Function at 0x488bc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x6c
push esi
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
test esi, esi
je 0x488c22
lea eax, [esp + 0xc]
push 0x64
push eax
call fcn.00423a00
add esp, 8
push 0x63
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea edx, [esp + 0xc]
push str.Edit
push edx
call fcn.005e31f5
add esp, 8
test eax, eax
je 0x488c33
mov eax, dword [0x63b6a8]
test eax, eax
je 0x488c22
lea eax, [esp + 0xc]
push str.RichEdit20A
push eax
call fcn.005e31f5
add esp, 8
test eax, eax
je 0x488c33
push 0
call fcn.00421c80
add esp, 4
xor eax, eax
pop esi
add esp, 0x6c
ret
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test ah, 8
jne 0x488c2c
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push ebp
push edi
push esi
call ebx
mov edi, eax
push edi
call fcn.00582af0
add esp, 4
test eax, eax
je 0x488c63
mov eax, 1
jmp 0x488ce1
cmp edi, dword [0x641500]
je 0x488cdc
cmp edi, dword [0x610c78]
je 0x488cdc
push edi
call ebx
cmp eax, dword [0x610c78]
je 0x488cdc
cmp edi, dword [0x637f24]
je 0x488cdc
mov eax, dword [0x615f08]
cmp edi, eax
je 0x488cdc
cmp edi, dword [0x61604c]
je 0x488cdc
test eax, eax
je 0x488ca6
push edi
call ebx
cmp eax, dword [0x615f08]
je 0x488cdc
mov ebx, dword [0x613894]
test ebx, ebx
je 0x488cd2
mov ebp, dword [sym.imp.USER32.dll_IsChild]
mov eax, dword [ebx + 0xc8]
cmp eax, edi
je 0x488cdc
push edi
push eax
call ebp
test eax, eax
jne 0x488cdc
mov ebx, dword [ebx + 0x13ac]
test ebx, ebx
jne 0x488cb6
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x6c
ret
mov eax, 2
mov bl, byte [esp + 0x80]
cmp bl, 3
mov dword [0x609a98], 0xffffffff
jne 0x488d0b
mov ecx, dword [0x61368c]
test ecx, ecx
je 0x488d0b
push eax
push esi
call fcn.0043f630
add esp, 8
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push esi
call fcn.00488760
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
add esp, 0x10
cmp ebp, edi
jne 0x488dcc
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cmp bl, 3
jne 0x488d5a
test ah, ah
push 3
jns 0x488d78
push 3
lea eax, [esp + 0x20]
push str._c_c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x488d8b
test ah, ah
movzx eax, bl
push eax
jns 0x488d78
push eax
lea edx, [esp + 0x20]
push str._c_c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x488d8b
lea ecx, [esp + 0x1c]
push 0x5e7094
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
push edi
push 1
push esi
call fcn.00488690
add esp, 0x10
lea edx, [esp + 0x18]
push edx
push 0
push 0xc2
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
inc edi
push edi
push edi
push 1
push esi
call fcn.00488690
add esp, 0x10
mov dword [0x609a98], edi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x6c
ret
cmp bl, 3
jne 0x488e48
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 3
lea eax, [esp + 0x1c]
push 0x5e7094
push eax
call ebx
push ebp
push ebp
push 1
push esi
call fcn.00488690
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x1c
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xc2
push esi
call ebp
push 3
lea edx, [esp + 0x1c]
push 0x5e7094
push edx
call ebx
push edi
push edi
push 1
push esi
call fcn.00488690
add esp, 0x1c
lea eax, [esp + 0x18]
push eax
push 0
push 0xc2
push esi
call ebp
lea eax, [esp + 0x18]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488e38
sub eax, ecx
add edi, eax
jmp 0x488dac
movzx ebx, bl
push ebx
lea ecx, [esp + 0x1c]
push 0x5e7094
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
push edi
push 1
push esi
call fcn.00488690
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x1c
lea edx, [esp + 0x18]
push edx
push 0
push 0xc2
push esi
call edi
lea eax, [esp + 0x18]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488e85
sub eax, ecx
push ebx
add ebp, eax
lea eax, [esp + 0x1c]
push 0x5e7094
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebp
push ebp
push 1
push esi
call fcn.00488690
add esp, 0x1c
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xc2
push esi
call edi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x6c
ret