Function at 0x443192
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
lea esi, [edi + 0x30ec]
push esi
call fcn.00442de2
cmp eax, 1
jne 0x4433cb
mov eax, dword [ebp + 0xc]
and eax, 0x1ff
sub eax, 0x10d
push ebx
je 0x443317
sub eax, 0x50
je 0x4431d7
sub eax, 0x1c
jne 0x4433ca
call dword [sym.imp.USER32.dll_CreatePopupMenu]
xor ebx, ebx
push ebx
push 9
push 0x110a
push dword [edi + 0x30f0]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x4433ca
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x113e
push dword [edi + 0x30f0]
mov dword [ebp - 0x3c], 6
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4433ca
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4433ca
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push ebx
push dword [esi]
call edi
push 0xffffffffffffffec
push dword [ebp - 8]
mov dword [ebp + 0xc], eax
call edi
test al, 0x10
je 0x44325d
mov ecx, dword [ebp - 4]
xor edx, edx
push str.ADDPPost_files
inc edx
call fcn.00457166
mov ecx, dword [ebp - 4]
push str.ADDHDD_hook
push 2
pop edx
call fcn.00457166
mov ecx, dword [ebp - 4]
push str.ADDEDD_emulate
push 3
pop edx
call fcn.00457166
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
and eax, 1
push eax
push str.ADDRRight_button_DD
push 4
pop edx
call fcn.00457186
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call fcn.0042757f
push ebx
push dword [esi]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x102
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [ebp - 0xc]
dec eax
je 0x443304
dec eax
je 0x4432fe
dec eax
je 0x4432f8
dec eax
jne 0x4433ca
mov eax, dword [ebp + 0xc]
xor eax, 1
push eax
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x15d
push dword [ebp + 8]
call fcn.00443192
jmp 0x4433ca
or dword [ebp + 0xc], 8
jmp 0x443308
or dword [ebp + 0xc], 0xa
jmp 0x443308
or dword [ebp + 0xc], 4
push 4
push dword [esi]
call edi
push dword [ebp + 0xc]
push eax
jmp 0x4433b3
xor ebx, ebx
push ebx
push 9
push 0x110a
push dword [edi + 0x30f0]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x4433ca
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x113e
push dword [edi + 0x30f0]
mov dword [ebp - 0x3c], 6
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4433ca
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4433ca
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push ebx
push dword [esi]
call edi
push 4
push dword [esi]
mov dword [ebp - 4], eax
call edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
mov dword [ebp - 0xc], eax
call edi
mov ecx, 0x8000
test cx, ax
je 0x443392
and dword [ebp - 4], 0xfffffffd
push 0x10
call edi
mov ecx, 0x8000
test cx, ax
jne 0x4433a9
test dword [ebp + 0xc], 0x400
je 0x4433ad
or dword [ebp - 4], 1
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00442500
push ebx
push ebx
push 0x10
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
pop ebx
pop edi
pop esi
leave
ret 8