Function at 0x410830
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x16c
push ebx
push ebp
push esi
mov esi, dword [0x4e7d10]
mov bh, dl
mov edx, dword [0x4e8a84]
mov dword [esp + 0x1c], ecx
cmp esi, 1
jne 0x41086f
cmp byte [0x4e7d40], 0
jne 0x41086f
movzx ebp, bh
lea eax, [ebp*4]
add eax, ebp
cmp dword [edx + eax*4], 0
jne 0x41086f
xor cl, cl
jmp 0x410874
mov cl, 1
movzx ebp, bh
cmp byte [esp + 0x180], 0
mov byte [esp + 0xf], cl
je 0x4108a7
lea eax, [ebp*4]
movzx ecx, cl
add eax, ebp
mov esi, 1
cmp byte [edx + eax*4 + 8], 0
cmovne ecx, esi
pop esi
pop ebp
mov al, cl
pop ebx
add esp, 0x16c
ret
cmp dword [0x4e66dc], 0
mov al, byte [esp + 0x184]
je 0x4108c3
test al, al
jne 0x4108c3
test cl, cl
je 0x4108c3
mov ch, 1
jmp 0x4108c5
xor ch, ch
mov bl, byte [0x4e657c]
mov byte [esp + 0x10], ch
push edi
cmp esi, 1
jne 0x4109a3
cmp byte [0x4e7d3e], 0
je 0x4108ea
test al, al
jne 0x4109a3
mov byte [esp + 0x1a], 1
cmp bh, 0xe7
je 0x4109a8
mov eax, dword [0x4e7d14]
mov edi, dword [0x4e7d18]
mov al, byte [eax + ebp]
test al, al
jne 0x41091d
movzx eax, word [esp + 0x180]
mov al, byte [eax + edi]
test al, al
je 0x4109a8
mov cl, al
and al, 4
and cl, 2
je 0x41092a
test al, al
je 0x410934
mov dl, al
test cl, cl
jne 0x410946
test dl, dl
je 0x410946
test cl, cl
je 0x41093d
test bl, 0x30
jne 0x410946
test al, al
je 0x4109a8
test bl, 0x30
jne 0x4109a8
mov dx, word [esp + 0x180]
mov esi, 4
movzx eax, dx
mov dword [0x4e7d10], esi
cmp byte [eax + edi], 0
mov byte [0x4e7d20], bh
setne byte [0x4e7d26]
mov word [0x4e7d22], dx
xor eax, eax
mov word [0x4e7d24], ax
test cl, cl
je 0x41098c
mov byte [0x4e7d27], 1
test bl, 0x30
jne 0x410991
mov byte [0x4e7d27], al
test ch, ch
jne 0x4109a8
cmp byte [0x4e9cec], al
je 0x411273
jmp 0x4109a8
mov byte [esp + 0x1a], 0
lea eax, [ebp - 0x21]
cmp eax, 0x84
ja case.0x4109b9.41
movzx eax, byte [eax + 0x411398]
jmp dword [eax*4 + 0x41138c]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x16c
ret
test ch, ch
je case.0x4109b9.41
mov edx, dword [0x4e5d78]
test edx, edx
je 0x4109f3
xor eax, eax
xor edx, edx
mov word [0x4e5d80], ax
mov dword [0x4e5d78], edx
jmp 0x4109f3
mov edx, dword [0x4e5d78]
test bl, bl
je 0x410a28
cmp esi, 1
jne 0x410a05
cmp byte [0x4e7d3f], 0
jne 0x410a28
cmp bl, 0x10
je 0x410a28
cmp bl, 0x20
je 0x410a28
cmp bl, 0x30
je 0x410a28
test bl, 0xc
setne cl
test bl, 3
setne al
test al, cl
je 0x411273
cmp bh, 8
jne 0x410a9f
test bl, bl
jne 0x410a9f
cmp byte [esp + 0x1a], bl
je 0x410a60
cmp esi, 1
jne 0x410a60
cmp byte [0x4e7d3c], bl
je 0x410a60
mov ecx, dword [0x4e7d48]
test ecx, ecx
je 0x410a60
mov eax, dword [0x4e7d44]
dec ecx
xor esi, esi
mov dword [0x4e7d48], ecx
mov word [eax + ecx*2], si
cmp byte [esp + 0x14], 0
je 0x410a7c
test edx, edx
je 0x410a7c
dec edx
xor eax, eax
mov dword [0x4e5d78], edx
mov word [edx*2 + 0x4e5d80], ax
cmp byte [0x4e9cec], 0
je 0x411273
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov byte [0x4e9cec], 0
pop ebx
add esp, 0x16c
ret
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov edx, esi
mov dword [esp + 0x38], esi
call fcn.0041b540
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [esp + 0x30], eax
cmp dword [0x4e9ce8], esi
je 0x410afe
push 0x1c
lea eax, [esp + 0x148]
mov dword [0x4e9ce8], esi
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0x144]
push str.ApplicationFrameWindow
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
sete al
mov byte [0x4e9ce4], al
jmp 0x410b03
mov al, byte [0x4e9ce4]
mov bl, byte [0x4e9cec]
lea edi, [esp + 0x44]
mov ecx, 0x40
mov esi, 0x4e6580
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.USER32.dll_ToUnicodeEx]
test bl, bl
je 0x410b9e
test al, al
je 0x410b9e
cmp bh, 0xe7
je 0x410b9e
mov dl, byte [0x4e9ce2]
lea ecx, [esp + 0x44]
mov al, byte [0x4e9ce3]
neg dl
sbb dl, dl
and dl, 0x20
neg al
sbb al, al
and al, 9
or dl, al
call fcn.0041b0d0
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x24]
push esi
push 0
push 2
push eax
lea eax, [esp + 0x54]
push eax
movzx eax, word [0x4e9ce0]
push eax
movzx eax, bl
push eax
call edi
test eax, eax
jle 0x410b95
push esi
push 0
push 2
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
push eax
movzx eax, word [0x4e9ce0]
push eax
movzx eax, byte [0x4e9cec]
push eax
call edi
mov byte [0x4e9cec], 0
jmp 0x410ba2
mov esi, dword [esp + 0x30]
mov dl, byte [0x4e657c]
lea ecx, [esp + 0x44]
call fcn.0041b0d0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x410bc4
or byte [esp + 0x58], 1
jmp 0x410bc9
and byte [esp + 0x58], 0xfe
cmp bh, 0xe7
jne 0x410bed
mov ax, word [esp + 0x180]
mov ecx, 1
mov esi, dword [esp + 0x20]
mov di, ax
mov dword [esp + 0x1c], ecx
mov word [esp + 0x24], di
jmp 0x410c2b
xor eax, eax
cmp dword [0x4e586c], eax
push esi
mov esi, dword [esp + 0x24]
setne al
push eax
push 2
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
push eax
push dword [esi + 4]
push ebp
call edi
mov ecx, eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x411273
mov di, word [esp + 0x24]
mov ax, word [esp + 0x180]
cmp byte [0x4e9cec], 0
setne byte [esp + 0x2f]
test ecx, ecx
jns 0x410ca9
cmp byte [esp + 0x13], 0
je 0x411273
mov word [0x4e9ce0], ax
mov al, byte [0x4e657c]
test al, 0x30
mov byte [0x4e9cec], bh
setne byte [0x4e9ce2]
test al, 0xc
setne cl
test al, 3
setne al
and cl, al
mov eax, dword [esp + 0x30]
push eax
xor eax, eax
mov byte [0x4e9ce3], cl
cmp dword [0x4e586c], eax
setne al
push eax
push 2
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
push eax
push dword [esi + 4]
mov eax, dword [sym.imp.USER32.dll_ToUnicodeEx]
push ebp
call eax
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16c
ret
test byte [0x4e657c], 3
jne 0x410cd9
cmp di, 0xd
jne 0x410cc2
mov edi, 0xa
mov word [esp + 0x24], di
mov bx, word [esp + 0x26]
cmp bx, 0xd
jne 0x410cde
mov ebx, 0xa
mov word [esp + 0x26], bx
jmp 0x410cde
mov bx, word [esp + 0x26]
cmp byte [esp + 0x14], 0
mov ebp, dword [sym.imp.USER32.dll_CharLowerW]
mov byte [esp + 0x1b], 0
je 0x4110c8
mov eax, dword [esp + 0x38]
cmp eax, dword [0x4e5d74]
je 0x410d11
mov dword [0x4e5d74], eax
xor eax, eax
mov word [0x4e5d80], ax
xor esi, esi
jmp 0x410d59
mov esi, dword [0x4e5d78]
mov eax, 0x5a
sub eax, esi
cmp eax, 3
jge 0x410d59
mov esi, 0x4e5dda
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x410d30
sub esi, ecx
sar esi, 1
lea eax, [esi*2 + 2]
push eax
push 0x4e5dda
push 0x4e5d80
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea ecx, [esi + 1]
mov word [esi*2 + 0x4e5d80], di
mov esi, dword [esp + 0x1c]
mov eax, ecx
mov dword [0x4e5d78], ecx
cmp esi, 1
jle 0x410d88
lea eax, [ecx + 1]
mov word [ecx*2 + 0x4e5d80], bx
mov ecx, eax
mov dword [0x4e5d78], ecx
xor edx, edx
mov word [ecx*2 + 0x4e5d80], dx
test eax, eax
je 0x4110cc
xor esi, esi
mov dword [esp + 0x38], esi
cmp dword [0x4e66e0], edx
jbe 0x4110c8
nop dword [eax]
mov eax, dword [0x4e66dc]
mov ebp, dword [eax + esi*4]
mov dword [esp + 0x40], ebp
cmp byte [ebp + 0x23], 0
jne 0x410ede
cmp byte [ebp + 0x2a], 0
mov al, byte [ebp + 0x22]
movzx edx, al
je 0x410e0b
cmp ecx, edx
jle 0x410ede
movzx eax, word [ecx*2 + 0x4e5d7e]
push eax
push str._____:____.___n__t
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
test eax, eax
je 0x410ed8
mov ecx, dword [0x4e5d78]
mov al, byte [ebp + 0x22]
lea ebx, [ecx*2 + 0x4e5d7c]
jmp 0x410e1a
cmp ecx, edx
jl 0x410ede
lea ebx, [ecx*2 + 0x4e5d7e]
mov edx, dword [ebp + 8]
movzx edi, al
dec edi
cmp byte [ebp + 0x26], 0
lea edi, [edx + edi*2]
je 0x410e44
cmp edi, edx
jb 0x410e80
nop
mov ax, word [ebx]
cmp ax, word [edi]
jne 0x410e80
sub edi, 2
sub ebx, 2
cmp edi, edx
jae 0x410e30
jmp 0x410e80
cmp edi, edx
jb 0x410e80
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov esi, eax
movzx eax, word [ebx]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
cmp ax, si
jne 0x410e76
sub edi, 2
sub ebx, 2
cmp edi, dword [ebp + 8]
jae 0x410e50
mov ecx, dword [0x4e5d78]
mov esi, dword [esp + 0x38]
cmp edi, dword [ebp + 8]
jae 0x410ede
cmp byte [ebp + 0x2b], 0
jne 0x410ec9
cmp ebx, 0x4e5d80
jb 0x410ec9
movzx eax, word [ebx]
push eax
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x410ed8
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x3c]
push eax
push 4
push 0x400
call dword [sym.imp.KERNEL32.dll_GetStringTypeExW]
test eax, eax
je 0x410ec9
test byte [esp + 0x14], 1
jne 0x410ed8
mov edx, dword [ebp + 4]
mov ecx, dword [ebp + 0x10]
call fcn.00413410
test eax, eax
jne 0x410ef4
mov ecx, dword [0x4e5d78]
inc esi
mov dword [esp + 0x38], esi
cmp esi, dword [0x4e66e0]
jb 0x410db0
jmp 0x4110c2
mov eax, dword [esp + 0x18c]
mov edx, dword [esp + 0x20]
add eax, 4
mov cl, byte [ebp + 0x21]
push eax
mov edx, dword [edx + 0x10]
call fcn.00413ee0
add esp, 4
test al, al
je 0x4110c2
cmp byte [ebp + 0x27], 0
mov ecx, dword [0x4e5d78]
je 0x411031
cmp byte [ebp + 0x2a], 0
lea eax, [ecx*2 + 0x4e5d80]
lea edx, [eax - 2]
cmove edx, eax
xor al, al
mov dword [esp + 0x20], eax
mov esi, edx
movzx eax, byte [ebp + 0x22]
xor ebx, ebx
mov dword [esp + 0x34], eax
xor edi, edi
add eax, eax
mov dword [esp + 0x3c], edx
sub esi, eax
mov byte [esp + 0x14], bl
mov eax, dword [esp + 0x34]
cmp esi, edx
mov edx, ebx
cmova eax, edx
mov dword [esp + 0x34], eax
test eax, eax
je 0x411031
mov ebp, eax
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x410f8f
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
je 0x410fbb
cmp byte [esp + 0x14], 0
jne 0x410fba
movzx eax, word [esi]
push eax
mov byte [esp + 0x18], 1
call dword [sym.imp.USER32.dll_IsCharUpperW]
mov ecx, dword [esp + 0x20]
test eax, eax
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [esp + 0x20], ecx
inc ebx
inc edi
add esi, 2
cmp edi, ebp
jb 0x410f73
mov ebp, dword [esp + 0x40]
test ebx, ebx
je 0x41102b
cmp ebx, 1
jne 0x410fe7
xor edi, edi
mov ecx, 2
cmp byte [esp + 0x20], 0
cmovne edi, ecx
mov ecx, dword [0x4e5d78]
jmp 0x411033
cmp byte [esp + 0x20], 0
je 0x41102b
movzx eax, byte [ebp + 0x22]
mov edi, 2
mov ebx, dword [esp + 0x3c]
add eax, eax
mov esi, ebx
sub esi, eax
cmp esi, ebx
jae 0x41101b
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x411019
add esi, edi
cmp esi, ebx
jb 0x411005
cmp esi, ebx
mov ecx, dword [0x4e5d78]
mov eax, 1
cmove edi, eax
jmp 0x411033
mov ecx, dword [0x4e5d78]
xor edi, edi
mov bl, byte [ebp + 0x28]
test bl, bl
jne 0x41103f
cmp byte [ebp + 0x29], bl
je 0x411049
mov byte [esp + 0x13], 0
mov byte [esp + 0x1b], 1
mov eax, dword [esp + 0x190]
mov edx, dword [esp + 0x38]
mov dword [eax], edx
mov dl, byte [ebp + 0x2a]
test dl, dl
je 0x411067
movzx eax, word [ecx*2 + 0x4e5d7e]
jmp 0x411069
xor eax, eax
shl edi, 0x10
movzx eax, ax
or edi, eax
cmp dword [ebp + 0xc], 0
mov eax, dword [esp + 0x194]
mov dword [eax], edi
je 0x41109d
test dl, dl
je 0x411099
mov ax, word [ecx*2 + 0x4e5d7e]
mov ecx, 1
mov word [0x4e5d80], ax
jmp 0x4110ac
xor ecx, ecx
jmp 0x4110ac
test bl, bl
je 0x4110ac
movzx eax, byte [ebp + 0x22]
sub ecx, eax
test dl, dl
je 0x4110ac
dec ecx
xor eax, eax
cmp byte [ebp + 0x2c], al
cmovne ecx, eax
mov dword [0x4e5d78], ecx
mov word [ecx*2 + 0x4e5d80], ax
mov ebp, dword [sym.imp.USER32.dll_CharLowerW]
mov esi, dword [esp + 0x1c]
cmp byte [esp + 0x2f], 0
je 0x411142
cmp byte [esp + 0x13], 0
je 0x411142
push pe_nt_image_headers32
lea eax, [esp + 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov dl, byte [0x4e9ce2]
lea ecx, [esp + 0x50]
mov al, byte [0x4e9ce3]
add esp, 0xc
neg dl
sbb dl, dl
and dl, 0x20
neg al
sbb al, al
and al, 9
or dl, al
call fcn.0041b0d0
mov eax, dword [esp + 0x30]
push eax
push 0
push 2
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x54]
push eax
movzx eax, word [0x4e9ce0]
push eax
movzx eax, byte [0x4e9cec]
push eax
mov eax, dword [sym.imp.USER32.dll_ToUnicodeEx]
call eax
mov byte [0x4e9cec], 0
cmp byte [esp + 0x1a], 0
je 0x411273
cmp dword [0x4e7d10], 1
jne 0x411273
cmp byte [esp + 0x1b], 0
jne 0x411273
xor ebx, ebx
test esi, esi
jle 0x411203
nop
cmp byte [0x4e7d3d], 0
movzx eax, word [esp + ebx*2 + 0x24]
push eax
je 0x411192
push dword [0x4e7d1c]
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
mov esi, eax
jmp 0x4111bc
mov esi, dword [0x4e7d1c]
call ebp
mov edi, eax
movzx eax, word [esi]
push eax
call ebp
cmp ax, di
je 0x4111bc
cmp word [esi], 0
je 0x4111c4
movzx eax, word [esi + 2]
add esi, 2
push eax
call ebp
cmp ax, di
jne 0x4111a7
test esi, esi
jne 0x411282
mov edx, dword [0x4e7d48]
cmp edx, dword [0x4e7d4c]
je 0x411203
mov eax, dword [0x4e7d44]
mov cx, word [esp + ebx*2 + 0x24]
inc ebx
mov word [eax + edx*2], cx
xor edx, edx
mov ecx, dword [0x4e7d48]
mov eax, dword [0x4e7d44]
inc ecx
mov dword [0x4e7d48], ecx
mov word [eax + ecx*2], dx
cmp ebx, dword [esp + 0x1c]
jl 0x411170
xor esi, esi
cmp byte [0x4e7d41], 0
je 0x4112da
cmp byte [0x4e7d3d], 0
je 0x4112a7
cmp dword [0x4e7d2c], esi
jbe 0x411254
mov edi, dword [sym.imp.VCRUNTIME140.dll_wcsstr]
nop dword [eax]
mov eax, dword [0x4e7d28]
push dword [eax + esi*4]
push dword [0x4e7d44]
call edi
add esp, 8
test eax, eax
jne 0x411373
inc esi
cmp esi, dword [0x4e7d2c]
jb 0x411230
mov eax, dword [0x4e7d48]
mov edx, 5
mov ecx, dword [0x4e7d10]
cmp eax, dword [0x4e7d4c]
cmovge ecx, edx
mov dword [0x4e7d10], ecx
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16c
ret
mov cx, word [esp + ebx*2 + 0x24]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov dword [0x4e7d10], 4
mov word [0x4e7d24], cx
pop ebx
add esp, 0x16c
ret
cmp dword [0x4e7d2c], esi
jbe 0x411254
nop
mov edx, dword [0x4e7d28]
mov ecx, dword [0x4e7d44]
mov edx, dword [edx + esi*4]
call fcn.0049cc80
test eax, eax
jne 0x411373
inc esi
cmp esi, dword [0x4e7d2c]
jb 0x4112b0
jmp 0x411254
cmp byte [0x4e7d3d], 0
je 0x41133f
mov edi, dword [0x4e7d2c]
test edi, edi
je 0x411254
mov ebx, dword [0x4e7d44]
mov ebp, dword [0x4e7d28]
nop dword [eax]
mov ecx, dword [ebp + esi*4]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41132c
test dx, dx
je 0x411328
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41132c
add eax, 4
add ecx, 4
test dx, dx
jne 0x411306
xor eax, eax
jmp 0x411331
sbb eax, eax
or eax, 1
test eax, eax
je 0x411373
inc esi
cmp esi, edi
jb 0x411300
jmp 0x411254
cmp dword [0x4e7d2c], esi
jbe 0x411254
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [0x4e7d28]
push dword [eax + esi*4]
push dword [0x4e7d44]
call edi
test eax, eax
je 0x411373
inc esi
cmp esi, dword [0x4e7d2c]
jb 0x411351
jmp 0x411254
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov dword [0x4e7d10], 3
pop ebx
add esp, 0x16c
ret