Function at 0x488ed0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x51fa70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov eax, dword [0x57373c]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x88]
mov ebp, dword [esp + 0x8c]
cmp eax, 1
mov dword [esp + 0x80], 0
jne 0x488fad
mov ecx, ebp
call fcn.00407620
mov ecx, ebp
mov esi, eax
call fcn.00407600
test esi, esi
mov edi, eax
jne 0x488f78
lea ecx, [ebx + 0x7b9]
cmp ebp, ecx
jne 0x488f78
mov ecx, ebp
call fcn.004f825d
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx + 0xbc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x80], 0xffffffff
call fcn.004f33be
xor eax, eax
mov ecx, dword [esp + 0x78]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x74
ret 8
mov eax, dword [ebp]
push 0
mov ecx, ebp
call dword [eax + 0xbc]
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x488fa1
test edi, edi
je 0x488fa1
push edi
mov ecx, ebp
call fcn.00407340
test esi, esi
je 0x488fad
push esi
mov ecx, ebp
call fcn.00407380
mov ecx, ebp
call fcn.00407320
mov ecx, ebp
mov esi, eax
call fcn.00407360
mov edi, eax
test edi, edi
mov dword [esp + 0x8c], edi
je 0x488f4d
test esi, esi
je 0x488f4d
lea ecx, [ebx + 0x7b9]
cmp ebp, ecx
jne 0x489010
cmp edi, 4
jne 0x489010
mov eax, dword [0x57cecc]
lea edx, [esi + esi*4]
lea eax, [eax + edx*4]
mov dl, byte [eax + 0xfc]
test dl, dl
je 0x489001
cmp word [eax + 0xf8], 0xffff
jne 0x48905a
mov dword [esp + 0x8c], 3
push 3
jmp 0x48904e
lea ecx, [ebx + 0x700]
cmp ebp, ecx
jne 0x48905a
cmp edi, 2
jl 0x48905a
cmp edi, 3
jg 0x48905a
mov eax, dword [ebx + 0x87a]
mov edx, dword [0x57cecc]
shl eax, 4
add eax, esi
lea ecx, [edx + eax*2]
cmp byte [eax + ecx - 0xb], 0xff
jne 0x48905a
mov dword [esp + 0x8c], 1
push 1
mov ecx, ebp
call fcn.00407380
mov edi, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
push ebp
push edx
mov ecx, ebx
call fcn.004891a0
push edi
lea eax, [esp + 0x8c]
push esi
push eax
mov ecx, ebp
call fcn.00407960
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x84], 1
call fcn.004f34f7
lea ecx, [esp + 0x88]
mov byte [esp + 0x80], 0
call fcn.004f33be
mov esi, dword [esp + 0x10]
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esi - 8]
lea edi, [esp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 0x7b9]
cmp ebp, ecx
jne 0x48911f
mov eax, dword [esp + 0x8c]
dec eax
cmp eax, 3
ja case.default.0x4890e2
jmp dword [eax*4 + 0x48918c]
push ebx
lea ecx, [esp + 0x18]
push 1
push ecx
jmp 0x48915d
push ebx
lea edx, [esp + 0x18]
push 1
add ebx, 0x35a
push edx
push ebx
call fcn.004093d0
jmp case.default.0x4890e2
push ebx
lea eax, [esp + 0x18]
push 1
add ebx, 0x35a
push eax
push ebx
call fcn.004093d0
jmp case.default.0x4890e2
lea ecx, [ebx + 0x700]
cmp ebp, ecx
jne case.default.0x4890e2
mov eax, dword [esp + 0x8c]
dec eax
je 0x489155
dec eax
je case.0x4890e2.1
dec eax
jne case.default.0x4890e2
push 1
push ebx
lea edx, [esp + 0x1c]
push 1
lea eax, [ebx + 0xc6]
push edx
add ebx, 0x7c
push eax
push ebx
call fcn.004094a0
jmp case.default.0x4890e2
push ebx
lea edx, [esp + 0x18]
push 1
push edx
add ebx, 0x688
mov ecx, ebp
push ebx
call fcn.004091a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x80], 0xffffffff
call fcn.004f33be
mov eax, 1
jmp 0x488f63