Function at 0x448c60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472b79
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x490fb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x448e7a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je case.0x448cec.2
mov edx, dword [ebp + 8]
mov al, byte [edx + 8]
mov byte [ebp - 0x12], al
movsx ecx, byte [ebp - 0x12]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x4c]
sub edx, 0x43
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], 0x13
ja case.0x448cec.2
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0x448ec4]
jmp dword [ecx*4 + 0x448eb0]
mov edx, dword [ebp - 0x48]
mov dword [edx + 0x198], 0
mov eax, dword [ebp - 0x48]
mov dword [eax + 0x19c], 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x48]
add ecx, 0x1dc
call fcn.0041ec10
lea ecx, [ebp - 0x2c]
call fcn.00417d90
mov dword [ebp - 0x1c], eax
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x48]
add ecx, 0x1dc
call fcn.00421c90
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x448d4c
jmp case.0x448cec.2
mov eax, dword [ebp - 0x48]
add eax, 0x1a4
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
mov edx, esp
mov dword [ebp - 0x40], esp
push ecx
mov ecx, edx
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
add eax, 0x1a0
push eax
call fcn.00449b60
add esp, 0xc
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x54]
mov dword [ecx + 0x19c], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x198], ecx
jmp case.0x448cec.2
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x48]
call fcn.00448ee0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x448e45
mov ecx, dword [ebp - 0x30]
call fcn.0043a550
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx + 0x1d4]
add ecx, 0x14
call fcn.00435580
push 1
mov edx, dword [ebp - 0x48]
mov ecx, dword [edx + 0x1d4]
call fcn.0043af80
push 0xffffffffffffffff
push 1
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x48]
call fcn.00445190
mov ecx, dword [ebp - 0x48]
add ecx, 0x1dc
call fcn.004226c0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x3c]
push edx
push 1
mov ecx, dword [ebp - 0x48]
add ecx, 0x1dc
call sub.mfc100.dll_Ordinal_6135
push 1
mov eax, dword [ebp - 0x38]
push eax
push 1
mov ecx, dword [ebp - 0x48]
add ecx, 0x1dc
call sub.mfc100.dll_Ordinal_12695
jmp case.0x448cec.2
mov ecx, dword [ebp - 0x48]
call fcn.00447630
jmp case.0x448cec.2
mov ecx, dword [ebp - 0x48]
call fcn.00447c00
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 8]
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x11]
mov byte [ebp - 0x58], al
cmp byte [ebp - 0x58], 0x2e
je 0x448e70
jmp 0x448e7a
push 1
mov ecx, dword [ebp - 0x48]
call fcn.004489e0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x48]
call sub.mfc100.dll_Ordinal_11111
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4