Function at 0x486b90
Capabilities:
Log keystrokes via polling
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5398fb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x34]
test esi, esi
je 0x486bcb
mov dword [esi], 0
push 0x38
call fcn.00517778
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x24], 0
je 0x486bf0
mov ecx, eax
call fcn.00487940
mov edi, eax
jmp 0x486bf2
xor edi, edi
test edi, edi
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x18], edi
jne 0x486c0c
mov eax, 0x8007000e
jmp 0x486ceb
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x486c25
push eax
mov ecx, edi
call fcn.00486ed0
mov dword [esp + 0x2c], eax
jmp 0x486d09
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
and ax, 0x8000
push 0x12
movzx ebx, ax
call esi
and ax, 0x8000
push 0x10
movzx ebp, ax
call esi
mov edx, dword [esp + 0x30]
movsx esi, ax
movsx eax, bp
movsx ecx, bx
and esi, eax
and esi, ecx
push edx
mov ecx, edi
and esi, 0xffff8000
call fcn.00486fa0
test esi, esi
mov dword [esp + 0x2c], eax
je 0x486d01
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.QTPlayerExportSessionFiles
call fcn.00488980
call fcn.004a02d0
add esp, 4
test eax, eax
je 0x486d01
mov ecx, edi
call fcn.00486e40
push 0x55d1e0
push str.c:out.exportSession
mov esi, eax
call fcn.00519de2
add esp, 8
mov ebx, eax
push ebx
push esi
call fcn.004cf9d0
add esp, 4
push eax
push 1
push esi
call fcn.004cf9f0
add esp, 4
push eax
call fcn.005195e4
push ebx
call fcn.00519409
add esp, 0x14
mov dword [esp + 0x2c], 0xffffff80
mov ecx, edi
call fcn.00487ea0
push edi
call fcn.0051688a
add esp, 4
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x2c], 0
jl 0x486cd7
test esi, esi
je 0x486d16
mov dword [esi], edi
lea ebp, [ebx + 0x1c]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x18]
lea esi, [ebx + 0xc]
push eax
mov ecx, esi
call fcn.00486b20
mov eax, dword [esi + 4]
test eax, eax
jne 0x486d3a
xor esi, esi
jmp 0x486d42
mov esi, dword [esi + 8]
sub esi, eax
sar esi, 2
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, 1
jne 0x486d64
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x486d64
push eax
call fcn.004833a0
push eax
call fcn.00483b40
add esp, 8
cmp dword [ebx], 0
jne 0x486d82
call fcn.00412a00
mov dword [ebx], eax
mov edx, dword [eax]
push ebx
mov ecx, eax
mov eax, dword [edx + 0x1e0]
push 0x486760
call eax
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1e8]
call eax
test eax, eax
je 0x486d9a
push eax
mov ecx, edi
call fcn.00486f60
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x4c]
push 1
call eax
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.00486f90
test eax, eax
je 0x486ce7
call fcn.004a0650
test eax, eax
jne 0x486ce7
call fcn.004a05c0
test eax, eax
jne 0x486ce7
mov ecx, edi
call fcn.00487f50
test eax, eax
mov dword [esp + 0x2c], eax
jge 0x486ce7
push edi
mov ecx, ebx
call fcn.00485fe0
jmp 0x486ce7