Function at 0x44d0e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4b7080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0xc]
push 0
push 4
push eax
mov eax, dword [0x4be930]
add eax, 0xc441d4
push eax
push dword [0x4be878]
call edi
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x14
push eax
push dword [0x4be878]
call edi
push 0
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
add eax, 0x3c
push eax
push dword [0x4be878]
call edi
push 0
push 4
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0xc]
push dword [0x4be878]
call edi
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x20]
push 0
push 8
push eax
lea ebx, [esi + 0x1a8]
push ebx
push dword [0x4be878]
call edi
push 0
push 8
lea ecx, [ebp - 0x18]
lea eax, [esi + 0x1b0]
push ecx
push eax
push dword [0x4be878]
mov dword [ebp - 0xc], eax
call edi
push 0
push 8
lea ecx, [ebp - 0x20]
lea eax, [esi + 0x1b8]
push ecx
push eax
push dword [0x4be878]
mov dword [ebp - 8], eax
call edi
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x44d7ca
mov eax, dword [0x4be904]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, 1
jne 0x44d239
movsd xmm0, qword [0x4a9040]
lea eax, [ebp - 0x88]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x88], xmm0
call esi
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x28]
movsd xmm0, qword [0x4a8f48]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x28], xmm0
call esi
movsd xmm0, qword [0x4a9078]
lea eax, [ebp - 0x88]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x88], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
jmp 0x44d23c
mov edi, dword [ebp - 0xc]
cmp eax, 2
jne 0x44d2a2
movsd xmm0, qword [0x4a9038]
lea eax, [ebp - 0x28]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x28], xmm0
call esi
movsd xmm0, qword [0x4a8f28]
lea eax, [ebp - 0x10]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x10], xmm0
call esi
movsd xmm0, qword [0x4a8fd0]
lea eax, [ebp - 0x28]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x28], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 3
jne 0x44d308
movsd xmm0, qword [0x4a8fb0]
lea eax, [ebp - 0x10]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x10], xmm0
call esi
movsd xmm0, qword [0x4a8f40]
lea eax, [ebp - 0x30]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x30], xmm0
call esi
movsd xmm0, qword [0x4a9020]
lea eax, [ebp - 0x10]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x10], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 4
jne 0x44d36e
movsd xmm0, qword [0x4a9080]
lea eax, [ebp - 0x30]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x30], xmm0
call esi
movsd xmm0, qword [0x4a8f10]
lea eax, [ebp - 0x38]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x38], xmm0
call esi
movsd xmm0, qword [0x4a9010]
lea eax, [ebp - 0x30]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x30], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 5
jne 0x44d3d4
movsd xmm0, qword [0x4a9068]
lea eax, [ebp - 0x38]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x38], xmm0
call esi
movsd xmm0, qword [0x4a8f08]
lea eax, [ebp - 0x40]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x40], xmm0
call esi
movsd xmm0, qword [0x4a9018]
lea eax, [ebp - 0x38]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x38], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 6
jne 0x44d43a
movsd xmm0, qword [0x4a9060]
lea eax, [ebp - 0x40]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x40], xmm0
call esi
movsd xmm0, qword [0x4a8f18]
lea eax, [ebp - 0x48]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x48], xmm0
call esi
movsd xmm0, qword [0x4a9088]
lea eax, [ebp - 0x40]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x40], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 7
jne 0x44d4a0
movsd xmm0, qword [0x4a8fd8]
lea eax, [ebp - 0x48]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x48], xmm0
call esi
movsd xmm0, qword [0x4a8f38]
lea eax, [ebp - 0x50]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x50], xmm0
call esi
movsd xmm0, qword [0x4a8ff0]
lea eax, [ebp - 0x48]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x48], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 8
jne 0x44d505
movsd xmm0, qword [0x4a9000]
push 0
push eax
lea eax, [ebp - 0x50]
movsd qword [ebp - 0x50], xmm0
push eax
push ebx
push dword [0x4be878]
call esi
movsd xmm0, qword [0x4a8f50]
lea eax, [ebp - 0x58]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x58], xmm0
call esi
movsd xmm0, qword [0x4a9050]
lea eax, [ebp - 0x50]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x50], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 9
jne 0x44d56b
movsd xmm0, qword [0x4a8fc8]
lea eax, [ebp - 0x58]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x58], xmm0
call esi
movsd xmm0, qword [0x4a8f68]
lea eax, [ebp - 0x60]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x60], xmm0
call esi
movsd xmm0, qword [0x4a8f90]
lea eax, [ebp - 0x58]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x58], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 0xa
jne 0x44d5d1
movsd xmm0, qword [0x4a8fb8]
lea eax, [ebp - 0x60]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x60], xmm0
call esi
movsd xmm0, qword [0x4a8f60]
lea eax, [ebp - 0x68]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x68], xmm0
call esi
movsd xmm0, qword [0x4a8f98]
lea eax, [ebp - 0x60]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x60], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 0xb
jne 0x44d637
movsd xmm0, qword [0x4a8fc0]
lea eax, [ebp - 0x68]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x68], xmm0
call esi
movsd xmm0, qword [0x4a8f58]
lea eax, [ebp - 0x70]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x70], xmm0
call esi
movsd xmm0, qword [0x4a8fa0]
lea eax, [ebp - 0x68]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x68], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 0xc
jne 0x44d69d
movsd xmm0, qword [0x4a8ff8]
lea eax, [ebp - 0x70]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x70], xmm0
call esi
movsd xmm0, qword [0x4a8ee0]
lea eax, [ebp - 0x78]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x78], xmm0
call esi
movsd xmm0, qword [0x4a9008]
lea eax, [ebp - 0x70]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x70], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 0xd
jne 0x44d703
movsd xmm0, qword [0x4a9058]
lea eax, [ebp - 0x78]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x78], xmm0
call esi
movsd xmm0, qword [0x4a8ee8]
lea eax, [ebp - 0x18]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x18], xmm0
call esi
movsd xmm0, qword [0x4a9048]
lea eax, [ebp - 0x78]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x78], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 0xe
jne 0x44d769
movsd xmm0, qword [0x4a9028]
lea eax, [ebp - 0x18]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x18], xmm0
call esi
movsd xmm0, qword [0x4a8f00]
lea eax, [ebp - 0x20]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x20], xmm0
call esi
movsd xmm0, qword [0x4a8fe0]
lea eax, [ebp - 0x18]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x18], xmm0
push dword [0x4be878]
call esi
mov eax, dword [0x4be904]
cmp eax, 0xf
jne 0x44d7ca
movsd xmm0, qword [0x4a9030]
lea eax, [ebp - 0x20]
push 0
push 8
push eax
push ebx
push dword [0x4be878]
movsd qword [ebp - 0x20], xmm0
call esi
movsd xmm0, qword [0x4a8ef8]
lea eax, [ebp - 0x18]
push 0
push 8
push eax
push edi
push dword [0x4be878]
movsd qword [ebp - 0x18], xmm0
call esi
movsd xmm0, qword [0x4a8fe8]
lea eax, [ebp - 0x20]
push 0
push 8
push eax
push dword [ebp - 8]
movsd qword [ebp - 0x20], xmm0
push dword [0x4be878]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00492363
mov esp, ebp
pop ebp
ret