Function at 0x47ef7e
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x560ccc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
mov eax, dword [str.GBURNER]
mov edx, dword [0x6ef434]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push esi
mov esi, ecx
push edi
mov ecx, dword [0x6ef430]
push 0x11
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call ebp
mov di, ax
push 8
and edi, 0xffff8000
call ebp
mov ebx, dword [esp + 0x15c]
and eax, 0xffff8000
cmp ebx, 0x61
jne 0x47efbd
mov ebx, 0x41
jmp 0x47efd3
cmp ebx, 0x63
jne 0x47efc9
mov ebx, 0x43
jmp 0x47efd3
cmp ebx, 0x76
jne 0x47efd3
mov ebx, 0x56
test di, di
je 0x47f0b7
mov ecx, ebx
sub ecx, 0x41
je 0x47f080
sub ecx, 2
je 0x47f03e
sub ecx, 0x13
jne 0x47f0b7
mov eax, dword [esi + 0x49e0]
cmp eax, 1
je 0x47f005
cmp eax, 2
jne 0x47f01b
mov ecx, dword [esi + 0x30f8]
test ecx, ecx
je 0x47f01b
mov ecx, esi
call fcn.0045d210
jmp 0x47f0f6
cmp eax, 3
jne 0x47f0f6
mov eax, dword [esi + 0x30fc]
test eax, eax
je 0x47f0f6
mov ecx, esi
call fcn.0045d730
jmp 0x47f0f6
mov eax, dword [esi + 0x49e0]
cmp eax, 1
je 0x47f04e
cmp eax, 2
jne 0x47f064
mov ecx, dword [esi + 0x30f8]
test ecx, ecx
je 0x47f064
mov ecx, esi
call fcn.0045d1f0
jmp 0x47f0f6
cmp eax, 3
jne 0x47f0f6
mov eax, dword [esi + 0x30fc]
test eax, eax
je 0x47f0f6
mov ecx, esi
call fcn.0045d630
jmp 0x47f0f6
mov eax, dword [esi + 0x49e0]
cmp eax, 1
je 0x47f090
cmp eax, 2
jne 0x47f0a1
mov ecx, dword [esi + 0x30f8]
test ecx, ecx
je 0x47f0a1
call fcn.0048ee10
jmp 0x47f0f6
cmp eax, 3
jne 0x47f0f6
mov ecx, dword [esi + 0x30fc]
test ecx, ecx
je 0x47f0f6
call fcn.0048ee10
jmp 0x47f0f6
cmp ebx, 0x2e
jne 0x47f0f6
test ax, ax
jne 0x47f0f6
mov eax, dword [esi + 0x49e0]
cmp eax, 1
jne 0x47f0d3
call fcn.00457960
jmp 0x47f0f6
cmp eax, 2
jne 0x47f0ec
mov eax, dword [esi + 0x30f8]
add eax, 0x7c
push eax
call fcn.00457420
add esp, 4
jmp 0x47f0f6
cmp eax, 3
jne 0x47f0f6
call fcn.004576c0
push 0xa0
mov dword [esi + 0x49e0], 0
call ebp
test ax, ax
jne 0x47f118
push 0xa1
call ebp
test ax, ax
je 0x47f122
cmp bl, 0x38
jne 0x47f122
mov ebx, 0x2a
push 0xa0
call ebp
test ax, ax
jne 0x47f13a
push 0xa1
call ebp
test ax, ax
je 0x47f144
cmp bl, 0x33
jne 0x47f144
mov ebx, 0x23
mov eax, dword [0x75e0bc]
cmp bl, byte [esp + eax + 0x14]
jne 0x47f239
mov cl, byte [esp + eax + 0x15]
inc eax
test cl, cl
mov dword [0x75e0bc], eax
jne 0x47f248
mov eax, dword [0x7a9b70]
xor esi, esi
cmp eax, esi
mov dword [0x75e0bc], esi
jne 0x47f1d1
push esi
lea ecx, [esp + 0x24]
call fcn.005069c0
lea ecx, [esp + 0x20]
mov dword [esp + 0x154], esi
call fcn.00544d44
lea ecx, [esp + 0x90]
mov dword [esp + 0x154], 2
call fcn.004d83c0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x154], 1
call fcn.00544250
lea ecx, [esp + 0x20]
mov dword [esp + 0x154], 0xffffffff
call fcn.004cef40
jmp 0x47f248
mov ecx, dword [0x700320]
mov dword [esp + 0x10], ecx
push str.Do_you_want_to_close_log_file_
push 0x26ac
mov dword [esp + 0x15c], 3
call fcn.00506990
push eax
push 0x7a9b7c
lea edx, [esp + 0x20]
push str._s_r_n_r_n_s
push edx
call fcn.005412cd
mov eax, dword [esp + 0x28]
push 0x44
push eax
call fcn.004dd630
add esp, 0x20
cmp eax, 6
jne 0x47f223
call fcn.00506e70
lea ecx, [esp + 0x10]
mov dword [esp + 0x154], 0xffffffff
call fcn.00544250
jmp 0x47f248
cmp ebx, 0x10
je 0x47f248
mov dword [0x75e0bc], 0
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret 0xc