Function at 0x487c50
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6552e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x92
jb 0x487c73
xor eax, eax
jmp 0x487f07
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x5af0c8]
movsx edx, byte [ecx]
test edx, edx
jne 0x487c8b
xor eax, eax
jmp 0x487f07
cmp dword [0x5af0c0], 0
je 0x487ca7
call fcn.00488ca0
test eax, eax
jne 0x487ca7
mov eax, 1
jmp 0x487f07
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
mov ecx, dword [0x65a4ec]
mov dword [ebp - 0x208], ecx
jmp 0x487cda
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x214], 0
jne 0x487d29
mov eax, dword [ebp - 0x210]
cmp eax, dword [0x65a4f0]
jae 0x487d29
mov ecx, dword [ebp - 0x208]
mov edx, dword [ecx]
cmp edx, dword [ebp + 8]
jne 0x487d18
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 4]
jne 0x487d18
mov dword [ebp - 0x214], 1
jmp 0x487d27
mov edx, dword [ebp - 0x208]
add edx, 0xc
mov dword [ebp - 0x208], edx
jmp 0x487ccb
cmp dword [ebp - 0x214], 0
jne 0x487d39
xor eax, eax
jmp 0x487f07
mov eax, dword [ebp - 0x208]
cmp dword [eax + 8], 0
je 0x487d65
mov ecx, dword [ebp - 0x208]
mov edx, dword [ecx + 8]
push edx
call fcn.00488c20
add esp, 4
test eax, eax
jne 0x487d65
mov eax, 1
jmp 0x487f07
mov dword [ebp - 0x218], 0
cmp dword [ebp + 0xc], 0
je 0x487e8c
push 1
mov eax, dword [0x65a4e4]
push eax
mov ecx, dword [0x65a4e8]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jne 0x487e22
mov dword [ebp - 0x218], 1
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jne 0x487e22
mov eax, dword [ebp + 0xc]
and eax, 0xc
je 0x487ddf
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x104], 1
mov eax, dword [ebp + 0xc]
and eax, 0x10
je 0x487df7
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x104], 1
mov edx, dword [ebp + 0xc]
and edx, 3
je 0x487e0f
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x104], 1
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x487e8c
push 0
call fcn.00405380
add esp, 4
cmp dword [ebp - 0x218], 0
je 0x487e53
push 0
mov eax, dword [0x65a4e4]
push eax
mov ecx, dword [0x65a4e8]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, dword [0x65a4e4]
push edx
push str.Input_attachment_to_thread_ID__0x_failed__redirection_disabled
lea eax, [ebp - 0x184]
push eax
call fcn.0040ad40
add esp, 0xc
push 0x10
lea ecx, [ebp - 0x184]
push ecx
call fcn.004055c0
push eax
call fcn.004854a0
add esp, 0xc
mov eax, 1
jmp 0x487f07
push 0
mov edx, dword [ebp + 8]
push edx
push 0x100
mov eax, dword [0x65a4e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
jne 0x487ee3
push 0
call fcn.00405380
add esp, 4
mov ecx, dword [0x65a4e0]
push ecx
push str.Keyboard_redirection_to_window_hwnd__0lx_failed__redirection_disabled
lea edx, [ebp - 0x204]
push edx
call fcn.0040ad40
add esp, 0xc
push 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.004055c0
push eax
call fcn.004854a0
add esp, 0xc
cmp dword [ebp - 0x218], 0
je 0x487f02
push 0
mov ecx, dword [0x65a4e4]
push ecx
mov edx, dword [0x65a4e8]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret