Function at 0x412b58
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov bl, byte [ebp + 0xc]
movzx ax, bl
or eax, dword [ebp + 0x10]
test ax, ax
je 0x41305f
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
jne 0x412b85
mov dword [ebp + 0x1c], 0xffc3d44d
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
cmp eax, dword [0x466248]
mov eax, dword [0x468480]
sete byte [ebp - 1]
cmp eax, edi
je 0x412baa
cmp byte [ebp - 1], 0
mov byte [ebp - 2], 1
je 0x412bae
mov byte [ebp - 2], 0
cmp eax, 1
je 0x412bb9
cmp byte [ebp - 1], 0
je 0x412bbd
mov byte [ebp + 0x18], 0
test bl, bl
jne 0x412bd0
push dword [ebp + 0x10]
call fcn.00413c3a
mov bl, al
mov byte [ebp + 0xc], bl
jmp 0x412be3
cmp word [ebp + 0x10], di
jne 0x412be4
push edi
push dword [ebp + 0xc]
call fcn.00413cfd
pop ecx
mov dword [ebp + 0x10], eax
pop ecx
mov al, byte [ebp + 0x11]
neg al
sbb eax, eax
neg eax
cmp dword [0x468480], 2
mov dword [ebp - 0x10], eax
je 0x412c02
cmp byte [0x467399], 0
je 0x412c23
cmp bl, 0xa0
jb 0x412c23
cmp bl, 0xa1
jbe 0x412c1e
cmp bl, 0xa3
jbe 0x412c1a
cmp bl, 0xa5
ja 0x412c23
mov bl, 0x12
jmp 0x412c20
mov bl, 0x11
jmp 0x412c20
mov bl, 0x10
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x14], edi
je 0x412d4c
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00413062
add esp, 0xc
test al, al
je 0x412ce6
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [ebp + 8], edi
mov cl, 0x80
mov dl, 0x7f
jne 0x412c67
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
or byte [eax], cl
jmp 0x412c79
cmp dword [ebp + 8], 1
jne 0x412c79
movzx eax, bl
lea eax, [ebp + eax - 0x11c]
and byte [eax], dl
cmp bl, 0xa0
jb 0x412cd9
cmp bl, 0xa1
jbe 0x412cc1
cmp bl, 0xa3
jbe 0x412ca7
cmp bl, 0xa5
ja 0x412cd9
test byte [ebp - 0x78], cl
jne 0x412c9f
test byte [ebp - 0x77], cl
jne 0x412c9f
and byte [ebp - 0x10a], dl
jmp 0x412cd9
or byte [ebp - 0x10a], cl
jmp 0x412cd9
test byte [ebp - 0x7a], cl
jne 0x412cb9
test byte [ebp - 0x79], cl
jne 0x412cb9
and byte [ebp - 0x10b], dl
jmp 0x412cd9
or byte [ebp - 0x10b], cl
jmp 0x412cd9
test byte [ebp - 0x7c], cl
jne 0x412cd3
test byte [ebp - 0x7b], cl
jne 0x412cd3
and byte [ebp - 0x10c], dl
jmp 0x412cd9
or byte [ebp - 0x10c], cl
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, word [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
shl esi, 0x10
cmp dword [ebp + 8], 1
je 0x412d0d
mov eax, esi
or eax, 1
push eax
movzx eax, bl
push eax
push pe_nt_image_headers32
push dword [ebp + 0x14]
call edi
cmp byte [ebp + 0x18], 0
je 0x412d27
cmp dword [ebp + 8], 2
jne 0x412d27
mov eax, dword [0x464108]
push dword [eax + 0x64]
call fcn.00412227
pop ecx
cmp dword [ebp + 8], 0
je 0x41303a
movzx eax, byte [ebp + 0xc]
or esi, 0xc0000001
push esi
push eax
push 0x101
push dword [ebp + 0x14]
call edi
jmp 0x41303a
cmp byte [0x466c8a], 0
mov eax, dword [ebp + 8]
mov dword [0x468424], eax
mov byte [0x468428], bl
je 0x412dd6
cmp bl, 0x12
je 0x412d72
cmp bl, 0xa4
je 0x412d72
cmp bl, 0xa5
jne 0x412dd6
cmp byte [0x46739b], 0
je 0x412dd6
call esi
cmp eax, dword [0x466c9c]
jne 0x412dd6
push edi
mov byte [ebp - 5], 1
call fcn.0041aa2f
pop ecx
cmp byte [ebp - 1], 0
lea esi, [ebp - 0x1c]
jne 0x412d9e
mov esi, 0x46841c
cmp bl, 0xa5
mov dword [ebp - 0xc], esi
jne 0x412db8
cmp byte [ebp - 2], 0
jne 0x412db8
cmp dword [0x466388], edi
mov byte [ebp - 3], 1
jne 0x412dbc
mov byte [ebp - 3], 0
mov al, byte [ebp - 3]
test al, al
mov byte [ebp - 4], al
je 0x412e0f
cmp byte [ebp - 1], 0
jne 0x412ddc
mov eax, dword [0x468420]
mov dword [ebp - 0x14], eax
jmp 0x412e07
mov byte [ebp - 5], 0
jmp 0x412d90
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
je 0x412df0
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x412df2
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edi
push eax
mov dword [ebp - 0x14], eax
call fcn.0041313b
pop ecx
pop ecx
mov dword [esi], eax
cmp dword [esi], edi
je 0x412e2e
mov byte [ebp - 4], 0
mov bl, byte [ebp + 0xf]
xor edi, edi
cmp byte [ebp - 2], 0
je 0x412e5c
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00413062
add esp, 0xc
mov byte [ebp - 0x18], al
jmp 0x412e60
cmp byte [0x4673a1], 0
sete bl
dec bl
and bl, 0x91
add bl, 0x11
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x1c]
mov dword [0x46637c], eax
jmp 0x412e12
mov byte [ebp - 0x18], 0
cmp byte [ebp - 1], 0
jne 0x412e83
mov eax, dword [0x468480]
cmp eax, 2
je 0x412e83
cmp dword [0x466388], edi
je 0x412e7d
cmp eax, 1
jne 0x412e83
mov byte [ebp - 1], 1
jmp 0x412e87
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
je 0x412f51
cmp byte [ebp - 2], 0
je 0x412eb6
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00411bc9
add esp, 0x14
jmp 0x412f28
cmp byte [ebp - 3], 0
je 0x412ecc
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x412ecc
mov eax, dword [ebp + 0x1c]
mov dword [0x466380], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x466380], edi
je 0x412f28
cmp dword [0x46637c], edi
mov byte [ebp - 4], 0
je 0x412efc
mov dword [0x46637c], edi
push 4
jmp 0x412f19
cmp byte [ebp - 6], 0
jne 0x412f28
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
add eax, 4
push eax
push dword [ebp - 0x14]
call fcn.0041313b
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp + 0xc], 0x90
jne 0x412f3c
cmp byte [0x467399], 0
je 0x412f3c
call fcn.00415a2b
cmp byte [ebp - 1], 0
je 0x412f51
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00415a54
add esp, 0xc
cmp byte [ebp + 0x18], 0
je 0x412f7a
cmp dword [ebp + 8], 2
jne 0x412f7a
cmp dword [0x468480], 2
mov eax, dword [0x464108]
jne 0x412f70
mov eax, dword [eax + 0x68]
jmp 0x412f73
mov eax, dword [eax + 0x64]
push eax
call fcn.00412227
pop ecx
cmp dword [ebp + 8], edi
je 0x41302c
or dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
je 0x412fa6
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00411bc9
add esp, 0x14
jmp 0x413016
cmp byte [ebp - 3], 0
je 0x412fbc
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jne 0x412fbc
mov eax, dword [ebp + 0x1c]
mov dword [0x466384], eax
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 4], 0
mov dword [0x466384], edi
je 0x413016
cmp dword [0x46637c], edi
je 0x412fe8
mov dword [0x46637c], edi
push 4
jmp 0x413007
cmp byte [ebp - 6], 0
je 0x413016
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
neg eax
add eax, 3
push eax
push dword [ebp - 0x14]
call fcn.0041313b
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp byte [ebp - 1], 0
je 0x41302c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
call fcn.00415a54
add esp, 0xc
cmp byte [ebp - 5], 0
je 0x41303a
push 1
call fcn.0041aa2f
pop ecx
cmp byte [ebp + 0x18], 0
pop edi
pop esi
je 0x41305f
cmp dword [0x468480], 2
mov eax, dword [0x464108]
jne 0x413055
mov eax, dword [eax + 0x60]
jmp 0x413058
mov eax, dword [eax + 0x5c]
push eax
call fcn.00412227
pop ecx
pop ebx
leave
ret