Function at 0x48d4b4
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x56e914
call fcn.00524444
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push 1
call fcn.00543016
mov eax, dword [esi + 0x108]
mov ecx, dword [esi + 0x1a8]
mov dl, byte [esi + 0xd4]
mov byte [eax + ecx], dl
mov eax, dword [esi + 0x1a8]
mov ecx, dword [esi + 0x11c]
mov dl, byte [esi + 0xd8]
mov byte [eax + ecx], dl
mov eax, dword [esi + 0x1a8]
mov ecx, dword [esi + 0x130]
mov dl, byte [esi + 0xdc]
mov byte [eax + ecx], dl
mov eax, dword [esi + 0x1a8]
mov ecx, dword [esi + 0x144]
mov dl, byte [esi + 0xe4]
mov byte [eax + ecx], dl
mov eax, dword [esi + 0x1a8]
mov ecx, dword [esi + 0x158]
mov dl, byte [esi + 0xec]
mov byte [eax + ecx], dl
mov eax, dword [esi + 0x1a8]
mov ecx, dword [esi + 0x16c]
mov dl, byte [esi + 0xe8]
mov byte [eax + ecx], dl
cmp dword [esi + 0xe0], 0xffffffff
je 0x48d56a
mov eax, dword [esi + 0x1a8]
mov ecx, dword [esi + 0x180]
mov dx, word [esi + 0xe0]
mov word [ecx + eax*2], dx
mov ecx, esi
call fcn.0048d187
mov dword [esi + 0x1a8], eax
mov ecx, dword [esi + 0x108]
movzx ecx, byte [ecx + eax]
mov dword [esi + 0xd4], ecx
mov ecx, dword [esi + 0x11c]
movzx ecx, byte [eax + ecx]
mov dword [esi + 0xd8], ecx
mov ecx, dword [esi + 0x130]
movzx ecx, byte [eax + ecx]
mov dword [esi + 0xdc], ecx
mov ecx, dword [esi + 0x180]
movzx ecx, word [ecx + eax*2]
mov dword [esi + 0xe0], ecx
mov ecx, dword [esi + 0x144]
movzx ecx, byte [eax + ecx]
mov dword [esi + 0xe4], ecx
mov ecx, dword [esi + 0x16c]
movzx ecx, byte [eax + ecx]
mov dword [esi + 0xe8], ecx
mov ecx, dword [esi + 0x158]
movzx ecx, byte [eax + ecx]
mov dword [esi + 0xec], ecx
mov ecx, dword [0x61d784]
mov dword [ebp - 0x18], ecx
mov ecx, dword [esi + 0x194]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [ecx + eax], bl
je 0x48d604
push 0x24
jmp 0x48d606
push 0x23
lea ecx, [ebp - 0x18]
call fcn.00545796
push dword [ebp - 0x18]
mov ecx, esi
push 0xc1
call fcn.00543bb6
mov eax, dword [esi + 0x1a8]
mov ecx, dword [esi + 0x180]
push 0x622c94
movzx eax, word [ecx + eax*2]
cmp eax, ebx
mov dword [esi + 0xe0], eax
jne 0x48d65b
lea ecx, [esi + 0x5c]
call fcn.00543cd5
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
jmp 0x48d771
lea ecx, [ebp - 0x10]
call fcn.0053ebbd
cmp dword [esi + 0xd4], ebx
mov byte [ebp - 4], 1
je 0x48d67c
push str.Alt
lea ecx, [ebp - 0x10]
call fcn.0053ecd8
cmp dword [esi + 0xd8], ebx
je 0x48d691
push 0x629c58
lea ecx, [ebp - 0x10]
call fcn.0053ef67
cmp dword [esi + 0xdc], ebx
je 0x48d6a6
push 0x629c54
lea ecx, [ebp - 0x10]
call fcn.0053ef67
push edi
push 0x5bee9c
lea ecx, [ebp - 0x14]
call fcn.0053ebbd
mov al, byte [0x5be880]
xor edi, edi
cmp al, bl
mov byte [ebp - 4], 2
je 0x48d6f1
mov edx, dword [esi + 0xe0]
mov ecx, 0x5be880
movzx eax, al
cmp edx, eax
je 0x48d6e2
mov al, byte [ecx + 8]
add ecx, 8
inc edi
cmp al, bl
jne 0x48d6ce
jmp 0x48d6f1
push dword [edi*8 + 0x5be884]
lea ecx, [ebp - 0x14]
call fcn.00545796
cmp byte [edi*8 + 0x5be880], bl
pop edi
jne 0x48d743
push 1
push 2
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0053a3f4
push 0x622c94
mov byte [ebp - 4], 3
push dword [ebp - 0x1c]
call fcn.00524dbe
pop ecx
test eax, eax
pop ecx
je 0x48d737
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push eax
call fcn.0053ec88
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0053eb4f
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.0053ef67
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0053eb4f
push dword [ebp - 0x10]
lea ecx, [esi + 0x5c]
call fcn.00543cd5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0053eb4f
push ebx
mov ecx, esi
call fcn.00543016
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0053eb4f
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret