Function at 0x4485d6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
cmp edi, 0x20a
ja 0x448696
je 0x448635
lea ecx, [edi - 0x200]
cmp ecx, 6
ja case.default.0x448546
jmp dword [ecx*4 + 0x448768]
cmp dword [0x550b28], 0
je 0x44855e
call fcn.00449230
mov eax, dword [ebp + 0xc]
mov ecx, eax
shr ecx, 2
and ecx, 2
mov esi, ecx
or esi, 1
test al, 4
push 0x12
cmove esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
shr ecx, 0x10
push ecx
movzx ecx, bx
push ecx
mov ecx, esi
or ecx, 4
test ax, ax
cmovns ecx, esi
xor eax, eax
cmp edi, 0x201
setne al
inc eax
jmp 0x448617
mov ecx, dword [0x54d3d0]
test ecx, ecx
je 0x44875c
mov eax, dword [ecx]
push 0
push 0
push 0
push 1
call dword [eax + 0x68]
test eax, eax
je case.default.0x448546
mov ecx, dword [0x54d3d0]
push 0
push 0
push 0
mov eax, dword [ecx]
push 2
call dword [eax + 0x68]
jmp case.default.0x448546
mov ecx, eax
shr ecx, 2
and ecx, 2
mov esi, ecx
or esi, 1
test byte [ebp + 0xc], 4
push 0x12
cmove esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
shr ecx, 0x10
push ecx
movzx ecx, bx
push ecx
mov ecx, esi
or ecx, 4
test ax, ax
cmovns ecx, esi
xor eax, eax
cmp edi, 0x203
setne al
add eax, 0x100
push ecx
push eax
call fcn.004254d0
add esp, 0x10
test eax, eax
sete al
test al, al
jne case.default.0x448546
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [0x54d3d0]
test esi, esi
je 0x44875c
shr eax, 0x10
movsx ecx, ax
mov eax, 0x77777777
imul ecx
sub edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x44868e
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x4c]
mov esi, dword [0x54d3d0]
test esi, esi
je 0x44875c
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp + 0xc]
push edi
call dword [eax + 8]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
jns 0x44866f
mov eax, dword [esi]
push 1
jmp 0x448664
cmp edi, 0x2a1
je case.0x448546.512
cmp edi, 0x502
jne case.default.0x448546
cmp eax, esi
jne case.default.0x448546
mov eax, ebx
shr eax, 0x10
cmp ax, 1
jne 0x4486d5
movzx eax, bx
test ax, ax
js case.default.0x448546
push eax
lea eax, [esi + 0x40]
push eax
call fcn.00448f30
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ax, 2
jne case.default.0x448546
movzx eax, bx
test ax, ax
js case.default.0x448546
push eax
lea eax, [esi + 0x40]
push 0x51f5b1
push eax
call fcn.00448d70
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test al, 1
jne 0x44872f
cmp dword [0x550b28], 0
jne 0x44872f
test al, 2
je 0x44874a
mov eax, esi
shr eax, 0x10
push eax
movzx eax, si
push eax
push 2
push 0
call fcn.004254d0
add esp, 0x10
jmp 0x44874a
mov ecx, dword [0x54d3d0]
test ecx, ecx
je 0x44874a
mov edx, dword [ecx]
mov eax, esi
push 0
shr eax, 0x10
push eax
movzx eax, si
push eax
call dword [edx + 0x40]
mov ecx, dword [ebp - 4]
mov eax, esi
shr eax, 0x10
push eax
movzx eax, si
push eax
call fcn.004487d0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc