Function at 0x463ee0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1b3c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5061ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x464104
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x463f2d
cmp eax, 0x101
jne 0x464104
mov eax, dword [ecx - 0xfc]
lea edi, [ecx - 0xfc]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, edi
call dword [eax + 0xcc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0
test eax, eax
je 0x4640f3
push 1
mov ecx, edi
call fcn.004168f0
test al, al
je 0x4640f0
mov ecx, edi
call fcn.00419420
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x34]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x463f92
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 2
jmp 0x4640fa
cmp dword [esi + 4], 0x100
jne 0x464060
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push dword [eax + 0x60]
call fcn.0042fd60
movzx eax, word [ebp - 0x12]
mov byte [ebp - 4], 3
cmp dword [esi + 8], eax
jne 0x464054
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp cx, ax
jne 0x463ffb
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
jne 0x463ff8
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x463ff8
push 0x10
call esi
mov ecx, 0x8000
test cx, ax
je 0x464049
mov eax, dword [ebp - 0x14]
mov ecx, 1
cmp cx, ax
jne 0x464016
push 0x10
call esi
mov ecx, 0x8000
test cx, ax
jne 0x464049
mov eax, dword [ebp - 0x14]
mov ecx, 2
cmp cx, ax
jne 0x464031
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x464049
mov eax, dword [ebp - 0x14]
mov ecx, 4
cmp cx, ax
jne 0x464054
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x464054
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov eax, dword [ecx]
call dword [eax + 0x28]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.0041ca40
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x464083
mov esi, dword [sym.imp.USER32.dll_GetParent]
cmp eax, edi
je 0x464093
push eax
call esi
test eax, eax
jne 0x464075
mov ecx, dword [ebp - 0x1c]
cmp eax, edi
je 0x464096
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 4
jmp 0x4640fa
mov ecx, dword [ebp - 0x1c]
cmp ecx, edi
je 0x464087
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x4640ba
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push 0x4df260
push eax
call dword [ecx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4640d6
push dword [ebp + 8]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x18]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 0x10]
inc ebx
mov byte [ebp - 4], 7
test ecx, ecx
je 0x4640e7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 8
jmp 0x4640fa
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
test eax, eax
je 0x464104
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4