Function at 0x479940
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524321
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x56d370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x170], ebx
cmp esi, 0x200
ja 0x479e26
je 0x479dfc
lea eax, [esi - 5]
cmp eax, 0x82
ja case.0x4799b4.6
movzx eax, byte [eax + 0x47a024]
jmp dword [eax*4 + 0x47a00c]
mov dword [ecx], 1
mov al, 1
jmp 0x479f52
push 1
push 0
mov ecx, edx
call fcn.004d1220
jmp case.0x4799b4.6
lea eax, [ebp - 0x17c]
mov ecx, edi
push eax
call fcn.00478f60
push eax
mov ecx, edi
call fcn.004787b0
test eax, eax
je case.0x4799b4.6
mov eax, dword fs:[0x2c]
mov ecx, dword [0x572b38]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x572aa4]
cmp eax, dword [ecx + 4]
jg 0x479f70
push dword [0x572aa0]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x164]
mov dword [eax], 1
mov al, 1
jmp 0x479f52
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je case.0x4799b4.6
cmp dword [ecx + 4], 0x100
jne case.0x4799b4.6
mov esi, dword [edi + 0x1c]
mov eax, dword [edi + 0x20]
cmp esi, eax
je 0x479a6b
cmp byte [esi + 0x28], bl
jne 0x479a63
add esi, 0x3c
cmp esi, eax
jne 0x479a57
cmp esi, eax
jne 0x479c3e
cmp byte [edi + 0x10], bl
je case.0x4799b4.6
cmp byte [edi + 0x54], bl
je case.0x4799b4.6
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.0x4799b4.6
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 8]
cmp eax, 0x41
je 0x479f3c
cmp eax, 0x43
jne case.0x4799b4.6
cmp byte [edi + 0x3d], bl
je case.0x4799b4.6
xor eax, eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov esi, dword [edi + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x164], eax
cmp esi, dword [edi + 0x20]
je 0x479c30
xor eax, eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov edx, dword [esi + 0x30]
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
je 0x479bd7
mov ecx, dword [esi + 0x34]
cmp ecx, 0xffffffff
je 0x479bd7
cmp edx, ecx
jg 0x479fae
test bl, 1
je 0x479b16
and ebx, 0xfffffffe
mov dword [ebp - method.plat::Exception.virtual_0], vtable.plat::Exception.0
mov eax, dword [esi + 4]
sub ecx, edx
push 1
inc ecx
push ecx
lea eax, [eax + edx*2]
push 0xfde9
push eax
lea ecx, [ebp - 0x188]
call fcn.00411420
push 0xffffffffffffffff
push dword [ebp - 0x184]
lea ecx, [ebp - 0x17c]
call fcn.00407520
cmp byte [ebp - 0x180], 0
mov eax, dword [ebp - 0x184]
mov byte [ebp - 4], 2
je 0x479b72
test eax, eax
je 0x479b72
push dword [ebp - 0x188]
push eax
call fcn.00408000
mov eax, dword [ebp - 0x184]
add esp, 8
push eax
call fcn.0047f552
add esp, 4
mov dword [ebp - 0x188], 0
cmp dword [ebp - 0x174], 0
mov dword [ebp - 0x184], 0
je 0x479bb5
mov eax, dword [ebp - 0x164]
cmp dword [esi + 0x2c], eax
je 0x479bb5
push 0xffffffffffffffff
push 0x5383b0
lea ecx, [ebp - 0x174]
call fcn.00407520
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0x174]
push 0xffffffffffffffff
push dword [ebp - 0x17c]
mov dword [ebp - 0x164], eax
call fcn.00407520
mov eax, dword [ebp - 0x17c]
push eax
mov byte [ebp - 4], 0
call fcn.0047f552
add esi, 0x3c
add esp, 4
cmp esi, dword [edi + 0x20]
jne 0x479ad2
mov eax, dword [ebp - 0x174]
test eax, eax
je 0x479c30
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x165]
push dword [eax + 4]
call fcn.00473210
push dword [ebp - 0x174]
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00473610
lea ecx, [ebp - 0x165]
call fcn.004733b0
mov eax, dword [ebp - 0x174]
push eax
call fcn.0047f552
add esp, 4
jmp case.0x4799b4.6
mov ecx, dword [ecx + 8]
xor bl, bl
lea eax, [ecx - 9]
cmp eax, 0xec
ja case.0x4799b4.6
movzx eax, byte [eax + 0x47a0b8]
jmp dword [eax*4 + 0x47a0a8]
mov ecx, dword [edi + 8]
test ecx, ecx
je case.0x4799b4.6
mov eax, dword [ecx]
push dword [esi + 0xc]
call dword [eax + 4]
mov eax, dword [ebp - 0x164]
mov dword [eax], 4
mov al, 1
jmp 0x479f52
mov bl, 1
cmp byte [edi + 0x10], 0
je 0x479ca4
cmp byte [edi + 0x54], 0
je 0x479ca4
mov ecx, edi
mov byte [edi + 0x54], 0
call fcn.00479670
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 8]
cmp ecx, 9
jne 0x479cba
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
shr ebx, 0xf
and bl, 1
mov ecx, dword [edi + 0x20]
cmp esi, ecx
je 0x479cd8
mov eax, dword [ebp - 0x16c]
mov ecx, esi
mov byte [esi + 0x28], 0
push dword [eax + 4]
call fcn.00477f80
mov ecx, dword [edi + 0x20]
test bl, bl
je 0x479d00
mov eax, dword [edi + 0x1c]
mov edx, esi
mov esi, ecx
cmp eax, edx
je 0x479d0d
cmp dword [eax + 0xc], 0
mov esi, eax
cmove esi, ecx
add eax, 0x3c
mov ecx, esi
cmp eax, edx
jne 0x479ce7
jmp 0x479d0d
add esi, 0x3c
cmp esi, ecx
je 0x479d0d
cmp dword [esi + 0xc], 0
je 0x479d00
cmp esi, dword [edi + 0x20]
je case.0x4799b4.6
push esi
mov ecx, edi
call fcn.00478240
mov eax, dword [ebp - 0x164]
mov dword [eax], 4
mov al, 1
jmp 0x479f52
mov ecx, edi
call fcn.00478e40
cmp esi, 7
jne 0x4799c1
mov esi, dword [ebp - 0x16c]
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetAncestor]
push dword [esi + 4]
mov ebx, eax
mov dword [ebp - 0x164], ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4799c1
push 1
push dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push ebx
call esi
mov ebx, dword [ebp + 0x14]
cmp ebx, eax
jne 0x479d9f
mov eax, dword [edi + 0x1c]
mov edx, dword [edi + 0x20]
cmp eax, edx
je 0x4799c1
nop
cmp dword [eax + 0xc], 0
jne 0x479de5
add eax, 0x3c
cmp eax, edx
jne 0x479d90
jmp 0x479de5
mov eax, dword [ebp - 0x16c]
push 0
push dword [eax + 4]
push dword [ebp - 0x164]
call esi
cmp ebx, eax
jne case.0x4799b4.6
mov eax, dword [edi + 0x20]
mov edx, eax
mov ecx, dword [edi + 0x1c]
cmp ecx, eax
je 0x479de5
mov esi, eax
nop dword [eax + eax]
cmp dword [ecx + 0xc], 0
mov eax, ecx
cmove eax, edx
add ecx, 0x3c
mov edx, eax
cmp ecx, esi
jne 0x479dd0
mov edx, dword [edi + 0x20]
cmp eax, edx
je 0x4799c1
push eax
mov ecx, edi
call fcn.00478240
mov al, 1
jmp 0x479f52
cmp byte [edi + 0x10], bl
je case.0x4799b4.6
cmp byte [edi + 0x3c], bl
je case.0x4799b4.6
mov eax, dword [ebp + 0x18]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
mov ecx, edi
call fcn.004797d0
jmp case.0x4799b4.6
cmp esi, 0x203
ja 0x479f45
je 0x479f37
sub esi, 0x201
je 0x479e9d
sub esi, 1
jne case.0x4799b4.6
cmp byte [edi + 0x10], bl
je 0x479e60
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [edi + 0x50]
mov byte [edi + 0x3c], bl
call dword [sym.imp.USER32.dll_SetCursor]
cmp byte [edi + 0x3d], bl
jne case.0x4799b4.6
lea eax, [ebp - 0x17c]
mov ecx, edi
push eax
call fcn.00478f60
push eax
mov ecx, edi
call fcn.004787b0
mov ecx, dword [edi + 8]
test ecx, ecx
je case.0x4799b4.6
test eax, eax
je case.0x4799b4.6
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp case.0x4799b4.6
cmp byte [edi + 0x10], bl
je case.0x4799b4.6
mov ecx, edi
call fcn.00478e40
cmp byte [edi + 0x54], bl
jne 0x479ece
mov ebx, dword [ebp - 0x16c]
mov esi, dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
je 0x479ece
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x54], 1
mov eax, 0x88888889
mov ecx, dword [edi + 0x20]
sub ecx, dword [edi + 0x1c]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je case.0x4799b4.6
mov eax, dword [ebp + 0x18]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
mov ecx, edi
call fcn.004797d0
cmp byte [edi + 0x3c], 0
je case.0x4799b4.6
mov eax, dword fs:[0x2c]
mov ecx, dword [0x572b38]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x572aac]
cmp eax, dword [ecx + 4]
jg 0x479fcb
push dword [0x572aa8]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [edi + 0x50], eax
jmp case.0x4799b4.6
cmp byte [edi + 0x10], bl
je case.0x4799b4.6
mov ecx, edi
call fcn.004796c0
jmp case.0x4799b4.6
cmp esi, 0x31a
jne case.0x4799b4.6
mov byte [edi + 0x11], bl
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047fc61
mov esp, ebp
pop ebp
ret 0x18
push 0x572aa4
call fcn.0047fb55
add esp, 4
cmp dword [0x572aa4], 0xffffffff
jne 0x479a16
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x572aa4
mov dword [0x572aa0], eax
call fcn.0047fb0b
add esp, 4
jmp 0x479a16
push 0x7b
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.12.xlabelcon_windows_64_rvcoreuilibsuiwinmarkuptextwin.cxx
push str.selStartIdx___selEndIdx
lea ecx, [ebp - 0x160]
call fcn.00428e20
push eax
call fcn.00428ea0
push 0x572aac
call fcn.0047fb55
add esp, 4
cmp dword [0x572aac], 0xffffffff
jne 0x479f26
push 0x7f01
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x572aac
mov dword [0x572aa8], eax
call fcn.0047fb0b
add esp, 4
jmp 0x479f26