Function at 0x4103a0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, dl
push edi
movzx eax, bl
mov edi, ecx
or ax, si
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edi
je 0x410884
mov eax, dword [ebp + 0x14]
mov ecx, 0xffc3d44d
test eax, eax
cmovne ecx, eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4dbfc8]
sete bh
cmp dword [0x4dd6f4], 0
je 0x4103fc
mov byte [esp + 0x10], 1
test bh, bh
je 0x410401
mov byte [esp + 0x10], 0
cmp dword [0x4dd6f4], 1
je 0x41040e
test bh, bh
je 0x410412
mov byte [ebp + 0x10], 0
mov edx, dword [ebp + 8]
test bl, bl
jne 0x410462
movzx ecx, dx
movzx eax, dx
sub ecx, 0x45
je 0x41045a
sub ecx, 0xf1
je 0x410431
sub ecx, 0xf
jne 0x410434
movzx eax, dl
test eax, 0x100
je 0x410443
movzx eax, al
or eax, 0xe000
push 3
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebp + 8]
mov bl, al
mov byte [esp + 0x14], bl
jmp 0x410476
mov bl, 0x13
mov byte [esp + 0x14], bl
jmp 0x410476
test dx, dx
jne 0x410476
xor dl, dl
mov cl, bl
call fcn.00413780
movzx edx, ax
mov dword [ebp + 8], edx
mov eax, edx
mov byte [esp + 0x24], dl
xor ecx, ecx
shr eax, 8
test al, al
setne cl
cmp dword [0x4dd6f4], 2
mov dword [esp + 0x20], ecx
jne case.default.0x4104a0
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x4104a0
jmp dword [eax*4 + 0x41088c]
mov bl, 0x11
jmp 0x4104b1
mov bl, 0x10
jmp 0x4104b1
mov bl, 0x12
mov byte [esp + 0x14], bl
cmp dword [ebp + 0xc], 0
je 0x4105e5
push 0
mov cl, bl
call fcn.00412a20
add esp, 4
test al, al
je 0x41057f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test edi, edi
jne 0x4104ec
movzx eax, bl
or byte [esp + eax + 0x28], 0x80
jmp 0x4104f9
cmp edi, 1
jne 0x4104f9
movzx eax, bl
and byte [esp + eax + 0x28], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x410506
jmp dword [eax*4 + 0x4108a4]
test byte [esp + 0xca], 0x80
jne 0x410528
test byte [esp + 0xcb], 0x80
jne 0x410528
and byte [esp + 0x39], 0x7f
jmp case.default.0x410506
or byte [esp + 0x39], 0x80
jmp case.default.0x410506
test byte [esp + 0xc8], 0x80
jne 0x41054a
test byte [esp + 0xc9], 0x80
jne 0x41054a
and byte [esp + 0x38], 0x7f
jmp case.default.0x410506
or byte [esp + 0x38], 0x80
jmp case.default.0x410506
test byte [esp + 0xcc], 0x80
jne 0x41056c
test byte [esp + 0xcd], 0x80
jne 0x41056c
and byte [esp + 0x3a], 0x7f
jmp case.default.0x410506
or byte [esp + 0x3a], 0x80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
movzx esi, dx
shl esi, 0x10
cmp edi, 1
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
je 0x4105a4
mov eax, esi
or eax, 1
push eax
movzx eax, bl
push eax
push 0x100
push dword [ebp + 0xc]
call edi
cmp byte [ebp + 0x10], 0
mov eax, dword [esp + 0x18]
je 0x4105c3
cmp eax, 2
jne 0x4105c3
mov ecx, dword [0x4d78c8]
mov ecx, dword [ecx + 0x74]
call fcn.00411e00
jmp 0x4105cb
test eax, eax
je 0x410859
or esi, 0xc0000001
movzx eax, bl
push esi
push eax
push 0x101
push dword [ebp + 0xc]
call edi
jmp 0x410859
cmp byte [0x4dbcb0], 0
mov dword [0x4dd67c], edi
mov byte [0x4dd680], bl
je 0x410694
cmp bl, 0x12
je 0x410611
cmp bl, 0xa4
je 0x410611
cmp bl, 0xa5
jne 0x410694
test bh, bh
jne 0x410694
push 0
mov byte [esp + 0x17], 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4dbcb0], bh
mov eax, dword [0x4dd6d8]
mov ecx, dword [0x4dbeb0]
mov dword [esp + 0x18], eax
cmp bl, 0xa5
jne 0x4106fa
test eax, eax
mov al, byte [esp + 0x10]
je 0x4106fe
test al, al
jne 0x4106fe
test ecx, ecx
je 0x4106fe
mov byte [esp + 0x11], 1
mov esi, dword [ebp + 8]
xor dh, dh
mov byte [esp + 0x12], dh
test bh, bh
jne 0x41072d
mov eax, dword [0x4dd6f4]
cmp eax, 2
je 0x41072d
test ecx, ecx
je 0x41068d
cmp eax, 1
jne 0x41072d
mov bh, 1
jmp 0x41072f
mov byte [esp + 0x13], 0
test bh, bh
je 0x410628
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
test eax, eax
je 0x4106e7
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [esp + 0x128], 0x30
lea eax, [esp + 0x128]
push eax
push esi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x4106e7
mov eax, dword [esp + 0x134]
test eax, eax
je 0x4106e7
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
call fcn.00412d50
jmp 0x41062d
mov al, byte [esp + 0x10]
mov byte [esp + 0x11], 0
test al, al
je 0x410661
mov esi, dword [ebp + 8]
mov cl, bl
push 0
mov edx, esi
call fcn.00412a20
mov ecx, dword [0x4dbeb0]
add esp, 4
mov dh, al
mov byte [esp + 0x12], al
jmp 0x41066a
xor bh, bh
cmp edi, 1
je 0x410796
cmp byte [esp + 0x10], 0
je 0x410752
push dword [esp + 0x1c]
mov dl, bl
mov cl, dh
push dword [esp + 0x24]
push esi
call fcn.004118b0
add esp, 0xc
jmp 0x410785
mov ecx, dword [esp + 0x1c]
mov eax, dword [0x4dbeb4]
cmp byte [esp + 0x11], 0
push ecx
push dword [esp + 0x24]
cmovne eax, ecx
push dword [esp + 0x2c]
mov dword [0x4dbeb4], eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [0x4dbeb4], 0
test bh, bh
je 0x410796
push esi
mov dl, bl
xor cl, cl
call fcn.00411fd0
add esp, 4
cmp byte [ebp + 0x10], 0
je 0x4107c2
cmp edi, 2
jne 0x4107c2
mov eax, dword [0x4d78c8]
cmp dword [0x4dd6f4], edi
jne 0x4107b8
mov ecx, dword [eax + 0x78]
call fcn.00411e00
jmp 0x4107c6
mov ecx, dword [eax + 0x74]
call fcn.00411e00
jmp 0x4107c6
test edi, edi
je 0x410843
mov ecx, dword [esp + 0x20]
or ecx, 2
cmp byte [esp + 0x10], 0
je 0x4107ea
push dword [esp + 0x1c]
mov dl, bl
push ecx
mov cl, byte [esp + 0x1a]
push esi
call fcn.004118b0
add esp, 0xc
jmp 0x41081a
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4dbeb4]
cmp byte [esp + 0x11], 0
push edx
push ecx
push dword [esp + 0x2c]
cmovne eax, edx
push dword [esp + 0x20]
mov dword [0x4dbeb4], eax
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [0x4dbeb4], 0
cmp dword [esp + 0x18], 0
je 0x410832
mov eax, 0x138
cmp si, ax
jne 0x410832
and byte [0x4dd6e8], 0xfe
test bh, bh
je 0x410843
push esi
mov dl, bl
mov cl, 1
call fcn.00411fd0
add esp, 4
cmp byte [esp + 0x13], 0
je 0x410859
push 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4dbcb0], 1
cmp byte [ebp + 0x10], 0
je 0x410884
cmp dword [0x4dd6f4], 2
mov eax, dword [0x4d78c8]
jne 0x41087c
mov ecx, dword [eax + 0x70]
call fcn.00411e00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x6c]
call fcn.00411e00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret