Function at 0x4460d0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x495458
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bea30]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov edi, dword [esp + 0x34]
push str.CheckItemTerminateState
push str.CInstallAction
call fcn.0042af10
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 8
push 0x12
mov dword [esp + 0x38], 0
call ebp
test ax, ax
jge 0x446138
push 0x11
call ebp
test ax, ax
jge 0x446138
mov ebp, 1
jmp 0x44613a
xor ebp, ebp
mov eax, dword [esi + 0x28]
mov edx, dword [esi + 0x2c]
mov ecx, eax
and ecx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov ecx, 0
jne 0x446158
test ecx, ecx
je 0x446186
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x7f1e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 2
jne 0x44617a
test ebp, ebp
je 0x446343
or dword [edi + 0x38], 0x110
jmp 0x44633b
mov ecx, eax
and ecx, 0x800
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov ecx, 0
jne 0x4461a5
test ecx, ecx
je 0x446286
cmp ebx, 1
jne 0x446260
call fcn.0045525d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4461c8
push 0x80004005
call fcn.004022b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ebx, [esp + 0x18]
mov dword [esp + 0x2c], 0
call fcn.0043ed40
test eax, eax
mov ebx, dword [esp + 0x18]
je 0x44622a
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
push ebx
push 0
push 0x7f1a
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x44622a
call fcn.00446380
test eax, eax
je 0x44621d
mov dword [esp + 0x34], 0x4d5
jmp 0x44622a
cmp dword [edi + 0x1c], 3
jne 0x44622a
or dword [edi + 0x38], 0x800
push 0
mov ecx, esi
call fcn.0043ee20
lea eax, [ebx - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x446343
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x446343
cmp dword [edi + 0x1c], 3
jne 0x446272
or dword [edi + 0x38], 0x800
jmp 0x446343
test ebx, ebx
jne 0x446343
push esi
push edi
call fcn.00446a10
jmp 0x446343
mov ecx, eax
and ecx, 0x200
mov dword [esp + 0x18], ecx
mov ecx, 0
jne 0x44629d
test ecx, ecx
je 0x446319
test ebp, ebp
jne 0x446343
cmp ebx, 0xffffffff
je 0x4462c6
cmp ebx, 0xfffffffd
je 0x446310
cmp ebx, 0xffffff9e
je 0x4462c6
cmp ebx, 0xffffff9d
je 0x4462c6
cmp ebx, 0xfffffffa
je 0x4462c6
push edi
call fcn.00446870
jmp 0x446343
cmp ebx, 0xfffffffd
je 0x446310
call fcn.00445c00
test eax, eax
je 0x4462e1
push 0x41
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x446310
cmp ebx, 0xffffff9e
je 0x446307
cmp ebx, 0xffffff9d
je 0x446307
call fcn.00445c00
test eax, eax
je 0x446301
push 0x5a
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x446307
or dword [edi + 0x38], 0x40
jmp 0x44633b
or dword [edi + 0x38], 0x4000
jmp 0x44633b
or dword [edi + 0x38], 0x2000
jmp 0x44633b
and eax, 0x20
mov dword [esp + 0x18], eax
mov eax, ecx
jne 0x446328
test eax, eax
je 0x446343
test ebp, ebp
jne 0x446343
cmp ebx, 0xbc2
jne 0x446343
or dword [edi + 0x38], 0x120
mov dword [esp + 0x34], 0x4c7
mov esi, dword [esp + 0x34]
push esi
push str.CheckItemTerminateState
push str.CInstallAction
call fcn.0042b190
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4