Function at 0x480a0e
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x480a15
call fcn.004d5aa0
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.0048a000
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 4]
call fcn.0048a000
mov dword [esp + 8], 1
jmp 0x480a4a
push dword [esp + 4]
call fcn.004d3290
cmp eax, dword [esp + 8]
jl 0x4810d5
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push 1
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.004d3140
lea eax, [esp + 0x10]
push eax
call fcn.004d57f0
push dword [esp + 0xc]
mov edx, 0x511c4a
pop ecx
call fcn.0048a210
je 0x481009
mov ebx, dword [esp + 8]
inc ebx
push ebx
mov eax, 0x511c64
push eax
push dword [esp + 0xc]
call fcn.004d3640
mov ebx, eax
mov edi, dword [esp + 8]
inc edi
sub ebx, edi
mov dword [esp + 0x10], ebx
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
inc ebx
push ebx
push dword [esp + 0x14]
call fcn.004d3140
lea eax, [esp + 0x18]
push eax
call fcn.004d57f0
push dword [esp + 0x14]
mov edx, str.ALTDOWN
mov ecx, dword [esp]
call fcn.0048a210
je 0x480b1e
push 0
push 0
push 0
push 0x12
call sub.USER32.DLL_keybd_event
jmp 0x480f11
mov edx, str.ALTUP
mov ecx, dword [esp]
call fcn.0048a210
je 0x480b4b
push 0
push 2
push 0
push 0x12
call sub.USER32.DLL_keybd_event
jmp 0x480f11
mov edx, str.BACKSPACE
mov ecx, dword [esp]
call fcn.0048a210
je 0x480b67
mov dword [esp + 0x1c], 8
jmp 0x480f11
mov edx, str.CONTROLDOWN
mov ecx, dword [esp]
call fcn.0048a210
je 0x480b94
push 0
push 0
push 0
push 0x11
call sub.USER32.DLL_keybd_event
jmp 0x480f11
mov edx, str.CONTROLUP
mov ecx, dword [esp]
call fcn.0048a210
je 0x480bc1
push 0
push 2
push 0
push 0x11
call sub.USER32.DLL_keybd_event
jmp 0x480f11
mov edx, str.DELETE
mov ecx, dword [esp]
call fcn.0048a210
je 0x480bdd
mov dword [esp + 0x1c], 0x2e
jmp 0x480f11
mov edx, str.DOWN
mov ecx, dword [esp]
call fcn.0048a210
je 0x480bf9
mov dword [esp + 0x1c], 0x28
jmp 0x480f11
mov edx, 0x515550
mov ecx, dword [esp]
call fcn.0048a210
je 0x480c15
mov dword [esp + 0x1c], 0x23
jmp 0x480f11
mov edx, str.ENTER
mov ecx, dword [esp]
call fcn.0048a210
je 0x480c31
mov dword [esp + 0x1c], 0xd
jmp 0x480f11
mov edx, 0x515294
mov ecx, dword [esp]
call fcn.0048a210
je 0x480c4d
mov dword [esp + 0x1c], 0x70
jmp 0x480f11
mov edx, 0x5152ce
mov ecx, dword [esp]
call fcn.0048a210
je 0x480c69
mov dword [esp + 0x1c], 0x71
jmp 0x480f11
mov edx, 0x51533a
mov ecx, dword [esp]
call fcn.0048a210
je 0x480c85
mov dword [esp + 0x1c], 0x72
jmp 0x480f11
mov edx, 0x515354
mov ecx, dword [esp]
call fcn.0048a210
je 0x480ca1
mov dword [esp + 0x1c], 0x73
jmp 0x480f11
mov edx, 0x51536a
mov ecx, dword [esp]
call fcn.0048a210
je 0x480cbd
mov dword [esp + 0x1c], 0x74
jmp 0x480f11
mov edx, 0x51539a
mov ecx, dword [esp]
call fcn.0048a210
je 0x480cd9
mov dword [esp + 0x1c], 0x75
jmp 0x480f11
mov edx, 0x5153bc
mov ecx, dword [esp]
call fcn.0048a210
je 0x480cf5
mov dword [esp + 0x1c], 0x76
jmp 0x480f11
mov edx, 0x5153d4
mov ecx, dword [esp]
call fcn.0048a210
je 0x480d11
mov dword [esp + 0x1c], 0x77
jmp 0x480f11
mov edx, 0x515484
mov ecx, dword [esp]
call fcn.0048a210
je 0x480d2d
mov dword [esp + 0x1c], 0x78
jmp 0x480f11
mov edx, 0x51651e
mov ecx, dword [esp]
call fcn.0048a210
je 0x480d49
mov dword [esp + 0x1c], 0x79
jmp 0x480f11
mov edx, 0x516526
mov ecx, dword [esp]
call fcn.0048a210
je 0x480d65
mov dword [esp + 0x1c], 0x7a
jmp 0x480f11
mov edx, 0x5165c4
mov ecx, dword [esp]
call fcn.0048a210
je 0x480d81
mov dword [esp + 0x1c], 0x7b
jmp 0x480f11
mov edx, str.ESCAPE
mov ecx, dword [esp]
call fcn.0048a210
je 0x480d9d
mov dword [esp + 0x1c], 0x1b
jmp 0x480f11
mov edx, str.HOME
mov ecx, dword [esp]
call fcn.0048a210
je 0x480db9
mov dword [esp + 0x1c], 0x24
jmp 0x480f11
mov edx, str.INSERT
mov ecx, dword [esp]
call fcn.0048a210
je 0x480dd5
mov dword [esp + 0x1c], 0x2d
jmp 0x480f11
mov edx, 0x510306
mov ecx, dword [esp]
call fcn.0048a210
je 0x480df1
mov dword [esp + 0x1c], 0x25
jmp 0x480f11
mov edx, str.PAGEDOWN
mov ecx, dword [esp]
call fcn.0048a210
je 0x480e0d
mov dword [esp + 0x1c], 0x22
jmp 0x480f11
mov edx, str.PAGEUP
mov ecx, dword [esp]
call fcn.0048a210
je 0x480e29
mov dword [esp + 0x1c], 0x21
jmp 0x480f11
mov edx, str.PRINTSCREEN
mov ecx, dword [esp]
call fcn.0048a210
je 0x480e45
mov dword [esp + 0x1c], 0x2c
jmp 0x480f11
mov edx, str.RETURN
mov ecx, dword [esp]
call fcn.0048a210
je 0x480e61
mov dword [esp + 0x1c], 0xd
jmp 0x480f11
mov edx, str.RIGHT
mov ecx, dword [esp]
call fcn.0048a210
je 0x480e7d
mov dword [esp + 0x1c], 0x27
jmp 0x480f11
mov edx, str.SHIFTDOWN
mov ecx, dword [esp]
call fcn.0048a210
je 0x480eaf
mov dword [esp + 0x20], 1
push 0
push 0
push 0
push 0x10
call sub.USER32.DLL_keybd_event
jmp 0x480f11
mov edx, str.SHIFTUP
mov ecx, dword [esp]
call fcn.0048a210
je 0x480ee1
mov dword [esp + 0x20], 0
push 0
push 2
push 0
push 0x10
call sub.USER32.DLL_keybd_event
jmp 0x480f11
mov edx, 0x519b28
mov ecx, dword [esp]
call fcn.0048a210
je 0x480efa
mov dword [esp + 0x1c], 9
jmp 0x480f11
mov edx, 0x514f10
mov ecx, dword [esp]
call fcn.0048a210
je 0x480f11
mov dword [esp + 0x1c], 0x26
pop eax
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push 3
push dword [esp + 0x20]
call fcn.004d30d0
call fcn.004d5880
mov edx, 0x51a608
pop ecx
push ecx
call fcn.0048a200
mov ecx, eax
call fcn.0048a210
jne 0x480fc1
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push 7
push dword [esp + 0x20]
call fcn.004d30d0
call fcn.004d5880
mov edx, str.CONTROL
pop ecx
push ecx
call fcn.0048a200
mov ecx, eax
call fcn.0048a210
jne 0x480fc1
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push 5
push dword [esp + 0x20]
call fcn.004d30d0
call fcn.004d5880
mov edx, str.SHIFT
pop ecx
push ecx
call fcn.0048a200
mov ecx, eax
call fcn.0048a210
jne 0x480fc1
mov eax, 1
jmp 0x480fc3
xor eax, eax
and eax, eax
je 0x480ff7
push 0
push 0
push 0
push dword [esp + 0x24]
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push dword [esp + 0x24]
call sub.USER32.DLL_keybd_event
mov ebx, dword [esp + 8]
add ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 8], ebx
jmp 0x4810cb
push 0
call sub.USER32.DLL_GetKeyboardLayout
push eax
push dword [esp + 0x10]
call fcn.004d3c30
push eax
call sub.USER32.DLL_VkKeyScanExW
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
cmp ebx, 0x130
jle 0x481042
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x481042
mov eax, 1
jmp 0x481044
xor eax, eax
and eax, eax
je 0x481061
push 0
push 0
push 0
push 0x10
call sub.USER32.DLL_keybd_event
push 0
push 0
push 0
push dword [esp + 0x24]
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push dword [esp + 0x24]
call sub.USER32.DLL_keybd_event
mov ebx, dword [esp + 0x18]
cmp ebx, 0x130
jle 0x4810ac
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x4810ac
mov eax, 1
jmp 0x4810ae
xor eax, eax
and eax, eax
je 0x4810cb
push 0
push 2
push 0
push 0x10
call sub.USER32.DLL_keybd_event
inc dword [esp + 8]
jno 0x480a4a
mov ebx, dword [esp + 0x20]
cmp ebx, dword [esp + 0x24]
je 0x4810f1
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
call sub.USER32.DLL_AttachThreadInput
push 0
push 2
push 0
push 0x12
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push 0x11
call sub.USER32.DLL_keybd_event
push 0
push 2
push 0
push 0x10
call sub.USER32.DLL_keybd_event
mov eax, 1
jmp 0x481145
push dword [esp + 4]
call fcn.004d5b30
push dword [esp + 0x14]
call fcn.004d5b30
push dword [esp + 0xc]
call fcn.004d5b30
push dword [esp]
call fcn.004d5b30
add esp, 0x28
pop edi
pop ebx
ret 0xc