Function at 0x419c40
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
push ebx
mov dword [esp + 0xc], edx
mov bl, byte [esp + 0xc]
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, bl
mov edi, ecx
or ax, si
mov dword [esp + 0x18], edi
je 0x41a0f7
test edx, edx
mov eax, 0xffc3d44d
cmovne eax, edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4e8f4c]
sete bh
cmp dword [0x4ea7b0], 0
je 0x419c9e
mov byte [esp + 0x11], 1
test bh, bh
je 0x419ca3
mov byte [esp + 0x11], 0
cmp dword [0x4ea7b0], 1
je 0x419cb0
test bh, bh
je 0x419cb4
mov byte [ebp + 0x10], 0
mov edx, dword [ebp + 8]
test bl, bl
jne 0x419d04
movzx ecx, dx
movzx eax, dx
sub ecx, 0x45
je 0x419cfc
sub ecx, 0xf1
je 0x419cd3
sub ecx, 0xf
jne 0x419cd6
movzx eax, dl
test eax, 0x100
je 0x419ce5
movzx eax, al
or eax, 0xe000
push 3
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebp + 8]
mov bl, al
mov byte [esp + 0x14], bl
jmp 0x419d18
mov bl, 0x13
mov byte [esp + 0x14], bl
jmp 0x419d18
test dx, dx
jne 0x419d18
xor dl, dl
mov cl, bl
call fcn.0041d290
movzx edx, ax
mov dword [ebp + 8], edx
mov eax, edx
mov byte [esp + 0x24], dl
xor ecx, ecx
shr eax, 8
test al, al
setne cl
cmp dword [0x4ea7b0], 2
mov dword [esp + 0x20], ecx
jne case.default.0x419d42
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x419d42
jmp dword [eax*4 + 0x41a100]
mov bl, 0x11
jmp 0x419d53
mov bl, 0x10
jmp 0x419d53
mov bl, 0x12
mov byte [esp + 0x14], bl
cmp dword [ebp + 0xc], 0
je 0x419ed8
push 0
mov cl, bl
call fcn.0041c570
add esp, 4
test al, al
je 0x419e71
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test edi, edi
jne 0x419d8e
movzx eax, bl
or byte [esp + eax + 0x28], 0x80
jmp 0x419d9b
cmp edi, 1
jne 0x419d9b
movzx eax, bl
and byte [esp + eax + 0x28], 0x7f
movzx edi, bl
lea eax, [edi - 0xa0]
cmp eax, 5
ja case.default.0x419dad
jmp dword [eax*4 + 0x41a118]
test byte [esp + 0xca], 0x80
jne 0x419de0
test byte [esp + 0xcb], 0x80
jne 0x419de0
and byte [esp + 0x39], 0x7f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x419e74
or byte [esp + 0x39], 0x80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x419e74
test byte [esp + 0xc8], 0x80
jne 0x419e1e
test byte [esp + 0xc9], 0x80
jne 0x419e1e
and byte [esp + 0x38], 0x7f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x419e74
or byte [esp + 0x38], 0x80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x419e74
test byte [esp + 0xcc], 0x80
jne 0x419e5c
test byte [esp + 0xcd], 0x80
jne 0x419e5c
and byte [esp + 0x3a], 0x7f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x419e74
or byte [esp + 0x3a], 0x80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [ebp + 8]
jmp 0x419e74
movzx edi, bl
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
movzx esi, dx
shl esi, 0x10
cmp eax, 1
je 0x419e9e
mov eax, esi
or eax, 1
push eax
push edi
push 0x100
push dword [ebp + 0xc]
call ebx
mov eax, dword [esp + 0x18]
cmp byte [ebp + 0x10], 0
je 0x419eb9
cmp eax, 2
jne 0x419eb9
mov ecx, dword [0x4e4798]
mov ecx, dword [ecx + 0x74]
call fcn.0041b7d0
jmp 0x419ec1
test eax, eax
je 0x41a0cc
or esi, 0xc0000001
push esi
push edi
push 0x101
push dword [ebp + 0xc]
call ebx
jmp 0x41a0cc
mov dword [0x4ea738], edi
mov byte [0x4ea73c], bl
test bh, bh
je 0x419f45
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
test eax, eax
je 0x419f32
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [esp + 0x128], 0x30
lea eax, [esp + 0x128]
push eax
push esi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x419f32
mov eax, dword [esp + 0x134]
test eax, eax
je 0x419f32
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
call fcn.0041c8b0
mov edx, dword [ebp + 8]
jmp 0x419f4a
mov eax, dword [0x4ea794]
mov esi, dword [0x4e8e34]
mov dword [esp + 0x18], eax
cmp bl, 0xa5
jne 0x419f8f
test eax, eax
mov al, byte [esp + 0x11]
je 0x419f93
test al, al
jne 0x419f93
test esi, esi
je 0x419f93
mov byte [esp + 0x12], 1
xor cl, cl
mov byte [esp + 0x13], cl
test bh, bh
jne 0x419fb0
mov eax, dword [0x4ea7b0]
cmp eax, 2
je 0x419fb0
test esi, esi
je 0x419f8b
cmp eax, 1
jne 0x419fb0
mov bh, 1
jmp 0x419fb2
mov al, byte [esp + 0x11]
mov byte [esp + 0x12], 0
test al, al
je 0x419f6e
push 0
mov cl, bl
call fcn.0041c570
add esp, 4
mov byte [esp + 0x13], al
mov cl, al
jmp 0x419f74
xor bh, bh
cmp edi, 1
je 0x41a01c
cmp byte [esp + 0x11], 0
je 0x419fd3
push dword [esp + 0x1c]
push dword [esp + 0x24]
push edx
mov dl, bl
call fcn.0041b280
add esp, 0xc
jmp 0x41a006
mov ecx, dword [esp + 0x1c]
mov eax, dword [0x4e8e38]
cmp byte [esp + 0x12], 0
push ecx
push dword [esp + 0x24]
cmovne eax, ecx
push dword [esp + 0x2c]
mov dword [0x4e8e38], eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [0x4e8e38], 0
mov esi, dword [ebp + 8]
test bh, bh
je 0x41a01f
push esi
mov dl, bl
xor cl, cl
call fcn.0041b9a0
add esp, 4
jmp 0x41a01f
mov esi, dword [ebp + 8]
cmp byte [ebp + 0x10], 0
je 0x41a04b
cmp edi, 2
jne 0x41a04b
mov eax, dword [0x4e4798]
cmp dword [0x4ea7b0], edi
jne 0x41a041
mov ecx, dword [eax + 0x78]
call fcn.0041b7d0
jmp 0x41a04f
mov ecx, dword [eax + 0x74]
call fcn.0041b7d0
jmp 0x41a04f
test edi, edi
je 0x41a0cc
mov ecx, dword [esp + 0x20]
or ecx, 2
cmp byte [esp + 0x11], 0
je 0x41a073
push dword [esp + 0x1c]
mov dl, bl
push ecx
mov cl, byte [esp + 0x1b]
push esi
call fcn.0041b280
add esp, 0xc
jmp 0x41a0a3
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4e8e38]
cmp byte [esp + 0x12], 0
push edx
push ecx
push dword [esp + 0x2c]
cmovne eax, edx
push dword [esp + 0x20]
mov dword [0x4e8e38], eax
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [0x4e8e38], 0
cmp dword [esp + 0x18], 0
je 0x41a0bb
mov eax, 0x138
cmp si, ax
jne 0x41a0bb
and byte [0x4ea7a4], 0xfe
test bh, bh
je 0x41a0cc
push esi
mov dl, bl
mov cl, 1
call fcn.0041b9a0
add esp, 4
cmp byte [ebp + 0x10], 0
je 0x41a0f7
cmp dword [0x4ea7b0], 2
mov eax, dword [0x4e4798]
jne 0x41a0ef
mov ecx, dword [eax + 0x70]
call fcn.0041b7d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x6c]
call fcn.0041b7d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret