Function at 0x479a90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
mov eax, dword [ebx]
mov edx, dword [eax + 0x17c]
push esi
push edi
call edx
mov ecx, dword [ebp + 8]
mov esi, eax
lea eax, [ecx - 0xd]
xor edi, edi
cmp eax, 0x1b
ja case.0x479ac2.14
movzx eax, byte [eax + 0x479dac]
jmp dword [eax*4 + 0x479d90]
mov edi, dword [0x6b41bc]
mov ecx, ebx
mov dword [0x6b41bc], 0
call fcn.00479e30
mov esi, eax
test esi, esi
je 0x479b4c
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x479b02
test eax, eax
je 0x479b02
mov edx, dword [esi]
mov eax, dword [edx + 0xb8]
mov ecx, esi
call eax
test eax, eax
je 0x479b4c
mov edx, dword [esi]
mov eax, dword [edx + 0xa8]
push 0
mov ecx, esi
call eax
test eax, eax
je 0x479b4c
cmp dword [esi + 0x88], 0
je 0x479ba2
mov ecx, ebx
call fcn.00479e30
cmp eax, esi
jne 0x479ba2
mov ecx, dword [esi + 0x88]
push 0
push 0
push 0x24
call fcn.00479a90
mov dword [0x6b41bc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, ebx
call fcn.00479e10
mov esi, eax
test esi, esi
je 0x479b84
push 0x6a335c
mov ecx, esi
call fcn.00566997
test eax, eax
jne 0x479b84
mov edx, dword [esi]
mov eax, dword [edx + 0x1dc]
mov ecx, esi
call eax
mov dword [0x6b41bc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, ebx
call fcn.00479dd0
test eax, eax
je 0x479ba2
mov ecx, dword [eax + 0x20]
push 0
push 0x27
push 0x100
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
mov dword [0x6b41bc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, ebx
call fcn.00479e10
test eax, eax
je 0x479bd1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1d8]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0xec], edi
je 0x479d85
mov ecx, dword [ebx + 0xec]
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
test eax, eax
je 0x479d85
push 0
mov eax, ebx
call fcn.00479e50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x11
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jns 0x479c27
cmp dword [esi + 0x6f0], edi
jne 0x479c27
call fcn.0047a700
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
mov edi, 1
cmp dword [0x6b4174], 0
jne 0x479c45
mov edx, dword [esi]
mov eax, dword [edx + 0x22c]
push ecx
mov ecx, esi
call eax
test edi, edi
je 0x479d85
cmp dword [ebx + 0x87c], 0
je 0x479d85
mov eax, dword [esi + 0x5bc]
test eax, eax
jl 0x479d85
mov ecx, esi
call fcn.0045f850
mov edi, eax
test edi, edi
jne 0x479c89
mov edx, dword [esi]
mov eax, dword [edx + 0x188]
mov ecx, esi
call eax
test eax, eax
je 0x479d85
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.user32.dll_GetClientRect]
mov ecx, dword [edi + 0x34]
cmp ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x6e4]
mov dword [esp + 0xc], eax
jge 0x479d01
mov edx, dword [esi]
mov eax, dword [edx + 0x188]
mov ecx, esi
call eax
mov ecx, eax
mov eax, dword [edi + 0x34]
sub eax, dword [esp + 0x14]
cdq
idiv ecx
mov edi, eax
sub edi, 1
jmp 0x479d27
push 1
mov eax, ebx
call fcn.00479e50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi]
mov eax, dword [edx + 0x22c]
push ecx
mov ecx, esi
call eax
test eax, eax
jne 0x479d85
mov ecx, ebx
call fcn.00560640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [edi + 0x3c]
cmp edx, dword [esp + 0x1c]
jle 0x479d85
mov eax, dword [esi]
mov edx, dword [eax + 0x188]
mov ecx, esi
call edx
mov ecx, eax
mov eax, dword [edi + 0x3c]
sub eax, dword [esp + 0x1c]
cdq
idiv ecx
mov edi, eax
add edi, 1
test edi, edi
je 0x479d85
mov edx, dword [esi]
mov eax, dword [edx + 0x188]
mov ecx, esi
call eax
mov ecx, eax
mov eax, dword [ebx + 0x840]
cdq
idiv ecx
mov ecx, dword [esp + 0xc]
add ecx, edi
mov edi, dword [esi + 0x5d4]
sub eax, 2
sub edi, eax
xor eax, eax
add edi, 0xffffffff
test ecx, ecx
setl al
sub eax, 1
and eax, ecx
cmp eax, edi
jl 0x479d68
mov eax, edi
mov ecx, esi
call fcn.00478770
push 0
mov eax, ebx
call fcn.0047b5a0
test eax, eax
je 0x479d85
push 0
mov eax, ebx
call fcn.0047b5a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc