Function at 0x46f140
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x32]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x46f824
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x48c7f4]
mov eax, dword [eax]
xor edx, edx
call fcn.00454c10
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0046ce20
test eax, eax
jle 0x46f1cc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.0046ce20
mov edx, eax
dec edx
mov eax, ebx
call fcn.0046ce28
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
call fcn.0046ef44
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.0046ea54
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x46f1e2
mov eax, ebx
call fcn.0043d490
call fcn.0045ee94
mov byte [ebp - 6], 1
jmp 0x46f7fb
cmp byte [ebp - 6], 0
jne 0x46f1f6
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x46f7da
mov eax, dword [edi + 4]
sub eax, 0x12
je 0x46f316
sub eax, 0x34
je 0x46f228
add eax, 0xffffffa5
sub eax, 9
jb 0x46f316
sub eax, 0x157
je 0x46f239
jmp 0x46f322
push ebp
call fcn.0046f0ec
pop ecx
call fcn.00403f80
jmp 0x46f82b
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407358
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00436920
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x46f2bf
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea ecx, [ebp - 0x4c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046eb10
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x46f2bf
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
jmp 0x46f322
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x46f2f9
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00436920
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea ecx, [ebp - 0x4c]
mov edx, dword [esi + 0x40]
mov eax, esi
call fcn.0046eb10
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x46f2f6
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x46f301
test bl, bl
je 0x46f2c6
test bl, bl
jne 0x46f322
push ebp
call fcn.0046f0ec
pop ecx
call fcn.00403f80
jmp 0x46f82b
push ebp
call fcn.0046f0ec
pop ecx
jmp 0x46f7da
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x46f7da
mov eax, dword [edi + 4]
sub eax, 0x7b
je 0x46f7da
add eax, 0xffffff7b
sub eax, 9
jb 0x46f374
add eax, 0xffffff09
sub eax, 0xb
jb 0x46f618
sub eax, 0x264
jne 0x46f7d4
mov eax, dword [ebp - 4]
call fcn.0046ee88
jmp 0x46f7da
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x46f7da
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x46f3aa
sub eax, 2
je 0x46f5c7
sub eax, 2
je 0x46f3aa
sub eax, 2
je 0x46f5c7
jmp 0x46f7da
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x46f3ed
je 0x46f49f
cmp eax, 0x12
jg 0x46f3d6
je 0x46f5b0
sub eax, 9
je 0x46f7da
sub eax, 4
je 0x46f412
jmp 0x46f5bc
sub eax, 0x1b
je 0x46f477
sub eax, 5
je 0x46f7da
jmp 0x46f5bc
sub eax, 0x26
je 0x46f573
dec eax
je 0x46f509
dec eax
je 0x46f58d
sub eax, 0x51
je 0x46f5b0
jmp 0x46f5bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x46f425
mov si, 0xffef
call fcn.00403904
mov eax, dword [ebp - 4]
call fcn.0046ee88
test al, al
jne 0x46f7da
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x46f7da
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x46f840
call fcn.00404870
je 0x46f7da
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x46f7da
push ebp
call fcn.0046f0ec
pop ecx
jmp 0x46f7da
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x46f485
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.00403f80
jmp 0x46f82b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x46f4b5
mov eax, dword [ebp - 4]
call fcn.0046f010
jmp 0x46f7da
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x46f7da
cmp byte [ebx + 0x34], 0
je 0x46f4ea
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
call fcn.00403f80
jmp 0x46f82b
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
jmp 0x46f7da
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x46f51f
mov eax, dword [ebp - 4]
call fcn.0046ef44
jmp 0x46f7da
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x46f7da
cmp byte [ebx + 0x34], 0
je 0x46f554
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
call fcn.00403f80
jmp 0x46f82b
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
jmp 0x46f7da
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x46f7da
mov eax, dword [ebp - 4]
call fcn.0046f010
jmp 0x46f7da
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x46f5a3
mov eax, dword [ebp - 4]
call fcn.0046ef44
jmp 0x46f7da
mov eax, dword [ebp - 4]
call fcn.0046ee88
jmp 0x46f7da
push ebp
call fcn.0046f0ec
pop ecx
jmp 0x46f7da
push edi
call sub.user32.dll_TranslateMessage
jmp 0x46f7da
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.0046e1d4
test eax, eax
je 0x46f7da
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.0046e1d4
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
jmp 0x46f7da
mov eax, dword [edi + 4]
sub eax, 0x200
je 0x46f630
sub eax, 2
je 0x46f6ff
jmp 0x46f7da
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407358
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x493d1c]
jne 0x46f661
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x493d20]
je 0x46f7da
mov esi, dword [ebp - 4]
jmp 0x46f668
mov esi, eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x46f666
test esi, esi
je 0x46f6d7
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.0046ea54
cmp ebx, dword [esi + 0x40]
je 0x46f6d0
cmp esi, dword [ebp - 4]
je 0x46f6d0
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x46f6af
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x48]
cmp esi, ebx
jne 0x46f691
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
call fcn.00403f80
jmp 0x46f82b
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x46f673
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x46f6e8
mov eax, dword [ebp - 4]
call fcn.0046ee88
mov eax, dword [ebp - 0xe]
mov dword [0x493d1c], eax
mov eax, dword [ebp - 0xa]
mov dword [0x493d20], eax
jmp 0x46f7da
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407358
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00436920
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x46f785
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea ecx, [ebp - 0x4c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046eb10
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x46f785
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043d490
push eax
call sub.user32.dll_PostMessageA
jmp 0x46f7da
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x46f7bf
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00436920
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea ecx, [ebp - 0x4c]
mov edx, dword [esi + 0x40]
mov eax, esi
call fcn.0046eb10
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x46f7bc
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x46f7c7
test bl, bl
je 0x46f78c
test bl, bl
jne 0x46f7da
push ebp
call fcn.0046f0ec
pop ecx
jmp 0x46f7da
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.0046f118
pop ecx
test al, al
je 0x46f7fb
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x46f1ff
push ebp
call fcn.0046f118
pop ecx
test al, al
jne 0x46f1eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f82b
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.0045eeb4
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret