Function at 0x4c8a0b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
movzx ax, ah
mov word [ebp - 0x24], ax
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
movzx ax, ah
mov word [ebp - 0x1c], ax
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x4c8a68
xor eax, eax
jmp 0x4c8e22
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xe6], 0
je 0x4c8b23
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xe6]
push eax
call fcn.00472d8e
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c8aad
jmp case.default.0x4c8df9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xe6]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x44], 2
jne 0x4c8ad9
mov dword [ebp - 0x20], 1
jmp 0x4c8ae0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xe6]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0x20], 0
je 0x4c8b04
cmp dword [ebp + 0xc], 8
je 0x4c8b0e
cmp dword [ebp + 0xc], 0x2e
jne 0x4c8b23
push 0xd3
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004ce5da
add esp, 0xc
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x32], 0
jne 0x4c8b3a
cmp dword [ebp - 0x20], 0
je 0x4c8c6e
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x32], 0
je 0x4c8c1e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
jmp 0x4c8bfb
mov eax, dword [ebp + 8]
push eax
call fcn.004f4ea5
add esp, 4
jmp case.default.0x4c8df9
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x32], 1
jne 0x4c8bf1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x42], 0
jl 0x4c8bc2
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x46], 0
jl 0x4c8bc2
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov cx, word [eax + 0x42]
shl ecx, 0x10
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dx, word [eax + 0x46]
or ecx, edx
push ecx
push 0x459
mov eax, dword [ebp + 8]
push eax
call fcn.0043db0f
add esp, 0x20
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xe6], 0
je 0x4c8bec
push 0
push 1
push 1
push 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xe6]
push eax
call fcn.00472111
add esp, 0x14
jmp case.default.0x4c8df9
jmp 0x4c8c1e
cmp dword [ebp - 0x28], 8
je 0x4c8b52
cmp dword [ebp - 0x28], 0xd
je 0x4c8b68
cmp dword [ebp - 0x28], 0x2e
je 0x4c8b52
jmp 0x4c8c1e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
jmp 0x4c8c50
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004c9988
add esp, 0x10
jmp case.default.0x4c8df9
cmp dword [ebp - 0x2c], 0x25
jb 0x4c8c69
cmp dword [ebp - 0x2c], 0x28
jbe 0x4c8c29
jmp 0x4c8c69
jmp 0x4c8cee
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1d6]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
je 0x4c8cde
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
jmp 0x4c8cc5
push 0
push 0xd3
push 0xc8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1d6]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0044af73
add esp, 0x14
jmp 0x4c8cde
cmp dword [ebp - 0x30], 8
je 0x4c8c99
cmp dword [ebp - 0x30], 0x2e
je 0x4c8c99
jmp 0x4c8cde
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1d6]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
jmp 0x4c8de8
test dword [ebp - 0x1c], 0xffff
je 0x4c8d1e
push 0
push 2
push 0x114
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4c8d31
push 0
push 2
push 0x115
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4c8df9
test dword [ebp - 0x1c], 0xffff
je 0x4c8d5b
push 0
push 3
push 0x114
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4c8d6e
push 0
push 3
push 0x115
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x4c8df9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x42]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x42], 1
push 1
push 1
push 1
push 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xde]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0043c3e6
add esp, 0x18
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x42], eax
jmp case.default.0x4c8df9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x42]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x42], 1
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004c929b
add esp, 8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x42], eax
jmp case.default.0x4c8df9
sub dword [ebp - 0x34], 0x21
cmp dword [ebp - 0x34], 3
ja case.default.0x4c8df9
mov eax, dword [ebp - 0x34]
jmp dword [eax*4 + 0x4c8e00]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x14]
jmp 0x4c8e22
pop edi
pop esi
pop ebx
leave
ret