Function at 0x44d797
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, ecx
xor edx, edx
cmp esi, edx
jne 0x44d7ad
xor al, al
jmp 0x44db11
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
push edi
cmp eax, 0xffffff6a
je 0x44da6d
cmp eax, 0xffffff4f
je 0x44da6d
cmp eax, 0xffffff94
jne 0x44d843
call fcn.0044d666
lea edi, [esi + 0x10]
mov eax, dword [edi]
push 0xffffffffffffffff
and eax, 0x7f
push eax
mov ecx, esi
call fcn.0044b09d
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x44d7f5
inc edi
mov ecx, dword [ebx + 0x10]
mov eax, dword [esi + 0x28]
mov al, byte [eax + ecx]
mov cl, byte [edi]
mov dl, cl
and dl, 0x7f
cmp dl, al
jne 0x44d813
movzx eax, cl
xor eax, 0x80
jmp 0x44d816
movzx eax, al
mov byte [edi], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, esi
call fcn.0044c286
mov eax, dword [esi + 0x10]
mov ecx, eax
shr ecx, 7
not ecx
and ecx, 1
push ecx
and eax, 0x7f
push eax
mov ecx, esi
call fcn.0044b09d
jmp 0x44db0d
cmp eax, 0xfffffff4
jne 0x44d979
mov edi, 0x10000
cmp byte [0x4c8206], dl
je 0x44d877
test dword [ebx + 0xc], edi
je 0x44d883
test byte [ebx + 0x24], 1
je 0x44d883
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call fcn.0044c5a7
mov dword [ebx + 0x34], eax
jmp 0x44d883
mov eax, dword [esi + 4]
cmp dword [eax + 0x24], edx
je 0x44da14
mov eax, dword [ebx + 0xc]
dec eax
je 0x44d96a
sub eax, edi
je 0x44d95a
sub eax, 0x20000
je 0x44d8a4
dec eax
je 0x44d8ef
jmp 0x44db0d
mov ecx, dword [esi + 0xc]
push 0x10
call fcn.0044f515
mov eax, dword [esi + 4]
cmp dword [eax + 0x34], 0
je 0x44d8d8
mov edx, dword [esi + 0x28]
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebx + 0x38]
movzx ecx, byte [ecx + edx]
push dword [esi + 0xc]
mov edx, dword [ebx + 0x24]
call dword [eax + 0x34]
test al, al
je 0x44d8d8
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], eax
cmp byte [0x4c8068], 0
je 0x44db0d
cmp dword [ebx + 0x38], 0
jne 0x44db0d
mov ecx, dword [esi + 0x28]
mov eax, dword [ebx + 0x38]
mov cl, byte [eax + ecx]
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [esi + 4]
test dword [ecx + 0x24], edx
jne 0x44d909
push 0
jmp 0x44d96c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x24]
mov dword [ebp - 0x14], 2
push 0x1038
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esi + 0x28]
sub dword [ebp - 0x14], eax
mov ecx, dword [ebx + 0x38]
movzx ecx, byte [ecx + edx]
push dword [esi + 0xc]
mov eax, dword [esi + 4]
push ecx
lea edx, [ebp - 0x14]
mov ecx, ebx
call dword [eax + 0x20]
mov ecx, dword [esi + 0xc]
test al, al
je 0x44d956
push 4
jmp 0x44d96f
push 0
jmp 0x44d96f
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x24]
neg eax
sbb eax, eax
and eax, 0x20
push eax
jmp 0x44d96c
push 0x20
mov ecx, dword [esi + 0xc]
call fcn.0044f515
jmp 0x44db0d
cmp eax, 0xffffff65
jne 0x44da1b
cmp word [ebx + 0xc], 0x41
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jne 0x44d9bb
push 0x11
call edi
test ax, ax
jge 0x44d9bb
push 2
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44db0d
cmp word [ebx + 0xc], 0x43
jne 0x44d9d7
push 0x11
call edi
test ax, ax
jge 0x44d9d7
mov ecx, esi
call fcn.0044d16a
jmp 0x44db0d
cmp word [ebx + 0xc], 0x71
jne 0x44da14
mov eax, dword [esi + 4]
test byte [eax + 0x30], 1
je 0x44da14
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jl 0x44da14
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push edi
push 0x1076
push dword [ebx]
call esi
xor al, al
jmp 0x44db0f
cmp eax, 0xffffff4d
jne 0x44da14
mov eax, dword [esi + 4]
cmp dword [eax + 0x2c], edx
je 0x44da14
mov eax, dword [ebx + 0x10]
or dword [ebp - 4], 0xffffffff
test al, 2
je 0x44da65
mov edi, dword [ebx + 0xc]
and eax, 0x20
mov dword [ebp + 8], eax
cmp edi, dword [esi + 0x14]
jb 0x44da4d
xor edi, edi
cmp dword [ebp + 8], edi
je 0x44da65
mov dword [ebp + 8], edi
push dword [esi + 0xc]
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0x14]
mov ecx, edi
call dword [eax + 0x2c]
test al, al
jne 0x44da62
inc edi
jmp 0x44da3e
mov dword [ebp - 4], edi
push dword [ebp - 4]
jmp 0x44d96c
lea edi, [ebx + 0xc]
test byte [edi], 1
mov ecx, dword [edi + 0x18]
mov dword [ebp - 4], ecx
je 0x44da98
mov eax, 0x104
cmp ecx, eax
jge 0x44da86
mov eax, ecx
mov dword [edi + 0x18], eax
xor eax, eax
mov word [0x4c5fe8], ax
mov dword [edi + 0x14], 0x4c5fe8
mov ecx, dword [edi + 8]
mov dword [edi + 0x24], edx
mov eax, dword [esi + 0x28]
mov dword [ebp + 8], ecx
cmp eax, edx
je 0x44daae
movzx eax, byte [eax + ecx]
jmp 0x44dab0
xor eax, eax
mov dword [edi + 8], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0xc]
imul edx, dword [edi + 4]
push dword [esi + 0xc]
add edx, dword [esi + 0x18]
mov ecx, edi
call dword [eax + 0x1c]
test byte [edi], 1
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
je 0x44daf7
mov eax, dword [edi + 0x14]
mov esi, 0x4c5fe8
cmp eax, esi
je 0x44daf7
test eax, eax
jne 0x44dae8
mov eax, 0x48e94c
push dword [edi + 0x18]
mov edx, eax
mov ecx, esi
call fcn.00411c90
mov dword [edi + 0x14], esi
mov eax, dword [ebp - 4]
mov dword [edi + 0x18], eax
cmp dword [ebx + 8], 0xffffff6a
jne 0x44db0d
mov ecx, edi
call fcn.0046927f
mov al, 1
pop edi
pop ebx
pop esi
leave
ret 4