Function at 0x485910
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
cmp dword [edi + 0x1ac0], 0
je 0x485a78
cmp ebx, 0x100
jne 0x485a78
cmp esi, 0x1b
je 0x485a5b
cmp esi, 0xd
je 0x485a5b
cmp esi, 0x25
je 0x48596e
cmp esi, 0x27
je 0x48596e
cmp esi, 0x26
je 0x48596e
cmp esi, 0x28
je 0x48596e
cmp esi, 0x24
je 0x48596e
cmp esi, 0x23
jne 0x485af2
lea eax, [ebp - 8]
push eax
call fcn.0047c670
cmp esi, 0x25
jne 0x485989
cmp word [ebp - 8], 0
jle 0x4859f0
dec word [ebp - 8]
jmp 0x4859f0
cmp esi, 0x27
jne 0x4859a4
movsx ecx, word [edi + 0x1afc]
movsx edx, word [ebp - 8]
dec ecx
cmp edx, ecx
jge 0x4859f0
inc word [ebp - 8]
jmp 0x4859f0
cmp esi, 0x26
jne 0x4859b6
cmp word [ebp - 6], 0
jle 0x4859f0
dec word [ebp - 6]
jmp 0x4859f0
cmp esi, 0x28
jne 0x4859d1
movsx eax, word [edi + 0x1afe]
movsx ecx, word [ebp - 6]
dec eax
cmp ecx, eax
jge 0x4859f0
inc word [ebp - 6]
jmp 0x4859f0
cmp esi, 0x24
jne 0x4859de
xor edx, edx
mov word [ebp - 8], dx
jmp 0x4859f0
cmp esi, 0x23
jne 0x4859f0
mov ax, word [edi + 0x1afc]
dec ax
mov word [ebp - 8], ax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x485a3f
mov eax, dword [ebp - 6]
mov edx, dword [edi + 0x1ac0]
mov ecx, dword [ebp - 8]
push 0
push 0
push 0
push eax
xor eax, eax
and edx, 0x200
cmp edx, 0x200
sete al
push ecx
mov ecx, edi
push eax
call fcn.00481950
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 6]
mov edx, dword [ebp - 8]
push 1
push ecx
push edx
mov ecx, edi
call fcn.0047e450
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp esi, 0x1b
setne al
movzx ecx, al
push esi
push ecx
mov ecx, edi
call fcn.00485820
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp ebx, 0x101
jne 0x485aea
mov eax, dword [edi + 0x50]
movzx edx, word [eax + 0x4938]
cmp esi, edx
jne 0x485aa2
pop edi
xor ecx, ecx
pop esi
mov word [eax + 0x4938], cx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1264], 0
je 0x485b45
push 0
push 0x7da
call fcn.0044f060
push eax
push esi
call fcn.00425d80
add esp, 8
test al, al
je 0x485b45
cmp dword [edi + 0x1b98], 0
je 0x485b45
push 0
mov ecx, edi
call fcn.0047cb70
mov ecx, edi
call fcn.0047bcd0
jmp 0x485b45
cmp ebx, 0x100
jne 0x485b45
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1264], 0
je 0x485b2f
push 0
push 0x7da
call fcn.0044f060
push eax
push esi
call fcn.00425d80
add esp, 8
test al, al
je 0x485b2f
push 1
mov ecx, edi
call fcn.004834c0
test al, al
je 0x485b2f
mov ecx, edi
call fcn.0047bcd0
mov eax, dword [edi + 0x50]
cmp word [eax + 0x4938], 0
je 0x485b45
xor edx, edx
mov word [eax + 0x4938], dx
mov eax, dword [edi]
lea ecx, [eax - 2]
cmp ecx, 3
ja 0x485bf0
cmp ebx, 0x101
jne 0x485b9c
cmp esi, 0x1b
jne 0x485bf0
cmp eax, 4
jne 0x485b87
mov edx, dword [0x52fe2c]
mov eax, dword [edx + 0x40d0]
cmp dword [eax], 0
je 0x485b87
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x485bf0
mov ecx, dword [edi + 0x50]
push 1
call fcn.0048d600
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp ebx, 0x100
jne 0x485bf0
cmp esi, 0x22
je 0x485bd9
cmp esi, 0x21
je 0x485bd9
cmp eax, 3
je 0x485bf0
cmp eax, 4
je 0x485bf0
cmp esi, 0x26
je 0x485bc2
cmp esi, 0x28
jne 0x485bf0
mov ecx, dword [edi + 0x50]
push ecx
push esi
push 0
call fcn.0042c9a0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [edi + 0x50]
push edx
push esi
push 0
call fcn.0042c9a0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14