Function at 0x410f1f
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov bl, byte [ebp + 0xc]
movzx ax, bl
or eax, dword [ebp + 0x10]
test ax, ax
je 0x41141e
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
jne 0x410f4c
mov dword [ebp + 0x1c], 0xffc3d44d
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
call esi
cmp eax, dword [0x463210]
mov eax, dword [0x4650d0]
sete byte [ebp - 1]
cmp eax, edi
je 0x410f71
cmp byte [ebp - 1], 0
mov byte [ebp - 2], 1
je 0x410f75
mov byte [ebp - 2], 0
cmp eax, 1
je 0x410f80
cmp byte [ebp - 1], 0
je 0x410f84
mov byte [ebp + 0x18], 0
test bl, bl
jne 0x410f97
push dword [ebp + 0x10]
call fcn.00411fa2
mov bl, al
mov byte [ebp + 0xc], bl
jmp 0x410faa
cmp word [ebp + 0x10], di
jne 0x410fab
push edi
push dword [ebp + 0xc]
call fcn.00412065
pop ecx
mov dword [ebp + 0x10], eax
pop ecx
mov al, byte [ebp + 0x11]
neg al
sbb eax, eax
neg eax
cmp dword [0x4650d0], 2
mov dword [ebp - 0x10], eax
je 0x410fc9
cmp byte [0x464499], 0
je 0x410fea
cmp bl, 0xa0
jb 0x410fea
cmp bl, 0xa1
jbe 0x410fe5
cmp bl, 0xa3
jbe 0x410fe1
cmp bl, 0xa5
ja 0x410fea
mov bl, 0x12
jmp 0x410fe7
mov bl, 0x11
jmp 0x410fe7
mov bl, 0x10
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x14], edi
je 0x411111
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00411421
add esp, 0xc
test al, al
je 0x4110ad
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [ebp + 8], edi
mov cl, 0x80
mov dl, 0x7f
jne 0x41102e
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
or byte [eax], cl
jmp 0x411040
cmp dword [ebp + 8], 1
jne 0x411040
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
and byte [eax], dl
cmp bl, 0xa0
jb 0x4110a0
cmp bl, 0xa1
jbe 0x411088
cmp bl, 0xa3
jbe 0x41106e
cmp bl, 0xa5
ja 0x4110a0
test byte [ebp - 0x78], cl
jne 0x411066
test byte [ebp - 0x77], cl
jne 0x411066
and byte [ebp - 0x10a], dl
jmp 0x4110a0
or byte [ebp - 0x10a], cl
jmp 0x4110a0
test byte [ebp - 0x7a], cl
jne 0x411080
test byte [ebp - 0x79], cl
jne 0x411080
and byte [ebp - 0x10b], dl
jmp 0x4110a0
or byte [ebp - 0x10b], cl
jmp 0x4110a0
test byte [ebp - 0x7c], cl
jne 0x41109a
test byte [ebp - 0x7b], cl
jne 0x41109a
and byte [ebp - 0x10c], dl
jmp 0x4110a0
or byte [ebp - 0x10c], cl
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, word [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
shl esi, 0x10
cmp dword [ebp + 8], 1
je 0x4110d4
mov eax, esi
or eax, 1
push eax
movzx eax, bl
push eax
push 0x100
push dword [ebp + 0x14]
call edi
cmp byte [ebp + 0x18], 0
je 0x4110ec
cmp dword [ebp + 8], 2
jne 0x4110ec
push dword [0x46327c]
call fcn.004105fd
pop ecx
cmp dword [ebp + 8], 0
je 0x4113fc
movzx eax, byte [ebp + 0xc]
or esi, 0xc0000001
push esi
push eax
push 0x101
push dword [ebp + 0x14]
call edi
jmp 0x4113fc
cmp byte [0x463d8a], 0
mov eax, dword [ebp + 8]
mov dword [0x465074], eax
mov byte [0x465078], bl
je 0x41119b
cmp bl, 0x12
je 0x411137
cmp bl, 0xa4
je 0x411137
cmp bl, 0xa5
jne 0x41119b
cmp byte [0x46449b], 0
je 0x41119b
call esi
cmp eax, dword [0x463d9c]
jne 0x41119b
push edi
mov byte [ebp - 5], 1
call fcn.00419e04
pop ecx
cmp byte [ebp - 1], 0
lea esi, [ebp - 0x1c]
jne 0x411163
mov esi, 0x46506c
cmp bl, 0xa5
mov dword [ebp - 0xc], esi
jne 0x41117d
cmp byte [ebp - 2], 0
jne 0x41117d
cmp dword [0x463490], edi
mov byte [ebp - 3], 1
jne 0x411181
mov byte [ebp - 3], 0
mov al, byte [ebp - 3]
test al, al
mov byte [ebp - 4], al
je 0x4111d4
cmp byte [ebp - 1], 0
jne 0x4111a1
mov eax, dword [0x465070]
mov dword [ebp - 0x14], eax
jmp 0x4111cc
mov byte [ebp - 5], 0
jmp 0x411155
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
je 0x4111b5
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x4111b7
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edi
push eax
mov dword [ebp - 0x14], eax
call fcn.004114fa
pop ecx
pop ecx
mov dword [esi], eax
cmp dword [esi], edi
je 0x4111f3
mov byte [ebp - 4], 0
mov bl, byte [ebp + 0xf]
xor edi, edi
cmp byte [ebp - 2], 0
je 0x411221
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00411421
add esp, 0xc
mov byte [ebp - 0x18], al
jmp 0x411225
cmp byte [0x4644a1], 0
sete bl
dec bl
and bl, 0x91
add bl, 0x11
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x1c]
mov dword [0x463484], eax
jmp 0x4111d7
mov byte [ebp - 0x18], 0
cmp byte [ebp - 1], 0
jne 0x411248
mov eax, dword [0x4650d0]
cmp eax, 2
je 0x411248
cmp dword [0x463490], edi
je 0x411242
cmp eax, 1
jne 0x411248
mov byte [ebp - 1], 1
jmp 0x41124c
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
je 0x411316
cmp byte [ebp - 2], 0
je 0x41127b
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.0041000c
add esp, 0x14
jmp 0x4112ed
cmp byte [ebp - 3], 0
je 0x411291
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x411291
mov eax, dword [ebp + 0x1c]
mov dword [0x463488], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x463488], edi
je 0x4112ed
cmp dword [0x463484], edi
mov byte [ebp - 4], 0
je 0x4112c1
mov dword [0x463484], edi
push 4
jmp 0x4112de
cmp byte [ebp - 6], 0
jne 0x4112ed
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
add eax, 4
push eax
push dword [ebp - 0x14]
call fcn.004114fa
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp + 0xc], 0x90
jne 0x411301
cmp byte [0x464499], 0
je 0x411301
call fcn.00413d10
cmp byte [ebp - 1], 0
je 0x411316
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00413d39
add esp, 0xc
cmp byte [ebp + 0x18], 0
je 0x41133c
cmp dword [ebp + 8], 2
jne 0x41133c
cmp dword [0x4650d0], 2
mov eax, dword [0x463280]
je 0x411335
mov eax, dword [0x46327c]
push eax
call fcn.004105fd
pop ecx
cmp dword [ebp + 8], edi
je 0x4113ee
or dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
je 0x411368
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.0041000c
add esp, 0x14
jmp 0x4113d8
cmp byte [ebp - 3], 0
je 0x41137e
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x41137e
mov eax, dword [ebp + 0x1c]
mov dword [0x46348c], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x46348c], edi
je 0x4113d8
cmp dword [0x463484], edi
je 0x4113aa
mov dword [0x463484], edi
push 4
jmp 0x4113c9
cmp byte [ebp - 6], 0
je 0x4113d8
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
neg eax
add eax, 3
push eax
push dword [ebp - 0x14]
call fcn.004114fa
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp - 1], 0
je 0x4113ee
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
call fcn.00413d39
add esp, 0xc
cmp byte [ebp - 5], 0
je 0x4113fc
push 1
call fcn.00419e04
pop ecx
cmp byte [ebp + 0x18], 0
pop edi
pop esi
je 0x41141e
cmp dword [0x4650d0], 2
mov eax, dword [0x463278]
je 0x411417
mov eax, dword [0x463274]
push eax
call fcn.004105fd
pop ecx
pop ebx
leave
ret