Function at 0x408540
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x12c
push ebx
push ebp
push esi
mov esi, dword [0x4d3ea0]
mov bh, dl
mov edx, dword [0x4d4bb4]
mov dword [esp + 0x18], ecx
cmp esi, 1
jne 0x408582
cmp byte [0x4d3ed0], 0
jne 0x408582
movzx ebp, bh
lea eax, [ebp*8]
add eax, ebp
shl eax, 5
cmp dword [eax + edx], 0
jne 0x408582
xor cl, cl
jmp 0x408587
mov cl, 1
movzx ebp, bh
cmp byte [esp + 0x140], 0
mov byte [esp + 0xf], cl
je 0x4085bd
lea eax, [ebp*8]
movzx ecx, cl
add eax, ebp
mov esi, 1
shl eax, 5
cmp byte [eax + edx + 4], 0
cmovne ecx, esi
pop esi
pop ebp
mov al, cl
pop ebx
add esp, 0x12c
ret
cmp dword [0x4d2144], 0
mov al, byte [esp + 0x144]
je 0x4085d9
test al, al
jne 0x4085d9
test cl, cl
je 0x4085d9
mov ch, 1
jmp 0x4085db
xor ch, ch
mov bl, byte [0x4d2017]
mov byte [esp + 0x10], ch
push edi
cmp esi, 1
jne 0x4086b1
cmp byte [0x4d3ece], 0
je 0x408600
test al, al
jne 0x4086b1
mov byte [esp + 0x15], 1
cmp bh, 0xe7
je 0x4086b6
mov eax, dword [0x4d3ea4]
mov edi, dword [0x4d3ea8]
mov al, byte [eax + ebp]
test al, al
jne 0x408633
movzx eax, word [esp + 0x140]
mov al, byte [eax + edi]
test al, al
je 0x4086b6
mov cl, al
and al, 4
and cl, 2
je 0x408640
test al, al
je 0x40864a
mov dl, al
test cl, cl
jne 0x40865c
test dl, dl
je 0x40865c
test cl, cl
je 0x408653
test bl, 0x30
jne 0x40865c
test al, al
je 0x4086b6
test bl, 0x30
jne 0x4086b6
mov dx, word [esp + 0x140]
mov esi, 4
movzx eax, dx
mov dword [0x4d3ea0], esi
cmp byte [eax + edi], 0
mov byte [0x4d3eb0], bh
setne byte [0x4d3eb6]
mov word [0x4d3eb2], dx
xor eax, eax
mov word [0x4d3eb4], ax
test cl, cl
je 0x4086a2
mov byte [0x4d3eb7], 1
test bl, 0x30
jne 0x4086a7
mov byte [0x4d3eb7], al
test ch, ch
je 0x408eb6
jmp 0x4086b6
mov byte [esp + 0x15], 0
lea eax, [ebp - 0x21]
cmp eax, 0x84
ja case.0x4086c7.41
movzx eax, byte [eax + 0x408fe8]
jmp dword [eax*4 + 0x408fdc]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x12c
ret
test ch, ch
je case.0x4086c7.41
mov edx, dword [0x4d1804]
test edx, edx
je 0x408701
xor eax, eax
xor edx, edx
mov word [0x4d1808], ax
mov dword [0x4d1804], edx
jmp 0x408701
mov edx, dword [0x4d1804]
test bl, bl
je 0x408731
cmp esi, 1
jne 0x408713
cmp byte [0x4d3ecf], 0
jne 0x408731
cmp bl, 0x10
je 0x408731
cmp bl, 0x20
je 0x408731
test bl, 0xc
setne cl
test bl, 3
setne al
test al, cl
je 0x408eb6
cmp bh, 8
jne 0x4087a8
test bl, bl
jne 0x4087a8
cmp byte [esp + 0x15], bl
je 0x408769
cmp esi, 1
jne 0x408769
cmp byte [0x4d3ecc], bl
je 0x408769
mov ecx, dword [0x4d3ed8]
test ecx, ecx
je 0x408769
mov eax, dword [0x4d3ed4]
dec ecx
xor esi, esi
mov dword [0x4d3ed8], ecx
mov word [eax + ecx*2], si
cmp byte [esp + 0x14], 0
je 0x408785
test edx, edx
je 0x408785
dec edx
xor eax, eax
mov dword [0x4d1804], edx
mov word [edx*2 + 0x4d1808], ax
cmp byte [0x4d5636], 0
je 0x408eb6
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov byte [0x4d5636], 0
pop ebx
add esp, 0x12c
ret
mov ecx, 0x40
lea edi, [esp + 0x3c]
mov esi, 0x4d2018
mov dl, bl
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x3c]
call fcn.00411e20
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4087d6
or byte [esp + 0x50], 1
jmp 0x4087db
and byte [esp + 0x50], 0xfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4087f2
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x4087f4
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edx, eax
mov dword [esp + 0x30], edx
cmp bh, 0xe7
jne 0x408821
mov ax, word [esp + 0x140]
mov ecx, 1
mov di, ax
mov dword [esp + 0x18], ecx
mov word [esp + 0x20], di
jmp 0x408867
xor eax, eax
cmp dword [0x4d1450], eax
push edx
setne al
push eax
push 2
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x30]
push dword [eax + 4]
push ebp
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x408eb6
mov di, word [esp + 0x20]
mov ax, word [esp + 0x140]
mov edx, dword [esp + 0x30]
cmp byte [0x4d5636], 0
je 0x40887f
cmp bh, 9
je 0x40887f
mov byte [esp + 0x16], 1
cmp bh, 0x1b
jne 0x408884
mov byte [esp + 0x16], 0
test ecx, ecx
jns 0x4088f6
cmp byte [esp + 0x13], 0
je 0x408eb6
mov word [0x4d5634], ax
mov al, byte [0x4d2017]
test al, 0x30
mov byte [0x4d5636], bh
push edx
setne byte [0x4d5631]
test al, 0xc
setne cl
test al, 3
setne al
and cl, al
xor eax, eax
cmp dword [0x4d1450], eax
mov byte [0x4d5630], cl
setne al
push eax
push 2
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x30]
push dword [eax + 4]
mov eax, dword [sym.imp.USER32.dll_ToUnicodeEx]
push ebp
call eax
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
test byte [0x4d2017], 3
jne 0x408926
cmp di, 0xd
jne 0x40890f
mov edi, 0xa
mov word [esp + 0x20], di
mov bx, word [esp + 0x22]
cmp bx, 0xd
jne 0x40892b
mov ebx, 0xa
mov word [esp + 0x22], bx
jmp 0x40892b
mov bx, word [esp + 0x22]
cmp byte [esp + 0x14], 0
mov ebp, dword [sym.imp.USER32.dll_CharLowerW]
mov byte [esp + 0x17], 0
je 0x408d06
cmp esi, dword [0x4d1800]
je 0x40895b
xor eax, eax
mov dword [0x4d1800], esi
mov word [0x4d1808], ax
xor esi, esi
jmp 0x40899e
mov esi, dword [0x4d1804]
mov eax, 0x5a
sub eax, esi
cmp eax, 3
jge 0x40899e
mov esi, 0x4d1862
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x408975
sub esi, ecx
sar esi, 1
lea eax, [esi*2 + 2]
push eax
push 0x4d1862
push 0x4d1808
call fcn.0048cfe0
add esp, 0xc
lea ecx, [esi + 1]
mov word [esi*2 + 0x4d1808], di
mov esi, dword [esp + 0x18]
mov eax, ecx
mov dword [0x4d1804], ecx
cmp esi, 1
jle 0x4089cd
lea eax, [ecx + 1]
mov word [ecx*2 + 0x4d1808], bx
mov ecx, eax
mov dword [0x4d1804], ecx
xor edx, edx
mov word [ecx*2 + 0x4d1808], dx
test eax, eax
je 0x408d0a
xor esi, esi
mov dword [esp + 0x2c], esi
cmp dword [0x4d2148], edx
jbe 0x408d06
mov eax, dword [0x4d2144]
mov ebp, dword [eax + esi*4]
mov dword [esp + 0x38], ebp
cmp byte [ebp + 0x27], 0
jne 0x408b11
cmp byte [ebp + 0x2f], 0
mov al, byte [ebp + 0x26]
movzx edx, al
je 0x408a4b
cmp ecx, edx
jle 0x408b11
movzx eax, word [ecx*2 + 0x4d1806]
push eax
push str._____:____.___n__t
call fcn.0048c759
add esp, 8
test eax, eax
je 0x408b0b
mov ecx, dword [0x4d1804]
mov al, byte [ebp + 0x26]
lea ebx, [ecx*2 + 0x4d1804]
jmp 0x408a5a
cmp ecx, edx
jl 0x408b11
lea ebx, [ecx*2 + 0x4d1806]
mov edx, dword [ebp + 4]
movzx edi, al
dec edi
cmp byte [ebp + 0x2a], 0
lea edi, [edx + edi*2]
je 0x408a84
cmp edi, edx
jb 0x408ac0
nop
mov ax, word [ebx]
cmp ax, word [edi]
jne 0x408ac0
sub edi, 2
sub ebx, 2
cmp edi, edx
jae 0x408a70
jmp 0x408ac0
cmp edi, edx
jb 0x408ac0
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov esi, eax
movzx eax, word [ebx]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
cmp ax, si
jne 0x408ab6
sub edi, 2
sub ebx, 2
cmp edi, dword [ebp + 4]
jae 0x408a90
mov ecx, dword [0x4d1804]
mov esi, dword [esp + 0x2c]
cmp edi, dword [ebp + 4]
jae 0x408b11
cmp byte [ebp + 0x30], 0
jne 0x408ae1
cmp ebx, 0x4d1808
jb 0x408ae1
movzx eax, word [ebx]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x408b0b
mov eax, dword [ebp]
test eax, eax
je 0x408aed
mov eax, dword [eax + 4]
jmp 0x408af2
mov eax, 0x4ac22c
mov edx, dword [ebp + 0xc]
mov cl, byte [ebp + 0x24]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
call fcn.0040ae50
add esp, 0xc
test eax, eax
jne 0x408b27
mov ecx, dword [0x4d1804]
inc esi
mov dword [esp + 0x2c], esi
cmp esi, dword [0x4d2148]
jb 0x4089f1
jmp 0x408d00
mov eax, dword [esp + 0x14c]
mov cl, byte [ebp + 0x25]
add eax, 4
push eax
mov eax, dword [esp + 0x20]
mov edx, dword [eax + 0x10]
call fcn.0040b940
add esp, 4
test al, al
je 0x408d00
cmp byte [ebp + 0x2b], 0
mov ecx, dword [0x4d1804]
je 0x408c6c
cmp byte [ebp + 0x2f], 0
lea eax, [ecx*2 + 0x4d1808]
lea edx, [eax - 2]
cmove edx, eax
xor al, al
mov dword [esp + 0x1c], eax
mov esi, edx
movzx eax, byte [ebp + 0x26]
xor ebx, ebx
mov dword [esp + 0x28], eax
xor edi, edi
add eax, eax
mov dword [esp + 0x34], edx
sub esi, eax
mov byte [esp + 0x14], bl
mov eax, dword [esp + 0x28]
cmp esi, edx
mov edx, ebx
cmova eax, edx
mov dword [esp + 0x28], eax
test eax, eax
je 0x408c6c
mov ebp, eax
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x408bc2
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
je 0x408bee
cmp byte [esp + 0x14], 0
jne 0x408bed
movzx eax, word [esi]
push eax
mov byte [esp + 0x18], 1
call dword [sym.imp.USER32.dll_IsCharUpperW]
mov ecx, dword [esp + 0x1c]
test eax, eax
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [esp + 0x1c], ecx
inc ebx
inc edi
add esi, 2
cmp edi, ebp
jb 0x408ba6
mov ebp, dword [esp + 0x38]
test ebx, ebx
je 0x408c66
cmp ebx, 1
jne 0x408c1a
xor edi, edi
mov ecx, 2
cmp byte [esp + 0x1c], 0
cmovne edi, ecx
mov ecx, dword [0x4d1804]
jmp 0x408c6e
cmp byte [esp + 0x1c], 0
je 0x408c66
movzx eax, byte [ebp + 0x26]
mov edi, 2
mov ebx, dword [esp + 0x34]
add eax, eax
mov esi, ebx
sub esi, eax
cmp esi, ebx
jae 0x408c56
nop dword [eax + eax]
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x408c54
add esi, edi
cmp esi, ebx
jb 0x408c40
cmp esi, ebx
mov ecx, dword [0x4d1804]
mov eax, 1
cmove edi, eax
jmp 0x408c6e
mov ecx, dword [0x4d1804]
xor edi, edi
mov bl, byte [ebp + 0x2c]
test bl, bl
jne 0x408c7a
cmp byte [ebp + 0x2d], bl
je 0x408c84
mov byte [esp + 0x13], 0
mov byte [esp + 0x17], 1
mov eax, dword [esp + 0x150]
mov edx, dword [esp + 0x2c]
mov dword [eax], edx
mov dl, byte [ebp + 0x2f]
test dl, dl
je 0x408ca2
movzx eax, word [ecx*2 + 0x4d1806]
jmp 0x408ca4
xor eax, eax
movzx eax, ax
shl edi, 0x10
or edi, eax
mov eax, dword [esp + 0x154]
mov dword [eax], edi
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x408cdb
test dl, dl
je 0x408cd7
mov ax, word [ecx*2 + 0x4d1806]
mov ecx, 1
mov word [0x4d1808], ax
jmp 0x408cea
xor ecx, ecx
jmp 0x408cea
test bl, bl
je 0x408cea
movzx eax, byte [ebp + 0x26]
sub ecx, eax
test dl, dl
je 0x408cea
dec ecx
xor eax, eax
cmp byte [ebp + 0x31], al
cmovne ecx, eax
mov dword [0x4d1804], ecx
mov word [ecx*2 + 0x4d1808], ax
mov ebp, dword [sym.imp.USER32.dll_CharLowerW]
mov esi, dword [esp + 0x18]
cmp byte [esp + 0x16], 0
je 0x408d81
cmp byte [esp + 0x13], 0
mov bl, byte [0x4d5636]
mov byte [0x4d5636], 0
je 0x408d81
push pe_nt_image_headers32
lea eax, [esp + 0x40]
push 0
push eax
call fcn.0048ce40
mov dl, byte [0x4d5631]
lea ecx, [esp + 0x48]
mov al, byte [0x4d5630]
add esp, 0xc
neg dl
sbb dl, dl
and dl, 0x20
neg al
sbb al, al
and al, 9
or dl, al
call fcn.00411e20
push dword [esp + 0x30]
lea eax, [esp + 0x38]
push 0
push 2
push eax
lea eax, [esp + 0x4c]
push eax
movzx eax, word [0x4d5634]
push eax
movzx eax, bl
push eax
mov eax, dword [sym.imp.USER32.dll_ToUnicodeEx]
call eax
cmp byte [esp + 0x15], 0
je 0x408eb6
cmp dword [0x4d3ea0], 1
jne 0x408eb6
cmp byte [esp + 0x17], 0
jne 0x408eb6
xor ebx, ebx
test esi, esi
jle 0x408e42
nop
cmp byte [0x4d3ecd], 0
movzx eax, word [esp + ebx*2 + 0x20]
push eax
je 0x408dd1
push dword [0x4d3eac]
call fcn.0048c759
add esp, 8
mov esi, eax
jmp 0x408dfb
mov esi, dword [0x4d3eac]
call ebp
mov edi, eax
movzx eax, word [esi]
push eax
call ebp
cmp ax, di
je 0x408dfb
cmp word [esi], 0
je 0x408e03
movzx eax, word [esi + 2]
add esi, 2
push eax
call ebp
cmp ax, di
jne 0x408de6
test esi, esi
jne 0x408ec5
mov edx, dword [0x4d3ed8]
cmp edx, dword [0x4d3edc]
je 0x408e42
mov eax, dword [0x4d3ed4]
mov cx, word [esp + ebx*2 + 0x20]
inc ebx
mov word [eax + edx*2], cx
xor edx, edx
mov ecx, dword [0x4d3ed8]
mov eax, dword [0x4d3ed4]
inc ecx
mov dword [0x4d3ed8], ecx
mov word [eax + ecx*2], dx
cmp ebx, dword [esp + 0x18]
jl 0x408db0
xor esi, esi
cmp byte [0x4d3ed1], 0
je 0x408f2a
cmp byte [0x4d3ecd], 0
je 0x408eea
cmp dword [0x4d3ebc], esi
jbe 0x408e97
nop word [eax + eax]
mov eax, dword [0x4d3eb8]
push dword [eax + esi*4]
push dword [0x4d3ed4]
call fcn.0048c820
add esp, 8
test eax, eax
jne 0x408fc3
inc esi
cmp esi, dword [0x4d3ebc]
jb 0x408e70
mov eax, dword [0x4d3ed8]
mov edx, 5
mov ecx, dword [0x4d3ea0]
cmp eax, dword [0x4d3edc]
cmovge ecx, edx
mov dword [0x4d3ea0], ecx
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
mov cx, word [esp + ebx*2 + 0x20]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov dword [0x4d3ea0], 4
mov word [0x4d3eb4], cx
pop ebx
add esp, 0x12c
ret
cmp dword [0x4d3ebc], esi
jbe 0x408e97
nop dword [eax]
nop word [eax + eax]
mov edx, dword [0x4d3eb8]
mov ecx, dword [0x4d3ed4]
mov edx, dword [edx + esi*4]
call fcn.00473300
test eax, eax
jne 0x408fc3
inc esi
cmp esi, dword [0x4d3ebc]
jb 0x408f00
jmp 0x408e97
cmp byte [0x4d3ecd], 0
je 0x408f8f
mov edi, dword [0x4d3ebc]
test edi, edi
je 0x408e97
mov ebx, dword [0x4d3ed4]
mov ebp, dword [0x4d3eb8]
nop dword [eax]
mov ecx, dword [ebp + esi*4]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f7c
test dx, dx
je 0x408f78
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f7c
add eax, 4
add ecx, 4
test dx, dx
jne 0x408f56
xor eax, eax
jmp 0x408f81
sbb eax, eax
or eax, 1
test eax, eax
je 0x408fc3
inc esi
cmp esi, edi
jb 0x408f50
jmp 0x408e97
cmp dword [0x4d3ebc], esi
jbe 0x408e97
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [0x4d3eb8]
push dword [eax + esi*4]
push dword [0x4d3ed4]
call edi
test eax, eax
je 0x408fc3
inc esi
cmp esi, dword [0x4d3ebc]
jb 0x408fa1
jmp 0x408e97
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov dword [0x4d3ea0], 3
pop ebx
add esp, 0x12c
ret