Function at 0x46d7d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov al, 5
mov byte [esi + 0x3a8], al
mov byte [esi + 0x3c0], al
mov eax, dword [esi]
xor ebx, ebx
push edi
mov dword [esi + 0x3c8], ebx
call dword [eax + 0xc]
movzx ebp, byte [esi + 0x3a8]
movzx ecx, byte [esi + 0x3c0]
mov dword [esi + 4], ebx
mov edx, dword [0x6f3560]
shl ecx, 4
push pe_nt_image_headers32
sub edx, ecx
add ebp, 2
push 0x200
shl ebp, 4
sub edx, ebp
push str.chat.tga
sub edx, 0x9c
push str.data_interface
lea ecx, [esi + 0x28]
mov dword [esi + 8], edx
mov dword [esi + 0xc], 0x200
mov dword [esi + 0x10], 0x80
call fcn.00538940
push 0x10
push 0x10
push str.chat_check.tga
push str.data_interface
lea ecx, [esi + 0x68]
call fcn.00538940
push 0x40
push 0x80
push str.chat_icon.tga
push str.data_interface
lea ecx, [esi + 0x38]
call fcn.00538940
push 0x3f000000
push 0x3ec00000
push 0x3e000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3e000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3e000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3e000000
push ebx
push 0x3e000000
push ebx
push 0x3e000000
push ebx
push 1
push pe_nt_image_headers32
push 0x200
push str.chat.tga
push ebx
push 0x16
mov dword [0x84efa8], ebx
push 0x40
mov ecx, 0x41
xor eax, eax
lea edi, [esi + 0x84]
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
push 0x20
rep stosd dword es:[edi], eax
mov dword [esi + 0x188], ebx
push 0x40
push 0xf
push ebx
push 0xf
push ebx
lea ecx, [esi + 0x31f4]
call fcn.00517f80
push 0x3f300000
push 0x3f200000
push 0x3e000000
push 0x3dc00000
push 0x3f300000
push 0x3f200000
push 0x3dc00000
push 0x3d800000
push 0x3f300000
push 0x3f200000
push 0x3dc00000
push 0x3d800000
push 0x3f300000
push 0x3f200000
push 0x3d800000
push 0x3d000000
push 0x3f300000
push 0x3f200000
push 0x3d000000
push ebx
push 1
push pe_nt_image_headers32
push 0x200
push str.chat.tga
push ebx
push 0x10
push 0x10
push 0x10
push 0x10
push 0xf
push ebx
push 0xf
push ebx
lea ecx, [esi + 0x36c8]
call fcn.00517f80
lea ecx, [esi + 0x3b9c]
mov byte [esi + 0x3ba8], bl
mov dword [esi + 0x3bb4], ebx
mov byte [esi + 0x3ba9], bl
mov dword [esi + 0x3bb8], 0xffffffff
mov byte [esi + 0x3baa], bl
mov byte [esi + 0x3bab], bl
mov byte [esi + 0x3bac], bl
call fcn.004c5530
push ebx
push 0x40800000
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3ec00000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3ec00000
push 0x3f800000
push 0x3f000000
xor eax, eax
push 0x3ec00000
mov ecx, 0x41
lea edi, [esi + 0x18c]
rep stosd dword es:[edi], eax
push 0x3e800000
mov ecx, 0x41
lea edi, [esi + 0x290]
rep stosd dword es:[edi], eax
movzx eax, byte [esi + 0x3a8]
push 0x3f800000
mov dword [esi + 0x3c4], ebx
lea edi, [esi + 0x4d0]
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
mov ecx, eax
shl ecx, 4
sub ecx, 6
push ecx
mov edx, dword [esi + 8]
mov dword [esp + 0xbc], ecx
fild dword [esp + 0xbc]
add eax, 2
shl eax, 4
mov ecx, edi
fstp dword [esp]
push 0x41500000
push 0x41980000
push ebx
push 1
push 0x13
push 0xd
push 0x20
push 0x10
push eax
mov eax, dword [esi + 4]
push 0x10
push 4
push 4
push edx
push eax
call fcn.0051b9e0
push 0xc
mov ecx, edi
call fcn.0051a400
movzx ecx, byte [esi + 0x3a8]
mov edx, dword [0x7034d8]
add ecx, 2
mov dword [esp + 0x10], ecx
sub esp, 8
mov ecx, edi
fild dword [esp + 0x18]
fstp dword [esp + 4]
fild dword [edx + 0x18]
fstp dword [esp]
call fcn.0051a440
push ebx
movzx eax, byte [esi + 0x3a8]
push 0x40800000
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3ec00000
push 0x3f000000
push ebx
push 0x3f000000
mov dword [esi + 0x2370], eax
movzx eax, byte [esi + 0x3c0]
lea edi, [esi + 0x1420]
push 0x3ec00000
push 0x3f800000
push 0x3f000000
push 0x3ec00000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
mov ecx, eax
shl ecx, 4
sub ecx, 6
push ecx
mov edx, dword [esi + 8]
mov dword [esp + 0xbc], ecx
fild dword [esp + 0xbc]
add eax, 2
shl eax, 4
add ebp, 0xc
fstp dword [esp]
push 0x41500000
push 0x41980000
push ebx
push 1
push 0x13
push 0xd
push 0x20
push 0x10
push eax
mov eax, dword [esi + 4]
push 0x10
push ebp
push 4
push edx
push eax
mov ecx, edi
call fcn.0051b9e0
push 0xc
mov ecx, edi
call fcn.0051a400
movzx ecx, byte [esi + 0x3c0]
mov edx, dword [0x7034d8]
add ecx, 4
mov dword [esp + 0x10], ecx
sub esp, 8
mov ecx, edi
fild dword [esp + 0x18]
fstp dword [esp + 4]
fild dword [edx + 0x1c]
fstp dword [esp]
call fcn.0051a440
movzx eax, byte [esi + 0x3c0]
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 0x3f000000
mov dword [esi + 0x2374], eax
push ebx
push 0x3e800000
push ebx
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push ebx
push 0x40
push 0x80
push str.chat_icon.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push ebx
push ebx
push ebx
push ebx
lea ecx, [esi + 0x2378]
call fcn.00517f80
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push ebx
push 0x40
push 0x80
push str.chat_icon.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push ebx
push ebx
push ebx
push ebx
lea ecx, [esi + 0x284c]
call fcn.00517f80
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
push ebx
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push ebx
push ebx
push ebx
push ebx
lea ecx, [esi + 0x2d20]
call fcn.00517f80
mov edi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0xd
call edi
push 0x20
call edi
pop edi
mov dword [esi + 0x3bb0], ebx
mov dword [esi + 0x3bbc], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret