Function at 0x471ca3
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x80
mov eax, 0x55c92b
call fcn.005399db
mov esi, ecx
lea eax, [ebp - 0x8c]
call fcn.0047175e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea ebx, [ebp - 0x8c]
mov eax, esi
call fcn.004bc333
push dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2c], ebx
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
mov eax, dword [esi]
or dword [esi + 0x2e4], 0xffffffff
push ecx
mov ecx, esi
call dword [eax + 0x38]
cmp dword [esi + 0x2c8], 1
jne 0x471d2e
mov eax, dword [esi + 0x2b8]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
jmp 0x471d3a
mov eax, dword [esi + 0x2bc]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x4c], ebx
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x4c]
stosd dword es:[edi], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x38]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov byte [esi + 0x340], bl
mov eax, dword [esi + 0x2fc]
sub eax, dword [esi + 0x2f8]
xor edi, edi
test eax, 0xfffffffc
jle 0x471e1e
mov dword [ebp - 0x14], ebx
cmp edi, dword [esi + 0x2a4]
jne 0x471da7
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setne cl
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
push edi
mov ecx, esi
call dword [eax + 0xa0]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x24], eax
jg 0x471e17
mov ecx, dword [esi + 0x2fc]
sub ecx, dword [esi + 0x2f8]
sar ecx, 2
dec ecx
cmp ecx, edi
je 0x471dda
add eax, 0xffffffea
cmp dword [ebp - 0x24], eax
jg 0x471e17
push dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push edi
push eax
push ecx
mov ecx, dword [ebp + 8]
mov eax, esp
mov dword [esi + 0x2e4], edi
mov dword [eax], ecx
mov eax, dword [esi]
mov ecx, esi
mov dword [ebp - 0x14], esp
call dword [eax + 0xa4]
mov eax, dword [esi + 0x2fc]
sub eax, dword [esi + 0x2f8]
inc edi
sar eax, 2
cmp edi, eax
jl 0x471d88
jmp 0x471e1e
mov byte [esi + 0x340], 1
cmp dword [esi + 0x338], ebx
je 0x471ea2
cmp byte [esi + 0x340], bl
je 0x471ea2
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00472add
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
call dword [eax + 0x4c]
lea edx, [esi + 0x324]
cmp dword [edx + 0x18], 0x10
jb 0x471e52
mov edx, dword [edx + 4]
jmp 0x471e55
add edx, 4
mov edi, dword [eax]
push edx
mov ecx, eax
call dword [edi + 0x1c]
mov edx, eax
cmp edx, ebx
je 0x471ea2
xor ecx, ecx
cmp dword [esi + 0x2a4], 0xfffffffe
jne 0x471e6f
inc ecx
cmp dword [esi + 0x2e0], ebx
je 0x471e7a
push 2
pop ecx
xor eax, eax
mov dword [ebp - 0x5c], ebx
lea edi, [ebp - 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xff
push 4
stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
mov eax, edx
call fcn.004c3a62
add esp, 0x18
push dword [ebp - 0x1c]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_RestoreDC]
lea esi, [ebp - 0x8c]
lea edi, [ebp - 0x18]
call fcn.004bc476
cmp dword [ebp - 0x10], ebx
je 0x471eca
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.00539ab3
ret 4