Function at 0x44d290
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [esp + 0x18], edx
push edi
cmp esi, 0x200
ja 0x44d4af
je 0x44d304
mov eax, esi
sub eax, 2
je 0x44d2d1
sub eax, 0x1d
jne case.0x44d4c5.515
push ecx
push eax
call fcn.0044d610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x50]
test eax, eax
je case.0x44d4c5.515
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je case.0x44d4c5.515
mov dword [ebx + 0x50], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
mov edi, ecx
sub edi, dword [ebx + 8]
cwde
mov esi, eax
mov dword [esp + 0x10], ecx
sub esi, dword [ebx + 0xc]
mov dword [esp + 0x14], eax
mov ecx, esi
mov eax, edi
imul ecx, esi
imul eax, edi
mov dword [esp + 0x18], 0x60
add ecx, eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x28], ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 1
push dword [esp + 0x30]
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_MonitorFromPoint]
push str.SHCore.dll
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x44d36d
mov edx, 0x200
jmp 0x44d3ac
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x44d384
mov edx, 0x200
jmp 0x44d3ac
lea ecx, [esp + 0x18]
push ecx
push ecx
push 0
push dword [esp + 0x2c]
call eax
mov edx, 0x200
test eax, eax
jne 0x44d3ac
mov ecx, dword [esp + 0x18]
mov eax, 0xaaaaaaab
shl ecx, 9
mul ecx
shr edx, 6
cmp dword [esp + 0x24], edx
jle 0x44d41b
mov eax, esi
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
cmp edi, ecx
jle 0x44d3c7
test edi, edi
jle 0x44d3c7
mov cl, 0x52
jmp 0x44d3f0
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jle 0x44d3da
test edi, edi
jns 0x44d3da
mov cl, 0x4c
jmp 0x44d3f0
cmp esi, eax
jle 0x44d3e6
test esi, esi
jle 0x44d3e6
mov cl, 0x44
jmp 0x44d3f0
cmp ecx, eax
jle 0x44d41b
test esi, esi
jns 0x44d41b
mov cl, 0x55
mov eax, dword [ebx + 0x10]
cmp eax, 3
jge 0x44d40b
cmp eax, 0xffffffff
je 0x44d403
cmp byte [eax + ebx + 0x14], cl
je 0x44d40b
inc eax
mov dword [ebx + 0x10], eax
mov byte [eax + ebx + 0x14], cl
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
jmp 0x44d423
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp dword [ebx + 0x50], 0
je 0x44d49d
push ecx
push eax
push ecx
mov ecx, ebx
call fcn.0044cb70
mov esi, dword [ebx + 0x50]
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push esi
push eax
mov dword [esp + 0x20], eax
call edi
push 2
mov esi, eax
mov dword [esp + 0x18], 0x1ff0000
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], 0
push eax
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x38], 0
push eax
push dword [esp + 0x28]
lea eax, [ebx + 0x58]
push eax
push 0
push 0
push dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
push esi
mov esi, dword [esp + 0x1c]
push esi
call edi
test esi, esi
je 0x44d49d
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, ebx
call fcn.0044ce40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esi - 0x201]
cmp eax, 0x14
ja case.0x44d4c5.515
movzx eax, byte [eax + 0x44d5f0]
jmp dword [eax*4 + 0x44d5d4]
push ecx
push 0
call fcn.0044d610
jmp case.0x44d4c5.515
push ecx
push 0
call fcn.0044d610
cmp dword [0x61a1c8], 0
jne 0x44d4f1
mov ecx, ebx
call fcn.0044d0a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ax, word [0x5cf4c8]
mov word [ebx + 0x14], ax
mov al, byte [0x5cf4ca]
mov byte [ebx + 0x16], al
mov dword [ebx + 0x10], 2
call fcn.0044ce40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0044d0a0
mov dword [ebx + 0x14], 0
mov ecx, ebx
mov byte [ebx + 0x18], 0
mov dword [ebx + 0x10], 0xffffffff
call fcn.0044ce40
push ecx
push 0
mov ecx, ebx
call fcn.0044d610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ax, word [0x5cf4e0]
mov word [ebx + 0x14], ax
mov al, byte [0x5cf4e2]
jmp 0x44d50b
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 2
call edi
cwde
shr eax, 0x10
test eax, eax
je case.0x44d4c5.515
push 4
call edi
cwde
shr eax, 0x10
test eax, eax
jne case.0x44d4c5.515
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x5cf4d8]
shr eax, 0x10
test ax, ax
cmovg ecx, dword [0x5cf4dc]
mov dword [ebx + 0x14], ecx
mov ecx, ebx
mov dword [ebx + 0x10], 3
call fcn.0044ce40
mov ecx, ebx
call fcn.0044d0a0
push ecx
push 0
mov ecx, ebx
call fcn.0044d610
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc