Function at 0x44d7e0
Capabilities:
Log keystrokes via polling
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1020
call fcn.004bdb50
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
push edi
push 0xffffffffffffffff
mov dword [ebp - 0x24], ecx
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
push 0x5705d0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x30], eax
call fcn.004e1e9b
mov eax, dword [0x56b44c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], edi
cmp di, word [ebp - 0x30]
jae 0x44d9e4
and edi, 0xffff
push 0
push 0
push edi
push esi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov esi, eax
inc esi
and esi, 0xffff
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x44d9d3
mov ecx, dword [ebp + 8]
push esi
push ebx
push edi
push ecx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
push ebx
lea ecx, [ebp - 0x14]
call fcn.004e1fbe
lea edx, [ebp - 0x28]
push 4
push edx
lea ecx, [ebp - 0x14]
call fcn.004d6e91
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.004e1f6e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004e1e27
lea ecx, [ebp - 0x1c]
call fcn.004e23d3
mov eax, dword [ebp - 0x1c]
push 0x55c7b4
push eax
call fcn.004bdb15
add esp, 8
test eax, eax
jne 0x44d8fa
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x1030]
push ecx
push edx
mov ecx, edi
call fcn.004472c0
test eax, eax
je 0x44d964
lea eax, [ebp - 0x1030]
lea ecx, [ebp - 0x14]
push eax
call fcn.004e1fbe
jmp 0x44d964
lea ecx, [ebp - 0x2c]
push 4
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004d6e91
mov edx, dword [eax]
push 0x55c7ec
push edx
call fcn.004bda36
add esp, 8
lea ecx, [ebp - 0x2c]
test eax, eax
sete byte [ebp - 0x15]
call fcn.004e1e27
mov al, byte [ebp - 0x15]
test al, al
je 0x44d961
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1030]
push eax
push 0x800
push ecx
push 0x5705d0
push 0x55c7e4
push 0x55c7c0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x1030]
lea ecx, [ebp - 0x14]
push edx
call fcn.004e1fbe
mov edi, dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x44d9c0
push 0
mov ecx, edi
call fcn.004f4e86
mov esi, eax
test esi, esi
je 0x44d9b6
mov ecx, dword [esi + 0xf8]
test ecx, ecx
je 0x44d9b6
mov eax, dword [ebp - 0x14]
push 0
push 0
push 0
push 0
push 0
push eax
call fcn.00417a10
mov ecx, dword [esi + 0xf8]
mov dword [ecx + 0xac], 0
jmp 0x44d9d3
mov edx, dword [ebp - 0x14]
push 0
push 0
push edx
jmp 0x44d9c8
mov eax, dword [ebp - 0x14]
push 1
push 0
push eax
push 2
push 1
mov ecx, edi
call fcn.004476b0
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp + 8]
inc eax
mov dword [ebp - 0x20], eax
mov edi, eax
jmp 0x44d83e
push esi
call dword [sym.imp.SHELL32.dll_DragFinish]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004e1e27
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004e1e27
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4