Function at 0x48e3a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
xor eax, eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 2
mov ebx, ecx
mov word [ebp - 0x14], ax
cmp edi, 0x202
je 0x48e406
cmp edi, 0x201
je 0x48e402
cmp edi, 0x203
je 0x48e402
cmp byte [ebp + 0x14], 0
jne 0x48e406
push 1
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x48e406
or dword [ebp - 0xc], 1
cmp edi, 0x205
je 0x48e43b
cmp edi, 0x204
je 0x48e437
cmp edi, 0x206
je 0x48e437
cmp byte [ebp + 0x14], 0
jne 0x48e43b
push 2
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x48e43b
or dword [ebp - 0xc], 2
cmp edi, 0x208
je 0x48e470
cmp edi, 0x207
je 0x48e46c
cmp edi, 0x209
je 0x48e46c
cmp byte [ebp + 0x14], 0
jne 0x48e470
push 4
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x48e470
or dword [ebp - 0xc], 4
mov eax, edi
mov edi, dword [ebp + 0xc]
cmp eax, 0x20c
je 0x48e4a1
cmp eax, 0x20b
je 0x48e48a
cmp eax, 0x20d
jne 0x48e4a1
mov eax, edi
shr eax, 0x10
test al, 1
je 0x48e499
or dword [ebp - 0xc], 8
jmp 0x48e4a1
test al, 2
je 0x48e4a1
or dword [ebp - 0xc], 0x10
test byte [ebp - 0xc], 7
mov eax, 0
setne al
push 0x14
mov dword [ebx + 0x6ba4], eax
call esi
test al, 1
je 0x48e4c2
or dword [ebp - 8], 0x80
push 0x90
call esi
test al, 1
je 0x48e4d1
or dword [ebp - 8], 0x20
push 0x91
call esi
test al, 1
je 0x48e4e0
or dword [ebp - 8], 0x40
push 0xa4
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x48e4fa
or dword [ebp - 8], 2
push 0xa5
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x48e514
or dword [ebp - 8], 1
push 0xa2
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x48e52e
or dword [ebp - 8], 8
push 0xa3
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x48e548
or dword [ebp - 8], 4
push 0x10
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x48e55f
or dword [ebp - 8], 0x10
mov esi, dword [ebp + 8]
cmp esi, 0x203
je 0x48e773
cmp esi, 0x206
je 0x48e773
cmp esi, 0x209
je 0x48e773
cmp esi, 0x200
jne 0x48e59a
mov dword [ebp - 4], 1
jmp 0x48e7a5
cmp esi, 0x20a
jne 0x48e6a3
movsx eax, word [ebp + 0x12]
movsx ecx, word [ebp + 0x10]
push eax
push ecx
mov esi, edi
movzx edx, di
shr esi, 0x10
push edx
movsx eax, si
push eax
lea ecx, [ebp - 0x11c]
push str.WM_MOUSEWHEEL__i__Btns0x_04X__x_i__y_i__n
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp byte [ebx + 0x4961], 2
jb 0x48e619
movsx edx, word [ebp + 0x12]
movsx eax, word [ebp + 0x10]
push edx
push eax
push edi
lea ecx, [ebp - 0x9c]
push str.WM_MOUSEWHEEL_wParam0x_08X__x_i__y_i_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebx + 0x4964]
add esp, 0x14
test ecx, ecx
je 0x48e619
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x9c]
push edx
call fcn.004c87c0
movzx eax, si
mov dword [ebp - 4], 4
test ax, ax
jge 0x48e644
cmp ax, 0xff88
jle 0x48e664
mov esi, dword [ebp + 8]
mov eax, 0xffffff88
movzx edx, ax
shl edx, 0x10
or dword [ebp - 0xc], edx
jmp 0x48e7a5
cmp ax, 0x78
jge 0x48e660
mov esi, dword [ebp + 8]
mov eax, 0x78
movzx edx, ax
shl edx, 0x10
or dword [ebp - 0xc], edx
jmp 0x48e7a5
cmp ax, 0xff88
jl 0x48e66c
cmp ax, 0x78
jle 0x48e692
movsx ecx, ax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
shl ecx, 4
sub ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
movzx eax, cx
mov esi, dword [ebp + 8]
movzx edx, ax
shl edx, 0x10
or dword [ebp - 0xc], edx
jmp 0x48e7a5
cmp esi, 0x20e
jne 0x48e77a
cmp byte [ebx + 0x4961], 2
jb 0x48e6f6
movsx eax, word [ebp + 0x12]
movsx ecx, word [ebp + 0x10]
push eax
push ecx
push edi
lea edx, [ebp - 0x9c]
push str.WM_MOUSEHWHEEL_wParam0x_08X__x_i__y_i_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebx + 0x4964]
add esp, 0x14
test ecx, ecx
je 0x48e6f6
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.004c87c0
shr edi, 0x10
mov eax, edi
mov dword [ebp - 4], 8
test ax, ax
jge 0x48e720
cmp ax, 0xff88
jle 0x48e73a
mov eax, 0xffffff88
movzx edx, ax
shl edx, 0x10
or dword [ebp - 0xc], edx
jmp 0x48e7a5
cmp ax, 0x78
jge 0x48e736
mov eax, 0x78
movzx edx, ax
shl edx, 0x10
or dword [ebp - 0xc], edx
jmp 0x48e7a5
cmp ax, 0xff88
jl 0x48e742
cmp ax, 0x78
jle 0x48e768
movsx ecx, ax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
shl ecx, 4
sub ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
movzx eax, cx
movzx edx, ax
shl edx, 0x10
or dword [ebp - 0xc], edx
jmp 0x48e7a5
mov dword [ebp - 4], 2
cmp esi, 0x201
je 0x48e792
cmp esi, 0x204
je 0x48e792
cmp esi, 0x207
jne 0x48e7a5
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x6a0c], 1
mov dword [ebx + 0x6a10], eax
mov ecx, dword [ebp - 0xc]
and cl, 2
cmp cl, 2
sete al
mov byte [ebp + 0xb], al
test al, al
je 0x48e869
mov ecx, dword [ebx + 0x46c8]
test ecx, ecx
je 0x48e7e2
mov eax, dword [ebx + 0x4924]
test al, 4
je 0x48e7e2
test al, 0x10
jne 0x48e7e2
mov eax, dword [ebx + 0x6b94]
test eax, eax
je 0x48e7e2
cmp eax, ecx
je 0x48e7e4
xor eax, eax
test eax, eax
setne al
test al, al
je 0x48e869
cmp dword [ebx + 0x59a8], 0
je 0x48e869
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x11288], 0
je 0x48e869
movsx eax, word [ebx + 0x59b2]
cmp eax, 3
jg 0x48e81f
jne 0x48e869
cmp dword [ebx + 0x59b4], 0x94d
jb 0x48e869
cmp byte [ecx + 0x11273], 0
jne 0x48e837
test dword [ebp - 8], 0xf
jne 0x48e869
mov byte [ebp + 0xb], 0
jmp 0x48e869
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x41f0]
push 1
push 0
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.0047ba40
mov ecx, dword [ebp + 0xc]
push 1
push ecx
mov ecx, ebx
call fcn.0048ca40
test eax, eax
je 0x48e869
test byte [ebp - 8], 0x1f
jne 0x48e869
or dword [ebp - 8], 5
cmp esi, 0x200
jne 0x48e91b
cmp dword [ebx + 0x6a00], 1
mov ax, word [ebp + 0x12]
mov cx, word [ebp + 0x10]
jne 0x48e8c1
mov edx, dword [ebp - 0xc]
cmp dword [ebx + 0x69f8], edx
jne 0x48e8c1
mov edx, dword [ebp - 8]
cmp dword [ebx + 0x69fc], edx
jne 0x48e8c1
movsx edx, word [ebx + 0x69f4]
movsx esi, cx
sub edx, esi
jne 0x48e8c1
movsx edx, word [ebx + 0x69f6]
movsx esi, ax
sub edx, esi
jne 0x48e8c1
cmp byte [ebp + 0x14], dl
je 0x48ea12
cmp dword [ebx + 0x6a0c], 0
je 0x48e90d
cmp dword [ebx + 0x6ba4], 0
je 0x48e903
cmp word [ebx + 0x6a10], cx
jne 0x48e8e5
cmp word [ebx + 0x6a12], ax
je 0x48e903
mov eax, dword [ebx + 0x6a10]
push 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.0048d7e0
mov ax, word [ebp + 0x12]
mov cx, word [ebp + 0x10]
mov dword [ebx + 0x6a0c], 0
mov word [ebx + 0x6ba8], cx
mov word [ebx + 0x6baa], ax
mov edx, dword [0x52fe30]
cmp byte [edx + 0x11288], 0
je 0x48e9da
mov ecx, dword [ebx + 0x41e4]
cmp dword [ebx + 0x41f0], ecx
je 0x48e945
push 0
push 0
jmp 0x48e9d5
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0
call fcn.0047bb70
test eax, eax
je 0x48e9c3
cmp byte [ebp + 0xb], 0
jne 0x48e965
push 0
push 0
jmp 0x48e9cf
mov edx, dword [ebp + 0x12]
mov ecx, dword [ebp - 0x1a]
sub edx, ecx
movzx eax, dx
cmp ax, 0xffff
jl 0x48e97c
cmp ax, 1
jle 0x48e9c3
movzx edi, word [ebp + 0x12]
xor edx, edx
cmp ax, 0xffff
setge dl
lea edx, [edx + edx - 1]
movzx esi, dx
lea eax, [esi + ecx]
mov word [ebp + 0x12], ax
cmp ax, di
je 0x48e9c3
lea esp, [esp]
mov eax, dword [ebp + 0x10]
push 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.0048d7e0
mov ax, word [ebp + 0x12]
add ax, si
mov word [ebp + 0x12], ax
cmp ax, di
jne 0x48e9a0
cmp byte [ebp + 0xb], 0
je 0x48e9da
lea edx, [ebp + 0x10]
push edx
push 1
mov ecx, dword [ebx + 0x41e4]
call fcn.0047bb90
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x46c8]
test eax, eax
je 0x48ea05
cmp eax, dword [ebx + 0x46d4]
je 0x48ea05
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov ecx, dword [ebx + 0x46c8]
mov dword [ebx + 0x46d4], ecx
push 0
lea edx, [ebp - 0x14]
push edx
mov ecx, ebx
call fcn.0048d7e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10