Function at 0x475e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x475e48
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov edi, 0x5055a4
xor eax, eax
push ebp
push 0x4763b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x50559c
call fcn.00404b74
mov dword [ebp - 4], ebx
mov byte [ebp - 9], 0
mov bl, 0x20
mov byte [ebp - 0xa], 0x20
call fcn.00475b98
push ebp
call fcn.00475cc4
pop ecx
cmp dword [ebp - 4], 0
jne 0x475ead
call fcn.00471f04
mov ebx, eax
mov byte [ebp - 0xa], 0x20
call fcn.0046a418
test bl, bl
jne 0x475ead
call fcn.00471f04
mov byte [ebp - 0xa], al
mov edx, dword [0x5055b0]
add edx, dword [ebp - 4]
sub edx, dword [0x5055b4]
mov eax, dword [0x5055ac]
call fcn.00472004
cmp dword [ebp - 4], 1
jl 0x475efc
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jg 0x475efc
mov al, 0xf
call fcn.00472104
mov eax, dword [0x5055b8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
mov edx, dword [eax + 8]
mov eax, dword [0x4826f8]
call fcn.00405240
call fcn.00402ef8
call fcn.004028d8
xor eax, eax
mov al, bl
cmp eax, 0x11
jg 0x475f16
je 0x475f27
sub eax, 1
jb 0x475f7d
sub eax, 0xc
je 0x475f61
jmp 0x476046
sub eax, 0x1b
je 0x475f61
sub eax, 0xc4
je 0x475f6f
jmp 0x476046
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004090a8
push dword [ebp - 0x14]
push 0x4763cc
lea edx, [ebp - 0x18]
mov eax, dword [edi]
call fcn.004090a8
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404eec
mov eax, dword [ebp - 0x10]
call fcn.0046a9b4
jmp 0x476157
mov byte [ebp - 9], 1
jmp 0x476157
call sub.user32.dll_WaitMessage
call fcn.00471eec
test al, al
je 0x475f6a
jmp 0x476157
xor eax, eax
mov al, byte [ebp - 0xa]
cmp eax, 0x50
jg 0x475fbb
je 0x476016
cmp eax, 0x48
jg 0x475fa8
je 0x47600e
sub eax, 9
je 0x476016
sub eax, 0x39
je 0x475fe0
sub eax, 5
je 0x47601e
jmp 0x476157
sub eax, 0x49
je 0x476034
sub eax, 6
je 0x47602a
jmp 0x476157
cmp eax, 0x66
jg 0x475fd1
je 0x475ff4
sub eax, 0x51
je 0x47603d
sub eax, 0x14
je 0x475fea
jmp 0x476157
sub eax, 0x76
je 0x47602a
sub eax, 0xe
je 0x47601e
jmp 0x476157
call fcn.0046d748
jmp 0x476157
call fcn.0046d774
jmp 0x476157
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x476157
call fcn.00468aec
jmp 0x476157
dec dword [ebp - 4]
jmp 0x476157
inc dword [ebp - 4]
jmp 0x476157
mov dword [ebp - 4], 1
jmp 0x476157
mov eax, dword [edi]
mov dword [ebp - 4], eax
jmp 0x476157
sub dword [ebp - 4], 0xa
jmp 0x476157
add dword [ebp - 4], 0xa
jmp 0x476157
mov eax, ebx
call fcn.00402b10
dec eax
sub al, 0x1a
jb 0x47606c
add al, 0xf1
sub al, 2
jb 0x47606c
sub al, 1
je 0x47606c
add al, 0xfe
sub al, 0xb
jb 0x47606c
add al, 0xf9
sub al, 0x1a
jae 0x476157
mov esi, dword [ebp - 4]
inc esi
cmp esi, dword [edi]
jle 0x476091
mov esi, 1
call fcn.0046a57c
jmp 0x476091
cmp esi, dword [edi]
jl 0x476090
mov esi, 1
call fcn.0046a57c
jmp 0x476091
inc esi
cmp esi, dword [ebp - 4]
je 0x4760f5
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x5055b8]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 8]
lea edx, [ebp - 0x28]
call fcn.00408fc0
mov eax, dword [ebp - 0x28]
mov ecx, 1
mov edx, 1
call fcn.00405084
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0046af84
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408d70
mov eax, dword [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.00402b10
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404d54
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00404f70
jne 0x476080
lea eax, [ebp - 0x38]
push eax
mov eax, dword [0x5055b8]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 8]
lea edx, [ebp - 0x3c]
call fcn.00408fc0
mov eax, dword [ebp - 0x3c]
mov ecx, 1
mov edx, 1
call fcn.00405084
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0046af84
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00408d70
mov eax, dword [ebp - 0x30]
push eax
mov eax, ebx
call fcn.00402b10
mov edx, eax
lea eax, [ebp - 0x40]
call fcn.00404d54
mov edx, dword [ebp - 0x40]
pop eax
call fcn.00404f70
jne 0x476157
mov dword [ebp - 4], esi
cmp dword [edi], 0
je 0x476162
cmp dword [ebp - 4], 0
jg 0x476170
mov dword [ebp - 4], 1
call fcn.0046a5d8
jmp 0x476181
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jle 0x476181
mov eax, dword [edi]
mov dword [ebp - 4], eax
call fcn.0046a5d8
cmp dword [edi], 0
je 0x4762a6
cmp bl, 0x1b
je 0x4762a6
cmp bl, 0xd
je 0x4762a6
mov eax, dword [0x5055b8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
mov esi, eax
push ebp
call fcn.00475cc4
pop ecx
mov edx, dword [0x5055b0]
add edx, dword [ebp - 4]
sub edx, dword [0x5055b4]
mov eax, dword [0x5055ac]
call fcn.00472004
mov al, 0xe
call fcn.00472104
mov eax, dword [0x4826f8]
mov edx, dword [esi + 8]
call fcn.00405240
call fcn.00402ef8
call fcn.004028d8
mov edx, dword [0x5055b0]
add edx, dword [ebp - 4]
sub edx, dword [0x5055b4]
mov eax, dword [0x5055ac]
call fcn.00472004
xor edx, edx
mov eax, dword [esi + 8]
call fcn.00454e94
cmp byte [ebp - 0xa], 0x4d
jne 0x47621d
mov eax, dword [esi + 8]
call fcn.0046a680
jmp 0x4762a6
mov eax, dword [esi + 4]
call fcn.0046a4a8
test al, al
je 0x476233
mov eax, dword [esi + 4]
call fcn.0046a374
jmp 0x4762a6
mov eax, dword [esi + 4]
call fcn.00404e2c
dec eax
jle 0x47629e
mov eax, dword [esi + 4]
cmp byte [eax + 1], 0x7c
jne 0x47629e
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x63
mov edx, 3
mov eax, dword [esi + 4]
call fcn.00405084
mov eax, dword [ebp - 0x44]
call fcn.0046a4a8
test al, al
je 0x47629e
lea eax, [ebp - 0x48]
mov edx, dword [esi + 4]
mov dl, byte [edx]
call fcn.00404d54
mov eax, dword [ebp - 0x48]
call fcn.0046a680
lea eax, [ebp - 0x4c]
push eax
mov ecx, 0x63
mov edx, 3
mov eax, dword [esi + 4]
call fcn.00405084
mov eax, dword [ebp - 0x4c]
call fcn.0046a374
jmp 0x4762a6
mov eax, dword [esi + 8]
call fcn.0046a9b4
cmp byte [ebp - 9], 0
je 0x475e91
cmp dword [ebp - 4], 1
jl 0x4762c2
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jg 0x4762c2
cmp bl, 0x1b
jne 0x4762d3
xor eax, eax
mov dword [ebp - 8], eax
mov eax, 0x50559c
call fcn.00404b74
jmp 0x476342
mov edx, dword [0x5055b0]
add edx, dword [ebp - 4]
sub edx, dword [0x5055b4]
mov eax, dword [0x5055ac]
call fcn.00472004
mov al, 0xe
call fcn.00472104
mov eax, dword [0x5055b8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
mov edx, dword [eax + 8]
mov eax, dword [0x4826f8]
call fcn.00405240
call fcn.00402ef8
call fcn.004028d8
mov al, 0xf
call fcn.00472104
mov eax, dword [0x5055b8]
mov edx, dword [ebp - 4]
mov ebx, dword [eax + edx*4]
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov eax, 0x50559c
mov edx, dword [0x5055b8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 8]
call fcn.00404bc8
mov eax, dword [0x48295c]
mov eax, dword [eax + 4]
mov edx, dword [0x5055b0]
add edx, dword [edi]
cmp eax, edx
jge 0x47636a
mov edx, dword [0x48295c]
mov edx, eax
mov eax, 1
call fcn.00472004
jmp 0x476374
mov eax, 1
call fcn.00472004
mov ebx, dword [edi]
test ebx, ebx
jle 0x476396
mov esi, 1
mov eax, dword [0x5055b8]
mov eax, dword [eax + esi*4]
mov edx, dword [0x4759d0]
call fcn.004059a4
inc esi
dec ebx
jne 0x47637f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4763b8
lea eax, [ebp - 0x4c]
mov edx, 0x10
call fcn.00404b98
ret