Function at 0x412730
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
mov bl, byte [ebp + 0xc]
movzx ax, bl
or eax, dword [ebp + 0x10]
test ax, ax
je 0x412c24
push esi
xor esi, esi
cmp dword [ebp + 0x1c], esi
push edi
jne 0x41275d
mov dword [ebp + 0x1c], 0xffc3d44d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x45c8b0]
mov eax, dword [0x45f458]
sete byte [ebp - 1]
cmp eax, esi
je 0x412780
cmp byte [ebp - 1], 0
mov byte [ebp - 2], 1
je 0x412784
mov byte [ebp - 2], 0
xor edi, edi
inc edi
cmp eax, edi
je 0x412791
cmp byte [ebp - 1], 0
je 0x412795
mov byte [ebp + 0x18], 0
test bl, bl
jne 0x4127a8
push dword [ebp + 0x10]
call fcn.004137b2
mov byte [ebp + 0xc], al
mov bl, al
jmp 0x4127bb
cmp word [ebp + 0x10], si
jne 0x4127bc
push dword [ebp + 0xc]
xor al, al
call fcn.00413875
mov dword [ebp + 0x10], eax
pop ecx
mov al, byte [ebp + 0x11]
neg al
sbb eax, eax
neg eax
cmp dword [0x45f458], 2
mov dword [ebp - 0xc], eax
je 0x4127da
cmp byte [0x460211], 0
je 0x412801
cmp bl, 0xa0
jb 0x412801
cmp bl, 0xa1
jbe 0x4127fa
cmp bl, 0xa3
jbe 0x4127f4
cmp bl, 0xa5
ja 0x412801
mov byte [ebp + 0xc], 0x12
jmp 0x4127fe
mov byte [ebp + 0xc], 0x11
jmp 0x4127fe
mov byte [ebp + 0xc], 0x10
mov bl, byte [ebp + 0xc]
cmp dword [ebp + 0x14], esi
je 0x412927
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor edx, edx
call fcn.00412c27
test al, al
pop ecx
je 0x4128c3
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [ebp + 8], 0
mov cl, 0x80
mov dl, 0x7f
jne 0x412845
movzx eax, bl
lea eax, [ebp + eax - 0x114]
or byte [eax], cl
jmp 0x412856
cmp dword [ebp + 8], edi
jne 0x412856
movzx eax, bl
lea eax, [ebp + eax - 0x114]
and byte [eax], dl
cmp bl, 0xa0
jb 0x4128b6
cmp bl, 0xa1
jbe 0x41289e
cmp bl, 0xa3
jbe 0x412884
cmp bl, 0xa5
ja 0x4128b6
test byte [ebp - 0x70], cl
jne 0x41287c
test byte [ebp - 0x6f], cl
jne 0x41287c
and byte [ebp - 0x102], dl
jmp 0x4128b6
or byte [ebp - 0x102], cl
jmp 0x4128b6
test byte [ebp - 0x72], cl
jne 0x412896
test byte [ebp - 0x71], cl
jne 0x412896
and byte [ebp - 0x103], dl
jmp 0x4128b6
or byte [ebp - 0x103], cl
jmp 0x4128b6
test byte [ebp - 0x74], cl
jne 0x4128b0
test byte [ebp - 0x73], cl
jne 0x4128b0
and byte [ebp - 0x104], dl
jmp 0x4128b6
or byte [ebp - 0x104], cl
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, word [ebp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
shl esi, 0x10
cmp dword [ebp + 8], edi
je 0x4128e9
mov eax, esi
or eax, edi
push eax
movzx eax, byte [ebp + 0xc]
push eax
push 0x100
push dword [ebp + 0x14]
call ebx
cmp byte [ebp + 0x18], 0
je 0x412902
cmp dword [ebp + 8], 2
jne 0x412902
mov eax, dword [0x45b170]
mov eax, dword [eax + 0x64]
call fcn.00411e1b
cmp dword [ebp + 8], 0
je 0x412c01
movzx eax, byte [ebp + 0xc]
or esi, 0xc0000001
push esi
push eax
push 0x101
push dword [ebp + 0x14]
call ebx
jmp 0x412c01
cmp byte [0x45e402], 0
mov eax, dword [ebp + 8]
mov dword [0x45c914], eax
mov byte [0x45f405], bl
je 0x4129ac
cmp bl, 0x12
je 0x41294d
cmp bl, 0xa4
je 0x41294d
cmp bl, 0xa5
jne 0x4129ac
cmp byte [ebp - 1], 0
jne 0x4129ac
cmp byte [0x460213], 0
je 0x4129ac
xor bl, bl
mov byte [ebp - 7], 1
call fcn.0041a306
mov bl, byte [ebp + 0xc]
cmp byte [ebp - 1], 0
lea edi, [ebp - 0x14]
jne 0x412978
mov edi, 0x45c90c
cmp bl, 0xa5
jne 0x412990
cmp byte [ebp - 2], 0
jne 0x412990
cmp dword [0x45db00], 0
mov byte [ebp - 3], 1
jne 0x412994
mov byte [ebp - 3], 0
mov al, byte [ebp - 3]
test al, al
mov byte [ebp - 4], al
je 0x412a15
cmp byte [ebp - 1], 0
jne 0x4129b2
mov ebx, dword [0x45c910]
jmp 0x4129db
mov byte [ebp - 7], 0
jmp 0x41296a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4129c7
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x4129c9
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, eax
xor eax, eax
call fcn.00412cf9
mov dword [edi], eax
cmp dword [edi], 0
je 0x4129e6
mov byte [ebp - 4], 0
jmp 0x412a18
cmp byte [0x46021a], 0
sete al
dec al
and al, 0x91
add al, 0x11
mov byte [ebp - 5], al
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x1c]
mov dword [0x45daf4], eax
jmp 0x412a18
mov ebx, dword [ebp + 0xc]
cmp byte [ebp - 2], 0
je 0x412a31
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor edx, edx
call fcn.00412c27
pop ecx
mov byte [ebp - 0x10], al
jmp 0x412a35
mov byte [ebp - 0x10], 0
cmp byte [ebp - 1], 0
jne 0x412a59
mov eax, dword [0x45f458]
cmp eax, 2
je 0x412a59
cmp dword [0x45db00], 0
je 0x412a53
cmp eax, 1
jne 0x412a59
mov byte [ebp - 1], 1
jmp 0x412a5d
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
je 0x412b21
cmp byte [ebp - 2], 0
je 0x412a8c
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.00411802
add esp, 0x14
jmp 0x412af7
cmp byte [ebp - 3], 0
je 0x412a9f
cmp dword [edi], 3
jne 0x412a9f
mov eax, dword [ebp + 0x1c]
mov dword [0x45daf8], eax
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
and dword [0x45daf8], 0
cmp byte [ebp - 4], 0
je 0x412af7
cmp dword [0x45daf4], 0
mov byte [ebp - 4], 0
je 0x412ad3
and dword [0x45daf4], 0
push 4
pop eax
jmp 0x412af0
cmp byte [ebp - 6], 0
jne 0x412af7
movzx eax, byte [ebp - 5]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
add eax, 4
call fcn.00412cf9
mov dword [edi], eax
cmp byte [ebp + 0xc], 0x90
jne 0x412b0b
cmp byte [0x460211], 0
je 0x412b0b
call fcn.004156ff
cmp byte [ebp - 1], 0
je 0x412b21
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
call fcn.00415728
add esp, 0xc
cmp byte [ebp + 0x18], 0
je 0x412b48
cmp dword [ebp + 8], 2
jne 0x412b48
cmp dword [0x45f458], 2
mov eax, dword [0x45b170]
jne 0x412b40
mov eax, dword [eax + 0x68]
jmp 0x412b43
mov eax, dword [eax + 0x64]
call fcn.00411e1b
cmp dword [ebp + 8], 0
je 0x412bf4
or dword [ebp - 0xc], 2
cmp byte [ebp - 2], 0
je 0x412b75
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.00411802
add esp, 0x14
jmp 0x412bde
cmp byte [ebp - 3], 0
je 0x412b88
cmp dword [edi], 3
jne 0x412b88
mov eax, dword [ebp + 0x1c]
mov dword [0x45dafc], eax
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
and dword [0x45dafc], 0
cmp byte [ebp - 4], 0
je 0x412bde
cmp dword [0x45daf4], 0
je 0x412bb8
and dword [0x45daf4], 0
push 4
pop eax
jmp 0x412bd7
cmp byte [ebp - 6], 0
je 0x412bde
movzx eax, byte [ebp - 5]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
neg eax
add eax, 3
call fcn.00412cf9
mov dword [edi], eax
cmp byte [ebp - 1], 0
je 0x412bf4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
call fcn.00415728
add esp, 0xc
cmp byte [ebp - 7], 0
je 0x412c01
mov bl, 1
call fcn.0041a306
cmp byte [ebp + 0x18], 0
pop edi
pop esi
je 0x412c24
cmp dword [0x45f458], 2
mov eax, dword [0x45b170]
jne 0x412c1c
mov eax, dword [eax + 0x60]
jmp 0x412c1f
mov eax, dword [eax + 0x5c]
call fcn.00411e1b
pop ebx
leave
ret