Function at 0x406650
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x4a14d8]
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4a2bc0]
mov bl, al
cmp edi, 1
jne 0x40668a
cmp byte [0x4a2bec], 0
jne 0x40668a
movzx eax, bl
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + ecx], 0
mov byte [esp + 0x12], 0
je 0x40668f
mov byte [esp + 0x12], 1
cmp byte [esp + 0x134], 0
je 0x4066be
movzx eax, bl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ecx + 4], 0
mov al, 1
jne 0x40703f
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
cmp dword [0x4a24a4], 0
je 0x4066d6
test dl, dl
jne 0x4066d6
mov byte [esp + 0x13], 1
cmp byte [esp + 0x12], dl
jne 0x4066db
mov byte [esp + 0x13], 0
mov al, byte [0x4a0a35]
cmp edi, 1
jne 0x4067b9
cmp byte [0x4a2bea], 0
je 0x4066fa
test dl, dl
jne 0x4067b9
mov edx, dword [0x4a2bc4]
mov esi, dword [0x4a2bc8]
movzx ecx, bl
mov cl, byte [ecx + edx]
mov byte [esp + 0x17], 1
test cl, cl
jne 0x406724
movzx ecx, word [esp + reloc.USER32.dll_CheckMenuItem]
mov cl, byte [ecx + esi]
test cl, cl
je 0x40679d
mov dl, cl
shr cl, 2
shr dl, 1
and cl, 1
and dl, 1
je 0x4067c0
test cl, cl
jne 0x406747
test al, 0x30
jne 0x406747
test cl, cl
je 0x40679d
test al, 0x30
jne 0x40679d
movzx ecx, word [esp + reloc.USER32.dll_CheckMenuItem]
mov edi, 4
mov dword [0x4a2bc0], edi
cmp byte [ecx + esi], 0
mov byte [0x4a2bcc], bl
setne cl
mov byte [0x4a2bd0], cl
mov cx, word [esp + reloc.USER32.dll_CheckMenuItem]
mov word [0x4a2bce], cx
test dl, dl
je 0x40678b
mov byte [0x4a2bd1], 1
test al, 0x30
jne 0x406792
mov byte [0x4a2bd1], 0
cmp byte [esp + 0x13], 0
je 0x40703b
movzx ebp, bl
lea ecx, [ebp - 0x21]
cmp ecx, 0x84
ja case.0x4067b2.41
movzx edx, byte [ecx + 0x407058]
jmp dword [edx*4 + 0x40704c]
mov byte [esp + 0x17], 0
jmp 0x40679d
test cl, cl
je 0x406747
jmp 0x406743
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
cmp byte [esp + 0x13], 0
je case.0x4067b2.41
mov ecx, dword [0x49f7e4]
test ecx, ecx
je 0x4067fe
xor ecx, ecx
mov byte [0x49f7e8], 0
mov dword [0x49f7e4], ecx
jmp 0x4067fe
mov ecx, dword [0x49f7e4]
test al, al
je 0x406828
cmp edi, 1
jne 0x406810
cmp byte [0x4a2beb], 0
jne 0x406828
cmp al, 0x10
je 0x406828
cmp al, 0x20
je 0x406828
test al, 0xc
je 0x40703b
test al, 3
je 0x40703b
cmp bl, 8
jne 0x406899
test al, al
jne 0x406899
cmp byte [esp + 0x17], al
je 0x40685d
cmp edi, 1
jne 0x40685d
cmp byte [0x4a2be8], al
je 0x40685d
mov eax, dword [0x4a2bf4]
test eax, eax
je 0x40685d
mov edx, dword [0x4a2bf0]
dec eax
mov dword [0x4a2bf4], eax
mov byte [edx + eax], 0
cmp byte [esp + 0x13], 0
je 0x406876
test ecx, ecx
je 0x406876
dec ecx
mov dword [0x49f7e4], ecx
mov byte [ecx + 0x49f7e8], 0
cmp byte [0x4a330c], 0
je 0x40703b
mov byte [0x4a330c], 0
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
mov ecx, 0x40
mov esi, 0x4a0a58
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x28]
call fcn.00410950
push DestroyWindow
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4068c5
or byte [esp + 0x3c], 1
jmp 0x4068ca
and byte [esp + 0x3c], 0xfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4068e1
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x4068e3
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
xor eax, eax
cmp dword [0x4a0bb0], eax
lea ecx, [esp + 0x1c]
setne al
lea edx, [esp + 0x2c]
push eax
mov eax, dword [esp + reloc.USER32.dll_AdjustWindowRectEx]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
push ebp
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
je 0x40703b
cmp byte [0x4a330c], 0
je 0x406939
cmp bl, 9
je 0x406939
mov byte [esp + 0x15], 1
cmp bl, 0x1b
jne 0x40693e
mov byte [esp + 0x15], 0
test edi, edi
jns 0x406998
cmp byte [esp + 0x15], 0
jne 0x406998
cmp byte [esp + 0x12], 0
je 0x40698b
mov al, byte [0x4a0a35]
mov dx, word [esp + reloc.USER32.dll_CheckMenuItem]
test al, 0x30
setne cl
mov byte [0x4a330c], bl
mov word [0x4a3310], dx
mov byte [0x4a3312], cl
test al, 3
je 0x406984
mov byte [0x4a3313], 1
test al, 0xc
jne 0x40698b
mov byte [0x4a3313], 0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
test byte [0x4a0a35], 3
jne 0x4069b9
mov cl, 0xd
mov al, 0xa
cmp byte [esp + 0x18], cl
jne 0x4069af
mov byte [esp + 0x18], al
cmp byte [esp + 0x19], cl
jne 0x4069b9
mov byte [esp + 0x19], al
cmp byte [esp + 0x13], 0
mov byte [esp + 0x16], 0
je 0x406d4e
cmp esi, dword [0x49f7e0]
je 0x4069e2
mov dword [0x49f7e0], esi
mov byte [0x49f7e8], 0
xor ecx, ecx
jmp 0x406a28
mov ecx, dword [0x49f7e4]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x406a28
mov eax, 0x49f815
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406a00
sub eax, edx
mov dword [0x49f7e4], eax
inc eax
push eax
push 0x49f815
push 0x49f7e8
call fcn.004777f0
mov ecx, dword [0x49f7e4]
add esp, 0xc
mov al, byte [esp + 0x18]
mov byte [ecx + 0x49f7e8], al
inc ecx
mov dword [0x49f7e4], ecx
cmp edi, 1
jle 0x406a4f
mov dl, byte [esp + 0x19]
mov byte [ecx + 0x49f7e8], dl
inc ecx
mov dword [0x49f7e4], ecx
mov byte [ecx + 0x49f7e8], 0
test ecx, ecx
je 0x406d4e
cmp dword [0x4a24a8], 0
mov dword [esp + 0x24], 0
jbe 0x406d4e
mov eax, dword [0x4a24a4]
mov edx, dword [esp + 0x24]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x26], 0
jne 0x406b7e
cmp byte [ebp + 0x2e], 0
je 0x406ac6
movzx eax, byte [ebp + 0x25]
cmp ecx, eax
jle 0x406b7e
movsx eax, byte [ecx + 0x49f7e7]
push eax
push str._____:____.___n__t
call fcn.00477c01
add esp, 8
test eax, eax
je 0x406b78
mov ecx, dword [0x49f7e4]
lea edi, reloc.USER32.dll_AdjustWindowRectEx
jmp 0x406ad8
movzx edx, byte [ebp + 0x25]
cmp ecx, edx
jl 0x406b7e
lea edi, reloc.USER32.dll_AdjustWindowRectEx
cmp byte [ebp + 0x29], 0
movzx edx, byte [ebp + 0x25]
mov eax, dword [ebp + 4]
lea esi, [edx + eax - 1]
je 0x406afe
cmp esi, eax
jb 0x406b2d
lea ecx, [ecx]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x406b2d
dec esi
dec edi
cmp esi, eax
jae 0x406af0
jmp 0x406b2d
cmp esi, eax
jb 0x406b2d
movzx eax, byte [edi]
mov ebx, dword [sym.imp.USER32.dll_CharLowerA]
push eax
call ebx
movzx ecx, byte [esi]
push ecx
mov dword [esp + 0x20], eax
call ebx
mov ecx, dword [esp + 0x1c]
cmp cl, al
jne 0x406b27
dec esi
dec edi
cmp esi, dword [ebp + 4]
jae 0x406b02
mov ecx, dword [0x49f7e4]
cmp esi, dword [ebp + 4]
jae 0x406b7e
cmp byte [ebp + 0x2f], 0
jne 0x406b4e
cmp edi, 0x49f7e8
jb 0x406b4e
movzx edx, byte [edi]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
jne 0x406b78
mov eax, dword [ebp]
test eax, eax
je 0x406b59
mov eax, dword [eax]
jmp 0x406b5e
mov eax, 0x49588a
mov ecx, dword [ebp + 0xc]
mov bl, byte [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x10]
call fcn.00408dd0
add esp, 8
test eax, eax
jne 0x406b98
mov ecx, dword [0x49f7e4]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [0x4a24a8]
jb 0x406a73
jmp 0x406d4a
xor edi, edi
cmp byte [ebp + 0x2a], 0
je 0x406c7c
cmp byte [ebp + 0x2e], 0
mov ebx, dword [0x49f7e4]
lea ebx, reloc.USER32.dll_AdjustWindowRectEx
je 0x406bb7
dec ebx
movzx ecx, byte [ebp + 0x25]
mov esi, ebx
sub esi, ecx
mov dword [esp + 0x1c], edi
mov byte [esp + 0x14], 0
mov byte [esp + 0x13], 0
cmp esi, ebx
jae 0x406c24
mov edi, dword [sym.imp.USER32.dll_IsCharUpperA]
jmp 0x406be0
movzx edx, byte [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerA]
test eax, eax
jne 0x406bf8
movzx eax, byte [esi]
push eax
call edi
test eax, eax
je 0x406c17
cmp byte [esp + 0x14], 0
jne 0x406c13
movzx ecx, byte [esi]
push ecx
mov byte [esp + 0x18], 1
call edi
test eax, eax
je 0x406c13
mov byte [esp + 0x13], 1
inc dword [esp + 0x1c]
inc esi
cmp esi, ebx
jb 0x406be0
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x406c28
xor edi, edi
jmp 0x406c7c
cmp eax, 1
jne 0x406c3b
movzx edi, byte [esp + 0x13]
neg edi
sbb edi, edi
and edi, 2
jmp 0x406c7c
cmp byte [esp + 0x13], 0
jne 0x406c46
xor edi, edi
jmp 0x406c7c
movzx edx, byte [ebp + 0x25]
mov esi, ebx
sub esi, edx
mov edi, 2
cmp esi, ebx
jae 0x406c75
jmp 0x406c60
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerA]
test eax, eax
jne 0x406c73
inc esi
cmp esi, ebx
jb 0x406c60
cmp esi, ebx
jne 0x406c7c
mov edi, 1
mov dl, byte [ebp + 0x2b]
test dl, dl
jne 0x406c88
cmp byte [ebp + 0x2c], dl
je 0x406c92
mov byte [esp + 0x12], 0
mov byte [esp + 0x16], 1
mov ecx, dword [esp + reloc.USER32.dll_AdjustWindowRectEx]
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
mov cl, byte [ebp + 0x2e]
test cl, cl
je 0x406cb4
mov eax, dword [0x49f7e4]
movsx eax, byte [eax + 0x49f7e7]
jmp 0x406ccb
cmp byte [esp + 0x15], 0
je 0x406cc9
cmp byte [esp + 0x16], 0
je 0x406cc9
mov eax, 1
jmp 0x406ccb
xor eax, eax
movzx esi, di
movzx eax, ax
shl esi, 0x10
or esi, eax
mov eax, dword [esp + reloc.USER32.dll_AdjustWindowRectEx]
mov dword [eax], esi
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x406d15
test cl, cl
je 0x406d09
mov ecx, dword [0x49f7e4]
mov dl, byte [ecx + 0x49f7e7]
mov byte [0x49f7e8], dl
mov dword [0x49f7e4], 1
jmp 0x406d2d
mov dword [0x49f7e4], 0
jmp 0x406d2d
test dl, dl
je 0x406d2d
movzx eax, byte [ebp + 0x25]
sub dword [0x49f7e4], eax
test cl, cl
je 0x406d2d
dec dword [0x49f7e4]
cmp byte [ebp + 0x30], 0
je 0x406d3d
mov dword [0x49f7e4], 0
mov ecx, dword [0x49f7e4]
mov byte [ecx + 0x49f7e8], 0
mov edi, dword [esp + 0x20]
cmp byte [esp + 0x15], 0
je 0x406e6d
cmp byte [esp + 0x12], 0
mov al, byte [0x4a330c]
mov byte [esp + 0x1c], al
mov byte [0x4a330c], 0
je 0x406e6d
mov cl, byte [0x4a0a35]
mov byte [0x49f950], al
xor al, al
test cl, 0x10
je 0x406d8e
mov al, 0xa0
mov byte [esp + 0x20], al
jmp 0x406da0
test cl, 0x20
je 0x406d9b
mov al, 0xa1
mov byte [esp + 0x20], al
jmp 0x406da0
mov byte [esp + 0x20], 0xa0
mov esi, dword [esp + 0x20]
test al, al
mov al, byte [0x4a3312]
setne cl
mov byte [esp + 0x14], cl
cmp al, cl
je 0x406dd2
push 0xffc3d44d
xor edx, edx
push 0
test al, al
sete dl
push 0
push 0
push esi
push edx
call fcn.0040e2a0
add esp, 0x18
cmp byte [0x4a3313], 0
je 0x406f0c
test byte [0x4a0a35], 8
jne 0x406f0c
push 0xffc3d44d
push 0
push 0
push 0
push 0xa5
push 0
mov bl, 1
call fcn.0040e2a0
add esp, 0x18
movzx eax, word [0x4a3310]
mov ecx, dword [esp + 0x1c]
push 0xffc3d44e
push 0
push 0
push eax
push ecx
push 2
call fcn.0040e2a0
add esp, 0x18
test bl, bl
je 0x406e46
push 0xffc3d44d
push 0
push 0
push 0
push 0xa5
push 1
call fcn.0040e2a0
add esp, 0x18
mov al, byte [0x4a3312]
cmp al, byte [esp + 0x14]
je 0x406e6d
push 0xffc3d44d
xor edx, edx
push 0
test al, al
setne dl
push 0
push 0
push esi
push edx
call fcn.0040e2a0
add esp, 0x18
cmp byte [esp + 0x17], 0
je 0x40703b
cmp dword [0x4a2bc0], 1
jne 0x40703b
cmp byte [esp + 0x16], 0
jne 0x40703b
mov eax, dword [0x4a2bf4]
cmp eax, dword [0x4a2bf8]
jge 0x406ebf
mov ecx, dword [0x4a2bf0]
mov dl, byte [esp + 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x4a2bf4]
mov ecx, dword [0x4a2bf0]
inc eax
mov dword [0x4a2bf4], eax
mov byte [ecx + eax], 0
cmp edi, 1
jle 0x406ef3
mov eax, dword [0x4a2bf4]
cmp eax, dword [0x4a2bf8]
jge 0x406ef3
mov edx, dword [0x4a2bf0]
mov cl, byte [esp + 0x19]
mov byte [edx + eax], cl
mov eax, dword [0x4a2bf4]
mov edx, dword [0x4a2bf0]
inc eax
mov dword [0x4a2bf4], eax
mov byte [edx + eax], 0
mov eax, dword [0x4a2bd8]
test eax, eax
jne 0x406f13
mov eax, dword [0x4a2bf8]
cmp dword [0x4a2bf4], eax
jmp 0x40702f
xor bl, bl
jmp 0x406e08
xor esi, esi
cmp byte [0x4a2bed], 0
je 0x406fb5
cmp byte [0x4a2be9], 0
je 0x406f84
test eax, eax
je 0x407023
jmp 0x406f40
mov ecx, dword [0x4a2bd4]
mov eax, dword [ecx + esi*4]
mov edx, dword [0x4a2bf0]
push eax
push edx
call fcn.00477d42
add esp, 8
test eax, eax
jne 0x406f6b
inc esi
cmp esi, dword [0x4a2bd8]
jb 0x406f40
jmp 0x407023
mov dword [0x4a2bc0], 3
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
test eax, eax
je 0x407023
lea esp, [esp]
mov eax, dword [0x4a2bd4]
mov ecx, dword [eax + esi*4]
mov eax, dword [0x4a2bf0]
push ecx
call fcn.004645f0
add esp, 4
test eax, eax
jne 0x406f6b
inc esi
cmp esi, dword [0x4a2bd8]
jb 0x406f90
jmp 0x407023
cmp byte [0x4a2be9], 0
je 0x406fe9
test eax, eax
je 0x407023
mov edx, dword [0x4a2bd4]
mov eax, dword [edx + esi*4]
push eax
mov eax, dword [0x4a2bf0]
push eax
call fcn.00476dcc
add esp, 8
test eax, eax
je 0x406f6b
inc esi
cmp esi, dword [0x4a2bd8]
jb 0x406fc2
jmp 0x407023
test eax, eax
je 0x407023
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x407000
mov ecx, dword [0x4a2bd4]
mov edx, dword [ecx + esi*4]
mov eax, dword [0x4a2bf0]
push edx
push eax
call edi
test eax, eax
je 0x406f6b
inc esi
cmp esi, dword [0x4a2bd8]
jb 0x407000
mov ecx, dword [0x4a2bf8]
cmp dword [0x4a2bf4], ecx
jl 0x40703b
mov dword [0x4a2bc0], 5
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret