Function at 0x469b95
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 0x1c], ebx
push edi
mov edi, eax
je 0x469bfa
cmp dword [ebp + 0x1c], 0x6a
jne 0x469ca4
cmp dword [ebp + 0xc], 0x100
jne 0x469ca4
movzx eax, word [ebp + 0x10]
cmp eax, 0x61
mov dword [edi + 0x400], ebx
je 0x469bd3
cmp eax, 0x41
jne 0x469bea
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x469bea
lea esi, [edi + 0x3d4]
call fcn.0046ce0e
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x400], ebx
jmp 0x469ca2
mov eax, dword [ebp + 0xc]
cmp eax, 0x113
jne 0x469c39
mov eax, dword [ebp + 0x10]
dec eax
mov dword [edi + 0x400], 1
je 0x469c20
dec eax
jne 0x469c27
mov esi, edi
call fcn.0046c2a9
jmp 0x469c27
mov esi, edi
call fcn.0046bd6e
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x400], ebx
je 0x469c89
xor eax, eax
inc eax
jmp 0x469ca6
cmp eax, 0x4e
jne 0x469c63
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0xffffffff
jne 0x469c89
lea esi, [edi + 0x400]
mov ecx, edi
mov dword [esi], 1
call fcn.004699ae
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [esi], ebx
jmp 0x469c32
cmp eax, 0x110
jne 0x469caf
lea esi, [edi + 0x400]
mov ebx, edi
mov dword [esi], 1
call fcn.0046b08e
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [esi], 0
jne 0x469c34
xor ebx, ebx
push ebx
push dword [ebp + 0x18]
mov ecx, edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046d0fe
test eax, eax
jne 0x469c34
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x10
jne 0x469cd8
push ebx
push 2
push 0x111
push dword [edi + 4]
lea esi, [edi + 0x400]
mov dword [esi], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x469c5f
cmp eax, 2
jne 0x469d12
lea eax, [edi + 0x838]
push eax
push 2
mov dword [edi + 0x400], 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
cmp dword [edi + 0x2d8], ebx
je 0x469c27
lea eax, [edi + 0x2d4]
call fcn.0040bbc0
jmp 0x469c27
cmp eax, 0x112
jne 0x469d3f
mov eax, dword [ebp + 0x10]
and eax, 0xfff0
cmp eax, 0xf060
lea esi, [edi + 0x400]
mov dword [esi], ebx
jne 0x469cd1
mov eax, edi
mov dword [esi], 1
call fcn.0046b7d6
jmp 0x469cd1
cmp eax, 0x111
jne 0x469d7c
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [edi + 0x400], 1
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov dword [esp + 0x10], esp
push eax
mov ebx, edi
call fcn.0046ca0e
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [edi + 0x400], 0
jmp 0x469c85
cmp eax, 0x133
jne 0x469dc5
mov eax, dword [ebp + 0x14]
cmp eax, dword [edi + 0x3d4]
mov dword [edi + 0x400], 1
jne 0x469db9
push ebx
push eax
push dword [ebp + 0x10]
call fcn.0046cda2
push 0xadadad
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_SetTextColor]
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x469dbb
xor eax, eax
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x469c2c
cmp eax, 0x432
jne 0x469ddf
mov esi, edi
mov dword [edi + 0x400], 1
call fcn.0046b46d
jmp 0x469dbb
cmp eax, 0x467
jne 0x469e0c
push dword [ebp + 0x14]
xor esi, esi
push dword [ebp + 0x10]
inc esi
push edi
mov dword [edi + 0x400], esi
call fcn.0046be4d
push dword [ebp + 0x10]
mov ecx, esi
mov edx, edi
call fcn.0046bc88
jmp 0x469c27
cmp eax, 0x46b
jne 0x469e2e
xor eax, eax
inc eax
push ebx
mov dword [edi + 0x400], eax
mov dword [edi + 0xc34], eax
call fcn.0046cad6
push ebx
push 3
pop ecx
jmp 0x469e00
cmp eax, 0x46e
jne 0x469e58
xor eax, eax
inc eax
lea esi, [edi + 0x400]
mov dword [esi], eax
push eax
mov eax, edi
call fcn.0046bf2c
push ebx
push 2
pop ecx
mov edx, edi
call fcn.0046bc88
jmp 0x469cd1
cmp eax, 0x46d
jne 0x469e7e
push ebx
lea esi, [edi + 0x400]
push 0xc8
lea eax, [edi + 0x24]
mov dword [esi], 1
call fcn.0046d396
jmp 0x469cd1
cmp eax, 0x470
jne 0x469e9d
lea esi, [edi + 0x400]
mov eax, edi
mov dword [esi], 1
call fcn.0046b6cf
jmp 0x469c5a
cmp eax, 0x471
jne 0x469ec9
push ebx
xor esi, esi
push 6
inc esi
pop ecx
mov edx, edi
mov dword [edi + 0x400], esi
mov dword [edi + 0xc10], esi
call fcn.0046bc88
push esi
call fcn.0046cad6
jmp 0x469c27
cmp eax, 0x46c
jne 0x469efe
mov eax, dword [ebp + 0x10]
sub eax, ebx
mov dword [edi + 0x400], 1
je 0x469ef4
dec eax
je 0x469ef4
dec eax
je 0x469ef4
dec eax
je 0x469ef4
dec eax
je 0x469ef4
dec eax
jne 0x469c27
call fcn.0046b738
jmp 0x469c27
cmp eax, 0x468
jne 0x469f48
cmp dword [ebp + 0x10], 2
jne 0x469f3e
cmp dword [ebp + 0x14], 0x204
je 0x469f1d
cmp dword [ebp + 0x14], 0x201
jne 0x469f3e
lea eax, [edi + 0xc14]
cmp byte [eax], bl
jne 0x469f2a
mov byte [eax], 1
push 9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x469c34
cmp eax, 0x46a
jne 0x469f6a
push 2
lea esi, [edi + 0x400]
pop ecx
mov eax, edi
mov dword [esi], 1
call fcn.0046d0db
jmp 0x469cd1
cmp eax, 0x472
jne 0x469f8a
lea esi, [edi + 0x400]
push ebx
mov eax, edi
mov dword [esi], 1
call fcn.0046b918
jmp 0x469cd1
cmp eax, 0x476
jne 0x469c89
xor eax, eax
inc eax
lea esi, [edi + 0x400]
push eax
mov dword [esi], eax
call fcn.0046cad6
jmp 0x469cd1