Function at 0x4442e7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
push edi
mov esi, ecx
je 0x444300
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x44430a
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x444314
mov byte [esi + 0x17], 1
xor eax, eax
cmp byte [esi + 0x14], al
je 0x444323
cmp byte [esi + 0x1a], al
je 0x444323
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x444330
cmp byte [esi + 0x1b], al
je 0x444330
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x44433d
cmp byte [esi + 0x1c], al
je 0x44433d
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x44434a
cmp byte [esi + 0x1d], al
je 0x44434a
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x444357
cmp byte [esi + 0x1e], al
je 0x444357
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x4443f9
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x44452f
mov cl, byte [esi + 0x1a]
movzx eax, byte [ebp - 0x6c]
xor edx, edx
test cl, cl
cmove eax, edx
mov dl, byte [esi + 0x1b]
mov byte [ebp - 0x6c], al
movzx eax, byte [ebp - 0x6b]
xor edi, edi
test dl, dl
cmove eax, edi
mov byte [ebp - 0x6b], al
test cl, cl
jne 0x4443ad
movzx eax, byte [ebp - 0xfc]
test dl, dl
cmove eax, edi
mov byte [ebp - 0xfc], al
movzx eax, byte [ebp - 0xfb]
xor edx, edx
cmp byte [esi + 0x1c], dl
cmove eax, edx
cmp byte [esi + 0x1d], dl
mov byte [ebp - 0xfb], al
movzx eax, byte [ebp - 0xfa]
cmove eax, edx
mov byte [ebp - 0xfa], al
movzx eax, byte [ebp - 0xb1]
test cl, cl
cmove eax, edx
mov byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x44452f
push ebx
lea ecx, [ebp - 0xc]
call fcn.00443f3c
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x444430
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x44444e
cmp byte [esi + 0x1a], 0
jne 0x44444e
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.004456b1
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f2d
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x444470
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x44448e
cmp byte [esi + 0x1b], 0
jne 0x44448e
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.004456b1
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f2d
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4444aa
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x4444c5
cmp byte [esi + 0x1c], 0
jne 0x4444c5
push 0x11
lea ecx, [ebp - 0xc]
call fcn.004456b1
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f2d
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4444e1
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x4444fc
cmp byte [esi + 0x1d], 0
jne 0x4444fc
push 0x12
lea ecx, [ebp - 0xc]
call fcn.004456b1
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f2d
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x444513
push 0x5b
call edi
test bx, ax
je 0x44452e
cmp byte [esi + 0x1e], 0
jne 0x44452e
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.004456b1
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f2d
pop ebx
pop edi
pop esi
leave
ret 4