Function at 0x406cf0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov edx, dword [0x4c8f44]
sub esp, 0x15c
push ebx
push ebp
mov ebp, dword [0x4ca640]
push edi
mov di, word [esp + 0x174]
cmp ebp, 1
jne 0x406d37
cmp byte [0x4ca670], 0
jne 0x406d37
movzx ecx, byte [esp + 0x170]
lea ecx, [ecx + ecx*8]
shl ecx, 5
cmp dword [ecx + edx], 0
jne 0x406d37
xor bl, bl
mov byte [esp + 0xf], bl
jmp 0x406d40
mov byte [esp + 0xf], 1
mov bl, byte [esp + 0xf]
cmp byte [esp + 0x178], 0
je 0x406d71
movzx ecx, byte [esp + 0x170]
lea eax, [ecx + ecx*8]
shl eax, 5
cmp byte [eax + edx + 4], 0
mov al, 1
jne 0x407819
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x15c
ret
cmp dword [0x4c9f0c], 0
je 0x406d87
test al, al
jne 0x406d87
mov byte [esp + 0x10], 1
test bl, bl
jne 0x406d8c
mov byte [esp + 0x10], 0
mov bl, byte [0x4c8505]
push esi
cmp ebp, 1
jne 0x406e8e
cmp byte [0x4ca66e], 0
je 0x406dad
test al, al
jne 0x406e8e
mov al, byte [esp + 0x174]
mov byte [esp + 0x15], 1
cmp al, 0xe7
je 0x406e67
mov edx, dword [0x4ca644]
mov esi, dword [0x4ca648]
movzx ecx, al
mov cl, byte [ecx + edx]
test cl, cl
jne 0x406de5
movzx eax, di
mov cl, byte [eax + esi]
test cl, cl
je 0x406e67
mov dl, cl
shr cl, 2
shr dl, 1
and cl, 1
and dl, 1
je 0x406e95
test cl, cl
jne 0x406e0a
test bl, 0x30
jne 0x406e0a
test cl, cl
je 0x406e67
test bl, 0x30
jne 0x406e67
movzx ecx, di
mov ebp, 4
mov dword [0x4ca640], ebp
cmp byte [ecx + esi], 0
mov cl, byte [esp + 0x174]
setne al
mov byte [0x4ca656], al
xor eax, eax
mov byte [0x4ca650], cl
mov word [0x4ca652], di
mov word [0x4ca654], ax
test dl, dl
je 0x406e50
mov byte [0x4ca657], 1
test bl, 0x30
jne 0x406e55
mov byte [0x4ca657], al
cmp byte [esp + 0x14], al
jne 0x406e67
cmp byte [0x4cb354], al
je 0x40782d
mov al, byte [esp + 0x174]
movzx ecx, al
mov dword [esp + 0x24], ecx
add ecx, 0xffffffdf
cmp ecx, 0x84
ja case.0x406e87.41
movzx ecx, byte [ecx + 0x407884]
jmp dword [ecx*4 + 0x407878]
mov byte [esp + 0x15], 0
jmp 0x406e67
test cl, cl
je 0x406e0a
jmp 0x406e05
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret
cmp byte [esp + 0x14], 0
je case.0x406e87.41
mov edx, dword [0x4c7254]
test edx, edx
je 0x406ed7
xor edx, edx
mov word [0x4c7258], dx
mov dword [0x4c7254], edx
jmp 0x406ed7
mov edx, dword [0x4c7254]
test bl, bl
je 0x406f0a
cmp ebp, 1
jne 0x406ee9
cmp byte [0x4ca66f], 0
jne 0x406f0a
cmp bl, 0x10
je 0x406f0a
cmp bl, 0x20
je 0x406f0a
cmp bl, 0x30
je 0x406f0a
test bl, 0xc
je 0x40782d
test bl, 3
je 0x40782d
cmp al, 8
jne 0x406f7d
test bl, bl
jne 0x406f7d
cmp byte [esp + 0x15], bl
je 0x406f42
cmp ebp, 1
jne 0x406f42
cmp byte [0x4ca66c], bl
je 0x406f42
mov ecx, dword [0x4ca678]
test ecx, ecx
je 0x406f42
mov esi, dword [0x4ca674]
dec ecx
xor eax, eax
mov dword [0x4ca678], ecx
mov word [esi + ecx*2], ax
cmp byte [esp + 0x14], 0
je 0x406f5e
test edx, edx
je 0x406f5e
dec edx
xor ecx, ecx
mov dword [0x4c7254], edx
mov word [edx*2 + 0x4c7258], cx
cmp byte [0x4cb354], 0
je 0x406f6e
mov byte [0x4cb354], 0
mov al, byte [esp + 0x13]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x15c
ret
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, eax
lea ebx, [esp + 0x20]
mov dword [esp + 0x20], eax
call fcn.004124e0
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebp, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], ebp
cmp dword [0x4cb360], eax
je 0x406fdf
push 0x1c
lea edx, [esp + 0x138]
push edx
push eax
mov dword [0x4cb360], eax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0x134]
push str.ApplicationFrameWindow
push eax
call fcn.0048e489
add esp, 8
test eax, eax
sete byte [0x4cb35c]
mov bl, byte [0x4cb354]
mov ecx, 0x40
mov esi, 0x4c8528
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_ToUnicodeEx]
test bl, bl
je 0x40707c
cmp byte [0x4cb35c], 0
je 0x40707c
cmp byte [esp + 0x174], 0xe7
je 0x40707c
mov al, byte [0x4cb35a]
mov cl, byte [0x4cb35b]
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x34]
call fcn.00412050
push ebp
push 0
push 2
lea edx, [esp + 0x24]
push edx
mov eax, ecx
movzx ecx, word [0x4cb358]
push eax
movzx edx, bl
push ecx
push edx
call esi
test eax, eax
jle 0x407075
movzx edx, word [0x4cb358]
push ebp
push 0
push 2
lea eax, [esp + 0x24]
push eax
movzx eax, byte [0x4cb354]
lea ecx, [esp + 0x44]
push ecx
push edx
push eax
call esi
mov byte [0x4cb354], 0
mov al, byte [0x4c8505]
lea ecx, [esp + 0x34]
call fcn.00412050
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x40709d
or byte [esp + 0x48], 1
jmp 0x4070a2
and byte [esp + 0x48], 0xfe
cmp byte [esp + 0x174], 0xe7
jne 0x4070c4
mov cx, word [esp + 0x178]
mov edi, 1
mov dword [esp + 0x30], edi
mov word [esp + 0x18], cx
jmp 0x4070fd
xor edx, edx
cmp dword [0x4c8698], edx
push ebp
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x178]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x38]
push eax
push ecx
call esi
mov edi, eax
mov dword [esp + 0x30], edi
test edi, edi
je 0x40782d
cmp byte [0x4cb354], 0
setne byte [esp + 0x2b]
test edi, edi
jns 0x407196
mov bl, byte [esp + 0x13]
test bl, bl
je 0x407816
mov ax, word [esp + 0x178]
mov dl, byte [esp + 0x174]
mov word [0x4cb358], ax
mov al, byte [0x4c8505]
test al, 0x30
setne cl
mov byte [0x4cb354], dl
mov byte [0x4cb35a], cl
test al, 3
je 0x407157
mov byte [0x4cb35b], 1
test al, 0xc
jne 0x40715e
mov byte [0x4cb35b], 0
xor edx, edx
cmp dword [0x4c8698], edx
push ebp
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x178]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x38]
push eax
push ecx
call esi
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x15c
ret
test byte [0x4c8505], 3
jne 0x4071c6
mov eax, 0xd
cmp word [esp + 0x18], ax
jne 0x4071b5
mov edx, 0xa
mov word [esp + 0x18], dx
cmp word [esp + 0x1a], ax
jne 0x4071c6
mov eax, 0xa
mov word [esp + 0x1a], ax
cmp byte [esp + 0x14], 0
mov byte [esp + 0x16], 0
je 0x4073d9
mov eax, dword [esp + 0x20]
cmp eax, dword [0x4c7250]
je 0x4071f2
xor ecx, ecx
mov dword [0x4c7250], eax
mov word [0x4c7258], cx
jmp 0x407241
mov ecx, dword [0x4c7254]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x407241
mov eax, 0x4c72b2
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407210
sub eax, edx
sar eax, 1
mov dword [0x4c7254], eax
lea eax, [eax + eax + 2]
push eax
push 0x4c72b2
push 0x4c7258
call fcn.0048ef00
mov ecx, dword [0x4c7254]
add esp, 0xc
mov dx, word [esp + 0x18]
mov word [ecx*2 + 0x4c7258], dx
inc ecx
mov dword [0x4c7254], ecx
cmp edi, 1
jle 0x40726e
mov ax, word [esp + 0x1a]
mov word [ecx*2 + 0x4c7258], ax
inc ecx
mov dword [0x4c7254], ecx
xor edx, edx
mov word [ecx*2 + 0x4c7258], dx
test ecx, ecx
je 0x4073d9
mov dword [esp + 0x20], edx
cmp dword [0x4c9f10], edx
jbe 0x4073d9
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
jmp 0x4072a0
mov eax, dword [0x4c9f0c]
mov edx, dword [esp + 0x20]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x23], 0
jne 0x4073b6
cmp byte [ebp + 0x2a], 0
je 0x4072f5
movzx eax, byte [ebp + 0x22]
cmp ecx, eax
jle 0x4073b6
movzx eax, word [ecx*2 + 0x4c7256]
push eax
push 0x4c4910
call fcn.0048f261
add esp, 8
test eax, eax
je 0x4073b0
mov ecx, dword [0x4c7254]
lea edi, [ecx*2 + 0x4c7254]
jmp 0x407308
movzx edx, byte [ebp + 0x22]
cmp ecx, edx
jl 0x4073b6
lea edi, [ecx*2 + 0x4c7256]
cmp byte [ebp + 0x26], 0
movzx edx, byte [ebp + 0x22]
mov eax, dword [ebp + 8]
lea esi, [eax + edx*2 - 2]
je 0x407334
cmp esi, eax
jb 0x407376
lea ecx, [ecx]
mov dx, word [edi]
cmp dx, word [esi]
jne 0x407376
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x407320
jmp 0x407376
cmp esi, eax
jb 0x407376
jmp 0x407346
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
movzx eax, word [esi]
push eax
call ebx
movzx ecx, word [edi]
push ecx
mov dword [esp + 0x28], eax
call ebx
mov ecx, dword [esp + 0x24]
cmp ax, cx
jne 0x40736a
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 8]
jae 0x407340
mov ecx, dword [0x4c7254]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
cmp esi, dword [ebp + 8]
jae 0x4073b6
cmp byte [ebp + 0x2b], 0
jne 0x407399
cmp edi, 0x4c7258
jb 0x407399
movzx edx, word [edi]
push edx
call fcn.00407910
add esp, 4
test al, al
jne 0x4073b0
mov eax, dword [ebp + 4]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004098f0
add esp, 4
test eax, eax
jne 0x407498
mov ecx, dword [0x4c7254]
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [0x4c9f10]
jb 0x4072a0
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov esi, dword [sym.imp.USER32.dll_ToUnicodeEx]
mov bl, byte [esp + 0x13]
cmp byte [esp + 0x2b], 0
je 0x407445
test bl, bl
je 0x407445
push 0x100
lea edx, [esp + 0x38]
push 0
push edx
call fcn.00497360
mov al, byte [0x4cb35a]
mov cl, byte [0x4cb35b]
add esp, 0xc
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x34]
call fcn.00412050
push ebp
push 0
push 2
lea edx, [esp + 0x38]
push edx
movzx edx, byte [0x4cb354]
mov eax, ecx
movzx ecx, word [0x4cb358]
push eax
push ecx
push edx
call esi
mov byte [0x4cb354], 0
cmp byte [esp + 0x15], 0
je 0x407816
cmp dword [0x4ca640], 1
jne 0x407816
cmp byte [esp + 0x16], 0
jne 0x407816
xor esi, esi
test edi, edi
jle 0x4076d1
cmp byte [0x4ca66d], 0
je 0x40767d
movzx eax, word [esp + esi*2 + 0x18]
push eax
mov eax, dword [0x4ca64c]
push eax
call fcn.0048f261
add esp, 8
jmp 0x40768d
movzx edx, byte [ebp + 0x21]
mov ecx, dword [esp + 0x180]
mov eax, dword [esp + 0x170]
mov eax, dword [eax + 0x10]
add ecx, 4
push edx
call fcn.0040a530
add esp, 4
test al, al
je 0x4073cb
cmp byte [ebp + 0x27], 0
jne 0x4074ce
xor edi, edi
jmp 0x4075ad
cmp byte [ebp + 0x2a], 0
mov ebx, dword [0x4c7254]
lea ebx, [ebx*2 + 0x4c7258]
je 0x4074e4
sub ebx, 2
movzx ecx, byte [ebp + 0x22]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov dword [esp + 0x24], 0
mov byte [esp + 0x17], 0
mov byte [esp + 0x14], 0
cmp esi, ebx
jae 0x407556
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
lea ebx, [ebx]
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x407528
movzx eax, word [esi]
push eax
call edi
test eax, eax
je 0x407547
cmp byte [esp + 0x17], 0
jne 0x407543
movzx ecx, word [esi]
push ecx
mov byte [esp + 0x1b], 1
call edi
test eax, eax
je 0x407543
mov byte [esp + 0x14], 1
inc dword [esp + 0x24]
add esi, 2
cmp esi, ebx
jb 0x407510
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x40755a
xor edi, edi
jmp 0x4075ad
cmp eax, 1
jne 0x40756d
movzx edi, byte [esp + 0x14]
neg edi
sbb edi, edi
and edi, 2
jmp 0x4075ad
cmp byte [esp + 0x14], 0
jne 0x407578
xor edi, edi
jmp 0x4075ad
movzx edx, byte [ebp + 0x22]
add edx, edx
mov esi, ebx
sub esi, edx
mov edi, 2
cmp esi, ebx
jae 0x4075a6
jmp 0x407590
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x4075a4
add esi, edi
cmp esi, ebx
jb 0x407590
cmp esi, ebx
jne 0x4075ad
mov edi, 1
mov dl, byte [ebp + 0x28]
test dl, dl
jne 0x4075b9
cmp byte [ebp + 0x29], dl
je 0x4075c6
xor bl, bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x16], 1
jmp 0x4075ca
mov bl, byte [esp + 0x13]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x184]
mov dword [ecx], eax
mov al, byte [ebp + 0x2a]
test al, al
je 0x4075ee
mov ecx, dword [0x4c7254]
movzx ecx, word [ecx*2 + 0x4c7256]
jmp 0x4075f0
xor ecx, ecx
movzx esi, di
movzx ecx, cx
shl esi, 0x10
or esi, ecx
mov ecx, dword [esp + 0x188]
mov dword [ecx], esi
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
je 0x407637
test al, al
je 0x40762f
mov edx, dword [0x4c7254]
mov ax, word [edx*2 + 0x4c7256]
mov word [0x4c7258], ax
mov dword [0x4c7254], 1
jmp 0x40764f
mov dword [0x4c7254], ecx
jmp 0x40764f
test dl, dl
je 0x40764f
movzx edx, byte [ebp + 0x22]
sub dword [0x4c7254], edx
test al, al
je 0x40764f
dec dword [0x4c7254]
cmp byte [ebp + 0x2c], cl
je 0x40765a
mov dword [0x4c7254], ecx
mov ecx, dword [0x4c7254]
mov esi, dword [sym.imp.USER32.dll_ToUnicodeEx]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
xor eax, eax
mov word [ecx*2 + 0x4c7258], ax
jmp 0x4073dd
mov ax, word [esp + esi*2 + 0x18]
mov ecx, dword [0x4ca64c]
call fcn.00475510
test eax, eax
jne 0x40772b
mov eax, dword [0x4ca678]
cmp eax, dword [0x4ca67c]
je 0x4076d1
mov cx, word [esp + esi*2 + 0x18]
mov edx, dword [0x4ca674]
mov word [edx + eax*2], cx
mov eax, dword [0x4ca678]
mov edx, dword [0x4ca674]
inc eax
xor ecx, ecx
inc esi
mov dword [0x4ca678], eax
mov word [edx + eax*2], cx
cmp esi, edi
jl 0x407472
xor esi, esi
cmp byte [0x4ca671], 0
je 0x407796
cmp byte [0x4ca66d], 0
je 0x407764
cmp dword [0x4ca65c], esi
jbe 0x4077fe
jmp 0x407700
mov ecx, dword [0x4ca658]
mov eax, dword [ecx + esi*4]
mov edx, dword [0x4ca674]
push eax
push edx
call fcn.0048f288
add esp, 8
test eax, eax
jne 0x40774d
inc esi
cmp esi, dword [0x4ca65c]
jb 0x407700
jmp 0x4077fe
mov ax, word [esp + esi*2 + 0x18]
pop esi
pop edi
mov word [0x4ca654], ax
pop ebp
mov al, bl
mov dword [0x4ca640], 4
pop ebx
add esp, 0x15c
ret
pop esi
pop edi
pop ebp
mov al, bl
mov dword [0x4ca640], 3
pop ebx
add esp, 0x15c
ret
cmp dword [0x4ca65c], esi
jbe 0x4077fe
mov eax, dword [0x4ca674]
mov ecx, dword [0x4ca658]
push eax
mov eax, dword [ecx + esi*4]
call fcn.00475560
add esp, 4
test eax, eax
jne 0x40774d
inc esi
cmp esi, dword [0x4ca65c]
jb 0x407770
jmp 0x4077fe
cmp byte [0x4ca66d], 0
je 0x40783c
mov ebx, dword [0x4ca65c]
test ebx, ebx
je 0x4077fa
mov edi, dword [0x4ca674]
mov ebp, dword [0x4ca658]
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4077ec
test dx, dx
je 0x4077e8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4077ec
add eax, 4
add ecx, 4
test dx, dx
jne 0x4077c6
xor eax, eax
jmp 0x4077f1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407823
inc esi
cmp esi, ebx
jb 0x4077c0
mov bl, byte [esp + 0x13]
mov edx, dword [0x4ca67c]
cmp dword [0x4ca678], edx
jl 0x407816
mov dword [0x4ca640], 5
mov al, bl
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x15c
ret
mov dword [0x4ca640], 3
mov al, byte [esp + 0x13]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x15c
ret
cmp dword [0x4ca65c], esi
jbe 0x4077fe
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea ebx, [ebx]
mov edx, dword [0x4ca658]
mov eax, dword [edx + esi*4]
mov ecx, dword [0x4ca674]
push eax
push ecx
call edi
test eax, eax
je 0x40774d
inc esi
cmp esi, dword [0x4ca65c]
jb 0x407850
jmp 0x4077fe