Function at 0x44bd30
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
push esi
mov esi, ecx
mov eax, esi
jmp 0x44bd40
cmp dword [eax + 0x104], 0
jne 0x44be47
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x184]
call eax
test eax, eax
jne 0x44bd40
xor ebp, ebp
push edi
mov eax, esi
call fcn.0044d400
mov edi, eax
test edi, edi
je 0x44bd87
mov edx, dword [edi]
mov eax, dword [edx + 0x128]
mov ecx, edi
call eax
test eax, eax
je 0x44bd87
cmp dword [edi + 0x68], 0
jne 0x44bf90
cmp dword [esi + 0x12c], 0
jg 0x44c1a3
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
lea edx, [esp + 0x14]
push edx
push 0x285a
mov eax, esi
call fcn.0044d400
mov ecx, eax
call fcn.004183f0
mov ecx, esi
call fcn.004f94f9
test eax, eax
je 0x44c1a3
mov eax, dword [esi + 0xcc]
test eax, eax
jl 0x44be1a
mov ecx, dword [esi + 0xfc]
cmp eax, dword [ecx + 0x2c]
jge 0x44be1a
mov ecx, dword [ecx + 0x28]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x44be1a
mov edx, dword [edi]
mov eax, dword [edx + 0x6c]
mov ecx, edi
call eax
test eax, eax
je 0x44be1a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi]
mov edx, dword [edx + 0xcc]
push eax
push ecx
mov ecx, edi
call edx
cmp eax, 1
je 0x44bf09
cmp eax, 2
je 0x44bf09
mov ecx, esi
call fcn.00410aa0
test eax, eax
je 0x44c1a3
mov eax, dword [esp + 0x10]
add eax, 0xfffffff7
cmp eax, 0x17
ja case.0x44be40.10
movzx eax, byte [eax + 0x44c1c4]
jmp dword [eax*4 + 0x44c1b0]
mov ebp, dword [eax + 0x104]
test ebp, ebp
je 0x44bd5f
cmp dword [ebp + 0x5c], 0
je 0x44bd5f
pop esi
mov eax, 2
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
test ax, ax
jge 0x44beb6
test ebp, ebp
je 0x44beb6
mov eax, esi
call fcn.0044d4d0
mov edi, eax
push edi
push 0x5ba6c0
call fcn.004f9663
add esp, 8
test eax, eax
je 0x44beb6
push 0x10
call ebx
xor ecx, ecx
test ax, ax
setge cl
push edi
lea ecx, [ecx + ecx - 1]
mov eax, ecx
mov ecx, ebp
call fcn.004325e0
test eax, eax
jne 0x44bf03
mov edi, dword [esi]
push 0x10
add edi, 0x1c4
call ebx
xor edx, edx
test ax, ax
mov eax, dword [edi]
setl dl
mov ecx, esi
push edx
call eax
mov eax, dword [esi + 0xcc]
test eax, eax
jl 0x44bf03
mov ecx, esi
call fcn.0044c850
mov esi, eax
test esi, esi
je 0x44bf03
mov edx, dword [esi]
mov eax, dword [edx + 0xc8]
mov ecx, esi
call eax
test eax, eax
je 0x44bf03
mov edx, dword [esi]
mov eax, dword [edx + 0x68]
push 1
mov ecx, esi
call eax
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
mov eax, dword [edx + 0x1c4]
push 5
mov ecx, esi
call eax
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
mov eax, dword [edx + 0x1c4]
push 4
mov ecx, esi
call eax
pop edi
pop esi
pop ebp
ret 8
cmp dword [esi + 0xf8], 0
jne case.0x44be40.10
mov eax, esi
call fcn.0044d500
mov edi, eax
call fcn.00430840
push 0x20
push 0xf100
push 0x112
mov eax, esi
call fcn.0044d400
mov ecx, eax
call fcn.004100e0
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
mov edi, dword [sym.imp.USER32.dll_GetFocus]
call edi
test eax, eax
je 0x44bf9b
call edi
mov ecx, dword [esi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x44bf9b
pop edi
pop esi
mov eax, 2
pop ebp
ret 8
mov eax, dword [esi + 0x100]
test eax, eax
je 0x44bfc1
cmp eax, 1
je 0x44bfc1
cmp eax, 4
je 0x44bfc1
cmp eax, 5
jne 0x44bfbd
cmp dword [esi + 0xf8], 1
je 0x44bfc1
xor edi, edi
jmp 0x44bfc6
mov edi, 1
mov ecx, esi
call fcn.0044e510
mov edx, dword [esp + 0x10]
lea ecx, [edx - 0x23]
cmp ecx, 5
ja case.default.0x44bfdd
jmp dword [ecx*4 + 0x44c1dc]
test edi, edi
je 0x44c004
xor edx, edx
test eax, eax
sete dl
mov ecx, esi
mov eax, edx
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x1c4]
call eax
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
xor ecx, ecx
test eax, eax
setne cl
add ecx, 2
mov eax, ecx
push eax
mov eax, dword [edx + 0x1c4]
mov ecx, esi
call eax
pop edi
pop esi
pop ebp
ret 8
test edi, edi
je 0x44c043
mov edx, dword [esi]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
push eax
mov eax, dword [edx + 0x1c4]
mov ecx, esi
call eax
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
neg eax
sbb eax, eax
add eax, 3
push eax
mov eax, dword [edx + 0x1c4]
mov ecx, esi
call eax
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
mov edx, dword [edx + 0x1c4]
xor eax, eax
test edi, edi
setne al
mov ecx, esi
inc eax
push eax
call edx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
mov edx, dword [eax + 0x1c4]
neg edi
sbb edi, edi
and edi, 3
push edi
mov ecx, esi
call edx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
mov edx, dword [eax + 0x1c4]
push 6
mov ecx, esi
call edx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
mov edx, dword [eax + 0x1c4]
push 7
mov ecx, esi
call edx
pop edi
pop esi
pop ebp
ret 8
test edx, edx
je 0x44c1a3
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x44c1a3
call fcn.0042f650
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x44c101
push 0x11
call edi
test ax, ax
jl 0x44c101
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0044c290
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
test ebp, ebp
je 0x44c127
push esi
push 0x5ba6c0
call fcn.004f9663
add esp, 8
test eax, eax
je 0x44c127
mov ecx, dword [esp + 0x10]
push ecx
mov eax, ebp
call fcn.004308b0
test eax, eax
jne 0x44c1a3
push 0x11
mov dword [esp + 0x18], 0
call edi
test ax, ax
jl 0x44c18d
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
push esi
call fcn.0044d0d0
mov edi, eax
cmp edi, 0xffffffff
je 0x44c18d
mov edx, dword [esi]
mov eax, dword [edx + 0x148]
push 2
push edi
mov ecx, esi
call eax
cmp dword [esp + 0x14], 0
jne 0x44c182
test edi, edi
jl 0x44c174
mov eax, edi
mov ecx, esi
call fcn.0044c850
jmp 0x44c176
xor eax, eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xa8]
call eax
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
mov eax, dword [esp + 0x10]
cmp eax, 0x10
je 0x44c1a3
cmp eax, 0x11
je 0x44c1a3
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8