Function at 0x47e650
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
jne 0x47e8f0
push esi
push 0x10
call edi
mov esi, eax
push 0x11
and esi, 0x8000
call edi
mov ecx, dword [ebp + 0xc]
mov edx, eax
add ecx, 0xffffffdd
and edx, 0x8000
cmp ecx, 0xb
ja case.default.0x47e695
push ebx
jmp dword [ecx*4 + 0x47e8f8]
test edx, edx
je 0x47e700
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x614]
mov ebx, dword [edi + 0x618]
mov dword [ebp + 8], eax
mov eax, dword [edi + 0x5e0]
cmp eax, 0xffffffff
jne 0x47e6cf
push dword [edi + 0x5dc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [edi + 0x5e0], eax
test ebx, ebx
je 0x47e6e1
push 0
push eax
push ebx
push ecx
mov ecx, edi
call fcn.0047ce20
mov ebx, eax
mov edx, dword [edi]
test esi, esi
push ebx
cmovne ebx, dword [ebp + 8]
push ebx
push edi
call dword [edx + 0x21c]
mov ecx, edi
call fcn.0047d840
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push esi
call fcn.0047d950
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test edx, edx
je 0x47e777
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x614]
mov ebx, dword [edi + 0x618]
mov dword [ebp + 8], eax
mov eax, dword [edi + 0x5e0]
cmp eax, 0xffffffff
jne 0x47e743
push dword [edi + 0x5dc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [edi + 0x5e0], eax
cmp ebx, eax
je 0x47e758
push 1
push eax
lea eax, [ebx + 1]
push eax
push ecx
mov ecx, edi
call fcn.0047ce20
mov ebx, eax
mov edx, dword [edi]
test esi, esi
push ebx
cmovne ebx, dword [ebp + 8]
push ebx
push edi
call dword [edx + 0x21c]
mov ecx, edi
call fcn.0047d840
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push esi
call fcn.0047d9e0
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test esi, esi
mov esi, dword [ebp + 8]
je 0x47e796
mov ecx, dword [esi + 0x614]
jmp 0x47e798
xor ecx, ecx
mov eax, dword [esi]
push 0
push ecx
push esi
call dword [eax + 0x21c]
mov ecx, esi
call fcn.0047d840
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.0047d990
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
test dword [edi + 0x5fc], 0x800
jne case.0x47e695.38
test esi, esi
je 0x47e7e2
test edx, edx
jne case.0x47e695.38
mov eax, dword [edi + 0x614]
mov ecx, dword [edi]
cmp eax, dword [edi + 0x618]
je 0x47e811
push edi
test esi, esi
je 0x47e804
call dword [ecx + 0x1cc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call dword [ecx + 0x1c8]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
push 0
push 0xffffffffffffffff
push edi
test esi, esi
je 0x47e840
call dword [ecx + 0x21c]
mov ecx, dword [edi + 0x618]
test ecx, ecx
mov edx, dword [edi]
lea eax, [ecx - 1]
cmove eax, ecx
push eax
push dword [edi + 0x614]
push edi
call dword [edx + 0x21c]
jmp 0x47e8a4
mov eax, dword [ecx + 0x21c]
test edx, edx
je 0x47e87b
call eax
mov eax, dword [edi + 0x5e0]
cmp eax, 0xffffffff
jne 0x47e869
push dword [edi + 0x5dc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [edi + 0x5e0], eax
mov ecx, dword [edi]
push eax
push dword [edi + 0x614]
push edi
call dword [ecx + 0x21c]
jmp 0x47e8a4
call eax
mov edx, dword [edi + 0x618]
mov eax, dword [edi + 0x5dc]
mov esi, dword [edi]
lea ecx, [edx + 1]
cmp word [eax + edx*2], 0
cmove ecx, edx
push ecx
push dword [edi + 0x614]
push edi
call dword [esi + 0x21c]
mov ecx, edi
call fcn.0047d840
mov eax, dword [edi]
push edi
call dword [eax + 0x1c8]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test esi, esi
je 0x47e8de
mov ecx, dword [ebp + 8]
test dword [ecx + 0x5fc], 0x800
jne case.0x47e695.38
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1bc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test edx, edx
je case.0x47e695.38
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c0]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10