Function at 0x10005cb0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
mov eax, dword [0x10051d18]
test eax, eax
je 0x10005cdb
cmp dword [eax], ecx
je 0x10005d1f
mov eax, dword [0x10051d14]
mov dword [0x10051d18], 0
test eax, eax
je 0x10005cfb
nop
cmp dword [eax], ecx
je 0x10005cfb
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x10005cf0
push 0x2b0
push str.keycode_to_unicode
push str._s___u_:_Refreshing_locale_cache._n
push 1
call dword [0x10051024]
add esp, 0x10
call fcn.10006050
mov eax, dword [0x10051d18]
xor ecx, ecx
mov dword [ebp - 8], ecx
test eax, eax
je 0x10005ffc
push ebx
push esi
push edi
push dword [eax]
push 0x2be
push str.keycode_to_unicode
push str._s___u_:_Using_keyboard_layout__p._n
push 2
call dword [0x10051024]
add esp, 0x14
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x10051d18]
and eax, 1
mov dword [ebp - 0x1c], eax
xor bl, bl
xor edi, edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0xc], ecx
xor cl, cl
mov dword [ebp - 0x14], edx
xor dl, dl
mov dword [ebp - 0x10], eax
mov byte [ebp - 1], dl
mov byte [ebp - 2], cl
cmp byte [eax], cl
je 0x10005dd6
mov esi, eax
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0xffff8000
test cx, ax
je 0x10005dc3
mov al, byte [esi]
cmp al, 0x10
jne 0x10005da6
mov dl, 1
mov byte [ebp - 1], dl
jmp 0x10005dc6
mov dl, byte [ebp - 1]
cmp al, 0x11
jne 0x10005db4
mov cl, 1
mov byte [ebp - 2], cl
jmp 0x10005dc9
cmp al, 0x12
movzx ebx, bl
mov eax, 1
cmove ebx, eax
jmp 0x10005dc6
mov dl, byte [ebp - 1]
mov cl, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
inc edi
cmp byte [eax + edi*2], 0
lea esi, [eax + edi*2]
jne 0x10005d85
xor eax, eax
test dl, dl
setne al
mov esi, eax
test cl, cl
je 0x10005dea
test bl, bl
je 0x10005dea
lea esi, [eax + 3]
push str.IsWow64Process
push 0x100454a0
mov edi, 8
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x10005e4b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
push ecx
push eax
call ebx
test eax, eax
jne 0x10005e4b
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push 0x1a2
push str.is_wow64
push str._s___u_:_pIsWow64Process__p___p__failed__n
push 1
call dword [0x10051024]
add esp, 0x18
cmp dword [ebp - 0x10], 0
mov eax, dword [0x10051d1c]
je 0x10005e5f
lea edi, [eax + 0xf]
and edi, 0xfff8
mov ecx, dword [ebp - 0x14]
movzx edx, ax
movzx eax, di
add edx, 5
mov di, word [0x10051028]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0xf001
nop
movzx eax, byte [edx + ecx]
mov ecx, dword [ecx]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
add eax, 0xfffffffe
cdq
sub eax, edx
mov edx, eax
sar edx, 1
test ecx, ecx
je 0x10005ebc
cmp esi, edx
jge 0x10005fef
mov al, byte [ecx]
movzx eax, al
cmp eax, dword [ebp + 8]
je 0x10005f43
lea ecx, [ecx + edx*2]
add ecx, 2
mov al, byte [ecx]
test al, al
jne 0x10005ea4
mov ebx, dword [ebp - 8]
mov eax, 0xf000
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
jne 0x10005e80
cmp di, ax
je 0x10005f3a
mov ecx, dword [ebp - 0xc]
xor esi, esi
cmp dword [ecx], esi
je 0x10005f3a
mov edx, dword [ebp + 0x10]
mov eax, ecx
nop dword [eax]
cmp edx, 1
jb 0x10005f30
mov ebx, dword [ebp + 0xc]
mov ax, word [ecx]
cmp ax, word [ebx]
mov ebx, dword [ebp - 8]
jne 0x10005f2d
cmp word [ecx + 2], di
jne 0x10005f2d
mov edi, 0xf000
mov word [0x10051028], di
cmp ebx, edx
ja 0x10005f2d
movzx eax, word [ecx + 4]
push ebx
push eax
push dword [ebp + 0xc]
call fcn.1000a4c0
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [ebp - 0xc]
inc esi
cmp dword [eax + esi*8], 0
lea ecx, [eax + esi*8]
jne 0x10005ef0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ecx + 1], 1
jne 0x10005f5d
cmp dword [ebp - 0x1c], 0
je 0x10005f5d
cmp byte [ebp - 1], 0
je 0x10005f5c
test esi, esi
jle 0x10005f5c
dec esi
jmp 0x10005f5d
inc esi
movzx eax, word [ecx + esi*2 + 2]
cmp ax, word [ebp - 0x18]
jne 0x10005fb9
mov eax, 0xf000
cmp di, ax
jne 0x10005f86
lea eax, [edx + esi]
mov di, word [ecx + eax*2 + 4]
mov word [0x10051028], di
jmp 0x10005ebc
cmp ebx, 2
jb 0x10005ff4
movzx ecx, di
mov ebx, 2
movzx eax, cl
shl cx, 8
or cx, ax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
mov word [eax], cx
mov eax, 0xf000
mov edi, eax
mov word [0x10051028], di
jmp 0x10005ec4
mov ecx, 0xf000
cmp ax, cx
je 0x10005fdb
cmp ebx, 1
jb 0x10005fe5
mov ecx, dword [ebp + 0xc]
mov ebx, 1
mov dword [ebp - 8], ebx
mov word [ecx], ax
jmp 0x10005ebf
mov ebx, dword [ebp - 8]
mov eax, ecx
jmp 0x10005ec4
mov ebx, dword [ebp - 8]
mov eax, ecx
jmp 0x10005ec4
mov eax, 0xf000
mov ebx, dword [ebp - 8]
jmp 0x10005ec4
mov eax, ecx
mov esp, ebp
pop ebp
ret