Function at 0x470120
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov al, 5
mov byte [esi + 0x3ac], al
mov byte [esi + 0x3c4], al
mov eax, dword [esi]
xor ebx, ebx
push edi
mov dword [esi + 0x3cc], ebx
call dword [eax + 0xc]
mov ecx, esi
call fcn.00526820
movzx ebp, byte [esi + 0x3ac]
movzx ecx, byte [esi + 0x3c4]
mov dword [esi + 4], ebx
mov edx, dword [0x7085a0]
shl ecx, 4
push 0x100
sub edx, ecx
add ebp, 2
push 0x200
shl ebp, 4
sub edx, ebp
push str.chat.tga
sub edx, 0x9c
push str.data_interface
lea ecx, [esi + 0x2c]
mov dword [esi + 8], edx
mov dword [esi + 0xc], 0x200
mov dword [esi + 0x10], 0x80
call fcn.005497a0
push 0x10
push 0x10
push str.chat_check.tga
push str.data_interface
lea ecx, [esi + 0x6c]
call fcn.005497a0
push 0x40
push 0x80
push str.chat_icon.tga
push str.data_interface
lea ecx, [esi + 0x3c]
call fcn.005497a0
push ebx
push 0x3f000000
push 0x3ec00000
push 0x3e000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3e000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3e000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3e000000
push ebx
push 0x3e000000
push ebx
push 0x3e000000
push ebx
push 1
push 0x100
push 0x200
mov dword [0x864e00], ebx
push str.chat.tga
mov ecx, 0x41
xor eax, eax
lea edi, [esi + 0x88]
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
push ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x18c], ebx
push 0x16
push 0x40
push 0x20
push 0x40
push 0xf
push ebx
push 0xf
push ebx
lea ecx, [esi + 0x3b24]
call fcn.00528830
push ebx
push 0x3f300000
push 0x3f200000
push 0x3e000000
push 0x3dc00000
push 0x3f300000
push 0x3f200000
push 0x3dc00000
push 0x3d800000
push 0x3f300000
push 0x3f200000
push 0x3dc00000
push 0x3d800000
push 0x3f300000
push 0x3f200000
push 0x3d800000
push 0x3d000000
push 0x3f300000
push 0x3f200000
push 0x3d000000
push ebx
push 1
push 0x100
push 0x200
push str.chat.tga
push ebx
push 0x10
push 0x10
push 0x10
push 0x10
push 0xf
push ebx
push 0xf
push ebx
lea ecx, [esi + 0x40fc]
call fcn.00528830
lea ecx, [esi + 0x46d4]
mov byte [esi + 0x46e0], bl
mov dword [esi + 0x46ec], ebx
mov byte [esi + 0x46e1], bl
mov dword [esi + 0x46f0], 0xffffffff
mov byte [esi + 0x46e2], bl
mov byte [esi + 0x46e3], bl
mov byte [esi + 0x46e4], bl
call fcn.004ce800
push ebx
push 0x40800000
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3ec00000
push 0x3f000000
push ebx
xor eax, eax
push 0x3f000000
mov ecx, 0x41
lea edi, [esi + 0x190]
rep stosd dword es:[edi], eax
push 0x3ec00000
mov ecx, 0x41
lea edi, [esi + 0x294]
rep stosd dword es:[edi], eax
movzx eax, byte [esi + 0x3ac]
push 0x3f800000
mov dword [esi + 0x3c8], ebx
lea edi, [esi + 0x4dc]
push 0x3f000000
push 0x3ec00000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
mov ecx, eax
shl ecx, 4
sub ecx, 6
push ecx
mov edx, dword [esi + 8]
mov dword [esp + 0xbc], ecx
fild dword [esp + 0xbc]
add eax, 2
shl eax, 4
mov ecx, edi
fstp dword [esp]
push 0x41500000
push 0x41980000
push ebx
push 1
push 0x13
push 0xd
push 0x20
push 0x10
push eax
mov eax, dword [esi + 4]
push 0x10
push 4
push 4
push edx
push eax
call fcn.0052c430
push 0xc
mov ecx, edi
call fcn.0052ad50
movzx ecx, byte [esi + 0x3ac]
mov edx, dword [0x7191d8]
add ecx, 2
mov dword [esp + 0x10], ecx
sub esp, 8
mov ecx, edi
fild dword [esp + 0x18]
fstp dword [esp + 4]
fild dword [edx + 0x18]
fstp dword [esp]
call fcn.0052ad90
movzx eax, byte [esi + 0x3ac]
push ebx
push 0x40800000
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
mov dword [esi + 0x2994], eax
movzx eax, byte [esi + 0x3c4]
lea edi, [esi + 0x1738]
push 0x3ec00000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3ec00000
push 0x3f800000
push 0x3f000000
push 0x3ec00000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
mov ecx, eax
shl ecx, 4
sub ecx, 6
push ecx
mov edx, dword [esi + 8]
mov dword [esp + 0xbc], ecx
fild dword [esp + 0xbc]
add eax, 2
shl eax, 4
add ebp, 0xc
fstp dword [esp]
push 0x41500000
push 0x41980000
push ebx
push 1
push 0x13
push 0xd
push 0x20
push 0x10
push eax
mov eax, dword [esi + 4]
push 0x10
push ebp
push 4
push edx
push eax
mov ecx, edi
call fcn.0052c430
push 0xc
mov ecx, edi
call fcn.0052ad50
movzx ecx, byte [esi + 0x3c4]
mov edx, dword [0x7191d8]
add ecx, 4
mov dword [esp + 0x10], ecx
sub esp, 8
mov ecx, edi
fild dword [esp + 0x18]
fstp dword [esp + 4]
fild dword [edx + 0x1c]
fstp dword [esp]
call fcn.0052ad90
movzx eax, byte [esi + 0x3c4]
push ebx
push 0x3f000000
push ebx
push 0x3e800000
push ebx
mov dword [esi + 0x2998], eax
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push ebx
push 0x40
push 0x80
push str.chat_icon.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push ebx
push ebx
push ebx
push ebx
lea ecx, [esi + 0x299c]
call fcn.00528830
push ebx
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push ebx
push 0x40
push 0x80
push str.chat_icon.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push ebx
push ebx
push ebx
push ebx
lea ecx, [esi + 0x2f74]
call fcn.00528830
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
push ebx
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push ebx
push ebx
push ebx
push ebx
lea ecx, [esi + 0x354c]
call fcn.00528830
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xd
call edi
push 0x20
call edi
pop edi
mov dword [esi + 0x46e8], ebx
mov dword [esi + 0x46f4], ebx
mov dword [esi + 0x3d0], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret