Function at 0x440cec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp word [edi + 0xc], 9
jne 0x440d24
lea eax, [ecx + 0x64]
lea edx, [ecx + 0x68]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [edi]
cmp edx, dword [eax]
jne 0x440d24
mov ecx, dword [ecx + 0x3c]
mov eax, dword [ecx]
call dword [eax]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and al, 1
push 0x11
mov byte [ebp - 1], al
call esi
shr eax, 0xf
and al, 1
push 0xa3
mov byte [ebp + 0xb], al
call esi
mov bx, ax
push 0x10
shr ebx, 0xf
and bl, 1
call esi
shr eax, 0xf
and al, 1
xor esi, esi
mov byte [ebp - 8], al
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ax, word [edi + 0xc]
cmp ax, 0x30
jb 0x440da2
cmp ax, 0x39
ja 0x440da2
test bl, bl
jne 0x440d7e
cmp byte [ebp - 1], bl
je 0x440da2
mov ecx, dword [ebp - 0xc]
movzx eax, ax
sub eax, 0x30
cmp byte [ebp - 8], 0
push eax
je 0x440d98
call fcn.0043a5ed
jmp 0x441134
call fcn.0043a65e
jmp 0x441134
cmp ax, 0x71
je 0x440dae
cmp ax, 0x70
jne 0x440dda
cmp byte [ebp - 1], 0
je 0x440dda
cmp byte [ebp + 0xb], 0
jne 0x440dda
cmp byte [ebp - 8], 0
jne 0x440dda
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp ax, 0x70
mov ecx, dword [ecx + 0x3c]
setne bl
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
jmp 0x441134
cmp ax, 0x78
jne 0x440dfc
cmp byte [ebp - 1], 0
jne 0x440dfc
cmp byte [ebp + 0xb], 0
jne 0x440dfc
cmp byte [ebp - 8], 0
jne 0x440dfc
mov ecx, 0x46f690
call fcn.00427d20
mov cx, word [edi + 0xc]
cmp cx, 0x72
jb 0x440e2e
cmp cx, 0x7b
ja 0x440e2e
cmp byte [ebp + 0xb], 0
je 0x440e2e
call fcn.004411f1
cmp eax, esi
jl 0x440e2e
mov ebx, dword [ebp - 0xc]
push dword [eax*8 + 0x45f154]
mov ecx, ebx
call fcn.00444eda
jmp 0x440e31
mov ebx, dword [ebp - 0xc]
movzx eax, word [edi + 0xc]
cmp eax, 0x52
jg 0x440ff5
je 0x440fdf
cmp eax, 0x28
jg 0x440ef6
je 0x440e84
sub eax, 8
je 0x440eea
sub eax, 8
je 0x440ed0
sub eax, 0x12
je 0x440ead
sub eax, 3
je 0x440e71
dec eax
je 0x440e9a
dec eax
jne 0x440d1b
cmp byte [ebp - 1], 0
je 0x440e84
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x440d1b
cmp byte [ebp - 8], 0
je 0x440d1b
mov ecx, ebx
call fcn.004443c7
jmp 0x440d1b
cmp byte [ebp - 1], 0
je 0x440e84
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x440d1b
cmp byte [ebp + 0xb], 0
je 0x440d1b
cmp byte [ebp - 1], 0
jne 0x440d1b
cmp byte [ebp - 8], 0
jne 0x440d1b
jmp 0x441134
and byte [ebx + 0x158], 0
lea ecx, [ebx + 0x68]
call fcn.00428f6d
mov dword [ebx + 0x15c], eax
jmp 0x440d1b
mov ecx, ebx
call fcn.0043af76
jmp 0x441134
cmp eax, 0x2d
je 0x440f88
cmp eax, 0x2e
je 0x440f74
cmp eax, 0x30
jle 0x440d1b
cmp eax, 0x34
jle 0x440f5a
cmp eax, 0x41
je 0x440f47
cmp eax, 0x43
je 0x440f3b
cmp eax, 0x4e
jne 0x440d1b
cmp byte [ebp + 0xb], 0
je 0x440d1b
mov ecx, ebx
call fcn.00443d39
jmp 0x441134
cmp byte [ebp + 0xb], 0
je 0x440d1b
jmp 0x440f9e
cmp byte [ebp + 0xb], 0
je 0x440d1b
push 1
mov ecx, ebx
jmp 0x441045
cmp byte [ebp + 0xb], 0
je 0x440d1b
add eax, 0xffffffcf
mov ecx, ebx
push eax
call fcn.00435d31
jmp 0x441134
cmp byte [ebp - 8], 0
mov ecx, ebx
sete al
push eax
call fcn.0044333a
jmp 0x441134
cmp byte [ebp - 1], 0
jne 0x440d1b
cmp byte [ebp + 0xb], 0
je 0x440faa
cmp byte [ebp - 8], 0
jne 0x440fb0
mov ecx, ebx
call fcn.004424f1
jmp 0x441134
cmp byte [ebp - 8], 0
je 0x440fc6
cmp byte [ebp + 0xb], 0
jne 0x440d1b
mov ecx, ebx
call fcn.00452879
jmp 0x441134
cmp byte [ebx + 0x87], 0
je 0x440d1b
mov ecx, ebx
call fcn.00444466
jmp 0x441134
cmp byte [ebp + 0xb], 0
je 0x440d1b
mov ecx, ebx
call fcn.0044098b
jmp 0x441134
cmp eax, 0x71
jg 0x4410e9
je 0x4410c2
sub eax, 0x56
je 0x4410b3
dec eax
dec eax
je 0x44109d
dec eax
dec eax
je 0x441087
sub eax, 0x10
je 0x44107b
dec eax
je 0x44104f
dec eax
dec eax
jne 0x440d1b
cmp byte [ebp - 1], 0
je 0x44103c
push esi
mov ecx, ebx
call fcn.004446bc
jmp 0x441134
cmp byte [ebp - 8], 0
push esi
mov ecx, ebx
je 0x441071
call fcn.0044484b
jmp 0x441134
cmp byte [ebp - 1], 0
je 0x441059
push 1
jmp 0x441030
cmp byte [ebp - 8], 0
jne 0x440f51
cmp byte [ebp + 0xb], 0
jne 0x441134
push 1
mov ecx, ebx
call fcn.004445ec
jmp 0x441134
mov ecx, ebx
call fcn.0044487d
jmp 0x441134
cmp byte [ebp + 0xb], 0
je 0x440d1b
mov ecx, ebx
call fcn.00443fd8
jmp 0x441134
cmp byte [ebp + 0xb], 0
je 0x440d1b
mov ecx, ebx
call fcn.00452879
jmp 0x441134
cmp byte [ebp + 0xb], 0
je 0x440d1b
jmp 0x440fba
cmp byte [ebp - 1], 0
jne 0x440d1b
cmp byte [ebp + 0xb], 0
jne 0x440d1b
cmp byte [ebp - 8], 0
jne 0x440d1b
mov ecx, ebx
call fcn.00443fa7
jmp 0x441134
sub eax, 0x72
je 0x4411d0
dec eax
je 0x4411a4
dec eax
je 0x441185
dec eax
je 0x441162
dec eax
je 0x44113b
sub eax, 5
jne 0x440d1b
cmp byte [ebp - 1], 0
je 0x440d1b
cmp byte [ebp + 0xb], 0
jne 0x440d1b
cmp byte [ebp - 8], 0
jne 0x440d1b
mov ecx, ebx
call fcn.0043ad7e
mov al, 1
jmp 0x440d1d
cmp byte [ebp - 1], 0
jne 0x440d1b
cmp byte [ebp + 0xb], 0
jne 0x440d1b
cmp byte [ebp - 8], 0
jne 0x440d1b
mov ecx, ebx
call fcn.00443ae9
jmp 0x441134
cmp byte [ebp - 1], 0
jne 0x440d1b
cmp byte [ebp + 0xb], 0
jne 0x440d1b
mov ecx, dword [ebx + 0x3c]
push dword [ebp - 8]
mov eax, dword [ecx]
push 1
call dword [eax + 8]
jmp 0x441134
cmp byte [ebp - 1], 0
jne 0x440d1b
cmp byte [ebp + 0xb], 0
jne 0x440d1b
mov ecx, dword [ebx + 0x3c]
push dword [ebp - 8]
mov eax, dword [ecx]
push esi
jmp 0x441180
cmp byte [ebp - 1], 0
jne 0x440d1b
cmp byte [ebp + 0xb], 0
jne 0x440d1b
cmp byte [ebp - 8], 0
jne 0x440f2f
push 1
mov ecx, ebx
call fcn.0043fd9c
jmp 0x441134
cmp byte [ebp - 1], 0
jne 0x440d1b
cmp byte [ebp + 0xb], 0
jne 0x440d1b
cmp byte [ebp - 8], 0
jne 0x440d1b
push esi
jmp 0x4411c4