Function at 0x44ce34
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0x10
push ebx
push esi
push edi
je 0x44d0b7
sub eax, 0x100
je 0x44d070
dec eax
jne 0x44ce75
movzx eax, word [ebp + 0x10]
dec eax
je 0x44cefd
dec eax
je 0x44ceec
sub eax, 0x3eb
je 0x44cee0
dec eax
je 0x44cea9
sub eax, 0x19
je 0x44ce8e
cmp dword [ebp + 0xc], 0xd
je 0x44ce85
push 0
push dword [ebp + 8]
call fcn.0044a7fb
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.0044af65
push 0
push 0x44c27e
push str.index
push 0x47b474
call fcn.00448ce4
jmp 0x44d0c1
cmp dword [0x4d6494], 1
jne 0x44cec8
push 0x4d6de0
push str.Select_Destination_File_for__s
call fcn.0042f614
pop ecx
pop ecx
push eax
push 1
jmp 0x44ced6
push str.Select_Save_Image_to_restore
call fcn.0042f614
pop ecx
push eax
push 0
push dword [ebp + 8]
call fcn.0044a880
jmp 0x44cef6
push 0
push dword [ebp + 8]
call fcn.0044a7fb
jmp 0x44cef6
push 2
push dword [ebp + 8]
call fcn.00448b17
xor eax, eax
jmp 0x44d0c4
push 0x400
push 0x4cd988
push 0x3f1
push dword [ebp + 8]
call dword [sym.imp.e_to_open__s_GetDlgItemTextA]
push 0xa
push 0x49efd8
push 0x3ed
push dword [ebp + 8]
call fcn.004472df
cmp dword [0x4d6494], 1
jne 0x44d069
push dword [0x49efd8]
mov ecx, 0x4cde18
call fcn.0041483a
xor ebx, ebx
mov dword [0x4cd334], eax
cmp eax, ebx
je 0x44cf57
mov dword [0x49f02c], ebx
cmp dword [0x49f02c], ebx
jne 0x44cf6b
cmp dword [0x4cd314], ebx
jne 0x44cf6b
xor eax, eax
jmp 0x44cf70
mov eax, 0x4cd33c
mov ecx, dword [0x4cdfa8]
push eax
push dword [0x49efd8]
call fcn.00445fda
test eax, eax
jne 0x44cfa8
push ebx
push 0x20000000
push str.Filename_Error
push str.You_have_selected_multiple_partitions._nYou_must_specify__DISK_in_the_output_file_name._nThis_will_create_multiple_images__with__DISK__nreplaced_by_the_drive_name._n
push 0x24
push dword [0x4d617c]
call fcn.0041ee88
jmp 0x44cef6
mov ecx, dword [0x4cdfa8]
call fcn.00446224
mov esi, str.DontAskBeforeOverwrite
mov ecx, dword [0x4cdfa8]
call fcn.0044625e
mov edi, eax
push 0x46c3a0
push edi
call fcn.00450597
pop ecx
pop ecx
test eax, eax
je 0x44d041
push ebx
push edi
call fcn.00450d79
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x44d041
push ebx
push esi
call fcn.00447d39
test eax, eax
jne 0x44d041
mov ecx, dword [0x4cdfa8]
push ebx
push 0x21000004
push str.Filename_Warning
call fcn.0044625e
push eax
push str._s__already_exists._nDo_you_want_to_replace_it.
call fcn.0042f614
pop ecx
pop ecx
push eax
push 0x33
push dword [0x4d617c]
call fcn.0041ee88
mov edi, eax
test edi, 0x1000000
je 0x44d032
push 1
push esi
call fcn.00447d88
and edi, 0xfeffffff
cmp edi, 7
je 0x44cef6
mov ecx, dword [0x4cdfa8]
call fcn.00446229
test eax, eax
jne 0x44cfb8
cmp dword [0x4cd314], ebx
je 0x44d069
call fcn.00420b7b
test eax, eax
je 0x44cef6
push 1
jmp 0x44ceee
push dword [ebp + 0x14]
mov esi, dword [ebp + 8]
push esi
call fcn.0044a729
push 0xa
push 0x49efd8
push 0x3ed
push esi
call fcn.00447222
push 1
push esi
call fcn.0044a7fb
push 0
push 0x3ff
push 0xc5
push 0x3f1
push esi
call dword [sym.imp.e_to_open__s_GetDlgItem]
push eax
call dword [sym.imp.e_to_open__s_SendMessageA]
jmp 0x44d0c1
push 0
push dword [ebp + 8]
call fcn.00448b17
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10