Function at 0x47c370
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e738
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x58d984]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edi, dword [ebp + 8]
mov eax, dword [eax + 0x34]
call eax
test al, al
jne 0x47c3b7
mov eax, dword [edi]
cmp eax, 8
jbe 0x47c3b7
cmp eax, 0x14
jb 0x47c3c4
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x2c]
call eax
test al, al
jne 0x47c3e5
mov ecx, dword [esi + 0x294]
push edi
test ecx, ecx
je 0x47c3d9
mov eax, dword [ecx]
call dword [eax + 0x74]
jmp 0x47c846
mov ecx, esi
call fcn.00476b30
jmp 0x47c846
mov ecx, dword [edi]
cmp ecx, 0x24
jne 0x47c3fa
push edi
lea ecx, [esi - 4]
call fcn.0047d2e0
jmp 0x47c846
cmp ecx, 5
jne 0x47c470
push 9
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x47c434
cmp byte [esi + 0x361], 0
jne 0x47c434
mov ecx, dword [esi + 0x2b0]
test ecx, ecx
je 0x47c846
push 0
push 0
push 0x2a
push esi
call fcn.0044d4b0
jmp 0x47c846
cmp byte [esi + 0x368], 0
je 0x47c452
mov eax, dword [edi + 0x18]
cmp eax, 0x30
jb 0x47c846
cmp eax, 0x39
ja 0x47c846
mov eax, dword [esi - 4]
lea ecx, [esi - 4]
push 0
push dword [edi + 0x1c]
push dword [edi + 0x18]
push 0x102
call dword [eax + 0x1c8]
jmp 0x47c846
cmp ecx, 3
jne 0x47c483
push edi
lea ecx, [esi - 4]
call fcn.0047ce40
jmp 0x47c846
cmp ecx, 9
jne 0x47c493
push edi
push 0x200
jmp 0x47c83e
cmp ecx, 0x13
jne 0x47c4b6
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x47c846
push edi
mov ecx, esi
call fcn.00496ef0
jmp 0x47c846
cmp ecx, 0xd
je 0x47c7a1
cmp ecx, 0x1b
je 0x47c7a1
cmp ecx, 0xe
je 0x47c74b
cmp ecx, 0x1d
je 0x47c74b
cmp ecx, 0xfffffc18
jne 0x47c503
cmp byte [esi + 0x365], 0
lea ecx, [esi - 4]
je 0x47c4f8
call fcn.0047eea0
jmp 0x47c846
push edi
push 0x203
jmp 0x47c841
cmp ecx, 0xf
jne 0x47c513
push edi
push 0x204
jmp 0x47c83e
cmp ecx, 0x10
jne 0x47c523
push edi
push 0x205
jmp 0x47c83e
cmp ecx, 0x21
jne 0x47c5af
mov ecx, esi
call fcn.00476860
mov ecx, eax
call fcn.0044b430
mov edi, eax
test edi, edi
je 0x47c846
push edi
call sub.IMM32.dll_ImmGetContext
mov ebx, eax
test ebx, ebx
je 0x47c846
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00476450
mov ecx, dword [esi + 0x374]
mov eax, dword [esi + 0x378]
sub ecx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 2
cmp ecx, 1
jge 0x47c582
mov ecx, 1
cmp eax, 1
jge 0x47c58c
mov eax, 1
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov dword [ebp - 0x28], ecx
call sub.IMM32.dll_ImmSetCompositionWindow
push ebx
push edi
call sub.IMM32.dll_ImmReleaseContext
mov byte [esi + 0x370], 1
jmp 0x47c846
cmp ecx, 0x22
jne 0x47c5c0
mov byte [esi + 0x370], 0
jmp 0x47c846
cmp ecx, 0xfffffc1a
jne 0x47c61a
mov edi, dword [esi + 0x35c]
test edi, edi
je 0x47c608
mov ecx, dword [edi + 0xc]
or dword [edi + 0x14], 0x20
push 0
mov eax, dword [ecx]
call dword [eax + 0x24]
test eax, eax
jns 0x47c5e8
and dword [edi + 0x14], 0xffffffdf
mov eax, dword [esi + 0x35c]
push 0
push 0
push 0
mov ecx, dword [eax + 0xc]
push 7
mov eax, dword [ecx]
call dword [eax + 0xc]
push 1
lea ecx, [esi - 4]
call fcn.0047f1f0
push 0
mov ecx, esi
mov byte [esi + 0x1f], 1
call fcn.004770c0
jmp 0x47c846
cmp ecx, 0xfffffc1b
jne 0x47c4a9
mov ebx, dword [esi + 0x35c]
test ebx, ebx
je 0x47c6ab
mov ecx, dword [ebx + 0xc]
or dword [ebx + 0x14], 0x20
push 0
mov eax, dword [ecx]
call dword [eax + 0x24]
test eax, eax
jns 0x47c646
and dword [ebx + 0x14], 0xffffffdf
mov eax, dword [esi + 0x35c]
push 0
push 0
push 0
mov ecx, dword [eax + 0xc]
push 8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [esi + 0x36f], 0
mov dword [esi + 0x46c], 0
mov ebx, dword [esi + 0x470]
mov dword [esi + 0x470], 0
test ebx, ebx
je 0x47c6a2
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x47c6a2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
or eax, 0xffffffff
lock xadd dword [ebx + 8], eax
jne 0x47c6a2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push 0
mov ecx, esi
call fcn.004770c0
cmp byte [esi + 0x36c], 0
mov byte [esi + 0x1f], 0
mov byte [esi + 0x36b], 0
je 0x47c6f7
cmp byte [esi + 0x365], 0
je 0x47c6f7
cmp byte [esi + 0x1c], 0
je 0x47c6f7
mov eax, dword [esi - 4]
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0xffffffff
push ecx
push 0
push 0x437
lea ecx, [esi - 4]
mov dword [ebp - 0x3c], 0
call dword [eax + 0x1c8]
cmp byte [esi + 0x36d], 0
je 0x47c72f
cmp byte [esi + 0x1c], 0
je 0x47c72f
mov eax, dword [esi - 4]
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0xffffffff
push ecx
push 0
push 0x437
lea ecx, [esi - 4]
mov dword [ebp - 0x44], 0
call dword [eax + 0x1c8]
push 0
mov ecx, esi
call fcn.004770c0
push 0
call fcn.004abd10
mov ecx, eax
call fcn.004abd60
jmp 0x47c846
cmp byte [esi + 0x1c], 0
je 0x47c796
cmp byte [esi + 0x36b], 0
jne 0x47c796
cmp byte [esi + 0x36d], 0
mov byte [esi + 0x36b], 1
je 0x47c796
lea ecx, [esi - 4]
call fcn.0047eea0
test byte [esi + 0x3a0], 4
mov ecx, esi
mov eax, dword [esi]
je 0x47c790
call dword [eax + 0x134]
push edi
push 0x202
jmp 0x47c83e
call dword [eax + 0x144]
push edi
push 0x202
jmp 0x47c83e
mov eax, dword [esi + 0x4b0]
sub eax, dword [esi + 0x4ac]
sar eax, 5
test eax, eax
je 0x47c825
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [edi + 0xc]
sub esp, 8
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [edi + 0x10]
mov dword [ecx + 4], eax
lea ecx, [esi - 4]
call fcn.0047c870
test al, al
je 0x47c814
mov ecx, dword [esi + 0x2b0]
test ecx, ecx
je 0x47c80a
push 0
lea eax, [esi - 4]
neg eax
push 0
sbb eax, eax
push 0x2b
and eax, esi
push eax
call fcn.0044d4b0
lea ecx, [ebp - 0x28]
call fcn.00403110
jmp 0x47c846
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.00403110
mov ecx, dword [edi]
cmp ecx, 0x1b
jne 0x47c838
push 1
call fcn.004abd10
mov ecx, eax
call fcn.004abd60
push edi
push 0x201
lea ecx, [esi - 4]
call fcn.0047d280
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eda39
mov esp, ebp
pop ebp
ret 4