Function at 0x442345
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
cmp ecx, 0x102
jne 0x442363
xor eax, eax
jmp 0x4425e7
cmp ecx, 0x100
je 0x442516
cmp ecx, 0x104
je 0x442516
cmp ecx, 0x101
je 0x4424ae
cmp ecx, 0x105
je 0x4424ae
cmp ecx, 8
jne 0x4423b3
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00440c1f
mov edi, eax
mov eax, edi
jmp 0x4425e7
mov eax, 0x2111
cmp ecx, eax
jne 0x442408
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
mov edx, 0x300
cmp cx, dx
jne 0x4423e0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push eax
call fcn.00440c4e
jmp 0x4423aa
mov eax, 0x400
cmp cx, ax
jne 0x4423ac
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4423ac
cmp ecx, 0x2133
je 0x44242b
cmp ecx, 0x2138
je 0x44242b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00413887
jmp 0x4425e7
mov ecx, dword [esi + 0x20]
call fcn.00440f11
cmp eax, 0xffffffff
je 0x44235c
push 1
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esi + 0x20]
call fcn.004267a1
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x24], edi
jne 0x4424a6
mov ecx, dword [esi + 0x20]
call fcn.00440f11
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
jmp 0x4425e7
mov ecx, dword [esi + 0x20]
call fcn.0044128e
cmp eax, 1
jae 0x44235c
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424d5
push 0
jmp 0x4424d7
push 1
call fcn.0044122f
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424ec
push 0
jmp 0x4424ee
push 1
call fcn.0044120d
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x442503
push 0
jmp 0x442505
push 1
call fcn.004411eb
mov ecx, esi
call fcn.0044221e
jmp 0x44235c
mov ecx, dword [esi + 0x20]
call fcn.00441264
test eax, eax
je 0x44252a
mov ecx, dword [esi + 0x20]
call fcn.0044129c
mov ecx, dword [esi + 0x20]
call fcn.00441272
test eax, eax
je 0x44253e
mov ecx, dword [esi + 0x20]
call fcn.004412ac
mov ecx, dword [esi + 0x20]
call fcn.00441280
test eax, eax
je 0x442552
mov ecx, dword [esi + 0x20]
call fcn.004412bc
mov ecx, dword [esi + 0x20]
call fcn.0044128e
mov ecx, dword [esi + 0x20]
push 0
mov edx, eax
call fcn.00441251
test edx, edx
jbe 0x442573
mov ecx, dword [esi + 0x20]
push edx
call fcn.004412cc
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x442589
push 0
jmp 0x44258b
push 1
call fcn.0044122f
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4425a0
push 0
jmp 0x4425a2
push 1
call fcn.0044120d
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4425b7
push 0
jmp 0x4425b9
push 1
call fcn.004411eb
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x4425dd
cmp eax, 0x11
je 0x4425dd
cmp eax, 0x10
je 0x4425dd
cmp eax, 0x12
je 0x4425dd
mov ecx, dword [esi + 0x20]
push eax
call fcn.00441251
mov ecx, esi
call fcn.0044221e
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc