Function at 0x41f6c0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x480
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x47c], eax
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp dword [esp + 0x4a4], 0
mov edi, eax
jne 0x41f704
mov eax, 1
pop edi
mov ecx, dword [esp + 0x47c]
xor ecx, esp
call fcn.00524d83
add esp, 0x480
ret
mov ecx, dword [esp + 0x490]
push ebp
cmp ecx, 0x40
ja 0x41fa34
mov eax, dword [esp + 0x498]
cmp eax, 0x40
ja 0x41fa34
cmp dword [esp + 0x48c], 0
je 0x41fa34
mov ebp, dword [esp + 0x490]
test ebp, ebp
je 0x41fa34
push ebx
mov ebx, dword [esp + 0x4a8]
push esi
push 0x180
mov dword [esp + 0x28], ecx
mov ecx, dword [0x5c5de0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x4a8]
lea edx, [esp + 0x34]
push 0
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], eax
mov dword [esp + 0x33c], ebx
mov dword [esp + 0x434], ecx
call fcn.00526520
push 0x180
lea eax, [esp + 0x1c0]
push 0
push eax
call fcn.00526520
push 0xf4
lea ecx, [esp + 0x350]
push 0
push ecx
call fcn.00526520
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyExW]
xor eax, eax
add esp, 0x24
push edi
push eax
push 0x90
mov dword [esp + 0x438], eax
mov dword [esp + 0x43c], eax
mov dword [esp + 0x440], eax
mov dword [esp + 0x444], eax
mov dword [esp + 0x448], eax
mov dword [esp + 0x44c], eax
mov dword [esp + 0x450], eax
mov dword [esp + 0x454], eax
call esi
push edi
push 0
push 0x10
mov word [esp + 0x446], ax
call esi
push edi
push 0
push 0xa0
mov word [esp + 0x43a], ax
call esi
push edi
push 0
push 0xa1
mov word [esp + 0x43c], ax
call esi
push edi
push 0
push 0x11
mov word [esp + 0x43e], ax
call esi
push edi
push 0
push 0xa2
mov word [esp + 0x440], ax
call esi
push edi
push 0
push 0xa3
mov word [esp + 0x442], ax
call esi
push edi
push 0
push 0x12
mov word [esp + 0x444], ax
call esi
push edi
push 0
push 0xa4
mov word [esp + 0x448], ax
call esi
push edi
push 0
push 0xa5
mov word [esp + 0x44a], ax
call esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x90
mov word [esp + 0x444], ax
call esi
test al, 1
jle 0x41f8ba
or word [esp + 0x42c], 4
push 0x10
call esi
mov edx, 0x8000
test dx, ax
jbe 0x41f8d1
or word [esp + 0x42c], 1
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jbe 0x41f8e8
or word [esp + 0x42c], 2
push 0x12
call esi
mov edx, 0x8000
test dx, ax
jbe 0x41f8ff
or word [esp + 0x42c], 8
mov ecx, dword [esp + 0x494]
lea edx, [esp + 0x30]
sub ecx, edx
mov edx, ebp
lea esi, [esp + 0x30]
xor eax, eax
sub edx, esi
jmp 0x41f920
lea esi, [ecx + eax*2]
movzx esi, word [esp + esi + 0x30]
mov word [esp + eax*2 + 0x30], si
lea esi, [edx + eax*2]
movzx esi, word [esp + esi + 0x30]
mov word [esp + eax*2 + 0x1b0], si
inc eax
cmp eax, 0xc0
jb 0x41f920
test ebx, ebx
jbe 0x41f962
mov eax, dword [esp + 0x4a8]
push ebx
push eax
lea ecx, [esp + 0x33c]
push ecx
call fcn.005257e0
add esp, 0xc
lea edx, [esp + 0x44c]
push edx
call fcn.0041f620
mov eax, dword [str.LOCOS97]
mov ecx, dword [0x5533e4]
mov dl, byte [0x5533e8]
add esp, 4
push 0
push 0x80
push 3
push 0
push 0
mov dword [esp + 0x28], eax
push 0xc0000000
lea eax, [esp + 0x464]
push eax
mov dword [esp + 0x34], ecx
mov byte [esp + 0x38], dl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41f9fc
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x438
lea edx, [esp + 0x20]
push edx
push 0x438
mov eax, edx
push eax
push 0x72159
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
lea ecx, [esp + 0x18]
push str.LS06CXX
push ecx
call fcn.00526c61
add esp, 0xc
test eax, eax
je 0x41fa17
xor eax, eax
pop esi
pop ebx
pop ebp
pop edi
mov ecx, dword [esp + 0x47c]
xor ecx, esp
call fcn.00524d83
add esp, 0x480
ret
mov al, byte [esp + 0x1c]
cmp al, 1
jne 0x41fa26
mov eax, 2
jmp 0x41f9fe
xor edx, edx
test al, al
setne dl
dec edx
and edx, edi
mov eax, edx
jmp 0x41f9fe
mov ecx, dword [esp + 0x484]
pop ebp
pop edi
xor ecx, esp
xor eax, eax
call fcn.00524d83
add esp, 0x480
ret