Function at 0x44f0b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453b28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp + 0xc]
lea eax, [ecx - 0x100]
cmp eax, 0xf
mov dword [ebp - 4], ebx
ja case.0x44f0f4.264
movzx eax, byte [eax + 0x44f54c]
jmp dword [eax*4 + 0x44f53c]
call fcn.0044e9c0
test al, al
je case.0x44f0f4.264
test dword [ebp + 0x14], 0x800
je case.0x44f0f4.264
mov ecx, dword [ebp + 8]
push ecx
call dword [0x471f24]
push ebx
mov edi, eax
call fcn.0044d530
add esp, 4
test al, al
push ebx
push ebx
push 0x800
push edi
je 0x44f17a
call dword [0x471f2c]
mov ebx, eax
mov edx, ebx
shr edx, 1
add esi, 0x8c
push edx
mov ecx, esi
call fcn.0044ee00
cmp dword [esi], 0
jbe 0x44f168
mov eax, dword [esi + 0xc]
push ebx
push eax
push 0x800
push edi
call dword [0x471f2c]
jmp 0x44f1d9
push ebx
xor eax, eax
push eax
push 0x800
push edi
call dword [0x471f2c]
jmp 0x44f1d9
call dword [0x471f30]
mov esi, eax
call fcn.00407e20
mov ebx, esp
push esi
push ebx
push 0x800
push edi
call dword [0x471f30]
push 0
push 0
push esi
push ebx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 0x14]
add esi, 0x8c
push eax
mov ecx, esi
mov dword [ebp + 0x10], eax
call fcn.0044ee00
cmp dword [esi], 0
jbe 0x44f1c5
mov eax, dword [esi + 0xc]
jmp 0x44f1c7
xor eax, eax
mov ecx, dword [ebp + 0x10]
push ecx
push eax
push 0xffffffffffffffff
push ebx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 8]
push edi
push edx
call dword [0x471f28]
mov ebx, dword [esi]
test ebx, ebx
jbe 0x44f1ef
mov edx, dword [esi + 0xc]
jmp 0x44f1f9
mov dword [ebp + 8], 0
mov edx, dword [ebp + 8]
test ebx, ebx
ja 0x44f218
xor al, al
lea esp, [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
test edx, edx
je case.0x44f0f4.264
test ebx, ebx
je case.0x44f0f4.264
movzx ecx, word [edx]
test cx, cx
je case.0x44f0f4.264
movzx esi, cx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov eax, 1
jne 0x44f2bb
mov eax, esi
and eax, 0xfffffc00
cmp eax, 0xdc00
je 0x44f25d
mov esi, 0xfffd
mov eax, 1
jmp 0x44f300
and esi, 0x3ff
add esi, 0x40
shl esi, 0xa
cmp ebx, 1
jne 0x44f27a
mov esi, 0xfffd
mov eax, ebx
jmp 0x44f300
movzx ecx, word [edx + 2]
test cx, cx
jne 0x44f28f
mov esi, 0xfffd
mov eax, 1
jmp 0x44f300
movzx ecx, cx
mov edi, ecx
and edi, 0xfffffc00
cmp edi, 0xd800
mov eax, 2
je 0x44f2b3
mov esi, 0xfffd
mov eax, 1
jmp 0x44f300
and ecx, 0x3ff
or esi, ecx
cmp esi, 0xffff
je 0x44f2f3
cmp esi, 0xfffe
je 0x44f2f3
cmp esi, 0xfdd0
jb 0x44f2db
cmp esi, 0xfdef
jbe 0x44f2f3
cmp esi, 0x10ffff
ja 0x44f2f3
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
jne 0x44f2f8
mov esi, 0xfffd
test eax, eax
je case.0x44f0f4.264
mov edi, dword [ebp - 0x14]
push 0
push 0
lea edx, [edx + eax*2]
push 1
add edi, 0x20
sub ebx, eax
mov eax, dword [edi]
push esi
mov dword [ebp + 8], edx
mov edx, dword [eax + 4]
push 0
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 4]
push 0
push 0
push 0
push esi
push 0
mov ecx, edi
call edx
test ebx, ebx
ja 0x44f215
jmp case.0x44f0f4.264
cmp ecx, 0x100
je 0x44f353
cmp ecx, 0x104
mov byte [ebp - 0x18], 0
jne 0x44f357
mov byte [ebp - 0x18], 1
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
push ecx
mov ebx, eax
shr ebx, 0x1e
push eax
and bl, 1
push edx
mov ecx, esi
mov byte [ebp + 0x17], bl
call fcn.0044dcb0
test al, al
je 0x44f515
mov edi, dword [ebp - 0x1c]
cmp edi, 0x10a020
jne 0x44f41e
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
push 0x108
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 8]
push pe_nt_image_headers32
push eax
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x44f3fd
mov edx, dword [ebp - 0x40]
xor edx, dword [ebp + 0xc]
test edx, 0xfffffffb
jne 0x44f3fd
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp + 8]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0044dcb0
test al, al
je 0x44f3fd
cmp dword [ebp + 8], 0x10a041
jne 0x44f3fd
mov edx, dword [ebp + 0x14]
cmp edx, dword [ebp - 0x34]
je 0x44f515
and bl, byte [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 4]
push edx
mov edx, dword [ebp - 0x18]
lea ecx, [esi + 0x20]
push ebx
push edx
mov edx, dword [ebp - 0x24]
push edx
push edi
call eax
jmp 0x44f515
cmp edi, 0x10a000
jne 0x44f3fd
lea eax, [ebp - 0xd]
push eax
lea ecx, [ebp + 8]
add esi, 0x44
push ecx
mov ecx, esi
mov byte [ebp - 0xd], 0
mov dword [ebp + 8], edi
call fcn.00430cb0
movzx edx, byte [eax]
lea eax, [ebp - 0xe]
push eax
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
mov byte [ebp + 0xb], dl
mov byte [ebp - 0xe], 0
mov dword [ebp + 0xc], 0x10a001
call fcn.00430cb0
movzx edx, byte [eax]
push 0
mov byte [ebp + 0xf], dl
call fcn.0044d530
add esp, 4
test al, al
je 0x44f49d
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
movzx ebx, ax
shr ebx, 0xf
and bl, 1
push 0xa1
mov byte [ebp - 0x1c], bl
call esi
shr eax, 0xf
and al, 1
mov byte [ebp - 0x18], al
jmp 0x44f4b8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
shr ebx, 0xf
and bl, 1
mov byte [ebp - 0x18], 0
mov al, byte [ebp - 0x18]
mov byte [ebp - 0x1c], bl
cmp byte [ebp + 0xb], bl
mov esi, dword [ebp - 0x20]
jne 0x44f4c4
test bl, bl
je 0x44f4e8
and bl, byte [ebp + 0x17]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x20]
mov eax, dword [eax + 4]
push esi
add ecx, 0x20
push ebx
push edx
push 0x10a01f
push 0x10a000
call eax
mov al, byte [ebp - 0x18]
cmp byte [ebp + 0xf], al
jne 0x44f4f1
test al, al
je 0x44f512
and al, byte [ebp + 0x17]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x20]
mov edx, dword [edx + 4]
push esi
add ecx, 0x20
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0x10a01f
push 0x10a001
call edx
mov esi, dword [ebp - 0x14]
cmp dword [ebp + 0x10], 0x73
jne 0x44f525
cmp dword [esi + 0x70], 0
jne case.0x44f0f4.264
mov al, 1
jmp 0x44f1ff
cmp dword [ebp + 0x10], 0xffff
setne al
jmp 0x44f1ff