Function at 0x487c60
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6554d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x92
jb 0x487c83
xor eax, eax
jmp 0x487f17
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x5af238]
movsx edx, byte [ecx]
test edx, edx
jne 0x487c9b
xor eax, eax
jmp 0x487f17
cmp dword [0x5af230], 0
je 0x487cb7
call fcn.00488c20
test eax, eax
jne 0x487cb7
mov eax, 1
jmp 0x487f17
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
mov ecx, dword [0x65a6dc]
mov dword [ebp - 0x208], ecx
jmp 0x487cea
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x214], 0
jne 0x487d39
mov eax, dword [ebp - 0x210]
cmp eax, dword [0x65a6e0]
jae 0x487d39
mov ecx, dword [ebp - 0x208]
mov edx, dword [ecx]
cmp edx, dword [ebp + 8]
jne 0x487d28
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 4]
jne 0x487d28
mov dword [ebp - 0x214], 1
jmp 0x487d37
mov edx, dword [ebp - 0x208]
add edx, 0xc
mov dword [ebp - 0x208], edx
jmp 0x487cdb
cmp dword [ebp - 0x214], 0
jne 0x487d49
xor eax, eax
jmp 0x487f17
mov eax, dword [ebp - 0x208]
cmp dword [eax + 8], 0
je 0x487d75
mov ecx, dword [ebp - 0x208]
mov edx, dword [ecx + 8]
push edx
call fcn.00488ba0
add esp, 4
test eax, eax
jne 0x487d75
mov eax, 1
jmp 0x487f17
mov dword [ebp - 0x218], 0
cmp dword [ebp + 0xc], 0
je 0x487e9c
push 1
mov eax, dword [0x65a6d4]
push eax
mov ecx, dword [0x65a6d8]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jne 0x487e32
mov dword [ebp - 0x218], 1
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jne 0x487e32
mov eax, dword [ebp + 0xc]
and eax, 0xc
je 0x487def
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x104], 1
mov eax, dword [ebp + 0xc]
and eax, 0x10
je 0x487e07
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x104], 1
mov edx, dword [ebp + 0xc]
and edx, 3
je 0x487e1f
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x104], 1
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x487e9c
push 0
call fcn.004053d0
add esp, 4
cmp dword [ebp - 0x218], 0
je 0x487e63
push 0
mov eax, dword [0x65a6d4]
push eax
mov ecx, dword [0x65a6d8]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, dword [0x65a6d4]
push edx
push str.Input_attachment_to_thread_ID__0x_failed__redirection_disabled
lea eax, [ebp - 0x184]
push eax
call fcn.0040ae60
add esp, 0xc
push 0x10
lea ecx, [ebp - 0x184]
push ecx
call fcn.00405620
push eax
call fcn.004853e0
add esp, 0xc
mov eax, 1
jmp 0x487f17
push 0
mov edx, dword [ebp + 8]
push edx
push 0x100
mov eax, dword [0x65a6d0]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
jne 0x487ef3
push 0
call fcn.004053d0
add esp, 4
mov ecx, dword [0x65a6d0]
push ecx
push str.Keyboard_redirection_to_window_hwnd__0lx_failed__redirection_disabled
lea edx, [ebp - 0x204]
push edx
call fcn.0040ae60
add esp, 0xc
push 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.00405620
push eax
call fcn.004853e0
add esp, 0xc
cmp dword [ebp - 0x218], 0
je 0x487f12
push 0
mov ecx, dword [0x65a6d4]
push ecx
mov edx, dword [0x65a6d8]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret