Function at 0x448a26
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x1bcc]
mov eax, 0x1c4c
call fcn.00468c00
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x1bc8], eax
mov eax, dword [ebp + 0x1bd8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1bd4]
push 0x4739e8
push eax
lea eax, [ebp + 0x908]
xor ebx, ebx
push eax
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x68], ebx
call dword [sym.imp.PPLIB32W.DLL__CatPath_12]
lea eax, [edi + 0xa34]
lea ecx, [ebp - 0x58]
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, bx
jne 0x448a7a
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push 0x258
lea eax, [ebp + 0xdb8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
call esi
push ebx
push ebx
push 0x258
lea eax, [ebp + 0x1970]
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0x908]
push eax
push ebx
push ebx
call esi
lea eax, [ebp + 0x1970]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x448aca
push dword [edi + 0x1858]
sub eax, esi
lea eax, [ebp + eax + 0x1970]
mov dword [ebp - 0x78], eax
call dword [sym.imp.PPLIB32W.DLL__VFSGetSusieFuncs_4]
mov esi, eax
mov dword [ebp - 0x80], esi
cmp esi, ebx
je 0x448e5a
cmp dword [esi + 0x28], ebx
je 0x448b0e
push esi
lea eax, [ebp + 0x908]
push eax
push edi
call fcn.00448714
jmp 0x448e5d
push str.susie
push 1
call dword [sym.imp.PPLIB32W.DLL__VFSArchiveSection_8]
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
lea eax, [ebp + 0xdb8]
push eax
call dword [esi + 0x14]
test eax, eax
jne 0x448e55
cmp dword [ebp - 0x60], ebx
je 0x448e55
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_LocalLock]
push dword [ebp - 0x60]
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
add eax, dword [ebp - 0x74]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.00424050
jmp 0x448db0
push ebx
push ebx
push 0x258
lea eax, [ebp + 0x1010]
push eax
push 0xffffffffffffffff
lea eax, [esi + 0x50]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test byte [esi + 0x24], 0x10
je 0x448b94
cmp dword [edi + 0x184c], ebx
je 0x448db0
lea eax, [ebp + 0x1010]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x448b9d
mov esi, dword [ebp - 0x74]
sub eax, edx
mov dword [ebp - 0x70], eax
cmp esi, dword [ebp - 0x7c]
jae 0x448d9a
add esi, 0x18
mov dword [ebp - 0x64], esi
cmp byte [esi - 0x18], bl
je 0x448d9a
lea eax, [esi + 0xc8]
cmp byte [eax], bl
je 0x448e09
push eax
push esi
lea eax, [ebp + 0x1718]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [edi + 0x184c], ebx
je 0x448dc6
push 0x258
lea eax, [ebp + 0x458]
push eax
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x70]
lea edi, [ebp + 0x1718]
lea esi, [ebp + 0x1010]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x448e03
mov eax, dword [ebp - 0x70]
mov al, byte [ebp + eax + 0x1718]
cmp al, bl
je 0x448c3c
cmp al, 0x5c
jne 0x448e03
xor eax, eax
mov word [ebp + 0x1268], ax
mov eax, dword [ebp - 0x5c]
mov edi, dword [eax + 0x1850]
lea esi, [ebp + 0x458]
cmp edi, ebx
je 0x448c71
push esi
call dword [sym.imp.PPLIB32W.DLL__FindPathSeparator_4]
mov esi, eax
cmp esi, ebx
je 0x448c6c
inc esi
inc esi
dec edi
jne 0x448c58
jmp 0x448c71
mov esi, 0x4739e8
push ebx
push ebx
push 0x104
push dword [ebp - 0x78]
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, esi
lea eax, [ebp + 0x1268]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x448cb4
cmp dx, bx
je 0x448cb0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x448cb4
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x448c8e
xor eax, eax
jmp 0x448cb9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x448d01
push 0x258
lea eax, [ebp + 0x1268]
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0x1970]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
lea eax, [ebp + 0x1268]
push eax
call dword [sym.imp.PPLIB32W.DLL__MakeDirectories_8]
lea eax, [ebp + 0x1268]
mov ecx, esi
sub eax, esi
movzx edx, word [ecx]
mov word [eax + ecx], dx
inc ecx
inc ecx
cmp dx, bx
jne 0x448cf3
mov esi, dword [ebp - 0x64]
mov edi, dword [ebp - 0x80]
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1970]
push eax
push dword [esi - 0x10]
lea eax, [ebp + 0xdb8]
push eax
call dword [edi + 0x18]
cmp eax, ebx
je 0x448d8d
cmp eax, 0xffffffff
jne 0x448e23
push 0x258
lea eax, [ebp + 0x1268]
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0x1718]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp + 0x908]
push eax
lea eax, [ebp + 0x1268]
push eax
call fcn.004270bd
push eax
lea eax, [ebp + 0x1268]
push eax
call dword [sym.imp.PPLIB32W.DLL__VFSFullPath_12]
lea eax, [ebp + 0x1268]
push eax
lea eax, [esi - 0x18]
push eax
lea eax, [ebp + 0xdb8]
push eax
push edi
call fcn.00448657
mov dword [ebp - 0x68], eax
cmp eax, ebx
jne 0x448e2a
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x184c], ebx
jne 0x448e06
mov edi, eax
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x448e32
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.00424095
mov esi, eax
cmp esi, ebx
jne 0x448b66
jmp 0x448e39
lea edi, [ebp + 0x1718]
lea eax, [ebp + 0x1010]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x448df0
cmp cl, bl
je 0x448dec
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x448df0
inc eax
inc eax
inc edi
inc edi
cmp cl, bl
jne 0x448dd2
xor eax, eax
jmp 0x448df5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x448e06
mov eax, dword [ebp - 0x78]
mov byte [eax], bl
jmp 0x448d04
mov esi, dword [ebp - 0x64]
mov edi, dword [ebp - 0x5c]
add esi, 0x1ac
lea eax, [esi - 0x18]
mov dword [ebp - 0x64], esi
cmp eax, dword [ebp - 0x7c]
jb 0x448bbb
jmp 0x448d9a
mov dword [ebp - 0x68], 0x3eb
mov edi, dword [ebp - 0x5c]
jmp 0x448d9a
mov dword [ebp - 0x68], 0x4c7
call fcn.004486f2
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x68]
jmp 0x448e5d
call fcn.004486f2
push 6
pop eax
mov ecx, dword [ebp + 0x1bc8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0x1bcc
leave
ret 8