Function at 0x48bdb0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x58fa2c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
shr ebx, 0x10
mov dword [ebp - 0x210], eax
mov byte [ebp - 0x20c], 0
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyNameTextA]
test bl, 2
je 0x48be97
push 0
push 0x11
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call edi
cmp byte [ebp - 0x108], 0
je 0x48be54
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x48be26
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48be36
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x48be79
lea ecx, [ebp - 0x20c]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x48be60
mov eax, dword [str.Ctrl]
mov dword [ecx], eax
mov al, byte [0x525988]
mov byte [ecx + 4], al
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x48be80
mov eax, dword [0x52598c]
mov dword [edi], eax
mov edi, dword [sym.imp.USER32.dll_GetKeyNameTextA]
test bl, 4
je 0x48bf39
push 0
push 0x12
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call edi
cmp byte [ebp - 0x108], 0
je 0x48bf03
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x48bed5
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48bee5
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x48bf21
lea edi, [ebp - 0x20c]
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x48bf10
mov eax, dword [0x525990]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x48bf28
mov eax, dword [0x52598c]
mov dword [edi], eax
test bl, 1
je 0x48bfe8
push 0
push 0x10
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp byte [ebp - 0x108], 0
je 0x48bfae
lea edx, [ebp - 0x108]
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x48bf80
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48bf90
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x48bfd0
lea ecx, [ebp - 0x20c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x48bfb5
mov eax, dword [str.Shift]
mov dword [ecx], eax
mov ax, word [0x525998]
mov word [ecx + 4], ax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x48bfd7
mov eax, dword [0x52598c]
mov dword [edi], eax
test bl, 8
je 0x48c089
push 0
push 0x5b
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp byte [ebp - 0x108], 0
je 0x48c058
lea edx, [ebp - 0x108]
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x48c030
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48c040
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x48c071
lea edi, [ebp - 0x20c]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x48c060
mov eax, dword [0x52599c]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x48c078
mov eax, dword [0x52598c]
mov dword [edi], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov eax, dword [ebp + 8]
push 0
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
push 0x104
or eax, 0x200
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x48c0c4
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48c0d4
push dword [ebp + 0x10]
mov ecx, edx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
push dword [ebp - 0x210]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00488a00
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004a4566
mov esp, ebp
pop ebp
ret