Function at 0x44227f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
cmp ecx, 0x102
jne 0x44229d
xor eax, eax
jmp 0x442521
cmp ecx, 0x100
je 0x442450
cmp ecx, 0x104
je 0x442450
cmp ecx, 0x101
je 0x4423e8
cmp ecx, 0x105
je 0x4423e8
cmp ecx, 8
jne 0x4422ed
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00440bdf
mov edi, eax
mov eax, edi
jmp 0x442521
mov eax, 0x2111
cmp ecx, eax
jne 0x442342
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
mov edx, 0x300
cmp cx, dx
jne 0x44231a
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push eax
call fcn.0041581d
jmp 0x4422e4
mov eax, 0x400
cmp cx, ax
jne 0x4422e6
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4422e6
cmp ecx, 0x2133
je 0x442365
cmp ecx, 0x2138
je 0x442365
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.004137c5
jmp 0x442521
mov ecx, dword [esi + 0x20]
call fcn.00440e4a
cmp eax, 0xffffffff
je 0x442296
push 1
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esi + 0x20]
call fcn.00426766
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x24], edi
jne 0x4423e0
mov ecx, dword [esi + 0x20]
call fcn.00440e4a
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
jmp 0x442521
mov ecx, dword [esi + 0x20]
call fcn.004411c7
cmp eax, 1
jae 0x442296
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x44240f
push 0
jmp 0x442411
push 1
call fcn.00441168
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x442426
push 0
jmp 0x442428
push 1
call fcn.00441146
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x44243d
push 0
jmp 0x44243f
push 1
call fcn.00441124
mov ecx, esi
call fcn.00442158
jmp 0x442296
mov ecx, dword [esi + 0x20]
call fcn.0044119d
test eax, eax
je 0x442464
mov ecx, dword [esi + 0x20]
call fcn.004411d5
mov ecx, dword [esi + 0x20]
call fcn.004411ab
test eax, eax
je 0x442478
mov ecx, dword [esi + 0x20]
call fcn.004411e5
mov ecx, dword [esi + 0x20]
call fcn.004411b9
test eax, eax
je 0x44248c
mov ecx, dword [esi + 0x20]
call fcn.004411f5
mov ecx, dword [esi + 0x20]
call fcn.004411c7
mov ecx, dword [esi + 0x20]
push 0
mov edx, eax
call fcn.0044118a
test edx, edx
jbe 0x4424ad
mov ecx, dword [esi + 0x20]
push edx
call fcn.00441205
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424c3
push 0
jmp 0x4424c5
push 1
call fcn.00441168
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424da
push 0
jmp 0x4424dc
push 1
call fcn.00441146
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424f1
push 0
jmp 0x4424f3
push 1
call fcn.00441124
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x442517
cmp eax, 0x11
je 0x442517
cmp eax, 0x10
je 0x442517
cmp eax, 0x12
je 0x442517
mov ecx, dword [esi + 0x20]
push eax
call fcn.0044118a
mov ecx, esi
call fcn.00442158
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc