Function at 0x49a840
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov eax, dword [0x99c228]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
jne 0x49a8d2
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
mov edi, 1
push ebx
mov dword [0x99c228], edi
call esi
cmp eax, 7
jne 0x49a89b
push edi
call esi
cmp eax, 2
jne 0x49a887
mov dword [0x99c22c], edi
pop edi
mov dword [0x574c08], ebx
pop esi
pop ebx
jmp 0x49aac0
mov dword [0x574c08], edi
pop edi
mov dword [0x99c22c], ebx
pop esi
pop ebx
jmp 0x49a900
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0x3ff
cmp eax, 7
je 0x49a8c6
cmp eax, 0xc
je 0x49a8c6
cmp eax, 0x13
je 0x49a8c6
cmp eax, 0xa
je 0x49a8c6
cmp eax, 0x10
mov dword [0x574c08], edi
jne 0x49a8cc
mov dword [0x574c08], ebx
mov dword [0x99c22c], ebx
cmp dword [0x574c08], ebx
je 0x49a8e2
pop edi
pop esi
pop ebx
jmp 0x49a900
cmp dword [0x99c22c], ebx
je 0x49a8f2
pop edi
pop esi
pop ebx
jmp 0x49aac0
pop edi
pop esi
pop ebx
jmp 0x49ac80
xor eax, eax
mov al, byte [esp + 6]
cmp eax, 0x7f
jle 0x49a90e
xor eax, eax
ret
mov ecx, dword [esp + 4]
xor edx, edx
mov dl, byte [eax + 0x574b08]
shr ecx, 0x18
and ecx, 1
mov eax, edx
test ecx, ecx
jne 0x49a978
lea ecx, [eax - 0x84]
cmp ecx, 0xf
ja case.0x49a98b.19
jmp dword [ecx*4 + 0x49a9b8]
mov eax, 0xa3
ret
mov eax, 0xa4
ret
mov eax, 0xa5
ret
mov eax, 0xa6
ret
mov eax, 0xa8
ret
mov eax, 0xa9
ret
mov eax, 0xaa
ret
mov eax, 0xab
ret
mov eax, 0xad
ret
mov eax, 0xae
ret
lea ecx, [eax - 0xd]
cmp ecx, 0xa5
ja case.0x49a98b.19
xor edx, edx
mov dl, byte [ecx + 0x49aa14]
jmp dword [edx*4 + 0x49a9f8]
mov eax, 0xb2
ret
mov eax, 0xac
ret
mov eax, 0xaf
ret
mov eax, 0xb1
ret
mov eax, 0x8c
ret
mov eax, 0x8b
ret
xor eax, eax
mov al, byte [esp + 6]
cmp eax, 0x7f
jle 0x49aace
xor eax, eax
ret
mov ecx, dword [esp + 4]
xor edx, edx
mov dl, byte [eax + 0x574b88]
shr ecx, 0x18
and ecx, 1
mov eax, edx
test ecx, ecx
jne 0x49ab38
lea ecx, [eax - 0x84]
cmp ecx, 0xf
ja case.0x49ab4b.19
jmp dword [ecx*4 + 0x49ab78]
mov eax, 0xa3
ret
mov eax, 0xa4
ret
mov eax, 0xa5
ret
mov eax, 0xa6
ret
mov eax, 0xa8
ret
mov eax, 0xa9
ret
mov eax, 0xaa
ret
mov eax, 0xab
ret
mov eax, 0xad
ret
mov eax, 0xae
ret
lea ecx, [eax - 0xd]
cmp ecx, 0xa5
ja case.0x49ab4b.19
xor edx, edx
mov dl, byte [ecx + 0x49abd4]
jmp dword [edx*4 + 0x49abb8]
mov eax, 0xb2
ret
mov eax, 0xac
ret
mov eax, 0xaf
ret
mov eax, 0xb1
ret
mov eax, 0x8c
ret
mov eax, 0x8b
ret
push esi
mov esi, dword [esp + 8]
sar esi, 0x10
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
and esi, 0x7f
push 1
push esi
call edi
lea ecx, [eax - 8]
cmp ecx, 0x9b
ja case.0x49acae.58
xor edx, edx
mov dl, byte [ecx + 0x49af60]
jmp dword [edx*4 + 0x49ae94]
pop edi
mov eax, 0xd
pop esi
ret
pop edi
mov eax, 0x7f
pop esi
ret
pop edi
mov eax, 0x89
pop esi
ret
pop edi
mov eax, 0x8c
pop esi
ret
pop edi
mov eax, 0x8a
pop esi
ret
pop edi
mov eax, 0x8d
pop esi
ret
pop edi
mov eax, 0x88
pop esi
ret
pop edi
mov eax, 0x81
pop esi
ret
pop edi
mov eax, 0x84
pop esi
ret
pop edi
mov eax, 0x85
pop esi
ret
pop edi
mov eax, 0x86
pop esi
ret
pop edi
mov eax, 0x87
pop esi
ret
pop edi
mov eax, 0x92
pop esi
ret
pop edi
mov eax, 0x91
pop esi
ret
pop edi
mov eax, 0x90
pop esi
ret
pop edi
mov eax, 0x93
pop esi
ret
pop edi
mov eax, 0x8e
pop esi
ret
pop edi
mov eax, 0x8f
pop esi
ret
pop edi
mov eax, 0x94
pop esi
ret
pop edi
mov eax, 0x95
pop esi
ret
pop edi
mov eax, 0x96
pop esi
ret
pop edi
mov eax, 0x97
pop esi
ret
pop edi
mov eax, 0x98
pop esi
ret
pop edi
mov eax, 0x99
pop esi
ret
pop edi
mov eax, 0x9a
pop esi
ret
pop edi
mov eax, 0x9b
pop esi
ret
pop edi
mov eax, 0x9c
pop esi
ret
pop edi
mov eax, 0x9d
pop esi
ret
pop edi
mov eax, 0x9e
pop esi
ret
pop edi
mov eax, 0x9f
pop esi
ret
pop edi
mov eax, 0x83
pop esi
ret
pop edi
mov eax, 0xad
pop esi
ret
pop edi
mov eax, 0xa9
pop esi
ret
pop edi
mov eax, 0xaa
pop esi
ret
pop edi
mov eax, 0xab
pop esi
ret
pop edi
mov eax, 0xa6
pop esi
ret
pop edi
mov eax, 0xa7
pop esi
ret
pop edi
mov eax, 0xa8
pop esi
ret
pop edi
mov eax, 0xa3
pop esi
ret
pop edi
mov eax, 0xa4
pop esi
ret
pop edi
mov eax, 0xa5
pop esi
ret
pop edi
mov eax, 0xb3
pop esi
ret
pop edi
mov eax, 0xb1
pop esi
ret
pop edi
mov eax, 0xb4
pop esi
ret
pop edi
mov eax, 0xb0
pop esi
ret
pop edi
mov eax, 0xae
pop esi
ret
pop edi
mov eax, 0xaf
pop esi
ret
pop edi
mov eax, 0xec
pop esi
ret
pop edi
mov eax, 0xed
pop esi
ret
pop edi
mov eax, 0xee
pop esi
ret
push 2
push eax
call edi
mov edi, eax
mov eax, dword [0x5879dc]
and edi, 0xff
cmp eax, 1
jle 0x49ae69
push 1
push edi
call fcn.00535508
add esp, 8
jmp 0x49ae74
mov eax, dword [str.________________________________H]
mov al, byte [eax + edi*2]
and eax, 1
test eax, eax
je 0x49ae83
push edi
call fcn.005356be
add esp, 4
mov edi, eax
cmp esi, 0x29
jne 0x49ae8d
mov edi, 0x60
mov eax, edi
pop edi
pop esi
ret