Function at 0x46b9c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x3a8], 0xffffffff
jne 0x46ba33
mov eax, edi
lea esp, [esp]
cmp byte [eax + 0x213], 0
mov eax, dword [eax + 0x244]
jne 0x46b9f5
test eax, eax
jne 0x46b9e0
jmp 0x46ba33
test eax, eax
je 0x46ba33
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x78]
call eax
cmp dword [0x59b534], 0
je 0x46ba14
mov edx, eax
call fcn.0042ef00
jmp 0x46ba16
xor eax, eax
push 0
push 0x5866e0
push 0x578908
push 0
push eax
call fcn.00511c29
add esp, 0x14
mov dword [edi + 0x3a8], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x54]
mov edx, dword [ebx + 0x58]
add eax, 0xffffffff
cmp eax, 0x16
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
ja case.0x46ba5a.2
movzx eax, byte [eax + 0x46c040]
jmp dword [eax*4 + 0x46c024]
lea esi, [esp + 0x20]
mov ecx, edi
call fcn.0046b810
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x28]
jge 0x46ba80
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x2c]
jl 0x46ba8e
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
fld dword [esp + 0x10]
fild dword [esp + 0x20]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x46baf1
fild dword [esp + 0x28]
fcompp
fnstsw ax
test ah, 0x41
jne 0x46baf3
fld dword [esp + 0x14]
fild dword [esp + 0x24]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x46baf1
fild dword [esp + 0x2c]
fcompp
fnstsw ax
test ah, 0x41
jne 0x46baf3
cmp byte [edi + 0x358], 0
je 0x46baed
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0x80
push eax
push ecx
mov ecx, edi
call fcn.0046b900
test al, al
je 0x46baf3
mov bl, 1
jmp 0x46baf5
fstp st(0)
xor bl, bl
cmp byte [edi + 0x366], 0
je 0x46bba0
test bl, bl
je 0x46bba0
cmp dword [edi + 0x3a8], 0
je 0x46bba0
mov eax, dword [edi + 0x3ac]
test eax, eax
lea esi, [edi + 0x3ac]
je 0x46bba0
add eax, 4
je 0x46bba0
cmp byte [0x59b495], 0
je 0x46bb66
mov eax, dword [0x587aa4]
test eax, eax
jne 0x46bb54
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
add eax, 1
mov dword [0x587aa4], eax
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, 0x8000
seta al
test al, al
jne 0x46bba0
cmp dword [edi + 0x3a8], 0
je 0x46bbc3
mov eax, dword [esi]
test eax, eax
je 0x46bbc3
add eax, 4
je 0x46bbc3
mov edx, dword [edi]
mov edx, dword [edx + 0x30]
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call edx
mov ecx, dword [edi + 0x3a8]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
lea edx, [esp + 0x10]
push edx
push esi
push edi
call eax
jmp 0x46bbc3
mov ecx, dword [edi + 0x3a8]
test ecx, ecx
je 0x46bbc3
mov eax, dword [edi + 0x3ac]
test eax, eax
je 0x46bbc3
add eax, 4
je 0x46bbc3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
push edi
call eax
test bl, bl
je 0x46bc1d
mov ecx, edi
call fcn.0046b890
mov eax, dword [edi + 0x354]
test eax, eax
je 0x46bbef
cmp eax, 1
jne 0x46bbf6
cmp byte [edi + 0x359], 0
je 0x46bbf6
cmp byte [edi + 0x35a], 0
je 0x46bbf6
mov esi, edi
call fcn.0046b770
cmp dword [edi + 0x354], 2
jne 0x46bc46
push 1
mov esi, edi
call fcn.0046b620
mov eax, dword [edi + 8]
neg eax
sbb eax, eax
add eax, 0xf4241
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edi + 0x354], 1
mov byte [edi + 0x366], 1
jne 0x46bc34
mov esi, edi
call fcn.0046b6e0
cmp dword [edi + 0x354], 3
jne 0x46bc46
push 1
mov ecx, edi
call fcn.0046b520
mov eax, dword [edi + 8]
neg eax
sbb eax, eax
add eax, 0xf4241
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea esi, [esp + 0x20]
mov ecx, edi
call fcn.0046b810
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x28]
jge 0x46ba80
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x2c]
jge 0x46ba80
fld dword [esp + 0x10]
fild dword [esp + 0x20]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x46be27
fild dword [esp + 0x28]
fcompp
fnstsw ax
test ah, 0x41
jne case.0x46ba5a.2
fld dword [esp + 0x14]
fild dword [esp + 0x24]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x46be27
fild dword [esp + 0x2c]
fcompp
fnstsw ax
test ah, 0x41
jne case.0x46ba5a.2
cmp byte [edi + 0x358], 0
je 0x46bcf5
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0x80
push eax
push ecx
mov ecx, edi
call fcn.0046b900
test al, al
je case.0x46ba5a.2
cmp byte [ebx + 0x6c], 0
jne case.0x46ba5a.2
mov ecx, dword [edi + 0x3a8]
test ecx, ecx
je 0x46bd29
mov eax, dword [edi + 0x3ac]
test eax, eax
je 0x46bd29
add eax, 4
je 0x46bd29
mov byte [edi + 0x366], 0
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
push edi
call eax
mov ecx, edi
call fcn.0046b890
cmp byte [edi + 0x359], 0
je 0x46bd68
cmp byte [edi + 0x35a], 0
je 0x46bd68
push 0
push 0x58616c
push 0x578908
push 0
mov eax, edi
call fcn.0042d5d0
push eax
call fcn.00511c29
add esp, 0x14
test eax, eax
jne case.0x46ba5a.2
cmp byte [edi + 0x35c], 0
je 0x46bddc
mov eax, edi
call fcn.00451e90
test eax, eax
je 0x46bd8a
mov eax, edi
call fcn.00451e90
mov esi, eax
call fcn.004487a0
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push 1
push 1
mov ecx, edi
call eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
cmp byte [edi + 0x35a], 0
je 0x46bdce
cmp byte [edi + 0x359], 0
mov esi, edi
je 0x46bdc9
push 0
call fcn.0046b620
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0046b770
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 1
mov esi, edi
call fcn.0046b620
cmp byte [edi + 0x364], 0
je 0x46be11
push 0x28
call fcn.00511d1c
add esp, 4
test eax, eax
je 0x46be06
push edi
mov esi, eax
call fcn.0046cdf0
jmp 0x46be08
xor eax, eax
push eax
call fcn.00428ba0
add esp, 4
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
fstp st(0)
mov eax, 0xf4241
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea esi, [esp + 0x20]
mov ecx, edi
call fcn.0046b810
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x28]
jge 0x46ba80
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x2c]
jge 0x46ba80
fld dword [esp + 0x10]
fild dword [esp + 0x20]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x46bee3
fild dword [esp + 0x28]
fcompp
fnstsw ax
test ah, 0x41
jne 0x46bee5
fld dword [esp + 0x14]
fild dword [esp + 0x24]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x46bee3
fild dword [esp + 0x2c]
fcompp
fnstsw ax
test ah, 0x41
jne 0x46bee5
cmp byte [edi + 0x358], 0
je 0x46bebd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0x80
push eax
push ecx
mov ecx, edi
call fcn.0046b900
test al, al
je 0x46bee5
mov ecx, edi
call fcn.0046b890
cmp byte [edi + 0x35c], 0
jne 0x46bee5
mov edx, dword [edi]
mov eax, dword [edx + 0x78]
push 1
push 1
mov ecx, edi
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
fstp st(0)
push 1
mov ecx, edi
call fcn.0046b520
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ecx
push ebx
push edx
mov ecx, edi
call fcn.00456620
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test byte [ebx + 0x64], 1
jne case.0x46ba5a.2
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
push ebx
push ecx
mov ecx, edi
call fcn.00456620
cmp eax, 0xf4240
je 0x46bdce
mov al, byte [ebx + 0x64]
test al, 0x10
jne 0x46bf58
test al, 0xe
jne case.0x46ba5a.2
mov edx, dword [ebx + 0x10]
cmp edx, dword [edi + 0x384]
jne case.0x46ba5a.2
mov ebx, dword [ebx + 0x10]
cmp ebx, 0x1b
jne 0x46bf6d
cmp dword [edi + 0x384], ebx
jne 0x46bf6d
lea eax, [ebx - 0x1a]
jmp 0x46bf6f
xor eax, eax
cmp byte [edi + 0x35a], 0
je 0x46bf8f
test eax, eax
jne 0x46bfa1
cmp ebx, 0x20
je 0x46bfa1
mov eax, 0xf4241
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x46bfa1
cmp ebx, 0xd
je 0x46bfa1
cmp ebx, 0x20
jne case.0x46ba5a.2
push 1
mov esi, edi
call fcn.0046b620
mov eax, edi
mov dword [edi + 0x368], 0x100
call fcn.00451e90
test eax, eax
je 0x46bfed
fldz
or ecx, 0xffffffff
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
or edx, ecx
mov dword [eax + 4], edx
or esi, ecx
mov dword [eax + 8], esi
push ecx
or ebx, ecx
mov dword [eax + 0xc], ebx
fstp dword [esp]
push 1
mov eax, edi
call fcn.00451e90
push eax
call fcn.00446010
mov eax, dword [edi]
mov edx, dword [eax + 0x78]
push 1
push 0
mov ecx, edi
call edx
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
push ebx
push ecx
mov ecx, edi
call fcn.00456620
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc