Function at 0x48e0e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x118]
mov esi, ecx
stosd dword es:[edi], eax
xor ecx, ecx
push 2
inc ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
pop eax
mov word [ebp - 0x118], ax
cmp ebx, 0x202
je 0x48e154
cmp ebx, 0x201
je 0x48e14e
cmp ebx, 0x203
je 0x48e14e
mov al, byte [ebp + 0x14]
test al, al
jne 0x48e157
push ecx
call edi
mov ecx, 0x8000
test cx, ax
je 0x48e154
xor ecx, ecx
inc ecx
or dword [ebp - 0x110], ecx
mov al, byte [ebp + 0x14]
cmp ebx, 0x205
je 0x48e188
cmp ebx, 0x204
je 0x48e181
cmp ebx, 0x206
je 0x48e181
test al, al
jne 0x48e188
push 2
call edi
mov ecx, 0x8000
test cx, ax
je 0x48e188
or dword [ebp - 0x110], 2
cmp ebx, 0x208
je 0x48e1bb
cmp ebx, 0x207
je 0x48e1b4
cmp ebx, 0x209
je 0x48e1b4
cmp byte [ebp + 0x14], 0
jne 0x48e1bb
push 4
call edi
mov ecx, 0x8000
test cx, ax
je 0x48e1bb
or dword [ebp - 0x110], 4
mov edi, dword [ebp + 0xc]
cmp ebx, 0x20c
je 0x48e1f3
cmp ebx, 0x20b
je 0x48e1d6
cmp ebx, 0x20d
jne 0x48e1f3
mov eax, edi
shr eax, 0x10
test al, 1
je 0x48e1e8
or dword [ebp - 0x110], 8
jmp 0x48e1f3
test al, 2
je 0x48e1f3
or dword [ebp - 0x110], 0x10
test byte [ebp - 0x110], 7
mov ecx, esi
setne al
mov byte [esi + 0x27051], al
lea eax, [ebp - 0x10c]
push eax
call fcn.00482d1b
lea eax, [ebp - 0x10c]
mov ecx, esi
push eax
call fcn.00482d59
cmp ebx, 0x203
je 0x48e43c
cmp ebx, 0x206
je 0x48e43c
cmp ebx, 0x209
je 0x48e43c
cmp ebx, 0x200
jne 0x48e259
xor ecx, ecx
inc ecx
mov dword [ebp - 0x108], ecx
jmp 0x48e320
cmp ebx, 0x20a
jne 0x48e3b1
movsx eax, word [ebp + 0x12]
mov ecx, edi
push eax
movsx eax, word [ebp + 0x10]
push eax
shr ecx, 0x10
movzx eax, di
push eax
movsx eax, cx
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x11c], ecx
push 0x556d58
push eax
call fcn.00401133
add esp, 0x18
mov ecx, esi
push 2
call fcn.00497662
test eax, eax
je 0x48e2d0
movsx eax, word [ebp + 0x12]
push eax
movsx eax, word [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 0x84]
push 0x556db0
push eax
call fcn.00409af0
add esp, 0x14
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.00489fb2
mov eax, dword [ebp - 0x11c]
push 0x78
pop ecx
movzx eax, ax
mov dword [ebp - 0x108], 4
push 0xffffffffffffff88
pop edx
test ax, ax
jns 0x48e2f7
cmp ax, dx
jle 0x48e300
mov eax, edx
jmp 0x48e2fd
cmp ax, cx
cmovl eax, ecx
cmp ax, dx
jl 0x48e307
cmp ax, cx
jle 0x48e311
cwde
cdq
idiv ecx
imul eax, eax, 0x78
movzx eax, ax
movzx eax, ax
shl eax, 0x10
or dword [ebp - 0x110], eax
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x110]
shr eax, 1
and al, 1
mov dword [ebp - 0x11c], eax
je 0x48e4b6
push ecx
mov ecx, esi
call fcn.00487c63
test eax, eax
je 0x48e4b6
cmp dword [esi + 0x6044], 0
je 0x48e4b6
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10ff8], 0
je 0x48e4b6
movsx eax, word [esi + 0x604e]
cmp eax, 3
jg 0x48e387
jne 0x48e4b6
cmp dword [esi + 0x6050], 0x94d
jb 0x48e4b6
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10fe3], 0
jne 0x48e479
mov eax, dword [ebp - 0x10c]
and eax, 0xf
neg al
sbb al, al
and byte [ebp - 0x11c], al
jmp 0x48e4b6
cmp ebx, 0x20e
jne 0x48e446
push 2
mov ecx, esi
call fcn.00497662
test eax, eax
je 0x48e3f7
movsx eax, word [ebp + 0x12]
push eax
movsx eax, word [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 0x84]
push 0x556ddc
push eax
call fcn.00409af0
add esp, 0x14
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.00489fb2
push 0x78
pop ecx
shr edi, 0x10
mov dword [ebp - 0x108], 8
push 0xffffffffffffff88
pop edx
test di, di
jns 0x48e418
cmp di, dx
jle 0x48e421
mov edi, edx
jmp 0x48e41e
cmp di, cx
cmovl edi, ecx
cmp di, dx
jl 0x48e428
cmp di, cx
jle 0x48e434
movsx eax, di
cdq
idiv ecx
imul eax, eax, 0x78
movzx edi, ax
movzx eax, di
jmp 0x48e314
mov dword [ebp - 0x108], 2
cmp ebx, 0x201
je 0x48e462
cmp ebx, 0x204
je 0x48e462
cmp ebx, 0x207
jne 0x48e31d
mov eax, dword [ebp + 0x10]
xor ecx, ecx
inc ecx
mov dword [esi + 0x26ebe], eax
mov byte [esi + 0x26ebc], cl
jmp 0x48e320
mov ecx, dword [esi + 0x4294]
lea eax, [ebp - 0x120]
xor edi, edi
inc edi
push edi
push 0
push dword [ebp + 0x10]
push eax
call fcn.00477d97
push edi
push dword [ebp - 0x120]
mov ecx, esi
call fcn.00484ad3
test eax, eax
je 0x48e4b6
test byte [ebp - 0x10c], 0x1f
jne 0x48e4b6
or dword [ebp - 0x10c], 5
cmp ebx, 0x200
jne 0x48e575
mov dx, word [ebp + 0x12]
xor ebx, ebx
mov di, word [ebp + 0x10]
inc ebx
cmp dword [esi + 0x26eb0], ebx
jne 0x48e516
mov eax, dword [esi + 0x26ea8]
cmp eax, dword [ebp - 0x110]
jne 0x48e516
mov eax, dword [esi + 0x26eac]
cmp eax, dword [ebp - 0x10c]
jne 0x48e516
movsx ecx, word [esi + 0x26ea4]
movsx eax, di
sub ecx, eax
jne 0x48e516
movsx ecx, word [esi + 0x26ea6]
movsx eax, dx
sub ecx, eax
jne 0x48e516
cmp byte [ebp + 0x14], cl
je 0x48e68f
cmp byte [esi + 0x26ebc], 0
je 0x48e565
cmp byte [esi + 0x27051], 0
je 0x48e55e
cmp word [esi + 0x26ebe], di
jne 0x48e53a
cmp word [esi + 0x26ec0], dx
je 0x48e55e
mov eax, dword [esi + 0x26ebe]
mov ecx, esi
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0048d312
mov dx, word [ebp + 0x12]
mov di, word [ebp + 0x10]
mov byte [esi + 0x26ebc], 0
mov word [esi + 0x27052], di
mov word [esi + 0x27054], dx
jmp 0x48e578
xor ebx, ebx
inc ebx
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10ff8], 0
je 0x48e651
mov ecx, dword [esi + 0x4288]
cmp dword [esi + 0x4294], ecx
je 0x48e5a1
push 0
push 0
jmp 0x48e64c
and dword [ebp - 0x128], 0
lea eax, [ebp - 0x128]
push eax
call fcn.0047b45d
test al, al
je 0x48e635
cmp byte [ebp - 0x11c], 0
jne 0x48e5c7
push 0
push 0
jmp 0x48e646
mov dx, word [ebp + 0x12]
mov edi, dword [ebp - 0x126]
mov ax, dx
sub ax, di
movzx ecx, ax
or eax, 0xffffffff
cmp cx, ax
jl 0x48e5e7
cmp cx, bx
jle 0x48e635
mov eax, ebx
or ebx, 0xffffffff
cmp cx, bx
movzx ecx, dx
mov dword [ebp - 0x120], ecx
cmovl eax, ebx
movzx ebx, ax
lea eax, [ebx + edi]
mov word [ebp + 0x12], ax
cmp ax, cx
je 0x48e635
mov edi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, esi
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0048d312
mov ax, word [ebp + 0x12]
add ax, bx
mov word [ebp + 0x12], ax
cmp ax, di
jne 0x48e60c
cmp byte [ebp - 0x11c], 0
je 0x48e651
lea eax, [ebp + 0x10]
xor edi, edi
push eax
inc edi
push edi
mov ecx, dword [esi + 0x4288]
call fcn.00480ebd
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x114], eax
mov eax, dword [esi + 0x4784]
test eax, eax
je 0x48e67f
cmp eax, dword [esi + 0x4940]
je 0x48e67f
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov eax, dword [esi + 0x4784]
mov dword [esi + 0x4940], eax
push 0
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.0048d312
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 0x10