Function at 0x44b8fb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp word [edi + 0xc], 9
jne 0x44b933
lea eax, [ecx + 0x64]
lea edx, [ecx + 0x68]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [edi]
cmp edx, dword [eax]
jne 0x44b933
mov ecx, dword [ecx + 0x3c]
mov eax, dword [ecx]
call dword [eax]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and al, 1
push 0x11
mov byte [ebp - 1], al
call esi
shr eax, 0xf
and al, 1
push 0xa3
mov byte [ebp + 0xb], al
call esi
mov bx, ax
push 0x10
shr ebx, 0xf
and bl, 1
call esi
shr eax, 0xf
and al, 1
xor esi, esi
mov byte [ebp - 8], al
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ax, word [edi + 0xc]
cmp ax, 0x30
jb 0x44b9b1
cmp ax, 0x39
ja 0x44b9b1
test bl, bl
jne 0x44b98d
cmp byte [ebp - 1], bl
je 0x44b9b1
mov ecx, dword [ebp - 0xc]
movzx eax, ax
sub eax, 0x30
cmp byte [ebp - 8], 0
push eax
je 0x44b9a7
call fcn.00444e08
jmp 0x44bd6d
call fcn.00444e79
jmp 0x44bd6d
cmp ax, 0x71
je 0x44b9bd
cmp ax, 0x70
jne 0x44b9e9
cmp byte [ebp - 1], 0
je 0x44b9e9
cmp byte [ebp + 0xb], 0
jne 0x44b9e9
cmp byte [ebp - 8], 0
jne 0x44b9e9
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp ax, 0x70
mov ecx, dword [ecx + 0x3c]
setne bl
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
jmp 0x44bd6d
cmp ax, 0x78
jne 0x44ba0b
cmp byte [ebp - 1], 0
jne 0x44ba0b
cmp byte [ebp + 0xb], 0
jne 0x44ba0b
cmp byte [ebp - 8], 0
jne 0x44ba0b
mov ecx, 0x47e498
call fcn.004306ea
mov cx, word [edi + 0xc]
cmp cx, 0x72
jb 0x44ba3d
cmp cx, 0x7b
ja 0x44ba3d
cmp byte [ebp + 0xb], 0
je 0x44ba3d
call fcn.0044be2a
cmp eax, esi
jl 0x44ba3d
mov ebx, dword [ebp - 0xc]
push dword [eax*8 + 0x46d05c]
mov ecx, ebx
call fcn.0044fe73
jmp 0x44ba40
mov ebx, dword [ebp - 0xc]
movzx eax, word [edi + 0xc]
cmp eax, 0x56
jg 0x44bc1e
je 0x44bc0f
cmp eax, 0x2d
jg 0x44bb63
je 0x44bb0c
sub eax, 8
je 0x44bb00
sub eax, 8
je 0x44bae6
sub eax, 0x12
je 0x44bac3
sub eax, 3
je 0x44bab0
dec eax
je 0x44ba9d
dec eax
je 0x44bab0
dec eax
jne 0x44b92a
cmp byte [ebp - 8], 0
je 0x44b92a
mov ecx, ebx
call fcn.0044f470
jmp 0x44b92a
cmp byte [ebp - 1], 0
je 0x44ba87
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x44b92a
cmp byte [ebp - 1], 0
je 0x44ba87
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x44b92a
cmp byte [ebp + 0xb], 0
je 0x44b92a
cmp byte [ebp - 1], 0
jne 0x44b92a
cmp byte [ebp - 8], 0
jne 0x44b92a
jmp 0x44bd6d
and byte [ebx + 0x178], 0
lea ecx, [ebx + 0x68]
call fcn.00431ada
mov dword [ebx + 0x17c], eax
jmp 0x44b92a
mov ecx, ebx
call fcn.004458b5
jmp 0x44bd6d
cmp byte [ebp - 1], 0
jne 0x44b92a
cmp byte [ebp + 0xb], 0
je 0x44bb2e
cmp byte [ebp - 8], 0
jne 0x44bb34
mov ecx, ebx
call fcn.0044d548
jmp 0x44bd6d
cmp byte [ebp - 8], 0
je 0x44bb4a
cmp byte [ebp + 0xb], 0
jne 0x44b92a
mov ecx, ebx
call fcn.0045f8c6
jmp 0x44bd6d
cmp byte [ebx + 0x87], 0
je 0x44b92a
mov ecx, ebx
call fcn.0044f50f
jmp 0x44bd6d
cmp eax, 0x2e
je 0x44bbfb
cmp eax, 0x30
jle 0x44b92a
cmp eax, 0x34
jle 0x44bbe1
cmp eax, 0x41
je 0x44bbce
cmp eax, 0x43
je 0x44bbbf
cmp eax, 0x4e
je 0x44bba9
cmp eax, 0x52
jne 0x44b92a
cmp byte [ebp + 0xb], 0
je 0x44b92a
push esi
mov ecx, ebx
call fcn.0044b52f
jmp 0x44bd6d
cmp byte [ebp + 0xb], 0
je 0x44b92a
mov ecx, ebx
call fcn.0044edc5
jmp 0x44bd6d
cmp byte [ebp + 0xb], 0
je 0x44b92a
jmp 0x44bb22
cmp byte [ebp + 0xb], 0
je 0x44b92a
push 1
mov ecx, ebx
jmp 0x44bc6d
cmp byte [ebp + 0xb], 0
je 0x44b92a
add eax, 0xffffffcf
mov ecx, ebx
push eax
call fcn.0043f3c3
jmp 0x44bd6d
cmp byte [ebp - 8], 0
mov ecx, ebx
sete al
push eax
call fcn.0044e39a
jmp 0x44bd6d
cmp byte [ebp + 0xb], 0
je 0x44b92a
jmp 0x44bb3e
cmp eax, 0x71
jg 0x44bd22
je 0x44bcfb
sub eax, 0x57
je 0x44bcdb
dec eax
je 0x44bcc5
dec eax
dec eax
je 0x44bcaf
sub eax, 0x10
je 0x44bca3
dec eax
je 0x44bc77
dec eax
dec eax
jne 0x44b92a
cmp byte [ebp - 1], 0
je 0x44bc64
push esi
mov ecx, ebx
call fcn.0044f725
jmp 0x44bd6d
cmp byte [ebp - 8], 0
push esi
mov ecx, ebx
je 0x44bc99
call fcn.0044f8b4
jmp 0x44bd6d
cmp byte [ebp - 1], 0
je 0x44bc81
push 1
jmp 0x44bc58
cmp byte [ebp - 8], 0
jne 0x44bbd8
cmp byte [ebp + 0xb], 0
jne 0x44bd6d
push 1
mov ecx, ebx
call fcn.0044f655
jmp 0x44bd6d
mov ecx, ebx
call fcn.0044f8e6
jmp 0x44bd6d
cmp byte [ebp + 0xb], 0
je 0x44b92a
mov ecx, ebx
call fcn.0044f077
jmp 0x44bd6d
cmp byte [ebp + 0xb], 0
je 0x44b92a
mov ecx, ebx
call fcn.0045f8c6
jmp 0x44bd6d
cmp byte [ebp + 0xb], 0
je 0x44b92a
push esi
push 8
push 0x111
push dword [0x47e87c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x44bd6d
cmp byte [ebp - 1], 0
jne 0x44b92a
cmp byte [ebp + 0xb], 0
jne 0x44b92a
cmp byte [ebp - 8], 0
jne 0x44b92a
mov ecx, ebx
call fcn.0044f046
jmp 0x44bd6d
sub eax, 0x72
je 0x44be09
dec eax
je 0x44bddd
dec eax
je 0x44bdbe
dec eax
je 0x44bd9b
dec eax
je 0x44bd74
sub eax, 5
jne 0x44b92a
cmp byte [ebp - 1], 0
je 0x44b92a
cmp byte [ebp + 0xb], 0
jne 0x44b92a
cmp byte [ebp - 8], 0
jne 0x44b92a
mov ecx, ebx
call fcn.004455bd
mov al, 1
jmp 0x44b92c
cmp byte [ebp - 1], 0
jne 0x44b92a
cmp byte [ebp + 0xb], 0
jne 0x44b92a
cmp byte [ebp - 8], 0
jne 0x44b92a
mov ecx, ebx
call fcn.0044eb62
jmp 0x44bd6d
cmp byte [ebp - 1], 0
jne 0x44b92a
cmp byte [ebp + 0xb], 0
jne 0x44b92a
mov ecx, dword [ebx + 0x3c]
push dword [ebp - 8]
mov eax, dword [ecx]
push 1
call dword [eax + 8]
jmp 0x44bd6d
cmp byte [ebp - 1], 0
jne 0x44b92a
cmp byte [ebp + 0xb], 0
jne 0x44b92a
mov ecx, dword [ebx + 0x3c]
push dword [ebp - 8]
mov eax, dword [ecx]
push esi
jmp 0x44bdb9
cmp byte [ebp - 1], 0
jne 0x44b92a
cmp byte [ebp + 0xb], 0
jne 0x44b92a
cmp byte [ebp - 8], 0
jne 0x44bbb3
push 1
mov ecx, ebx
call fcn.0044a77a
jmp 0x44bd6d
cmp byte [ebp - 1], 0
jne 0x44b92a
cmp byte [ebp + 0xb], 0
jne 0x44b92a
cmp byte [ebp - 8], 0
jne 0x44b92a
push esi
jmp 0x44bdfd