Function at 0x479620
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5240a1
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x170], ebx
cmp esi, 0x200
ja 0x479b06
je 0x479adc
lea eax, [esi - 5]
cmp eax, 0x82
ja case.0x479694.6
movzx eax, byte [eax + 0x479d04]
jmp dword [eax*4 + 0x479cec]
mov dword [ecx], 1
mov al, 1
jmp 0x479c32
push 1
push 0
mov ecx, edx
call fcn.004d0f00
jmp case.0x479694.6
lea eax, [ebp - 0x17c]
mov ecx, edi
push eax
call fcn.00478c30
push eax
mov ecx, edi
call fcn.00478480
test eax, eax
je case.0x479694.6
mov eax, dword fs:[0x2c]
mov ecx, dword [0x571b70]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x571adc]
cmp eax, dword [ecx + 4]
jg 0x479c50
push dword [0x571ad8]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x164]
mov dword [eax], 1
mov al, 1
jmp 0x479c32
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je case.0x479694.6
cmp dword [ecx + 4], 0x100
jne case.0x479694.6
mov esi, dword [edi + 0x1c]
mov eax, dword [edi + 0x20]
cmp esi, eax
je 0x47974b
cmp byte [esi + 0x28], bl
jne 0x479743
add esi, 0x3c
cmp esi, eax
jne 0x479737
cmp esi, eax
jne 0x47991e
cmp byte [edi + 0x10], bl
je case.0x479694.6
cmp byte [edi + 0x54], bl
je case.0x479694.6
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.0x479694.6
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 8]
cmp eax, 0x41
je 0x479c1c
cmp eax, 0x43
jne case.0x479694.6
cmp byte [edi + 0x3d], bl
je case.0x479694.6
xor eax, eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov esi, dword [edi + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x164], eax
cmp esi, dword [edi + 0x20]
je 0x479910
xor eax, eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov edx, dword [esi + 0x30]
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
je 0x4798b7
mov ecx, dword [esi + 0x34]
cmp ecx, 0xffffffff
je 0x4798b7
cmp edx, ecx
jg 0x479c8e
test bl, 1
je 0x4797f6
and ebx, 0xfffffffe
mov dword [ebp - method.plat::Exception.virtual_0], vtable.plat::Exception.0
mov eax, dword [esi + 4]
sub ecx, edx
push 1
inc ecx
push ecx
lea eax, [eax + edx*2]
push 0xfde9
push eax
lea ecx, [ebp - 0x188]
call fcn.00411420
push 0xffffffffffffffff
push dword [ebp - 0x184]
lea ecx, [ebp - 0x17c]
call fcn.00407520
cmp byte [ebp - 0x180], 0
mov eax, dword [ebp - 0x184]
mov byte [ebp - 4], 2
je 0x479852
test eax, eax
je 0x479852
push dword [ebp - 0x188]
push eax
call fcn.00408000
mov eax, dword [ebp - 0x184]
add esp, 8
push eax
call fcn.0047f232
add esp, 4
mov dword [ebp - 0x188], 0
cmp dword [ebp - 0x174], 0
mov dword [ebp - 0x184], 0
je 0x479895
mov eax, dword [ebp - 0x164]
cmp dword [esi + 0x2c], eax
je 0x479895
push 0xffffffffffffffff
push 0x5381e0
lea ecx, [ebp - 0x174]
call fcn.00407520
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0x174]
push 0xffffffffffffffff
push dword [ebp - 0x17c]
mov dword [ebp - 0x164], eax
call fcn.00407520
mov eax, dword [ebp - 0x17c]
push eax
mov byte [ebp - 4], 0
call fcn.0047f232
add esi, 0x3c
add esp, 4
cmp esi, dword [edi + 0x20]
jne 0x4797b2
mov eax, dword [ebp - 0x174]
test eax, eax
je 0x479910
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x165]
push dword [eax + 4]
call fcn.00472ee0
push dword [ebp - 0x174]
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004732e0
lea ecx, [ebp - 0x165]
call fcn.00473080
mov eax, dword [ebp - 0x174]
push eax
call fcn.0047f232
add esp, 4
jmp case.0x479694.6
mov ecx, dword [ecx + 8]
xor bl, bl
lea eax, [ecx - 9]
cmp eax, 0xec
ja case.0x479694.6
movzx eax, byte [eax + 0x479d98]
jmp dword [eax*4 + 0x479d88]
mov ecx, dword [edi + 8]
test ecx, ecx
je case.0x479694.6
mov eax, dword [ecx]
push dword [esi + 0xc]
call dword [eax + 4]
mov eax, dword [ebp - 0x164]
mov dword [eax], 4
mov al, 1
jmp 0x479c32
mov bl, 1
cmp byte [edi + 0x10], 0
je 0x479984
cmp byte [edi + 0x54], 0
je 0x479984
mov ecx, edi
mov byte [edi + 0x54], 0
call fcn.00479350
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 8]
cmp ecx, 9
jne 0x47999a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
shr ebx, 0xf
and bl, 1
mov ecx, dword [edi + 0x20]
cmp esi, ecx
je 0x4799b8
mov eax, dword [ebp - 0x16c]
mov ecx, esi
mov byte [esi + 0x28], 0
push dword [eax + 4]
call fcn.00477c50
mov ecx, dword [edi + 0x20]
test bl, bl
je 0x4799e0
mov eax, dword [edi + 0x1c]
mov edx, esi
mov esi, ecx
cmp eax, edx
je 0x4799ed
cmp dword [eax + 0xc], 0
mov esi, eax
cmove esi, ecx
add eax, 0x3c
mov ecx, esi
cmp eax, edx
jne 0x4799c7
jmp 0x4799ed
add esi, 0x3c
cmp esi, ecx
je 0x4799ed
cmp dword [esi + 0xc], 0
je 0x4799e0
cmp esi, dword [edi + 0x20]
je case.0x479694.6
push esi
mov ecx, edi
call fcn.00477f10
mov eax, dword [ebp - 0x164]
mov dword [eax], 4
mov al, 1
jmp 0x479c32
mov ecx, edi
call fcn.00478b10
cmp esi, 7
jne 0x4796a1
mov esi, dword [ebp - 0x16c]
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetAncestor]
push dword [esi + 4]
mov ebx, eax
mov dword [ebp - 0x164], ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4796a1
push 1
push dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push ebx
call esi
mov ebx, dword [ebp + 0x14]
cmp ebx, eax
jne 0x479a7f
mov eax, dword [edi + 0x1c]
mov edx, dword [edi + 0x20]
cmp eax, edx
je 0x4796a1
nop
cmp dword [eax + 0xc], 0
jne 0x479ac5
add eax, 0x3c
cmp eax, edx
jne 0x479a70
jmp 0x479ac5
mov eax, dword [ebp - 0x16c]
push 0
push dword [eax + 4]
push dword [ebp - 0x164]
call esi
cmp ebx, eax
jne case.0x479694.6
mov eax, dword [edi + 0x20]
mov edx, eax
mov ecx, dword [edi + 0x1c]
cmp ecx, eax
je 0x479ac5
mov esi, eax
nop dword [eax + eax]
cmp dword [ecx + 0xc], 0
mov eax, ecx
cmove eax, edx
add ecx, 0x3c
mov edx, eax
cmp ecx, esi
jne 0x479ab0
mov edx, dword [edi + 0x20]
cmp eax, edx
je 0x4796a1
push eax
mov ecx, edi
call fcn.00477f10
mov al, 1
jmp 0x479c32
cmp byte [edi + 0x10], bl
je case.0x479694.6
cmp byte [edi + 0x3c], bl
je case.0x479694.6
mov eax, dword [ebp + 0x18]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
mov ecx, edi
call fcn.004794b0
jmp case.0x479694.6
cmp esi, 0x203
ja 0x479c25
je 0x479c17
sub esi, 0x201
je 0x479b7d
sub esi, 1
jne case.0x479694.6
cmp byte [edi + 0x10], bl
je 0x479b40
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [edi + 0x50]
mov byte [edi + 0x3c], bl
call dword [sym.imp.USER32.dll_SetCursor]
cmp byte [edi + 0x3d], bl
jne case.0x479694.6
lea eax, [ebp - 0x17c]
mov ecx, edi
push eax
call fcn.00478c30
push eax
mov ecx, edi
call fcn.00478480
mov ecx, dword [edi + 8]
test ecx, ecx
je case.0x479694.6
test eax, eax
je case.0x479694.6
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp case.0x479694.6
cmp byte [edi + 0x10], bl
je case.0x479694.6
mov ecx, edi
call fcn.00478b10
cmp byte [edi + 0x54], bl
jne 0x479bae
mov ebx, dword [ebp - 0x16c]
mov esi, dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
je 0x479bae
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x54], 1
mov eax, 0x88888889
mov ecx, dword [edi + 0x20]
sub ecx, dword [edi + 0x1c]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je case.0x479694.6
mov eax, dword [ebp + 0x18]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
mov ecx, edi
call fcn.004794b0
cmp byte [edi + 0x3c], 0
je case.0x479694.6
mov eax, dword fs:[0x2c]
mov ecx, dword [0x571b70]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x571ae4]
cmp eax, dword [ecx + 4]
jg 0x479cab
push dword [0x571ae0]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [edi + 0x50], eax
jmp case.0x479694.6
cmp byte [edi + 0x10], bl
je case.0x479694.6
mov ecx, edi
call fcn.004793a0
jmp case.0x479694.6
cmp esi, 0x31a
jne case.0x479694.6
mov byte [edi + 0x11], bl
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret 0x18
push 0x571adc
call fcn.0047f835
add esp, 4
cmp dword [0x571adc], 0xffffffff
jne 0x4796f6
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x571adc
mov dword [0x571ad8], eax
call fcn.0047f7eb
add esp, 4
jmp 0x4796f6
push 0x7b
push str.C:ent_slave_rootworkspaceVNCConnectBuildsClientsVNC_7.13.xlabelcon_windows_64_rvcoreuilibsuiwinMarkupTextWin.cxx
push str.selStartIdx___selEndIdx
lea ecx, [ebp - 0x160]
call fcn.00428f10
push eax
call fcn.00428f90
push 0x571ae4
call fcn.0047f835
add esp, 4
cmp dword [0x571ae4], 0xffffffff
jne 0x479c06
push 0x7f01
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x571ae4
mov dword [0x571ae0], eax
call fcn.0047f7eb
add esp, 4
jmp 0x479c06