Function at 0x4891a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
push edi
test byte [esi + 0x5e0], 1
mov dword [esi + 0x2f4], ecx
je 0x4891f8
test ecx, ecx
je 0x48971d
mov ecx, dword [esi + 0x2cc]
mov eax, dword [ecx]
call dword [eax + 0x90]
test eax, eax
je 0x489240
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov eax, dword [esi + 0x2f8]
test eax, eax
je 0x48976b
pop edi
mov dword [eax], 1
xor eax, eax
pop esi
pop ebp
ret 0xc
cmp dword [esi + 0x5f0], 0
jne 0x489238
movd xmm0, dword [esi + 0x5ac]
cvtdq2ps xmm0, xmm0
subss xmm0, dword [ebp + 8]
cvttss2si eax, xmm0
mov dword [esi + 0x5ac], eax
mov eax, dword [esi + 0x2f8]
test eax, eax
je 0x48922b
mov dword [eax], 1
cmp dword [esi + 0x5ac], 0
jle 0x48976b
test ecx, ecx
je 0x48971d
test byte [esi + 0x5e0], 0x14
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
je 0x489325
cmp dword [esi + 0x2e4], 0
je 0x489280
cmp dword [esi + 0x5ec], 0
je 0x48926e
push 8
call edi
test ax, ax
jne 0x4892b1
mov ecx, dword [esi + 0x2e4]
mov eax, dword [ecx]
call dword [eax + 0x90]
test eax, eax
jne 0x4892b1
cmp dword [esi + 0x2e0], 0
je 0x489325
cmp dword [esi + 0x5ec], 0
je 0x48929f
push 8
call edi
test ax, ax
jne 0x4892b1
mov ecx, dword [esi + 0x2e0]
mov eax, dword [ecx]
call dword [eax + 0x90]
test eax, eax
je 0x489325
mov eax, dword [esi + 0x2f8]
test eax, eax
je 0x4892cb
mov dword [eax], 0x14
mov dword [esi + 0x2f8], 0
mov eax, dword [esi + 0x568]
test eax, eax
je 0x4892e5
mov dword [eax], 0
mov dword [esi + 0x568], 0
mov eax, dword [esi + 0x56c]
test eax, eax
je 0x4892fc
mov byte [eax], 0
mov dword [esi + 0x56c], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
test byte [esi + 0x5e0], 0x80
je 0x48976b
mov ecx, dword [esi + 0x2e8]
call fcn.0047b220
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
test dword [esi + 0x5e0], 0x20a
je 0x48971d
cmp dword [esi + 0x2d8], 0
je 0x489773
cmp dword [esi + 0x5e8], 0
je 0x489354
push 0xd
call edi
test ax, ax
jne 0x489384
mov ecx, dword [esi + 0x2d8]
mov eax, dword [ecx]
call dword [eax + 0x90]
test eax, eax
je 0x48971d
cmp dword [0x1a4e7a8], 0
jne 0x48971d
cmp dword [0x1a4e7ac], 0
je 0x48971d
mov eax, dword [esi + 0x2f8]
test eax, eax
je 0x48939e
mov dword [eax], 0xa
mov dword [esi + 0x2f8], 0
cmp dword [esi + 0x568], 0
je 0x489422
mov ecx, dword [esi + 0x2e8]
mov edi, 0x700992
call fcn.0047b0d0
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x4893d7
test cl, cl
je 0x4893d3
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x4893d7
add eax, 2
add edi, 2
test cl, cl
jne 0x4893b7
xor eax, eax
jmp 0x4893dc
sbb eax, eax
or eax, 1
test eax, eax
je 0x48940c
mov ecx, dword [esi + 0x2e8]
call fcn.0047b0d0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__atoi64]
mov ecx, dword [esi + 0x568]
add esp, 4
test edx, edx
jl 0x489408
jg 0x489406
cmp eax, 0xffffffff
jbe 0x489408
xor eax, eax
mov dword [ecx], eax
jmp 0x489418
mov eax, dword [esi + 0x568]
mov dword [eax], 0
mov dword [esi + 0x568], 0
cmp dword [esi + 0x56c], 0
je 0x4894a3
mov ecx, dword [esi + 0x2ec]
mov edi, 0x700992
call fcn.0047b0d0
nop dword [eax + eax]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x489460
test cl, cl
je 0x48945c
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x489460
add eax, 2
add edi, 2
test cl, cl
jne 0x489440
xor eax, eax
jmp 0x489465
sbb eax, eax
or eax, 1
test eax, eax
je 0x489490
mov ecx, dword [esi + 0x2ec]
call fcn.0047b0d0
mov edx, dword [esi + 0x56c]
nop word [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx], cl
lea edx, [edx + 1]
test cl, cl
jne 0x489480
jmp 0x489499
mov eax, dword [esi + 0x56c]
mov byte [eax], 0
mov dword [esi + 0x56c], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
test byte [esi + 0x5e0], 0x80
je 0x4894c0
mov ecx, dword [esi + 0x2e8]
call fcn.0047b220
test dword [esi + 0x5e0], 0x100
je 0x4894d7
mov ecx, dword [esi + 0x2ec]
call fcn.0047b220
mov edx, dword [esi + 0x5cc]
mov eax, edx
mov ecx, dword [esi + 0x5c8]
sub eax, ecx
mov edi, dword [esi + 0x5d4]
inc edi
sar eax, 2
cmp eax, edi
jbe 0x489728
mov dword [esi + 0x5d4], edi
push dword [ecx + edi*4]
mov ecx, esi
call fcn.00488b20
mov ecx, esi
call fcn.00488a00
mov ecx, dword [esi + 0x2c8]
test ecx, ecx
je 0x48954c
mov eax, dword [ecx]
call dword [eax + 0x158]
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0x2c8]
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2c8]
test ecx, ecx
je 0x48954c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2c8], 0
mov ecx, dword [esi + 0x2cc]
test ecx, ecx
je 0x48957b
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2cc]
test ecx, ecx
je 0x48957b
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2cc], 0
mov ecx, dword [esi + 0x2d0]
test ecx, ecx
je 0x4895aa
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2d0]
test ecx, ecx
je 0x4895aa
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2d0], 0
mov ecx, dword [esi + 0x2d4]
test ecx, ecx
je 0x4895d9
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2d4]
test ecx, ecx
je 0x4895d9
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2d4], 0
mov ecx, dword [esi + 0x2d8]
test ecx, ecx
je 0x489608
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2d8]
test ecx, ecx
je 0x489608
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2d8], 0
mov ecx, dword [esi + 0x2dc]
test ecx, ecx
je 0x489637
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2dc]
test ecx, ecx
je 0x489637
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2dc], 0
mov ecx, dword [esi + 0x2e0]
test ecx, ecx
je 0x489666
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2e0]
test ecx, ecx
je 0x489666
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2e0], 0
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x489695
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x489695
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2e4], 0
mov ecx, dword [esi + 0x2e8]
test ecx, ecx
je 0x4896c4
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2e8]
test ecx, ecx
je 0x4896c4
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2e8], 0
mov ecx, dword [esi + 0x2ec]
test ecx, ecx
je 0x4896f3
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf4]
mov ecx, dword [esi + 0x2ec]
test ecx, ecx
je 0x4896f3
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x2ec], 0
mov ecx, esi
call fcn.0048d730
test eax, eax
je 0x489705
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov ecx, esi
call fcn.00488280
push 0
push 0
push dword [esi + 0x5e0]
mov ecx, esi
call fcn.004872b0
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp ecx, edx
je 0x48976b
test dword [esi + 0x5e0], 0x400
je 0x48976b
mov esi, dword [0x779904]
push 4
mov byte [esi + 0x4f40], 0
mov ecx, dword [0x77b1c4]
call fcn.004db360
push 1
mov ecx, eax
call fcn.004ec6f0
cmp dword [esi + 0x4c3c], 0
je 0x48976b
mov ecx, esi
call fcn.004ba650
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
cmp dword [esi + 0x2dc], 0
je 0x48971d
cmp dword [esi + 0x5e8], 0
je 0x48978e
push 0xd
call edi
test ax, ax
jne 0x4897a4
mov ecx, dword [esi + 0x2dc]
mov eax, dword [ecx]
call dword [eax + 0x90]
test eax, eax
je 0x48971d
mov eax, dword [esi + 0x2f8]
test eax, eax
je 0x4897be
mov dword [eax], 0xa
mov dword [esi + 0x2f8], 0
cmp dword [esi + 0x568], 0
je 0x489842
mov ecx, dword [esi + 0x2e8]
mov edi, 0x700992
call fcn.0047b0d0
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x4897f7
test cl, cl
je 0x4897f3
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x4897f7
add eax, 2
add edi, 2
test cl, cl
jne 0x4897d7
xor eax, eax
jmp 0x4897fc
sbb eax, eax
or eax, 1
test eax, eax
je 0x48982c
mov ecx, dword [esi + 0x2e8]
call fcn.0047b0d0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__atoi64]
mov ecx, dword [esi + 0x568]
add esp, 4
test edx, edx
jl 0x489828
jg 0x489826
cmp eax, 0xffffffff
jbe 0x489828
xor eax, eax
mov dword [ecx], eax
jmp 0x489838
mov eax, dword [esi + 0x568]
mov dword [eax], 0
mov dword [esi + 0x568], 0
cmp dword [esi + 0x56c], 0
je 0x4898c3
mov ecx, dword [esi + 0x2ec]
mov edi, 0x700992
call fcn.0047b0d0
nop dword [eax + eax]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x489880
test cl, cl
je 0x48987c
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x489880
add eax, 2
add edi, 2
test cl, cl
jne 0x489860
xor eax, eax
jmp 0x489885
sbb eax, eax
or eax, 1
test eax, eax
je 0x4898b0
mov ecx, dword [esi + 0x2ec]
call fcn.0047b0d0
mov edx, dword [esi + 0x56c]
nop word [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx], cl
lea edx, [edx + 1]
test cl, cl
jne 0x4898a0
jmp 0x4898b9
mov eax, dword [esi + 0x56c]
mov byte [eax], 0
mov dword [esi + 0x56c], 0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], 1
xor eax, eax
pop ebp
ret 0xc