Function at 0x488770
Capabilities:
Check if file exists
Get file attributes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x552064]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
lea eax, [esp + 0x14]
mov byte [esp + 0xf], cl
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x14]
push eax
call esi
push 0x556f2c
call esi
mov ebx, 0x55718c
nop
mov esi, dword [ebx]
mov edi, 4
add esi, 0x2c
nop word [eax + eax]
mov ecx, dword [esi]
test ecx, ecx
je 0x4887cc
mov eax, dword [ecx]
push ecx
call dword [eax + 0x48]
add esi, 0x1e
sub edi, 1
jne 0x4887c0
add ebx, 4
cmp ebx, 0x5571cc
jl 0x4887b0
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x556f2c
call edi
call fcn.00494ff0
mov bl, byte [esp + 0xf]
test bl, bl
jne 0x488829
mov ecx, dword [0x560204]
mov edx, dword [ecx + 8]
test edx, edx
je 0x488822
mov eax, dword [ecx + 0x1c]
imul eax, dword [ecx + 0x18]
shl eax, 2
push eax
push 0
push edx
call fcn.004fdf60
mov ecx, dword [0x560204]
add esp, 0xc
mov dword [ecx + 0x10], 0
call fcn.0048e700
mov ecx, dword [0x563da8]
call fcn.00461de0
mov ecx, dword [0x5643c9]
call fcn.00461de0
push dword [0x5643c5]
call fcn.004c57d0
add esp, 4
mov byte [0x564406], 0
push 0x564350
call fcn.004c57d0
add esp, 4
push 0
call fcn.004b3d80
add esp, 4
push 0
call fcn.004b6810
add esp, 4
push 0
call fcn.004aa0f0
add esp, 4
push 0
call fcn.004bbdf0
add esp, 4
push 0
call fcn.004ba030
mov ecx, dword [0x563f64]
add esp, 4
mov edx, dword [ecx + 8]
test edx, edx
je 0x4888bb
mov eax, dword [ecx + 0x1c]
imul eax, dword [ecx + 0x18]
shl eax, 2
push eax
push 0
push edx
call fcn.004fdf60
add esp, 0xc
mov ecx, dword [0x563f68]
mov edx, dword [ecx + 8]
test edx, edx
je 0x4888de
mov eax, dword [ecx + 0x1c]
imul eax, dword [ecx + 0x18]
shl eax, 2
push eax
push 0
push edx
call fcn.004fdf60
add esp, 0xc
mov esi, dword [0x563f6d]
mov byte [0x563f6c], 0
mov ecx, dword [esi + 0x75]
test ecx, ecx
je 0x488914
mov eax, dword [ecx - 8]
add ecx, 0xfffffff8
cmp eax, 0xffffffff
je 0x48890d
dec eax
mov dword [ecx], eax
test eax, eax
jg 0x48890d
push ecx
call fcn.00501c9e
add esp, 4
mov dword [esi + 0x75], 0
push esi
call fcn.004c57d0
movaps xmm0, xmmword [0x545650]
add esp, 4
mov word [0x563fad], 0
movups xmmword [0x563faf], xmm0
push 0
call fcn.004be640
add esp, 4
push 0
call fcn.004b6090
add esp, 4
test bl, bl
jne 0x48897f
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x7b
call esi
bt ax, 0xf
jae 0x488970
nop dword [eax]
call fcn.00469420
push 0x7b
call esi
bt ax, 0xf
jb 0x488960
mov esi, 0x14
call fcn.00469420
sub esi, 1
jne 0x488975
cmp byte [0x556a1e], 0
mov byte [0x556c51], 0
mov byte [0x556bc3], 0
je 0x48899d
call fcn.00488490
jmp 0x4889a4
mov byte [0x5645b0], 6
mov eax, dword [0x560210]
movsd xmm2, qword [0x5454e0]
test eax, eax
jg 0x4889bf
movsd qword [0x5602b0], xmm2
jmp 0x4889df
movd xmm1, dword [0x55312c]
movd xmm0, eax
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x5602b0], xmm1
mov eax, dword [0x560214]
test eax, eax
jg 0x4889f2
movsd qword [0x5602b8], xmm2
jmp 0x488a12
movd xmm1, dword [0x5530c4]
movd xmm0, eax
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x5602b8], xmm1
mov ecx, dword [0x5602ac]
test ecx, ecx
je 0x488a9b
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov byte [0x56388c], 0
call fcn.0048faa0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x488a6e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x488a53
test al, 0x10
jne 0x488a53
mov ecx, esi
call fcn.0048f530
mov eax, dword [esi - 8]
add esi, 0xfffffff8
cmp eax, 0xffffffff
je 0x488a6e
dec eax
mov dword [esi], eax
test eax, eax
jg 0x488a6e
push esi
call fcn.00501c9e
add esp, 4
mov eax, dword [0x564610]
mov edx, 1
mov dword [0x5602ac], 0
mov byte [0x5645b0], 0
mov dword [eax + 8], 0
mov ecx, dword [0x564610]
call fcn.00492040
lea eax, [esp + 0x14]
mov dword [0x5602cc], 0
push eax
call edi
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e66f2
mov esp, ebp
pop ebp
ret