Function at 0x406980
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x4c28e0]
sub esp, 0x120
cmp dword [0x4c3fc4], 1
push ebx
mov bl, byte [esp + 0x12c]
push edi
mov di, word [esp + 0x134]
jne 0x4069c3
cmp byte [0x4c3ff0], 0
jne 0x4069c3
movzx eax, bl
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + ecx], 0
mov byte [esp + 0xa], 0
je 0x4069c8
mov byte [esp + 0xa], 1
cmp byte [esp + 0x138], 0
je 0x4069f5
movzx eax, bl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ecx + 4], 0
mov al, 1
jne 0x407353
mov al, byte [esp + 0xa]
pop edi
pop ebx
add esp, 0x120
ret
cmp dword [0x4c38ac], 0
je 0x406a0d
test dl, dl
jne 0x406a0d
mov byte [esp + 0xb], 1
cmp byte [esp + 0xa], dl
jne 0x406a12
mov byte [esp + 0xb], 0
cmp dword [0x4c3fc4], 1
mov al, byte [0x4c1ea5]
push esi
jne 0x406ad0
cmp byte [0x4c3fee], 0
je 0x406a36
test dl, dl
jne 0x406ad0
mov edx, dword [0x4c3fc8]
mov esi, dword [0x4c3fcc]
movzx ecx, bl
mov cl, byte [ecx + edx]
mov byte [esp + 0x10], 1
test cl, cl
jne 0x406a5b
movzx ecx, di
mov cl, byte [ecx + esi]
test cl, cl
je 0x406ad5
mov dl, cl
shr cl, 2
shr dl, 1
and cl, 1
and dl, 1
je 0x406af2
test cl, cl
jne 0x406a7e
test al, 0x30
jne 0x406a7e
test cl, cl
je 0x406ad5
test al, 0x30
jne 0x406ad5
movzx ecx, di
mov dword [0x4c3fc4], 4
cmp byte [ecx + esi], 0
mov byte [0x4c3fd0], bl
setne cl
mov byte [0x4c3fd4], cl
mov word [0x4c3fd2], di
test dl, dl
je 0x406ab4
mov byte [0x4c3fd5], 1
test al, 0x30
jne 0x406abb
mov byte [0x4c3fd5], 0
cmp byte [esp + 0xf], 0
jne 0x406ad5
mov al, byte [esp + 0xe]
pop esi
pop edi
pop ebx
add esp, 0x120
ret
mov byte [esp + 0x10], 0
push ebp
movzx ebp, bl
lea ecx, [ebp - 0x21]
cmp ecx, 0x84
ja case.0x406aeb.41
movzx edx, byte [ecx + 0x407368]
jmp dword [edx*4 + 0x40735c]
test cl, cl
je 0x406a7e
jmp 0x406a7a
pop ebp
pop esi
pop edi
mov al, 1
pop ebx
add esp, 0x120
ret
cmp byte [esp + 0x13], 0
je case.0x406aeb.41
mov ecx, dword [0x4c0bfc]
test ecx, ecx
je 0x406b2d
xor ecx, ecx
mov word [0x4c0c00], cx
mov dword [0x4c0bfc], ecx
jmp 0x406b2d
mov ecx, dword [0x4c0bfc]
test al, al
je 0x406b5b
cmp dword [0x4c3fc4], 1
jne 0x406b43
cmp byte [0x4c3fef], 0
jne 0x406b5b
cmp al, 0x10
je 0x406b5b
cmp al, 0x20
je 0x406b5b
test al, 0xc
je 0x40734d
test al, 3
je 0x40734d
cmp bl, 8
jne 0x406bd5
test al, al
jne 0x406bd5
cmp byte [esp + 0x14], al
je 0x406b96
cmp dword [0x4c3fc4], 1
jne 0x406b96
cmp byte [0x4c3fec], al
je 0x406b96
mov eax, dword [0x4c3ff8]
test eax, eax
je 0x406b96
mov esi, dword [0x4c3ff4]
dec eax
xor edx, edx
mov dword [0x4c3ff8], eax
mov word [esi + eax*2], dx
cmp byte [esp + 0x13], 0
je 0x406bb2
test ecx, ecx
je 0x406bb2
dec ecx
xor eax, eax
mov dword [0x4c0bfc], ecx
mov word [ecx*2 + 0x4c0c00], ax
cmp byte [0x4c4e68], 0
je 0x40734d
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
mov byte [0x4c4e68], 0
pop ebx
add esp, 0x120
ret
mov ecx, 0x40
mov esi, 0x4c1ec8
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
call fcn.00411240
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x406c01
or byte [esp + 0x44], 1
jmp 0x406c06
and byte [esp + 0x44], 0xfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x406c1d
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x406c1f
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, dword [sym.imp.USER32.dll_ToUnicodeEx]
xor ecx, ecx
cmp dword [0x4c2034], ecx
mov edi, eax
setne cl
push edi
lea edx, [esp + 0x1c]
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], edi
push ecx
mov ecx, dword [esp + 0x13c]
push 2
push edx
mov edx, dword [ecx + 4]
push eax
push edx
push ebp
call ebx
mov dword [esp + 0x2c], eax
test eax, eax
je 0x40734d
cmp byte [0x4c4e68], 0
mov al, byte [esp + 0x138]
je 0x406c82
cmp al, 9
je 0x406c82
mov byte [esp + 0x17], 1
cmp al, 0x1b
jne 0x406c87
mov byte [esp + 0x17], 0
cmp dword [esp + 0x2c], 0
jge 0x406d08
cmp byte [esp + 0x12], 0
je 0x40734d
mov byte [0x4c4e68], al
mov ax, word [esp + 0x13c]
mov word [0x4c4e6c], ax
mov al, byte [0x4c1ea5]
test al, 0x30
setne cl
mov byte [0x4c4e6e], cl
test al, 3
je 0x406ccb
mov byte [0x4c4e6f], 1
test al, 0xc
jne 0x406cd2
mov byte [0x4c4e6f], 0
xor edx, edx
cmp dword [0x4c2034], edx
push edi
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x13c]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
push eax
push ebp
call ebx
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x120
ret
test byte [0x4c1ea5], 3
jne 0x406d38
mov eax, 0xd
cmp word [esp + 0x18], ax
jne 0x406d27
mov ecx, 0xa
mov word [esp + 0x18], cx
cmp word [esp + 0x1a], ax
jne 0x406d38
mov edx, 0xa
mov word [esp + 0x1a], dx
cmp byte [esp + 0x13], 0
mov byte [esp + 0x15], 0
je 0x4070da
cmp esi, dword [0x4c0bf8]
je 0x406d62
xor eax, eax
mov dword [0x4c0bf8], esi
mov word [0x4c0c00], ax
xor ecx, ecx
jmp 0x406db1
mov ecx, dword [0x4c0bfc]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x406db1
mov eax, 0x4c0c5a
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406d80
sub eax, edx
sar eax, 1
mov dword [0x4c0bfc], eax
lea eax, [eax + eax + 2]
push eax
push 0x4c0c5a
push 0x4c0c00
call fcn.00488c10
mov ecx, dword [0x4c0bfc]
add esp, 0xc
mov dx, word [esp + 0x18]
mov word [ecx*2 + 0x4c0c00], dx
inc ecx
cmp dword [esp + 0x2c], 1
mov dword [0x4c0bfc], ecx
jle 0x406de0
mov ax, word [esp + 0x1a]
mov word [ecx*2 + 0x4c0c00], ax
inc ecx
mov dword [0x4c0bfc], ecx
xor edx, edx
mov word [ecx*2 + 0x4c0c00], dx
test ecx, ecx
je 0x4070da
mov dword [esp + 0x24], edx
cmp dword [0x4c38b0], edx
jbe 0x4070da
mov eax, dword [0x4c38ac]
mov edx, dword [esp + 0x24]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x26], 0
jne 0x406f21
cmp byte [ebp + 0x2e], 0
je 0x406e57
movzx eax, byte [ebp + 0x25]
cmp ecx, eax
jle 0x406f21
movzx eax, word [ecx*2 + 0x4c0bfe]
push eax
push 0x4be400
call fcn.00488f71
add esp, 8
test eax, eax
je 0x406f1b
mov ecx, dword [0x4c0bfc]
lea edi, [ecx*2 + 0x4c0bfc]
jmp 0x406e6a
movzx edx, byte [ebp + 0x25]
cmp ecx, edx
jl 0x406f21
lea edi, [ecx*2 + 0x4c0bfe]
cmp byte [ebp + 0x29], 0
movzx edx, byte [ebp + 0x25]
mov eax, dword [ebp + 4]
lea esi, [eax + edx*2 - 2]
je 0x406e94
cmp esi, eax
jb 0x406ed0
nop
mov dx, word [edi]
cmp dx, word [esi]
jne 0x406ed0
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x406e80
jmp 0x406ed0
cmp esi, eax
jb 0x406ed0
jmp 0x406ea0
movzx eax, word [edi]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
push eax
call ebx
movzx ecx, word [esi]
push ecx
mov dword [esp + 0x24], eax
call ebx
mov ecx, dword [esp + 0x20]
cmp cx, ax
jne 0x406eca
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 4]
jae 0x406ea0
mov ecx, dword [0x4c0bfc]
cmp esi, dword [ebp + 4]
jae 0x406f21
cmp byte [ebp + 0x2f], 0
jne 0x406ef1
cmp edi, 0x4c0c00
jb 0x406ef1
movzx edx, word [edi]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x406f1b
mov eax, dword [ebp]
test eax, eax
je 0x406efc
mov eax, dword [eax]
jmp 0x406f01
mov eax, 0x4a59a4
mov ecx, dword [ebp + 0xc]
mov bl, byte [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x10]
call fcn.00409180
add esp, 8
test eax, eax
jne 0x406f3b
mov ecx, dword [0x4c0bfc]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [0x4c38b0]
jb 0x406e02
jmp 0x4070d6
xor edi, edi
cmp byte [ebp + 0x2a], 0
je 0x40701d
cmp byte [ebp + 0x2e], 0
mov ebx, dword [0x4c0bfc]
lea ebx, [ebx*2 + 0x4c0c00]
je 0x406f5d
sub ebx, 2
movzx ecx, byte [ebp + 0x25]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov dword [esp + 0x20], edi
mov byte [esp + 0x16], 0
mov byte [esp + 0x13], 0
cmp esi, ebx
jae 0x406fc6
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
nop
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x406f98
movzx eax, word [esi]
push eax
call edi
test eax, eax
je 0x406fb7
cmp byte [esp + 0x16], 0
jne 0x406fb3
movzx ecx, word [esi]
push ecx
mov byte [esp + 0x1a], 1
call edi
test eax, eax
je 0x406fb3
mov byte [esp + 0x13], 1
inc dword [esp + 0x20]
add esi, 2
cmp esi, ebx
jb 0x406f80
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x406fca
xor edi, edi
jmp 0x40701d
cmp eax, 1
jne 0x406fdd
movzx edi, byte [esp + 0x13]
neg edi
sbb edi, edi
and edi, 2
jmp 0x40701d
cmp byte [esp + 0x13], 0
jne 0x406fe8
xor edi, edi
jmp 0x40701d
movzx edx, byte [ebp + 0x25]
add edx, edx
mov esi, ebx
sub esi, edx
mov edi, 2
cmp esi, ebx
jae 0x407016
jmp 0x407000
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x407014
add esi, edi
cmp esi, ebx
jb 0x407000
cmp esi, ebx
jne 0x40701d
mov edi, 1
mov dl, byte [ebp + 0x2b]
test dl, dl
jne 0x407029
cmp byte [ebp + 0x2c], dl
je 0x407033
mov byte [esp + 0x12], 0
mov byte [esp + 0x15], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x144]
mov dword [ecx], eax
mov al, byte [ebp + 0x2e]
test al, al
je 0x407057
mov ecx, dword [0x4c0bfc]
movzx ecx, word [ecx*2 + 0x4c0bfe]
jmp 0x407059
xor ecx, ecx
movzx esi, di
movzx ecx, cx
shl esi, 0x10
or esi, ecx
mov ecx, dword [esp + 0x148]
mov dword [ecx], esi
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp word [esi], cx
je 0x4070a3
test al, al
je 0x40709b
mov edx, dword [0x4c0bfc]
mov ax, word [edx*2 + 0x4c0bfe]
mov word [0x4c0c00], ax
mov dword [0x4c0bfc], 1
jmp 0x4070bb
mov dword [0x4c0bfc], ecx
jmp 0x4070bb
test dl, dl
je 0x4070bb
movzx edx, byte [ebp + 0x25]
sub dword [0x4c0bfc], edx
test al, al
je 0x4070bb
dec dword [0x4c0bfc]
cmp byte [ebp + 0x30], cl
je 0x4070c6
mov dword [0x4c0bfc], ecx
mov ecx, dword [0x4c0bfc]
xor eax, eax
mov word [ecx*2 + 0x4c0c00], ax
mov edi, dword [esp + 0x28]
cmp byte [esp + 0x17], 0
je 0x40714b
cmp byte [esp + 0x12], 0
mov bl, byte [0x4c4e68]
mov byte [0x4c4e68], 0
je 0x40714b
push 0x100
lea edx, [esp + 0x34]
push 0
push edx
call fcn.00490d90
mov al, byte [0x4c4e6e]
mov cl, byte [0x4c4e6f]
add esp, 0xc
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x30]
call fcn.00411240
push edi
push 0
push 2
lea edx, [esp + 0x34]
push edx
mov eax, ecx
movzx ecx, word [0x4c4e6c]
push eax
movzx edx, bl
push ecx
push edx
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp byte [esp + 0x14], 0
je 0x40734d
mov ebx, 1
cmp dword [0x4c3fc4], ebx
jne 0x40734d
cmp byte [esp + 0x15], 0
jne 0x40734d
mov eax, dword [0x4c3ff8]
cmp eax, dword [0x4c3ffc]
jge 0x4071a6
mov ecx, dword [0x4c3ff4]
mov dx, word [esp + 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [0x4c3ff8]
mov edx, dword [0x4c3ff4]
add eax, ebx
xor ecx, ecx
mov dword [0x4c3ff8], eax
mov word [edx + eax*2], cx
cmp dword [esp + 0x2c], ebx
jle 0x4071e0
mov eax, dword [0x4c3ff8]
cmp eax, dword [0x4c3ffc]
jge 0x4071e0
mov ecx, dword [0x4c3ff4]
mov dx, word [esp + 0x1a]
mov word [ecx + eax*2], dx
mov eax, dword [0x4c3ff8]
mov edx, dword [0x4c3ff4]
add eax, ebx
xor ecx, ecx
mov dword [0x4c3ff8], eax
mov word [edx + eax*2], cx
mov edi, dword [0x4c3fdc]
test edi, edi
jne 0x4071fa
mov eax, dword [0x4c3ffc]
cmp dword [0x4c3ff8], eax
jmp 0x407341
xor esi, esi
cmp byte [0x4c3ff1], 0
je 0x40729a
cmp byte [0x4c3fed], 0
je 0x407265
test edi, edi
je 0x407335
lea ebx, [ebx]
mov ecx, dword [0x4c3fd8]
mov eax, dword [ecx + esi*4]
mov edx, dword [0x4c3ff4]
push eax
push edx
call fcn.00488f98
add esp, 8
test eax, eax
jne 0x40724c
add esi, ebx
cmp esi, dword [0x4c3fdc]
jb 0x407220
jmp 0x407335
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
mov dword [0x4c3fc4], 3
pop ebx
add esp, 0x120
ret
test edi, edi
je 0x407335
lea ecx, [ecx]
mov eax, dword [0x4c3ff4]
mov ecx, dword [0x4c3fd8]
push eax
mov eax, dword [ecx + esi*4]
call fcn.0046f720
add esp, 4
test eax, eax
jne 0x40724c
add esi, ebx
cmp esi, dword [0x4c3fdc]
jb 0x407270
jmp 0x407335
cmp byte [0x4c3fed], 0
je 0x4072fa
test edi, edi
je 0x407335
mov ebx, dword [0x4c3ff4]
mov ebp, dword [0x4c3fd8]
mov ecx, dword [ebp + esi*4]
mov eax, ebx
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4072e6
test dx, dx
je 0x4072e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4072e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4072c0
xor eax, eax
jmp 0x4072eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40724c
inc esi
cmp esi, edi
jb 0x4072b7
jmp 0x407335
test edi, edi
je 0x407335
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x407310
mov edx, dword [0x4c3fd8]
mov eax, dword [edx + esi*4]
mov ecx, dword [0x4c3ff4]
push eax
push ecx
call edi
test eax, eax
je 0x40724c
add esi, ebx
cmp esi, dword [0x4c3fdc]
jb 0x407310
mov edx, dword [0x4c3ffc]
cmp dword [0x4c3ff8], edx
jl 0x40734d
mov dword [0x4c3fc4], 5
mov al, byte [esp + 0x12]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x120
ret