Function at 0x440bf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x112
jne 0x440c51
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0xf060
jne 0x440c51
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
jne 0x440c51
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x38]
sub ecx, 0x420
call fcn.004274d0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.0044e900
mov eax, 1
jmp 0x4413f4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0x100
jne 0x44112a
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x71
je 0x440c7c
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x5b
je 0x440c7c
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x5c
jne 0x440c9b
mov edx, dword [ebp - 0x38]
mov eax, dword [edx - 0x420]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
jmp 0x4413f4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x1b
jne 0x440cda
mov edx, dword [ebp - 0x38]
cmp dword [edx - 0x3d4], 0
je 0x440ccb
push 0
push 0
push 0x8405
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax - 0x420]
push ecx
call fcn.00427190
add esp, 0x10
mov eax, 1
jmp 0x4413f4
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x6b
je 0x440d08
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0xbb
je 0x440d08
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x6d
je 0x440d08
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0xbd
jne 0x440da5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x440da0
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x1e04]
call fcn.00532af0
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x6b
je 0x440d3f
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0xbb
jne 0x440d4a
mov ecx, dword [ebp - 8]
add ecx, 0xa
mov dword [ebp - 8], ecx
jmp 0x440d68
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x6d
je 0x440d5f
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0xbd
jne 0x440d68
mov ecx, dword [ebp - 8]
sub ecx, 0xa
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x64
jl 0x440d77
mov dword [ebp - 8], 0x64
jmp 0x440d84
cmp dword [ebp - 8], 0
jge 0x440d84
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.00452140
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x7a
je 0x440db7
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x5a
jne 0x440df4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x440def
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.0044deb0
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x78
je 0x440e06
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x58
jne 0x440e4f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x440e4a
mov ecx, dword [ebp - 0x38]
sub ecx, 0x420
call fcn.004274d0
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.0044e900
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x72
je 0x440e61
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x52
jne 0x440e8a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x440e85
mov ecx, dword [ebp - 0x38]
add ecx, 4
call fcn.00511f90
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x75
je 0x440e9c
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x55
jne 0x440ee8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x440ee3
mov ecx, dword [ebp - 0x38]
add ecx, 0x5348
call fcn.00531e60
test eax, eax
je 0x440ee3
mov edx, dword [ebp - 0x38]
cmp dword [edx - 0x3d4], 0
jne 0x440ee3
push 0
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.0044cee0
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x79
je 0x440efa
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x59
jne 0x440f4e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x440f49
mov ecx, dword [ebp - 0x38]
add ecx, 0x5348
call fcn.00531e90
test eax, eax
je 0x440f49
mov eax, dword [ebp - 0x38]
cmp dword [eax - 0x3d4], 0
jne 0x440f49
push 0
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.0044cee0
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x6d
je 0x440f60
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x4d
jne 0x440fa6
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x440fa1
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx - 0x3d8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp dword [eax + 0x1e18], 0
sete cl
push ecx
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.00451a60
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x67
je 0x440fca
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x47
je 0x440fca
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x25
je 0x440fca
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x27
jne 0x441031
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x44102c
mov ecx, dword [ebp - 0x38]
add ecx, 0x5348
call fcn.00531e90
test eax, eax
jne 0x44102c
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x76c4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
push 0x100
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x76c4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x74
je 0x441043
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x54
jne 0x441099
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x441094
mov ecx, dword [ebp - 0x38]
add ecx, 0x5348
call fcn.00531e90
test eax, eax
jne 0x441094
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
push 0x100
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x76c8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x4413f4
jmp 0x44112a
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x26
je 0x4410c6
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x28
je 0x4410c6
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x21
je 0x4410c6
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x22
je 0x4410c6
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0xd
jne 0x44112a
mov ecx, dword [ebp - 0x38]
add ecx, 0x5348
call fcn.00531e90
test eax, eax
jne 0x44112a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x44112a
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x76c8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
push 0x100
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x76c8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x4413f4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x2e
jne 0x44117c
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x7790
call fcn.0042d4e0
cmp dword [ebp - 0x18], eax
jne 0x44117c
cmp dword [ebp - 0x18], 0
je 0x44117c
push 9
mov ecx, dword [ebp - 0x38]
sub ecx, 0x420
call fcn.00458f80
push 0
push 0x1f4
push 9
mov ecx, dword [ebp - 0x38]
sub ecx, 0x420
call fcn.00458f50
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0x102
jne 0x4412ef
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x7790
call fcn.0042d4e0
cmp dword [ebp - 0x1c], eax
jne 0x44120c
cmp dword [ebp - 0x1c], 0
je 0x44120c
push 9
mov ecx, dword [ebp - 0x38]
sub ecx, 0x420
call fcn.00458f80
push 0
push 0x1f4
push 9
mov ecx, dword [ebp - 0x38]
sub ecx, 0x420
call fcn.00458f50
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
push 0x102
mov ecx, dword [ebp - 0x38]
add ecx, 0x7790
call fcn.0042d4e0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x4413f4
cmp dword [ebp - 0x1c], 0
je 0x4412ef
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ecx - 0x420]
jne 0x441251
mov eax, dword [ebp + 8]
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
movzx edx, word [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.00442bf0
mov eax, 1
jmp 0x4413f4
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x779c]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ecx + 4]
jne 0x441269
jmp 0x4412ef
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x77a0], 0
je 0x44128a
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x77a0]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edx + 4]
jne 0x44128a
jmp 0x4412ef
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x76c8], 0
je 0x4412dd
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x76c8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 4]
jne 0x4412dd
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x76c8]
call fcn.004e5b50
test eax, eax
je 0x4412db
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x76c8]
call fcn.004e5360
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x44]
call eax
test eax, eax
je 0x4412dd
jmp 0x4412ef
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x1c], eax
jmp 0x44120c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0x20a
jne 0x44135b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov ecx, dword [ebp - 0x38]
sub ecx, 0x424
call fcn.004533a0
mov eax, 1
jmp 0x4413f4
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x4413f2
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 8
je 0x4413f2
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
je 0x4413de
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x66
je 0x441395
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x46
jne 0x4413de
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x34], 0
je 0x4413d4
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x779c]
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [eax + 4]
jne 0x4413c5
mov dword [ebp - 0x30], 1
jmp 0x4413d4
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x34], eax
jmp 0x4413a5
cmp dword [ebp - 0x30], 0
jne 0x4413de
xor eax, eax
jmp 0x4413f4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x779c]
call fcn.0041ca80
jmp 0x4413f4
xor eax, eax
mov esp, ebp
pop ebp
ret 4