Function at 0x449ccf
Capabilities:
Get thread local storage value
Log keystrokes

Disassembly:
push ebp
nop
mov ebp, esp
nop
sub esp, 0x40
nop
add dword [0x40746c], ecx
nop
push ebx
nop
mov ebx, 0xdf2efe4
nop
or dword [0x40310d], 0x1dd7
nop
mov dword [ebp - 0x10], ebx
nop
mov dword [0x429674], 0x1e
nop
cmp dword [0x429674], 0
nop
je 0x449d74
cmp dword [0x429674], 0xc
nop
jne 0x449d2d
push 0x407d50
nop
push dword [ebp - 0x18]
nop
call dword [sym.imp.kernel32.dll_GetHandleInformation]
cmp dword [0x429674], 0xd
nop
jne 0x449d4e
xor ecx, ecx
nop
xor ecx, dword [0x429674]
nop
dec ecx
nop
mov dword [0x429674], ecx
nop
mov ecx, dword [0x429674]
nop
dec ecx
nop
mov dword [0x429674], ecx
nop
jmp 0x449d01
mov dword [ebp - 0x3c], 0xdf2efe7
nop
or dword [0x429678], ebx
nop
mov dword [ebp - 0xc], 0xdf2efdb
nop
lea eax, [ebx + 9]
nop
and dword [0x429680], 0
nop
mov ecx, dword [0x429680]
nop
inc ecx
nop
mov dword [0x429680], ecx
nop
cmp dword [0x429680], 0xb
nop
jne 0x449dc2
push dword [ebp - 0xc]
nop
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [0x429680], 0xa
nop
jne 0x449de3
xor ecx, ecx
nop
xor ecx, dword [0x429680]
nop
inc ecx
nop
mov dword [0x429680], ecx
nop
cmp dword [0x429680], 0x1e
nop
jb 0x449d9a
mov ecx, dword [0x407478]
nop
xor ecx, dword [0x429688]
nop
mov dword [0x407478], ecx
nop
mov dword [ebp - 0x34], eax
nop
adc dword [0x407d68], ecx
nop
mov dword [ebp - 0x38], 0xdf2eff7
nop
mov ecx, dword [0x403109]
nop
xor dword [0x407d68], ecx
nop
mov dword [ebp - 0x3c], 0xdf2eff9
nop
add dword [0x407480], 0x2ad6
nop
mov ecx, dword [ebp - 0xc]
nop
and dword [0x407d58], 0x407464
nop
push esi
nop
mov esi, 0x75683544
nop
push edi
nop
inc dword [0x407480]
nop
xor ecx, esi
nop
mov dword [0x407d60], 0x1a
nop
cmp dword [0x407d60], 0
nop
je 0x449ed7
cmp dword [0x407d60], 4
nop
jne 0x449e96
push dword [ebp - 0xc]
nop
push dword [ebp - 0x18]
nop
push dword [ebp - 0x1c]
nop
call dword [sym.imp.user32.dll_AttachThreadInput]
cmp dword [0x407d60], 5
nop
jne 0x449eb4
mov edi, dword [0x407d60]
nop
dec edi
nop
mov dword [0x407d60], edi
nop
xor edi, edi
nop
or edi, dword [0x407d60]
nop
dec edi
nop
mov dword [0x407d60], edi
nop
jmp 0x449e68
mov edi, 0x789ada9f
nop
or dword [0x407d5c], 0x429678
nop
sub ecx, edi
nop
sub dword [0x42968c], 0x2959
nop
xor edx, edx
nop
mov dword [ebp - 0x30], ecx
nop
mov dword [ebp - 0x30], edx
nop
mov dword [0x40310d], 0x3146
nop
cmp dword [0x407734], edx
nop
mov dword [0x429678], 0x212d
nop
jne 0x44a487
mov dword [ebp - 0x18], 0xdf2e9db
nop
sbb dword [0x403109], ebx
nop
mov ecx, dword [ebp - 0x18]
nop
xor ecx, esi
nop
sub ecx, edi
nop
adc dword [0x407474], 0x407e0c
nop
mov dword [ebp - 0x30], ecx
nop
sub dword [0x407d4c], 0x5bf0
nop
mov ecx, dword [ebp + 0x10]
nop
add dword [0x407e18], 0x407478
nop
sub ecx, eax
nop
mov dword [0x407474], 0x5e2e
nop
je 0x44a182
sub dword [0x429690], 0x53f3
nop
sub ecx, 0xa
nop
je 0x44a0ec
dec ecx
nop
dec ecx
nop
mov dword [0x407d50], 0x29b1
nop
jne 0x44a280
mov dword [0x407478], ebx
nop
mov eax, dword [0x407624]
nop
mov dword [0x429694], 0x3912
nop
mov dword [ebp - 0x18], 0xdf2ef9b
nop
mov dword [0x407d54], 0x7b8c
nop
mov dword [ebp - 0x30], eax
nop
cmp dword [0x40772c], edx
nop
mov dword [0x407470], 0x30f9
nop
je 0x44a0c6
cmp dword [0x407730], edx
nop
je 0x44a0c6
sub dword [0x407470], 0x5202
nop
lea eax, [ebp - 0x40]
nop
push eax
nop
or dword [0x407d58], 0x7a68
nop
mov eax, dword [ebp - 0x18]
nop
xor dword [0x407d68], 0x40310d
nop
xor eax, esi
nop
sbb dword [0x407e08], 0x407d60
nop
sub eax, edi
nop
push eax
nop
adc eax, 0x7f2a
nop
push dword [0x407728]
nop
mov eax, dword [0x407644]
nop
sbb dword [0x407468], 0x407470
nop
push dword [0x407724]
nop
adc dword [0x403101], 0x6f97
nop
push 4
nop
push 1
nop
xor dword [0x407d64], 0x42967c
nop
push 0x40759a
nop
push dword [eax]
nop
sub dword [0x407d68], 0x5f15
nop
call fcn.00448534
add esp, 0x20
nop
test eax, eax
nop
je 0x44a0c6
neg eax
nop
mov eax, dword [ebp - 0x10]
nop
xor eax, esi
nop
sbb dword [0x403101], 0x407e20
nop
sub eax, edi
nop
mov dword [0x429678], 0x1b9e
nop
mov dword [0x407738], eax
nop
mov dword [0x40747c], 0x2013
nop
mov dword [0x407734], 1
nop
mov dword [0x429680], 0x75c6
nop
jmp 0x44a280
and dword [0x403109], 0
nop
jmp 0x44a10a
mov eax, dword [0x403109]
nop
inc eax
nop
mov dword [0x403109], eax
nop
cmp dword [0x403109], 0x10
nop
jae 0x44a13b
cmp dword [0x403109], 0x14
nop
jne 0x44a130
push dword [ebp - 0x14]
nop
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
jmp 0x44a0fc
mov eax, dword [0x40772c]
nop
mov ecx, dword [0x407730]
nop
sub ecx, eax
nop
sbb dword [0x4030f5], 0x407480
nop
add ecx, 4
nop
mov dword [0x407724], eax
nop
mov dword [0x407d50], 0x3092
nop
mov dword [0x407728], ecx
nop
mov dword [0x407d4c], 0x78d8
nop
jmp 0x44a280
mov eax, dword [0x4074a4]
nop
sub dword [0x40747c], 0x61e6
nop
mov dword [ebp - 0x1c], eax
nop
and dword [0x429698], 0
nop
jmp 0x44a1b9
xor eax, eax
nop
or eax, dword [0x429698]
nop
inc eax
nop
mov dword [0x429698], eax
nop
cmp dword [0x429698], 0x16
nop
jae 0x44a25c
cmp dword [0x429698], 6
nop
jne 0x44a1e1
push 0x407e0c
nop
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
cmp dword [0x429698], 5
nop
jne 0x44a1fd
mov eax, dword [0x429698]
nop
inc eax
nop
mov dword [0x429698], eax
nop
jmp 0x44a1a7
mov eax, dword [0x4076a8]
nop
mov dword [ebp - 0x20], eax
nop
mov eax, dword [ebp - 0x1c]
nop
mov eax, dword [eax]
nop
mov dword [0x40772c], eax
nop
mov eax, dword [ebp - 0x20]
nop
mov eax, dword [eax]
nop
mov dword [0x407730], eax
nop
mov eax, dword [0x407738]
nop
test eax, eax
nop
je 0x44a3ea
mov eax, dword [ebp - 0xc]
nop
xor eax, esi
nop
sub eax, edi
nop
mov dword [ebp - 0x24], eax
nop
mov eax, dword [0x407728]
nop
mov dword [ebp - 0x18], eax
nop
mov eax, dword [0x407724]
nop
mov dword [ebp - 0x28], 0xdf2ee45
nop
mov dword [ebp - 0x2c], ebx
nop
mov dword [ebp - 0x14], eax
nop
mov eax, 0xdf2efdb
nop
mov dword [ebp - 0x30], eax
nop
mov dword [ebp - 4], ebx
nop
mov dword [ebp - 0xc], 0xdf2efe5
nop
mov ecx, dword [ebp - 4]
nop
xor ecx, esi
nop
mov edx, edi
nop
sub edx, ecx
nop
add edx, dword [ebp - 0x18]
nop
mov dword [ebp - 8], edx
nop
mov ecx, dword [ebp - 0xc]
nop
cmp ecx, eax
nop
je 0x44a3ea
mov eax, dword [ebp - 4]
nop
mov ecx, dword [ebp - 4]
nop
xor eax, esi
nop
xor ecx, esi
nop
lea ecx, [eax + ecx + 0xeca4ac2]
nop
mov eax, dword [ebp - 8]
nop
xor edx, edx
nop
div ecx
nop
mov eax, dword [ebp - 0xc]
nop
mov ecx, dword [ebp - 4]
nop
xor eax, esi
nop
xor ecx, esi
nop
sub eax, ecx
nop
cmp edx, eax
nop
jne 0x44a37d
mov eax, dword [ebp - 8]
nop
add eax, dword [ebp - 0x14]
nop
mov ecx, dword [ebp - 0x24]
nop
mov al, byte [eax]
nop
test ecx, ecx
nop
jne 0x44a352
xor al, 0x74
nop
add al, 0x65
nop
jmp 0x44a372
mov ecx, dword [ebp - 0x28]
nop
xor cl, 0x44
nop
mov dl, 0x9f
nop
sub dl, cl
nop
mov ecx, dword [ebp - 0x2c]
nop
xor cl, 0x44
nop
add al, dl
nop
add cl, 0x61
nop
ror al, cl
nop
mov ecx, dword [ebp - 8]
nop
add ecx, dword [ebp - 0x14]
nop
mov byte [ecx], al
nop
mov eax, dword [ebp - 8]
nop
mov ecx, dword [ebp - 0x30]
nop
add eax, edi
nop
xor eax, esi
nop
cmp eax, ecx
nop
jne 0x44a3c5
mov eax, dword [ebp - 0xc]
nop
mov ecx, dword [ebp - 4]
nop
xor eax, esi
nop
xor ecx, esi
nop
sub eax, ecx
nop
add eax, edi
nop
xor eax, esi
nop
mov dword [ebp - 0xc], eax
nop
mov eax, dword [ebp - 4]
nop
xor eax, esi
nop
mov ecx, edi
nop
sub ecx, eax
nop
add ecx, dword [ebp - 0x18]
nop
jmp 0x44a3d6
mov eax, dword [ebp - 4]
nop
xor eax, esi
nop
mov ecx, edi
nop
sub ecx, eax
nop
add ecx, dword [ebp - 8]
nop
mov dword [ebp - 8], ecx
nop
mov eax, dword [ebp - 0xc]
nop
cmp eax, 0xdf2efdb
nop
jne 0x44a2f5
mov ecx, dword [ebp - 0x10]
nop
mov eax, dword [ebp + 0x10]
nop
xor ecx, esi
nop
xor eax, esi
nop
lea eax, [ecx + eax - 0x789ada9f]
nop
jmp 0x44a46d
mov ecx, dword [ebp - 0x34]
nop
cmp eax, ecx
nop
jne 0x44a41f
push eax
nop
push 0xc7b24a3
nop
jmp 0x44a44e
mov ecx, dword [ebp - 0x38]
nop
cmp eax, ecx
nop
jne 0x44a439
push eax
nop
push 0xc653996
nop
jmp 0x44a44e
mov ecx, dword [ebp - 0x3c]
nop
cmp eax, ecx
nop
jne 0x44a45e
push eax
nop
push 0xd8624a3
nop
add eax, 0x789ada9f
nop
xor eax, esi
nop
push eax
nop
call fcn.00449ccf
mov eax, dword [ebp - 0x10]
nop
xor eax, esi
nop
lea eax, [eax + edi - 0x789ada9f]
nop
xor eax, esi
nop
mov edi, eax
nop
xor edi, esi
nop
lea ecx, [edi - 0x789ada9f]
nop
cmp ecx, 0x28
nop
jb 0x44a405
pop edi
nop
pop esi
nop
pop ebx
nop
leave
nop
ret 0xc