Function at 0x448714
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0xdc4]
sub esp, 0xe44
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0xdc0], eax
mov eax, dword [ebp + 0xdd4]
push ebx
push esi
mov esi, dword [ebp + 0xdd0]
push edi
mov edi, dword [ebp + 0xdcc]
mov dword [ebp - 0x6c], eax
xor ebx, ebx
lea eax, [edi + 0xa34]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], ebx
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, bx
jne 0x44875d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x448770
sub eax, edx
sar eax, 1
push str.susie
lea eax, [esi + eax*2]
push 1
mov dword [ebp - 0x7c], eax
call dword [sym.imp.PPLIB32W.DLL__VFSArchiveSection_8]
test eax, eax
jl 0x448a09
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x6c]
call dword [eax + 0x28]
test eax, eax
jne 0x448a04
cmp dword [ebp - 0x54], ebx
je 0x448a04
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalLock]
push dword [ebp - 0x54]
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov esi, eax
add esi, dword [ebp - 0x78]
lea eax, [ebp - 0x68]
push eax
push edi
mov dword [ebp - 0x70], esi
call fcn.00424050
jmp 0x4489cd
test byte [eax + 0x24], 0x10
je 0x4487f8
cmp dword [edi + 0x184c], ebx
je 0x4489cd
add eax, 0x50
mov dword [ebp - 0x74], eax
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x448801
sub eax, edx
sar eax, 1
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x78]
cmp eax, esi
jae 0x4489b8
lea esi, [eax + 0x18]
mov dword [ebp - 0x58], esi
cmp byte [esi - 0x18], bl
je 0x4489b8
lea eax, [esi + 0x190]
cmp word [eax], bx
je 0x44899a
push eax
push esi
lea eax, [ebp + 0x910]
push eax
call dword [sym.imp.PPLIB32W.DLL__CatPath_12]
cmp dword [edi + 0x184c], ebx
je 0x448952
mov eax, dword [ebp - 0x80]
mov esi, dword [ebp - 0x74]
add eax, eax
mov ecx, eax
lea edi, [ebp + 0x910]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x448994
movzx eax, word [ebp + eax + 0x910]
cmp ax, bx
je 0x448887
cmp ax, 0x5c
jne 0x448994
mov edi, dword [ebp - 0x58]
xor eax, eax
mov word [ebp + 0x460], ax
mov eax, dword [ebp - 0x5c]
mov esi, dword [eax + 0x1850]
cmp esi, ebx
je 0x4488b9
push edi
call dword [sym.imp.PPLIB32W.DLL__FindPathSeparator_4]
mov edi, eax
cmp edi, ebx
je 0x4488b4
inc edi
inc edi
dec esi
jne 0x4488a0
jmp 0x4488b9
mov edi, 0x4739e8
mov ecx, dword [ebp - 0x7c]
mov esi, edi
neg esi
mov eax, edi
lea edx, [esi + ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, bx
jne 0x4488c5
mov ecx, edi
lea eax, [ebp + 0x460]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x448901
cmp dx, bx
je 0x4488fd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x448901
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4488db
xor eax, eax
jmp 0x448906
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x44892b
push ebx
push dword [ebp - 0x64]
call dword [sym.imp.PPLIB32W.DLL__MakeDirectories_8]
mov eax, edi
lea ecx, [ebp + esi + 0x460]
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, bx
jne 0x44891d
mov esi, dword [ebp - 0x58]
mov edi, dword [ebp - 0x5c]
push ebx
push ebx
push ebx
push dword [ebp - 0x64]
lea eax, [ebp - 0x50]
push dword [esi - 0x10]
push eax
mov eax, dword [ebp - 0x6c]
call dword [eax + 0x2c]
test eax, eax
jne 0x4489b1
cmp dword [edi + 0x184c], ebx
je 0x4489b8
jmp 0x44899a
mov ecx, dword [ebp - 0x74]
lea eax, [ebp + 0x910]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x448981
cmp dx, bx
je 0x44897d
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x448981
add ecx, 4
add eax, 4
cmp dx, bx
jne 0x44895b
xor eax, eax
jmp 0x448986
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x44899a
mov ecx, dword [ebp - 0x7c]
xor eax, eax
mov word [ecx], ax
jmp 0x448931
mov edi, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x58]
add esi, 0x33c
lea eax, [esi - 0x18]
mov dword [ebp - 0x58], esi
cmp eax, dword [ebp - 0x70]
jb 0x448823
jmp 0x4489b8
mov dword [ebp - 0x60], 0x3eb
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4489e1
mov esi, dword [ebp - 0x70]
lea eax, [ebp - 0x68]
push eax
push edi
call fcn.00424095
cmp eax, ebx
jne 0x4487e6
jmp 0x4489e8
mov dword [ebp - 0x60], 0x4c7
call fcn.004486f2
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x60]
jmp 0x448a0c
call fcn.004486f2
push 6
pop eax
mov ecx, dword [ebp + 0xdc0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0xdc4
leave
ret 0xc