Function at 0x4417ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
cmp ecx, 0x102
jne 0x4417ca
xor eax, eax
jmp 0x441a4e
cmp ecx, 0x100
je 0x44197d
cmp ecx, 0x104
je 0x44197d
cmp ecx, 0x101
je 0x441915
cmp ecx, 0x105
je 0x441915
cmp ecx, 8
jne 0x44181a
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00414e1f
mov edi, eax
mov eax, edi
jmp 0x441a4e
mov eax, 0x2111
cmp ecx, eax
jne 0x44186f
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
mov edx, 0x300
cmp cx, dx
jne 0x441847
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push eax
call fcn.00440057
jmp 0x441811
mov eax, 0x400
cmp cx, ax
jne 0x441813
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x441813
cmp ecx, 0x2133
je 0x441892
cmp ecx, 0x2138
je 0x441892
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00412cde
jmp 0x441a4e
mov ecx, dword [esi + 0x20]
call fcn.0044031a
cmp eax, 0xffffffff
je 0x4417c3
push 1
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esi + 0x20]
call fcn.00425cc2
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x24], edi
jne 0x44190d
mov ecx, dword [esi + 0x20]
call fcn.0044031a
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
jmp 0x441a4e
mov ecx, dword [esi + 0x20]
call fcn.004406f5
cmp eax, 1
jae 0x4417c3
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x44193c
push 0
jmp 0x44193e
push 1
call fcn.00440696
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x441953
push 0
jmp 0x441955
push 1
call fcn.00440674
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x44196a
push 0
jmp 0x44196c
push 1
call fcn.00440652
mov ecx, esi
call fcn.00441685
jmp 0x4417c3
mov ecx, dword [esi + 0x20]
call fcn.004406cb
test eax, eax
je 0x441991
mov ecx, dword [esi + 0x20]
call fcn.00440703
mov ecx, dword [esi + 0x20]
call fcn.004406d9
test eax, eax
je 0x4419a5
mov ecx, dword [esi + 0x20]
call fcn.00440713
mov ecx, dword [esi + 0x20]
call fcn.004406e7
test eax, eax
je 0x4419b9
mov ecx, dword [esi + 0x20]
call fcn.00440723
mov ecx, dword [esi + 0x20]
call fcn.004406f5
mov ecx, dword [esi + 0x20]
push 0
mov edx, eax
call fcn.004406b8
test edx, edx
jbe 0x4419da
mov ecx, dword [esi + 0x20]
push edx
call fcn.00440733
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4419f0
push 0
jmp 0x4419f2
push 1
call fcn.00440696
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x441a07
push 0
jmp 0x441a09
push 1
call fcn.00440674
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x441a1e
push 0
jmp 0x441a20
push 1
call fcn.00440652
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x441a44
cmp eax, 0x11
je 0x441a44
cmp eax, 0x10
je 0x441a44
cmp eax, 0x12
je 0x441a44
mov ecx, dword [esi + 0x20]
push eax
call fcn.004406b8
mov ecx, esi
call fcn.00441685
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc