Function at 0x44c6f0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
push esi
push edi
push dword [ebp + 0x24]
mov ebx, ecx
push dword [ebp + 0x20]
mov dword [esp + 0x1c], ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00459f40
mov dword [esp + 0x18], eax
test eax, eax
je 0x44c8bf
mov esi, dword [ebp + 0x10]
xor cl, cl
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x1c], 2
mov byte [esp + 0x12], cl
mov al, byte [esi]
mov byte [esp + 0x13], 1
mov dword [esp + 0x30], connect
mov dword [esp + 0x34], connect
test al, al
je 0x44c812
movzx ebx, al
test ebx, 0xffffff80
je 0x44c761
xor eax, eax
jmp 0x44c76c
push 2
push ebx
call fcn.004b47c1
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
mov ecx, ebx
cmove edx, ecx
movsx eax, dl
add eax, 0xffffffbc
cmp eax, 0x15
ja case.0x44c78d.69
movzx eax, byte [eax + 0x44ccf0]
jmp dword [eax*4 + 0x44ccd4]
mov dword [esp + 0x1c], 0
jmp case.0x44c78d.69
mov dword [esp + 0x1c], 1
jmp case.0x44c78d.69
mov cl, byte [esi + 1]
call fcn.00412890
mov cl, byte [esp + 0x12]
cmp al, 0x41
jne 0x44c802
inc esi
mov byte [esp + 0x13], 0
jmp 0x44c802
push 3
push 0x4d6938
push esi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne case.0x44c78d.69
mov cl, 1
add esi, 2
mov byte [esp + 0x12], cl
jmp 0x44c802
lea eax, [esi + 1]
push eax
call fcn.004b2c14
mov dword [esp + 0x34], eax
jmp 0x44c7fb
lea eax, [esi + 1]
push eax
call fcn.004b2c14
mov dword [esp + 0x38], eax
add esp, 4
mov cl, byte [esp + 0x12]
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x44c752
test cl, cl
jne 0x44c82b
mov ecx, dword [esp + 0x18]
mov edx, edi
call fcn.004a0100
mov ebx, eax
mov dword [esp + 0x28], ebx
test ebx, ebx
jne 0x44c981
push 0x30
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.004afdf0
add esp, 0xc
mov byte [esp + 0x80], 1
mov al, byte [edi]
cmp al, 0x20
je 0x44c84e
cmp al, 9
jne 0x44c851
inc edi
jmp 0x44c844
movzx ebx, al
test ebx, 0xffffff80
je 0x44c860
xor eax, eax
jmp 0x44c86b
push 2
push ebx
call fcn.004b47c1
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
mov ecx, ebx
cmove edx, ecx
cmp dl, 0x58
jne case.0x44ca8b.3
cmp byte [edi + 1], 0
lea esi, [edi + 1]
je case.0x44ca8b.3
mov ecx, esi
call fcn.00417810
mov dl, byte [esi]
mov dword [esp + 0x58], eax
test dl, dl
je case.0x44ca8b.3
nop dword [eax]
mov ecx, 0x4d5ff4
mov al, 0x20
cmp dl, al
je 0x44c8f0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x44c8a7
mov dl, byte [esi + 1]
inc esi
test dl, dl
jne 0x44c8a0
mov ebx, dword [esp + 0x14]
mov eax, dword [0x4e498c]
test byte [eax + 0xe0], 1
jne 0x44ccb7
mov ecx, dword [0x4e7934]
push 1
push 0
push 0xffffffffffffffff
push 0x4d07c0
call fcn.0049e6b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
je 0x44c8f0
cmp al, 9
je 0x44c8f0
test al, al
je case.0x44ca8b.3
movsx eax, al
push eax
call fcn.004b9d88
add esp, 4
cmp eax, 0x59
jne case.0x44ca8b.3
cmp byte [esi + 1], 0
lea ecx, [esi + 1]
je case.0x44ca8b.3
call fcn.00417810
mov ebx, dword [esp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x48]
push eax
push ebx
call esi
mov eax, dword [esp + 0x48]
add dword [esp + 0x58], eax
mov eax, dword [esp + 0x4c]
add dword [esp + 0x5c], eax
lea eax, [esp + 0x58]
push eax
push 0x453a10
push ebx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [esp + 0x70]
test eax, eax
cmovne ebx, eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push eax
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.USER32.dll_ScreenToClient]
jmp 0x44c987
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [ebp + 0xc]
cmp edi, 1
jl 0x44cc98
mov ecx, dword [esp + 0x30]
cmp ecx, 0x80000000
je 0x44c9aa
mov eax, dword [esp + 0x34]
cmp eax, 0x80000000
jne 0x44c9f5
lea eax, [esp + 0x38]
push eax
push ebx
call esi
test eax, eax
je case.0x44ca8b.3
mov ecx, dword [esp + 0x30]
cmp ecx, 0x80000000
jne 0x44c9d9
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x38]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x34]
cmp eax, 0x80000000
jne 0x44c9f5
mov eax, dword [esp + 0x44]
sub eax, dword [esp + 0x3c]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x34], eax
movzx edx, ax
shl edx, 0x10
movzx eax, cx
or edx, eax
mov dword [esp + 0x20], 0
mov al, byte [ebp + 8]
mov dword [esp + 0x24], edx
cmp al, 0x9f
je 0x44ca1b
cmp al, 0x9e
je 0x44ca1b
xor bh, bh
jmp 0x44ca1d
mov bh, 1
cmp al, 0x9c
je 0x44ca29
cmp al, 0x9d
je 0x44ca29
xor bl, bl
jmp 0x44ca2b
mov bl, 1
test bh, bh
je 0x44ca56
cmp al, 0x9f
mov esi, 0xffffff88
mov eax, dword [esp + 0x2c]
mov ecx, 0x78
cmove esi, ecx
mov dword [esp + 0x14], eax
imul esi, edi
mov edi, 0x20a
shl esi, 0x10
jmp 0x44caf7
test bl, bl
je 0x44ca7e
cmp al, 0x9c
mov esi, 0x78
mov eax, dword [esp + 0x2c]
mov ecx, 0xffffff88
cmove esi, ecx
mov dword [esp + 0x14], eax
imul esi, edi
mov edi, 0x20e
shl esi, 0x10
jmp 0x44caf7
movzx eax, al
dec eax
cmp eax, 5
ja case.0x44ca8b.3
jmp dword [eax*4 + 0x44cd08]
mov edi, 0x201
mov dword [esp + 0x14], 0x202
mov esi, 1
jmp 0x44caf7
mov edi, 0x204
mov dword [esp + 0x14], 0x205
mov esi, 2
jmp 0x44caf7
mov edi, 0x207
mov dword [esp + 0x14], 0x208
mov esi, 0x10
jmp 0x44caf7
mov dword [esp + 0x20], 0x10000
mov esi, 0x10020
jmp 0x44caea
mov dword [esp + 0x20], 0x20000
mov esi, 0x20040
mov dword [esp + 0x14], 0x20c
mov edi, 0x20b
cmp byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
je 0x44cb55
push 0
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x44cb45
cmp eax, dword [0x4e9a38]
je 0x44cb45
mov ecx, dword [esp + 0x18]
call fcn.004a0580
test al, al
jne 0x44cb45
push 1
push dword [esp + 0x30]
push dword [0x4e9a38]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x24]
jmp 0x44cb5d
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
test bh, bh
jne 0x44cc35
test bl, bl
jne 0x44cc35
cmp dword [ebp + 0xc], 0
jle 0x44cc7f
mov eax, dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, dword [esp + 0x28]
cmp dword [esp + 0x1c], 1
je 0x44cbce
push edx
push esi
push edi
push ebx
call eax
mov eax, dword [0x4e498c]
cmp dword [eax + 0x58], 0xffffffff
jle 0x44cbc9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4e9a38], eax
je 0x44cbb6
mov eax, dword [0x4e498c]
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44cbc9
mov ecx, dword [0x4e498c]
mov edx, 1
mov ecx, dword [ecx + 0x58]
call fcn.00401a30
mov eax, dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esp + 0x1c], 0
je 0x44cc20
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x1c]
push ebx
call eax
mov eax, dword [0x4e498c]
cmp dword [eax + 0x58], 0xffffffff
jle 0x44cc20
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4e9a38], eax
je 0x44cc0d
mov eax, dword [0x4e498c]
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44cc20
mov ecx, dword [0x4e498c]
mov edx, 1
mov ecx, dword [ecx + 0x58]
call fcn.00401a30
sub dword [ebp + 0xc], 1
mov edx, dword [esp + 0x24]
mov eax, dword [sym.imp.USER32.dll_PostMessageA]
jne 0x44cb80
jmp 0x44cc7f
mov ebx, dword [esp + 0x28]
push edx
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x4e498c]
cmp dword [eax + 0x58], 0xffffffff
jle 0x44cc7f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4e9a38], eax
je 0x44cc6c
mov eax, dword [0x4e498c]
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44cc7f
mov ecx, dword [0x4e498c]
mov edx, 1
mov ecx, dword [ecx + 0x58]
call fcn.00401a30
cmp byte [esp + 0x12], 0
je 0x44cc98
push 0
push dword [esp + 0x30]
push dword [0x4e9a38]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [0x4e7934]
push 1
push 0
push 0xffffffffffffffff
push 0x4d03bc
call fcn.0049e6b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
push 0x4d0335
push 0
push 0x4d07c0
mov ecx, ebx
call fcn.00446950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20