Function at 0x411044
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov bl, byte [ebp + 0xc]
movzx ax, bl
or eax, dword [ebp + 0x10]
test ax, ax
je 0x411543
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
jne 0x411071
mov dword [ebp + 0x1c], 0xffc3d44d
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
call esi
cmp eax, dword [0x464230]
mov eax, dword [0x4660f0]
sete byte [ebp - 1]
cmp eax, edi
je 0x411096
cmp byte [ebp - 1], 0
mov byte [ebp - 2], 1
je 0x41109a
mov byte [ebp - 2], 0
cmp eax, 1
je 0x4110a5
cmp byte [ebp - 1], 0
je 0x4110a9
mov byte [ebp + 0x18], 0
test bl, bl
jne 0x4110bc
push dword [ebp + 0x10]
call fcn.004120c7
mov bl, al
mov byte [ebp + 0xc], bl
jmp 0x4110cf
cmp word [ebp + 0x10], di
jne 0x4110d0
push edi
push dword [ebp + 0xc]
call fcn.0041218a
pop ecx
mov dword [ebp + 0x10], eax
pop ecx
mov al, byte [ebp + 0x11]
neg al
sbb eax, eax
neg eax
cmp dword [0x4660f0], 2
mov dword [ebp - 0x10], eax
je 0x4110ee
cmp byte [0x4654b9], 0
je 0x41110f
cmp bl, 0xa0
jb 0x41110f
cmp bl, 0xa1
jbe 0x41110a
cmp bl, 0xa3
jbe 0x411106
cmp bl, 0xa5
ja 0x41110f
mov bl, 0x12
jmp 0x41110c
mov bl, 0x11
jmp 0x41110c
mov bl, 0x10
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x14], edi
je 0x411236
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00411546
add esp, 0xc
test al, al
je 0x4111d2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [ebp + 8], edi
mov cl, 0x80
mov dl, 0x7f
jne 0x411153
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
or byte [eax], cl
jmp 0x411165
cmp dword [ebp + 8], 1
jne 0x411165
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
and byte [eax], dl
cmp bl, 0xa0
jb 0x4111c5
cmp bl, 0xa1
jbe 0x4111ad
cmp bl, 0xa3
jbe 0x411193
cmp bl, 0xa5
ja 0x4111c5
test byte [ebp - 0x78], cl
jne 0x41118b
test byte [ebp - 0x77], cl
jne 0x41118b
and byte [ebp - 0x10a], dl
jmp 0x4111c5
or byte [ebp - 0x10a], cl
jmp 0x4111c5
test byte [ebp - 0x7a], cl
jne 0x4111a5
test byte [ebp - 0x79], cl
jne 0x4111a5
and byte [ebp - 0x10b], dl
jmp 0x4111c5
or byte [ebp - 0x10b], cl
jmp 0x4111c5
test byte [ebp - 0x7c], cl
jne 0x4111bf
test byte [ebp - 0x7b], cl
jne 0x4111bf
and byte [ebp - 0x10c], dl
jmp 0x4111c5
or byte [ebp - 0x10c], cl
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, word [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
shl esi, 0x10
cmp dword [ebp + 8], 1
je 0x4111f9
mov eax, esi
or eax, 1
push eax
movzx eax, bl
push eax
push pe_nt_image_headers32
push dword [ebp + 0x14]
call edi
cmp byte [ebp + 0x18], 0
je 0x411211
cmp dword [ebp + 8], 2
jne 0x411211
push dword [0x46429c]
call fcn.00410722
pop ecx
cmp dword [ebp + 8], 0
je 0x411521
movzx eax, byte [ebp + 0xc]
or esi, 0xc0000001
push esi
push eax
push 0x101
push dword [ebp + 0x14]
call edi
jmp 0x411521
cmp byte [0x464daa], 0
mov eax, dword [ebp + 8]
mov dword [0x466094], eax
mov byte [0x466098], bl
je 0x4112c0
cmp bl, 0x12
je 0x41125c
cmp bl, 0xa4
je 0x41125c
cmp bl, 0xa5
jne 0x4112c0
cmp byte [0x4654bb], 0
je 0x4112c0
call esi
cmp eax, dword [0x464dbc]
jne 0x4112c0
push edi
mov byte [ebp - 5], 1
call fcn.00419f23
pop ecx
cmp byte [ebp - 1], 0
lea esi, [ebp - 0x1c]
jne 0x411288
mov esi, 0x46608c
cmp bl, 0xa5
mov dword [ebp - 0xc], esi
jne 0x4112a2
cmp byte [ebp - 2], 0
jne 0x4112a2
cmp dword [0x4644b0], edi
mov byte [ebp - 3], 1
jne 0x4112a6
mov byte [ebp - 3], 0
mov al, byte [ebp - 3]
test al, al
mov byte [ebp - 4], al
je 0x4112f9
cmp byte [ebp - 1], 0
jne 0x4112c6
mov eax, dword [0x466090]
mov dword [ebp - 0x14], eax
jmp 0x4112f1
mov byte [ebp - 5], 0
jmp 0x41127a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
je 0x4112da
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x4112dc
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edi
push eax
mov dword [ebp - 0x14], eax
call fcn.0041161f
pop ecx
pop ecx
mov dword [esi], eax
cmp dword [esi], edi
je 0x411318
mov byte [ebp - 4], 0
mov bl, byte [ebp + 0xf]
xor edi, edi
cmp byte [ebp - 2], 0
je 0x411346
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00411546
add esp, 0xc
mov byte [ebp - 0x18], al
jmp 0x41134a
cmp byte [0x4654c1], 0
sete bl
dec bl
and bl, 0x91
add bl, 0x11
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x1c]
mov dword [0x4644a4], eax
jmp 0x4112fc
mov byte [ebp - 0x18], 0
cmp byte [ebp - 1], 0
jne 0x41136d
mov eax, dword [0x4660f0]
cmp eax, 2
je 0x41136d
cmp dword [0x4644b0], edi
je 0x411367
cmp eax, 1
jne 0x41136d
mov byte [ebp - 1], 1
jmp 0x411371
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
je 0x41143b
cmp byte [ebp - 2], 0
je 0x4113a0
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00410131
add esp, 0x14
jmp 0x411412
cmp byte [ebp - 3], 0
je 0x4113b6
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x4113b6
mov eax, dword [ebp + 0x1c]
mov dword [0x4644a8], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x4644a8], edi
je 0x411412
cmp dword [0x4644a4], edi
mov byte [ebp - 4], 0
je 0x4113e6
mov dword [0x4644a4], edi
push 4
jmp 0x411403
cmp byte [ebp - 6], 0
jne 0x411412
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
add eax, 4
push eax
push dword [ebp - 0x14]
call fcn.0041161f
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp + 0xc], 0x90
jne 0x411426
cmp byte [0x4654b9], 0
je 0x411426
call fcn.00413e35
cmp byte [ebp - 1], 0
je 0x41143b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00413e5e
add esp, 0xc
cmp byte [ebp + 0x18], 0
je 0x411461
cmp dword [ebp + 8], 2
jne 0x411461
cmp dword [0x4660f0], 2
mov eax, dword [0x4642a0]
je 0x41145a
mov eax, dword [0x46429c]
push eax
call fcn.00410722
pop ecx
cmp dword [ebp + 8], edi
je 0x411513
or dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
je 0x41148d
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00410131
add esp, 0x14
jmp 0x4114fd
cmp byte [ebp - 3], 0
je 0x4114a3
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x4114a3
mov eax, dword [ebp + 0x1c]
mov dword [0x4644ac], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x4644ac], edi
je 0x4114fd
cmp dword [0x4644a4], edi
je 0x4114cf
mov dword [0x4644a4], edi
push 4
jmp 0x4114ee
cmp byte [ebp - 6], 0
je 0x4114fd
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
neg eax
add eax, 3
push eax
push dword [ebp - 0x14]
call fcn.0041161f
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp - 1], 0
je 0x411513
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
call fcn.00413e5e
add esp, 0xc
cmp byte [ebp - 5], 0
je 0x411521
push 1
call fcn.00419f23
pop ecx
cmp byte [ebp + 0x18], 0
pop edi
pop esi
je 0x411543
cmp dword [0x4660f0], 2
mov eax, dword [0x464298]
je 0x41153c
mov eax, dword [0x464294]
push eax
call fcn.00410722
pop ecx
pop ebx
leave
ret