Function at 0x444c00
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4db434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
shr ebx, 0x10
mov dword [ebp - 0x210], eax
mov byte [ebp - 0x20c], 0
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyNameTextA]
test bl, 2
je 0x444ce7
push 0
push 0x11
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call edi
cmp byte [ebp - 0x108], 0
je 0x444ca4
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x444c76
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x444c86
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x444cc9
lea ecx, [ebp - 0x20c]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x444cb0
mov eax, dword [str.Ctrl]
mov dword [ecx], eax
mov al, byte [0x4b3664]
mov byte [ecx + 4], al
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x444cd0
mov eax, dword [0x4b3668]
mov dword [edi], eax
mov edi, dword [sym.imp.USER32.dll_GetKeyNameTextA]
test bl, 4
je 0x444d89
push 0
push 0x12
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call edi
cmp byte [ebp - 0x108], 0
je 0x444d53
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x444d25
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x444d35
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x444d71
lea edi, [ebp - 0x20c]
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x444d60
mov eax, dword [0x4b366c]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x444d78
mov eax, dword [0x4b3668]
mov dword [edi], eax
test bl, 1
je 0x444e38
push 0
push 0x10
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp byte [ebp - 0x108], 0
je 0x444dfe
lea edx, [ebp - 0x108]
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x444dd0
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x444de0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x444e20
lea ecx, [ebp - 0x20c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x444e05
mov eax, dword [str.Shift]
mov dword [ecx], eax
mov ax, word [0x4b3674]
mov word [ecx + 4], ax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x444e27
mov eax, dword [0x4b3668]
mov dword [edi], eax
test bl, 8
je 0x444ed9
push 0
push 0x5b
call esi
push 0x104
or eax, 0x200
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp byte [ebp - 0x108], 0
je 0x444ea8
lea edx, [ebp - 0x108]
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x444e80
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x444e90
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x444ec1
lea edi, [ebp - 0x20c]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x444eb0
mov eax, dword [0x4b3678]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x444ec8
mov eax, dword [0x4b3668]
mov dword [edi], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov eax, dword [ebp + 8]
push 0
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
push 0x104
or eax, 0x200
lea ecx, [ebp - 0x108]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x444f14
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x444f24
push dword [ebp + 0x10]
mov ecx, edx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
push dword [ebp - 0x210]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004448b0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004584f8
mov esp, ebp
pop ebp
ret