Function at 0x474400
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b12b0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4bd040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x47443c
test eax, eax
je 0x47459d
cmp dword [0x4bdc88], 0xcccccccc
jb 0x474452
mov dword [0x4bdc88], 0
mov edx, dword [0x4bdda8]
lea edi, [eax + 0x1a]
lea eax, [ecx + 0x15e]
cmp edx, dword [0x4bddb0]
jl 0x4744ae
cmp edx, dword [0x4bddb8]
jg 0x4744ae
mov ecx, dword [0x4bddac]
mov esi, dword [0x4bddb4]
cmp ecx, esi
jl 0x4744ae
cmp ecx, dword [0x4bddbc]
jg 0x4744ae
sub edx, dword [0x4bddb0]
cmp edx, eax
jl 0x4744ae
add eax, 0x28
cmp edx, eax
jg 0x4744ae
sub ecx, esi
cmp ecx, edi
jl 0x4744ae
lea eax, [edi + 0xc]
cmp ecx, eax
jg 0x4744ae
mov edi, 1
jmp 0x4744b0
xor edi, edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x4bdd94]
jne 0x47467c
cmp dword [0x4bddc8], 0
jne 0x47467c
cmp dword [0x4bddcc], 0
jne 0x47467c
cmp dword [0x4bdec8], 0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jne 0x4745c9
test edi, edi
je 0x47468c
push 1
call esi
bt ax, 0xf
jae 0x4745bc
push 0
push 0
push 0
push 0
push 4
call dword [sym.imp.USER32.dll_mouse_event]
mov dword [0x4bdec8], 1
mov eax, dword [0x4bdd8c]
sub esp, 0x10
mov edi, dword [0x4bdd90]
cdq
sub eax, edx
mov dword [ebp - 0x2c], edi
mov esi, eax
mov eax, dword [0x4bdd88]
cdq
sub eax, edx
sar esi, 1
mov ecx, eax
mov dword [ebp - 0x30], esi
mov eax, dword [0x4bdd84]
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
mov dword [ebp - 0x38], eax
mov eax, esp
mov dword [ebp - 0x34], ecx
sub esp, 0x18
movups xmm0, xmmword [ebp - 0x38]
mov ecx, esp
movups xmmword [eax], xmm0
push 3
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push 0x4b4658
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004ae170
mov eax, dword [ebp + 0xc]
add eax, 0x1b
push eax
mov eax, dword [ebp + 8]
add eax, 0x163
push eax
call fcn.00407dc0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af21a
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x4bdec8], 0
je 0x47468c
push 8
call esi
bt ax, 0xf
mov edi, dword [sym.imp.USER32.dll_keybd_event]
jae 0x4745e4
push 0
push 2
push 0
push 8
jmp 0x4745f7
push 0x1b
call esi
bt ax, 0xf
jae 0x47460d
push 0
push 2
push 0
push 0x1b
call edi
mov dword [0x4bdc88], 0
mov dword [0x4bdec8], 0
mov edi, dword [sym.imp.USER32.dll_mouse_event]
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x474673
push 0
cmp esi, 1
jne 0x474636
push 0
push 0
push 0
push 4
call edi
jmp 0x474663
cmp esi, 2
jne 0x474647
push 0
push 0
push 0
push 0x10
call edi
jmp 0x474663
cmp esi, 4
jne 0x474658
push 0
push 0
push 0
push 0x40
call edi
jmp 0x474663
push 2
push 0
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [0x4bdc88], esi
mov dword [0x4bdec8], 0
inc esi
cmp esi, 0xfe
jl 0x474615
cmp dword [0x4bdec8], 0
jne 0x474523
mov edi, dword [ebp - 0x2c]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x4b25ae
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
call fcn.004ae170
mov edx, dword [0x4bdc88]
cmp edx, 0xde
ja case.0x4746c9.10
movzx eax, byte [edx + 0x4753c0]
jmp dword [eax*4 + 0x4751e4]
push 4
push str._M1_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._M2_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._CAN_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._M3_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._M4_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._M5_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._NONE_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._BACK_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._TAB_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._CLE_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._ENT_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._PAU_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._CAP_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._KAN_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._JUN_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._FIN_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._HAN_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._ESC_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._CON_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._NON_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._ACC_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._MOD_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._SPA_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._NEXT_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._END_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._HOME_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._LEFT_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._UP_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._RIGT_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._DOWN_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._SEL_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._PRI_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._EXE_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._SNAP_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._INS_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._DEL_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 6
push str._HELP_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47c4
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47c8
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47cc
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47d0
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47d4
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47d8
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47dc
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47e0
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47e4
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47e8
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47ec
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47f0
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47f4
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47f8
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47fc
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4800
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4804
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4808
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b480c
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4810
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4814
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4818
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b481c
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4820
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4824
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4828
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._WIN_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._APP_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._SLP_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b479c
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47a0
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47a4
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47a8
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47ac
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47b0
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47b4
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47b8
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47bc
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b47c0
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4844
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4848
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._SEP_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4658
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F1_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F2_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F3_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F4_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F5_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F6_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F7_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F8_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 4
push str._F9_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F10_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F11_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F12_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F13_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F14_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F15_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F16_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F17_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F18_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F19_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F20_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F21_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F22_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F23_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._F24_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._NUM_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._SCR_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._SHF_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._CLR_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 5
push str._ALT_
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b492c
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4930
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4854
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4858
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4934
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4938
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b493c
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 3
push 0x4b4940
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
push 2
push 0x4b4944
lea ecx, [ebp - 0x28]
call fcn.00441350
jmp 0x475143
lea ecx, [ebp - 0x68]
call fcn.00441520
lea eax, [ebp - 0x68]
mov edx, 0x4b2638
push eax
lea ecx, [ebp - 0x50]
call fcn.00441a10
mov ecx, eax
add esp, 4
mov esi, dword [ecx + 0x14]
mov eax, esi
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 1
jb 0x47504c
lea eax, [edx + 1]
mov dword [ecx + 0x10], eax
mov eax, ecx
cmp esi, 0xf
jbe 0x475044
mov eax, dword [ecx]
mov word [eax + edx], 0x5d
jmp 0x475063
push 1
push 0x4b29c0
mov byte [ebp - 0x2c], 0
push dword [ebp - 0x2c]
push 1
call fcn.004ae2c0
mov ecx, eax
movups xmm0, xmmword [ecx]
movq xmm1, qword [ecx + 0x10]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov ecx, dword [ebp - 0x14]
movq qword [ebp - 0x30], xmm1
movups xmmword [ebp - 0x78], xmm0
cmp ecx, 0xf
jbe 0x4750c2
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4750af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x475133
push ecx
push edx
call fcn.004af678
movups xmm0, xmmword [ebp - 0x78]
add esp, 8
movq xmm1, qword [ebp - 0x30]
mov ecx, dword [ebp - 0x3c]
movq qword [ebp - 0x18], xmm1
movups xmmword [ebp - 0x28], xmm0
cmp ecx, 0xf
jbe 0x4750fb
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4750f1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x475133
push ecx
push edx
call fcn.004af678
add esp, 8
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0xf
jbe 0x475143
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x475139
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x475139
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004af678
add esp, 8
sub esp, 0x10
mov eax, esp
sub esp, 0x18
mov ecx, esp
mov dword [eax + 0xc], 0xff
test edi, edi
je 0x47516e
mov dword [eax], 0x82
mov dword [eax + 4], 0x82
mov dword [eax + 8], 0x82
jmp 0x475182
mov dword [eax], 0x64
mov dword [eax + 4], 0x64
mov dword [eax + 8], 0x64
lea eax, [ebp - 0x28]
push eax
call fcn.00440d20
mov eax, dword [ebp + 0xc]
add eax, 0x1b
push eax
mov eax, dword [ebp + 8]
add eax, 0x163
push eax
call fcn.00407dc0
mov ecx, dword [ebp - 0x14]
mov esi, dword [0x4bdc88]
cmp ecx, 0xf
jbe 0x4751dc
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4751d2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4751d2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004af678
add esp, 8
mov eax, esi
jmp 0x47459f