Function at 0x44e250
Capabilities:
Get common file path
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4eaa88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov ebp, ecx
push 0x11
call esi
mov di, ax
push 8
and edi, 0xffff8000
call esi
mov bx, ax
push 0x10
and ebx, 0xffff8000
call esi
mov esi, dword [esp + 0x4c]
and eax, 0xffff8000
cmp esi, 0x73
mov dword [esp + 0x10], eax
jne 0x44e2ab
mov esi, 0x53
jmp 0x44e2d9
cmp esi, 0x61
jne 0x44e2b7
mov esi, 0x41
jmp 0x44e2d9
cmp esi, 0x63
jne 0x44e2c3
mov esi, 0x43
jmp 0x44e2d9
cmp esi, 0x76
jne 0x44e2cf
mov esi, 0x56
jmp 0x44e2d9
cmp esi, 0x6f
jne 0x44e2d9
mov esi, 0x4f
test di, di
je case.0x44e2f6.70
lea eax, [esi - 0x41]
cmp eax, 0x15
ja case.0x44e2f6.70
xor ecx, ecx
mov cl, byte [eax + 0x44e58c]
jmp dword [ecx*4 + 0x44e574]
mov eax, dword [ebp + 0x8d8]
cmp eax, 1
je 0x44e30d
cmp eax, 2
jne 0x44e321
mov ecx, dword [ebp + 0x354]
test ecx, ecx
je 0x44e321
call fcn.0045a320
jmp case.0x44e2f6.70
cmp eax, 3
jne case.0x44e2f6.70
mov ecx, dword [ebp + 0x358]
test ecx, ecx
je case.0x44e2f6.70
call fcn.0045a320
jmp case.0x44e2f6.70
mov eax, dword [ebp + 0x8d8]
cmp eax, 1
je 0x44e352
cmp eax, 2
jne 0x44e365
mov ecx, dword [ebp + 0x354]
test ecx, ecx
je 0x44e365
mov ecx, ebp
call fcn.00438250
jmp case.0x44e2f6.70
cmp eax, 3
jne case.0x44e2f6.70
mov eax, dword [ebp + 0x358]
test eax, eax
je case.0x44e2f6.70
mov ecx, ebp
call fcn.004385d0
jmp case.0x44e2f6.70
mov eax, dword [ebp + 0x8d8]
cmp eax, 1
je 0x44e38d
cmp eax, 2
jne 0x44e3a0
mov ecx, dword [ebp + 0x354]
test ecx, ecx
je 0x44e3a0
mov ecx, ebp
call fcn.00438270
jmp case.0x44e2f6.70
cmp eax, 3
jne case.0x44e2f6.70
mov eax, dword [ebp + 0x358]
test eax, eax
je case.0x44e2f6.70
mov ecx, ebp
call fcn.004386d0
jmp case.0x44e2f6.70
mov ecx, ebp
call fcn.00451320
jmp case.0x44e2f6.70
mov ecx, ebp
call fcn.00451130
cmp esi, 0x2e
jne 0x44e403
test bx, bx
jne 0x44e552
mov eax, dword [ebp + 0x8d8]
cmp eax, 1
je 0x44e3f9
cmp eax, 2
je 0x44e3f9
cmp eax, 3
jne 0x44e552
call fcn.00433780
jmp 0x44e552
call fcn.004334f0
jmp 0x44e552
cmp esi, 0x71
jne 0x44e440
test di, di
jne 0x44e552
cmp word [esp + 0x10], di
jne 0x44e552
test bx, bx
jne 0x44e552
mov ecx, ebp
call fcn.00437b80
test eax, eax
je 0x44e552
mov ecx, ebp
call fcn.00437af0
jmp 0x44e552
cmp esi, 0x77
jne 0x44e552
test di, di
je 0x44e552
cmp word [esp + 0x10], 0
je 0x44e552
cmp word [ebp + 0x8e0], 0
lea ebx, [ebp + 0x8e0]
jne 0x44e552
mov edx, dword [0x532c18]
mov dword [esp + 0x4c], edx
push 0
push 5
push ebx
push 0
mov dword [esp + 0x54], 0
mov word [ebx], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
call fcn.004882b0
lea eax, [esp + 0x14]
push eax
call fcn.004b7a5c
lea ecx, [esp + 0x18]
push ecx
call fcn.004b78fc
mov ecx, 9
mov esi, eax
lea edi, [esp + 0x24]
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
inc eax
push edx
add ecx, 0x76c
push eax
push ecx
push str.PowerISO__4.4d_2.2d_2.2d_2.2d_2.2d_2.2d.log
push ebx
call fcn.004b721b
add esp, 4
lea edx, [ebp + eax*2 + 0x8e0]
push edx
call fcn.004b7592
push ebx
lea eax, [esp + 0x70]
push str.PowerISO_is_in_tracing_mode_now._All_tracing_information_will_be_written_to__s.
push eax
call fcn.004cbb75
add esp, 0x28
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.004ce2e0
call fcn.004b1470
add esp, 4
test eax, eax
je 0x44e53c
mov ecx, dword [esp + 0x4c]
push 0x40
push ecx
call fcn.00486e20
add esp, 8
jmp 0x44e541
mov word [ebx], 0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], 0xffffffff
call fcn.004ce26c
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [ebp + 0x8d8], 0
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x38
ret 0xc