Function at 0x44b1f0
Capabilities:
Check for foreground window switch
Log keystrokes via polling

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x148]
push ebp
push esi
push edi
xor edi, edi
cmp dword [0x58fb10], edi
jne 0x44b23b
cmp byte [0x52e4b8], 0
je 0x44b265
push edi
push 0x52e4b8
cmp dword [0x653778], edi
je 0x44b22c
lea ecx, [edi + 0xa]
call fcn.004700b0
jmp 0x44b233
mov ecx, ebx
call fcn.00471890
cmp dword [0x58fb10], edi
je 0x44b265
cmp byte [0x52db08], 0
je 0x44b265
push edi
push 0x52db08
cmp dword [0x653778], edi
je 0x44b25e
mov ecx, 0xa
call fcn.004700b0
jmp 0x44b265
mov ecx, ebx
call fcn.00471890
mov eax, dword [0x52e4b0]
mov ecx, dword [0x4edb78]
mov dword [0x58faa4], edi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x34], edi
mov dword [0x543998], edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], ecx
mov esi, 1
cmp dword [0x58fb10], edi
jne 0x44b2e0
xor eax, eax
mov dword [0x49b484], esi
cmp dword [0x53b590], edi
je 0x44b2b9
call fcn.004566d0
push edi
push edi
push esi
xor edx, edx
jmp 0x44b2d1
call fcn.004566d0
mov edx, dword [0x4ed874]
mov eax, dword [0x52dc0c]
push edi
push edx
push eax
mov edx, 0x544438
mov ecx, ebx
call fcn.0045f070
cmp dword [0x58fb10], edi
je 0x44b318
mov ecx, dword [0x4ac80c]
mov edx, dword [0x53b16c]
xor eax, eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x24], edx
mov dword [0x49b484], edi
call fcn.004566d0
call fcn.00440600
push edi
push edi
push esi
xor edx, edx
mov ecx, ebx
call fcn.0045f070
mov dword [0x49b484], esi
mov eax, dword [esp + 0x160]
xor ebp, ebp
cmp dword [esp + 0x158], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], ebp
jle 0x44b37b
jmp 0x44b340
mov ecx, dword [esp + 0x164]
mov edx, dword [ecx + edi*4]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b350
sub eax, esi
cmp ebp, eax
jae 0x44b371
mov eax, edx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b362
sub eax, edx
mov ebp, eax
mov dword [esp + 0x20], ebp
inc edi
cmp edi, dword [esp + 0x158]
jl 0x44b340
xor edi, edi
cmp dword [esp + 0x158], edi
jle 0x44b42f
mov esi, dword [esp + 0x164]
lea ebp, [esp + 0x80]
sub ebp, esi
cmp dword [0x58fb10], 0
mov edx, dword [esp + 0x18]
mov dword [esi + ebp], edx
jne 0x44b3b7
mov eax, dword [esp + 0x15c]
mov dword [esp + 0x14], eax
jmp 0x44b3fc
mov ecx, dword [0x4ed33c]
imul ecx, dword [esp + 0x20]
mov eax, dword [0x4965ec]
cdq
sub eax, edx
sar eax, 1
shr ecx, 2
sub ecx, eax
mov eax, dword [esp + 0x158]
cdq
sub eax, edx
mov dword [esp + 0x14], ecx
mov ecx, eax
mov eax, dword [0x4967f0]
sar ecx, 1
sub ecx, edi
imul ecx, dword [0x544748]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x24]
mov ecx, dword [esi]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x24]
mov edx, ebx
call fcn.00445d00
cmp eax, dword [esp + 0x28]
jle 0x44b41e
mov dword [esp + 0x28], eax
inc edi
add esi, 4
cmp edi, dword [esp + 0x158]
jl 0x44b39a
cmp dword [0x58fb10], 0
mov esi, dword [0x4965ec]
mov ecx, dword [0x4ed33c]
je 0x44b45b
mov ebp, ecx
imul ebp, dword [esp + 0x20]
mov eax, esi
cdq
sub eax, edx
shr ebp, 2
sar eax, 1
sub eax, ebp
mov dword [esp + 0x28], eax
imul ecx, dword [esp + 0x20]
mov eax, esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
shr ecx, 2
sar eax, 1
add ecx, eax
mov dword [esp + 0x44], ecx
mov dword [esp + edi*4 + 0x80], edx
mov eax, dword [ebx + 0x10]
push 1
push 0x202
push 0x202
push eax
lea ecx, [esp + 0x74]
push ecx
call esi
test eax, eax
jne 0x44b481
lea esp, [esp]
mov edx, dword [ebx + 0x10]
push 1
push 0x102
push 0x102
push edx
lea eax, [esp + 0x74]
push eax
call esi
test eax, eax
jne 0x44b4a0
xor edi, edi
mov dword [0x58faec], edi
mov dword [0x58faf0], edi
cmp dword [0x58fe00], edi
jne 0x44b507
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebx + 0x10]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x30]
mov edx, dword [ebx + 0x10]
shl ecx, 0x10
add ecx, dword [esp + 0x2c]
push ecx
push edi
push 0x200
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x58fe6c], edi
jne 0x44bbe5
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
push 1
push 0
push 0
push 0
lea eax, [esp + 0x58]
push eax
call esi
test eax, eax
je 0x44bbc9
mov edx, dword [0x49ac78]
mov eax, dword [ebx + 0x10]
lea ecx, [esp + 0x48]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x44b55c
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x49ab6c]
cmp eax, dword [ecx + 0x10]
je 0x44b57c
xor eax, eax
jmp 0x44b583
push 0x26
call ebp
movzx eax, ax
test eax, 0x8000
je 0x44b646
call edi
mov esi, dword [esp + 0x34]
lea edx, [esi + 0x7d]
cmp eax, edx
ja 0x44b5a3
cmp eax, esi
jae 0x44b64a
call edi
mov ecx, dword [esp + 0x1c]
add ecx, 0xffffffff
mov esi, eax
mov dword [esp + 0x34], esi
jns 0x44b5bc
mov ecx, dword [esp + 0x158]
dec ecx
cmp dword [0x58fb10], 0
je 0x44b5f2
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x158]
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
imul eax, dword [0x544748]
mov ecx, eax
mov eax, dword [0x4967f0]
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
jmp 0x44b61b
mov eax, dword [esp + 0x15c]
mov edx, dword [0x4ebfc8]
lea edx, [edx + eax + 1]
mov eax, dword [esp + ecx*4 + 0x80]
imul eax, dword [0x4edb80]
add eax, dword [0x4ed550]
mov dword [esp + 0x38], edx
mov edx, dword [0x49ab6c]
lea ecx, [esp + 0x38]
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x44b64a
mov esi, dword [esp + 0x34]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x49ab6c]
cmp eax, dword [ecx + 0x10]
je 0x44b65f
xor eax, eax
jmp 0x44b666
push 0x28
call ebp
movzx eax, ax
test eax, 0x8000
je 0x44b71d
call edi
lea edx, [esi + 0x7d]
cmp eax, edx
ja 0x44b682
cmp eax, esi
jae 0x44b71d
call edi
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x158]
inc ecx
cmp ecx, eax
jl 0x44b69a
xor ecx, ecx
cmp dword [0x58fb10], 0
je 0x44b6cd
mov edx, dword [esp + 0x28]
mov dword [esp + 0x2c], edx
cdq
sub eax, edx
mov esi, eax
mov eax, dword [0x4967f0]
sar esi, 1
sub esi, ecx
imul esi, dword [0x544748]
cdq
sub eax, edx
sar eax, 1
sub eax, esi
mov dword [esp + 0x30], eax
jmp 0x44b6f9
mov ecx, dword [esp + ecx*4 + 0x80]
imul ecx, dword [0x4edb80]
mov eax, dword [0x4ebfc8]
mov edx, dword [esp + 0x15c]
add ecx, dword [0x4ed550]
lea eax, [eax + edx + 1]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov eax, dword [0x49ab6c]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0x2c]
push edx
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [ebx + 0xa2c], 0x200
jne 0x44ba6b
or ebp, 0xffffffff
xor esi, esi
cmp dword [esp + 0x158], esi
mov dword [esp + 0x14], ebp
jl 0x44b9cc
mov edi, dword [ebx + 0xa30]
lea esp, [esp]
cmp dword [0x58fb10], 0
mov eax, dword [0x4ebfc8]
je 0x44b7ca
cmp dword [esp + 0x28], edi
jg 0x44b835
cmp dword [esp + 0x44], edi
jle 0x44b835
mov eax, dword [esp + 0x158]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [0x4967f0]
cdq
sar ecx, 1
sub eax, edx
mov edx, dword [ebx + 0xa34]
sub ecx, esi
mov ebx, ecx
imul ebx, dword [0x544748]
sar eax, 1
mov ebp, eax
sub ebp, ebx
cmp edx, ebp
jl 0x44b82a
mov ebx, 1
sub ebx, ecx
imul ebx, dword [0x544748]
add ebx, eax
cmp edx, ebx
mov ebx, dword [esp + 0x154]
jge 0x44b831
mov ebp, esi
mov dword [esp + 0x14], ebp
jmp 0x44b835
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x15c]
add ecx, edx
imul ecx, dword [0x4ab6cc]
add ecx, eax
cmp ecx, edi
jl 0x44b835
mov ecx, edx
add eax, ecx
cmp eax, edi
jge 0x44b835
mov edx, dword [esp + esi*4 + 0x80]
imul edx, dword [0x4edb80]
add edx, dword [0x4ed550]
mov eax, dword [ebx + 0xa34]
cmp eax, edx
jl 0x44b835
mov ecx, dword [esp + esi*4 + 0x84]
imul ecx, dword [0x4edb80]
add ecx, dword [0x4ed550]
cmp eax, ecx
jge 0x44b835
mov ebp, esi
mov dword [esp + 0x14], ebp
jmp 0x44b835
mov ebx, dword [esp + 0x154]
mov ebp, dword [esp + 0x14]
inc esi
cmp esi, dword [esp + 0x158]
jle 0x44b750
cmp ebp, 0xffffffff
je 0x44b9cc
cmp ebp, dword [esp + 0x158]
je 0x44b9cc
cmp dword [esp + 0x1c], ebp
je 0x44ba6b
cmp dword [0x58fb10], 0
jne 0x44b87e
cmp byte [0x53b598], 0
je 0x44b8aa
push 0
push 0x53b598
jmp 0x44b88e
cmp byte [0x52f068], 0
je 0x44b8aa
push 0
push 0x52f068
cmp dword [0x653778], 0
je 0x44b8a3
mov ecx, 0xa
call fcn.004700b0
jmp 0x44b8aa
mov ecx, ebx
call fcn.00471890
mov ecx, dword [esp + 0x1c]
cmp ecx, 0xffffffff
je 0x44b93d
cmp dword [0x58fb10], 0
jne 0x44b8d8
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + ecx*4 + 0x80]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
jmp 0x44b91d
mov esi, dword [0x4ed33c]
imul esi, dword [esp + 0x20]
mov eax, dword [0x4965ec]
cdq
sub eax, edx
sar eax, 1
shr esi, 2
sub esi, eax
mov eax, dword [esp + 0x158]
cdq
sub eax, edx
mov dword [esp + 0x14], esi
mov esi, eax
mov eax, dword [0x4967f0]
sar esi, 1
sub esi, ecx
imul esi, dword [0x544748]
cdq
sub eax, edx
sar eax, 1
sub esi, eax
mov dword [esp + 0x18], esi
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x168]
lea eax, [esp + 0x18]
push eax
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [esp + 0x24]
mov edx, ebx
call fcn.00445d00
cmp dword [0x58fb10], 0
mov dword [esp + 0x1c], ebp
jne 0x44b962
mov ecx, dword [esp + 0x15c]
mov edx, dword [esp + ebp*4 + 0x80]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jmp 0x44b9a7
mov ecx, dword [0x4ed33c]
imul ecx, dword [esp + 0x20]
mov eax, dword [0x4965ec]
cdq
sub eax, edx
sar eax, 1
shr ecx, 2
sub ecx, eax
mov eax, dword [esp + 0x158]
cdq
sub eax, edx
mov dword [esp + 0x14], ecx
mov ecx, eax
mov eax, dword [0x4967f0]
sar ecx, 1
sub ecx, ebp
imul ecx, dword [0x544748]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x164]
push edx
mov edx, dword [ecx + ebp*4]
lea eax, [esp + 0x18]
push eax
push edx
lea ecx, [esp + 0x24]
mov edx, ebx
call fcn.00445d00
jmp 0x44ba6b
mov ecx, dword [esp + 0x1c]
cmp ecx, 0xffffffff
je 0x44ba63
cmp dword [0x58fb10], 0
jne 0x44b9fa
mov eax, dword [esp + 0x15c]
mov ecx, dword [esp + ecx*4 + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
jmp 0x44ba3f
mov esi, dword [0x4ed33c]
imul esi, dword [esp + 0x20]
mov eax, dword [0x4965ec]
cdq
sub eax, edx
sar eax, 1
shr esi, 2
sub esi, eax
mov eax, dword [esp + 0x158]
cdq
sub eax, edx
mov dword [esp + 0x14], esi
mov esi, eax
mov eax, dword [0x4967f0]
sar esi, 1
sub esi, ecx
imul esi, dword [0x544748]
cdq
sub eax, edx
sar eax, 1
sub esi, eax
mov dword [esp + 0x18], esi
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x164]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
mov eax, dword [ecx + edx*4]
push eax
lea ecx, [esp + 0x24]
mov edx, ebx
call fcn.00445d00
mov dword [esp + 0x1c], 0xffffffff
cmp dword [0x58faec], 0
je 0x44ba8b
mov esi, dword [esp + 0x1c]
mov dword [0x58faec], 0
cmp esi, 0xffffffff
jne 0x44bbf4
cmp dword [0x58fb10], 0
jne 0x44bac2
mov eax, dword [0x49ab6c]
cmp dword [eax + 0xa2c], 0x20a
jne 0x44bac2
cmp dword [eax + 0xa30], 0
jle 0x44bac2
mov esi, 2
mov ecx, ebx
mov dword [0x4ab58c], esi
call fcn.004481f0
jmp 0x44bac7
mov esi, 2
cmp dword [0x58faf0], 0
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
jne 0x44bb01
call edi
mov ecx, dword [0x49ab6c]
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp eax, dword [ecx + 0x10]
je 0x44baed
xor eax, eax
jmp 0x44baf4
push 0x1b
call ebp
movzx eax, ax
test eax, 0x8000
je 0x44bbbd
jmp 0x44bb07
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call edi
mov edx, dword [0x49ab6c]
cmp eax, dword [edx + 0x10]
je 0x44bb18
xor eax, eax
jmp 0x44bb1f
push 0x1b
call ebp
movzx eax, ax
test eax, 0x8000
je 0x44bb30
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44bb07
cmp dword [0x58fb10], 0
mov dword [0x58faf0], 0
jne 0x44bcd0
cmp dword [esp + 0x1c], 0xffffffff
je 0x44bb88
mov eax, dword [esp + 0x15c]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + eax*4 + 0x80]
push edx
mov edx, dword [esp + 0x168]
mov eax, dword [edx + eax*4]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x18]
push ecx
push eax
lea ecx, [esp + 0x24]
mov edx, ebx
call fcn.00445d00
push 0xffffffffffffffff
mov ecx, ebx
mov dword [0x4ab58c], esi
call fcn.00429c00
cmp dword [0x4ebfd0], esi
je 0x44bd8f
cmp dword [0x58fafc], 0
jne 0x44bd8f
cmp dword [0x58fb00], 0
jne 0x44bd8f
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
cmp dword [0x58fb10], 0
jne 0x44bbd8
push ebx
call fcn.00461ed0
cmp dword [0x58fe6c], 0
je 0x44b520
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret 0x14
cmp dword [0x58fb10], 0
jne 0x44bc0f
cmp byte [0x4ed878], 0
je 0x44bc44
push 0
push 0x4ed878
jmp 0x44bc1f
cmp byte [0x53b698], 0
je 0x44bc3b
push 0
push 0x53b698
cmp dword [0x653778], 0
je 0x44bc34
mov ecx, 0xa
call fcn.004700b0
jmp 0x44bc3b
mov ecx, ebx
call fcn.00471890
cmp dword [0x58fb10], 0
jne 0x44bc5c
mov ecx, dword [esp + 0x15c]
mov edx, dword [esp + esi*4 + 0x80]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jmp 0x44bca1
mov ecx, dword [0x4ed33c]
imul ecx, dword [esp + 0x20]
mov eax, dword [0x4965ec]
cdq
sub eax, edx
sar eax, 1
shr ecx, 2
sub ecx, eax
mov eax, dword [esp + 0x158]
cdq
sub eax, edx
mov dword [esp + 0x14], ecx
mov ecx, eax
mov eax, dword [0x4967f0]
sar ecx, 1
sub ecx, esi
imul ecx, dword [0x544748]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x164]
push edx
mov edx, dword [ecx + esi*4]
lea eax, [esp + 0x18]
push eax
push edx
lea ecx, [esp + 0x24]
mov edx, ebx
call fcn.00445d00
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret 0x14
cmp byte [0x5439a0], 0
je 0x44bcfc
cmp dword [0x653778], 0
push 0
push 0x5439a0
je 0x44bcf5
mov ecx, 0xa
call fcn.004700b0
jmp 0x44bcfc
mov ecx, ebx
call fcn.00471890
mov ecx, dword [esp + 0x1c]
cmp ecx, 0xffffffff
je 0x44bd8f
cmp dword [0x58fb10], 0
jne 0x44bd2a
mov eax, dword [esp + 0x15c]
mov edx, dword [esp + ecx*4 + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
jmp 0x44bd6f
mov esi, dword [0x4ed33c]
imul esi, dword [esp + 0x20]
mov eax, dword [0x4965ec]
cdq
sub eax, edx
sar eax, 1
shr esi, 2
sub esi, eax
mov eax, dword [esp + 0x158]
cdq
sub eax, edx
mov dword [esp + 0x14], esi
mov esi, eax
mov eax, dword [0x4967f0]
sar esi, 1
sub esi, ecx
imul esi, dword [0x544748]
cdq
sub eax, edx
sar eax, 1
sub esi, eax
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x168]
mov ecx, dword [eax + ecx*4]
lea edx, [esp + 0x18]
push edx
push ecx
lea ecx, [esp + 0x24]
mov edx, ebx
call fcn.00445d00
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x140
ret 0x14