Function at 0x48eca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
mov esi, dword [ebp + 8]
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x48ef17
push edi
push 0x10
call ebx
mov edi, eax
push 0x11
and edi, 0x8000
call ebx
mov ecx, dword [ebp + 0xc]
mov ebx, eax
add ecx, 0xffffffdd
and ebx, 0x8000
cmp ecx, 0xb
ja case.0x48ece8.38
jmp dword [ecx*4 + 0x48ef20]
test ebx, ebx
je 0x48ed4f
mov eax, dword [esi + 0xe10]
mov ebx, dword [esi + 0xe14]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0xddc]
cmp eax, 0xffffffff
jne 0x48ed1f
push dword [esi + 0xdd8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi + 0xddc], eax
test ebx, ebx
je 0x48ed32
push 0
push eax
push ebx
push 0
mov ecx, esi
call fcn.0048d0f0
mov ebx, eax
push ebx
test edi, edi
mov ecx, esi
cmovne ebx, dword [ebp + 8]
push ebx
call fcn.0048dad0
mov ecx, esi
call fcn.0048d7b0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push edi
mov ecx, esi
call fcn.0048e1a0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x48edc1
mov eax, dword [esi + 0xe10]
mov ebx, dword [esi + 0xe14]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0xddc]
cmp eax, 0xffffffff
jne 0x48ed8e
push dword [esi + 0xdd8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi + 0xddc], eax
cmp ebx, eax
je 0x48eda4
push 1
push eax
lea eax, [ebx + 1]
mov ecx, esi
push eax
push 0
call fcn.0048d0f0
mov ebx, eax
push ebx
test edi, edi
mov ecx, esi
cmovne ebx, dword [ebp + 8]
push ebx
call fcn.0048dad0
mov ecx, esi
call fcn.0048d7b0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push edi
mov ecx, esi
call fcn.0048e230
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
test edi, edi
je 0x48eddc
mov eax, dword [esi + 0xe10]
jmp 0x48edde
xor eax, eax
push 0
push eax
mov ecx, esi
call fcn.0048dad0
mov ecx, esi
call fcn.0048d7b0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push ebx
push edi
mov ecx, esi
call fcn.0048e1e0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
test dword [esi + 0xdf8], 0x800
jne case.0x48ece8.38
test edi, edi
je 0x48ee22
test ebx, ebx
jne case.0x48ece8.38
mov eax, dword [esi + 0xe10]
cmp eax, dword [esi + 0xe14]
je 0x48ee48
mov eax, dword [esi]
push esi
test edi, edi
je 0x48eedc
call dword [eax + 0x1c8]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0048dad0
test edi, edi
je 0x48ee67
mov eax, dword [esi + 0xe14]
test eax, eax
lea ecx, [eax - 1]
cmove ecx, eax
jmp 0x48eec4
test ebx, ebx
je 0x48eead
mov eax, dword [esi + 0xddc]
cmp eax, 0xffffffff
jne 0x48ee88
push dword [esi + 0xdd8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi + 0xddc], eax
push eax
push dword [esi + 0xe10]
mov ecx, esi
call fcn.0048dad0
mov ecx, esi
call fcn.0048d7b0
mov eax, dword [esi]
push esi
call dword [eax + 0x1c4]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov edx, dword [esi + 0xe14]
mov eax, dword [esi + 0xdd8]
lea ecx, [edx + 1]
cmp word [eax + edx*2], 0
cmove ecx, edx
push ecx
push dword [esi + 0xe10]
mov ecx, esi
call fcn.0048dad0
mov ecx, esi
call fcn.0048d7b0
mov eax, dword [esi]
push esi
call dword [eax + 0x1c4]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
test edi, edi
je 0x48ef09
test dword [esi + 0xdf8], 0x800
jne case.0x48ece8.38
mov eax, dword [esi]
push esi
call dword [eax + 0x1bc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je case.0x48ece8.38
mov eax, dword [esi]
push esi
call dword [eax + 0x1c0]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10