Function at 0x4404d2
Capabilities:
Check for foreground window switch
Check if file exists
Create directory
Create process on windows
Create thread
Log keystrokes via polling
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x62c
mov eax, dword [0x485008]
xor eax, esp
mov dword [esp + 0x628], eax
push ebx
push esi
push edi
call fcn.00403ab1
call fcn.0043f273
push 0x104
lea edx, [esp + 0x224]
mov ecx, 0x46e60f
call fcn.00402de6
pop ecx
push eax
call fcn.00454f60
pop ecx
call fcn.0040b4b8
call fcn.0041696a
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0xc], esi
push 0
push 0x47a9e0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x440655
cmp byte [0x7e6a38], al
je 0x440670
push 0x7e6a38
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x440670
push 0x7e6a38
lea eax, [esp + 0x1c]
push str.LFS_is_not_running__nWould_you_like_to_run_it_now__n__s_
push eax
call fcn.00401468
add esp, 0xc
lea eax, [esp + 0x18]
push 4
push 0x46e060
push eax
push 0
call ebx
cmp eax, 6
jne 0x440b7d
push 0x104
lea eax, [esp + 0x11c]
push 0
push eax
call fcn.00447370
add esp, 0xc
mov edx, 0x47aa1c
mov ecx, 0x7e6a38
call fcn.004019b8
mov edx, eax
test edx, edx
je 0x440655
lea ecx, [edx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4405ca
mov esi, 0x7e6a38
lea eax, [esp + 0x118]
sub edx, esi
push edx
push esi
push eax
call fcn.0044d390
add esp, 0xc
lea eax, [esp + 0x430]
push dword [0x7e6bf0]
push str._insim_d
push eax
call fcn.00401468
add esp, 0xc
lea eax, [esp + 0x118]
push 0xa
push eax
lea eax, [esp + 0x438]
push eax
push esi
push 0x47aa2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor esi, esi
push 0
push 0x47aa34
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x44064a
push 0xa
inc esi
call edi
cmp esi, 0x1f4
jl 0x44062c
push 0x3e8
call edi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x440685
xor ecx, ecx
inc ecx
call fcn.00433737
xor ecx, ecx
inc ecx
call fcn.00417e3a
xor esi, esi
jmp 0x44052f
push 0x10
push 0x46e060
push str.LFS_is_not_running_
push 0
call ebx
jmp 0x440b7d
call fcn.00435380
call fcn.0041998a
call fcn.00434d1a
call fcn.0043514d
call fcn.0042c266
push dword [0x7e6bf0]
lea eax, [esp + 0x1c]
push str.LFSLazy_INSIMPORT__d
push 0x100
push eax
call fcn.00401599
add esp, 0x10
lea eax, [esp + 0x18]
xor esi, esi
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x440b96
jmp 0x44079f
call fcn.00449fee
cmp eax, esi
jae 0x440705
cmp dword [0x491214], 0
jne 0x440712
cmp dword [0x6b82d0], 0
jne 0x440705
push 1
call edi
cmp dword [0x491210], 0
je 0x4406dd
cmp dword [0x491214], 0
je 0x4407c2
lea ecx, [esp + 0xc]
call fcn.00407a09
movzx eax, byte [esp + 0xf]
push eax
movzx eax, byte [esp + 0x12]
push eax
mov eax, dword [esp + 0x14]
movzx ecx, ah
push ecx
movzx eax, al
push eax
lea eax, [esp + 0x28]
push str._d._d._d._d
push eax
call fcn.00401468
mov ecx, dword [0x7e6bf0]
lea edx, [esp + 0x30]
add esp, 0x18
call fcn.00407903
push dword [0x7e6bf0]
test eax, eax
lea eax, [esp + 0x1c]
je 0x440769
push str.Please_go_to_Multiplayer__Start_new_host_and_clear_IP_address_field._nThen_enter___insim__d__in_LFSs_chat.
jmp 0x44076e
push str.Couldnt_connect_to_LFS._nType___insim__d__in_LFSs_chat.
push eax
call fcn.00401468
add esp, 0xc
lea eax, [esp + 0x18]
xor esi, esi
push 0x10010
push 0x46e060
push eax
push esi
call ebx
xor ecx, ecx
call fcn.00433737
xor ecx, ecx
call fcn.00417e3a
mov dword [0x491214], esi
push esi
push esi
push 0x429ddd
call fcn.0044b34c
add esp, 0xc
mov dword [esp + 0x10], eax
call fcn.00449fee
lea esi, [eax + 0x7d0]
jmp 0x4406fc
cmp dword [0x6b82d0], 0
je 0x4407f1
xor esi, esi
push esi
push 0x46e060
push str.Wrong_Admin_Password__nGo_to_Multiplayer__Start_New_Host_and_make_sure_that_Admin_password_matches_defined_admin_password_or_leave_it_blank.
push esi
call ebx
xor ecx, ecx
call fcn.00433737
xor ecx, ecx
call fcn.00417e3a
mov dword [0x6b82d0], esi
jmp 0x44079f
cmp dword [0x49123c], 0
jne 0x4407fe
push 0xffffffffffffffff
call edi
call fcn.00449fee
cmp eax, esi
jb 0x440814
cmp byte [0x48bfc8], 0
je 0x440814
push 0xffffffffffffffff
call edi
call fcn.00449fee
cmp eax, esi
jb 0x440854
cmp byte [0x48bfc8], 0
jne 0x440854
xor esi, esi
push esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push 0x46e060
push str.LFS_did_not_respond._Possible_Admin_Password_error_nGo_to_Multiplayer__Start_New_Host_and_make_sure_that_field_Admin_password_matches_defined_admin_password_or_leave_it_blank.
push esi
call ebx
xor ecx, ecx
call fcn.00433737
xor ecx, ecx
call fcn.00417e3a
jmp 0x44079f
cmp dword [0x4a16f8], 0
jne 0x440865
push 0xffffffffffffffff
jmp 0x440863
push 1
call edi
cmp byte [0x831724], 0
je 0x440861
call fcn.0041a2c2
xor esi, esi
push esi
push esi
push 0x4196c6
call fcn.0044b34c
add esp, 0xc
jmp 0x44088a
push 1
call edi
cmp dword [0x69bddc], esi
je 0x440886
cmp byte [0x7e6be4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
je 0x4408ae
push 0x80
push dword [0x491210]
call ebx
call fcn.0040a0ed
push esi
push esi
push 0x422793
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x404a4f
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x435696
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x4149e8
call fcn.0044b34c
add esp, 0xc
call fcn.00409ecf
push 0
push 0
push 0x40a19f
mov esi, eax
call fcn.0044b34c
add esp, 0xc
test esi, esi
je 0x44091e
xor esi, esi
push esi
push esi
push 0x40b327
call fcn.0044b34c
add esp, 0xc
jmp 0x440920
xor esi, esi
push esi
push esi
push esi
push 0x407eb6
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
call esi
xor eax, eax
push eax
push eax
push eax
push 0x41690c
push eax
push eax
call esi
xor esi, esi
push esi
push esi
push 0x44045b
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x427c3d
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x428939
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x43ecc2
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x432cf6
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x42d413
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x432f02
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x433062
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x433267
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x419cb1
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x43f3fb
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x43fa9a
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x4267d5
call fcn.0044b34c
add esp, 0xc
cmp byte [0x7e6b5b], 0
je 0x440a1d
push esi
push esi
push fcn.0043fa99
call fcn.0044b34c
add esp, 0xc
push esi
push esi
push 0x43367d
call fcn.0044b34c
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x49120c]
jne 0x440a4a
cmp byte [0x7e6bfa], 0
je 0x440a4a
push 0x100
jmp 0x440a4c
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov eax, dword [0x4a17bc]
test eax, eax
je 0x440a7c
mov ecx, dword [0x485d58]
dec eax
cmp ecx, eax
jge 0x440a7c
push eax
push ecx
push 0x1015
push dword [0x7e6484]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x440a97
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x440a97
xor esi, esi
inc esi
cmp dword [0x83e578], esi
je 0x440ab9
mov eax, dword [0x4a17bc]
dec eax
push eax
push 0
push 0x1015
push dword [0x7e6484]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x49120c]
mov dword [0x83e578], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x440b67
xor esi, esi
push esi
call fcn.0044da37
sub eax, dword [0x7e6470]
pop ecx
sbb edx, esi
mov dword [esp + 0x14], edx
js 0x440b1c
jg 0x440af3
cmp eax, 0x12c
jbe 0x440b1c
cmp dword [0x801ecc], esi
jne 0x440b1c
mov dword [0x801ed0], 1
call fcn.004355fe
call fcn.00419c1f
xor ecx, ecx
call fcn.0042c3dd
mov dword [0x801ed0], esi
movzx eax, byte [0x6b8078]
mov ecx, 0x400
imul eax, eax, 0xe4
test word [eax + 0x49212a], cx
jne 0x440b40
cmp byte [0x7e6b42], 0
je 0x440b4f
cmp byte [eax + 0x49211f], 0
mov dword [0x801ed8], esi
jne 0x440b59
mov dword [0x801ed8], 8
call fcn.00403ab1
push 0xf
call edi
jmp 0x440a2c
push 0
push 0
push 2
push dword [0x6b845c]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
call edi
mov ecx, dword [esp + 0x634]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00445b7e
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0x46e060
push str.There_is_already_an_instance_of_program_connected_to_that_InSim_port_
push esi
call ebx
push esi
call fcn.004498af
int3