Function at 0x4773e8
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
cmp word [rdx + 0x18], 9
mov r14, r8
mov r13, rdx
mov rdi, rcx
jne 0x477431
mov rax, qword [rcx + 0xa8]
cmp qword [rdx], rax
jne 0x477431
mov rcx, qword [rcx + 0x58]
mov rax, qword [rcx]
call qword [rax]
xor al, al
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
mov r12w, ax
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa3
mov si, ax
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, InitCommonControls
mov r15w, ax
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
mov bp, ax
mov qword [r14], rbx
movzx edx, word [r13 + 0x18]
shr ebp, 0xf
and bpl, 1
cmp dx, 0x30
jb 0x4774cb
cmp dx, 0x39
ja 0x4774cb
cmp r15b, bl
jne 0x4774a9
cmp r12b, bl
je 0x4774cb
movzx edx, dx
mov rcx, rdi
sub edx, 0x30
cmp bpl, bl
je 0x4774c1
call fcn.0046ac18
jmp 0x4778ad
call fcn.0046be9c
jmp 0x4778ad
cmp dx, 0x71
je 0x4774d7
cmp dx, 0x70
jne 0x4774fe
cmp r12b, bl
je 0x4774fe
cmp sil, bl
jne 0x4774fe
cmp bpl, bl
jne 0x4774fe
mov rcx, qword [rdi + 0x58]
cmp dx, 0x70
mov rax, qword [rcx]
setne bl
mov edx, ebx
call qword [rax + VariantCopy]
jmp 0x4778ad
cmp dx, 0x78
jne 0x47751f
cmp r12b, bl
jne 0x47751f
cmp sil, bl
jne 0x47751f
cmp bpl, bl
jne 0x47751f
lea rcx, [0x004cf7d0]
call fcn.0044b114
movzx ecx, word [r13 + 0x18]
mov r14d, 8
cmp cx, 0x72
lea r15, [r14 - 9]
jb 0x477570
cmp cx, 0x7b
ja 0x477570
cmp sil, bl
je 0x477570
lea r8, [0x004a35c0]
mov eax, ebx
mov rdx, r8
cmp word [rdx], cx
je 0x47755d
inc eax
add rdx, r14
cmp eax, 5
jb 0x47754b
mov eax, r15d
cmp eax, ebx
jl 0x477570
cdqe
mov rcx, rdi
mov edx, dword [r8 + rax*8 + 4]
call fcn.0047ed28
movzx ecx, word [r13 + 0x18]
cmp ecx, 0x56
jg 0x477763
je 0x47774d
cmp ecx, 0x2d
jg 0x477696
je 0x477652
sub ecx, r14d
je 0x477645
sub ecx, r14d
je 0x477619
sub ecx, 0x12
je 0x4775f9
sub ecx, 3
je 0x4775e5
dec ecx
je 0x4775d1
dec ecx
je 0x4775e5
dec ecx
jne 0x47741e
cmp bpl, bl
je 0x47741e
mov rcx, rdi
call fcn.0047dd38
jmp 0x47741e
cmp r12b, bl
je 0x4775bb
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp 0x47741e
cmp r12b, bl
je 0x4775bb
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x47741e
cmp sil, bl
je 0x47741e
cmp r12b, bl
jne 0x47741e
cmp bpl, bl
jne 0x47741e
jmp 0x4778ad
mov rcx, qword [rdi + 0xa8]
mov r9d, 1
mov r8, r15
mov edx, 0x100c
mov byte [rdi + 0x22c], bl
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi + 0x230], eax
jmp 0x47741e
mov rcx, rdi
call fcn.0046c970
jmp 0x4778ad
cmp r12b, bl
jne 0x47741e
cmp sil, bl
je 0x47766a
cmp bpl, bl
jne 0x47766f
jmp 0x4776fc
cmp bpl, bl
je 0x47767d
cmp sil, bl
jne 0x47741e
jmp 0x477756
cmp byte [rdi + 0xdb], bl
je 0x47741e
mov rcx, rdi
call fcn.0047de40
jmp 0x4778ad
cmp ecx, 0x2e
je 0x47773a
cmp ecx, 0x30
jle 0x47741e
cmp ecx, 0x34
jle 0x477721
cmp ecx, 0x41
je 0x477709
cmp ecx, 0x43
je 0x4776f3
cmp ecx, 0x4e
je 0x4776dd
cmp ecx, 0x52
jne 0x47741e
cmp sil, bl
je 0x47741e
xor edx, edx
mov rcx, rdi
call fcn.004772cc
jmp 0x4778ad
cmp sil, bl
je 0x47741e
mov rcx, rdi
call fcn.0047d6b4
jmp 0x4778ad
cmp sil, bl
je 0x47741e
mov rcx, rdi
call fcn.00478b68
jmp 0x4778ad
cmp sil, bl
je 0x47741e
mov dl, 1
mov rcx, rdi
call fcn.0047e368
jmp 0x4778ad
cmp sil, bl
je 0x47741e
lea edx, [rcx - 0x31]
mov rcx, rdi
call fcn.00461648
jmp 0x4778ad
cmp bpl, bl
mov rcx, rdi
sete dl
call fcn.0047c2d8
jmp 0x4778ad
cmp sil, bl
je 0x47741e
mov rcx, rdi
call fcn.004633a8
jmp 0x4778ad
cmp ecx, 0x71
jg 0x477864
je 0x47783f
sub ecx, 0x57
je 0x47781c
dec ecx
je 0x477806
sub ecx, 2
je 0x4777f0
sub ecx, 0x10
je 0x4777e3
dec ecx
je 0x4777ae
cmp ecx, 2
jne 0x47741e
xor edx, edx
cmp r12b, bl
mov rcx, rdi
jne 0x4777b8
cmp bpl, bl
je 0x4777d9
jmp 0x477717
cmp r12b, bl
je 0x4777c2
mov dl, 1
mov rcx, rdi
call fcn.0047e0bc
jmp 0x4778ad
cmp bpl, bl
jne 0x477712
cmp sil, bl
jne 0x4778ad
mov dl, 1
mov rcx, rdi
call fcn.0047e55c
jmp 0x4778ad
mov rcx, rdi
call fcn.0047e390
jmp 0x4778ad
cmp sil, bl
je 0x47741e
mov rcx, rdi
call fcn.0047bb30
jmp 0x4778ad
cmp sil, bl
je 0x47741e
mov rcx, rdi
call fcn.004633a8
jmp 0x4778ad
cmp sil, bl
je 0x47741e
mov rcx, qword [0x004cf788]
xor r9d, r9d
mov r8, r14
mov edx, 0x111
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4778ad
cmp r12b, bl
jne 0x47741e
cmp sil, bl
jne 0x47741e
cmp bpl, bl
jne 0x47741e
mov rcx, rdi
call fcn.0047b898
jmp 0x4778ad
sub ecx, 0x72
je 0x477934
dec ecx
je 0x477912
dec ecx
je 0x4778ef
dec ecx
je 0x4778d9
dec ecx
je 0x4778b4
cmp ecx, 5
jne 0x47741e
cmp r12b, bl
je 0x47741e
cmp sil, bl
jne 0x47741e
cmp bpl, bl
jne 0x47741e
mov rcx, rdi
call fcn.0046c7b8
mov al, 1
jmp 0x477420
cmp r12b, bl
jne 0x47741e
cmp sil, bl
jne 0x47741e
cmp bpl, bl
jne 0x47741e
mov rcx, rdi
call fcn.0047d0b8
jmp 0x4778ad
cmp r12b, bl
jne 0x47741e
cmp sil, bl
jne 0x47741e
mov dl, 1
jmp 0x477903
cmp r12b, bl
jne 0x47741e
cmp sil, bl
jne 0x47741e
xor edx, edx
mov rcx, qword [rdi + 0x58]
mov r8b, bpl
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x4778ad
cmp r12b, bl
jne 0x47741e
cmp sil, bl
jne 0x47741e
cmp bpl, bl
mov rcx, rdi
jne 0x4776e9
mov dl, 1
jmp 0x477954
cmp r12b, bl
jne 0x47741e
cmp sil, bl
jne 0x47741e
cmp bpl, bl
jne 0x47741e
xor edx, edx
mov rcx, rdi
call fcn.00474d10
jmp 0x4778ad