Function at 0x476e34
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, 0x51404c
mov edx, dword [0x4826b8]
movzx edx, byte [edx]
mov word [0x5055bc], dx
dec eax
mov dword [edi], eax
mov byte [ebp - 5], 1
mov bl, byte [ebp + 8]
jmp 0x47732f
mov eax, dword [edi]
cmp eax, dword [0x514050]
jge 0x476e79
mov eax, dword [edi]
mov dword [0x514050], eax
jmp 0x476e96
mov eax, dword [0x514050]
add eax, dword [0x514054]
cmp eax, dword [edi]
jg 0x476e96
mov eax, dword [edi]
sub eax, dword [0x514054]
inc eax
mov dword [0x514050], eax
cmp dword [edi], 0
jge 0x476ea1
mov dword [edi], 0xffffffff
cmp dword [0x514050], 0
jge 0x476eb1
xor eax, eax
mov dword [0x514050], eax
mov eax, ebx
call fcn.00476b1c
mov bl, 1
cmp dword [edi], 0
jl 0x476ecd
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jg 0x476ed1
xor eax, eax
jmp 0x476ed3
mov al, 1
mov byte [ebp - 6], al
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
call fcn.00471f04
mov byte [esi], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setl byte [ebp - 0xd]
cmp byte [esi], 0
je 0x476fed
xor eax, eax
mov al, byte [esi]
add eax, 0xffffffe0
cmp eax, 0xf
ja case.0x476f10.32
mov al, byte [eax + 0x476f17]
jmp dword [eax*4 + 0x476f27]
cmp byte [ebp - 6], 0
je 0x47732f
mov eax, dword [edi]
mov al, byte [eax + 0x5055e8]
xor al, 1
mov edx, dword [edi]
mov byte [edx + 0x5055e8], al
jmp 0x47732f
cmp byte [ebp - 6], 0
je 0x47732f
mov eax, dword [edi]
mov byte [eax + 0x5055e8], 1
jmp 0x47732f
cmp byte [ebp - 6], 0
je 0x47732f
mov eax, dword [edi]
mov byte [eax + 0x5055e8], 0
jmp 0x47732f
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x47732f
inc eax
mov dword [ebp - 0x14], eax
mov eax, 0x5055e8
mov byte [eax], 1
inc eax
dec dword [ebp - 0x14]
jne 0x476fac
jmp 0x47732f
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x47732f
inc eax
mov dword [ebp - 0x14], eax
mov eax, 0x5055e8
mov byte [eax], 0
inc eax
dec dword [ebp - 0x14]
jne 0x476fd6
jmp 0x47732f
mov byte [ebp - 5], 0
jmp 0x47732f
call fcn.00471f04
mov edx, dword [ebp + 0xc]
mov byte [edx], al
call fcn.0046a418
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x51
jg 0x477066
je 0x4772fd
cmp eax, 0x49
jg 0x47703f
je 0x4772f8
sub eax, 9
je 0x477131
add eax, 0xffffffce
sub eax, 0xc
jb case.0x477091.115
je case.0x477091.132
dec eax
je 0x477108
jmp case.0x477091.120
sub eax, 0x4b
je case.0x477091.115
sub eax, 2
je case.0x477091.115
sub eax, 2
je case.0x477091.118
dec eax
je 0x477131
jmp case.0x477091.120
cmp eax, 0x73
jge 0x477085
sub eax, 0x53
je case.0x477091.115
add eax, 0xfffffff5
sub eax, 8
jb case.0x477091.115
je 0x4770e9
dec eax
sub eax, 3
jb case.0x477091.115
jmp case.0x477091.120
add eax, 0xffffff8d
cmp eax, 0x11
ja case.0x477091.120
jmp dword [eax*4 + 0x477098]
mov byte [ebp - 5], 0
jmp case.0x477091.120
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4770ff
call fcn.00468aec
jmp case.0x477091.120
mov byte [ebp - 5], 0
jmp case.0x477091.120
cmp byte [ebp - 0xd], 0
je 0x47712a
cmp dword [edi], 0
jl 0x47712a
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jle 0x47712a
mov eax, dword [edi]
mov byte [eax + 0x5055e8], 0
dec dword [edi]
jmp case.0x477091.120
cmp byte [ebp - 0xd], 0
je 0x477163
cmp dword [edi], 0
jl 0x477163
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jle 0x477163
mov eax, dword [edi]
cmp byte [eax + 0x5055e8], 0
jne 0x477163
call fcn.0046a5d8
mov eax, dword [edi]
mov byte [eax + 0x5055e8], 1
inc dword [edi]
cmp byte [ebp - 0xd], 0
je case.0x477091.120
cmp dword [edi], 0
jl case.0x477091.120
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jle case.0x477091.120
mov eax, dword [edi]
mov byte [eax + 0x5055e8], 1
jmp case.0x477091.120
cmp byte [ebp - 0xd], 0
je 0x4771d8
mov eax, dword [edi]
cmp eax, 0
jl 0x4771d8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x5055e8
mov dword [ebp - 0x18], eax
cmp dword [edi], 0
jl 0x4771cc
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jle 0x4771cc
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
dec dword [ebp - 0xc]
dec dword [ebp - 0x18]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4771b3
call fcn.0046a5d8
xor eax, eax
mov dword [edi], eax
jmp case.0x477091.120
cmp byte [ebp - 0xd], 0
je case.0x477091.120
mov eax, dword [edi]
cmp eax, 0
jl 0x47722a
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x5055e8
mov dword [ebp - 0x1c], eax
cmp dword [edi], 0
jl 0x47721e
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jle 0x47721e
mov eax, dword [ebp - 0x1c]
mov byte [eax], 1
dec dword [ebp - 0xc]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x477205
call fcn.0046a5d8
xor eax, eax
mov dword [edi], eax
jmp case.0x477091.120
cmp byte [ebp - 0xd], 0
je 0x477284
mov eax, dword [edi]
push eax
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
pop edx
sub eax, edx
jl 0x477284
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0x5055e8
mov dword [ebp - 0x20], eax
cmp dword [edi], 0
jl 0x47727c
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jle 0x47727c
mov eax, dword [ebp - 0x20]
mov byte [eax], 1
inc dword [ebp - 0x20]
dec dword [ebp - 0x14]
jne 0x477263
call fcn.0046a5d8
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov dword [edi], eax
jmp case.0x477091.120
cmp byte [ebp - 0xd], 0
je case.0x477091.120
mov eax, dword [edi]
push eax
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
pop edx
sub eax, edx
jl 0x4772e4
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0x5055e8
mov dword [ebp - 0x24], eax
cmp dword [edi], 0
jl 0x4772dc
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jle 0x4772dc
mov eax, dword [ebp - 0x24]
mov byte [eax], 0
inc dword [ebp - 0x24]
dec dword [ebp - 0x14]
jne 0x4772c3
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov dword [edi], eax
call fcn.0046a5d8
jmp case.0x477091.120
sub dword [edi], 0xa
jmp case.0x477091.120
add dword [edi], 0xa
cmp dword [edi], 0
jge 0x477310
mov dword [edi], 0xffffffff
call fcn.0046a5d8
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [edi]
jg 0x47732f
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [edi], eax
call fcn.0046a5d8
cmp byte [ebp - 5], 0
jne 0x476e66
mov eax, dword [0x4826b8]
mov dl, byte [0x5055bc]
mov byte [eax], dl
mov eax, dword [edi]
inc eax
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jl 0x477367
mov eax, dword [0x5055e0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, dword [ebp - 4]
cmp eax, dword [edx]
jge 0x47736b
xor ebx, ebx
jmp 0x47736d
mov bl, 1
call fcn.00454e54
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8