Function at 0x406ec0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x4c8ee0]
sub esp, 0x150
push ebx
mov bl, byte [esp + 0x15c]
push ebp
mov bp, word [esp + 0x164]
push edi
mov edi, dword [0x4ca5d8]
cmp edi, 1
jne 0x406f06
cmp byte [0x4ca608], 0
jne 0x406f06
movzx eax, bl
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + ecx], 0
mov byte [esp + 0xe], 0
je 0x406f0b
mov byte [esp + 0xe], 1
cmp byte [esp + 0x16c], 0
je 0x406f39
movzx eax, bl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ecx + 4], 0
mov al, 1
jne 0x407950
mov al, byte [esp + 0xe]
pop edi
pop ebp
pop ebx
add esp, 0x150
ret
cmp dword [0x4c9ea8], 0
je 0x406f51
test dl, dl
jne 0x406f51
mov byte [esp + 0xf], 1
cmp byte [esp + 0xe], dl
jne 0x406f56
mov byte [esp + 0xf], 0
mov al, byte [0x4c84a5]
push esi
cmp edi, 1
jne 0x407038
cmp byte [0x4ca606], 0
je 0x406f76
test dl, dl
jne 0x407038
mov byte [esp + 0x14], 1
cmp bl, 0xe7
je 0x407017
mov edx, dword [0x4ca5dc]
mov esi, dword [0x4ca5e0]
movzx ecx, bl
mov cl, byte [ecx + edx]
test cl, cl
jne 0x406fa4
movzx ecx, bp
mov cl, byte [ecx + esi]
test cl, cl
je 0x407017
mov dl, cl
shr cl, 2
shr dl, 1
and cl, 1
and dl, 1
je 0x40703f
test cl, cl
jne 0x406fc7
test al, 0x30
jne 0x406fc7
test cl, cl
je 0x407017
test al, 0x30
jne 0x407017
movzx ecx, bp
mov edi, 4
mov dword [0x4ca5d8], edi
cmp byte [ecx + esi], 0
mov byte [0x4ca5e8], bl
setne cl
mov byte [0x4ca5ee], cl
xor ecx, ecx
mov word [0x4ca5ea], bp
mov word [0x4ca5ec], cx
test dl, dl
je 0x407007
mov byte [0x4ca5ef], 1
test al, 0x30
jne 0x40700d
mov byte [0x4ca5ef], cl
cmp byte [esp + 0x13], cl
je 0x40794b
movzx ebx, byte [esp + 0x168]
lea ecx, [ebx - 0x21]
cmp ecx, 0x84
ja case.0x407031.41
movzx edx, byte [ecx + 0x407968]
jmp dword [edx*4 + 0x40795c]
mov byte [esp + 0x14], 0
jmp 0x407017
test cl, cl
je 0x406fc7
jmp 0x406fc3
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x150
ret
cmp byte [esp + 0x13], 0
je case.0x407031.41
mov ecx, dword [0x4c71f4]
test ecx, ecx
je 0x40707d
xor ecx, ecx
mov word [0x4c71f8], cx
mov dword [0x4c71f4], ecx
jmp 0x40707d
mov ecx, dword [0x4c71f4]
test al, al
je 0x4070ab
cmp edi, 1
jne 0x40708f
cmp byte [0x4ca607], 0
jne 0x4070ab
cmp al, 0x10
je 0x4070ab
cmp al, 0x20
je 0x4070ab
cmp al, 0x30
je 0x4070ab
test al, 0xc
je 0x40794b
test al, 3
je 0x40794b
cmp byte [esp + 0x168], 8
jne 0x407126
test al, al
jne 0x407126
cmp byte [esp + 0x14], al
je 0x4070e7
cmp edi, 1
jne 0x4070e7
cmp byte [0x4ca604], al
je 0x4070e7
mov eax, dword [0x4ca610]
test eax, eax
je 0x4070e7
mov esi, dword [0x4ca60c]
dec eax
xor edx, edx
mov dword [0x4ca610], eax
mov word [esi + eax*2], dx
cmp byte [esp + 0x13], 0
je 0x407103
test ecx, ecx
je 0x407103
dec ecx
xor eax, eax
mov dword [0x4c71f4], ecx
mov word [ecx*2 + 0x4c71f8], ax
cmp byte [0x4cb2e4], 0
je 0x40794b
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
mov byte [0x4cb2e4], 0
pop ebx
add esp, 0x150
ret
mov ecx, 0x40
mov esi, 0x4c84c8
lea edi, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x60]
call fcn.004119e0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x407152
or byte [esp + 0x74], 1
jmp 0x407157
and byte [esp + 0x74], 0xfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
xor esi, esi
test ebp, ebp
je 0x407198
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push ebp
call edi
lea ecx, [esp + 0x30]
mov esi, eax
push ecx
push esi
mov dword [esp + 0x38], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x407198
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x407198
push 0
push eax
call edi
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp byte [esp + 0x168], 0xe7
mov edi, dword [sym.imp.USER32.dll_ToUnicodeEx]
mov esi, eax
mov dword [esp + 0x2c], esi
jne 0x4071cd
mov dx, word [esp + 0x16c]
mov eax, 1
mov dword [esp + 0x28], eax
mov word [esp + 0x18], dx
jmp 0x407200
xor eax, eax
cmp dword [0x4c8638], eax
push esi
setne al
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x64]
push eax
mov eax, dword [esp + 0x16c]
push 2
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
push ebx
call edi
mov dword [esp + 0x28], eax
test eax, eax
je 0x40794b
cmp byte [0x4cb2e4], 0
mov cl, byte [esp + 0x168]
je 0x40721f
cmp cl, 9
je 0x40721f
mov byte [esp + 0x17], 1
cmp cl, 0x1b
jne 0x407224
mov byte [esp + 0x17], 0
test eax, eax
jns 0x4072a4
cmp byte [esp + 0x12], 0
je 0x40794b
mov al, byte [0x4c84a5]
mov dx, word [esp + 0x16c]
test al, 0x30
mov byte [0x4cb2e4], cl
setne cl
mov word [0x4cb2e8], dx
mov byte [0x4cb2ea], cl
test al, 3
je 0x407267
mov byte [0x4cb2eb], 1
test al, 0xc
jne 0x40726e
mov byte [0x4cb2eb], 0
xor edx, edx
cmp dword [0x4c8638], edx
push esi
setne dl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x64]
push edx
mov edx, dword [esp + 0x16c]
push 2
push eax
mov eax, dword [edx + 4]
push ecx
push eax
push ebx
call edi
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x150
ret
test byte [0x4c84a5], 3
jne 0x4072d4
mov eax, 0xd
cmp word [esp + 0x18], ax
jne 0x4072c3
mov ecx, 0xa
mov word [esp + 0x18], cx
cmp word [esp + 0x1a], ax
jne 0x4072d4
mov edx, 0xa
mov word [esp + 0x1a], dx
cmp byte [esp + 0x13], 0
mov byte [esp + 0x16], 0
je 0x4076b6
cmp ebp, dword [0x4c71f0]
je 0x4072fe
xor eax, eax
mov dword [0x4c71f0], ebp
mov word [0x4c71f8], ax
xor ecx, ecx
jmp 0x407351
mov ecx, dword [0x4c71f4]
mov edx, 0x5a
sub edx, ecx
cmp edx, 3
jge 0x407351
mov eax, 0x4c7252
lea edx, [eax + 2]
jmp 0x407320
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407320
sub eax, edx
sar eax, 1
mov dword [0x4c71f4], eax
lea eax, [eax + eax + 2]
push eax
push 0x4c7252
push 0x4c71f8
call fcn.0048e590
mov ecx, dword [0x4c71f4]
add esp, 0xc
mov dx, word [esp + 0x18]
mov word [ecx*2 + 0x4c71f8], dx
inc ecx
cmp dword [esp + 0x28], 1
mov dword [0x4c71f4], ecx
jle 0x407380
mov ax, word [esp + 0x1a]
mov word [ecx*2 + 0x4c71f8], ax
inc ecx
mov dword [0x4c71f4], ecx
xor edx, edx
mov word [ecx*2 + 0x4c71f8], dx
test ecx, ecx
je 0x4076b6
mov dword [esp + 0x24], edx
cmp dword [0x4c9eac], edx
jbe 0x4076b6
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
jmp 0x4073b0
mov eax, dword [0x4c9ea8]
mov edx, dword [esp + 0x24]
mov ebp, dword [eax + edx*4]
cmp byte [ebp + 0x1f], 0
jne 0x4074d0
cmp byte [ebp + 0x26], 0
je 0x407405
movzx eax, byte [ebp + 0x1e]
cmp ecx, eax
jle 0x4074d0
movzx eax, word [ecx*2 + 0x4c71f6]
push eax
push str._____:____.___n__t
call fcn.0048e8f1
add esp, 8
test eax, eax
je 0x4074ca
mov ecx, dword [0x4c71f4]
lea edi, [ecx*2 + 0x4c71f4]
jmp 0x407418
movzx edx, byte [ebp + 0x1e]
cmp ecx, edx
jl 0x4074d0
lea edi, [ecx*2 + 0x4c71f6]
cmp byte [ebp + 0x22], 0
movzx edx, byte [ebp + 0x1e]
mov eax, dword [ebp + 4]
lea esi, [eax + edx*2 - 2]
je 0x407444
cmp esi, eax
jb 0x407486
lea ecx, [ecx]
mov dx, word [edi]
cmp dx, word [esi]
jne 0x407486
sub esi, 2
sub edi, 2
cmp esi, eax
jae 0x407430
jmp 0x407486
cmp esi, eax
jb 0x407486
jmp 0x407456
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
movzx eax, word [esi]
push eax
call ebx
movzx ecx, word [edi]
push ecx
mov dword [esp + 0x24], eax
call ebx
mov ecx, dword [esp + 0x20]
cmp ax, cx
jne 0x40747a
sub esi, 2
sub edi, 2
cmp esi, dword [ebp + 4]
jae 0x407450
mov ecx, dword [0x4c71f4]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
cmp esi, dword [ebp + 4]
jae 0x4074d0
cmp byte [ebp + 0x27], 0
jne 0x4074a9
cmp edi, 0x4c71f8
jb 0x4074a9
movzx edx, word [edi]
push edx
call fcn.004079f0
add esp, 4
test al, al
jne 0x4074ca
mov eax, dword [ebp]
test eax, eax
je 0x4074b5
mov eax, dword [eax + 4]
jmp 0x4074ba
mov eax, 0x4ac274
mov esi, dword [ebp + 0xc]
push eax
call fcn.00409990
add esp, 4
test eax, eax
jne 0x4074ea
mov ecx, dword [0x4c71f4]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [0x4c9eac]
jb 0x4073b0
jmp 0x4076b6
movzx eax, byte [ebp + 0x1d]
mov edx, dword [esp + 0x164]
mov ecx, dword [esp + 0x174]
push eax
mov eax, dword [edx + 0x10]
add ecx, 4
call fcn.0040a5d0
add esp, 4
test al, al
je 0x4076b6
cmp byte [ebp + 0x23], 0
jne 0x407520
xor edi, edi
jmp 0x4075fd
cmp byte [ebp + 0x26], 0
mov ebx, dword [0x4c71f4]
lea ebx, [ebx*2 + 0x4c71f8]
je 0x407536
sub ebx, 2
movzx eax, byte [ebp + 0x1e]
add eax, eax
mov esi, ebx
sub esi, eax
mov dword [esp + 0x20], 0
mov byte [esp + 0x15], 0
mov byte [esp + 0x13], 0
cmp esi, ebx
jae 0x4075a6
mov edi, dword [sym.imp.USER32.dll_IsCharUpperW]
lea esp, [esp]
movzx ecx, word [esi]
push ecx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x407578
movzx edx, word [esi]
push edx
call edi
test eax, eax
je 0x407597
cmp byte [esp + 0x15], 0
jne 0x407593
movzx eax, word [esi]
push eax
mov byte [esp + 0x19], 1
call edi
test eax, eax
je 0x407593
mov byte [esp + 0x13], 1
inc dword [esp + 0x20]
add esi, 2
cmp esi, ebx
jb 0x407560
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4075aa
xor edi, edi
jmp 0x4075fd
cmp eax, 1
jne 0x4075bd
movzx edi, byte [esp + 0x13]
neg edi
sbb edi, edi
and edi, 2
jmp 0x4075fd
cmp byte [esp + 0x13], 0
jne 0x4075c8
xor edi, edi
jmp 0x4075fd
movzx ecx, byte [ebp + 0x1e]
add ecx, ecx
mov esi, ebx
sub esi, ecx
mov edi, 2
cmp esi, ebx
jae 0x4075f6
jmp 0x4075e0
movzx edx, word [esi]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x4075f4
add esi, edi
cmp esi, ebx
jb 0x4075e0
cmp esi, ebx
jne 0x4075fd
mov edi, 1
mov dl, byte [ebp + 0x24]
test dl, dl
jne 0x407609
cmp byte [ebp + 0x25], dl
je 0x407613
mov byte [esp + 0x12], 0
mov byte [esp + 0x16], 1
mov eax, dword [esp + 0x178]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov al, byte [ebp + 0x26]
test al, al
je 0x407637
mov ecx, dword [0x4c71f4]
movzx ecx, word [ecx*2 + 0x4c71f6]
jmp 0x407639
xor ecx, ecx
movzx esi, di
movzx ecx, cx
shl esi, 0x10
or esi, ecx
mov ecx, dword [esp + 0x17c]
mov dword [ecx], esi
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp word [esi], cx
je 0x407683
test al, al
je 0x40767b
mov edx, dword [0x4c71f4]
mov ax, word [edx*2 + 0x4c71f6]
mov word [0x4c71f8], ax
mov dword [0x4c71f4], 1
jmp 0x40769b
mov dword [0x4c71f4], ecx
jmp 0x40769b
test dl, dl
je 0x40769b
movzx edx, byte [ebp + 0x1e]
sub dword [0x4c71f4], edx
test al, al
je 0x40769b
dec dword [0x4c71f4]
cmp byte [ebp + 0x28], cl
je 0x4076a6
mov dword [0x4c71f4], ecx
mov ecx, dword [0x4c71f4]
xor eax, eax
mov word [ecx*2 + 0x4c71f8], ax
cmp byte [esp + 0x17], 0
je 0x407729
cmp byte [esp + 0x12], 0
mov bl, byte [0x4cb2e4]
mov byte [0x4cb2e4], 0
je 0x407729
push 0x100
lea edx, [esp + 0x64]
push 0
push edx
call fcn.004969f0
mov al, byte [0x4cb2ea]
mov cl, byte [0x4cb2eb]
add esp, 0xc
neg al
sbb al, al
and al, 0x20
neg cl
sbb cl, cl
and cl, 9
or al, cl
lea ecx, [esp + 0x60]
call fcn.004119e0
mov edx, dword [esp + 0x2c]
push edx
movzx edx, word [0x4cb2e8]
push 0
push 2
lea eax, [esp + 0x38]
push eax
push ecx
movzx eax, bl
push edx
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp byte [esp + 0x14], 0
je 0x40794b
cmp dword [0x4ca5d8], 1
jne 0x40794b
cmp byte [esp + 0x16], 0
jne 0x40794b
mov edi, dword [esp + 0x28]
xor esi, esi
test edi, edi
jle 0x4077ca
jmp 0x407760
cmp byte [0x4ca605], 0
mov ecx, dword [0x4ca5e4]
je 0x407780
movzx eax, word [esp + esi*2 + 0x18]
push eax
push ecx
call fcn.0048e8f1
add esp, 8
jmp 0x40778a
mov ax, word [esp + esi*2 + 0x18]
call fcn.00474c40
test eax, eax
jne 0x40781a
mov eax, dword [0x4ca610]
cmp eax, dword [0x4ca614]
je 0x4077ca
mov dx, word [esp + esi*2 + 0x18]
mov ecx, dword [0x4ca60c]
mov word [ecx + eax*2], dx
mov eax, dword [0x4ca610]
mov ecx, dword [0x4ca60c]
inc eax
xor edx, edx
inc esi
mov dword [0x4ca610], eax
mov word [ecx + eax*2], dx
cmp esi, edi
jl 0x407760
xor esi, esi
cmp byte [0x4ca609], 0
je 0x407899
cmp byte [0x4ca605], 0
je 0x407858
cmp dword [0x4ca5f4], esi
jbe 0x407933
mov edi, edi
mov eax, dword [0x4ca5f0]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4ca60c]
push eax
push ecx
call fcn.0048e918
add esp, 8
test eax, eax
jne 0x40783f
inc esi
cmp esi, dword [0x4ca5f4]
jb 0x4077f0
jmp 0x407933
mov dx, word [esp + esi*2 + 0x18]
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
mov dword [0x4ca5d8], 4
mov word [0x4ca5ec], dx
pop ebx
add esp, 0x150
ret
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
mov dword [0x4ca5d8], 3
pop ebx
add esp, 0x150
ret
cmp dword [0x4ca5f4], esi
jbe 0x407933
jmp 0x407870
mov edx, dword [0x4ca60c]
mov eax, dword [0x4ca5f0]
mov eax, dword [eax + esi*4]
push edx
call fcn.00474c90
add esp, 4
test eax, eax
jne 0x40783f
inc esi
cmp esi, dword [0x4ca5f4]
jb 0x407870
jmp 0x407933
cmp byte [0x4ca605], 0
je 0x4078ff
mov ebp, dword [0x4ca5f4]
test ebp, ebp
je 0x407933
mov edi, dword [0x4ca60c]
mov ebx, dword [0x4ca5f0]
lea esp, [esp]
mov ecx, dword [ebx + esi*4]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4078eb
test dx, dx
je 0x4078e7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4078eb
add eax, 4
add ecx, 4
test dx, dx
jne 0x4078c5
xor eax, eax
jmp 0x4078f0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40783f
inc esi
cmp esi, ebp
jb 0x4078c0
jmp 0x407933
cmp dword [0x4ca5f4], esi
jbe 0x407933
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea ecx, [ecx]
mov ecx, dword [0x4ca5f0]
mov edx, dword [ecx + esi*4]
mov eax, dword [0x4ca60c]
push edx
push eax
call edi
test eax, eax
je 0x40783f
inc esi
cmp esi, dword [0x4ca5f4]
jb 0x407910
mov ecx, dword [0x4ca614]
cmp dword [0x4ca610], ecx
jl 0x40794b
mov dword [0x4ca5d8], 5
mov al, byte [esp + 0x12]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x150
ret