Function at 0x46fed0
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x493905
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x4d4028]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
push 0xffffffffffffffff
xor edi, edi
lea ecx, [esi + 0x38]
push edi
mov dword [esp + 0x28], eax
call fcn.00490270
cmp dword [esi + 0x5c], edi
je 0x47017b
cmp dword [esi + 0x60], edi
je 0x47017b
mov ecx, dword [esp + 0x20]
or dword [esp + 0x5c], 0xffffffff
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x30]
xor ebx, ebx
push eax
inc ebx
push 0xf
mov word [esp + 0x5c], 0xf
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x6c], ebx
call fcn.0049094e
test eax, eax
je 0x4700cd
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
mov dword [esp + 0x28], eax
je 0x4700c2
lea ecx, [esp + 0x14]
call dword [0x4a2ef4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x280], edi
call dword [0x4a2ef4]
push edi
push edi
push 0xffffffffffffffff
push dword [esp + 0x34]
mov byte [esp + 0x290], bl
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
cmp eax, edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], edi
jbe 0x47009c
push 0x104
lea eax, [esp + 0x68]
push eax
push dword [esp + 0x20]
push dword [esp + 0x34]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x18]
call dword [0x4a2d8c]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x38]
call fcn.0046c850
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x284], 2
call dword [0x4a2ea0]
lea ecx, [esp + 0x38]
mov byte [esp + 0x280], bl
call dword [0x4a2ee8]
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], edi
je 0x470036
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
call dword [0x4a2ea0]
mov eax, dword [esp + 0x14]
call fcn.00417d00
test eax, eax
jne 0x47006c
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
test bl, al
je 0x470091
mov eax, dword [esi + 0x68]
cmp eax, edi
je 0x47006c
push dword [esp + 0x14]
push dword [esi + 0x6c]
call eax
test al, al
pop ecx
pop ecx
je 0x47007d
lea edx, [esp + 0x14]
lea ecx, [esi + 0x38]
mov eax, dword [ecx + 8]
push edx
push eax
call fcn.00490240
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x24]
jb 0x46ffc6
jmp 0x47009c
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x38]
call fcn.00490270
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [esp + 0x1c]
call dword [0x4a2ee8]
or dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x14]
call dword [0x4a2ee8]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
cmp word [esi + 0x70], di
jne 0x4700ee
push str.EMFFileDragDropExtraData
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
cmp ax, di
mov word [esi + 0x70], ax
jne 0x4700ee
xor eax, eax
jmp 0x4701b7
push dword [esi + 0x4c]
mov dword [esi + 0x50], edi
call fcn.004903a8
movzx eax, word [esi + 0x70]
or dword [esp + 0x4c], 0xffffffff
pop ecx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov dword [esi + 0x4c], edi
mov word [esp + 0x48], ax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], ebx
call fcn.0049094e
test eax, eax
je 0x47017b
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
mov dword [esp + 0x24], eax
je 0x470170
mov ebx, dword [eax]
push ebx
mov dword [esi + 0x50], ebx
call fcn.004903b4
cmp ebx, edi
pop ecx
mov dword [esi + 0x4c], eax
je 0x470166
mov ecx, dword [esp + 0x24]
push ebx
add ecx, 4
push ecx
push eax
call fcn.004922d4
add esp, 0xc
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
xor ebx, ebx
cmp dword [esi + 0x40], edi
je 0x470191
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setge bl
inc ebx
cmp dword [esi + 0x64], edi
je 0x4701b5
mov ecx, dword [esp + 0x20]
push edi
call fcn.00490936
mov ecx, dword [esi + 0x64]
mov edx, dword [ecx]
push ebx
lea edi, [ebp + 0x14]
push edi
push eax
mov eax, dword [esi + 0x58]
push dword [eax + 0x20]
push ecx
call dword [edx + 0xc]
mov eax, ebx
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.00490f79
mov esp, ebp
pop ebp
ret 0x14