Function at 0x463c7f
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push edi
push 9
pop eax
mov edi, ecx
cmp word [ebp + 0xc], ax
jne 0x463ca9
mov eax, dword [ebp]
cmp eax, dword [edi + 0x68]
jne 0x463ca9
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax]
xor al, al
jmp 0x463e2c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x11
mov dword [esp + 0x24], eax
call esi
movzx ebx, ax
shr ebx, 0xf
push 0xa3
and bl, 1
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x10
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [esp + 0x24]
movzx edx, ax
shr edx, 0xf
push 9
and dword [ecx], 0
and edx, 0xffffff01
movzx esi, word [ebp + 0xc]
pop ecx
mov dword [esp + 0x10], edx
mov byte [esp + 0x14], dl
lea eax, [esi - 0x30]
cmp ax, cx
ja 0x463d3c
cmp byte [esp + 0x18], 0
jne 0x463d1e
mov eax, dword [esp + 0x20]
test al, al
je 0x463d40
lea ecx, [esi - 0x30]
push ecx
mov ecx, edi
test dl, dl
je 0x463d32
call fcn.0045e3ba
jmp 0x4641b9
call fcn.0045df37
jmp 0x4641b9
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], 0x71
push 0x70
pop ecx
cmp si, word [esp + 0x24]
je 0x463d57
cmp si, cx
jne 0x463d7c
test al, al
je 0x463d7c
test bl, bl
jne 0x463d7c
test dl, dl
jne 0x463d7c
mov ecx, dword [edi + 0x3c]
xor eax, eax
push 0x70
pop edi
cmp si, di
mov edx, dword [ecx]
setne al
push eax
call dword [edx + 4]
jmp 0x4641b9
cmp esi, 0x78
jne 0x463d97
test al, al
jne 0x463d97
test bl, bl
jne 0x463d97
test dl, dl
jne 0x463d97
mov ecx, 0x5b3890
call fcn.00447f38
movzx ecx, word [ebp + 0xc]
push 9
pop edx
lea eax, [ecx - 0x72]
cmp ax, dx
ja 0x463dd0
test bl, bl
je 0x463dd0
xor eax, eax
cmp word [eax*8 + 0x57ecd0], cx
je 0x463dbe
inc eax
cmp eax, 5
jb 0x463dac
jmp 0x463dd0
test eax, eax
js 0x463dd0
push dword [eax*8 + 0x57ecd4]
mov ecx, edi
call fcn.00468735
movzx eax, word [ebp + 0xc]
cmp eax, 0x4e
ja 0x463f61
je 0x463f4d
cmp eax, 0x2d
ja 0x463ed4
je 0x463e9c
sub eax, 8
je 0x463e90
sub eax, 8
je 0x463e6f
sub eax, 0x12
je 0x463e56
sub eax, 3
je 0x463e34
sub eax, 1
je 0x463e45
sub eax, 1
je 0x463e34
sub eax, 1
jne 0x463e28
mov eax, dword [esp + 0x10]
test al, al
je 0x463e28
mov ecx, edi
call fcn.00467c4b
xor al, al
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret 8
cmp byte [esp + 0x20], 0
je 0x463e19
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x463e28
cmp byte [esp + 0x20], 0
je 0x463e19
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x463e28
test bl, bl
je 0x463e28
cmp byte [esp + 0x20], 0
jne 0x463e28
mov eax, dword [esp + 0x10]
test al, al
je 0x4641b9
jmp 0x463e28
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x68]
mov byte [edi + 0x178], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x17c], eax
jmp 0x463e28
mov ecx, edi
call fcn.0045e054
jmp 0x4641b9
cmp byte [esp + 0x20], 0
jne 0x463e28
mov eax, dword [esp + 0x10]
test bl, bl
je 0x463eb4
test al, al
je 0x463f06
jmp 0x463e28
test al, al
jne 0x46402f
cmp byte [edi + 0x87], al
je 0x463e28
mov ecx, edi
call fcn.00467cef
jmp 0x4641b9
mov ecx, eax
sub ecx, 0x2e
je 0x463f37
sub ecx, 3
je 0x463f1f
sub ecx, 1
je 0x463f1f
sub ecx, 1
je 0x463f1f
sub ecx, 1
je 0x463f1f
sub ecx, 0xd
je 0x463f12
dec ecx
sub ecx, 1
jne 0x463e28
test bl, bl
je 0x463e28
mov ecx, edi
call fcn.00465627
jmp 0x4641b9
test bl, bl
je 0x463e28
jmp 0x463fb4
test bl, bl
je 0x463e28
add eax, 0xffffffcf
mov ecx, edi
push eax
call fcn.004582bb
jmp 0x4641b9
mov eax, dword [esp + 0x10]
mov ecx, edi
xor al, 1
movzx eax, al
push eax
call fcn.00467327
jmp 0x4641b9
test bl, bl
je 0x463e28
mov ecx, edi
call fcn.00466ef1
jmp 0x4641b9
cmp eax, 0x6d
ja 0x46407d
je 0x464051
sub eax, 0x52
je 0x46403b
sub eax, 4
je 0x464027
sub eax, 1
je 0x464005
sub eax, 1
je 0x463ff1
dec eax
sub eax, 1
je 0x463fdd
sub eax, 0x10
je 0x463fd1
sub eax, 1
jne 0x463e28
cmp byte [esp + 0x20], al
je 0x463fad
push 1
jmp 0x46405a
cmp byte [esp + 0x10], 0
je 0x463fbb
push 1
jmp 0x464071
test bl, bl
jne 0x4641b9
push 1
mov ecx, edi
call fcn.00468127
jmp 0x4641b9
mov ecx, edi
call fcn.00467c15
jmp 0x4641b9
test bl, bl
je 0x463e28
mov ecx, edi
call fcn.00466c8c
jmp 0x4641b9
test bl, bl
je 0x463e28
mov ecx, edi
call fcn.00446e5e
jmp 0x4641b9
test bl, bl
je 0x463e28
push 0
push 8
push 0x111
push dword [0x5b3860]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4641b9
test bl, bl
je 0x463e28
mov ecx, edi
call fcn.00446e5e
jmp 0x4641b9
test bl, bl
je 0x463e28
push 0
mov ecx, edi
call fcn.00462c6f
jmp 0x4641b9
cmp byte [esp + 0x20], 0
push 0
je 0x464066
mov ecx, edi
call fcn.00467f49
jmp 0x4641b9
cmp byte [esp + 0x14], 0
je 0x463fc5
mov ecx, edi
call fcn.00467f1f
jmp 0x4641b9
sub eax, dword [esp + 0x24]
je 0x464193
sub eax, 1
je 0x464169
sub eax, 1
je 0x464148
sub eax, 1
je 0x464125
sub eax, 1
je 0x46410a
sub eax, 1
je 0x4640df
sub eax, 5
jne 0x463e28
cmp byte [esp + 0x20], al
je 0x463e28
test bl, bl
jne 0x463e28
mov eax, dword [esp + 0x10]
test al, al
jne 0x463e28
mov ecx, edi
call fcn.0045d55c
jmp 0x4641b9
cmp byte [esp + 0x20], 0
jne 0x463e28
test bl, bl
jne 0x463e28
mov eax, dword [esp + 0x10]
test al, al
jne 0x463e28
mov ecx, edi
call fcn.004670fa
jmp 0x4641b9
cmp byte [esp + 0x20], 0
jne 0x463e28
test bl, bl
jne 0x463e28
push dword [esp + 0x14]
push 1
jmp 0x46413e
cmp byte [esp + 0x20], 0
jne 0x463e28
test bl, bl
jne 0x463e28
push dword [esp + 0x14]
push 0
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x4641b9
cmp byte [esp + 0x20], 0
jne 0x463e28
test bl, bl
jne 0x463e28
cmp byte [esp + 0x10], bl
jne 0x463f55
push 1
jmp 0x46418a
cmp byte [esp + 0x20], 0
jne 0x463e28
test bl, bl
jne 0x463e28
mov eax, dword [esp + 0x10]
test al, al
jne 0x463e28
push 0
mov ecx, edi
call fcn.00461cf1
jmp 0x4641b9
cmp byte [esp + 0x20], 0
jne 0x463e28
test bl, bl
jne 0x463e28
mov eax, dword [esp + 0x10]
test al, al
jne 0x463e28
mov ecx, edi
call fcn.00467bdb
mov al, 1
jmp 0x463e2a