Function at 0x463d9b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push edi
push 9
pop eax
mov edi, ecx
cmp word [ebp + 0xc], ax
jne 0x463dc5
mov eax, dword [ebp]
cmp eax, dword [edi + 0x68]
jne 0x463dc5
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax]
xor al, al
jmp 0x463f48
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x11
mov dword [esp + 0x24], eax
call esi
movzx ebx, ax
shr ebx, 0xf
push 0xa3
and bl, 1
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x10
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [esp + 0x24]
movzx edx, ax
shr edx, 0xf
push 9
and dword [ecx], 0
and edx, 0xffffff01
movzx esi, word [ebp + 0xc]
pop ecx
mov dword [esp + 0x10], edx
mov byte [esp + 0x14], dl
lea eax, [esi - 0x30]
cmp ax, cx
ja 0x463e58
cmp byte [esp + 0x18], 0
jne 0x463e3a
mov eax, dword [esp + 0x20]
test al, al
je 0x463e5c
lea ecx, [esi - 0x30]
push ecx
mov ecx, edi
test dl, dl
je 0x463e4e
call fcn.0045e4c5
jmp 0x4642d5
call fcn.0045e042
jmp 0x4642d5
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], 0x71
push 0x70
pop ecx
cmp si, word [esp + 0x24]
je 0x463e73
cmp si, cx
jne 0x463e98
test al, al
je 0x463e98
test bl, bl
jne 0x463e98
test dl, dl
jne 0x463e98
mov ecx, dword [edi + 0x3c]
xor eax, eax
push 0x70
pop edi
cmp si, di
mov edx, dword [ecx]
setne al
push eax
call dword [edx + 4]
jmp 0x4642d5
cmp esi, 0x78
jne 0x463eb3
test al, al
jne 0x463eb3
test bl, bl
jne 0x463eb3
test dl, dl
jne 0x463eb3
mov ecx, 0x5b2890
call fcn.00448039
movzx ecx, word [ebp + 0xc]
push 9
pop edx
lea eax, [ecx - 0x72]
cmp ax, dx
ja 0x463eec
test bl, bl
je 0x463eec
xor eax, eax
cmp word [eax*8 + 0x57dcd0], cx
je 0x463eda
inc eax
cmp eax, 5
jb 0x463ec8
jmp 0x463eec
test eax, eax
js 0x463eec
push dword [eax*8 + 0x57dcd4]
mov ecx, edi
call fcn.00468853
movzx eax, word [ebp + 0xc]
cmp eax, 0x4e
ja 0x46407d
je 0x464069
cmp eax, 0x2d
ja 0x463ff0
je 0x463fb8
sub eax, 8
je 0x463fac
sub eax, 8
je 0x463f8b
sub eax, 0x12
je 0x463f72
sub eax, 3
je 0x463f50
sub eax, 1
je 0x463f61
sub eax, 1
je 0x463f50
sub eax, 1
jne 0x463f44
mov eax, dword [esp + 0x10]
test al, al
je 0x463f44
mov ecx, edi
call fcn.00467d69
xor al, al
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret 8
cmp byte [esp + 0x20], 0
je 0x463f35
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x463f44
cmp byte [esp + 0x20], 0
je 0x463f35
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x463f44
test bl, bl
je 0x463f44
cmp byte [esp + 0x20], 0
jne 0x463f44
mov eax, dword [esp + 0x10]
test al, al
je 0x4642d5
jmp 0x463f44
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x68]
mov byte [edi + 0x178], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x17c], eax
jmp 0x463f44
mov ecx, edi
call fcn.0045e15f
jmp 0x4642d5
cmp byte [esp + 0x20], 0
jne 0x463f44
mov eax, dword [esp + 0x10]
test bl, bl
je 0x463fd0
test al, al
je 0x464022
jmp 0x463f44
test al, al
jne 0x46414b
cmp byte [edi + 0x87], al
je 0x463f44
mov ecx, edi
call fcn.00467e0d
jmp 0x4642d5
mov ecx, eax
sub ecx, 0x2e
je 0x464053
sub ecx, 3
je 0x46403b
sub ecx, 1
je 0x46403b
sub ecx, 1
je 0x46403b
sub ecx, 1
je 0x46403b
sub ecx, 0xd
je 0x46402e
dec ecx
sub ecx, 1
jne 0x463f44
test bl, bl
je 0x463f44
mov ecx, edi
call fcn.00465743
jmp 0x4642d5
test bl, bl
je 0x463f44
jmp 0x4640d0
test bl, bl
je 0x463f44
add eax, 0xffffffcf
mov ecx, edi
push eax
call fcn.004583b7
jmp 0x4642d5
mov eax, dword [esp + 0x10]
mov ecx, edi
xor al, 1
movzx eax, al
push eax
call fcn.00467443
jmp 0x4642d5
test bl, bl
je 0x463f44
mov ecx, edi
call fcn.0046700d
jmp 0x4642d5
cmp eax, 0x6d
ja 0x464199
je 0x46416d
sub eax, 0x52
je 0x464157
sub eax, 4
je 0x464143
sub eax, 1
je 0x464121
sub eax, 1
je 0x46410d
dec eax
sub eax, 1
je 0x4640f9
sub eax, 0x10
je 0x4640ed
sub eax, 1
jne 0x463f44
cmp byte [esp + 0x20], al
je 0x4640c9
push 1
jmp 0x464176
cmp byte [esp + 0x10], 0
je 0x4640d7
push 1
jmp 0x46418d
test bl, bl
jne 0x4642d5
push 1
mov ecx, edi
call fcn.00468245
jmp 0x4642d5
mov ecx, edi
call fcn.00467d33
jmp 0x4642d5
test bl, bl
je 0x463f44
mov ecx, edi
call fcn.00466da8
jmp 0x4642d5
test bl, bl
je 0x463f44
mov ecx, edi
call fcn.00446f60
jmp 0x4642d5
test bl, bl
je 0x463f44
push 0
push 8
push 0x111
push dword [0x5b2860]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4642d5
test bl, bl
je 0x463f44
mov ecx, edi
call fcn.00446f60
jmp 0x4642d5
test bl, bl
je 0x463f44
push 0
mov ecx, edi
call fcn.00462d88
jmp 0x4642d5
cmp byte [esp + 0x20], 0
push 0
je 0x464182
mov ecx, edi
call fcn.00468067
jmp 0x4642d5
cmp byte [esp + 0x14], 0
je 0x4640e1
mov ecx, edi
call fcn.0046803d
jmp 0x4642d5
sub eax, dword [esp + 0x24]
je 0x4642af
sub eax, 1
je 0x464285
sub eax, 1
je 0x464264
sub eax, 1
je 0x464241
sub eax, 1
je 0x464226
sub eax, 1
je 0x4641fb
sub eax, 5
jne 0x463f44
cmp byte [esp + 0x20], al
je 0x463f44
test bl, bl
jne 0x463f44
mov eax, dword [esp + 0x10]
test al, al
jne 0x463f44
mov ecx, edi
call fcn.0045d665
jmp 0x4642d5
cmp byte [esp + 0x20], 0
jne 0x463f44
test bl, bl
jne 0x463f44
mov eax, dword [esp + 0x10]
test al, al
jne 0x463f44
mov ecx, edi
call fcn.00467216
jmp 0x4642d5
cmp byte [esp + 0x20], 0
jne 0x463f44
test bl, bl
jne 0x463f44
push dword [esp + 0x14]
push 1
jmp 0x46425a
cmp byte [esp + 0x20], 0
jne 0x463f44
test bl, bl
jne 0x463f44
push dword [esp + 0x14]
push 0
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x4642d5
cmp byte [esp + 0x20], 0
jne 0x463f44
test bl, bl
jne 0x463f44
cmp byte [esp + 0x10], bl
jne 0x464071
push 1
jmp 0x4642a6
cmp byte [esp + 0x20], 0
jne 0x463f44
test bl, bl
jne 0x463f44
mov eax, dword [esp + 0x10]
test al, al
jne 0x463f44
push 0
mov ecx, edi
call fcn.00461e01
jmp 0x4642d5
cmp byte [esp + 0x20], 0
jne 0x463f44
test bl, bl
jne 0x463f44
mov eax, dword [esp + 0x10]
test al, al
jne 0x463f44
mov ecx, edi
call fcn.00467cf9
mov al, 1
jmp 0x463f46