Function at 0x45db00
Capabilities:
Capture microphone audio
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x6a4474]
sub esp, 0x48
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x45de87
push esi
movzx esi, word [ebp + 0xc]
imul esi, esi, 0x3e80
push edi
shr esi, 1
push esi
call fcn.00401148
push esi
mov dword [0x6a4470], eax
call fcn.00401148
push 0x1f40
mov dword [0x6a446c], eax
call fcn.00401148
push 0x80e8
mov edi, eax
call fcn.00401148
add esp, 0x10
cmp dword [0x6a4470], 0
mov dword [ebp - 4], eax
je 0x45de85
cmp dword [0x6a446c], 0
je 0x45de85
test edi, edi
je 0x45de85
test eax, eax
je 0x45de85
push ebx
call fcn.004dc830
mov edx, dword [0x6a49f8]
mov ecx, dword [0x6a4470]
mov ebx, dword [sym.imp.WINMM.dll_waveInPrepareHeader]
push 0x20
push 0x6a4444
push edx
mov dword [ebp - 0xc], eax
mov dword [0x6a4444], ecx
mov dword [0x6a4448], esi
mov dword [0x6a4454], 0
call ebx
mov ecx, dword [0x6a49f8]
mov eax, dword [0x6a446c]
push 0x20
push 0x6a4424
push ecx
mov dword [0x6a4468], 0x6a4444
mov dword [0x6a4424], eax
mov dword [0x6a4428], esi
mov dword [0x6a4434], 0
call ebx
mov edx, dword [0x6a49f8]
mov ebx, dword [sym.imp.WINMM.dll_waveInAddBuffer]
push 0x20
push 0x6a4424
mov dword [0x6a441c], esi
mov esi, dword [ebp - 4]
push edx
mov dword [0x6a4464], 0x6a4424
mov byte [0x6a4421], 0
mov byte [0x6a4420], 0
mov dword [0x6a4418], 0
call ebx
mov eax, dword [0x6a4468]
mov ecx, dword [0x6a49f8]
push 0x20
push eax
push ecx
call ebx
mov edx, dword [0x6a49f8]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
call fcn.004574b0
mov dword [ebp - 0x14], eax
jmp 0x45dc60
cmp byte [0x6a4421], 0
je 0x45dcda
mov eax, dword [0x6a441c]
cmp word [ebp + 0xc], 2
mov ecx, dword [0x6a4470]
push eax
sete dl
push edi
movzx eax, dl
push ecx
push eax
push 0x1f40
call fcn.0045d3e0
lea ecx, [ebp - 8]
push ecx
push edi
mov dword [ebp - 8], eax
call fcn.0045d500
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push edx
push esi
push edi
push eax
call fcn.0045d550
add esp, 0x2c
add esi, eax
cmp byte [0x6a4420], 0
jne 0x45dd23
mov ecx, dword [0x6a4468]
mov edx, dword [0x6a49f8]
push 0x20
push ecx
push edx
mov byte [0x6a4421], 0
call ebx
mov ecx, dword [ebp + 0x10]
call fcn.004d4620
jmp 0x45dc60
cmp byte [0x6a4420], 0
jne 0x45dcfb
mov eax, dword [0x6a4474]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x45dcfb
mov byte [0x6a4420], 1
cmp dword [0x6a4418], 0
jne 0x45dd16
call fcn.004574b0
mov ecx, dword [ebp - 0x14]
add ecx, 0x2ee
cmp eax, ecx
ja 0x45dd23
mov ecx, dword [ebp + 0x10]
call fcn.004d4620
jmp 0x45dc60
mov edx, dword [0x6a49f8]
push edx
call dword [sym.imp.WINMM.dll_waveInReset]
mov eax, dword [0x6a49f8]
mov ebx, dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
push 0x20
push 0x6a4424
push eax
call ebx
mov ecx, dword [0x6a49f8]
push 0x20
push 0x6a4444
push ecx
call ebx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004dce90
mov eax, dword [0x6a4470]
push eax
call fcn.0040107c
mov ecx, dword [0x6a446c]
push ecx
call fcn.0040107c
push edi
call fcn.0040107c
xor eax, eax
mov dword [0x6a446c], eax
mov dword [0x6a4470], eax
mov edi, esi
sub edi, dword [ebp - 4]
mov eax, 0x3e0f83e1
imul edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea esi, [eax + eax*4]
shl esi, 6
push esi
call fcn.00401148
mov dword [ebp - 8], eax
call fcn.004dc830
mov edx, dword [ebp - 8]
push edi
mov edi, dword [ebp - 4]
push edx
mov ebx, eax
push edi
push ebx
call fcn.0045d5a0
push ebx
call fcn.004dce90
push edi
call fcn.0040107c
add esp, 0x2c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x50000
xor ecx, ecx
push ecx
mov ebx, eax
push ebx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x10]
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x28], 0x10001
mov dword [ebp - 0x24], 0x1f40
mov dword [ebp - 0x1c], 0x100002
mov dword [ebp - 0x20], 0x3e80
mov word [ebp - 0x18], cx
call fcn.004609c0
add esp, 0x18
test eax, eax
je 0x45de33
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040107c
add esp, 4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push 0x20
lea edx, [ebp - 0x48]
push edx
push eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
mov edx, dword [ebp - 0x10]
push 0x20
lea ecx, [ebp - 0x48]
push ecx
push edx
call dword [sym.imp.WINMM.dll_waveOutWrite]
test byte [ebp - 0x38], 1
jne 0x45de7b
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
push 0xffffffffffffffff
push ebx
call esi
test byte [ebp - 0x38], 1
je 0x45de70
push edi
call fcn.0040107c
add esp, 4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret