Function at 0x44a140
Capabilities:
Check if file exists
Get file attributes
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0xb28]
sub esp, 0xba8
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0xb24], eax
or dword [ebp - 0x74], 0xffffffff
push ebx
mov ebx, dword [ebp + 0xb30]
push esi
mov esi, dword [ebp + 0xb34]
push edi
xor edi, edi
mov dword [ebp - 0x78], edi
cmp dword [ebx + 0x3114], edi
je 0x44a181
push ebx
call fcn.00449edb
mov eax, dword [ebx + 0x1d20]
cmp eax, 1
je 0x44a1ac
cmp eax, 4
je 0x44a1ac
push ebx
call fcn.00449879
test eax, eax
je 0x44a1ac
push str.Copy
push esi
push ebx
call fcn.00449f3d
jmp 0x44a36c
lea edx, [ebp + 0x45c]
cmp esi, edi
je 0x44a285
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x44a1be
push edi
push edi
push str.X_unbg
call fcn.004254c4
cmp dword [ebx + 0x1d78], 1
mov dword [ebp - 0x80], eax
jle 0x44a21e
cmp eax, edi
je 0x44a21e
push 0x80
lea eax, [ebp + 0x91c]
push eax
push 0x104
call dword [sym.imp.PPLIB32W.DLL__MakeTempEntry_12]
push edi
push 0x8000100
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp + 0x91c]
push eax
call dword [sym.imp.PPLIB32W.DLL__CreateFileL_28]
mov dword [ebp - 0x74], eax
push edi
push edi
push str.X_arcdr
call fcn.004254c4
mov dword [ebp + 0x918], eax
lea eax, [ebp + 0x45c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x44a239
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 + 0x45c]
mov dword [ebp + 0x458], eax
mov esi, ebx
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x7c]
push eax
movsd dword es:[edi], dword [esi]
push ebx
mov dword [ebp - 0x70], 0x447e97
mov dword [ebp - 0x60], ebx
call fcn.00424050
mov edi, dword [sym.imp.PPLIB32W.DLL__PPxCommonCommand_12]
push 0x3feb
push 7
xor esi, esi
push esi
call edi
jmp 0x44a2fa
mov ecx, ebx
call fcn.0042479b
push 0x4739e8
lea eax, [ebp + 0x45c]
push eax
push edi
call dword [sym.imp.PPLIB32W.DLL__CatPath_12]
push 0x258
lea eax, [ebp + 0x45c]
push eax
push str.TUPAUnpack_archive
push ebx
call fcn.00428788
test eax, eax
je 0x44a1cc
mov eax, 0x4c7
jmp 0x44a36c
cmp dword [0x48712c], esi
je 0x44a2db
push eax
push ebx
call fcn.0044977b
test eax, eax
jne 0x44a30d
push esi
push dword [ebp - 0x74]
lea eax, [ebp - 0x70]
push eax
call fcn.00449582
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x44a30d
lea eax, [ebp - 0x7c]
push eax
push ebx
call fcn.00424095
mov dword [ebp - 0x5c], eax
cmp eax, esi
jne 0x44a2c8
jmp 0x44a314
mov dword [ebp - 0x78], 1
cmp dword [ebp - 0x74], 0xffffffff
je 0x44a361
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x78], esi
je 0x44a337
lea eax, [ebp + 0x91c]
push eax
call dword [sym.imp.PPLIB32W.DLL__DeleteFileL_4]
jmp 0x44a361
lea esi, [ebx + 0x584]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44a34e
mov esi, 0x48ab20
push dword [ebp - 0x80]
lea eax, [ebp + 0x91c]
push esi
push eax
push ebx
call fcn.00448239
xor esi, esi
push 0x3fec
push esi
push esi
call edi
xor eax, eax
mov ecx, dword [ebp + 0xb24]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0xb28
leave
ret 8