Function at 0x47bf5c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
cmp word [rdx + 0x18], 9
mov r14, r8
mov r13, rdx
mov rdi, rcx
jne 0x47bfa5
mov rax, qword [rcx + 0xa8]
cmp qword [rdx], rax
jne 0x47bfa5
mov rcx, qword [rcx + 0x58]
mov rax, qword [rcx]
call qword [rax]
xor al, al
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
mov r12w, ax
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa3
mov si, ax
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, InitCommonControls
mov r15w, ax
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
mov bp, ax
mov qword [r14], rbx
movzx edx, word [r13 + 0x18]
shr ebp, 0xf
and bpl, 1
cmp dx, 0x30
jb 0x47c03f
cmp dx, 0x39
ja 0x47c03f
cmp r15b, bl
jne 0x47c01d
cmp r12b, bl
je 0x47c03f
movzx edx, dx
mov rcx, rdi
sub edx, 0x30
cmp bpl, bl
je 0x47c035
call fcn.0046f9dc
jmp 0x47c421
call fcn.00470c60
jmp 0x47c421
cmp dx, 0x71
je 0x47c04b
cmp dx, 0x70
jne 0x47c072
cmp r12b, bl
je 0x47c072
cmp sil, bl
jne 0x47c072
cmp bpl, bl
jne 0x47c072
mov rcx, qword [rdi + 0x58]
cmp dx, 0x70
mov rax, qword [rcx]
setne bl
mov edx, ebx
call qword [rax + VariantCopyInd]
jmp 0x47c421
cmp dx, 0x78
jne 0x47c093
cmp r12b, bl
jne 0x47c093
cmp sil, bl
jne 0x47c093
cmp bpl, bl
jne 0x47c093
lea rcx, [0x004d57c0]
call fcn.0044b3dc
movzx ecx, word [r13 + 0x18]
mov r14d, 8
cmp cx, 0x72
lea r15, [r14 - 9]
jb 0x47c0e4
cmp cx, 0x7b
ja 0x47c0e4
cmp sil, bl
je 0x47c0e4
lea r8, [0x004a7c78]
mov eax, ebx
mov rdx, r8
cmp word [rdx], cx
je 0x47c0d1
inc eax
add rdx, r14
cmp eax, 5
jb 0x47c0bf
mov eax, r15d
cmp eax, ebx
jl 0x47c0e4
cdqe
mov rcx, rdi
mov edx, dword [r8 + rax*8 + 4]
call fcn.004837e0
movzx ecx, word [r13 + 0x18]
cmp ecx, 0x56
jg 0x47c2d7
je 0x47c2c1
cmp ecx, 0x2d
jg 0x47c20a
je 0x47c1c6
sub ecx, r14d
je 0x47c1b9
sub ecx, r14d
je 0x47c18d
sub ecx, 0x12
je 0x47c16d
sub ecx, 3
je 0x47c159
dec ecx
je 0x47c145
dec ecx
je 0x47c159
dec ecx
jne 0x47bf92
cmp bpl, bl
je 0x47bf92
mov rcx, rdi
call fcn.004827f0
jmp 0x47bf92
cmp r12b, bl
je 0x47c12f
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp 0x47bf92
cmp r12b, bl
je 0x47c12f
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x47bf92
cmp sil, bl
je 0x47bf92
cmp r12b, bl
jne 0x47bf92
cmp bpl, bl
jne 0x47bf92
jmp 0x47c421
mov rcx, qword [rdi + 0xa8]
mov r9d, 1
mov r8, r15
mov edx, 0x100c
mov byte [rdi + 0x22c], bl
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi + 0x230], eax
jmp 0x47bf92
mov rcx, rdi
call fcn.00471734
jmp 0x47c421
cmp r12b, bl
jne 0x47bf92
cmp sil, bl
je 0x47c1de
cmp bpl, bl
jne 0x47c1e3
jmp 0x47c270
cmp bpl, bl
je 0x47c1f1
cmp sil, bl
jne 0x47bf92
jmp 0x47c2ca
cmp byte [rdi + 0xdb], bl
je 0x47bf92
mov rcx, rdi
call fcn.004828f8
jmp 0x47c421
cmp ecx, 0x2e
je 0x47c2ae
cmp ecx, 0x30
jle 0x47bf92
cmp ecx, 0x34
jle 0x47c295
cmp ecx, 0x41
je 0x47c27d
cmp ecx, 0x43
je 0x47c267
cmp ecx, 0x4e
je 0x47c251
cmp ecx, 0x52
jne 0x47bf92
cmp sil, bl
je 0x47bf92
xor edx, edx
mov rcx, rdi
call fcn.0047be40
jmp 0x47c421
cmp sil, bl
je 0x47bf92
mov rcx, rdi
call fcn.0048216c
jmp 0x47c421
cmp sil, bl
je 0x47bf92
mov rcx, rdi
call fcn.0047d664
jmp 0x47c421
cmp sil, bl
je 0x47bf92
mov dl, 1
mov rcx, rdi
call fcn.00482e20
jmp 0x47c421
cmp sil, bl
je 0x47bf92
lea edx, [rcx - 0x31]
mov rcx, rdi
call fcn.00466404
jmp 0x47c421
cmp bpl, bl
mov rcx, rdi
sete dl
call fcn.00480d00
jmp 0x47c421
cmp sil, bl
je 0x47bf92
mov rcx, rdi
call fcn.0048e118
jmp 0x47c421
cmp ecx, 0x71
jg 0x47c3d8
je 0x47c3b3
sub ecx, 0x57
je 0x47c390
dec ecx
je 0x47c37a
sub ecx, 2
je 0x47c364
sub ecx, 0x10
je 0x47c357
dec ecx
je 0x47c322
cmp ecx, 2
jne 0x47bf92
xor edx, edx
cmp r12b, bl
mov rcx, rdi
jne 0x47c32c
cmp bpl, bl
je 0x47c34d
jmp 0x47c28b
cmp r12b, bl
je 0x47c336
mov dl, 1
mov rcx, rdi
call fcn.00482b74
jmp 0x47c421
cmp bpl, bl
jne 0x47c286
cmp sil, bl
jne 0x47c421
mov dl, 1
mov rcx, rdi
call fcn.00483014
jmp 0x47c421
mov rcx, rdi
call fcn.00482e48
jmp 0x47c421
cmp sil, bl
je 0x47bf92
mov rcx, rdi
call fcn.00480558
jmp 0x47c421
cmp sil, bl
je 0x47bf92
mov rcx, rdi
call fcn.0048e118
jmp 0x47c421
cmp sil, bl
je 0x47bf92
mov rcx, qword [0x004d5778]
xor r9d, r9d
mov r8, r14
mov edx, 0x111
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x47c421
cmp r12b, bl
jne 0x47bf92
cmp sil, bl
jne 0x47bf92
cmp bpl, bl
jne 0x47bf92
mov rcx, rdi
call fcn.004802c0
jmp 0x47c421
sub ecx, 0x72
je 0x47c4a8
dec ecx
je 0x47c486
dec ecx
je 0x47c463
dec ecx
je 0x47c44d
dec ecx
je 0x47c428
cmp ecx, 5
jne 0x47bf92
cmp r12b, bl
je 0x47bf92
cmp sil, bl
jne 0x47bf92
cmp bpl, bl
jne 0x47bf92
mov rcx, rdi
call fcn.0047157c
mov al, 1
jmp 0x47bf94
cmp r12b, bl
jne 0x47bf92
cmp sil, bl
jne 0x47bf92
cmp bpl, bl
jne 0x47bf92
mov rcx, rdi
call fcn.00481b70
jmp 0x47c421
cmp r12b, bl
jne 0x47bf92
cmp sil, bl
jne 0x47bf92
mov dl, 1
jmp 0x47c477
cmp r12b, bl
jne 0x47bf92
cmp sil, bl
jne 0x47bf92
xor edx, edx
mov rcx, qword [rdi + 0x58]
mov r8b, bpl
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x47c421
cmp r12b, bl
jne 0x47bf92
cmp sil, bl
jne 0x47bf92
cmp bpl, bl
mov rcx, rdi
jne 0x47c25d
mov dl, 1
jmp 0x47c4c8
cmp r12b, bl
jne 0x47bf92
cmp sil, bl
jne 0x47bf92
cmp bpl, bl
jne 0x47bf92
xor edx, edx
mov rcx, rdi
call fcn.00479884
jmp 0x47c421