Function at 0x44b880
Capabilities:
Create directory
Hide graphical window
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x384
mov eax, dword [0x54b07c]
xor eax, esp
mov dword [esp + 0x380], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov dword [esp + 0x18], 0
call fcn.004cb69f
add esp, 4
push eax
push 0x536fc0
lea eax, [esp + 0x1c]
push str.CONIN_
push eax
call fcn.004d6218
push 1
call fcn.004cb69f
add esp, 0x14
push eax
push 0x536fcc
lea eax, [esp + 0x1c]
push 0x536fc4
push eax
call fcn.004d6218
push 2
call fcn.004cb69f
add esp, 0x14
push eax
push 0x536fd8
lea eax, [esp + 0x1c]
push str.CONOUT_
push eax
call fcn.004d6218
push 0x104
lea eax, [esp + 0x94]
push 0
push eax
call fcn.004c7d50
add esp, 0x1c
lea eax, [esp + 0x188]
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
lea eax, [esp + 0x290]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x198]
push eax
call fcn.004d0507
add esp, 0x14
xor ecx, ecx
lea ebx, [ebx]
mov al, byte [esp + ecx + 0xc]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x7f], al
test al, al
jne 0x44b960
lea edx, [esp + 0x288]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x44b978
lea edi, [esp + 0x80]
sub edx, esi
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44b990
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x80]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
lea edx, [ecx + 1]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44b9d0
sub ecx, edx
lea eax, [esp + 0x80]
push ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00404700
lea eax, [esp + 0x68]
mov ecx, 0x54dea0
push eax
call fcn.00401f20
mov ecx, dword [esp + 0x7c]
cmp ecx, 0x10
jb 0x44ba30
mov edx, dword [esp + 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44ba26
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c38b
push ecx
push edx
call fcn.0049dbeb
add esp, 8
mov dword [0xf54874], ebx
call fcn.00424270
mov ecx, dword [0x54deb0]
mov esi, Ordinal_1
mov eax, esi
sub eax, ecx
cmp eax, 4
jb 0x44c390
cmp dword [0x54deb4], 0x10
mov eax, 0x54dea0
jb 0x44ba66
mov eax, dword [0x54dea0]
push 4
push str.save
push ecx
push eax
push ecx
push dword [esp + 0x24]
lea ecx, [esp + 0x80]
call fcn.00404aa0
cmp dword [esp + 0x7c], 0x10
lea eax, [esp + 0x68]
jb 0x44ba8f
mov eax, dword [esp + 0x68]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push eax
call edi
mov ecx, dword [esp + 0x7c]
cmp ecx, 0x10
jb 0x44bad0
mov edx, dword [esp + 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44bac6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c395
push ecx
push edx
call fcn.0049dbeb
add esp, 8
mov ecx, dword [0x54deb0]
mov eax, esi
sub eax, ecx
cmp eax, 7
jb 0x44c39a
cmp dword [0x54deb4], 0x10
mov eax, 0x54dea0
jb 0x44baf6
mov eax, dword [0x54dea0]
push 7
push str.Mempaks
push ecx
push eax
push ecx
push dword [esp + 0x24]
lea ecx, [esp + 0x80]
call fcn.00404aa0
cmp dword [esp + 0x7c], 0x10
lea eax, [esp + 0x68]
jb 0x44bb1f
mov eax, dword [esp + 0x68]
push 0
push eax
call edi
mov ecx, dword [esp + 0x7c]
cmp ecx, 0x10
jb 0x44bb5a
mov edx, dword [esp + 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44bb50
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c39f
push ecx
push edx
call fcn.0049dbeb
add esp, 8
mov ecx, dword [0x54deb0]
mov eax, esi
sub eax, ecx
cmp eax, 4
jb 0x44c3a4
cmp dword [0x54deb4], 0x10
mov eax, 0x54dea0
jb 0x44bb80
mov eax, dword [0x54dea0]
push 4
push str.Lang
push ecx
push eax
push ecx
push dword [esp + 0x24]
lea ecx, [esp + 0x80]
call fcn.00404aa0
cmp dword [esp + 0x7c], 0x10
lea eax, [esp + 0x68]
jb 0x44bba9
mov eax, dword [esp + 0x68]
push 0
push eax
call edi
mov ecx, dword [esp + 0x7c]
cmp ecx, 0x10
jb 0x44bbe4
mov edx, dword [esp + 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44bbda
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c3a9
push ecx
push edx
call fcn.0049dbeb
add esp, 8
mov ecx, dword [0x54deb0]
mov eax, esi
sub eax, ecx
cmp eax, 0xb
jb 0x44c3ae
cmp dword [0x54deb4], 0x10
mov eax, 0x54dea0
jb 0x44bc0a
mov eax, dword [0x54dea0]
push 0xb
push str.ScreenShots
push ecx
push eax
push ecx
push dword [esp + 0x24]
lea ecx, [esp + 0x80]
call fcn.00404aa0
cmp dword [esp + 0x7c], 0x10
lea eax, [esp + 0x68]
jb 0x44bc33
mov eax, dword [esp + 0x68]
push 0
push eax
call edi
mov ecx, dword [esp + 0x7c]
cmp ecx, 0x10
jb 0x44bc6e
mov edx, dword [esp + 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44bc64
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c3b3
push ecx
push edx
call fcn.0049dbeb
add esp, 8
mov ecx, dword [0x54deb0]
sub esi, ecx
cmp esi, 6
jb 0x44c3b8
cmp dword [0x54deb4], 0x10
mov eax, 0x54dea0
jb 0x44bc92
mov eax, dword [0x54dea0]
push 6
push str.plugin
push ecx
push eax
push ecx
push dword [esp + 0x24]
lea ecx, [esp + 0x80]
call fcn.00404aa0
cmp dword [esp + 0x7c], 0x10
lea eax, [esp + 0x68]
jb 0x44bcbb
mov eax, dword [esp + 0x68]
push 0
push eax
call edi
mov ecx, dword [esp + 0x7c]
cmp ecx, 0x10
jb 0x44bcf6
mov edx, dword [esp + 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44bcec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c3bd
push ecx
push edx
call fcn.0049dbeb
add esp, 8
mov dword [0xf5487c], 0
mov dword [0xf54888], 1
call fcn.00438bd0
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x93
push dword [0xf54874]
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], 0x30
mov dword [esp + 0x38], ebx
call esi
push 0xb4
push dword [0xf54874]
mov dword [esp + 0x3c], eax
call esi
push 0x7f00
push 0
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], str.myWindowClass
mov dword [esp + 0x28], 0x448ee0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x44], 0x65
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0x67
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push 0
push ebx
push 0
push 0
push dword [0x269351c]
mov dword [esp + 0x2c], eax
push dword [0x2693518]
push dword [0x2693514]
push dword [0x2693510]
push 0x2cf0000
push str.Mupen_64_1.1.6
push str.myWindowClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push dword [ebp + 0x14]
mov ebx, eax
push ebx
mov dword [esp + 0x18], ebx
mov dword [0xf54870], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x10
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.00433f60
mov eax, dword [0xf541f4]
mov esi, dword [0x269337c]
test eax, eax
je 0x44be24
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xf541f4], 0
test esi, esi
je 0x44be2d
call fcn.00422c90
call fcn.00422060
mov ecx, dword [0x2693380]
call fcn.00422c20
mov eax, dword [0xf541f0]
mov edx, dword [0x54bbc0]
mov ecx, dword [0xf54870]
mov dword [0x54fdb8], eax
mov dword [0x54fdbc], eax
mov eax, dword [0xf54874]
mov dword [0x54fdc0], 1
mov dword [0x54fdc4], 0x54fe48
mov dword [0x54fdc8], 0x115e970
mov dword [0x54fdcc], 0x115c900
mov dword [0x54fdd0], edx
mov dword [0x54fdd4], 0x115c8ec
mov dword [0x54fdd8], 0x195e9a4
mov dword [0x54fddc], 0x195e9a8
mov dword [0x54fde0], 0x195e9ac
mov dword [0x54fde4], 0x195e9b4
mov dword [0x54fde8], 0x195e9c4
mov dword [0x54fdec], 0x195e9c8
mov dword [0x54fdf0], 0x195e9cc
mov dword [0x54fdf4], 0x195e9d0
mov dword [0x54fdf8], 0x115e908
mov dword [0x54fdfc], 0x115e90c
mov dword [0x54fe00], 0x115e910
mov dword [0x54fe04], 0x115e914
mov dword [0x54fe08], 0x115e918
mov dword [0x54fe0c], 0x115e91c
mov dword [0x54fe10], 0x115e920
mov dword [0x54fe14], 0x115e924
mov dword [0x54fe18], 0x115e928
mov dword [0x54fe1c], 0x115e92c
mov dword [0x54fe20], 0x115e930
mov dword [0x54fe24], 0x115e934
mov dword [0x54fe28], 0x115e938
mov dword [0x54fe2c], 0x115e93c
mov dword [0x54fe30], 0x401ae0
mov dword [0x54ff14], ecx
mov dword [0x54ff18], eax
mov dword [0x54ff1c], 1
mov dword [0x54ff20], 0x54fe48
mov dword [0x54ff24], 0x115e970
mov dword [0x54ff28], 0x115c900
mov dword [0x54ff2c], edx
mov dword [0x54ff30], 0x115c8ec
mov dword [0x54ff34], 0x115e944
mov dword [0x54ff38], 0x115e948
mov dword [0x54ff3c], 0x115e94c
mov dword [0x54ff40], 0x115e950
mov dword [0x54ff44], 0x115e954
mov dword [0x54ff48], 0x115e958
mov dword [0x54ff4c], 0x401ae0
mov dword [0x5500c8], ecx
mov dword [0x5500cc], eax
mov dword [0x5500d0], 1
mov dword [0x5500d4], 0x54fe48
mov dword [0x5500d8], 0x550050
mov dword [0x550050], 0
mov dword [0x550054], 0
mov dword [0x550058], 1
mov dword [0x55005c], 0
mov dword [0x550060], 0
mov dword [0x550064], 1
mov dword [0x550068], 0
mov dword [0x55006c], 0
mov dword [0x550070], 1
mov dword [0x550074], 0
mov dword [0x550078], 0
mov dword [0x55007c], 1
mov dword [0x54ffdc], 1
mov dword [0x54ffe0], 0x115e970
mov dword [0x54ffe4], 0x115c900
mov dword [0x54ffe8], edx
mov dword [0x54ffec], 0x115c8ec
mov dword [0x54fff0], 0x195e970
mov dword [0x54fff4], 0x195e974
mov dword [0x54fff8], 0x195e978
mov dword [0x54fffc], 0x195e97c
mov dword [0x550000], 0x195e984
mov dword [0x550004], 0x195e998
mov eax, dword [fcn.00401ae0]
mov dword [0x550038], eax
mov eax, dword [fcn.00401ae0]
mov dword [0x55003c], eax
mov eax, dword [fcn.00401ae0]
mov dword [0x550040], eax
mov eax, dword [fcn.00401ae0]
mov dword [0x550008], 0x195e99c
mov dword [0x55000c], 0x115e900
mov dword [0x550010], 0x195e9a0
mov dword [0x550014], 0x195e9a4
mov dword [0x550018], 0x195e9a8
mov dword [0x55001c], 0x195e9ac
mov dword [0x550020], 0x195e9b4
mov dword [0x550024], 0x195e9c4
mov dword [0x550028], 0x195e9c8
mov dword [0x55002c], 0x195e9cc
mov dword [0x550030], 0x195e9d0
mov dword [0x550034], 0x401ae0
mov dword [0x550044], eax
call fcn.004210a0
call fcn.00421fc0
call fcn.00422060
cmp dword [0x2693370], 0
setne cl
call fcn.004458b0
xor ecx, ecx
call fcn.0041e9c0
xor ecx, ecx
call fcn.004018d0
xor ecx, ecx
call fcn.004489f0
xor ecx, ecx
call fcn.004483e0
push 0x44b790
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
push 0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jle 0x44c370
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x1c]
push dword [0xf54870]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x44c242
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov esi, dword [0x2795da0]
mov ebx, dword [0x2795d9c]
mov dword [esp + 0xc], esi
cmp ebx, esi
je 0x44c357
mov eax, esi
lea esp, [esp]
mov esi, dword [ebx]
cmp dword [esi + 0x18], 0
jne 0x44c34c
cmp dword [esi + 0x20], 0
jne 0x44c282
cmp dword [esi + 0x1c], 0
jne 0x44c282
cmp dword [esi + 0x24], 0
je 0x44c34c
cmp dword [0x2692b94], 0x10
mov eax, 0x2692b80
jb 0x44c295
mov eax, dword [0x2692b80]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x44c29f
mov ecx, dword [esi]
push dword [0x2692b90]
mov edx, dword [esi + 0x10]
push eax
call fcn.00402330
add esp, 8
test al, al
je 0x44c307
cmp dword [0x195eabc], 0
jne 0x44c348
push 0x10
call edi
shr eax, 0xf
and eax, 1
cmp eax, dword [esi + 0x20]
jne 0x44c2fb
push 0x11
call edi
shr eax, 0xf
and eax, 1
cmp eax, dword [esi + 0x1c]
jne 0x44c2fb
push 0x12
call edi
shr eax, 0xf
and eax, 1
cmp eax, dword [esi + 0x24]
jne 0x44c2fb
mov dword [0xf54750], 1
jmp 0x44c348
mov dword [0xf54750], 0
jmp 0x44c348
push 0x10
call edi
shr eax, 0xf
and eax, 1
cmp eax, dword [esi + 0x20]
jne 0x44c348
push 0x11
call edi
shr eax, 0xf
and eax, 1
cmp eax, dword [esi + 0x1c]
jne 0x44c348
push 0x12
call edi
shr eax, 0xf
and eax, 1
cmp eax, dword [esi + 0x24]
jne 0x44c348
push 0
push dword [esi + 0x28]
push 0x111
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0xc]
add ebx, 4
cmp ebx, eax
jne 0x44c260
push 0
push 0
push 0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jg 0x44c213
mov ecx, dword [esp + 0x38c]
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret 0x10
call fcn.004cb586
call fcn.004018c0
call fcn.004cb586
call fcn.004018c0
call fcn.004cb586
call fcn.004018c0
call fcn.004cb586
call fcn.004018c0
call fcn.004cb586
call fcn.004018c0
call fcn.004cb586
int3