Function at 0x44cb14
Capabilities:
Log keystrokes via polling
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
sub esp, 0x14
pushal
mov esi, eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], ebx
mov eax, 0
mov dword [esp + 0x2c], 0
movsx edi, word [esi + 0x92]
cmp dword [esi + 0x80], 3
je 0x44cb68
cmp dword [esi + 0x80], 0
sete al
movzx eax, al
movsx ecx, word [esi + eax*2 + 0x90]
mov eax, dword [esi + 0x80]
movsx eax, word [esi + eax*2 + 0x90]
sub ecx, eax
mov dword [esp + 0x2c], ecx
mov eax, ebx
cmp eax, 0x18
jne 0x44cb93
movzx eax, byte [esi + 0x7f]
and eax, 0x80
cmp eax, 0
jne 0x44d17a
jmp 0x44cb9c
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_OpenClipboard
cmp eax, 0
jne 0x44cbb7
jmp 0x44cc0e
cmp eax, 3
jne 0x44cc29
movzx eax, byte [esi + 0x7f]
and eax, 0x40
cmp eax, 0
jne 0x44d17a
mov ebx, dword [esp + 0x2c]
cmp ebx, 0
jne 0x44cb83
jmp 0x44cc0e
call sub.USER32.dll_EmptyClipboard
inc ebx
push ebx
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov dword [esp + 0x28], eax
push eax
call sub.KERNEL32.dll_GlobalLock
mov edx, eax
mov eax, edx
mov ebx, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
movsx ecx, word [esi + ecx*2 + 0x90]
lea ebx, [ebx + ecx]
mov ecx, dword [esp + 0x2c]
call fcn.0042f617
mov byte [edx + ecx], 0
mov ebx, dword [esp + 0x28]
push ebx
call sub.KERNEL32.dll_GlobalUnlock
push ebx
push 1
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
mov ebx, dword [esp + 0x24]
cmp ebx, 3
jne 0x44ccc2
mov ebx, 0
mov dword [esp + 0x24], ebx
jmp 0x44ccc2
cmp eax, 8
je 0x44cc38
cmp eax, 0x16
je 0x44cc38
cmp eax, 0x7f
jne 0x44cc56
mov dword [esi + 0xb0], 1
movzx eax, byte [esi + 0x7f]
and eax, 0x80
cmp eax, 0
jne 0x44d17a
jmp 0x44ccc2
mov dword [esi + 0xb0], 1
movzx eax, byte [esi + 0x7f]
and eax, 0x80
cmp eax, 0
jne 0x44d17a
mov eax, dword [esi + 0x63]
movzx eax, byte [eax + 0x3c]
cmp ebx, eax
jae 0x44ccb7
cmp ebx, 0xa
je 0x44d17a
cmp ebx, 0xd
je 0x44d17a
cmp ebx, 9
je 0x44d17a
cmp ebx, 0x1b
je 0x44d17a
push 0
call sub.USER32.dll_MessageBeep
jmp 0x44d17a
cmp ebx, 0
jne 0x44ccde
jmp 0x44cdcb
mov eax, dword [esi + 0x63]
movzx eax, byte [eax + 0x3d]
cmp ebx, eax
ja 0x44cc7d
cmp dword [esi + 0x80], 3
jne 0x44ccad
jmp 0x44cdcb
cmp ebx, 8
je 0x44cdbb
jmp 0x44cdcb
mov eax, esi
mov eax, dword [esi + 0x80]
mov bx, word [esi + eax*2 + 0x90]
cmp dword [esi + 0x80], 0
sete al
movzx eax, al
mov cx, word [esi + eax*2 + 0x90]
mov eax, dword [esp + 0x30]
call fcn.0044e184
add word [esi + 0x9a], ax
movsx ecx, word [esi + 0x88]
cmp dword [esi + 0x80], 0
sete al
movzx eax, al
movsx ebx, word [esi + eax*2 + 0x90]
sub ecx, ebx
mov eax, ecx
cmp eax, 0
jle 0x44cd5d
mov edx, dword [esi + 0x84]
mov eax, dword [esi + 0x80]
movsx eax, word [esi + eax*2 + 0x90]
lea eax, [edx + eax]
mov edx, dword [esi + 0x84]
lea ebx, [edx + ebx]
call fcn.0042f5a4
mov eax, dword [esp + 0x2c]
sub word [esi + 0x88], ax
mov eax, dword [esi + 0x80]
movsx edi, word [esi + eax*2 + 0x90]
mov ax, di
mov word [esi + 0x92], ax
mov dword [esi + 0x80], 3
mov eax, esi
lea ebx, [esi + 0x9c]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x30]
call dword [ecx + 0x10c]
mov dword [esi + 0xac], 1
call fcn.00516fe4
mov ebx, dword [esp + 0x24]
cmp ebx, 0x7f
jne 0x44ccd0
mov eax, esi
call fcn.0044d520
mov ebx, 0
mov dword [esp + 0x24], ebx
mov eax, ebx
cmp eax, 8
jne 0x44ce5f
cmp edi, 0
je 0x44d157
mov eax, esi
mov eax, dword [esi + 0x84]
movzx bx, byte [eax + edi - 1]
mov eax, dword [esp + 0x30]
call fcn.0044e11c
add word [esi + 0x9a], ax
movsx ecx, word [esi + 0x88]
sub ecx, edi
mov eax, ecx
cmp eax, 0
jle 0x44ce25
mov eax, dword [esi + 0x84]
lea eax, [eax + edi - 1]
mov ebx, dword [esi + 0x84]
lea ebx, [ebx + edi]
call fcn.0042f5a4
dec word [esi + 0x88]
mov eax, esi
mov ebx, edi
dec ebx
mov ecx, 0
call fcn.0044d578
mov eax, esi
lea ebx, [esi + 0x9c]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x30]
call dword [ecx + 0x10c]
mov dword [esi + 0xac], 1
jmp 0x44d157
cmp eax, 0x7f
jne 0x44cf02
movsx eax, word [esi + 0x88]
cmp edi, eax
je 0x44d157
mov eax, esi
mov eax, dword [esi + 0x84]
movzx bx, byte [eax + edi]
mov eax, dword [esp + 0x30]
call fcn.0044e11c
add word [esi + 0x9a], ax
movsx ecx, word [esi + 0x88]
sub ecx, edi
dec ecx
mov eax, ecx
cmp eax, 0
jle 0x44cebd
mov eax, dword [esi + 0x84]
lea eax, [eax + edi]
mov ebx, dword [esi + 0x84]
lea ebx, [ebx + edi + 1]
call fcn.0042f5a4
dec word [esi + 0x88]
mov eax, esi
lea ebx, [esi + 0x9c]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x30]
call dword [ecx + 0x10c]
mov dword [esi + 0xac], 1
mov eax, esi
call fcn.0044d520
jmp 0x44d157
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_OpenClipboard
cmp eax, 0
jne 0x44cf18
jmp 0x44d157
cmp eax, 0x16
jne 0x44cf47
push 1
call sub.USER32.dll_IsClipboardFormatAvailable
cmp eax, 0
jne 0x44ceef
jmp 0x44d157
push 1
call sub.USER32.dll_GetClipboardData
mov edi, eax
push edi
call sub.KERNEL32.dll_GlobalLock
mov ebx, eax
mov eax, esi
call fcn.0044d378
push edi
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
mov eax, esi
call fcn.0044d520
jmp 0x44d157
cmp eax, 0x18
je 0x44d157
cmp eax, 0
je 0x44d157
movsx eax, word [esi + 0x88]
sub eax, edi
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0x7f]
mov ecx, eax
and ecx, 0x20
cmp ecx, 0
je 0x44cf84
mov eax, ebx
call fcn.00429b94
movsx eax, al
mov dword [esp + 0x24], eax
jmp 0x44cfe5
and eax, 0x10
cmp eax, 0
je 0x44cfe5
push 0x10
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0
je 0x44cfd2
jmp 0x44cfe5
mov eax, dword [esi + 0x84]
mov al, byte [eax + edi - 1]
call fcn.00429bd0
cmp eax, 0
jne 0x44cfe5
mov eax, dword [esi + 0x84]
cmp byte [eax + edi - 1], 0x27
je 0x44cfe5
mov eax, dword [esi + 0x84]
cmp byte [eax + edi - 1], 0xc0
jae 0x44cfe5
jmp 0x44cfd7
cmp edi, 0
jne 0x44cfa2
mov eax, ebx
call fcn.00429b94
movsx eax, al
mov dword [esp + 0x24], eax
cmp dword [0x5456fc], 0
je 0x44d091
mov eax, dword [esi + 0x7b]
and eax, 2
cmp eax, 0
jne 0x44d034
mov eax, esi
mov ecx, dword [esp + 0x24]
mov ebx, ecx
call fcn.0044e11c
movsx ebx, ax
movsx eax, word [esi + 0x9a]
cmp ebx, eax
jle 0x44d024
push 0
call sub.USER32.dll_MessageBeep
jmp 0x44d17a
mov eax, esi
mov ebx, ecx
call fcn.0044e11c
sub word [esi + 0x9a], ax
movsx ebx, word [esi + 0x88]
movsx eax, word [esi + 0x8c]
cmp ebx, eax
jl 0x44d052
push 0
call sub.USER32.dll_MessageBeep
jmp 0x44d17a
mov eax, esi
movsx ebx, word [esi + 0x88]
inc ebx
mov eax, dword [esp + 0x30]
call fcn.0044e540
mov ecx, dword [esp + 0x20]
mov eax, ecx
cmp eax, 0
jle 0x44d11c
mov eax, dword [esi + 0x84]
lea eax, [eax + edi + 1]
mov ebx, dword [esi + 0x84]
lea ebx, [ebx + edi]
call fcn.0042f5a4
jmp 0x44d11c
movsx eax, word [esi + 0x88]
cmp edi, eax
je 0x44cff2
mov eax, dword [esi + 0x7b]
and eax, 2
cmp eax, 0
jne 0x44d11c
mov eax, esi
mov ecx, dword [esp + 0x24]
mov ebx, ecx
call fcn.0044e11c
mov dx, ax
mov eax, esi
mov eax, dword [esi + 0x84]
movzx bx, byte [eax + edi]
mov eax, dword [esp + 0x30]
call fcn.0044e11c
movsx ebx, dx
movsx edx, word [esi + 0x9a]
movsx eax, ax
add edx, eax
cmp ebx, edx
jle 0x44d0f0
push 0
call sub.USER32.dll_MessageBeep
jmp 0x44d17a
mov eax, esi
mov ebx, ecx
call fcn.0044e11c
mov cx, ax
mov eax, esi
mov eax, dword [esi + 0x84]
movzx bx, byte [eax + edi]
mov eax, dword [esp + 0x30]
call fcn.0044e11c
sub cx, ax
sub word [esi + 0x9a], cx
mov ebx, dword [esi + 0x84]
mov eax, dword [esp + 0x24]
mov byte [ebx + edi], al
mov eax, esi
lea ebx, [esi + 0x9c]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x30]
call dword [ecx + 0x10c]
mov eax, esi
mov ebx, edi
inc ebx
mov ecx, 0
call fcn.0044d578
mov dword [esi + 0xac], 1
cmp byte [esi + 0x10], 0xf
jne 0x44d17a
mov eax, dword [esi + 0x84]
push eax
movsx eax, word [esi + 0x88]
push eax
push 0x240d
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
popal
add esp, 0x14
ret