Function at 0x4799bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x479fec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jge 0x4799f6
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4d77d8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
cmp eax, dword [edx]
jg 0x479a0b
dec eax
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 1
call fcn.004790e8
mov byte [ebp - 5], 0
mov edx, dword [ebp - 4]
mov edx, dword [edx]
add edx, dword [0x4d77e4]
sub edx, dword [0x4d77ec]
mov eax, dword [0x4d77dc]
call fcn.00420904
mov byte [ebx], 0xde
jmp 0x479a6a
call sub.user32.dll_WaitMessage
call fcn.0046fc28
test al, al
je 0x479a54
call fcn.004207ec
test al, al
je 0x479a3d
call fcn.00420804
mov byte [ebx], al
mov byte [edi], 0x20
cmp byte [ebx], 0
jne 0x479a6a
call fcn.00420804
mov byte [edi], al
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x479a9f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x4d77d8]
cmp eax, dword [edx + 8]
jge 0x479a9f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x4d77d8]
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov dword [0x4d77d4], eax
push ebp
call fcn.0047956c
pop ecx
cmp byte [ebx], 0
je 0x479c0b
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x2d
jg 0x479acd
je 0x479b5c
sub eax, 0x20
je 0x479aed
sub eax, 0xa
je 0x479b8d
dec eax
je 0x479b2b
jmp 0x479c02
sub eax, 0x2f
je 0x479bbe
sub eax, 0xaf
je case.0x479c26.75
dec eax
je 0x479bf4
jmp 0x479c02
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl case.0x479c26.75
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x4d77d8]
cmp eax, dword [edx + 8]
jge case.0x479c26.75
mov eax, dword [0x4d77d4]
mov al, byte [eax + 0x158]
xor al, 1
mov edx, dword [0x4d77d4]
mov byte [edx + 0x158], al
jmp case.0x479c26.75
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl case.0x479c26.75
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x4d77d8]
cmp eax, dword [edx + 8]
jge case.0x479c26.75
mov eax, dword [0x4d77d4]
mov byte [eax + 0x158], 1
jmp case.0x479c26.75
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl case.0x479c26.75
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x4d77d8]
cmp eax, dword [edx + 8]
jge case.0x479c26.75
mov eax, dword [0x4d77d4]
mov byte [eax + 0x158], 0
jmp case.0x479c26.75
mov eax, dword [0x4d77d8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x479bb4
inc eax
xor esi, esi
mov edx, dword [0x4d77d8]
mov edx, dword [edx + 4]
mov edx, dword [edx + esi*4]
mov byte [edx + 0x158], 1
inc esi
dec eax
jne 0x479b9d
call fcn.00478f64
jmp case.0x479c26.75
mov eax, dword [0x4d77d8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x479be5
inc eax
xor esi, esi
mov edx, dword [0x4d77d8]
mov edx, dword [edx + 4]
mov edx, dword [edx + esi*4]
mov byte [edx + 0x158], 0
inc esi
dec eax
jne 0x479bce
call fcn.00478f64
jmp case.0x479c26.75
call sub.user32.dll_WaitMessage
call fcn.004207ec
test al, al
je 0x479bef
jmp case.0x479c26.75
mov byte [ebp - 5], 1
jmp case.0x479c26.75
xor eax, eax
mov al, byte [edi]
cmp eax, 0x4f
jg 0x479c69
je 0x479d49
add eax, 0xffffffc1
cmp eax, 0xe
ja case.0x479c26.64
jmp dword [eax*4 + 0x479c2d]
cmp eax, 0x62
jg 0x479c7d
je 0x479c9e
sub eax, 0x50
je 0x479cb8
dec eax
je 0x479cdb
jmp case.0x479c26.64
sub eax, 0x76
je 0x479d49
sub eax, 0xe
je case.0x479c26.71
jmp case.0x479c26.64
push ebp
xor eax, eax
call fcn.00479788
pop ecx
jmp case.0x479c26.75
push ebp
mov al, 1
call fcn.00479788
pop ecx
jmp case.0x479c26.75
push ebp
call fcn.0047970c
pop ecx
jmp case.0x479c26.75
push ebp
call fcn.0047965c
pop ecx
jmp case.0x479c26.75
mov esi, 1
push ebp
call fcn.0047970c
pop ecx
inc esi
cmp esi, 0xb
jne 0x479cc9
jmp case.0x479c26.75
mov esi, 1
push ebp
call fcn.0047965c
pop ecx
inc esi
cmp esi, 0xb
jne 0x479ce0
jmp case.0x479c26.75
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x479d40
mov eax, dword [0x4d77d8]
mov eax, dword [eax + 8]
dec eax
mov edx, dword [ebp - 4]
cmp eax, dword [edx]
jge 0x479d13
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
jl 0x479d36
inc eax
xor esi, esi
mov edx, dword [0x4d77d8]
mov edx, dword [edx + 4]
mov edx, dword [edx + esi*4]
mov byte [edx + 0x158], 0
inc esi
dec eax
jne 0x479d1f
call fcn.0046ffc0
call fcn.00478f64
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
jmp case.0x479c26.75
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x479d98
mov esi, dword [ebp - 4]
mov esi, dword [esi]
mov eax, dword [0x4d77d8]
mov eax, dword [eax + 8]
dec eax
sub eax, esi
jl 0x479d8e
inc eax
test esi, esi
jl 0x479d8a
mov edx, dword [0x4d77d8]
cmp esi, dword [edx + 8]
jge 0x479d8a
mov edx, dword [0x4d77d8]
mov edx, dword [edx + 4]
mov edx, dword [edx + esi*4]
mov byte [edx + 0x158], 1
inc esi
dec eax
jne 0x479d68
call fcn.0046ffc0
call fcn.00478f64
mov eax, dword [0x4d77d8]
mov eax, dword [eax + 8]
dec eax
mov edx, dword [ebp - 4]
mov dword [edx], eax
jmp case.0x479c26.75
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jge 0x479dbd
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffff
mov eax, dword [0x4d77d8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
cmp eax, dword [edx]
jg 0x479dd1
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x479de9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x4d77d8]
cmp eax, dword [edx + 8]
jne 0x479e0f
call fcn.0046ffc0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
xor edx, edx
call fcn.004790e8
mov edx, dword [0x4d77e8]
mov eax, dword [0x4d77e0]
call fcn.00420904
jmp 0x479f2b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
xor edx, edx
call fcn.004790e8
cmp byte [ebp - 5], 0
jne 0x479f2b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x4d77d8]
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov dword [0x4d77d4], eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4d77d4]
add edx, 0x44
mov ecx, 0x104
call fcn.00405350
lea eax, [ebp - 0x10]
mov edx, dword [0x4d77d4]
add edx, 0x148
mov ecx, 0xe
call fcn.00405350
mov edx, dword [ebp - 4]
mov edx, dword [edx]
add edx, dword [0x4d77e4]
sub edx, dword [0x4d77ec]
mov eax, dword [0x4d77dc]
call fcn.00420904
mov al, 0xe
call fcn.00420a04
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x4d77cc]
call fcn.004053a0
mov ecx, dword [0x4d7808]
sub ecx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405600
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, dword [0x4d77cc]
call fcn.004053ec
mov edx, dword [ebp - 0x14]
mov eax, dword [0x483518]
call fcn.004057bc
call fcn.00403314
call fcn.00402c94
mov edx, dword [ebp - 4]
mov edx, dword [edx]
add edx, dword [0x4d77e4]
sub edx, dword [0x4d77ec]
mov eax, dword [0x4d77dc]
call fcn.00420904
cmp byte [edi], 0x4d
jne 0x479f01
mov eax, dword [ebp - 0xc]
call fcn.00470054
jmp 0x479f2b
cmp byte [edi], 0x4b
jne 0x479f10
mov eax, dword [ebp - 0x10]
call fcn.00470054
jmp 0x479f2b
mov eax, dword [0x4d77d4]
cmp byte [eax + 0x158], 0
je 0x479f23
call fcn.0046ffc0
mov eax, dword [ebp - 0xc]
call fcn.00470338
cmp byte [ebp - 5], 0
je 0x479a42
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x479f52
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x4d77d8]
cmp eax, dword [edx + 8]
je 0x479f52
cmp byte [ebx], 0x1b
jne 0x479f5d
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffff
jmp 0x479fd1
mov edx, dword [ebp - 4]
mov edx, dword [edx]
add edx, dword [0x4d77e4]
sub edx, dword [0x4d77ec]
mov eax, dword [0x4d77dc]
call fcn.00420904
mov al, 0xe
call fcn.00420a04
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x4d77cc]
call fcn.004053a0
mov ecx, dword [0x4d7808]
sub ecx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405600
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, dword [0x4d77cc]
call fcn.004053ec
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x483518]
call fcn.004057bc
call fcn.00403314
call fcn.00402c94
mov al, 0xf
call fcn.00420a04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479ff3
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00405104
ret