Function at 0x7002f0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
push 0
call dword [sym.imp.user32.dll_GetKeyboardLayout]
mov ecx, eax
xchg dword [0x919aa0], ecx
mov dword [esp + 0x10], eax
cmp eax, ecx
jne 0x700326
movzx eax, byte [0x919aa4]
test al, al
jne 0x7005ad
jmp 0x7005a1
xorps xmm0, xmm0
xor edx, edx
xor ebx, ebx
movups xmmword [esp + 0x24], xmm0
movups xmmword [esp + 0x104], xmm0
movups xmmword [esp + 0xf4], xmm0
movups xmmword [esp + 0xe4], xmm0
movups xmmword [esp + 0xd4], xmm0
movups xmmword [esp + 0xc4], xmm0
movups xmmword [esp + 0xb4], xmm0
movups xmmword [esp + 0xa4], xmm0
movups xmmword [esp + 0x94], xmm0
movups xmmword [esp + 0x84], xmm0
movups xmmword [esp + 0x74], xmm0
movups xmmword [esp + 0x64], xmm0
movups xmmword [esp + 0x54], xmm0
movups xmmword [esp + 0x44], xmm0
movups xmmword [esp + 0x34], xmm0
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x25], 0x8080
movups xmmword [esp + 0x204], xmm0
movups xmmword [esp + 0x1f4], xmm0
movups xmmword [esp + 0x1e4], xmm0
movups xmmword [esp + 0x1d4], xmm0
movups xmmword [esp + 0x1c4], xmm0
movups xmmword [esp + 0x1b4], xmm0
movups xmmword [esp + 0x1a4], xmm0
movups xmmword [esp + 0x194], xmm0
movups xmmword [esp + 0x184], xmm0
movups xmmword [esp + 0x174], xmm0
movups xmmword [esp + 0x164], xmm0
movups xmmword [esp + 0x154], xmm0
movups xmmword [esp + 0x144], xmm0
movups xmmword [esp + 0x134], xmm0
movups xmmword [esp + 0x124], xmm0
movups xmmword [esp + 0x114], xmm0
nop
test dl, 1
jne 0x700599
cmp ebx, 0xff
lea esi, [ebx + 1]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov word [esp + 0xc], 0
setae al
mov dword [esp], eax
mov eax, 0xff
cmovae esi, eax
push dword [esp + 0x10]
push 0
push 5
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x124]
push eax
push 0
push ebx
call dword [sym.imp.user32.dll_ToUnicodeEx]
mov ebp, 0x110000
test eax, eax
mov edi, 0x110000
jle 0x7004e0
movzx eax, word [esp + 4]
lea ecx, [eax + 0x2000]
movzx ecx, cx
cmp ecx, 0xf800
jae 0x7004a0
mov edi, eax
jmp 0x7004e0
cmp eax, 0xdbff
ja 0x7004e0
movzx ecx, word [esp + 6]
lea edx, [ecx + 0x2000]
movzx edx, dx
cmp edx, 0xfc00
jb 0x7004e0
and eax, 0x3ff
and ecx, 0x3ff
shl eax, 0xa
lea edi, [eax + ecx + 0x10000]
nop word cs:[eax + eax]
nop dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov word [esp + 0xc], 0
push dword [esp + 0x10]
push 0
push 5
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push ebx
call dword [sym.imp.user32.dll_ToUnicodeEx]
test eax, eax
jle 0x700540
movzx eax, word [esp + 4]
lea ecx, [eax + 0x2000]
movzx ecx, cx
cmp ecx, 0xf800
jae 0x700530
mov ebp, eax
jmp 0x700540
cmp eax, 0xdbff
jbe 0x700567
nop word [eax + eax]
mov edx, dword [esp]
mov ebx, esi
cmp edi, ebp
je 0x700420
cmp edi, 0x110000
je 0x700420
cmp ebp, 0x110000
je 0x700420
jmp 0x7005a5
movzx ecx, word [esp + 6]
mov ebx, esi
lea edx, [ecx + 0x2000]
movzx edx, dx
cmp edx, 0xfc00
mov edx, dword [esp]
jb 0x700545
and eax, 0x3ff
and ecx, 0x3ff
shl eax, 0xa
lea ebp, [eax + ecx + 0x10000]
jmp 0x700545
xor eax, eax
xchg byte [0x919aa4], al
mov bl, 1
jmp 0x7005be
mov al, 1
xchg byte [0x919aa4], al
push 0xa5
call dword [sym.imp.user32.dll_GetKeyState]
test ax, ax
setns bl
mov ebp, dword [sym.imp.user32.dll_GetKeyState]
push 0x10
call ebp
movzx esi, ax
shr esi, 0xf
lea edi, [esi*4]
push 0x11
call ebp
mov ecx, ebp
test ax, ax
lea ebp, [esi*4 + 0x20]
cmovns ebp, edi
test bl, bl
cmove ebp, edi
push 0x12
mov edi, ecx
call ecx
lea esi, [ebp + 0x100]
test ax, ax
cmovns esi, ebp
test bl, bl
cmove esi, ebp
push 0x5b
call edi
test ax, ax
js 0x70061a
push 0x5c
call dword [sym.imp.user32.dll_GetKeyState]
test ax, ax
jns 0x700620
or esi, 0x800
mov eax, esi
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret