Function at 0x48ea60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x48f1ff
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x4e6fc0]
mov eax, dword [eax]
xor edx, edx
call fcn.0046279c
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0048c2e4
test eax, eax
jle 0x48eb63
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.0048c2e4
mov edx, eax
dec edx
mov eax, ebx
call fcn.0048c2ec
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x48eb4f
mov eax, esi
call fcn.0048c2e4
cmp ebx, eax
jge 0x48eb4f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.0048c2ec
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x48eb3b
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.0048c2e4
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x48eb3b
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.0048c2ec
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x48eb4f
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.0048e014
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x48eb79
mov eax, ebx
call fcn.0044b43c
call fcn.00466f80
mov byte [ebp - 6], 1
jmp 0x48f1c7
cmp byte [ebp - 6], 0
jne 0x48eb8d
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x48f1a3
mov eax, dword [ebp - 0x38]
sub eax, 0x12
je 0x48eca0
sub eax, 0x34
je 0x48ebbf
add eax, 0xffffffa5
sub eax, 9
jb 0x48eca0
sub eax, 0x157
je 0x48ebd0
jmp 0x48ecac
push ebp
call fcn.0048ea0c
pop ecx
call fcn.004044f8
jmp 0x48f206
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 0x30]
call fcn.00407d00
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 0x3c]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444790
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x48ec51
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x48ec51
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
jmp 0x48ecac
mov edi, dword [ebp - 4]
xor ebx, ebx
jmp 0x48ec83
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [edi + 0x3c]
call fcn.00444790
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [edi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x48ec80
mov bl, 1
mov edi, dword [edi + 0x48]
test edi, edi
je 0x48ec8b
test bl, bl
je 0x48ec58
test bl, bl
jne 0x48ecac
push ebp
call fcn.0048ea0c
pop ecx
call fcn.004044f8
jmp 0x48f206
push ebp
call fcn.0048ea0c
pop ecx
jmp 0x48f1a3
push 3
push 0
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x48f1a3
mov eax, dword [ebp - 0x38]
sub eax, 0x7b
je 0x48f1a3
add eax, 0xffffff7b
sub eax, 9
jb 0x48ed01
add eax, 0xffffff09
sub eax, 0xb
jb 0x48efe7
sub eax, 0x264
jne 0x48f19a
mov eax, dword [ebp - 4]
call fcn.0048e6c4
jmp 0x48f1a3
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x48f1a3
mov eax, dword [ebp - 0x38]
sub eax, 0x100
je 0x48ed37
sub eax, 2
je 0x48ef87
sub eax, 2
je 0x48ed37
sub eax, 2
je 0x48ef87
jmp 0x48f1a3
mov eax, dword [ebp - 0x34]
cmp eax, 0x25
jg 0x48ed7a
je 0x48ee36
cmp eax, 0x12
jg 0x48ed63
je 0x48ef6d
sub eax, 9
je 0x48f1a3
sub eax, 4
je 0x48ed9f
jmp 0x48ef79
sub eax, 0x1b
je 0x48ee09
sub eax, 5
je 0x48f1a3
jmp 0x48ef79
sub eax, 0x26
je 0x48ef30
dec eax
je 0x48eeab
dec eax
je 0x48ef4a
sub eax, 0x51
je 0x48ef6d
jmp 0x48ef79
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x48edb7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov si, 0xffef
call fcn.00403e74
mov eax, dword [ebp - 4]
call fcn.0048e6c4
test al, al
jne 0x48f1a3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x48f1a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x48f214
call fcn.0040546c
je 0x48f1a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x48f1a3
push ebp
call fcn.0048ea0c
pop ecx
jmp 0x48f1a3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x48ee1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.004044f8
jmp 0x48f206
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x48ee4c
mov eax, dword [ebp - 4]
call fcn.0048e8cc
jmp 0x48f1a3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x48f1a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
cmp byte [eax + 0x34], 0
je 0x48ee8c
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov eax, dword [eax + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
call fcn.004044f8
jmp 0x48f206
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
jmp 0x48f1a3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x48eec1
mov eax, dword [ebp - 4]
call fcn.0048e79c
jmp 0x48f1a3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x48f1a3
mov eax, dword [ebp - 4]
call fcn.0048e6c4
test al, al
jne 0x48f1a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
cmp byte [eax + 0x34], 0
je 0x48ef11
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov eax, dword [eax + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
call fcn.004044f8
jmp 0x48f206
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
jmp 0x48f1a3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x48f1a3
mov eax, dword [ebp - 4]
call fcn.0048e8cc
jmp 0x48f1a3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x48ef60
mov eax, dword [ebp - 4]
call fcn.0048e79c
jmp 0x48f1a3
mov eax, dword [ebp - 4]
call fcn.0048e6c4
jmp 0x48f1a3
push ebp
call fcn.0048ea0c
pop ecx
jmp 0x48f1a3
lea eax, [ebp - 0x3c]
push eax
call sub.user32.dll_TranslateMessage
jmp 0x48f1a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [ebp - 0x34]
call fcn.0048d594
test eax, eax
je 0x48f1a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [ebp - 0x34]
call fcn.0048d594
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x48efc8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
jmp 0x48f1a3
mov eax, dword [ebp - 0x38]
sub eax, 0x200
je 0x48efff
sub eax, 2
je 0x48f0d2
jmp 0x48f1a3
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 0x30]
call fcn.00407d00
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 0x3c]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x4fb650]
jne 0x48f031
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x4fb654]
je 0x48f1a3
mov edi, dword [ebp - 4]
jmp 0x48f039
mov edi, dword [edi + 0x48]
cmp dword [edi + 0x48], 0
jne 0x48f036
test edi, edi
je 0x48f0bb
mov eax, dword [edi + 0x40]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0xe]
mov eax, edi
call fcn.0048e014
mov eax, dword [edi + 0x40]
cmp eax, dword [ebp - 0x1c]
je 0x48f0b4
cmp edi, dword [ebp - 4]
je 0x48f0b4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp edi, dword [ebp - 0x20]
je 0x48f093
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x20], eax
cmp edi, dword [ebp - 0x20]
jne 0x48f06b
push 0
push 0
push 0x46f
mov eax, dword [edi + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
call fcn.004044f8
jmp 0x48f206
mov edi, dword [edi + 0x4c]
test edi, edi
jne 0x48f043
mov eax, dword [ebp - 0xe]
mov dword [0x4fb650], eax
mov eax, dword [ebp - 0xa]
mov dword [0x4fb654], eax
jmp 0x48f1a3
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 0x30]
call fcn.00407d00
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 0x3c]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444790
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x48f153
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x48f153
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b43c
push eax
call sub.user32.dll_PostMessageA
jmp 0x48f1a3
mov edi, dword [ebp - 4]
xor ebx, ebx
jmp 0x48f185
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [edi + 0x3c]
call fcn.00444790
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [edi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x48f182
mov bl, 1
mov edi, dword [edi + 0x48]
test edi, edi
je 0x48f18d
test bl, bl
je 0x48f15a
test bl, bl
jne 0x48f1a3
push ebp
call fcn.0048ea0c
pop ecx
jmp 0x48f1a3
lea eax, [ebp - 0x3c]
push eax
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.0048ea38
pop ecx
test al, al
je 0x48f1c7
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x48eb96
push ebp
call fcn.0048ea38
pop ecx
test al, al
jne 0x48eb82
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f206
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x48f1f2
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.00466fa0
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret