Function at 0x447360
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6515
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x18
mov dword [ebp - 0x120], 0x5448d0
mov dword [0x5448d8], ebx
call fcn.004a90a2
add esp, 4
cmp eax, ebx
je 0x447652
mov dword [0x5448d4], eax
mov dword [eax], eax
mov eax, dword [0x5448d4]
mov dword [eax + 4], eax
mov eax, dword [0x5448d4]
mov dword [eax + 8], eax
mov eax, dword [0x5448d4]
mov byte [eax + 0x14], 1
mov ecx, dword [0x5448d4]
mov byte [ecx + 0x15], 1
mov dword [ebp - 4], ebx
push 0x18
mov dword [0x5448e8], ebx
call fcn.004a90a2
add esp, 4
cmp eax, ebx
je 0x44761f
mov dword [0x5448e4], eax
mov dword [eax], eax
mov eax, dword [0x5448e4]
mov dword [eax + 4], eax
mov eax, dword [0x5448e4]
mov dword [eax + 8], eax
mov edx, dword [0x5448e4]
mov byte [edx + 0x14], 1
mov eax, dword [0x5448e4]
mov byte [eax + 0x15], 1
mov byte [ebp - 4], 1
mov esi, 0x4eb5f8
lea edi, [ebx + 0x61]
lea ecx, [ecx]
mov eax, esi
call fcn.004482c0
mov cl, byte [esi + 4]
mov byte [eax], cl
mov edx, esi
mov eax, 0x5448e0
call fcn.00448390
mov dl, byte [esi + 5]
add esi, 8
dec edi
mov byte [eax], dl
jne 0x447430
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.004b2d10
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x114], esi
movzx ecx, byte [esi + 0x4ebc50]
lea edi, [esi + 0x4ebc50]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movzx ecx, ax
cmp cx, 0xffff
je 0x4475e4
mov eax, ecx
shr eax, 8
mov dl, al
shl dl, 7
mov byte [ebp - 0x100], dl
mov dl, al
and al, 0xfc
shl al, 5
push 0
mov byte [ebp - 0xfe], al
movzx ebx, cl
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x110]
push ecx
and dl, 0xfe
push 0
shl dl, 6
push ebx
mov byte [ebp - 0xff], dl
call dword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jns 0x4475e4
movzx eax, byte [edi]
push eax
push eax
push str.Found_dead_key_0x_x__c
mov eax, 8
mov ecx, 0x4ecb00
call fcn.00403230
mov eax, dword [0x5448f4]
mov edx, dword [0x5448f0]
add esp, 0xc
cmp edi, eax
jae 0x447569
cmp edx, edi
ja 0x447569
mov esi, dword [0x5448f8]
sub edi, edx
cmp eax, esi
jne 0x44755e
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x447615
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x44755e
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x447540
xor eax, eax
jmp 0x447542
add eax, edx
cmp eax, ecx
jae 0x447548
mov eax, ecx
push eax
mov esi, 0x5448f0
call fcn.00428340
mov eax, dword [0x5448f4]
mov edx, dword [0x5448f0]
test eax, eax
je 0x4475bf
mov dl, byte [edx + edi]
mov byte [eax], dl
jmp 0x4475ba
mov esi, dword [0x5448f8]
cmp eax, esi
jne 0x4475b2
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfffffffe
ja 0x447615
inc ecx
sub esi, edx
cmp ecx, esi
jbe 0x4475b2
mov eax, esi
mov edx, eax
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, eax
jae 0x44759a
xor eax, eax
jmp 0x44759c
add eax, edx
cmp eax, ecx
jae 0x4475a2
mov eax, ecx
push eax
mov esi, 0x5448f0
call fcn.00428340
mov eax, dword [0x5448f4]
test eax, eax
je 0x4475bf
mov cl, byte [edi]
mov byte [eax], cl
mov eax, dword [0x5448f4]
push 0
inc eax
lea edx, [ebp - 0x118]
push edx
mov dword [0x5448f4], eax
lea eax, [ebp - 0x110]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
mov esi, dword [ebp - 0x114]
inc esi
mov dword [ebp - 0x114], esi
cmp esi, 7
jb 0x447470
mov eax, 0x5448d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.004a8927
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x11c], ebx
call fcn.004a8bfd
push 0x4e455c
lea edx, [ebp - 0x138]
push edx
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.004b2eef
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x114], ebx
call fcn.004a8bfd
push 0x4e455c
lea ecx, [ebp - 0x12c]
push ecx
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.004b2eef
int3