Function at 0x449d20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4901a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4bf454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx ebx, word [ebp + 8]
mov edi, dword [ebp + 0xc]
movzx eax, bx
push edi
push eax
push str.processKeyEvent___function_called:_virtKey___4.4x__addKeyData___x
push dword [esi + 0x210]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], eax
call fcn.00443ba0
add esp, 0x10
cmp byte [esi + 0x214], 0
je 0x449d9a
cmp ebx, 0x5b
je 0x449d85
cmp ebx, 0x5c
jne 0x449d9a
push str.Ignoring_the_Win_key_event
push dword [esi + 0x210]
call fcn.00443ba0
jmp 0x44a0a4
mov eax, edi
shr eax, 0x1f
not al
and eax, 0xffffff01
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x3c], al
movzx eax, al
push eax
push str.down___u
push dword [esi + 0x210]
call fcn.00443ba0
add esp, 0xc
cmp byte [esi + 0x1aa], 0
jl 0x449dd9
cmp byte [esi + 0x1ab], 0
mov byte [ebp - 0x29], 0
jge 0x449ddd
mov byte [ebp - 0x29], 1
cmp byte [esi + 0x1ac], 0
jl 0x449df3
cmp byte [esi + 0x1ad], 0
jl 0x449df3
xor bh, bh
jmp 0x449df5
mov bh, 1
cmp byte [esi + 0x1a8], 0
mov byte [ebp - 0x2a], bh
jl 0x449e0e
cmp byte [esi + 0x1a9], 0
jl 0x449e0e
xor edi, edi
jmp 0x449e13
mov edi, 1
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov bl, al
and bl, 1
movzx ecx, bl
push ecx
push edi
movzx ecx, bh
push ecx
movzx ecx, byte [ebp - 0x29]
push ecx
push str.ctrl___u__alt___u__shift___u__caps_toggled___u
push dword [esi + 0x210]
call fcn.00443ba0
mov eax, dword [ebp - 0x40]
add esp, 0x18
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
movzx eax, al
shl cl, 7
mov dword [ebp - 0x38], ecx
mov byte [eax + esi + 8], cl
mov byte [esi + 0x1c], bl
mov ebx, dword [ebp + 0xc]
shr ebx, 0x18
and bl, 1
mov al, bl
sub al, 0x5e
cmp dl, 0x11
movzx ecx, al
movzx eax, dl
cmovne ecx, eax
mov al, bl
sub al, 0x5c
cmp cl, 0x12
movzx edx, al
movzx eax, cl
cmovne edx, eax
mov al, bl
sub al, 0x60
cmp dl, 0x10
movzx ecx, al
movzx eax, dl
mov edx, dword [ebp - 0x38]
cmovne ecx, eax
movzx edi, cl
push ecx
mov eax, edi
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [esi + 0x20a]
mov byte [eax + esi + 0x108], dl
call fcn.0044f290
test al, al
je 0x449ef3
mov eax, dword [ebp - 0x34]
cmp eax, 0xff0d
jne 0x449ecd
test bl, bl
mov ecx, 0xff8d
cmovne eax, ecx
mov dword [ebp - 0x34], eax
push eax
push str.The_key_has_been_mapped_to_the__4.4x_rfb_symbol
push dword [esi + 0x210]
call fcn.00443ba0
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
push dword [ebp - 0x3c]
push dword [ebp - 0x34]
call dword [eax + 4]
jmp 0x44a0a7
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov ecx, esi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x3c]
push edi
call fcn.0044a4d0
cmp byte [ebp - 0x29], 0
mov byte [ebp - 0x2b], al
je 0x449f46
cmp byte [ebp - 0x2a], 0
je 0x449f46
test al, al
je 0x449f46
push str.Release_the_ctrl_and_alt_modifiers_before_send_the_key_event_s_
push dword [esi + 0x210]
call fcn.00443ba0
add esp, 8
mov ecx, esi
call fcn.0044a120
mov ebx, dword [ebp - 0x28]
xor edi, edi
cmp dword [ebp - 0x18], edi
jbe 0x449fa9
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x34]
cmovae eax, ebx
push ecx
lea ecx, [esi + 0x20a]
movzx eax, word [eax + edi*2]
push eax
call fcn.0044f220
test al, al
je 0x449f81
push dword [ebp - 0x3c]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x34]
call dword [eax + 4]
jmp 0x449fa3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, ebx
movzx eax, word [eax + edi*2]
push eax
push str.Cant_translate_the__4.4x_unicode_character_to_an_rfb_symbol_to_send_it
push dword [esi + 0x210]
call fcn.00443c00
add esp, 0xc
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x449f50
cmp byte [ebp - 0x29], 0
je 0x44a074
cmp byte [ebp - 0x2a], 0
je 0x44a074
cmp byte [ebp - 0x2b], 0
je 0x44a074
push str.Restore_the_ctrl_and_alt_modifiers_after_send_the_key_event_s_
push dword [esi + 0x210]
call fcn.00443ba0
add esp, 8
lea edi, [esi + 0x20a]
cmp byte [esi + 0x1aa], 0
jge 0x44a005
push 0xa2
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.0044f290
mov eax, dword [esi]
mov ecx, esi
push 1
push dword [ebp - 0x30]
call dword [eax + 4]
cmp byte [esi + 0x1ab], 0
jge 0x44a02a
push 0xa3
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.0044f290
mov eax, dword [esi]
mov ecx, esi
push 1
push dword [ebp - 0x30]
call dword [eax + 4]
cmp byte [esi + 0x1ac], 0
jge 0x44a04f
push 0xa4
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.0044f290
mov eax, dword [esi]
mov ecx, esi
push 1
push dword [ebp - 0x30]
call dword [eax + 4]
cmp byte [esi + 0x1ad], 0
jge 0x44a074
push 0xa5
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
call fcn.0044f290
mov eax, dword [esi]
mov ecx, esi
push 1
push dword [ebp - 0x44]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x44a0a7
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x44a09d
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a0c5
push ecx
push ebx
call fcn.00464d6f
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464d5e
mov esp, ebp
pop ebp
ret 8
call fcn.004715c1
int3