Function at 0x487f30
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x659780]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x92
jb 0x487f53
xor eax, eax
jmp 0x4881e7
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x5b33b8]
movsx edx, byte [ecx]
test edx, edx
jne 0x487f6b
xor eax, eax
jmp 0x4881e7
cmp dword [0x5b33b0], 0
je 0x487f87
call fcn.00488ef0
test eax, eax
jne 0x487f87
mov eax, 1
jmp 0x4881e7
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
mov ecx, dword [0x65e9f4]
mov dword [ebp - 0x208], ecx
jmp 0x487fba
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x214], 0
jne 0x488009
mov eax, dword [ebp - 0x210]
cmp eax, dword [0x65e9f8]
jae 0x488009
mov ecx, dword [ebp - 0x208]
mov edx, dword [ecx]
cmp edx, dword [ebp + 8]
jne 0x487ff8
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 4]
jne 0x487ff8
mov dword [ebp - 0x214], 1
jmp 0x488007
mov edx, dword [ebp - 0x208]
add edx, 0xc
mov dword [ebp - 0x208], edx
jmp 0x487fab
cmp dword [ebp - 0x214], 0
jne 0x488019
xor eax, eax
jmp 0x4881e7
mov eax, dword [ebp - 0x208]
cmp dword [eax + 8], 0
je 0x488045
mov ecx, dword [ebp - 0x208]
mov edx, dword [ecx + 8]
push edx
call fcn.00488e70
add esp, 4
test eax, eax
jne 0x488045
mov eax, 1
jmp 0x4881e7
mov dword [ebp - 0x218], 0
cmp dword [ebp + 0xc], 0
je 0x48816c
push 1
mov eax, dword [0x65e9ec]
push eax
mov ecx, dword [0x65e9f0]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jne 0x488102
mov dword [ebp - 0x218], 1
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jne 0x488102
mov eax, dword [ebp + 0xc]
and eax, 0xc
je 0x4880bf
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x104], 1
mov eax, dword [ebp + 0xc]
and eax, 0x10
je 0x4880d7
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x104], 1
mov edx, dword [ebp + 0xc]
and edx, 3
je 0x4880ef
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x104], 1
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x48816c
push 0
call fcn.00405440
add esp, 4
cmp dword [ebp - 0x218], 0
je 0x488133
push 0
mov eax, dword [0x65e9ec]
push eax
mov ecx, dword [0x65e9f0]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, dword [0x65e9ec]
push edx
push str.Input_attachment_to_thread_ID__0x_failed__redirection_disabled
lea eax, [ebp - 0x184]
push eax
call fcn.0040aec0
add esp, 0xc
push 0x10
lea ecx, [ebp - 0x184]
push ecx
call fcn.00405680
push eax
call fcn.00485700
add esp, 0xc
mov eax, 1
jmp 0x4881e7
push 0
mov edx, dword [ebp + 8]
push edx
push 0x100
mov eax, dword [0x65e9e8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
jne 0x4881c3
push 0
call fcn.00405440
add esp, 4
mov ecx, dword [0x65e9e8]
push ecx
push str.Keyboard_redirection_to_window_hwnd__0lx_failed__redirection_disabled
lea edx, [ebp - 0x204]
push edx
call fcn.0040aec0
add esp, 0xc
push 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.00405680
push eax
call fcn.00485700
add esp, 0xc
cmp dword [ebp - 0x218], 0
je 0x4881e2
push 0
mov ecx, dword [0x65e9ec]
push ecx
mov edx, dword [0x65e9f0]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050d210
mov esp, ebp
pop ebp
ret