Function at 0x44a386
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x12a74]
mov eax, 0x12af4
call fcn.00468c00
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x12a70], eax
push ebx
mov ebx, dword [ebp + 0x12a7c]
cmp dword [ebx + 0x3114], 0
je 0x44a3bb
push ebx
call fcn.00449edb
lea eax, [ebp - 0x80]
push eax
push ebx
call fcn.00424050
lea eax, [ebp - 0x80]
push eax
push ebx
call fcn.00424095
mov dword [ebp - 0x68], eax
test eax, eax
jne 0x44a3de
push 0x12
pop eax
jmp 0x44a71e
lea ecx, [ebx + 0xa34]
push ecx
add eax, 0x50
push eax
lea eax, [ebp + 0x12110]
push eax
call dword [sym.imp.PPLIB32W.DLL__VFSFullPath_12]
test eax, eax
jne 0x44a404
mov eax, 0xa1
jmp 0x44a71e
push esi
push 0x11000
lea eax, [ebp + 0x910]
push eax
lea eax, [ebp + 0x12110]
push eax
call fcn.00406e9a
mov esi, eax
cmp esi, 4
jae 0x44a42c
push 0xd
pop eax
jmp 0x44a71d
push edi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edi, eax
push edi
or esi, 0x40000000
push esi
lea eax, [ebp + 0x910]
push eax
lea eax, [ebp + 0x12110]
push eax
call dword [sym.imp.PPLIB32W.DLL__VFSCheckDir_16]
push edi
test eax, eax
jne 0x44a472
call dword [sym.imp.USER32.dll_DestroyMenu]
push str.no_archive
xor edx, edx
mov ecx, ebx
call fcn.00427caa
push 0xd
pop eax
jmp 0x44a71c
push ebx
call fcn.004263f2
test eax, eax
jg 0x44a485
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x44a503
push 0
mov esi, 0x258
push esi
lea ecx, [ebp + 0x125c0]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_GetMenuStringW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp word [ebp + 0x125c0], 0x2a
jne 0x44a4ca
push section..text
push 0
push str._ME_unpack2
push 0
push ebx
push dword [ebx + 0xc]
call dword [sym.imp.PPLIB32W.DLL__PP_ExtractMacro_24]
jmp 0x44a71c
lea edx, [ebp + 0x450]
mov ecx, ebx
call fcn.0042479b
push 0x4739e8
lea eax, [ebp + 0x450]
push eax
xor edi, edi
push edi
call dword [sym.imp.PPLIB32W.DLL__CatPath_12]
push esi
lea eax, [ebp + 0x450]
push eax
push str.TUPAUnpack_archive
push ebx
call fcn.00428788
test eax, eax
je 0x44a50d
mov eax, 0x4c7
jmp 0x44a71c
push edi
lea eax, [ebp + 0x450]
push eax
call dword [sym.imp.PPLIB32W.DLL__MakeDirectories_8]
push edi
push edi
push str.X_arcdr
call fcn.004254c4
mov dword [ebp + 0x90c], eax
lea eax, [ebp + 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x44a536
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 + 0x450]
mov dword [ebp + 0x44c], eax
mov esi, ebx
lea edi, [ebp - 0x7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x3feb
push 7
xor edi, edi
push edi
mov dword [ebp - 0x7c], 0x447e97
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.PPLIB32W.DLL__PPxCommonCommand_12]
cmp dword [0x48712c], edi
je 0x44a58d
push dword [ebp - 0x68]
push ebx
call fcn.0044977b
test eax, eax
jne 0x44a736
cmp word [ebp + 0x125c0], 0x3a
jne 0x44a5ae
lea eax, [ebp + 0x125c0]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push eax
call fcn.00449582
jmp 0x44a67f
lea eax, [ebp - 0x7c]
push eax
call fcn.004485d1
mov ecx, str.zipfldr.dll
lea eax, [ebp + 0x125c0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44a5e8
cmp dx, di
je 0x44a5e4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44a5e8
add eax, 4
add ecx, 4
cmp dx, di
jne 0x44a5c2
xor eax, eax
jmp 0x44a5ed
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x44a5f5
push 0x3f
jmp 0x44a66f
mov ecx, str.lzhfldr2.dll
lea eax, [ebp + 0x125c0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44a626
cmp dx, di
je 0x44a622
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44a626
add eax, 4
add ecx, 4
cmp dx, di
jne 0x44a600
xor eax, eax
jmp 0x44a62b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x44a633
push 0x3e
jmp 0x44a66f
mov ecx, str.cabview.dll
lea eax, [ebp + 0x125c0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44a664
cmp dx, di
je 0x44a660
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44a664
add eax, 4
add ecx, 4
cmp dx, di
jne 0x44a63e
xor eax, eax
jmp 0x44a669
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x44a683
push 0x3d
lea eax, [ebp + 0x12110]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004494ce
mov esi, eax
jmp 0x44a6c1
lea eax, [ebp + 0x125c0]
push eax
lea eax, [ebp + 0x11910]
push str.__u__s__all_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
push edi
lea eax, [ebp + 0x11910]
push eax
push edi
lea eax, [ebp - 0x7c]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.PPLIB32W.DLL__PP_ExtractMacro_24]
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00448633
cmp esi, edi
jne 0x44a70d
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x44a73b
lea eax, [ebp - 0x80]
push eax
push ebx
call fcn.00424095
mov dword [ebp - 0x68], eax
cmp eax, edi
je 0x44a70d
lea ecx, [ebx + 0xa34]
push ecx
add eax, 0x50
push eax
lea eax, [ebp + 0x12110]
push eax
call dword [sym.imp.PPLIB32W.DLL__VFSFullPath_12]
test eax, eax
jne 0x44a574
mov esi, 0xa1
push 0x3fec
push edi
push edi
call dword [sym.imp.PPLIB32W.DLL__PPxCommonCommand_12]
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp + 0x12a70]
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0x12a74
leave
ret 4
push 0xd
pop esi
jmp 0x44a70d
mov esi, 0x4c7
jmp 0x44a70d