Function at 0x444366
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
push edi
mov esi, ecx
je 0x44437f
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x444389
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x444393
mov byte [esi + 0x17], 1
xor eax, eax
cmp byte [esi + 0x14], al
je 0x4443a2
cmp byte [esi + 0x1a], al
je 0x4443a2
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x4443af
cmp byte [esi + 0x1b], al
je 0x4443af
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x4443bc
cmp byte [esi + 0x1c], al
je 0x4443bc
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x4443c9
cmp byte [esi + 0x1d], al
je 0x4443c9
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x4443d6
cmp byte [esi + 0x1e], al
je 0x4443d6
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x444478
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4445ae
mov cl, byte [esi + 0x1a]
movzx eax, byte [ebp - 0x6c]
xor edx, edx
test cl, cl
cmove eax, edx
mov dl, byte [esi + 0x1b]
mov byte [ebp - 0x6c], al
movzx eax, byte [ebp - 0x6b]
xor edi, edi
test dl, dl
cmove eax, edi
mov byte [ebp - 0x6b], al
test cl, cl
jne 0x44442c
movzx eax, byte [ebp - 0xfc]
test dl, dl
cmove eax, edi
mov byte [ebp - 0xfc], al
movzx eax, byte [ebp - 0xfb]
xor edx, edx
cmp byte [esi + 0x1c], dl
cmove eax, edx
cmp byte [esi + 0x1d], dl
mov byte [ebp - 0xfb], al
movzx eax, byte [ebp - 0xfa]
cmove eax, edx
mov byte [ebp - 0xfa], al
movzx eax, byte [ebp - 0xb1]
test cl, cl
cmove eax, edx
mov byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x4445ae
push ebx
lea ecx, [ebp - 0xc]
call fcn.00443fbb
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4444af
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x4444cd
cmp byte [esi + 0x1a], 0
jne 0x4444cd
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.00445730
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444fac
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4444ef
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x44450d
cmp byte [esi + 0x1b], 0
jne 0x44450d
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.00445730
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444fac
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x444529
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x444544
cmp byte [esi + 0x1c], 0
jne 0x444544
push 0x11
lea ecx, [ebp - 0xc]
call fcn.00445730
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444fac
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x444560
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x44457b
cmp byte [esi + 0x1d], 0
jne 0x44457b
push 0x12
lea ecx, [ebp - 0xc]
call fcn.00445730
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444fac
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x444592
push 0x5b
call edi
test bx, ax
je 0x4445ad
cmp byte [esi + 0x1e], 0
jne 0x4445ad
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.00445730
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444fac
pop ebx
pop edi
pop esi
leave
ret 4