecx
je 0x406d0a
xor ecx, ecx
mov word [0x4c2c40], cx
mov dword [0x4c2c3c], ecx
jmp 0x406d0a
mov ecx, dword [0x4c2c3c]
test al, al
je 0x406d34
cmp ebp, 1
jne 0x406d1c
cmp byte [0x4c6037], 0
jne 0x406d34
cmp al, 0x10
je 0x406d34
cmp al, 0x20
je 0x406d34
test al, 0xc
je 0x40755d
test al, 3
je 0x40755d
cmp byte [esp + 0x138], 8
jne 0x406daf
test al, al
jne 0x406daf
cmp byte [esp + 0x14], al
je 0x406d70
cmp ebp, 1
jne 0x406d70
cmp byte [0x4c6034], al
je 0x406d70
mov eax, dword [0x4c6040]
test eax, eax
je 0x406d70
mov esi, dword [0x4c603c]
dec eax
xor edx, edx
mov dword [0x4c6040], eax
mov word [esi + eax*2], dx
cmp byte [esp + 0x13], 0
je 0x406d8c
test ecx, ecx
je 0x406d8c
dec ecx
xor eax, eax
mov dword [0x4c2c3c], ecx
mov word [ecx*2 + 0x4c2c40], ax
cmp byte [0x4c6eb4], 0
je 0x40755d
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
mov byte [0x4c6eb4], 0
pop ebx
add esp, 0x120
ret
mov ecx, 0x40
mov esi, 0x4c3f08
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
call fcn.004114c0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x406ddb
or byte [esp + 0x44], 1
jmp 0x406de0
and byte [esp + 0x44], 0xfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
test ebp, ebp
je 0x406df7
push 0
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x406df9
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, dword [sym.imp.USER32.dll_ToUnicodeEx]
xor ecx, ecx
cmp dword [0x4c4074], ecx
mov esi, eax
setne cl
push esi
lea edx, [esp + 0x1c]
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], esi
push ecx
mov ecx, dword [esp + 0x13c]
push 2
push edx
mov edx, dword [ecx + 4]
push eax
push edx
push ebx
call edi
mov dword [esp + 0x2c], eax
test eax, eax
je 0x40755d
cmp byte [0x4c6eb4], 0
mov cl, byte [esp + 0x138]
je 0x406e5e
cmp cl, 9
je 0x406e5e
mov byte [esp + 0x17], 1
cmp cl, 0x1b
jne 0x406e63
mov byte [esp + 0x17], 0
test eax, eax
jns 0x406ee2
cmp byte [esp + 0x12], 0
je 0x40755d
mov ax, word [esp + 0x13c]
mov word [0x4c6eb8], ax
mov al, byte [0x4c3ee5]
test al, 0x30
mov byte [0x4c6eb4], cl
setne cl
mov byte [0x4c6eba], cl
test al, 3
je 0x406ea5
mov byte [0x4c6ebb], 1
test al, 0xc
jne 0x406eac
mov byte [0x4c6ebb], 0
xor edx, edx
cmp dword [0x4c4074], edx
push esi
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x13c]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
push eax
push ebx
call edi
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x120
ret
test byte [0x4c3ee5], 3
jne 0x406f12
mov eax, 0xd
cmp word [esp + 0x18], ax
jne 0x406f01
mov ecx, 0xa
mov word [esp + 0x18], cx
cmp word [esp + 0x1a], ax
jne 0x406f12
mov edx, 0xa
mov word [esp + 0x1a], dx
cmp byte [esp + 0x13], 0
mov byte [esp + 0x15], 0
je 0x4072e6
cmp ebp, dword [0x4c2c38]
je 0x406f3c
xor eax, eax
mov dword [0x4c2c38], ebp
mov word [0x4c2c40], ax
xor ecx, ecx
jmp 0x406f87
mov ecx, dword [0x4c2c3c]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x406f87
mov eax, 0x4c2c9a
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406f56
sub eax, edx
sar eax, 1
mov dword [0x4c2c3c], eax
lea eax, [eax + eax + 2]
push eax
push 0x4c2c9a
push 0x4c2c40
call fcn.0048b1f0
mov ecx, dword [0x4c2c3c]
add esp, 0xc
mov dx, word [esp + 0x18]
mov word [ecx*2 + 0x4c2c40], dx
inc ecx
cmp dword [esp + 0x2c], 1
mov dword [0x4c2c3c], ecx
jle 0x406fb6
mov ax, word [esp + 0x1a]
mov word [ecx*2 + 0x4c2c40], ax
inc ecx
mov dword [0x4c2c3c], ecx
xor edx, edx
mov word [ecx*2 + 0x4c2c40], dx
test ecx, ecx
je 0x4072e6
mov dword [esp + 0x24], edx
cmp dword [0x4c58f0], edx
jbe 0x4072e6
jmp 0x406fe0
mov eax, dword [0x4c58ec]
mov edx, dword [esp + 0x24]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x27], 0
jne 0x407101
cmp byte [ebp + 0x2f], 0
je 0x407035
movzx eax, byte [ebp + 0x26]
cmp ecx, eax
jle 0x407101
movzx eax, word [ecx*2 + 0x4c2c3e]
push eax
push 0x4c0410
call fcn.0048b551
add esp, 8
test eax, eax
je 0x4070fb
mov ecx, dword [0x4c2c3c]
lea edi, [ecx*2 + 0x4c2c3c]
jmp 0x407048
movzx edx, byte [ebp + 0x26]
cmp ecx, edx
jl 0x407101
lea edi, [ecx*2 + 0x4c2c3e]
cmp byte [ebp + 0x2a], 0
movzx edx, byte [ebp + 0x26]
mov eax, dword [ebp + 4]
lea esi, [eax + edx*2 - 2]
je 0x407074
cmp esi, eax
jb 0x4070b0
lea ecx, [ecx]
mov dx, word [edi]
cmp dx, word [esi]
jne 0x4070b0
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x407060
jmp 0x4070b0
cmp esi, eax
jb 0x4070b0
jmp 0x407080
movzx eax, word [esi]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
push eax
call ebx
movzx ecx, word [edi]
push ecx
mov dword [esp + 0x24], eax
call ebx
mov ecx, dword [esp + 0x20]
cmp ax, cx
jne 0x4070aa
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 4]
jae 0x407080
mov ecx, dword [0x4c2c3c]
cmp esi, dword [ebp + 4]
jae 0x407101
cmp byte [ebp + 0x30], 0
jne 0x4070d1
cmp edi, 0x4c2c40
jb 0x4070d1
movzx edx, word [edi]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x4070fb
mov eax, dword [ebp]
test eax, eax
je 0x4070dc
mov eax, dword [eax]
jmp 0x4070e1
mov eax, 0x49e828
mov edx, dword [ebp + 0xc]
mov bl, byte [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x10]
call fcn.00409390
add esp, 8
test eax, eax
jne 0x40711b
mov ecx, dword [0x4c2c3c]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [0x4c58f0]
jb 0x406fe0
jmp 0x4072e6
movzx edx, byte [ebp + 0x25]
mov ecx, dword [esp + 0x144]
mov eax, dword [esp + 0x134]
mov eax, dword [eax + 0x10]
add ecx, 4
push edx
call fcn.00409de0
add esp, 4
test al, al
je 0x4072e6
xor edi, edi
cmp byte [ebp + 0x2b], 0
je 0x40722d
cmp byte [ebp + 0x2f], 0
mov ebx, dword [0x4c2c3c]
lea ebx, [ebx*2 + 0x4c2c40]
je 0x407166
sub ebx, 2
movzx ecx, byte [ebp + 0x26]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov dword [esp + 0x20], edi
mov byte [esp + 0x16], 0
mov byte [esp + 0x13], 0
cmp esi, ebx
jae 0x4071d6
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
jmp 0x407190
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x4071a8
movzx eax, word [esi]
push eax
call edi
test eax, eax
je 0x4071c7
cmp byte [esp + 0x16], 0
jne 0x4071c3
movzx ecx, word [esi]
push ecx
mov byte [esp + 0x1a], 1
call edi
test eax, eax
je 0x4071c3
mov byte [esp + 0x13], 1
inc dword [esp + 0x20]
add esi, 2
cmp esi, ebx
jb 0x407190
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4071da
xor edi, edi
jmp 0x40722d
cmp eax, 1
jne 0x4071ed
movzx edi, byte [esp + 0x13]
neg edi
sbb edi, edi
and edi, 2
jmp 0x40722d
cmp byte [esp + 0x13], 0
jne 0x4071f8
xor edi, edi
jmp 0x40722d
movzx edx, byte [ebp + 0x26]
add edx, edx
mov esi, ebx
sub esi, edx
mov edi, 2
cmp esi, ebx
jae 0x407226
jmp 0x407210
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x407224
add esi, edi
cmp esi, ebx
jb 0x407210
cmp esi, ebx
jne 0x40722d
mov edi, 1
mov dl, byte [ebp + 0x2c]
test dl, dl
jne 0x407239
cmp byte [ebp + 0x2d], dl
je 0x407243
mov byte [esp + 0x12], 0
mov byte [esp + 0x15], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x148]
mov dword [ecx], eax
mov al, byte [ebp + 0x2f]
test al, al
je 0x407267
mov ecx, dword [0x4c2c3c]
movzx ecx, word [ecx*2 + 0x4c2c3e]
jmp 0x407269
xor ecx, ecx
movzx esi, di
movzx ecx, cx
shl esi, 0x10
or esi, ecx
mov ecx, dword [esp + 0x14c]
mov dword [ecx], esi
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp word [esi], cx
je 0x4072b3
test al, al
je 0x4072ab
mov edx, dword [0x4c2c3c]
mov ax, word [edx*2 + 0x4c2c3e]
mov word [0x4c2c40], ax
mov dword [0x4c2c3c], 1
jmp 0x4072cb
mov dword [0x4c2c3c], ecx
jmp 0x4072cb
test dl, dl
je 0x4072cb
movzx edx, byte [ebp + 0x26]
sub dword [0x4c2c3c], edx
test al, al
je 0x4072cb
dec dword [0x4c2c3c]
cmp byte [ebp + 0x31], cl
je 0x4072d6
mov dword [0x4c2c3c], ecx
mov ecx, dword [0x4c2c3c]
xor eax, eax
mov word [ecx*2 + 0x4c2c40], ax
cmp byte [esp + 0x17], 0
je 0x407359
cmp byte [esp + 0x12], 0
mov bl, byte [0x4c6eb4]
mov byte [0x4c6eb4], 0
je 0x407359
push 0x100
lea edx, [esp + 0x34]
push 0
push edx
call fcn.00493490
mov al, byte [0x4c6eba]
mov cl, byte [0x4c6ebb]
add esp, 0xc
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x30]
call fcn.004114c0
mov edx, dword [esp + 0x28]
push edx
movzx edx, word [0x4c6eb8]
push 0
push 2
lea eax, [esp + 0x34]
push eax
push ecx
movzx eax, bl
push edx
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp byte [esp + 0x14], 0
je 0x40755d
mov ebx, 1
cmp dword [0x4c600c], ebx
jne 0x40755d
cmp byte [esp + 0x15], 0
jne 0x40755d
mov eax, dword [0x4c6040]
cmp eax, dword [0x4c6044]
jge 0x4073b4
mov ecx, dword [0x4c603c]
mov dx, word [esp + 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [0x4c6040]
mov edx, dword [0x4c603c]
add eax, ebx
xor ecx, ecx
mov dword [0x4c6040], eax
mov word [edx + eax*2], cx
cmp dword [esp + 0x2c], ebx
jle 0x4073ee
mov eax, dword [0x4c6040]
cmp eax, dword [0x4c6044]
jge 0x4073ee
mov ecx, dword [0x4c603c]
mov dx, word [esp + 0x1a]
mov word [ecx + eax*2], dx
mov eax, dword [0x4c6040]
mov edx, dword [0x4c603c]
add eax, ebx
xor ecx, ecx
mov dword [0x4c6040], eax
mov word [edx + eax*2], cx
mov edi, dword [0x4c6024]
test edi, edi
jne 0x407408
mov eax, dword [0x4c6044]
cmp dword [0x4c6040], eax
jmp 0x407551
xor esi, esi
cmp byte [0x4c6039], 0
je 0x4074aa
cmp byte [0x4c6035], 0
je 0x407475
test edi, edi
je 0x407545
jmp 0x407430
mov ecx, dword [0x4c6020]
mov eax, dword [ecx + esi*4]
mov edx, dword [0x4c603c]
push eax
push edx
call fcn.0048b578
add esp, 8
test eax, eax
jne 0x40745c
add esi, ebx
cmp esi, dword [0x4c6024]
jb 0x407430
jmp 0x407545
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
mov dword [0x4c600c], 3
pop ebx
add esp, 0x120
ret
test edi, edi
je 0x407545
lea ecx, [ecx]
mov eax, dword [0x4c603c]
mov ecx, dword [0x4c6020]
push eax
mov eax, dword [ecx + esi*4]
call fcn.00471dc0
add esp, 4
test eax, eax
jne 0x40745c
add esi, ebx
cmp esi, dword [0x4c6024]
jb 0x407480
jmp 0x407545
cmp byte [0x4c6035], 0
je 0x40750a
test edi, edi
je 0x407545
mov ebx, dword [0x4c603c]
mov ebp, dword [0x4c6020]
mov ecx, dword [ebp + esi*4]
mov eax, ebx
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4074f6
test dx, dx
je 0x4074f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4074f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4074d0
xor eax, eax
jmp 0x4074fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40745c
inc esi
cmp esi, edi
jb 0x4074c7
jmp 0x407545
test edi, edi
je 0x407545
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x407520
mov edx, dword [0x4c6020]
mov eax, dword [edx + esi*4]
mov ecx, dword [0x4c603c]
push eax
push ecx
call edi
test eax, eax
je 0x40745c
add esi, ebx
cmp esi, dword [0x4c6024]
jb 0x407520
mov edx, dword [0x4c6044]
cmp dword [0x4c6040], edx
jl 0x40755d
mov dword [0x4c600c], 5
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x120
ret