Function at 0x481650
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push esi
mov esi, ecx
push edi
mov ebx, 1
push 0x10
mov dword [esi], 0
mov byte [esi + 8], 0
mov byte [esi + 9], 0
mov byte [esi + 0xa], 0
mov byte [esi + 0xb], 0
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xd], bl
mov byte [esi + 0xc], 0
call ebp
test ax, ax
setl al
push 0x11
mov byte [esi + 9], al
call ebp
test ax, ax
setl cl
push 0x90
mov byte [esi + 0xa], cl
mov byte [esi + 8], 0
mov byte [esi + 0xb], 0
mov byte [esi + 0xc], 0
mov byte [esi + 0xd], bl
call ebp
and eax, ebx
mov dword [esp + 0x10], eax
mov al, byte [esp + 0x1c]
test al, al
je 0x481942
mov edi, dword [esp + 0x18]
push edi
call ebp
test ax, ax
setl dl
cmp edi, 0x10
mov byte [esi + 0xc], dl
je 0x481930
cmp edi, 0x11
je 0x481930
mov eax, dword [esp + 0x10]
test eax, eax
je 0x48170e
cmp edi, 0x5f
jle 0x48170e
cmp edi, 0x6a
jge 0x48170e
add edi, 0xffffffd0
mov byte [esi + 0xb], bl
mov dword [esi], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x69
jle 0x48172a
cmp edi, 0x70
jge 0x48172a
add edi, 0xffffffc0
mov byte [esi + 0xb], bl
mov dword [esi], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x6f
jle 0x481746
cmp edi, 0x7f
jge 0x481746
add edi, 0xffffffb9
mov byte [esi + 8], bl
mov dword [esi], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
lea eax, [edi - 8]
cmp eax, 0x89
ja case.0x48175c.31
xor ecx, ecx
mov cl, byte [eax + 0x4819b4]
jmp dword [ecx*4 + 0x481954]
mov byte [esi + 8], bl
mov dword [esi], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 2
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 3
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 5
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 6
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 7
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x12
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0xd
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0xe
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0xf
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x11
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x16
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x17
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x18
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x19
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x13
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x20
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x38
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x39
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov byte [esi + 8], bl
mov dword [esi], 0x3a
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push edi
mov ecx, esi
call fcn.00481b70
and eax, 0xff
mov dword [esi + 4], edi
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
add edi, 0x55
mov byte [esi + 8], bl
mov dword [esi], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x18]
mov eax, esi
mov dword [esi], edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8