Function at 0x476e88
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
cmp word [rdx + 0x18], 9
mov r14, r8
mov r13, rdx
mov rdi, rcx
jne 0x476ed1
mov rax, qword [rcx + 0xa8]
cmp qword [rdx], rax
jne 0x476ed1
mov rcx, qword [rcx + 0x58]
mov rax, qword [rcx]
call qword [rax]
xor al, al
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
mov r12w, ax
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa3
mov si, ax
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, InitCommonControls
mov r15w, ax
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
mov bp, ax
mov qword [r14], rbx
movzx edx, word [r13 + 0x18]
shr ebp, 0xf
and bpl, 1
cmp dx, 0x30
jb 0x476f6b
cmp dx, 0x39
ja 0x476f6b
cmp r15b, bl
jne 0x476f49
cmp r12b, bl
je 0x476f6b
movzx edx, dx
mov rcx, rdi
sub edx, 0x30
cmp bpl, bl
je 0x476f61
call fcn.0046a6e4
jmp 0x47734d
call fcn.0046b968
jmp 0x47734d
cmp dx, 0x71
je 0x476f77
cmp dx, 0x70
jne 0x476f9e
cmp r12b, bl
je 0x476f9e
cmp sil, bl
jne 0x476f9e
cmp bpl, bl
jne 0x476f9e
mov rcx, qword [rdi + 0x58]
cmp dx, 0x70
mov rax, qword [rcx]
setne bl
mov edx, ebx
call qword [rax + VariantCopy]
jmp 0x47734d
cmp dx, 0x78
jne 0x476fbf
cmp r12b, bl
jne 0x476fbf
cmp sil, bl
jne 0x476fbf
cmp bpl, bl
jne 0x476fbf
lea rcx, [0x004ce7b0]
call fcn.0044add0
movzx ecx, word [r13 + 0x18]
mov r14d, 8
cmp cx, 0x72
lea r15, [r14 - 9]
jb 0x477010
cmp cx, 0x7b
ja 0x477010
cmp sil, bl
je 0x477010
lea r8, [0x004a2580]
mov eax, ebx
mov rdx, r8
cmp word [rdx], cx
je 0x476ffd
inc eax
add rdx, r14
cmp eax, 5
jb 0x476feb
mov eax, r15d
cmp eax, ebx
jl 0x477010
cdqe
mov rcx, rdi
mov edx, dword [r8 + rax*8 + 4]
call fcn.0047e6ac
movzx ecx, word [r13 + 0x18]
cmp ecx, 0x56
jg 0x477203
je 0x4771ed
cmp ecx, 0x2d
jg 0x477136
je 0x4770f2
sub ecx, r14d
je 0x4770e5
sub ecx, r14d
je 0x4770b9
sub ecx, 0x12
je 0x477099
sub ecx, 3
je 0x477085
dec ecx
je 0x477071
dec ecx
je 0x477085
dec ecx
jne 0x476ebe
cmp bpl, bl
je 0x476ebe
mov rcx, rdi
call fcn.0047d6bc
jmp 0x476ebe
cmp r12b, bl
je 0x47705b
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp 0x476ebe
cmp r12b, bl
je 0x47705b
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x476ebe
cmp sil, bl
je 0x476ebe
cmp r12b, bl
jne 0x476ebe
cmp bpl, bl
jne 0x476ebe
jmp 0x47734d
mov rcx, qword [rdi + 0xa8]
mov r9d, 1
mov r8, r15
mov edx, 0x100c
mov byte [rdi + 0x22c], bl
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi + 0x230], eax
jmp 0x476ebe
mov rcx, rdi
call fcn.0046c43c
jmp 0x47734d
cmp r12b, bl
jne 0x476ebe
cmp sil, bl
je 0x47710a
cmp bpl, bl
jne 0x47710f
jmp 0x47719c
cmp bpl, bl
je 0x47711d
cmp sil, bl
jne 0x476ebe
jmp 0x4771f6
cmp byte [rdi + 0xdb], bl
je 0x476ebe
mov rcx, rdi
call fcn.0047d7c4
jmp 0x47734d
cmp ecx, 0x2e
je 0x4771da
cmp ecx, 0x30
jle 0x476ebe
cmp ecx, 0x34
jle 0x4771c1
cmp ecx, 0x41
je 0x4771a9
cmp ecx, 0x43
je 0x477193
cmp ecx, 0x4e
je 0x47717d
cmp ecx, 0x52
jne 0x476ebe
cmp sil, bl
je 0x476ebe
xor edx, edx
mov rcx, rdi
call fcn.00476d6c
jmp 0x47734d
cmp sil, bl
je 0x476ebe
mov rcx, rdi
call fcn.0047d038
jmp 0x47734d
cmp sil, bl
je 0x476ebe
mov rcx, rdi
call fcn.0047859c
jmp 0x47734d
cmp sil, bl
je 0x476ebe
mov dl, 1
mov rcx, rdi
call fcn.0047dcec
jmp 0x47734d
cmp sil, bl
je 0x476ebe
lea edx, [rcx - 0x31]
mov rcx, rdi
call fcn.00461098
jmp 0x47734d
cmp bpl, bl
mov rcx, rdi
sete dl
call fcn.0047bbcc
jmp 0x47734d
cmp sil, bl
je 0x476ebe
mov rcx, rdi
call fcn.00489228
jmp 0x47734d
cmp ecx, 0x71
jg 0x477304
je 0x4772df
sub ecx, 0x57
je 0x4772bc
dec ecx
je 0x4772a6
sub ecx, 2
je 0x477290
sub ecx, 0x10
je 0x477283
dec ecx
je 0x47724e
cmp ecx, 2
jne 0x476ebe
xor edx, edx
cmp r12b, bl
mov rcx, rdi
jne 0x477258
cmp bpl, bl
je 0x477279
jmp 0x4771b7
cmp r12b, bl
je 0x477262
mov dl, 1
mov rcx, rdi
call fcn.0047da40
jmp 0x47734d
cmp bpl, bl
jne 0x4771b2
cmp sil, bl
jne 0x47734d
mov dl, 1
mov rcx, rdi
call fcn.0047dee0
jmp 0x47734d
mov rcx, rdi
call fcn.0047dd14
jmp 0x47734d
cmp sil, bl
je 0x476ebe
mov rcx, rdi
call fcn.0047b424
jmp 0x47734d
cmp sil, bl
je 0x476ebe
mov rcx, rdi
call fcn.00489228
jmp 0x47734d
cmp sil, bl
je 0x476ebe
mov rcx, qword [0x004ce768]
xor r9d, r9d
mov r8, r14
mov edx, 0x111
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x47734d
cmp r12b, bl
jne 0x476ebe
cmp sil, bl
jne 0x476ebe
cmp bpl, bl
jne 0x476ebe
mov rcx, rdi
call fcn.0047b18c
jmp 0x47734d
sub ecx, 0x72
je 0x4773d4
dec ecx
je 0x4773b2
dec ecx
je 0x47738f
dec ecx
je 0x477379
dec ecx
je 0x477354
cmp ecx, 5
jne 0x476ebe
cmp r12b, bl
je 0x476ebe
cmp sil, bl
jne 0x476ebe
cmp bpl, bl
jne 0x476ebe
mov rcx, rdi
call fcn.0046c284
mov al, 1
jmp 0x476ec0
cmp r12b, bl
jne 0x476ebe
cmp sil, bl
jne 0x476ebe
cmp bpl, bl
jne 0x476ebe
mov rcx, rdi
call fcn.0047ca3c
jmp 0x47734d
cmp r12b, bl
jne 0x476ebe
cmp sil, bl
jne 0x476ebe
mov dl, 1
jmp 0x4773a3
cmp r12b, bl
jne 0x476ebe
cmp sil, bl
jne 0x476ebe
xor edx, edx
mov rcx, qword [rdi + 0x58]
mov r8b, bpl
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x47734d
cmp r12b, bl
jne 0x476ebe
cmp sil, bl
jne 0x476ebe
cmp bpl, bl
mov rcx, rdi
jne 0x477189
mov dl, 1
jmp 0x4773f4
cmp r12b, bl
jne 0x476ebe
cmp sil, bl
jne 0x476ebe
cmp bpl, bl
jne 0x476ebe
xor edx, edx
mov rcx, rdi
call fcn.004747b0
jmp 0x47734d