Function at 0x4442e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
push edi
mov esi, ecx
je 0x4442f9
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x444303
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x44430d
mov byte [esi + 0x17], 1
xor eax, eax
cmp byte [esi + 0x14], al
je 0x44431c
cmp byte [esi + 0x1a], al
je 0x44431c
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x444329
cmp byte [esi + 0x1b], al
je 0x444329
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x444336
cmp byte [esi + 0x1c], al
je 0x444336
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x444343
cmp byte [esi + 0x1d], al
je 0x444343
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x444350
cmp byte [esi + 0x1e], al
je 0x444350
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x4443f2
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x444528
mov cl, byte [esi + 0x1a]
movzx eax, byte [ebp - 0x6c]
xor edx, edx
test cl, cl
cmove eax, edx
mov dl, byte [esi + 0x1b]
mov byte [ebp - 0x6c], al
movzx eax, byte [ebp - 0x6b]
xor edi, edi
test dl, dl
cmove eax, edi
mov byte [ebp - 0x6b], al
test cl, cl
jne 0x4443a6
movzx eax, byte [ebp - 0xfc]
test dl, dl
cmove eax, edi
mov byte [ebp - 0xfc], al
movzx eax, byte [ebp - 0xfb]
xor edx, edx
cmp byte [esi + 0x1c], dl
cmove eax, edx
cmp byte [esi + 0x1d], dl
mov byte [ebp - 0xfb], al
movzx eax, byte [ebp - 0xfa]
cmove eax, edx
mov byte [ebp - 0xfa], al
movzx eax, byte [ebp - 0xb1]
test cl, cl
cmove eax, edx
mov byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x444528
push ebx
lea ecx, [ebp - 0xc]
call fcn.00443f35
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x444429
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x444447
cmp byte [esi + 0x1a], 0
jne 0x444447
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.004456aa
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f26
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x444469
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x444487
cmp byte [esi + 0x1b], 0
jne 0x444487
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.004456aa
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f26
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4444a3
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x4444be
cmp byte [esi + 0x1c], 0
jne 0x4444be
push 0x11
lea ecx, [ebp - 0xc]
call fcn.004456aa
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f26
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4444da
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x4444f5
cmp byte [esi + 0x1d], 0
jne 0x4444f5
push 0x12
lea ecx, [ebp - 0xc]
call fcn.004456aa
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f26
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x44450c
push 0x5b
call edi
test bx, ax
je 0x444527
cmp byte [esi + 0x1e], 0
jne 0x444527
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.004456aa
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f26
pop ebx
pop edi
pop esi
leave
ret 4