Function at 0x44d78d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, ecx
xor edx, edx
cmp esi, edx
jne 0x44d7a3
xor al, al
jmp 0x44db07
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
push edi
cmp eax, 0xffffff6a
je 0x44da63
cmp eax, 0xffffff4f
je 0x44da63
cmp eax, 0xffffff94
jne 0x44d839
call fcn.0044d65c
lea edi, [esi + 0x10]
mov eax, dword [edi]
push 0xffffffffffffffff
and eax, 0x7f
push eax
mov ecx, esi
call fcn.0044b093
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x44d7eb
inc edi
mov ecx, dword [ebx + 0x10]
mov eax, dword [esi + 0x28]
mov al, byte [eax + ecx]
mov cl, byte [edi]
mov dl, cl
and dl, 0x7f
cmp dl, al
jne 0x44d809
movzx eax, cl
xor eax, 0x80
jmp 0x44d80c
movzx eax, al
mov byte [edi], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, esi
call fcn.0044c27c
mov eax, dword [esi + 0x10]
mov ecx, eax
shr ecx, 7
not ecx
and ecx, 1
push ecx
and eax, 0x7f
push eax
mov ecx, esi
call fcn.0044b093
jmp 0x44db03
cmp eax, 0xfffffff4
jne 0x44d96f
mov edi, 0x10000
cmp byte [0x4c9226], dl
je 0x44d86d
test dword [ebx + 0xc], edi
je 0x44d879
test byte [ebx + 0x24], 1
je 0x44d879
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call fcn.0044c59d
mov dword [ebx + 0x34], eax
jmp 0x44d879
mov eax, dword [esi + 4]
cmp dword [eax + 0x24], edx
je 0x44da0a
mov eax, dword [ebx + 0xc]
dec eax
je 0x44d960
sub eax, edi
je 0x44d950
sub eax, 0x20000
je 0x44d89a
dec eax
je 0x44d8e5
jmp 0x44db03
mov ecx, dword [esi + 0xc]
push 0x10
call fcn.0044f508
mov eax, dword [esi + 4]
cmp dword [eax + 0x34], 0
je 0x44d8ce
mov edx, dword [esi + 0x28]
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebx + 0x38]
movzx ecx, byte [ecx + edx]
push dword [esi + 0xc]
mov edx, dword [ebx + 0x24]
call dword [eax + 0x34]
test al, al
je 0x44d8ce
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], eax
cmp byte [0x4c9088], 0
je 0x44db03
cmp dword [ebx + 0x38], 0
jne 0x44db03
mov ecx, dword [esi + 0x28]
mov eax, dword [ebx + 0x38]
mov cl, byte [eax + ecx]
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [esi + 4]
test dword [ecx + 0x24], edx
jne 0x44d8ff
push 0
jmp 0x44d962
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x24]
mov dword [ebp - 0x14], 2
push 0x1038
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esi + 0x28]
sub dword [ebp - 0x14], eax
mov ecx, dword [ebx + 0x38]
movzx ecx, byte [ecx + edx]
push dword [esi + 0xc]
mov eax, dword [esi + 4]
push ecx
lea edx, [ebp - 0x14]
mov ecx, ebx
call dword [eax + 0x20]
mov ecx, dword [esi + 0xc]
test al, al
je 0x44d94c
push 4
jmp 0x44d965
push 0
jmp 0x44d965
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x24]
neg eax
sbb eax, eax
and eax, 0x20
push eax
jmp 0x44d962
push 0x20
mov ecx, dword [esi + 0xc]
call fcn.0044f508
jmp 0x44db03
cmp eax, 0xffffff65
jne 0x44da11
cmp word [ebx + 0xc], 0x41
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jne 0x44d9b1
push 0x11
call edi
test ax, ax
jge 0x44d9b1
push 2
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44db03
cmp word [ebx + 0xc], 0x43
jne 0x44d9cd
push 0x11
call edi
test ax, ax
jge 0x44d9cd
mov ecx, esi
call fcn.0044d160
jmp 0x44db03
cmp word [ebx + 0xc], 0x71
jne 0x44da0a
mov eax, dword [esi + 4]
test byte [eax + 0x30], 1
je 0x44da0a
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jl 0x44da0a
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push edi
push 0x1076
push dword [ebx]
call esi
xor al, al
jmp 0x44db05
cmp eax, 0xffffff4d
jne 0x44da0a
mov eax, dword [esi + 4]
cmp dword [eax + 0x2c], edx
je 0x44da0a
mov eax, dword [ebx + 0x10]
or dword [ebp - 4], 0xffffffff
test al, 2
je 0x44da5b
mov edi, dword [ebx + 0xc]
and eax, 0x20
mov dword [ebp + 8], eax
cmp edi, dword [esi + 0x14]
jb 0x44da43
xor edi, edi
cmp dword [ebp + 8], edi
je 0x44da5b
mov dword [ebp + 8], edi
push dword [esi + 0xc]
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0x14]
mov ecx, edi
call dword [eax + 0x2c]
test al, al
jne 0x44da58
inc edi
jmp 0x44da34
mov dword [ebp - 4], edi
push dword [ebp - 4]
jmp 0x44d962
lea edi, [ebx + 0xc]
test byte [edi], 1
mov ecx, dword [edi + 0x18]
mov dword [ebp - 4], ecx
je 0x44da8e
mov eax, 0x104
cmp ecx, eax
jge 0x44da7c
mov eax, ecx
mov dword [edi + 0x18], eax
xor eax, eax
mov word [0x4c6fe8], ax
mov dword [edi + 0x14], 0x4c6fe8
mov ecx, dword [edi + 8]
mov dword [edi + 0x24], edx
mov eax, dword [esi + 0x28]
mov dword [ebp + 8], ecx
cmp eax, edx
je 0x44daa4
movzx eax, byte [eax + ecx]
jmp 0x44daa6
xor eax, eax
mov dword [edi + 8], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0xc]
imul edx, dword [edi + 4]
push dword [esi + 0xc]
add edx, dword [esi + 0x18]
mov ecx, edi
call dword [eax + 0x1c]
test byte [edi], 1
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
je 0x44daed
mov eax, dword [edi + 0x14]
mov esi, 0x4c6fe8
cmp eax, esi
je 0x44daed
test eax, eax
jne 0x44dade
mov eax, 0x48f94c
push dword [edi + 0x18]
mov edx, eax
mov ecx, esi
call fcn.00411c98
mov dword [edi + 0x14], esi
mov eax, dword [ebp - 4]
mov dword [edi + 0x18], eax
cmp dword [ebx + 8], 0xffffff6a
jne 0x44db03
mov ecx, edi
call fcn.004694c2
mov al, 1
pop edi
pop ebx
pop esi
leave
ret 4