Function at 0x48b360
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x32]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x48bab7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x4b55bc]
mov eax, dword [eax]
xor edx, edx
call fcn.004620a4
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00488bd8
test eax, eax
jle 0x48b466
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.00488bd8
mov edx, eax
dec edx
mov eax, ebx
call fcn.00488be0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x48b452
mov eax, esi
call fcn.00488bd8
cmp ebx, eax
jge 0x48b452
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.00488be0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x48b43e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.00488bd8
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x48b43e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.00488be0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x48b452
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.0048a914
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x48b47c
mov eax, ebx
call fcn.0044ac08
call fcn.00495458
mov byte [ebp - 6], 1
jmp 0x48ba7f
cmp byte [ebp - 6], 0
jne 0x48b490
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x48ba5e
mov eax, dword [edi + 4]
sub eax, 0x12
je 0x48b59e
sub eax, 0x34
je 0x48b4c2
add eax, 0xffffffa5
sub eax, 9
jb 0x48b59e
sub eax, 0x157
je 0x48b4d3
jmp 0x48b5aa
push ebp
call fcn.0048b310
pop ecx
call fcn.00403be8
jmp 0x48babe
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004071d0
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00443f68
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x48b54f
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x48b54f
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
jmp 0x48b5aa
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x48b581
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00443f68
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x48b57e
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x48b589
test bl, bl
je 0x48b556
test bl, bl
jne 0x48b5aa
push ebp
call fcn.0048b310
pop ecx
call fcn.00403be8
jmp 0x48babe
push ebp
call fcn.0048b310
pop ecx
jmp 0x48ba5e
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x48ba5e
mov eax, dword [edi + 4]
mov edx, eax
sub edx, 0x7b
je 0x48ba5e
add edx, 0xffffff7b
sub edx, 9
jb 0x48b601
add edx, 0xffffff09
sub edx, 0xb
jb 0x48b8c2
sub edx, 0x264
jne 0x48ba58
mov eax, dword [ebp - 4]
call fcn.0048afc4
jmp 0x48ba5e
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x48ba5e
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x48b637
sub eax, 2
je 0x48b869
sub eax, 2
je 0x48b637
sub eax, 2
je 0x48b869
jmp 0x48ba5e
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x48b67a
je 0x48b72c
cmp eax, 0x12
jg 0x48b663
je 0x48b852
sub eax, 9
je 0x48ba5e
sub eax, 4
je 0x48b69f
jmp 0x48b85e
sub eax, 0x1b
je 0x48b704
sub eax, 5
je 0x48ba5e
jmp 0x48b85e
sub eax, 0x26
je 0x48b815
dec eax
je 0x48b796
dec eax
je 0x48b82f
sub eax, 0x51
je 0x48b852
jmp 0x48b85e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x48b6b2
mov si, 0xffef
call fcn.0040356c
mov eax, dword [ebp - 4]
call fcn.0048afc4
test al, al
jne 0x48ba5e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x48ba5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x48bad0
call fcn.004045ac
je 0x48ba5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x48ba5e
push ebp
call fcn.0048b310
pop ecx
jmp 0x48ba5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x48b712
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.00403be8
jmp 0x48babe
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x48b742
mov eax, dword [ebp - 4]
call fcn.0048b1cc
jmp 0x48ba5e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x48ba5e
cmp byte [ebx + 0x34], 0
je 0x48b777
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
call fcn.00403be8
jmp 0x48babe
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
jmp 0x48ba5e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x48b7ac
mov eax, dword [ebp - 4]
call fcn.0048b098
jmp 0x48ba5e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x48ba5e
mov eax, dword [ebp - 4]
call fcn.0048afc4
test al, al
jne 0x48ba5e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
cmp byte [ebx + 0x34], 0
je 0x48b7f6
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
call fcn.00403be8
jmp 0x48babe
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
jmp 0x48ba5e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x48ba5e
mov eax, dword [ebp - 4]
call fcn.0048b1cc
jmp 0x48ba5e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x48b845
mov eax, dword [ebp - 4]
call fcn.0048b098
jmp 0x48ba5e
mov eax, dword [ebp - 4]
call fcn.0048afc4
jmp 0x48ba5e
push ebp
call fcn.0048b310
pop ecx
jmp 0x48ba5e
push edi
call sub.user32.dll_TranslateMessage
jmp 0x48ba5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.00489ed8
test eax, eax
je 0x48ba5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.00489ed8
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
test ebx, ebx
je 0x48b8a3
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
jmp 0x48ba5e
sub eax, 0x200
je 0x48b8d7
sub eax, 2
je 0x48b995
jmp 0x48ba5e
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004071d0
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x4b6dc4]
jne 0x48b908
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x4b6dc8]
je 0x48ba5e
mov esi, dword [ebp - 4]
jmp 0x48b90f
mov esi, eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x48b90d
test esi, esi
je 0x48b97e
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.0048a914
cmp ebx, dword [esi + 0x40]
je 0x48b977
cmp esi, dword [ebp - 4]
je 0x48b977
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x48b956
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x48]
cmp esi, ebx
jne 0x48b938
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
call fcn.00403be8
jmp 0x48babe
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x48b91a
mov eax, dword [ebp - 0xe]
mov dword [0x4b6dc4], eax
mov eax, dword [ebp - 0xa]
mov dword [0x4b6dc8], eax
jmp 0x48ba5e
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004071d0
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00443f68
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x48ba11
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x48ba11
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044ac08
push eax
call sub.user32.dll_PostMessageA
jmp 0x48ba5e
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x48ba43
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00443f68
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x48ba40
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x48ba4b
test bl, bl
je 0x48ba18
test bl, bl
jne 0x48ba5e
push ebp
call fcn.0048b310
pop ecx
jmp 0x48ba5e
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.0048b33c
pop ecx
test al, al
je 0x48ba7f
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x48b499
push ebp
call fcn.0048b33c
pop ecx
test al, al
jne 0x48b485
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48babe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x48baaa
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.00495478
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret