Function at 0x44a69f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp word [edi + 0xc], 9
jne 0x44a6d7
lea eax, [ecx + 0x64]
lea edx, [ecx + 0x68]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [edi]
cmp edx, dword [eax]
jne 0x44a6d7
mov ecx, dword [ecx + 0x3c]
mov eax, dword [ecx]
call dword [eax]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and al, 1
push 0x11
mov byte [ebp - 1], al
call esi
shr eax, 0xf
and al, 1
push 0xa3
mov byte [ebp + 0xb], al
call esi
mov bx, ax
push 0x10
shr ebx, 0xf
and bl, 1
call esi
shr eax, 0xf
and al, 1
xor esi, esi
mov byte [ebp - 8], al
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ax, word [edi + 0xc]
cmp ax, 0x30
jb 0x44a755
cmp ax, 0x39
ja 0x44a755
test bl, bl
jne 0x44a731
cmp byte [ebp - 1], bl
je 0x44a755
mov ecx, dword [ebp - 0xc]
movzx eax, ax
sub eax, 0x30
cmp byte [ebp - 8], 0
push eax
je 0x44a74b
call fcn.00443d4f
jmp 0x44aae7
call fcn.00443dc0
jmp 0x44aae7
cmp ax, 0x71
je 0x44a761
cmp ax, 0x70
jne 0x44a78d
cmp byte [ebp - 1], 0
je 0x44a78d
cmp byte [ebp + 0xb], 0
jne 0x44a78d
cmp byte [ebp - 8], 0
jne 0x44a78d
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp ax, 0x70
mov ecx, dword [ecx + 0x3c]
setne bl
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
jmp 0x44aae7
cmp ax, 0x78
jne 0x44a7af
cmp byte [ebp - 1], 0
jne 0x44a7af
cmp byte [ebp + 0xb], 0
jne 0x44a7af
cmp byte [ebp - 8], 0
jne 0x44a7af
mov ecx, 0x47e478
call fcn.004300fb
mov cx, word [edi + 0xc]
cmp cx, 0x72
jb 0x44a7e1
cmp cx, 0x7b
ja 0x44a7e1
cmp byte [ebp + 0xb], 0
je 0x44a7e1
call fcn.0044aba4
cmp eax, esi
jl 0x44a7e1
mov ebx, dword [ebp - 0xc]
push dword [eax*8 + 0x46cd6c]
mov ecx, ebx
call fcn.0044ece5
jmp 0x44a7e4
mov ebx, dword [ebp - 0xc]
movzx eax, word [edi + 0xc]
cmp eax, 0x52
jg 0x44a9a8
je 0x44a992
cmp eax, 0x28
jg 0x44a8a9
je 0x44a837
sub eax, 8
je 0x44a89d
sub eax, 8
je 0x44a883
sub eax, 0x12
je 0x44a860
sub eax, 3
je 0x44a824
dec eax
je 0x44a84d
dec eax
jne 0x44a6ce
cmp byte [ebp - 1], 0
je 0x44a837
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x44a6ce
cmp byte [ebp - 8], 0
je 0x44a6ce
mov ecx, ebx
call fcn.0044e2b4
jmp 0x44a6ce
cmp byte [ebp - 1], 0
je 0x44a837
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x44a6ce
cmp byte [ebp + 0xb], 0
je 0x44a6ce
cmp byte [ebp - 1], 0
jne 0x44a6ce
cmp byte [ebp - 8], 0
jne 0x44a6ce
jmp 0x44aae7
and byte [ebx + 0x15c], 0
lea ecx, [ebx + 0x68]
call fcn.0043150d
mov dword [ebx + 0x160], eax
jmp 0x44a6ce
mov ecx, ebx
call fcn.00444800
jmp 0x44aae7
cmp eax, 0x2d
je 0x44a93b
cmp eax, 0x2e
je 0x44a927
cmp eax, 0x30
jle 0x44a6ce
cmp eax, 0x34
jle 0x44a90d
cmp eax, 0x41
je 0x44a8fa
cmp eax, 0x43
je 0x44a8ee
cmp eax, 0x4e
jne 0x44a6ce
cmp byte [ebp + 0xb], 0
je 0x44a6ce
mov ecx, ebx
call fcn.0044dbfd
jmp 0x44aae7
cmp byte [ebp + 0xb], 0
je 0x44a6ce
jmp 0x44a951
cmp byte [ebp + 0xb], 0
je 0x44a6ce
push 1
mov ecx, ebx
jmp 0x44a9f8
cmp byte [ebp + 0xb], 0
je 0x44a6ce
add eax, 0xffffffcf
mov ecx, ebx
push eax
call fcn.0043f153
jmp 0x44aae7
cmp byte [ebp - 8], 0
mov ecx, ebx
sete al
push eax
call fcn.0044d1d2
jmp 0x44aae7
cmp byte [ebp - 1], 0
jne 0x44a6ce
cmp byte [ebp + 0xb], 0
je 0x44a95d
cmp byte [ebp - 8], 0
jne 0x44a963
mov ecx, ebx
call fcn.0044c31c
jmp 0x44aae7
cmp byte [ebp - 8], 0
je 0x44a979
cmp byte [ebp + 0xb], 0
jne 0x44a6ce
mov ecx, ebx
call fcn.0045e766
jmp 0x44aae7
cmp byte [ebx + 0x87], 0
je 0x44a6ce
mov ecx, ebx
call fcn.0044e353
jmp 0x44aae7
cmp byte [ebp + 0xb], 0
je 0x44a6ce
mov ecx, ebx
call fcn.0044a2e8
jmp 0x44aae7
cmp eax, 0x71
jg 0x44aa9c
je 0x44aa75
sub eax, 0x56
je 0x44aa66
dec eax
dec eax
je 0x44aa50
dec eax
dec eax
je 0x44aa3a
sub eax, 0x10
je 0x44aa2e
dec eax
je 0x44aa02
dec eax
dec eax
jne 0x44a6ce
cmp byte [ebp - 1], 0
je 0x44a9ef
push esi
mov ecx, ebx
call fcn.0044e569
jmp 0x44aae7
cmp byte [ebp - 8], 0
push esi
mov ecx, ebx
je 0x44aa24
call fcn.0044e6f8
jmp 0x44aae7
cmp byte [ebp - 1], 0
je 0x44aa0c
push 1
jmp 0x44a9e3
cmp byte [ebp - 8], 0
jne 0x44a904
cmp byte [ebp + 0xb], 0
jne 0x44aae7
push 1
mov ecx, ebx
call fcn.0044e499
jmp 0x44aae7
mov ecx, ebx
call fcn.0044e72a
jmp 0x44aae7
cmp byte [ebp + 0xb], 0
je 0x44a6ce
mov ecx, ebx
call fcn.0044deaf
jmp 0x44aae7
cmp byte [ebp + 0xb], 0
je 0x44a6ce
mov ecx, ebx
call fcn.0045e766
jmp 0x44aae7
cmp byte [ebp + 0xb], 0
je 0x44a6ce
jmp 0x44a96d
cmp byte [ebp - 1], 0
jne 0x44a6ce
cmp byte [ebp + 0xb], 0
jne 0x44a6ce
cmp byte [ebp - 8], 0
jne 0x44a6ce
mov ecx, ebx
call fcn.0044de7e
jmp 0x44aae7
sub eax, 0x72
je 0x44ab83
dec eax
je 0x44ab57
dec eax
je 0x44ab38
dec eax
je 0x44ab15
dec eax
je 0x44aaee
sub eax, 5
jne 0x44a6ce
cmp byte [ebp - 1], 0
je 0x44a6ce
cmp byte [ebp + 0xb], 0
jne 0x44a6ce
cmp byte [ebp - 8], 0
jne 0x44a6ce
mov ecx, ebx
call fcn.00444508
mov al, 1
jmp 0x44a6d0
cmp byte [ebp - 1], 0
jne 0x44a6ce
cmp byte [ebp + 0xb], 0
jne 0x44a6ce
cmp byte [ebp - 8], 0
jne 0x44a6ce
mov ecx, ebx
call fcn.0044d99a
jmp 0x44aae7
cmp byte [ebp - 1], 0
jne 0x44a6ce
cmp byte [ebp + 0xb], 0
jne 0x44a6ce
mov ecx, dword [ebx + 0x3c]
push dword [ebp - 8]
mov eax, dword [ecx]
push 1
call dword [eax + 8]
jmp 0x44aae7
cmp byte [ebp - 1], 0
jne 0x44a6ce
cmp byte [ebp + 0xb], 0
jne 0x44a6ce
mov ecx, dword [ebx + 0x3c]
push dword [ebp - 8]
mov eax, dword [ecx]
push esi
jmp 0x44ab33
cmp byte [ebp - 1], 0
jne 0x44a6ce
cmp byte [ebp + 0xb], 0
jne 0x44a6ce
cmp byte [ebp - 8], 0
jne 0x44a8e2
push 1
mov ecx, ebx
call fcn.00449681
jmp 0x44aae7
cmp byte [ebp - 1], 0
jne 0x44a6ce
cmp byte [ebp + 0xb], 0
jne 0x44a6ce
cmp byte [ebp - 8], 0
jne 0x44a6ce
push esi
jmp 0x44ab77