Function at 0x44e9d6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x24]
xor edx, edx
push ebx
mov ebx, dword [ebp + 0xc]
inc edx
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebx + 0x42], edi
mov dword [ebx + 0x46], esi
cmp dword [0x49de80], 0xbb9
cmovne ecx, edx
xor eax, eax
cmp ecx, 5
sete al
push eax
push edx
push 0
push esi
push edi
push dword [ebp + 8]
call fcn.004214a3
xor eax, eax
mov dword [0x49d5dc], eax
mov dword [0x49d614], eax
mov dword [0x49d5e0], eax
lea eax, [ebp + 0x24]
push eax
push edi
push 0x65
push dword [ebx + 0x26]
call fcn.0043c164
test eax, eax
jne 0x44ec7e
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp edi, dword [ebx + 0xde]
jne 0x44eb0a
test esi, esi
jne 0x44eb0a
mov edx, 0x49e3a0
lea esi, [ecx + 0x1c]
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ecx + 0x54]
add eax, dword [ebx + 0x72]
add eax, dword [ecx + 0x18]
push eax
mov eax, dword [ebx + 0x6e]
sub eax, dword [ecx + 0x14]
push eax
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [0x49e378], edx
mov dword [0x49e37c], ecx
mov dword [0x49d5e8], edx
mov dword [0x49d5ec], ecx
mov eax, dword [ebx + 0x7a]
sub eax, dword [0x49e3a0]
add eax, edx
mov dword [0x49e390], eax
mov eax, dword [ebx + 0x7e]
sub eax, dword [0x49e3a4]
add eax, ecx
mov dword [0x49e394], eax
mov eax, dword [ebx + 0x56]
sub eax, dword [ebx + 0x82]
sub eax, dword [0x49e3a8]
add eax, edx
mov dword [0x49e398], eax
mov eax, dword [ebx + 0x5a]
sub eax, dword [ebx + 0x86]
sub eax, dword [0x49e3ac]
add eax, ecx
mov dword [0x49e390], edx
mov dword [0x49e39c], eax
mov dword [0x49e398], edx
mov dword [0x49cd90], 0xf
jmp 0x44ec64
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
push 0x11
call esi
mov esi, dword [ebp + 0x1c]
push esi
push dword [ebp - 4]
shr eax, 8
movzx ebx, al
call fcn.0041e296
movzx edx, di
movzx ecx, si
shl edx, 0x10
or edx, ecx
mov dword [ebp + 0x1c], eax
mov ecx, dword [ebp + 0x20]
lea esi, [eax + 0x30]
mov dword [0x49e384], edx
mov edx, 0x49e3a0
mov edi, edx
movsx eax, cx
push eax
shr ecx, 0x10
movsx eax, cx
movsd dword es:[edi], dword [esi]
push eax
push edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_OffsetRect]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [0x49e378], ecx
mov dword [0x49e37c], edx
mov dword [0x49d5e8], ecx
mov dword [0x49d5ec], edx
mov eax, dword [esi + 0x7a]
sub eax, dword [0x49e3a0]
add eax, ecx
mov dword [0x49e390], eax
mov eax, dword [esi + 0x7e]
sub eax, dword [0x49e3a4]
add eax, edx
mov dword [0x49e394], eax
mov eax, dword [esi + 0x56]
sub eax, dword [esi + 0x82]
sub eax, dword [0x49e3a8]
add eax, ecx
mov dword [0x49e398], eax
mov eax, dword [esi + 0x5a]
sub eax, dword [esi + 0x86]
sub eax, dword [0x49e3ac]
add eax, edx
mov dword [0x49e39c], eax
xor eax, eax
mov word [0x49e38a], ax
test ebx, ebx
je 0x44ebe6
mov dword [0x49cd90], 9
jmp 0x44ec64
mov ebx, dword [ebp - 4]
mov dword [0x49cd90], 0xa
cmp dword [ebx + 0x34], 0x22
jne 0x44ec0e
mov eax, dword [ebx + 0x8c]
cmp eax, 2
jg 0x44ec0e
dec eax
push eax
push ebx
call fcn.0041e296
jmp 0x44ec11
mov eax, dword [ebp + 0x1c]
push eax
push ebx
call fcn.0041e380
mov dword [0x47c4f4], eax
cmp eax, 0xffffffff
je 0x44ec64
lea ecx, [ebp + 0x18]
push ecx
push eax
push 0x65
push dword [esi + 0x26]
call fcn.0043c164
test eax, eax
jne 0x44ec64
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 1
push 0x10
add eax, 0x10
push eax
call fcn.0046bad9
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x18]
call fcn.0043d6c9
push dword [ebp + 0x18]
call fcn.0043d8ec
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetCapture]
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x24]
call fcn.0043d8ec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20