Function at 0x5443cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
push edi
call fcn.0055a268
test al, al
je 0x5443e8
mov al, 1
jmp 0x544697
xor ebx, ebx
cmp byte [edi + 0x1ee], bl
mov esi, 0x101
je 0x544457
cmp dword [ebp + 0xc], 0x5d
sete cl
cmp dword [ebp + 8], 0x105
je 0x544410
cmp dword [ebp + 8], esi
je 0x544410
xor al, al
jmp 0x544412
mov al, 1
cmp cl, bl
je 0x544457
cmp al, bl
je 0x544457
mov esi, dword [edi + 0x19]
cmp esi, ebx
je 0x5443e1
lea eax, [edi + 0x1d6]
mov ecx, dword [eax + 0x19]
sub ecx, dword [eax + 0x21]
push dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + 0x1f3]
push dword [eax]
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
call fcn.00449e5d
push dword [edi + 0x31]
lea eax, [edi + 0x21]
push eax
push dword [edi + 0x19]
call fcn.00449ece
jmp 0x5443e1
call fcn.0054299c
test al, al
jne 0x54465a
push edi
call fcn.005400d7
test al, al
jne 0x544695
mov ecx, dword [ebp + 8]
mov eax, 0x105
cmp ecx, eax
je 0x544489
cmp ecx, 0x104
mov byte [ebp - 4], bl
jne 0x54448d
mov byte [ebp - 4], 1
cmp dword [ebp + 0xc], 0x12
sete byte [ebp - 1]
cmp ecx, eax
je 0x5444a0
cmp ecx, esi
mov byte [ebp - 3], bl
jne 0x5444a4
mov byte [ebp - 3], 1
cmp byte [ebp - 3], bl
sete byte [ebp - 2]
or esi, 0xffffffff
cmp byte [ebp - 1], bl
mov dword [ebp - 8], esi
jne 0x5444ff
mov edx, dword [edi + 0x25]
xor ecx, ecx
cmp dword [edx + 4], ebx
je 0x5444ff
xor eax, eax
movzx eax, word [edx + eax + 0x224]
cmp dword [ebp + 0xc], eax
je 0x5444e5
inc ecx
mov eax, ecx
imul eax, eax, 0x227
mov esi, edx
cmp dword [eax + esi + 4], ebx
jne 0x5444c2
mov esi, dword [ebp - 8]
jmp 0x5444ff
cmp ecx, ebx
mov esi, ecx
jl 0x5444ff
cmp byte [ebp - 2], bl
je 0x5444ff
imul ecx, ecx, 0x227
add ecx, edx
or byte [ecx + 0x226], 0x20
cmp byte [edi + 0x214], bl
jne 0x5445c7
cmp byte [edi + 0x215], bl
jne 0x54457e
cmp byte [ebp - 1], bl
je 0x544538
cmp byte [ebp - 3], bl
je 0x544538
cmp byte [edi + 0x216], bl
jne 0x544538
mov eax, edi
mov byte [edi + 0x214], 1
call fcn.00436f29
jmp 0x5443e1
cmp byte [ebp - 1], bl
mov byte [edi + 0x216], bl
je 0x544551
cmp byte [ebp - 2], bl
je 0x544653
jmp 0x5443e1
cmp byte [ebp - 2], bl
je 0x544653
cmp byte [ebp - 4], bl
je 0x544653
cmp esi, ebx
jl 0x544653
mov byte [edi + 0x215], 1
mov eax, edi
call fcn.00541653
jmp 0x5443e1
cmp byte [ebp - 2], bl
je 0x544587
cmp esi, ebx
jge 0x544572
cmp dword [ebp + 0xc], 0x1b
mov byte [edi + 0x215], bl
je 0x5443e1
cmp byte [ebp - 3], bl
je 0x544653
cmp byte [ebp - 1], bl
jne 0x5443e1
cmp esi, ebx
jl 0x544653
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x544653
jmp 0x5443e1
cmp byte [edi + 0x215], bl
jne 0x544640
cmp byte [ebp - 1], bl
je 0x5445f6
cmp byte [ebp - 3], bl
je 0x5445f6
mov eax, edi
mov byte [edi + 0x214], bl
call fcn.00436f29
xor eax, eax
cmp byte [edi + 0x216], bl
sete al
jmp 0x544697
cmp byte [ebp - 1], bl
mov byte [edi + 0x216], bl
je 0x54460a
cmp byte [ebp - 2], bl
jne 0x5443e1
cmp dword [ebp + 0xc], 0x1b
jne 0x544623
mov byte [edi + 0x214], bl
mov bl, 1
mov eax, edi
call fcn.00436f29
mov al, bl
jmp 0x544697
cmp dword [ebp + 0xc], 0xd
jne 0x544638
mov byte [edi + 0x214], bl
mov byte [edi + 0x216], 1
jmp 0x544618
cmp byte [ebp - 2], bl
jmp 0x54455d
mov eax, edi
mov byte [edi + 0x214], bl
mov byte [edi + 0x215], bl
call fcn.00436f29
mov byte [edi + 0x216], 1
call fcn.0054299c
test al, al
je 0x544695
cmp dword [ebp + 8], 0x105
jne 0x54468e
cmp dword [ebp + 0xc], 0x12
jne 0x54468e
lea eax, [edi + 0x21f]
cmp byte [eax], bl
je 0x544686
call fcn.005429c1
jmp 0x5443e1
mov byte [eax], 1
jmp 0x5443e1
mov byte [edi + 0x21f], 1
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8