Function at 0x1115a240
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e81ab
mov eax, dword fs:[0]
push eax
sub esp, 0x8b8
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor edi, edi
push 0x30
mov dword [ebp - 0x89c], ecx
lea ecx, [ebp - 0x888]
push edi
push ecx
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8b0], edi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov byte [ebp - 0x88c], 0
mov dword [ebp - 0x8c4], edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x1115a9ee
movzx edi, byte [esi]
mov ecx, 1
lea eax, [edi - 0x1d]
sub ebx, ecx
add esi, ecx
cmp eax, 0xe2
ja case.0x1115a2d6.30
movzx edx, byte [eax + 0x1115aa5c]
jmp dword [edx*4 + 0x1115aa0c]
mov byte [0x1127f23d], cl
jmp case.0x1115a2d6.30
cmp byte [0x1127f23d], 0
je 0x1115a2fd
mov byte [0x1127f23d], 0
jmp case.0x1115a2d6.30
push 0xffffffffffffffff
push 0xfde9
push 0x320
lea eax, [ebp - 0x330]
push eax
push esi
call fcn.111b7e50
mov edi, eax
add esp, 0x14
mov dword [ebp - 0x8ac], edi
test edi, edi
je 0x1115a337
cmp word [ebp + edi*2 - 0x332], 0
jne 0x1115a337
dec edi
mov dword [ebp - 0x8ac], edi
mov cl, byte [esi]
dec ebx
inc esi
test cl, cl
jne 0x1115a337
jmp 0x1115a39e
mov byte [0x1127f23c], cl
jmp case.0x1115a2d6.30
cmp byte [0x1127f23c], 0
je 0x1115a361
mov byte [0x1127f23c], 0
jmp case.0x1115a2d6.30
cmp ebx, 2
jl case.0x1115a2d6.30
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl dx, 8
sub ebx, 2
or dx, ax
add esi, 2
jmp 0x1115a38f
test ebx, ebx
je case.0x1115a2d6.30
movzx edx, byte [esi]
sub ebx, ecx
add esi, ecx
mov edi, ecx
mov dword [ebp - 0x8ac], edi
mov word [ebp - 0x330], dx
cmp dword [ebp - 0x8b0], 0
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x8b4], esi
jne 0x1115a491
push 0x30
lea eax, [ebp - 0x888]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x888]
push ecx
push 0
mov dword [ebp - 0x888], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
mov dword [ebp - 0x8b0], eax
test eax, eax
je 0x1115a491
cmp byte [0x1127ad15], 0
jne 0x1115a491
mov eax, dword [ebp - 0x87c]
test eax, eax
je 0x1115a491
lea edx, [ebp - 0x898]
push edx
push eax
mov dword [ebp - 0x898], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x898]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1115a491
lea ecx, [ebp - 0x8a0]
push ecx
lea edx, [ebp - 0x740]
push edx
push 0
push eax
mov dword [ebp - 0x8a0], 0x208
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x1115a491
lea eax, [ebp - 0x740]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x1115a491
add eax, 2
push str.ntvdm.exe
push eax
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x1115a491
mov byte [ebp - 0x88c], 1
mov dword [ebp - 0x898], 0
test edi, edi
jle 0x1115a9e6
cmp dword [ebp - 0x8b0], 0
mov ecx, dword [ebp - 0x898]
movzx ebx, word [ebp + ecx*2 - 0x330]
je 0x1115a884
cmp byte [ebp - 0x88c], 0
jne 0x1115a884
push 0x118
lea edx, [ebp - 0x858]
push 0
push edx
call sub.MSVCR100.dll_memset
mov dword [ebp - 0x858], 1
mov dword [ebp - 0x850], 4
mov word [ebp - 0x852], bx
mov ecx, 7
lea esi, [ebp - 0x858]
lea edi, [ebp - 0x83c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x89c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc4]
add esp, 0xc
mov dword [ebp - 0x834], 6
call edx
mov esi, eax
mov dword [ebp - 0x8c0], eax
lea edx, [ebp - 0x8a8]
xor eax, eax
xor ecx, ecx
push edx
and esi, 0x40
mov word [ebp - 0x8a4], bx
mov word [ebp - 0x8a8], bx
mov word [ebp - 0x8a2], ax
mov word [ebp - 0x8a6], cx
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x8a4]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea ecx, [ebp - 0x8a4]
lea eax, [ebp - 0x8a8]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1115a5a6
test dx, dx
je 0x1115a5a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1115a5a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1115a580
xor eax, eax
jmp 0x1115a5ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
mov byte [ebp - 0x88d], al
test al, al
je 0x1115a5cc
movzx ecx, word [ebp - 0x8a4]
mov byte [ebp - 0x889], 1
cmp ebx, ecx
je 0x1115a5d3
mov byte [ebp - 0x889], 0
test al, al
je 0x1115a5e9
movzx edx, word [ebp - 0x8a8]
mov byte [ebp - 0x88b], 1
cmp ebx, edx
je 0x1115a5f0
mov byte [ebp - 0x88b], 0
mov ecx, dword [ebp - 0x89c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe0]
mov byte [ebp - 0x88a], 0
call edx
test eax, eax
je 0x1115a614
mov byte [ebp - 0x88a], 1
jmp 0x1115a639
cmp byte [ebp - 0x88d], 0
je 0x1115a639
test esi, esi
je 0x1115a71a
cmp byte [ebp - 0x889], 0
jne 0x1115a746
mov byte [ebp - 0x88a], 0
mov byte [ebp - 0x889], 0
test ebx, ebx
je 0x1115a653
cmp ebx, 0x20
jge 0x1115a653
add ebx, 0x60
mov byte [ebp - 0x889], 1
cmp byte [ebp - 0x88a], 0
jne 0x1115a680
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.ForceUnicodeKeys
push str.Client
call fcn.110bbc00
test eax, eax
je 0x1115a680
mov byte [ebp - 0x88a], 1
cmp dword [0x1127f238], 0
jne 0x1115a69b
cmp dword [0x1127f234], 0
jne 0x1115a69b
cmp byte [ebp - 0x889], 0
je 0x1115a6a2
mov byte [ebp - 0x88a], 0
xor esi, esi
mov dword [ebp - 0x894], 0xffffffff
cmp ebx, 0x20
jl 0x1115a80a
cmp byte [ebp - 0x88a], 0
jne 0x1115a80a
mov ecx, dword [ebp - 0x87c]
lea eax, [ebp - 0x8bc]
push eax
push ecx
mov dword [ebp - 0x8bc], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov dword [ebp - 0x8a0], eax
test esi, esi
jne 0x1115a701
mov esi, dword [0x1127f230]
mov dword [ebp - 0x8a0], esi
test esi, esi
je 0x1115a752
push esi
push ebx
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx edx, ax
mov dword [ebp - 0x894], edx
mov dword [0x1127f230], esi
jmp 0x1115a762
cmp byte [ebp - 0x88b], 0
jne 0x1115a746
cmp byte [ebp - 0x889], 0
je 0x1115a632
cmp dword [0x1127f22c], 0
jne 0x1115a746
cmp dword [0x1127f228], 0
je 0x1115a632
mov byte [ebp - 0x88a], 1
jmp 0x1115a639
push ebx
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
cmp al, 0xff
je 0x1115a791
shr eax, 8
test al, al
jne 0x1115a791
cmp ebx, 0x41
jl 0x1115a77d
cmp ebx, 0x5a
jle 0x1115a7ac
cmp ebx, 0x61
jl 0x1115a787
cmp ebx, 0x7a
jle 0x1115a7ac
cmp ebx, 0x30
jl 0x1115a791
cmp ebx, 0x39
jle 0x1115a7ac
cmp dword [0x1127f238], 0
jne 0x1115a7ac
cmp dword [0x1127f234], 0
jne 0x1115a7ac
cmp byte [ebp - 0x889], 0
je 0x1115a80a
mov ecx, dword [ebp - 0x8a0]
movsx edx, word [ebp - 0x894]
push ecx
push 0
push edx
mov dword [ebp - 0x850], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov word [ebp - 0x852], ax
movzx eax, byte [ebp - 0x894]
mov ecx, 7
lea esi, [ebp - 0x858]
lea edi, [ebp - 0x83c]
mov word [ebp - 0x854], ax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x850]
mov esi, dword [ebp - 0x8a0]
or ecx, 2
mov dword [ebp - 0x834], ecx
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.TraceKeys
push str._debug
call fcn.110bbc00
test eax, eax
je 0x1115a871
mov eax, ebx
cmp ebx, 0x20
jge 0x1115a833
mov eax, 0x3f
movsx edx, word [ebp - 0x894]
movzx ecx, byte [ebp - 0x889]
push edx
mov edx, dword [ebp - 0x850]
push ecx
movzx ecx, word [ebp - 0x852]
push edx
movzx edx, word [ebp - 0x854]
push ecx
mov ecx, dword [ebp - 0x8c0]
push edx
push esi
push ecx
push eax
push ebx
push str.keyx_x___c___ssx_x__hkl_x__vk_0_x_x__sc_0_x_x__flg_0_x_x__ctlKey_d__vkx_x_n
call fcn.111bd7b0
add esp, 0x28
push 0x1c
lea edx, [ebp - 0x858]
push edx
push 2
call dword [sym.imp.USER32.dll_SendInput]
jmp 0x1115a8c7
mov esi, dword [ebp - 0x89c]
mov eax, dword [esi]
mov edx, dword [eax + 0x64]
push 0x38
mov ecx, esi
call edx
mov ecx, 0x64
mov eax, ebx
call fcn.11150e00
mov ecx, 0xa
mov eax, ebx
call fcn.11150e00
mov ecx, 1
mov eax, ebx
call fcn.11150e00
mov eax, dword [esi]
mov edx, dword [eax + 0x64]
push 0xb8
mov ecx, esi
call edx
mov eax, dword [ebp - 0x898]
inc eax
mov dword [ebp - 0x898], eax
cmp eax, dword [ebp - 0x8ac]
jl 0x1115a4a3
mov esi, dword [ebp - 0x8b4]
mov ebx, dword [ebp + 0xc]
jmp 0x1115a9e6
mov dword [0x1127f224], ecx
jmp case.0x1115a2d6.30
mov dword [0x1127f224], 0
jmp case.0x1115a2d6.30
cmp dword [0x1127f224], 0
je case.0x1115a2d6.30
cmp dword [0x1127f220], 0
jne case.0x1115a2d6.30
mov ecx, dword [ebp - 0x89c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x70]
call edx
test eax, eax
jne 0x1115a9e6
jmp case.0x1115a2d6.30
mov dword [0x1127f220], ecx
jmp case.0x1115a2d6.30
mov dword [0x1127f220], 0
jmp case.0x1115a2d6.30
cmp dword [0x1127f220], 0
je case.0x1115a2d6.30
cmp dword [0x1127f224], 0
jne 0x1115a9e6
jmp case.0x1115a2d6.30
mov dword [0x1127f22c], ecx
jmp case.0x1115a2d6.30
mov dword [0x1127f22c], 0
jmp case.0x1115a2d6.30
mov dword [0x1127f228], ecx
jmp case.0x1115a2d6.30
mov dword [0x1127f228], 0
jmp case.0x1115a2d6.30
mov dword [0x1127f238], ecx
jmp case.0x1115a2d6.30
mov dword [0x1127f238], 0
jmp case.0x1115a2d6.30
mov dword [0x1127f234], ecx
jmp case.0x1115a2d6.30
mov dword [0x1127f234], 0
cmp dword [ebp - 0x8b8], 0
je 0x1115a9d8
mov ecx, dword [ebp - 0x8b8]
mov edx, dword [0x1127f224]
mov eax, dword [ecx]
mov eax, dword [eax + 0xa0]
push edx
push edi
call eax
test eax, eax
je 0x1115a9e6
mov ecx, dword [ebp - 0x89c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x64]
push edi
call eax
test ebx, ebx
jne 0x1115a2b5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0xc