Function at 0x48b7b5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x12
pop eax
xor ecx, ecx
cmp ebx, eax
jne 0x48b83e
cmp edi, 0x101
je 0x48b7dc
cmp edi, 0x105
jne 0x48b83e
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x111b8], cl
je 0x48b83e
call fcn.00424422
cmp eax, dword [0x5a22a4]
je 0x48b83c
push 0
mov ecx, esi
call fcn.00487c63
test eax, eax
je 0x48b83c
push 0x11
pop eax
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x48b83c
push 0x10
pop eax
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x48b83c
push 0xffffffffffffffff
push 0
push 2
push 0x11
pop eax
push eax
mov ecx, esi
call fcn.0048d8de
xor ecx, ecx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x48b942
cmp eax, 0xffffffff
je 0x48b942
mov edx, 0x100
cmp edi, edx
jb 0x48b883
cmp edi, 0x101
jbe 0x48b895
cmp edi, 0x103
jbe 0x48baea
cmp edi, 0x105
jbe 0x48b895
cmp edi, 0x106
je 0x48baea
push dword [ebp + 0x14]
push ebx
push edi
push eax
mov ecx, esi
call fcn.0048d60f
jmp 0x48baea
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x48b8c0
cmp edi, edx
je 0x48b8ac
cmp edi, 0x104
jne 0x48baea
mov dword [esi + 0x5cc], edi
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [esi + 0x18]
jmp 0x48b889
cmp dword [esi + 0x5cc], ecx
je 0x48b938
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x48b91a
movzx eax, word [eax]
test ax, ax
je 0x48b91a
mov edi, dword [ebp + 0x18]
mov ebx, ecx
push dword [ebp + 0x14]
cmp dword [esi + 0x5cc], edx
movzx eax, ax
push eax
mov eax, 0x106
lea ecx, [eax - 4]
cmove eax, ecx
mov ecx, esi
push eax
push dword [esi + 0x18]
call fcn.0048d60f
inc ebx
mov edx, 0x100
movzx eax, word [edi + ebx*2]
test ax, ax
jne 0x48b8dc
and dword [esi + 0x5cc], 0
jmp 0x48baea
cmp edi, 0x101
je 0x48baea
cmp edi, 0x105
je 0x48baea
mov dword [esi + 0x5cc], ecx
push dword [ebp + 0x14]
push ebx
push edi
jmp 0x48b8bb
mov ecx, dword [esi + 4]
call fcn.0041eea6
test al, al
jne 0x48baea
mov ecx, dword [esi + 0x4294]
call fcn.00481ff3
test al, al
je 0x48ba39
mov ecx, dword [ebp + 0x18]
mov eax, dword [0x5a23ec]
test ecx, ecx
je 0x48b986
xor edx, edx
cmp byte [eax + 0x10fbf], dl
je 0x48b988
cmp word [ecx], dx
jne 0x48ba1d
jmp 0x48b988
xor edx, edx
cmp byte [eax + 0x10fc0], 0
je 0x48baea
cmp edi, 0x100
je 0x48b9a9
cmp edi, 0x104
jne 0x48baea
push 0x10
pop eax
cmp ebx, eax
je 0x48baea
push 0x11
pop eax
cmp ebx, eax
je 0x48baea
push 0x12
pop eax
cmp ebx, eax
je 0x48baea
push 0x5b
pop eax
cmp ebx, eax
je 0x48baea
push 0x5c
pop eax
cmp ebx, eax
je 0x48baea
cmp ebx, 0x5d
je 0x48baea
mov ecx, dword [esi + 0x4294]
push edx
call fcn.00482005
xor ecx, ecx
test al, al
setne cl
add ecx, 0x7d7
push ecx
mov ecx, dword [0x5a23ec]
call fcn.0046012f
test al, al
jne 0x48baea
mov eax, dword [0x5a23ec]
xor edx, edx
cmp byte [eax + 0x10fbf], 1
mov ecx, dword [esi + 0x4294]
push edx
push edx
sete al
push edx
movzx eax, al
push eax
call fcn.004799b5
mov eax, dword [esi + 0x4294]
xor edx, edx
test eax, eax
je 0x48ba49
mov eax, dword [eax]
jmp 0x48ba4b
mov eax, edx
cmp eax, 1
jne 0x48baea
cmp edi, 0x105
je 0x48badb
movzx eax, bx
cmp edi, 0x101
je 0x48badb
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x48ba73
cmp word [ecx], dx
jne 0x48bad0
test ax, ax
je 0x48badb
push 0x5b
pop ecx
cmp ax, cx
je 0x48badb
push 0x5c
pop ecx
cmp ax, cx
je 0x48badb
push 0x11
pop ecx
cmp ax, cx
je 0x48badb
mov ecx, 0xa2
cmp ax, cx
je 0x48badb
inc ecx
cmp ax, cx
je 0x48badb
push 0x12
pop ecx
cmp ax, cx
je 0x48badb
mov ecx, 0xa4
cmp ax, cx
je 0x48badb
inc ecx
cmp ax, cx
je 0x48badb
push 0x10
pop ecx
cmp ax, cx
je 0x48badb
mov ecx, 0xa0
cmp ax, cx
je 0x48badb
inc ecx
cmp ax, cx
je 0x48badb
mov ecx, dword [esi + 0x4288]
call fcn.0047d7d5
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push ebx
push edi
call fcn.0048fd1d
pop edi
pop esi
pop ebx
pop ebp
ret 0x18