Function at 0x48fc00
Capabilities:
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
push esi
xor eax, eax
mov al, byte [ecx + 4]
push edi
mov esi, ecx
push eax
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [esi + 0x24], 0
call edi
test ah, 0x80
je 0x48fc22
or dword [esi + 0x24], 0x10
xor eax, eax
mov al, byte [esi + 5]
push eax
call edi
test ah, 0x80
je 0x48fc33
or dword [esi + 0x24], 0x20
xor eax, eax
mov al, byte [esi + 7]
push eax
call edi
test ah, 0x80
je 0x48fc47
or dword [esi + 0x24], 0x80
xor eax, eax
mov al, byte [esi + 6]
push eax
call edi
test ah, 0x80
je 0x48fc58
or dword [esi + 0x24], 0x40
xor eax, eax
mov al, byte [esi]
push eax
call edi
test ah, 0x80
je 0x48fc68
or dword [esi + 0x24], 1
xor eax, eax
mov al, byte [esi + 1]
push eax
call edi
test ah, 0x80
je 0x48fc79
or dword [esi + 0x24], 2
xor eax, eax
mov al, byte [esi + 3]
push eax
call edi
test ah, 0x80
je 0x48fc8a
or dword [esi + 0x24], 8
xor eax, eax
mov al, byte [esi + 2]
push eax
call edi
test ah, 0x80
je 0x48fc9b
or dword [esi + 0x24], 4
xor eax, eax
mov al, byte [esi + 8]
push eax
call edi
test ah, 0x80
je 0x48fcaf
or dword [esi + 0x24], 0x100
xor eax, eax
mov al, byte [esi + 9]
push eax
call edi
test ah, 0x80
je 0x48fcc3
or dword [esi + 0x24], 0x200
xor eax, eax
mov al, byte [esi + 0xa]
push eax
call edi
test ah, 0x80
je 0x48fcd7
or dword [esi + 0x24], 0x400
xor eax, eax
mov al, byte [esi + 0xb]
push eax
call edi
test ah, 0x80
je 0x48fceb
or dword [esi + 0x24], 0x800
xor eax, eax
mov al, byte [esi + 0xc]
push eax
call edi
test ah, 0x80
je 0x48fcff
or dword [esi + 0x24], 0x1000
xor eax, eax
mov al, byte [esi + 0xd]
push eax
call edi
test ah, 0x80
je 0x48fd13
or dword [esi + 0x24], 0x2000
xor eax, eax
mov al, byte [esi + 0xe]
push eax
call edi
test ah, 0x80
je 0x48fd27
or dword [esi + 0x24], 0x4000
xor eax, eax
mov al, byte [esi + 0xf]
push eax
call edi
test ah, 0x80
je 0x48fd3b
or dword [esi + 0x24], 0x8000
xor eax, eax
mov al, byte [esi + 0x10]
push eax
call edi
test ah, 0x80
je 0x48fd4f
or dword [esi + 0x24], 0x10000
xor eax, eax
mov al, byte [esi + 0x11]
push eax
call edi
test ah, 0x80
je 0x48fd63
or dword [esi + 0x24], 0x20000
xor eax, eax
mov al, byte [esi + 0x12]
push eax
call edi
test ah, 0x80
je 0x48fd77
or dword [esi + 0x24], 0x40000
xor eax, eax
mov al, byte [esi + 0x13]
push eax
call edi
test ah, 0x80
je 0x48fd8b
or dword [esi + 0x24], 0x80000
xor eax, eax
mov al, byte [esi + 0x14]
push eax
call edi
test ah, 0x80
je 0x48fd9f
or dword [esi + 0x24], 0x100000
xor eax, eax
mov al, byte [esi + 0x15]
push eax
call edi
test ah, 0x80
je 0x48fdb3
or dword [esi + 0x24], 0x200000
xor eax, eax
mov al, byte [esi + 0x16]
push eax
call edi
test ah, 0x80
je 0x48fdc7
or dword [esi + 0x24], 0x400000
xor eax, eax
mov al, byte [esi + 0x17]
push eax
call edi
test ah, 0x80
je 0x48fddb
or dword [esi + 0x24], 0x800000
xor eax, eax
mov al, byte [esi + 0x18]
push eax
call edi
test ah, 0x80
je 0x48fdef
or dword [esi + 0x24], 0x1000000
xor eax, eax
mov al, byte [esi + 0x19]
push eax
call edi
test ah, 0x80
je 0x48fe03
or dword [esi + 0x24], 0x2000000
xor eax, eax
mov al, byte [esi + 0x1a]
push eax
call edi
test ah, 0x80
je 0x48fe17
or dword [esi + 0x24], 0x4000000
xor eax, eax
mov al, byte [esi + 0x1b]
push eax
call edi
test ah, 0x80
je 0x48fe2b
or dword [esi + 0x24], 0x8000000
xor eax, eax
mov al, byte [esi + 0x1c]
push eax
call edi
test ah, 0x80
je 0x48fe3f
or dword [esi + 0x24], 0x10000000
xor eax, eax
mov al, byte [esi + 0x1d]
push eax
call edi
test ah, 0x80
je 0x48fe53
or dword [esi + 0x24], 0x20000000
xor eax, eax
mov al, byte [esi + 0x1e]
push eax
call edi
test ah, 0x80
je 0x48fe67
or dword [esi + 0x24], 0x40000000
xor eax, eax
mov al, byte [esi + 0x1f]
push eax
call edi
test ah, 0x80
je 0x48fe7b
or dword [esi + 0x24], 0x80000000
pop edi
pop esi
ret