Function at 0xbe44f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0xc96fc0], 1
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], esi
je 0xbe453a
lea eax, [ebp - 0x18]
mov edx, 0xa14ca8
push eax
push 1
push ecx
mov ecx, 0xc933f0
call fcn.00a4d1e0
or dword [ebp - 0x1c], 0xffffffff
cmp dword [esi + 0x178], 1
jne 0xbe454e
mov ecx, esi
call fcn.00be1ec1
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
cmp dword [ebx + 0x10], 0
je 0xbe462c
mov edi, dword [esi + 0xac]
mov eax, dword [esi + 0xb0]
mov ecx, eax
mov dword [ebp - 0x20], eax
test edi, edi
jne 0xbe45a1
mov eax, dword [esi + 0x88]
test eax, eax
je 0xbe4583
mov ecx, dword [eax]
jmp 0xbe4585
xor ecx, ecx
test ecx, ecx
jle 0xbe46f8
mov eax, dword [eax + 4]
xor ecx, ecx
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x20], eax
test edi, edi
je 0xbe46f8
cmp ecx, 0xfffffffe
jl 0xbe45dc
mov esi, dword [edi]
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
mov ecx, dword [esi + 0x3c]
call dword [0xc99200]
call dword [esi + 0x3c]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
test edi, edi
je 0xbe46f8
cmp eax, 0xffffffff
je 0xbe46f8
mov eax, dword [edi]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push edi
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0xc99200]
call esi
cmp eax, 1
jne 0xbe4663
mov ecx, dword [ebp - 0x20]
test ecx, ecx
js 0xbe4663
mov eax, dword [edi]
push ecx
push edi
mov esi, dword [eax + 0xbc]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0xbe4666
mov eax, dword [ebx + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ScreenToClient]
push 0
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00be59f7
mov edi, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0xbe45df
mov esi, dword [ebp - 0x1c]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0xbe46b1
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x2c]
push dword [eax + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ClientToScreen]
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x1c]
push ecx
push eax
mov eax, dword [ebp - 0x2c]
push 0
push dword [eax + 4]
add eax, 0x18
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push eax
call fcn.00bdff20
jmp 0xbe46f8
mov eax, dword [ebp - 0x2c]
cmp edi, dword [eax + 0x3f0]
jne 0xbe46cf
cmp edi, dword [eax + 0xb4]
jne 0xbe46f8
mov ecx, dword [ebp - 0x20]
cmp dword [eax + 0xb8], ecx
je 0xbe46f8
cmp dword [ebx + 0x10], 0
setne al
movzx eax, al
push eax
mov eax, dword [edi]
push esi
push edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xc99200]
call esi
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x14
push eax
call fcn.00be0ca0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00ab3c50
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc