Function at 0x465950
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x30c
mov dl, byte [0x4f55a8]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x7d]
mov byte [esp + 0x7c], dl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x40
mov dword [esp + 0x2d], eax
lea edi, [esp + 0x115]
mov dword [esp + 0x31], eax
mov byte [esp + 0x114], dl
mov dword [esp + 0x35], eax
mov byte [esp + 0x9c], dl
mov dword [esp + 0x39], eax
mov byte [esp + 0x5c], dl
mov word [esp + 0x3d], ax
mov byte [esp + 0x2c], dl
mov byte [esp + 0x3f], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x9d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x5d]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x3c4]
stosb byte es:[edi], al
mov eax, dword [esi + 0x3e0]
cmp eax, ecx
jge 0x4659fa
test eax, eax
jl 0x4659fa
mov ecx, dword [esi + 0x3c0]
mov edx, dword [ecx + eax*4]
mov dword [esp + 0x18], edx
jmp 0x465a02
mov dword [esp + 0x18], 0
cmp eax, dword [esi + 0x3c4]
jge 0x465b24
test eax, eax
jl 0x465b24
mov ecx, dword [esi + 0x3c0]
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x465b24
push 0
mov ecx, eax
call fcn.00425f70
mov ebp, eax
test ebp, ebp
je 0x465a4e
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0049ddf0
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x1c], 1
test eax, eax
je 0x465a56
mov dword [esp + 0x1c], 0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
mov bx, ax
push 0x11
shr ebx, 0xf
and ebx, 1
call edi
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
je 0x465b60
mov eax, dword [esi + 0x42c]
test eax, eax
je 0x465a99
lea edx, [esp + 0x5c]
push 0x4ee628
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5a
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x465b2b
test ebx, ebx
je 0x465b2b
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0049dfa0
push 0xffffffffffffffff
mov ecx, ebp
mov ebx, eax
call fcn.0049ddf0
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + ecx*4]
mov ecx, dword [esi + 0x2f0]
cdq
idiv ebx
mov edx, dword [ecx + 0x58]
mov dword [esp + 0x24], edx
mov ebx, eax
mov eax, dword [ecx + 0x5c]
mov dword [esp + 0x28], eax
call fcn.004a26d0
fld qword [esp + 0x24]
fmul qword [0x4d8f20]
push eax
push ebx
fadd qword [0x4d6e18]
call fcn.004a7d38
push eax
lea ecx, [esp + 0x68]
push str._d____s_d___z_d___
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + eax + 0x6c]
push edx
call edi
add esp, 0x14
jmp 0x465b60
xor ebp, ebp
jmp 0x465a4e
mov eax, dword [esi + 0x2f0]
fld qword [eax + 0x58]
fmul qword [0x4d8f20]
fadd qword [0x4d6e18]
call fcn.004a7d38
push eax
lea ecx, [esp + 0x60]
push str._d__
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + eax + 0x64]
push edx
call edi
add esp, 0xc
mov eax, dword [esi + 0x3c4]
test eax, eax
je 0x465b87
push eax
mov eax, dword [esi + 0x3e0]
inc eax
lea ecx, [esp + 0x80]
push eax
push str._d__d
push ecx
call edi
add esp, 0x10
jmp 0x465ba0
mov eax, dword [esi + 0xc0]
lea edx, [esp + 0x7c]
push 0x1e
push edx
push 0xa3
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x465c16
mov ecx, ebp
call fcn.0049e940
cmp eax, 1
jle 0x465c16
mov ecx, ebp
call fcn.0049dd40
test eax, eax
je 0x465bdb
mov ecx, ebp
call fcn.0049e940
push eax
lea ecx, [esp + 0xf0]
push str.___d__
push ecx
call edi
add esp, 0xc
jmp 0x465c03
mov edx, dword [esi + 0x2f0]
mov ecx, ebp
mov ebx, dword [edx + 0x6d0]
call fcn.0049e940
inc ebx
push eax
push ebx
lea eax, [esp + 0xf4]
push str.____d__d_
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0xec]
lea edx, [esp + 0x7c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x465cab
mov eax, dword [0x4f83ec]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov al, byte [edx + 0x521]
test al, al
je 0x465cab
mov eax, dword [edi + 0x24]
add eax, 4
mov ecx, dword [eax]
mov edx, dword [eax + 4]
or ecx, edx
jne 0x465c93
lea edx, [esp + 0x218]
push 1
push edx
mov ecx, edi
call fcn.004257f0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x21c]
push ecx
push edx
call fcn.00470f00
add esp, 0xc
test eax, eax
je 0x465c93
mov ecx, dword [edi + 0x24]
lea eax, [esp + 0x24]
push eax
call fcn.00439a70
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [edi + 0x24]
call fcn.00439a40
mov eax, dword [edi + 0x24]
lea edx, [esp + 0x2c]
push edx
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [eax + 4]
push edx
call fcn.00471310
add esp, 0xc
mov eax, dword [esi + 0x2e8]
test eax, eax
je 0x465cc6
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [esi + 0x2e8], 0
test edi, edi
je 0x465d19
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4f83ec]
mov edx, dword [eax + ecx*4]
mov al, byte [edx + 0x4f6]
test al, al
jne 0x465cf0
push 0x50
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x465d03
lea eax, [esp + 0x114]
push 0
push eax
mov ecx, edi
call fcn.004257f0
jmp 0x465d19
mov edx, dword [edi + 0x34]
lea ecx, [esp + 0x114]
push 0x104
push ecx
push edx
call sub.comdlg32.dll_GetFileTitleA
test ebp, ebp
je 0x465d90
mov eax, dword [ebp + 0x54]
test eax, eax
je 0x465d52
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x50
lea edx, [esp + eax + 0x9c]
sub ecx, eax
mov eax, dword [esi + 0xc0]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.0049e7a0
jmp 0x465d90
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0049e100
push eax
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0049e050
push eax
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0049dfa0
push eax
mov ecx, ebp
call fcn.0049dc40
push eax
lea ecx, [esp + 0xb8]
push 0
push ecx
call fcn.0049eeb0
add esp, 0x24
mov edx, dword [esi + 0xc8]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
mov eax, dword [esi + 0xc8]
push 0
push 0
push 0x31
push eax
call ebp
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x7c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push eax
lea eax, [esp + 0x84]
push eax
push ebx
call edi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
lea eax, [esp + 0x114]
add ecx, 0xa
push edx
push eax
mov dword [esp + 0x48], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x118]
push eax
push ecx
push ebx
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
lea ecx, [eax + edx + 0xa]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x465e29
push 0
call fcn.00425760
jmp 0x465e2b
xor eax, eax
mov edx, dword [esi + 0xc8]
push eax
push 1
push 0x40f
push edx
mov dword [esi + 0x2e8], eax
call ebp
test eax, eax
je 0x465e63
mov eax, dword [esi + 0x2e8]
test eax, eax
je 0x465e63
push 0x31
call fcn.004a6ff8
mov ecx, dword [esp + 0x44]
lea edx, [ecx + eax + 5]
mov dword [esp + 0x44], edx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4f83ec]
mov edi, 2
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x1c], eax
mov cl, byte [eax + 0x521]
test cl, cl
je 0x465eb7
lea edx, [esp + 0x10]
lea eax, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x30]
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov edi, 3
lea ecx, [eax + edx + 0xa]
mov dword [esp + 0x48], ecx
lea edx, [esp + 0x10]
lea eax, [esp + 0x9c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0xa0]
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov edx, dword [esp + edi*4 + 0x3c]
mov eax, dword [esp + 0x10]
inc edi
lea ecx, [edx + eax + 0xa]
lea edx, [esp + 0x10]
lea eax, [esp + 0x5c]
push edx
mov dword [esp + edi*4 + 0x40], ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x60]
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov edx, dword [esp + edi*4 + 0x3c]
mov eax, dword [esp + 0x10]
inc edi
lea ecx, [edx + eax + 0xa]
lea edx, [esp + 0x10]
push edx
push 0x10
push 0x4f05d8
mov dword [esp + edi*4 + 0x48], ecx
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [esp + edi*4 + 0x3c]
mov ecx, dword [esp + 0x10]
inc edi
push ebx
lea edx, [eax + ecx + 0xa]
mov eax, dword [esi + 0xc8]
mov dword [esp + edi*4 + 0x40], edx
push eax
mov dword [esp + edi*4 + 0x48], 0xffffffff
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 0xc8]
lea ecx, [esp + 0x40]
inc edi
push ecx
push edi
push 0x404
push edx
call ebp
mov ecx, dword [esi + 0xc8]
lea eax, [esp + 0x7c]
push eax
push 0
push 0x401
push ecx
call ebp
mov eax, dword [esi + 0xc8]
lea edx, [esp + 0x114]
push edx
push 1
push 0x401
push eax
mov edi, 2
call ebp
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx + 0x521]
test al, al
je 0x465fc2
mov eax, dword [esi + 0xc8]
lea edx, [esp + 0x2c]
push edx
push 2
push 0x401
push eax
mov edi, 3
call ebp
mov edx, dword [esi + 0xc8]
lea ecx, [esp + 0x9c]
mov eax, edi
push ecx
push eax
push 0x401
push edx
inc edi
call ebp
mov edx, dword [esi + 0xc8]
lea ecx, [esp + 0x5c]
mov eax, edi
push ecx
push eax
push 0x401
push edx
inc edi
call ebp
mov eax, edi
push 0
or ah, 0x10
inc edi
push eax
mov eax, dword [esi + 0xc8]
push 0x401
push eax
call ebp
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x466028
mov ecx, ebx
call fcn.00425340
test eax, eax
je 0x466028
mov ecx, ebx
call fcn.00425340
mov ebx, eax
jmp 0x46602d
mov ebx, 0x4f55a8
mov ecx, dword [esi + 0xc8]
push ebx
push edi
push 0x410
push ecx
call ebp
mov edx, dword [esi + 0xc8]
push ebx
push edi
push 0x401
push edx
call ebp
mov eax, dword [esi + 0xc8]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret