Function at 0x40bbd0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x168
push ebx
push esi
mov esi, dword [0x4de090]
mov bh, dl
mov edx, dword [0x4dc230]
mov dword [esp + 0x24], ecx
cmp esi, 1
jne 0x40bc08
cmp byte [0x4de0c0], 0
jne 0x40bc08
movzx eax, bh
lea eax, [eax + eax*4]
cmp dword [edx + eax*4], 0
jne 0x40bc08
xor cl, cl
jmp 0x40bc0a
mov cl, 1
cmp byte [esp + 0x178], 0
mov byte [esp + 9], cl
je 0x40bc39
movzx eax, bh
mov esi, 1
movzx ecx, cl
lea eax, [eax + eax*4]
cmp byte [edx + eax*4 + 8], 0
cmovne ecx, esi
pop esi
mov al, cl
pop ebx
add esp, 0x168
ret
cmp dword [0x4dc25c], 0
mov al, byte [esp + 0x17c]
je 0x40bc55
test al, al
jne 0x40bc55
test cl, cl
je 0x40bc55
mov dl, 1
jmp 0x40bc57
xor dl, dl
mov bl, byte [0x4dc212]
mov byte [esp + 0xc], dl
push ebp
push edi
cmp esi, 1
jne 0x40bd58
cmp byte [0x4de0be], 0
je 0x40bc7d
test al, al
jne 0x40bd58
mov ch, 1
mov byte [esp + 0x12], ch
cmp bh, 0xe7
je 0x40bcce
mov eax, dword [0x4de094]
mov edi, dword [0x4de098]
mov bp, word [esp + 0x17c]
movzx ecx, bh
mov al, byte [ecx + eax]
test al, al
jne 0x40bcaf
movzx eax, bp
mov al, byte [eax + edi]
test al, al
je 0x40bcca
mov cl, al
shr al, 2
shr cl, 1
and al, 1
and cl, 1
je 0x40bcf1
test al, al
jne 0x40bcfa
test bl, 0x30
jne 0x40bcfa
test al, al
jne 0x40bcf5
mov ch, byte [esp + 0x12]
movzx eax, bh
mov dword [esp + 0x30], eax
add eax, 0xffffffdf
cmp eax, 0x84
ja case.0x40bcea.41
movzx eax, byte [eax + 0x40c738]
jmp dword [eax*4 + 0x40c72c]
test al, al
je 0x40bcfa
test bl, 0x30
jne 0x40bcca
movzx eax, bp
mov esi, 4
mov dword [0x4de090], esi
cmp byte [eax + edi], 0
mov byte [0x4de0a0], bh
setne byte [0x4de0a6]
mov word [0x4de0a2], bp
xor eax, eax
mov word [0x4de0a4], ax
test cl, cl
je 0x40bd38
mov byte [0x4de0a7], 1
test bl, 0x30
jne 0x40bd3d
mov byte [0x4de0a7], al
test dl, dl
jne 0x40bcca
cmp byte [0x4df810], al
jne 0x40bcca
mov al, byte [esp + 0x11]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x168
ret
xor ch, ch
mov byte [esp + 0x12], ch
jmp 0x40bcce
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
add esp, 0x168
ret
test dl, dl
je case.0x40bcea.41
mov edx, dword [0x4db8fc]
test edx, edx
je 0x40bd96
xor eax, eax
xor edx, edx
mov word [0x4db900], ax
mov dword [0x4db8fc], edx
jmp 0x40bd96
mov edx, dword [0x4db8fc]
test bl, bl
je 0x40bdcb
cmp esi, 1
jne 0x40bda8
cmp byte [0x4de0bf], 0
jne 0x40bdcb
cmp bl, 0x10
je 0x40bdcb
cmp bl, 0x20
je 0x40bdcb
cmp bl, 0x30
je 0x40bdcb
test bl, 0xc
setne cl
test bl, 3
setne al
test al, cl
je 0x40c616
cmp bh, 8
jne 0x40be33
test bl, bl
jne 0x40be33
test ch, ch
je 0x40be01
cmp esi, 1
jne 0x40be01
cmp byte [0x4de0bc], bl
je 0x40be01
mov ecx, dword [0x4de0c8]
test ecx, ecx
je 0x40be01
mov eax, dword [0x4de0c4]
dec ecx
xor esi, esi
mov dword [0x4de0c8], ecx
mov word [eax + ecx*2], si
cmp byte [esp + 0x14], 0
je 0x40be1d
test edx, edx
je 0x40be1d
dec edx
xor eax, eax
mov dword [0x4db8fc], edx
mov word [edx*2 + 0x4db900], ax
mov al, byte [esp + 0x11]
pop edi
pop ebp
pop esi
mov byte [0x4df810], 0
pop ebx
add esp, 0x168
ret
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov edx, ebp
call fcn.004168c0
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [esp + 0x28], eax
cmp dword [0x4df80c], ebp
je 0x40be8d
push 0x1c
lea eax, [esp + 0x144]
mov dword [0x4df80c], ebp
push eax
push ebp
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0x140]
push str.ApplicationFrameWindow
push eax
call fcn.0049466a
add esp, 8
test eax, eax
sete al
mov byte [0x4df808], al
jmp 0x40be92
mov al, byte [0x4df808]
mov bl, byte [0x4df810]
lea edi, [esp + 0x40]
mov ecx, 0x40
mov esi, 0x4dc110
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_ToUnicodeEx]
test bl, bl
je 0x40bf2d
test al, al
je 0x40bf2d
cmp bh, 0xe7
je 0x40bf2d
mov dl, byte [0x4df806]
lea ecx, [esp + 0x40]
mov al, byte [0x4df807]
neg dl
sbb dl, dl
and dl, 0x20
neg al
sbb al, al
and al, 9
or dl, al
call fcn.00416440
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x18]
push edi
push 0
push 2
push eax
lea eax, [esp + 0x50]
push eax
movzx eax, word [0x4df804]
push eax
movzx eax, bl
push eax
call esi
test eax, eax
jle 0x40bf24
push edi
push 0
push 2
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x50]
push eax
movzx eax, word [0x4df804]
push eax
movzx eax, byte [0x4df810]
push eax
call esi
mov byte [0x4df810], 0
jmp 0x40bf31
mov edi, dword [esp + 0x28]
mov dl, byte [0x4dc212]
lea ecx, [esp + 0x40]
call fcn.00416440
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x40bf53
or byte [esp + 0x54], 1
jmp 0x40bf58
and byte [esp + 0x54], 0xfe
mov esi, dword [esp + 0x30]
cmp bh, 0xe7
jne 0x40bf80
mov ax, word [esp + 0x17c]
mov ecx, 1
mov edi, dword [esp + 0x2c]
mov dx, ax
mov dword [esp + 0x24], ecx
mov word [esp + 0x18], dx
jmp 0x40bfc2
xor eax, eax
cmp dword [0x4db444], eax
push edi
mov edi, dword [esp + 0x30]
setne al
push eax
push 2
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x50]
push eax
push dword [edi + 4]
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov ecx, eax
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x40c616
mov dx, word [esp + 0x18]
mov ax, word [esp + 0x17c]
cmp byte [0x4df810], 0
setne byte [esp + 0x23]
test ecx, ecx
jns 0x40c03b
mov bl, byte [esp + 0x11]
test bl, bl
je 0x40c02e
mov word [0x4df804], ax
mov al, byte [0x4dc212]
test al, 0x30
mov byte [0x4df810], bh
setne byte [0x4df806]
test al, 0xc
setne cl
test al, 3
setne al
test al, cl
mov eax, dword [esp + 0x28]
push eax
setne byte [0x4df807]
xor eax, eax
cmp dword [0x4db444], eax
setne al
push eax
push 2
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x50]
push eax
push dword [edi + 4]
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
add esp, 0x168
ret
test byte [0x4dc212], 3
jne 0x40c063
mov eax, 0xa
cmp dx, 0xd
jne 0x40c056
mov edx, eax
mov word [esp + 0x18], dx
cmp word [esp + 0x1a], 0xd
jne 0x40c063
mov word [esp + 0x1a], ax
xor bl, bl
mov byte [esp + 0x13], bl
cmp byte [esp + 0x14], bl
je 0x40c445
cmp ebp, dword [0x4db8f8]
je 0x40c08d
xor eax, eax
mov dword [0x4db8f8], ebp
mov word [0x4db900], ax
xor ecx, ecx
jmp 0x40c0e1
mov ecx, dword [0x4db8fc]
mov eax, 0x5a
sub eax, ecx
cmp eax, 3
jge 0x40c0e1
mov ecx, 0x4db95a
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c0a7
sub ecx, edx
sar ecx, 1
mov dword [0x4db8fc], ecx
lea eax, [ecx*2 + 2]
push eax
push 0x4db95a
push 0x4db900
call fcn.00492730
mov dx, word [esp + 0x24]
add esp, 0xc
mov ecx, dword [0x4db8fc]
mov ebp, dword [esp + 0x24]
mov word [ecx*2 + 0x4db900], dx
inc ecx
mov dword [0x4db8fc], ecx
cmp ebp, 1
jle 0x40c10d
mov ax, word [esp + 0x1a]
mov word [ecx*2 + 0x4db900], ax
inc ecx
mov dword [0x4db8fc], ecx
xor eax, eax
mov word [ecx*2 + 0x4db900], ax
test ecx, ecx
je 0x40c449
xor esi, esi
mov dword [esp + 0x30], esi
cmp dword [0x4dc260], eax
jbe 0x40c449
mov eax, dword [0x4dc25c]
mov ebp, dword [eax + esi*4]
mov dword [esp + 0x3c], ebp
cmp byte [ebp + 0x23], 0
jne 0x40c25f
cmp byte [ebp + 0x2a], 0
movzx eax, byte [ebp + 0x22]
je 0x40c186
cmp ecx, eax
jle 0x40c25f
movzx eax, word [ecx*2 + 0x4db8fe]
push eax
push str._____:____.___n__t
call fcn.00492ca4
add esp, 8
test eax, eax
je 0x40c259
mov ecx, dword [0x4db8fc]
lea ebx, [ecx*2 + 0x4db8fc]
jmp 0x40c195
cmp ecx, eax
jl 0x40c25f
lea ebx, [ecx*2 + 0x4db8fe]
cmp byte [ebp + 0x26], 0
movzx eax, byte [ebp + 0x22]
mov edx, dword [ebp + 8]
lea edi, [eax - 1]
lea edi, [edx + edi*2]
je 0x40c1c4
cmp edi, edx
jb 0x40c201
nop dword [eax]
mov ax, word [ebx]
cmp ax, word [edi]
jne 0x40c201
sub edi, 2
sub ebx, 2
cmp edi, edx
jae 0x40c1b0
jmp 0x40c201
cmp edi, edx
jb 0x40c201
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
movzx ecx, word [ebx]
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_CharLowerW]
push ecx
call eax
cmp ax, si
jne 0x40c1f7
sub edi, 2
sub ebx, 2
cmp edi, dword [ebp + 8]
jae 0x40c1d0
mov ecx, dword [0x4db8fc]
mov esi, dword [esp + 0x30]
cmp edi, dword [ebp + 8]
jae 0x40c25f
cmp byte [ebp + 0x2b], 0
jne 0x40c24a
cmp ebx, 0x4db900
jb 0x40c24a
movzx eax, word [ebx]
push eax
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x40c259
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x3c]
push eax
push 4
push 0x400
call dword [sym.imp.KERNEL32.dll_GetStringTypeExW]
test eax, eax
je 0x40c24a
test byte [esp + 0x14], 1
jne 0x40c259
mov edx, dword [ebp + 4]
mov ecx, dword [ebp + 0x10]
call fcn.0040e7b0
test eax, eax
jne 0x40c275
mov ecx, dword [0x4db8fc]
inc esi
mov dword [esp + 0x30], esi
cmp esi, dword [0x4dc260]
jb 0x40c131
jmp 0x40c441
mov eax, dword [esp + 0x188]
mov edx, dword [esp + 0x2c]
add eax, 4
mov cl, byte [ebp + 0x21]
push eax
mov edx, dword [edx + 0x10]
call fcn.0040f300
add esp, 4
test al, al
je 0x40c441
cmp byte [ebp + 0x27], 0
mov edx, dword [0x4db8fc]
je 0x40c3ac
cmp byte [ebp + 0x2a], 0
lea eax, [edx*2 + 0x4db900]
lea ecx, [eax - 2]
mov byte [esp + 0x14], 0
cmove ecx, eax
movzx eax, byte [ebp + 0x22]
add eax, eax
mov dword [esp + 0x38], ecx
mov esi, ecx
xor edi, edi
sub esi, eax
xor bl, bl
inc eax
shr eax, 1
cmp esi, ecx
cmova eax, edi
mov dword [esp + 0x34], eax
test eax, eax
je 0x40c3ac
xor ebp, ebp
nop dword [eax + eax]
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x40c30c
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
je 0x40c330
cmp byte [esp + 0x14], 0
jne 0x40c32f
movzx eax, word [esi]
push eax
mov byte [esp + 0x18], 1
call dword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
inc ebp
inc edi
add esi, 2
cmp edi, dword [esp + 0x34]
jb 0x40c2f0
mov dword [esp + 0x2c], ebp
test ebp, ebp
mov ebp, dword [esp + 0x3c]
je 0x40c3a6
cmp dword [esp + 0x2c], 1
jne 0x40c361
mov edx, dword [0x4db8fc]
xor edi, edi
test bl, bl
mov eax, 2
cmovne edi, eax
jmp 0x40c3ae
test bl, bl
je 0x40c3a6
movzx eax, byte [ebp + 0x22]
mov edi, 2
mov ebx, dword [esp + 0x38]
add eax, eax
mov esi, ebx
sub esi, eax
cmp esi, ebx
jae 0x40c396
nop dword [eax]
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x40c394
add esi, edi
cmp esi, ebx
jb 0x40c380
cmp esi, ebx
mov edx, dword [0x4db8fc]
mov eax, 1
cmove edi, eax
jmp 0x40c3ae
mov edx, dword [0x4db8fc]
xor edi, edi
mov bh, byte [ebp + 0x28]
test bh, bh
jne 0x40c3ba
cmp byte [ebp + 0x29], bh
je 0x40c3c5
xor bl, bl
mov byte [esp + 0x13], 1
mov byte [esp + 0x11], bl
mov eax, dword [esp + 0x18c]
mov bl, byte [ebp + 0x2a]
mov ecx, dword [esp + 0x30]
mov dword [eax], ecx
test bl, bl
je 0x40c3e3
movzx eax, word [edx*2 + 0x4db8fe]
jmp 0x40c3e5
xor eax, eax
movzx ecx, di
shl ecx, 0x10
movzx eax, ax
or ecx, eax
cmp dword [ebp + 0xc], 0
mov eax, dword [esp + 0x190]
mov dword [eax], ecx
je 0x40c41c
test bl, bl
je 0x40c418
mov ax, word [edx*2 + 0x4db8fe]
mov edx, 1
mov word [0x4db900], ax
jmp 0x40c42b
xor edx, edx
jmp 0x40c42b
test bh, bh
je 0x40c42b
movzx eax, byte [ebp + 0x22]
sub edx, eax
test bl, bl
je 0x40c42b
dec edx
xor eax, eax
cmp byte [ebp + 0x2c], al
cmovne edx, eax
mov dword [0x4db8fc], edx
mov word [edx*2 + 0x4db900], ax
mov bl, byte [esp + 0x13]
mov ebp, dword [esp + 0x24]
cmp byte [esp + 0x23], 0
mov al, byte [esp + 0x11]
je 0x40c4c3
test al, al
je 0x40c4c3
push 0x100
lea eax, [esp + 0x44]
push 0
push eax
call fcn.00493930
mov dl, byte [0x4df806]
lea ecx, [esp + 0x4c]
mov al, byte [0x4df807]
add esp, 0xc
neg dl
sbb dl, dl
and dl, 0x20
neg al
sbb al, al
and al, 9
or dl, al
call fcn.00416440
mov eax, dword [esp + 0x28]
push eax
push 0
push 2
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x50]
push eax
movzx eax, word [0x4df804]
push eax
movzx eax, byte [0x4df810]
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov al, byte [esp + 0x11]
mov byte [0x4df810], 0
cmp byte [esp + 0x12], 0
je 0x40c61a
cmp dword [0x4de090], 1
jne 0x40c61a
test bl, bl
jne 0x40c61a
xor ebx, ebx
test ebp, ebp
jle 0x40c5a1
nop dword [eax]
cmp byte [0x4de0bd], 0
lea ebp, [esp + 0x18]
movzx eax, word [ebp + ebx*2]
lea ebp, [ebp + ebx*2]
push eax
je 0x40c519
push dword [0x4de09c]
call fcn.00492ca4
add esp, 8
mov esi, eax
jmp 0x40c55b
mov eax, dword [sym.imp.USER32.dll_CharLowerW]
mov esi, dword [0x4de09c]
call eax
movzx edi, ax
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
movzx eax, ax
cmp eax, edi
je 0x40c55b
nop word [eax + eax]
cmp word [esi], 0
je 0x40c563
movzx eax, word [esi + 2]
add esi, 2
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
movzx eax, ax
cmp eax, edi
jne 0x40c540
test esi, esi
jne 0x40c625
mov edx, dword [0x4de0c8]
cmp edx, dword [0x4de0cc]
je 0x40c5a1
mov eax, dword [0x4de0c4]
inc ebx
mov cx, word [ebp]
mov word [eax + edx*2], cx
xor edx, edx
mov ecx, dword [0x4de0c8]
mov eax, dword [0x4de0c4]
inc ecx
mov dword [0x4de0c8], ecx
mov word [eax + ecx*2], dx
cmp ebx, dword [esp + 0x24]
jl 0x40c4f0
xor esi, esi
cmp byte [0x4de0c1], 0
je 0x40c67b
cmp byte [0x4de0bd], 0
je 0x40c649
cmp dword [0x4de0ac], esi
jbe 0x40c5f7
nop word [eax + eax]
mov eax, dword [0x4de0a8]
push dword [eax + esi*4]
push dword [0x4de0c4]
call fcn.004930fb
add esp, 8
test eax, eax
jne 0x40c713
inc esi
cmp esi, dword [0x4de0ac]
jb 0x40c5d0
mov eax, dword [0x4de0c8]
mov edx, 5
mov ecx, dword [0x4de090]
cmp eax, dword [0x4de0cc]
cmovge ecx, edx
mov dword [0x4de090], ecx
mov al, byte [esp + 0x11]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x168
ret
mov ax, word [esp + ebx*2 + 0x18]
pop edi
pop ebp
pop esi
mov word [0x4de0a4], ax
mov al, byte [esp + 5]
mov dword [0x4de090], 4
pop ebx
add esp, 0x168
ret
cmp dword [0x4de0ac], esi
jbe 0x40c5f7
mov edx, dword [0x4de0a8]
mov ecx, dword [0x4de0c4]
mov edx, dword [edx + esi*4]
call fcn.00478940
test eax, eax
jne 0x40c713
inc esi
cmp esi, dword [0x4de0ac]
jb 0x40c651
jmp 0x40c5f7
cmp byte [0x4de0bd], 0
je 0x40c6df
mov edi, dword [0x4de0ac]
test edi, edi
je 0x40c5f7
mov ebx, dword [0x4de0c4]
mov ebp, dword [0x4de0a8]
nop
mov ecx, dword [ebp + esi*4]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c6cc
test dx, dx
je 0x40c6c8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c6cc
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c6a6
xor eax, eax
jmp 0x40c6d1
sbb eax, eax
or eax, 1
test eax, eax
je 0x40c713
inc esi
cmp esi, edi
jb 0x40c6a0
jmp 0x40c5f7
cmp dword [0x4de0ac], esi
jbe 0x40c5f7
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [0x4de0a8]
push dword [eax + esi*4]
push dword [0x4de0c4]
call edi
test eax, eax
je 0x40c713
inc esi
cmp esi, dword [0x4de0ac]
jb 0x40c6f1
jmp 0x40c5f7
mov al, byte [esp + 0x11]
pop edi
pop ebp
pop esi
mov dword [0x4de090], 3
pop ebx
add esp, 0x168
ret