Function at 0x480b80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov rbx, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov ebp, r9d
mov r12d, r8d
mov edi, edx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x480bc0
call fcn.0048a330
mov rcx, rbx
mov rdx, rax
call fcn.00480a50
mov r9d, dword [rbx + 0x48]
mov qword [rsp + 0x40], r14
xor r14d, r14d
test r9d, r9d
mov qword [rsp + 0x38], r15
lea r15d, [r14 - 1]
jns 0x480bdf
mov ecx, r15d
jmp 0x480be8
test r9d, r9d
mov ecx, r14d
setg cl
test edi, edi
jns 0x480bf1
mov eax, r15d
jmp 0x480bf9
test edi, edi
mov eax, r14d
setg al
cmp ecx, eax
mov eax, edi
mov qword [rsp + 0x48], r13
cmovne r9d, r14d
cdq
mov r13d, edi
xor eax, edx
mov dword [rbx + 0x48], r9d
sub eax, edx
cmp eax, 0x3e8
jle 0x480c3b
test edi, edi
jns 0x480c29
mov r8d, r15d
imul r8d, r8d, 0x3e8
jmp 0x480c3e
test edi, edi
mov r8d, r14d
setg r8b
imul r8d, r8d, 0x3e8
jmp 0x480c3e
mov r8d, edi
mov ecx, dword [rsp + 0xa0]
mov qword [rsp + 0x60], rsi
mov esi, 1
sub ecx, esi
mov edx, r8d
mov r10d, esi
je 0x480c5f
cmp ecx, esi
je 0x480cae
jmp 0x480c6f
mov eax, r8d
mov r10d, 2
cdq
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, edx
cdq
mov ecx, eax
mov eax, r8d
xor ecx, edx
sub ecx, edx
cdq
mov r8d, eax
mov eax, ecx
xor r8d, edx
sub r8d, edx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x1ff
add eax, edx
sar eax, 9
imul eax, r10d
add r8d, eax
test edi, edi
jle 0x480ca9
mov edi, r8d
jmp 0x480cae
mov edi, r8d
neg edi
lea ecx, [r9 + rdi]
test ebp, ebp
mov rbp, qword [rsp + 0x68]
mov dword [rbx + 0x48], ecx
je 0x480cc8
mov eax, 2
jmp 0x480e3a
mov edi, dword [rbx + 8]
cmp edi, 3
jne 0x480cdb
mov edi, r14d
cmp qword [rbx + 0x30], rdi
setne dil
cmp dword [rbx + 0x58], r14d
jne 0x480d17
test byte [rbx + 0x20], 8
jne 0x480d17
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x480d17
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x480d17
lea rcx, [0x0050b280]
call fcn.0044f4d0
test eax, eax
je 0x480d1a
mov edi, r14d
mov eax, dword [rbx + 0x20]
test al, 0x40
je 0x480d28
mov edi, 4
jmp 0x480d44
cmp edi, esi
jne 0x480d44
test sil, al
jne 0x480d41
bt eax, 0xd
jae 0x480d44
call fcn.00488f80
cmp eax, 9
jl 0x480d44
mov edi, r14d
test edi, edi
mov ecx, r14d
je 0x480e06
sub edi, esi
je 0x480dea
sub edi, esi
je 0x480dd7
cmp edi, 2
jne 0x480e2c
mov r8d, dword [rbx + 0x48]
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x80
jl 0x480e2c
mov rax, qword [0x0050bfe0]
test rax, rax
je 0x480e1a
mov rcx, qword [rax]
test rcx, rcx
je 0x480e1a
mov rcx, qword [rcx + 0x58]
test r8d, r8d
mov eax, esi
mov r10, qword [rcx]
cmovg eax, r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [r10 + reloc.OLEAUT32.dll_VarDecAdd]
mov r11d, dword [rbx + 0x48]
test r11d, r11d
jle 0x480dcd
add r11d, 0xffffff80
mov dword [rbx + 0x48], r11d
jmp 0x480e1a
sub r11d, 0xffffff80
mov dword [rbx + 0x48], r11d
jmp 0x480e1a
mov r8, qword [rbx]
movzx edx, sil
mov rcx, rbx
call fcn.0047eab0
mov ecx, eax
jmp 0x480e16
mov r9, qword [rbx + 0x30]
mov r8, qword [rbx + 0x28]
movzx edx, sil
mov rcx, rbx
mov dword [rsp + 0x20], esi
call fcn.0047e900
mov ecx, eax
jmp 0x480e16
mov rdx, qword [rbx]
mov r8d, r12d
mov rcx, rbx
call fcn.0047e5a0
mov ecx, eax
test ecx, ecx
jle 0x480e2c
mov eax, r13d
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
jg 0x480e38
mov dword [rbx + 0x48], r14d
jmp 0x480e38
test ecx, ecx
mov esi, r14d
sets sil
add esi, 2
mov eax, esi
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret