Function at 0x48cbb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ec
mov eax, dword [0x5bd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x4e4], 0
push 0x5c
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4dc], 0
mov ebx, ecx
movlpd qword [ebp - 0x4d4], xmm0
push 0
push eax
mov edi, edx
mov dword [ebp - 0x4b0], ebx
movlpd qword [ebp - 0x4cc], xmm0
movlpd qword [ebp - 0x4c4], xmm0
movlpd qword [ebp - 0x4bc], xmm0
mov dword [ebp - 0x4b4], 0
call fcn.00583650
add esp, 0xc
lea edx, [ebp - 0x48]
mov ecx, edi
push 0x20
call fcn.0048c570
add esp, 4
test eax, eax
je 0x48cc4a
push 0x20
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [ebp - 0x4ac]
mov ecx, edi
call fcn.0048c760
movzx edx, byte [ebp - 0x491]
test eax, eax
movzx ecx, byte [ebp - 0x4ac]
cmovne edx, ecx
mov ecx, edi
mov byte [ebp - 0x491], dl
lea edx, [ebp - 0x4ac]
call fcn.0048c810
test eax, eax
je 0x48ccb2
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0x48
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push dword [ebp - 0x4ac]
call dword [sym.imp.KERNEL32.dll_MulDiv]
push esi
neg eax
push ebx
mov dword [ebp - 0x4a8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x4288cc
push edi
call ebx
neg eax
push 0x447e58
sbb eax, eax
and eax, 0x12c
add eax, 0x190
push edi
mov dword [ebp - 0x498], eax
call ebx
test eax, eax
mov dword [ebp - 0x4ec], 0x3c
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x4e8], eax
setne byte [ebp - 0x494]
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4d8], 0x41
push 0x10
mov dword [ebp - 0x4e0], eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x48cd2a
or dword [ebp - 0x4d8], 0x4000
lea eax, [ebp - 0x4ec]
push eax
call dword [sym.imp.COMDLG32.dll_ChooseFontW]
test eax, eax
je 0x48cfef
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x48cfef
push 0x448d28
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
push ecx
lea edx, [ebp - 0x48]
mov ecx, edi
call fcn.0048c670
add esp, 4
test eax, eax
je 0x48cda9
push 0x448e04
lea eax, [ebp - 0x448]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
cmp dword [ebp + 0xc], 0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
je 0x48cdff
mov al, byte [ebp - 0x491]
cmp al, 1
je 0x48cdff
test al, al
je 0x48cdff
movzx eax, al
cmp eax, dword [0x5e95bc]
je 0x48cdff
push 0x448e20
lea eax, [ebp - 0x448]
push eax
call esi
movzx eax, byte [ebp - 0x491]
push eax
lea eax, [ebp - 0x48]
push 0x41bca8
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
push 0x448e38
lea eax, [ebp - 0x448]
push eax
call esi
mov eax, 0x66666667
imul dword [ebp - 0x4dc]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
lea eax, [ebp - 0x48]
push 0x41bca8
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
mov eax, dword [ebp - 0x4bc]
test eax, 0x100
je 0x48ce5f
push 0x448e48
lea eax, [ebp - 0x448]
push eax
call esi
mov eax, dword [ebp - 0x4bc]
test eax, 0x200
je 0x48ce74
push 0x448e58
lea eax, [ebp - 0x448]
push eax
call esi
push 0x448e6c
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x48ce92
push 0x448e80
lea eax, [ebp - 0x448]
push eax
call esi
lea eax, [ebp - 0x4ac]
mov edx, edi
push eax
mov ecx, 1
call fcn.0048c920
add esp, 4
test eax, eax
je 0x48cee1
mov ecx, dword [ebp - 0x4ac]
mov eax, ecx
sar eax, 0x10
movzx eax, al
push eax
movzx eax, cx
shr eax, 8
push eax
movzx eax, cl
push eax
lea eax, [ebp - 0x48]
push 0x448ba8
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
lea eax, [ebp - 0x4ac]
mov edx, edi
push eax
xor ecx, ecx
call fcn.0048c920
add esp, 4
test eax, eax
je 0x48cf2d
mov ecx, dword [ebp - 0x4ac]
mov eax, ecx
sar eax, 0x10
movzx eax, al
push eax
movzx eax, cx
shr eax, 8
push eax
movzx eax, cl
push eax
lea eax, [ebp - 0x48]
push 0x448bd4
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
push 0x421394
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x48cf4b
push 0x448e98
lea eax, [ebp - 0x448]
push eax
call esi
lea edx, [ebp - 0x4ac]
mov ecx, edi
call fcn.0048ca20
test eax, eax
je 0x48cf88
push 0x448eb0
lea eax, [ebp - 0x448]
push eax
call esi
cmp dword [ebp - 0x4ac], 1
mov ecx, 0x41bcc8
mov eax, 0x448ec0
cmovne eax, ecx
push eax
lea eax, [ebp - 0x448]
push eax
call esi
lea edx, [ebp - 0x4ac]
mov ecx, edi
call fcn.0048caf0
test eax, eax
je 0x48cfc8
push 0x448ec4
lea eax, [ebp - 0x448]
push eax
call esi
push dword [ebp - 0x4ac]
lea eax, [ebp - 0x48]
push 0x41bca8
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
push dword [ebp + 8]
lea ecx, [ebp - 0x448]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057e93d
mov esp, ebp
pop ebp
ret