Function at 0x468be4
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
cmp word [rdx + 0x18], 9
mov r14, r8
mov r13, rdx
mov rdi, rcx
jne 0x468c2d
mov rax, qword [rcx + 0xa8]
cmp qword [rdx], rax
jne 0x468c2d
mov rcx, qword [rcx + 0x58]
mov rax, qword [rcx]
call qword [rax]
xor al, al
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
mov r12w, ax
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa3
mov si, ax
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, InitCommonControls
mov r15w, ax
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
mov bp, ax
mov qword [r14], rbx
movzx edx, word [r13 + 0x18]
shr ebp, 0xf
and bpl, 1
cmp dx, 0x30
jb 0x468cc7
cmp dx, 0x39
ja 0x468cc7
cmp r15b, bl
jne 0x468ca5
cmp r12b, bl
je 0x468cc7
movzx edx, dx
mov rcx, rdi
sub edx, 0x30
cmp bpl, bl
je 0x468cbd
call fcn.0045c770
jmp 0x469079
call fcn.0045d7c4
jmp 0x469079
cmp dx, 0x71
je 0x468cd3
cmp dx, 0x70
jne 0x468cfa
cmp r12b, bl
je 0x468cfa
cmp sil, bl
jne 0x468cfa
cmp bpl, bl
jne 0x468cfa
mov rcx, qword [rdi + 0x58]
cmp dx, 0x70
mov rax, qword [rcx]
setne bl
mov edx, ebx
call qword [rax + VariantCopyInd]
jmp 0x469079
cmp dx, 0x78
jne 0x468d1b
cmp r12b, bl
jne 0x468d1b
cmp sil, bl
jne 0x468d1b
cmp bpl, bl
jne 0x468d1b
lea rcx, [0x004bb790]
call fcn.0043e800
movzx ecx, word [r13 + 0x18]
mov r14, 0xffffffffffffffff
cmp cx, 0x72
jb 0x468d6a
cmp cx, 0x7b
ja 0x468d6a
cmp sil, bl
je 0x468d6a
lea r8, [0x00491380]
mov eax, ebx
mov rdx, r8
cmp word [rdx], cx
je 0x468d57
inc eax
add rdx, 8
cmp eax, 5
jb 0x468d44
mov eax, r14d
cmp eax, ebx
jl 0x468d6a
cdqe
mov rcx, rdi
mov edx, dword [r8 + rax*8 + 4]
call fcn.004700c8
movzx ecx, word [r13 + 0x18]
cmp ecx, 0x52
jg 0x468f3e
je 0x468f28
cmp ecx, 0x28
jg 0x468e48
je 0x468e32
sub ecx, 8
je 0x468e25
sub ecx, 8
je 0x468df9
sub ecx, 0x12
je 0x468dd9
sub ecx, 3
je 0x468db1
dec ecx
je 0x468dc5
dec ecx
jne 0x468c1a
cmp r12b, bl
je 0x468e32
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x468c1a
cmp r12b, bl
je 0x468e32
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp 0x468c1a
cmp sil, bl
je 0x468c1a
cmp r12b, bl
jne 0x468c1a
cmp bpl, bl
jne 0x468c1a
jmp 0x469079
mov rcx, qword [rdi + 0xa8]
mov r9d, 1
mov r8, r14
mov edx, 0x100c
mov byte [rdi + 0x204], bl
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi + 0x208], eax
jmp 0x468c1a
mov rcx, rdi
call fcn.0045e268
jmp 0x469079
cmp bpl, bl
je 0x468c1a
mov rcx, rdi
call fcn.0046f01c
jmp 0x468c1a
cmp ecx, 0x2d
je 0x468ee7
cmp ecx, 0x2e
je 0x468ed4
cmp ecx, 0x30
jle 0x468c1a
cmp ecx, 0x34
jle 0x468ebb
cmp ecx, 0x41
je 0x468ea3
cmp ecx, 0x43
je 0x468e8d
cmp ecx, 0x4e
jne 0x468c1a
cmp sil, bl
je 0x468c1a
mov rcx, rdi
call fcn.0046e9a8
jmp 0x469079
cmp sil, bl
je 0x468c1a
mov rcx, rdi
call fcn.0046a2a8
jmp 0x469079
cmp sil, bl
je 0x468c1a
mov dl, 1
mov rcx, rdi
call fcn.0046f64c
jmp 0x469079
cmp sil, bl
je 0x468c1a
lea edx, [rcx - 0x31]
mov rcx, rdi
call fcn.00454604
jmp 0x469079
cmp bpl, bl
mov rcx, rdi
sete dl
call fcn.0046d73c
jmp 0x469079
cmp r12b, bl
jne 0x468c1a
cmp sil, bl
je 0x468efc
cmp bpl, bl
jne 0x468f01
jmp 0x468e96
cmp bpl, bl
je 0x468f0f
cmp sil, bl
jne 0x468c1a
jmp 0x469001
cmp byte [rdi + 0xdb], bl
je 0x468c1a
mov rcx, rdi
call fcn.0046f124
jmp 0x469079
cmp sil, bl
je 0x468c1a
mov rcx, rdi
call fcn.00468ad8
jmp 0x469079
cmp ecx, 0x71
jg 0x469030
je 0x46900b
sub ecx, 0x56
je 0x468ff8
sub ecx, 2
je 0x468fe2
sub ecx, 2
je 0x468fcc
sub ecx, 0x10
je 0x468fbf
dec ecx
je 0x468f8a
cmp ecx, 2
jne 0x468c1a
xor edx, edx
cmp r12b, bl
mov rcx, rdi
jne 0x468f94
cmp bpl, bl
je 0x468fb5
jmp 0x468eb1
cmp r12b, bl
je 0x468f9e
mov dl, 1
mov rcx, rdi
call fcn.0046f3a0
jmp 0x469079
cmp bpl, bl
jne 0x468eac
cmp sil, bl
jne 0x469079
mov dl, 1
mov rcx, rdi
call fcn.0046f8fc
jmp 0x469079
mov rcx, rdi
call fcn.0046f674
jmp 0x469079
cmp sil, bl
je 0x468c1a
mov rcx, rdi
call fcn.0046cfa4
jmp 0x469079
cmp sil, bl
je 0x468c1a
mov rcx, rdi
call fcn.004561d0
jmp 0x469079
cmp sil, bl
je 0x468c1a
mov rcx, rdi
call fcn.004561d0
jmp 0x469079
cmp r12b, bl
jne 0x468c1a
cmp sil, bl
jne 0x468c1a
cmp bpl, bl
jne 0x468c1a
mov rcx, rdi
call fcn.0046cc54
jmp 0x469079
sub ecx, 0x72
je 0x469100
dec ecx
je 0x4690de
dec ecx
je 0x4690bb
dec ecx
je 0x4690a5
dec ecx
je 0x469080
cmp ecx, 5
jne 0x468c1a
cmp r12b, bl
je 0x468c1a
cmp sil, bl
jne 0x468c1a
cmp bpl, bl
jne 0x468c1a
mov rcx, rdi
call fcn.0045e0b0
mov al, 1
jmp 0x468c1c
cmp r12b, bl
jne 0x468c1a
cmp sil, bl
jne 0x468c1a
cmp bpl, bl
jne 0x468c1a
mov rcx, rdi
call fcn.0046e43c
jmp 0x469079
cmp r12b, bl
jne 0x468c1a
cmp sil, bl
jne 0x468c1a
mov dl, 1
jmp 0x4690cf
cmp r12b, bl
jne 0x468c1a
cmp sil, bl
jne 0x468c1a
xor edx, edx
mov rcx, qword [rdi + 0x58]
mov r8b, bpl
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x469079
cmp r12b, bl
jne 0x468c1a
cmp sil, bl
jne 0x468c1a
cmp bpl, bl
mov rcx, rdi
jne 0x468e83
mov dl, 1
jmp 0x469120
cmp r12b, bl
jne 0x468c1a
cmp sil, bl
jne 0x468c1a
cmp bpl, bl
jne 0x468c1a
xor edx, edx
mov rcx, rdi
call fcn.004663f4
jmp 0x469079