Function at 0x487148
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
mov eax, dword [esi]
call dword [eax + 0x420]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor ebx, ebx
call edi
xor ecx, ecx
push 0x11
test ax, ax
setl cl
mov dword [ebp - 4], ecx
call edi
xor ecx, ecx
test ax, ax
mov eax, dword [esi]
setl cl
mov dword [ebp - 8], ecx
mov ecx, esi
call dword [eax + 0x240]
push dword [esi + 0x60]
mov edi, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1d4]
test eax, eax
je 0x4871a3
mov ebx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
cmp eax, 0x25
ja 0x487308
je 0x4873bd
cmp eax, 0x20
ja 0x487282
je 0x487262
sub eax, 8
je 0x487245
dec eax
je 0x487219
sub eax, 4
je 0x4871fc
sub eax, 0xe
jne 0x4873d5
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
test eax, eax
je 0x4873d5
push 0
push 2
push 0x111
jmp 0x487237
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3c4]
jmp 0x4873d5
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
test eax, eax
je 0x4873d5
push 0
push dword [ebp - 4]
push 0x28
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3d4]
jmp 0x4873d5
mov eax, dword [esi + 0x40]
mov ebx, dword [esi]
lea ecx, [esi + 0x40]
push edi
call dword [eax + 0x28]
neg eax
sbb eax, eax
mov ecx, esi
inc eax
push eax
push edi
call dword [ebx + 0x230]
jmp 0x4873d5
sub eax, 0x21
je 0x4872eb
dec eax
je 0x4872ce
dec eax
je 0x4872b1
dec eax
jne 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3c8]
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3cc]
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3e4]
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3e0]
jmp 0x4873d5
cmp eax, 0x6b
ja 0x487374
je 0x487389
sub eax, 0x26
je 0x48735a
dec eax
je 0x487389
dec eax
je 0x487340
sub eax, 0x42
jne 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3dc]
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3bc]
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3b8]
jmp 0x4873d5
sub eax, 0x6d
je 0x4873bd
sub eax, 4
je 0x4873a3
sub eax, 0x4a
je 0x487389
dec eax
dec eax
je 0x4873bd
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3d8]
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3c0]
jmp 0x4873d5
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push edi
call dword [eax + 0x3d0]
mov ecx, esi
call sub.MFC42.DLL_CWnd::Default
pop edi
pop esi
pop ebx
leave
ret 0xc