Function at 0x487bba
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x48
mov eax, 0x553282
call fcn.00531203
mov edi, ecx
cmp byte [edi + 0x2c8], 0
je 0x487bd8
mov byte [edi + 0x2c8], 0
cmp dword [edi + 0x35c], 0
je 0x487f55
mov eax, dword [edi]
call dword [eax + 0x19c]
push eax
mov ecx, 0x5ab2e0
call fcn.00431950
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x487c0c
cmp dword [0x5ab2e4], eax
jne 0x487c0c
call fcn.004136db
mov eax, dword [edi + 0x35c]
mov ecx, edi
mov esi, dword [edi + 0x358]
mov dword [ebp - 0x34], eax
mov eax, dword [edi]
call dword [eax + 0x38c]
mov ecx, edi
call fcn.00487161
mov edx, dword [ebp - 0x34]
mov ebx, eax
cmp esi, edx
jne 0x487c59
mov ecx, edx
sub ecx, 8
je 0x487e90
sub ecx, 1
je 0x487cfc
sub ecx, 0xa
je 0x487c65
mov eax, dword [edi]
mov ecx, edi
push edx
call dword [eax + 0x37c]
mov ecx, edi
call fcn.0041ad8e
jmp 0x487f63
mov esi, dword [0x5d3da0]
test esi, esi
jne 0x487c7c
mov ecx, edi
call fcn.0041b527
mov esi, eax
test esi, esi
je 0x487ced
push esi
push 0x568ed8
call fcn.00421946
pop ecx
pop ecx
test eax, eax
je 0x487c9a
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x218]
jmp 0x487ce5
push esi
push 0x568948
call fcn.00421946
pop ecx
pop ecx
test eax, eax
je 0x487cb8
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x1f8]
jmp 0x487ce5
push esi
push 0x56fae4
call fcn.00421946
pop ecx
pop ecx
test eax, eax
jne 0x487cda
push esi
push 0x56fea0
call fcn.00421946
pop ecx
pop ecx
test eax, eax
je 0x487ced
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x210]
test eax, eax
je 0x487c59
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2dc]
jmp 0x487c59
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x487e3b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x340]
test eax, eax
je 0x487e3b
mov eax, dword [edi + 0xa4]
xor esi, esi
push esi
push esi
push 0xb
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [edi + 0x2f8], esi
jne 0x487dc3
push 0xa
lea ecx, [ebp - 0x54]
call fcn.0049df0c
lea eax, [ebp - 0x54]
mov dword [ebp - 4], esi
push eax
mov ecx, ebx
call fcn.004bc81f
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x487db5
mov ecx, eax
test eax, eax
je 0x487c07
push dword [ecx + 8]
mov eax, dword [eax]
push 0x5ab60c
mov dword [ebp - 0x38], eax
call fcn.00421946
mov esi, eax
pop ecx
pop ecx
mov ecx, esi
mov dword [ebp - 0x34], esi
mov edx, dword [esi]
call dword [edx + 0x340]
test eax, eax
je 0x487dac
mov eax, dword [ebx]
mov ecx, ebx
mov esi, dword [esi]
push 0
push 0
call dword [eax + 0x194]
mov ecx, dword [ebp - 0x34]
push eax
push 1
call dword [esi + 0x368]
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x487d5f
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0049df32
jmp 0x487dea
mov ecx, dword [edi + 0x330]
mov eax, dword [ecx]
call dword [eax + 0x1a0]
push eax
push 0x575500
call fcn.00421946
pop ecx
pop ecx
test eax, eax
je 0x487dea
push esi
mov ecx, eax
call fcn.004d9f22
mov eax, dword [edi + 0xa4]
push esi
push 1
push 0xb
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [edi + 0xa4]
push 0x56d1a4
call fcn.00421946
pop ecx
pop ecx
test eax, eax
je 0x487e20
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x178]
mov eax, dword [edi + 0xa4]
push 0x181
push esi
push esi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x487f63
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x487f63
test ebx, ebx
je 0x487f63
mov eax, dword [ebx]
mov ecx, ebx
mov esi, dword [esi + 0x11c]
call dword [eax + 0x194]
test esi, eax
je 0x487f63
mov eax, dword [ebx]
mov ecx, ebx
mov esi, dword [edi]
push 1
push 0
call dword [eax + 0x194]
push eax
xor eax, eax
mov ecx, edi
cmp dword [edi + 0x2f8], eax
sete al
push eax
call dword [esi + 0x368]
jmp 0x487f63
cmp dword [0x5d3b70], 0
je 0x487f63
push 8
mov ecx, edi
call fcn.004870b8
mov ebx, eax
test ebx, ebx
je 0x487f63
mov edx, dword [ebx]
lea eax, [ebp - 0x30]
push eax
mov ecx, ebx
call dword [edx + 0xc]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00414ea9
push dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.00414803
mov dword [ebx + 0x14], 1
mov ecx, edi
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], eax
call fcn.00417f55
test eax, 0x400000
je 0x487f29
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
add esi, eax
mov dword [ebp - 0x34], esi
push dword [ebp - 0x38]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x34]
mov esi, dword [edi + 0x20]
call dword [eax + 0x2e4]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x487f63
and dword [ebx + 0x14], 0
mov ecx, edi
push ebx
call fcn.0048921e
jmp 0x487f63
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00464445
call fcn.005311ad
ret 0xc