Function at 0x444882
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 0x1c], ebx
push edi
mov edi, eax
je 0x4448e7
cmp dword [ebp + 0x1c], 0x6a
jne 0x444991
cmp dword [ebp + 0xc], 0x100
jne 0x444991
movzx eax, word [ebp + 0x10]
cmp eax, 0x61
mov dword [edi + 0x3ec], ebx
je 0x4448c0
cmp eax, 0x41
jne 0x4448d7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4448d7
lea esi, [edi + 0x3c0]
call fcn.00446d5e
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x3ec], ebx
jmp 0x44498f
mov eax, dword [ebp + 0xc]
cmp eax, 0x113
jne 0x444926
mov eax, dword [ebp + 0x10]
dec eax
mov dword [edi + 0x3ec], 1
je 0x44490d
dec eax
jne 0x444914
mov esi, edi
call fcn.00446540
jmp 0x444914
mov esi, edi
call fcn.004460c9
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x3ec], ebx
je 0x444976
xor eax, eax
inc eax
jmp 0x444993
cmp eax, 0x4e
jne 0x444950
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0xffffffff
jne 0x444976
lea esi, [edi + 0x3ec]
mov ecx, edi
mov dword [esi], 1
call fcn.0044472b
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [esi], ebx
jmp 0x44491f
cmp eax, 0x110
jne 0x44499c
lea esi, [edi + 0x3ec]
mov ebx, edi
mov dword [esi], 1
call fcn.00445883
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [esi], 0
jne 0x444921
xor ebx, ebx
push ebx
push dword [ebp + 0x18]
mov ecx, edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00447201
test eax, eax
jne 0x444921
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x10
jne 0x4449c5
push ebx
push 2
push 0x111
push dword [edi + 4]
lea esi, [edi + 0x3ec]
mov dword [esi], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x44494c
push 2
pop esi
cmp eax, esi
jne 0x444a00
lea eax, [edi + 0x80c]
push eax
push esi
mov dword [edi + 0x3ec], 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
cmp dword [edi + 0x2c0], ebx
je 0x444914
lea eax, [edi + 0x2bc]
call fcn.0040aac9
jmp 0x444914
cmp eax, 0x112
jne 0x444a36
mov eax, dword [ebp + 0x10]
and eax, 0xfff0
cmp eax, 0xf060
mov dword [edi + 0x3ec], ebx
jne 0x444914
mov esi, edi
mov dword [edi + 0x3ec], 1
call fcn.00445dd6
jmp 0x444914
cmp eax, 0x111
jne 0x444a63
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cmp ax, 0x300
lea esi, [edi + 0x3ec]
mov dword [esi], ebx
jne 0x4449be
mov ebx, edi
call fcn.00446aa4
xor ebx, ebx
jmp 0x4449be
cmp eax, 0x133
jne 0x444a9d
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [esp + 0x10], esp
push ecx
mov dword [edi + 0x3ec], 1
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [eax], ecx
mov eax, edi
mov dword [esp + 0x14], esp
call fcn.00446918
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x444919
cmp eax, 0x467
jne 0x444aca
push dword [ebp + 0x14]
xor esi, esi
push dword [ebp + 0x10]
inc esi
push edi
mov dword [edi + 0x3ec], esi
call fcn.004461a8
push dword [ebp + 0x10]
mov ecx, esi
mov edx, edi
call fcn.0044600c
jmp 0x444914
cmp eax, 0x46b
jne 0x444af6
lea esi, [edi + 0x3ec]
xor eax, eax
mov ecx, edi
mov dword [esi], 1
call fcn.00446c59
push ebx
push 3
pop ecx
mov edx, edi
call fcn.0044600c
jmp 0x4449be
cmp eax, 0x46e
jne 0x444b13
lea esi, [edi + 0x3ec]
mov dword [esi], 1
call fcn.00445bbc
jmp 0x444947
cmp eax, 0x46d
jne 0x444b39
push ebx
lea esi, [edi + 0x3ec]
push 0xc8
lea eax, [edi + 0x24]
mov dword [esi], 1
call fcn.004473a6
jmp 0x4449be
cmp eax, 0x470
jne 0x444b58
lea esi, [edi + 0x3ec]
mov eax, edi
mov dword [esi], 1
call fcn.00445bf9
jmp 0x444947
cmp eax, 0x471
jne 0x444b87
push ebx
xor eax, eax
inc eax
push 6
pop ecx
mov edx, edi
mov dword [edi + 0x3ec], eax
mov dword [edi + 0xbe4], eax
call fcn.0044600c
mov eax, esi
mov ecx, edi
call fcn.00446c59
jmp 0x444914
cmp eax, 0x46c
jne 0x444ba9
mov eax, dword [ebp + 0x10]
lea esi, [edi + 0x3ec]
mov edx, edi
mov dword [esi], 1
call fcn.00445d87
jmp 0x444947
cmp eax, 0x468
jne 0x444bf2
cmp dword [ebp + 0x10], esi
jne 0x444be8
cmp dword [ebp + 0x14], 0x204
je 0x444bc7
cmp dword [ebp + 0x14], 0x201
jne 0x444be8
lea eax, [edi + 0xbe8]
cmp byte [eax], bl
jne 0x444bd4
mov byte [eax], 1
push 9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x444921
cmp eax, 0x46a
jne 0x444c14
push 2
lea esi, [edi + 0x3ec]
pop ecx
mov eax, edi
mov dword [esi], 1
call fcn.004471de
jmp 0x4449be
cmp eax, 0x472
jne 0x444976
lea esi, [edi + 0x3ec]
mov dword [esi], 1
call fcn.00445e46
jmp 0x4449be