Function at 0x475c80
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
cmp word [rdx + 0x18], 9
mov r14, r8
mov r13, rdx
mov rdi, rcx
jne 0x475cc9
mov rax, qword [rcx + 0xa8]
cmp qword [rdx], rax
jne 0x475cc9
mov rcx, qword [rcx + 0x58]
mov rax, qword [rcx]
call qword [rax]
xor al, al
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
mov r12w, ax
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa3
mov si, ax
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, InitCommonControls
mov r15w, ax
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
mov bp, ax
mov qword [r14], rbx
movzx edx, word [r13 + 0x18]
shr ebp, 0xf
and bpl, 1
cmp dx, 0x30
jb 0x475d63
cmp dx, 0x39
ja 0x475d63
cmp r15b, bl
jne 0x475d41
cmp r12b, bl
je 0x475d63
movzx edx, dx
mov rcx, rdi
sub edx, 0x30
cmp bpl, bl
je 0x475d59
call fcn.004699b8
jmp 0x476115
call fcn.0046aa7c
jmp 0x476115
cmp dx, 0x71
je 0x475d6f
cmp dx, 0x70
jne 0x475d96
cmp r12b, bl
je 0x475d96
cmp sil, bl
jne 0x475d96
cmp bpl, bl
jne 0x475d96
mov rcx, qword [rdi + 0x58]
cmp dx, 0x70
mov rax, qword [rcx]
setne bl
mov edx, ebx
call qword [rax + VariantCopyInd]
jmp 0x476115
cmp dx, 0x78
jne 0x475db7
cmp r12b, bl
jne 0x475db7
cmp sil, bl
jne 0x475db7
cmp bpl, bl
jne 0x475db7
lea rcx, [0x004d0780]
call fcn.0044a594
movzx ecx, word [r13 + 0x18]
mov r14, 0xffffffffffffffff
cmp cx, 0x72
jb 0x475e06
cmp cx, 0x7b
ja 0x475e06
cmp sil, bl
je 0x475e06
lea r8, [0x004a2748]
mov eax, ebx
mov rdx, r8
cmp word [rdx], cx
je 0x475df3
inc eax
add rdx, 8
cmp eax, 5
jb 0x475de0
mov eax, r14d
cmp eax, ebx
jl 0x475e06
cdqe
mov rcx, rdi
mov edx, dword [r8 + rax*8 + 4]
call fcn.0047d5ac
movzx ecx, word [r13 + 0x18]
cmp ecx, 0x52
jg 0x475fda
je 0x475fc4
cmp ecx, 0x28
jg 0x475ee4
je 0x475ece
sub ecx, 8
je 0x475ec1
sub ecx, 8
je 0x475e95
sub ecx, 0x12
je 0x475e75
sub ecx, 3
je 0x475e4d
dec ecx
je 0x475e61
dec ecx
jne 0x475cb6
cmp r12b, bl
je 0x475ece
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x475cb6
cmp r12b, bl
je 0x475ece
mov rcx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp 0x475cb6
cmp sil, bl
je 0x475cb6
cmp r12b, bl
jne 0x475cb6
cmp bpl, bl
jne 0x475cb6
jmp 0x476115
mov rcx, qword [rdi + 0xa8]
mov r9d, 1
mov r8, r14
mov edx, 0x100c
mov byte [rdi + 0x204], bl
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi + 0x208], eax
jmp 0x475cb6
mov rcx, rdi
call fcn.0046b550
jmp 0x476115
cmp bpl, bl
je 0x475cb6
mov rcx, rdi
call fcn.0047c5bc
jmp 0x475cb6
cmp ecx, 0x2d
je 0x475f83
cmp ecx, 0x2e
je 0x475f70
cmp ecx, 0x30
jle 0x475cb6
cmp ecx, 0x34
jle 0x475f57
cmp ecx, 0x41
je 0x475f3f
cmp ecx, 0x43
je 0x475f29
cmp ecx, 0x4e
jne 0x475cb6
cmp sil, bl
je 0x475cb6
mov rcx, rdi
call fcn.0047bf38
jmp 0x476115
cmp sil, bl
je 0x475cb6
mov rcx, rdi
call fcn.004773d0
jmp 0x476115
cmp sil, bl
je 0x475cb6
mov dl, 1
mov rcx, rdi
call fcn.0047cbec
jmp 0x476115
cmp sil, bl
je 0x475cb6
lea edx, [rcx - 0x31]
mov rcx, rdi
call fcn.00461858
jmp 0x476115
cmp bpl, bl
mov rcx, rdi
sete dl
call fcn.0047ab5c
jmp 0x476115
cmp r12b, bl
jne 0x475cb6
cmp sil, bl
je 0x475f98
cmp bpl, bl
jne 0x475f9d
jmp 0x475f32
cmp bpl, bl
je 0x475fab
cmp sil, bl
jne 0x475cb6
jmp 0x47609d
cmp byte [rdi + 0xdb], bl
je 0x475cb6
mov rcx, rdi
call fcn.0047c6c4
jmp 0x476115
cmp sil, bl
je 0x475cb6
mov rcx, rdi
call fcn.00475b74
jmp 0x476115
cmp ecx, 0x71
jg 0x4760cc
je 0x4760a7
sub ecx, 0x56
je 0x476094
sub ecx, 2
je 0x47607e
sub ecx, 2
je 0x476068
sub ecx, 0x10
je 0x47605b
dec ecx
je 0x476026
cmp ecx, 2
jne 0x475cb6
xor edx, edx
cmp r12b, bl
mov rcx, rdi
jne 0x476030
cmp bpl, bl
je 0x476051
jmp 0x475f4d
cmp r12b, bl
je 0x47603a
mov dl, 1
mov rcx, rdi
call fcn.0047c940
jmp 0x476115
cmp bpl, bl
jne 0x475f48
cmp sil, bl
jne 0x476115
mov dl, 1
mov rcx, rdi
call fcn.0047cde0
jmp 0x476115
mov rcx, rdi
call fcn.0047cc14
jmp 0x476115
cmp sil, bl
je 0x475cb6
mov rcx, rdi
call fcn.0047a3c4
jmp 0x476115
cmp sil, bl
je 0x475cb6
mov rcx, rdi
call fcn.0045fde8
jmp 0x476115
cmp sil, bl
je 0x475cb6
mov rcx, rdi
call fcn.0045fde8
jmp 0x476115
cmp r12b, bl
jne 0x475cb6
cmp sil, bl
jne 0x475cb6
cmp bpl, bl
jne 0x475cb6
mov rcx, rdi
call fcn.0047a12c
jmp 0x476115
sub ecx, 0x72
je 0x47619c
dec ecx
je 0x47617a
dec ecx
je 0x476157
dec ecx
je 0x476141
dec ecx
je 0x47611c
cmp ecx, 5
jne 0x475cb6
cmp r12b, bl
je 0x475cb6
cmp sil, bl
jne 0x475cb6
cmp bpl, bl
jne 0x475cb6
mov rcx, rdi
call fcn.0046b398
mov al, 1
jmp 0x475cb8
cmp r12b, bl
jne 0x475cb6
cmp sil, bl
jne 0x475cb6
cmp bpl, bl
jne 0x475cb6
mov rcx, rdi
call fcn.0047b93c
jmp 0x476115
cmp r12b, bl
jne 0x475cb6
cmp sil, bl
jne 0x475cb6
mov dl, 1
jmp 0x47616b
cmp r12b, bl
jne 0x475cb6
cmp sil, bl
jne 0x475cb6
xor edx, edx
mov rcx, qword [rdi + 0x58]
mov r8b, bpl
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x476115
cmp r12b, bl
jne 0x475cb6
cmp sil, bl
jne 0x475cb6
cmp bpl, bl
mov rcx, rdi
jne 0x475f1f
mov dl, 1
jmp 0x4761bc
cmp r12b, bl
jne 0x475cb6
cmp sil, bl
jne 0x475cb6
cmp bpl, bl
jne 0x475cb6
xor edx, edx
mov rcx, rdi
call fcn.00473718
jmp 0x476115