Function at 0x44db90
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x5dcb70], 1
mov eax, dword [ebp + 8]
mov dword [0x5dcb58], eax
mov ecx, dword [ebp + 0xc]
mov dword [0x5dcb60], ecx
mov edx, dword [ebp + 0x10]
mov dword [0x5dcb5c], edx
mov eax, dword [ebp + 0x14]
mov dword [0x5dcb68], eax
call fcn.004e2266
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.005022f0
add esp, 4
cmp dword [0x5efb14], 0
je 0x44dbe7
mov edx, dword [0x5efb14]
mov dword [ebp - 0xc], edx
jmp 0x44dbef
call fcn.0044e5e8
mov dword [ebp - 0xc], eax
push 0xfa0
call fcn.0059306c
add esp, 4
mov ecx, dword [0x5dcb6c]
mov dword [ecx + 0x64], eax
cmp dword [0x5efb54], 0
je 0x44dc19
mov edx, dword [0x5efb54]
mov dword [ebp - 0x10], edx
jmp 0x44dc21
call fcn.0051ba80
mov dword [ebp - 0x10], eax
push 0x44e390
push 1
mov eax, dword [0x5f02b8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x5bf310]
add esp, 0xc
push eax
call dword [0x5bf5d4]
add esp, 8
cmp dword [0x5efc68], 0
je 0x44dc59
mov edx, dword [0x5efc68]
mov dword [ebp - 0x14], edx
jmp 0x44dc61
call fcn.00502320
mov dword [ebp - 0x14], eax
push 1
mov eax, dword [0x5f0bfc]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call dword [0x5bf310]
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [0x5bf57c]
add esp, 4
mov ecx, dword [0x5dcb6c]
mov dword [ecx + 0x14], eax
push 0x44e406
mov edx, dword [ebp - 8]
push edx
call dword [0x5bf5d4]
add esp, 8
call fcn.004e2220
cmp dword [0x5efa10], 0
je 0x44dcbb
mov eax, dword [0x5efa10]
mov dword [ebp - 0x18], eax
jmp 0x44dcc3
call fcn.004ac160
mov dword [ebp - 0x18], eax
push 0x7f00
mov ecx, dword [ebp - 0x18]
push ecx
call dword [0x5bf0ac]
add esp, 8
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x28], eax
cmp dword [0x5efa88], 0
je 0x44dcf1
mov eax, dword [0x5efa88]
mov dword [ebp - 0x1c], eax
jmp 0x44dcf9
call fcn.00481090
mov dword [ebp - 0x1c], eax
push 0x7f00
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [0x5bf0ac]
add esp, 8
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x2c], eax
cmp dword [0x5efa84], 0
je 0x44dd27
mov eax, dword [0x5efa84]
mov dword [ebp - 0x20], eax
jmp 0x44dd2f
call fcn.004812b0
mov dword [ebp - 0x20], eax
push 0xd
mov ecx, dword [ebp - 0x20]
push ecx
call dword [0x5beae4]
add esp, 8
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x30], eax
cmp dword [0x5efa40], 0
je 0x44dd5a
mov eax, dword [0x5efa40]
mov dword [ebp - 0x24], eax
jmp 0x44dd62
call fcn.00499d40
mov dword [ebp - 0x24], eax
push 8
mov ecx, dword [ebp - 0x24]
push ecx
call dword [0x5bf9c4]
add esp, 8
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x34], eax
cmp dword [0x5efa40], 0
je 0x44dd8d
mov eax, dword [0x5efa40]
mov dword [ebp - 0x28], eax
jmp 0x44dd95
call fcn.00499d40
mov dword [ebp - 0x28], eax
push 5
mov ecx, dword [ebp - 0x28]
push ecx
call dword [0x5bf9c4]
add esp, 8
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x38], eax
mov eax, dword [0x5dcb6c]
mov ecx, dword [eax + 0x30]
push ecx
call dword [0x5bec7c]
add esp, 4
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x40], eax
mov eax, dword [0x5dcb6c]
mov ecx, dword [eax + 0x30]
push ecx
call dword [0x5be36c]
add esp, 4
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x44], eax
mov eax, dword [0x5dcb6c]
mov dword [eax + 0x3c], 2
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x5dcb6c]
mov dword [ecx + 0x48], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x4c], eax
cmp dword [0x5efc24], 0
je 0x44de24
mov eax, dword [0x5efc24]
mov dword [ebp - 0x2c], eax
jmp 0x44de32
call fcn.0050f5c0
mov ecx, dword [0x5efc24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [0x5bf2bc]
add esp, 4
cmp dword [0x5efc1c], 0
je 0x44de52
mov eax, dword [0x5efc1c]
mov dword [ebp - 0x30], eax
jmp 0x44de60
call fcn.0050f5c0
mov ecx, dword [0x5efc24]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [0x5bf2bc]
add esp, 4
cmp dword [0x5efc18], 0
je 0x44de80
mov eax, dword [0x5efc18]
mov dword [ebp - 0x34], eax
jmp 0x44de8e
call fcn.0050f5c0
mov ecx, dword [0x5efc24]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [0x5bf2bc]
add esp, 4
mov dword [0x5efc20], 0
mov eax, dword [0x5efc20]
mov dword [0x5efc18], eax
cmp dword [0x5ef9b8], 0
je 0x44dec3
mov ecx, dword [0x5ef9b8]
mov dword [ebp - 0x38], ecx
jmp 0x44decb
call fcn.004c5f20
mov dword [ebp - 0x38], eax
push 0x2d
push 0xc
push str.stdoutStream
mov edx, dword [ebp - 0x38]
push edx
call dword [0x5bf9c4]
add esp, 0x10
mov dword [0x5efc24], eax
cmp dword [0x5efc24], 0
je 0x44def9
mov eax, dword [0x5efc24]
mov dword [ebp - 0x3c], eax
jmp 0x44df07
call fcn.0050f5c0
mov ecx, dword [0x5efc24]
mov dword [ebp - 0x3c], ecx
push 1
mov edx, dword [ebp - 0x3c]
push edx
call dword [0x5bed58]
add esp, 8
cmp dword [0x5ef9b8], 0
je 0x44df29
mov eax, dword [0x5ef9b8]
mov dword [ebp - 0x40], eax
jmp 0x44df31
call fcn.004c5f20
mov dword [ebp - 0x40], eax
push 0x2d
push 0xc
push str.stderrStream
mov ecx, dword [ebp - 0x40]
push ecx
call dword [0x5bf9c4]
add esp, 0x10
mov dword [0x5efc1c], eax
cmp dword [0x5efc1c], 0
je 0x44df60
mov edx, dword [0x5efc1c]
mov dword [ebp - 0x44], edx
jmp 0x44df6d
call fcn.0050f5c0
mov eax, dword [0x5efc24]
mov dword [ebp - 0x44], eax
push 1
mov ecx, dword [ebp - 0x44]
push ecx
call dword [0x5bed58]
add esp, 8
mov edx, dword [0x5dcb6c]
mov dword [edx + 0x54], 0x44e494
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x5dcb6c]
mov edx, dword [ecx + 0x54]
push edx
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, dword [0x5dcb6c]
mov dword [ecx + 0x50], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x5efb70], 0
je 0x44dfc9
mov edx, dword [0x5efb70]
mov dword [ebp - 0x48], edx
jmp 0x44dfd1
call fcn.00517450
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push eax
call dword [0x5bf040]
add esp, 4
mov ecx, dword [0x5dcb6c]
mov dword [ecx + 0x1c], eax
mov edx, dword [0x5dcb6c]
cmp dword [edx + 0x5c], 0
jne 0x44dff8
call fcn.0044e066
call fcn.0044e53c
mov esp, ebp
pop ebp
ret