Function at 0x47d827
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push 0x154
mov eax, 0x5101b8
call fcn.004f41e2
mov ebx, ecx
lea eax, [ebp + 0x18]
mov byte [ebp - 0x121], 1
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.0047ea00
test al, al
jne 0x47d86f
test ebx, ebx
je 0x47d865
cmp dword [ebx + 0x1ab4], 0
jne 0x47e40e
mov edi, dword [ebp + 8]
xor al, al
jmp 0x47e417
mov eax, dword [ebx + 0x1ab4]
mov ecx, 0x202
mov esi, dword [ebp + 0x18]
test eax, eax
mov edi, dword [ebp + 8]
setne byte [ebp - 0x122]
mov dword [ebx + 0x19fe], esi
test eax, eax
jne 0x47d8dc
cmp edi, 0x207
je 0x47d8cf
cmp edi, 0x205
je 0x47d8cf
cmp edi, 0x204
je 0x47d8cf
cmp edi, 0x203
je 0x47d8cf
cmp edi, ecx
je 0x47d8cf
cmp edi, 0x201
je 0x47d8cf
cmp dword [ebx + 0x1ad0], eax
jne 0x47d8cf
cmp edi, 0x208
jne 0x47d8dc
mov ecx, ebx
call fcn.00481e99
mov byte [ebp - 0x122], al
mov ecx, dword [0x5a22a0]
push 1
call fcn.0041f0ec
mov ecx, dword [0x5a22a0]
push 0
mov dword [ebp - 0x144], eax
call fcn.0041f0ec
cmp byte [ebp - 0x122], 0
mov dword [ebp - 0x134], eax
je 0x47dae1
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10fb6], 0
je 0x47dae1
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 0x26e9c], 0
jne 0x47dae1
cmp dword [ebp - 0x144], 0
jne 0x47dae1
cmp dword [ebx + 0x1ab4], 0
jne 0x47dae1
cmp edi, 0x201
jne 0x47d987
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004e6ac5
pop ecx
pop ecx
mov dword [ebx + 0x1ad8], eax
mov dword [ebx + 0x1adc], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x1ad4], eax
mov dword [ebx + 0x1ad0], 1
jmp 0x47db09
cmp dword [ebx + 0x1ad0], 0
je 0x47db09
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x47d9b5
mov dword [ebx + 0x1ad0], 2
jmp 0x47db09
mov ecx, dword [0x5a2298]
call fcn.00443216
mov ecx, dword [0x5a2298]
mov dword [ebp - 0x128], eax
call fcn.0044308a
mov ecx, dword [ebp - 0x128]
cmp ecx, eax
mov edx, dword [ebp + 0x14]
cmovl ecx, eax
mov eax, dword [ebp + 0x10]
sub edx, dword [ebx + 0x1adc]
sub eax, dword [ebx + 0x1ad8]
mov dword [ebp - 0x128], edx
cmp edi, 0x200
jne 0x47da60
cmp dword [ebx + 0x1ad0], 1
jne 0x47db09
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jl 0x47da16
mov esi, edi
jmp 0x47da2e
mov eax, dword [ebp - 0x128]
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jl 0x47db09
mov esi, 0x100
mov ecx, dword [0x5a22a0]
push esi
call fcn.0040ee67
push dword [ebx + 0x1adc]
or dword [ebx + 0x1ab4], esi
push dword [ebx + 0x1ad8]
push dword [ebp + 0xc]
push 0x201
mov ecx, ebx
call fcn.0047e430
jmp 0x47e411
cmp edi, 0x203
jne 0x47db09
cmp dword [ebx + 0x1ad0], 2
jne 0x47db09
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jge 0x47db09
mov eax, dword [ebp - 0x128]
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jge 0x47db09
test dword [ebx + 0x1ab4], 0x300
jne 0x47daab
mov dword [ebx + 0x1ab4], 0x204
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x203
call fcn.0047e430
mov eax, dword [ebx + 0x1ab4]
test eax, eax
je 0x47dad5
or eax, 0x400
mov dword [ebx + 0x1ab4], eax
and dword [ebx + 0x1ad0], 0
jmp 0x47e411
cmp dword [ebx + 0x1ad0], 0
je 0x47db09
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub edi, dword [ebx + 0x1ad4]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
cmp edi, eax
ja 0x47db09
and dword [ebx + 0x1ad0], 0
cmp byte [ebp - 0x122], 0
mov edi, dword [ebp + 8]
je 0x47dd70
cmp edi, 0x201
je 0x47db3a
cmp edi, 0x202
jne 0x47dbfc
test byte [ebx + 0x1ab4], 8
jne 0x47dc3f
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10fb6], 0
je 0x47dbfc
cmp dword [ebx + 0x1ab4], 0
je 0x47dbfc
mov ecx, ebx
call fcn.00481d5b
test al, al
jne 0x47dbfc
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
call fcn.00481d9d
mov byte [ebp - 0x123], al
test al, al
jne 0x47db8c
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push eax
call fcn.004799b5
cmp edi, 0x201
jne 0x47dbc3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004e6ac5
pop ecx
pop ecx
mov dword [ebx + 0x1ad8], eax
mov dword [ebx + 0x1adc], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x1ad4], eax
mov dword [ebx + 0x1ad0], 1
mov ecx, 0x202
cmp edi, ecx
je 0x47dbe6
cmp byte [ebp - 0x123], 0
jne 0x47dbfc
cmp edi, 0x201
jne 0x47dc21
cmp dword [ebp - 0x134], 0
jne 0x47dc04
xor eax, eax
cmp edi, 0x201
cmove eax, ecx
mov dword [ebx + 0x1ae0], eax
jmp 0x47e411
cmp edi, 0x201
jne 0x47dc21
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x201
call fcn.0047e430
test al, al
jne 0x47e411
cmp edi, 0x200
jne 0x47dc3f
cmp dword [ebx + 0x1ab4], 0
jne 0x47dc3f
cmp dword [ebp - 0x134], 0
jne 0x47e411
mov eax, dword [0x5a23ec]
mov al, byte [eax + 0x10fcc]
cmp al, 2
je 0x47dc63
cmp al, 3
jne 0x47dd0a
cmp dword [ebx + 0x1ab4], 0
jne 0x47dd0a
cmp edi, 0x204
je 0x47dc77
cmp edi, 0x205
jne 0x47dd0a
mov ecx, dword [ebx + 0x4c]
push 0
call fcn.0049715d
test al, al
jne 0x47dc98
mov eax, dword [ebx + 0x4c]
mov byte [ebp - 0x128], 1
cmp dword [eax + 0x26e9c], 0
je 0x47dc9f
mov byte [ebp - 0x128], 0
push dword [ebp - 0x128]
mov ecx, dword [0x5a23ec]
push 0x7d9
call fcn.0046012f
test al, al
je 0x47dd0a
cmp edi, 0x205
jne 0x47e411
xor ecx, ecx
cmp dword [ebx + 0x1ab4], ecx
je 0x47dcec
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10fb6], cl
je 0x47dcec
push 1
push 1
mov ecx, ebx
call fcn.00478833
jmp 0x47e411
push ecx
push ecx
push ecx
push ecx
mov ecx, ebx
call fcn.004799b5
mov ecx, dword [ebx + 0x4c]
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0048cb64
jmp 0x47e411
mov eax, dword [0x5a23ec]
mov al, byte [eax + 0x10fcd]
cmp al, 2
je 0x47dd2a
cmp al, 3
jne 0x47dd70
cmp dword [ebx + 0x1ab4], 0
jne 0x47ddbb
cmp edi, 0x207
je 0x47dd3a
cmp edi, 0x208
jne 0x47dd70
mov ecx, dword [ebx + 0x4c]
push 0
call fcn.0049715d
mov ecx, dword [0x5a23ec]
neg al
sbb al, al
inc al
movzx eax, al
push eax
push 0x7d9
call fcn.0046012f
test al, al
je 0x47dd70
cmp edi, 0x208
jne 0x47e411
jmp 0x47dcf7
cmp dword [ebx + 0x1ab4], 0
jne 0x47ddbb
mov ecx, dword [ebx + 0x4c]
push 0
call fcn.004896d0
test al, al
je 0x47ddbb
cmp edi, 0x200
je 0x47dda8
cmp edi, 0x201
je 0x47dda8
mov eax, 0x202
cmp edi, eax
je 0x47dda8
cmp edi, 0x203
jne 0x47ddbb
push 1
push esi
push edi
mov ecx, ebx
call fcn.0047efff
test al, al
jne 0x47e411
mov ecx, dword [ebx + 0x4c]
call fcn.00497179
mov byte [ebp - 0x122], al
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10fa9], 0
jne 0x47dde7
mov ecx, dword [ebx + 0x4c]
call fcn.00497a10
test al, al
je 0x47dde7
mov al, 1
jmp 0x47dde9
xor al, al
xor cl, cl
mov byte [ebp - 0x123], al
cmp edi, 0x20a
je 0x47de01
cmp edi, 0x20e
jne 0x47de2c
mov dl, byte [ebp - 0x122]
test dl, dl
je 0x47de32
test al, al
je 0x47de32
cmp byte [ebx + 0x1b78], 0
je 0x47de97
cmp dword [ebx], 1
jne 0x47de32
mov eax, dword [ebx + 0x4c]
mov ecx, dword [eax]
add ecx, 0xc
call fcn.004cf171
mov cl, al
mov dl, byte [ebp - 0x122]
cmp byte [ebx + 0x1b78], 0
je 0x47de97
test cl, cl
jne 0x47de69
cmp byte [ebp - 0x123], cl
je 0x47de69
test dl, dl
je 0x47de69
cmp dword [ebx], 1
jne 0x47de69
cmp edi, 0x20a
je 0x47de60
cmp edi, 0x20e
jne 0x47de97
cmp dword [ebx + 0x1ab4], 0
je 0x47deaf
cmp edi, 0x20a
je 0x47e411
cmp edi, 0x20e
je 0x47e411
mov ecx, ebx
call fcn.00481ae4
test al, al
jne 0x47de97
cmp dword [ebx], 1
setne al
jmp 0x47e417
cmp dword [ebx + 0x1ab4], 0
je 0x47deaf
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
jmp 0x47da54
cmp dword [ebx], 1
jne 0x47e3e1
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x11001], 0
je 0x47e3e1
cmp edi, 0x204
jne 0x47def5
movzx eax, word [ebx + 0x1afe]
movsx ecx, ax
movsx eax, word [ebp + 0x1a]
dec ecx
cmp eax, ecx
jne 0x47e3e1
mov ecx, dword [ebx + 0x4c]
call fcn.004971e3
test al, al
jne 0x47df23
mov eax, 0x200
cmp edi, eax
je 0x47df0a
cmp edi, 0x205
jne 0x47e3e1
cmp byte [ebx + 0x1b8d], 0
je 0x47e3f1
cmp edi, 0x204
jne 0x47e1ff
lea ecx, [ebp - 0x160]
call fcn.004404f9
xor eax, eax
mov ecx, ebx
push eax
push 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x13c]
push esi
push eax
call fcn.00477d97
lea ecx, [ebp - 0x154]
call fcn.00477032
movsx eax, word [ebp - 0x13a]
lea ecx, [ebp - 0x160]
push ecx
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x134]
push ecx
push eax
lea eax, [ebp - 0x154]
mov ecx, ebx
push eax
call fcn.0047b0ce
test al, al
je 0x47e156
xor edx, edx
cmp dword [ebp - 0x128], 1
push 2
pop esi
jle 0x47e156
mov eax, dword [ebp - 0x134]
push 0x31
pop ecx
cmp word [eax], cx
jne 0x47e156
and dword [ebp - 0x12c], edx
add eax, 4
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], 0xfffffff8
mov dword [ebp - 0x134], 0x30
mov ecx, dword [ebp - 0x138]
movzx edi, word [ecx - 2]
cmp di, word [ebp - 0x134]
mov dword [ebp - 0x130], edi
mov edi, dword [ebp + 8]
jb 0x47e133
push 0x39
pop eax
cmp word [ebp - 0x130], ax
mov eax, dword [ebp - 0x13c]
ja 0x47e133
cmp esi, 9
jg 0x47e0a3
mov ecx, dword [ebp - 0x130]
movzx ecx, cx
sub ecx, 0x30
cmp ecx, esi
mov ecx, dword [ebp - 0x138]
jne 0x47e133
push 0x20
pop eax
cmp word [ecx - 4], ax
mov eax, dword [ebp - 0x13c]
jne 0x47e133
movzx edi, word [ecx]
cmp di, word [ebp - 0x134]
mov dword [ebp - 0x130], edi
mov edi, dword [ebp + 8]
jb 0x47e077
push 0x39
pop ecx
cmp word [ebp - 0x130], cx
mov ecx, dword [ebp - 0x138]
jbe 0x47e133
movsx edi, ax
cmp edi, dword [ebp - 0x12c]
mov dword [ebp - 0x130], edi
mov edi, dword [ebp + 8]
jg 0x47e126
cmp dword [ebp - 0x130], edx
jl 0x47e126
lea ecx, [esi + 0x6e]
jmp 0x47e17a
cmp dword [ebp - 0x140], 2
jg 0x47e176
push 0x31
pop eax
cmp word [ebp - 0x130], ax
mov eax, dword [ebp - 0x13c]
jne 0x47e133
movzx ecx, word [ecx]
sub ecx, 0x30
cmp ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x138]
jne 0x47e133
push 0x20
pop edi
cmp word [ecx - 4], di
mov edi, dword [ebp + 8]
jne 0x47e133
movzx edi, word [ecx + 2]
cmp di, word [ebp - 0x134]
mov dword [ebp - 0x130], edi
mov edi, dword [ebp + 8]
jb 0x47e10a
push 0x39
pop eax
cmp word [ebp - 0x130], ax
mov eax, dword [ebp - 0x13c]
jbe 0x47e133
movsx edi, ax
cmp edi, dword [ebp - 0x12c]
mov dword [ebp - 0x130], edi
mov edi, dword [ebp + 8]
jg 0x47e126
cmp dword [ebp - 0x130], edx
jge 0x47e171
mov edx, dword [ebp - 0x12c]
inc esi
inc dword [ebp - 0x140]
add ecx, 2
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp - 0x12c]
inc ecx
mov dword [ebp - 0x12c], ecx
inc ecx
cmp ecx, dword [ebp - 0x128]
jl 0x47dfe0
lea ecx, [ebp - 0x154]
call fcn.00477212
lea ecx, [ebp - 0x160]
call fcn.004e6c72
jmp 0x47e3f1
lea ecx, [esi + 0x6e]
jmp 0x47e179
push 0x7b
pop ecx
inc edx
mov dword [ebp - 0x128], ecx
test ecx, ecx
je 0x47e156
mov dword [ebx + 0x1b8e], eax
lea esi, [ebx + 0x1b94]
movsx eax, word [ebp - 0x13a]
push eax
xor eax, eax
mov byte [ebx + 0x1b8d], 1
cmp ecx, 0x70
mov ecx, dword [ebx + 0x4c]
setne al
inc edx
add eax, edx
mov ecx, dword [ecx]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.004db561
mov ecx, eax
push esi
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebx + 0x4c]
mov dword [esi + 4], eax
call fcn.004888cf
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x154]
mov dword [ebx + 0x1b9c], eax
call fcn.00477212
lea ecx, [ebp - 0x160]
call fcn.004e6c72
jmp 0x47e411
cmp edi, 0x205
jne 0x47e3db
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x128], eax
mov esi, 0x80
mov edi, dword [ebp - 0x128]
xor eax, eax
mov dword [ebp - 0x12c], eax
xor ecx, ecx
test byte [eax*4 + 0x55374c], 8
mov word [ebp - 0x110], cx
je 0x47e255
push str.Ctrl_
push esi
lea eax, [ebp - 0x110]
push eax
call fcn.004019cd
mov eax, dword [ebp - 0x12c]
test byte [eax*4 + 0x55374c], 2
je 0x47e277
push str.Alt_
push esi
lea eax, [ebp - 0x110]
push eax
call fcn.004019cd
mov eax, dword [ebp - 0x12c]
test byte [eax*4 + 0x55374c], 4
je 0x47e299
push str.RCtrl_
push esi
lea eax, [ebp - 0x110]
push eax
call fcn.004019cd
mov eax, dword [ebp - 0x12c]
test byte [eax*4 + 0x55374c], 1
je 0x47e2bb
push str.RAlt_
push esi
lea eax, [ebp - 0x110]
push eax
call fcn.004019cd
mov eax, dword [ebp - 0x12c]
test byte [eax*4 + 0x55374c], 0x10
je 0x47e2d7
push str.Shift_
push esi
lea eax, [ebp - 0x110]
push eax
call fcn.004019cd
mov eax, dword [ebx + 0x1b9c]
sub eax, 0x6f
push eax
push 0x554830
push 8
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x110]
lea eax, [ecx + eax*2]
push eax
call fcn.004e22e7
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x110]
add esp, 0x10
test al, 3
lea esi, [eax + 1]
push ecx
push esi
push 0
pop eax
push 0x40
pop ecx
cmove eax, ecx
push eax
push edi
call dword [sym.imp.USER32.dll_AppendMenuW]
mov eax, esi
mov esi, 0x80
mov dword [ebp - 0x12c], eax
cmp eax, 0xc
jb 0x47e22a
mov edx, dword [ebx + 0x1b94]
mov ecx, dword [ebx + 0x1b98]
lea eax, [edx - 1]
mov dword [ebp - 0x120], eax
lea eax, [ecx - 1]
mov dword [ebp - 0x11c], eax
lea eax, [edx + 1]
mov dword [ebp - 0x118], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x120]
push eax
push dword [0x5a22a4]
push ecx
mov ecx, dword [0x5a22a0]
push edx
push 0x122
push dword [ebp - 0x128]
mov ecx, dword [ecx + 0x3e60]
push 5
call fcn.0045ccbd
push dword [ebp - 0x128]
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov edi, dword [ebp + 8]
lea eax, [esi - 1]
cmp eax, 0xb
ja 0x47e3d2
movzx eax, word [ebx + 0x1b9c]
mov ecx, dword [ebx + 0x4c]
push 0xffffffffffffffff
push 0
push dword [esi*4 + 0x553748]
push eax
call fcn.0048d8de
mov byte [ebx + 0x1b8d], 0
jmp 0x47e411
cmp edi, eax
je 0x47e411
jmp 0x47e3f1
cmp byte [ebx + 0x1b8d], 0
je 0x47e3f1
mov byte [ebx + 0x1b8d], 0
cmp dword [ebp - 0x144], 0
je 0x47de8c
cmp edi, 0x200
jne 0x47de8c
mov al, 1
jmp 0x47e417
mov edi, dword [ebp + 8]
mov al, byte [ebp - 0x121]
cmp edi, dword [ebx + 0x1ae0]
jne 0x47e428
and dword [ebx + 0x1ae0], 0
mov al, 1
call fcn.004f418c
ret 0x14