Function at 0x44227b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
cmp ecx, 0x102
jne 0x442299
xor eax, eax
jmp 0x44251d
cmp ecx, 0x100
je 0x44244c
cmp ecx, 0x104
je 0x44244c
cmp ecx, 0x101
je 0x4423e4
cmp ecx, 0x105
je 0x4423e4
cmp ecx, 8
jne 0x4422e9
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00415883
mov edi, eax
mov eax, edi
jmp 0x44251d
mov eax, 0x2111
cmp ecx, eax
jne 0x44233e
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
mov edx, 0x300
cmp cx, dx
jne 0x442316
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push eax
call fcn.00440b7c
jmp 0x4422e0
mov eax, 0x400
cmp cx, ax
jne 0x4422e2
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4422e2
cmp ecx, 0x2133
je 0x442361
cmp ecx, 0x2138
je 0x442361
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00413833
jmp 0x44251d
mov ecx, dword [esi + 0x20]
call fcn.00440e3f
cmp eax, 0xffffffff
je 0x442292
push 1
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esi + 0x20]
call fcn.00426744
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x24], edi
jne 0x4423dc
mov ecx, dword [esi + 0x20]
call fcn.00440e3f
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
jmp 0x44251d
mov ecx, dword [esi + 0x20]
call fcn.004411c3
cmp eax, 1
jae 0x442292
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x44240b
push 0
jmp 0x44240d
push 1
call fcn.00441164
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x442422
push 0
jmp 0x442424
push 1
call fcn.00441142
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x442439
push 0
jmp 0x44243b
push 1
call fcn.00441120
mov ecx, esi
call fcn.00442154
jmp 0x442292
mov ecx, dword [esi + 0x20]
call fcn.00441199
test eax, eax
je 0x442460
mov ecx, dword [esi + 0x20]
call fcn.004411d1
mov ecx, dword [esi + 0x20]
call fcn.004411a7
test eax, eax
je 0x442474
mov ecx, dword [esi + 0x20]
call fcn.004411e1
mov ecx, dword [esi + 0x20]
call fcn.004411b5
test eax, eax
je 0x442488
mov ecx, dword [esi + 0x20]
call fcn.004411f1
mov ecx, dword [esi + 0x20]
call fcn.004411c3
mov ecx, dword [esi + 0x20]
push 0
mov edx, eax
call fcn.00441186
test edx, edx
jbe 0x4424a9
mov ecx, dword [esi + 0x20]
push edx
call fcn.00441201
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424bf
push 0
jmp 0x4424c1
push 1
call fcn.00441164
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424d6
push 0
jmp 0x4424d8
push 1
call fcn.00441142
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424ed
push 0
jmp 0x4424ef
push 1
call fcn.00441120
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x442513
cmp eax, 0x11
je 0x442513
cmp eax, 0x10
je 0x442513
cmp eax, 0x12
je 0x442513
mov ecx, dword [esi + 0x20]
push eax
call fcn.00441186
mov ecx, esi
call fcn.00442154
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc