Function at 0x4422f7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
cmp ecx, 0x102
jne 0x442315
xor eax, eax
jmp 0x442599
cmp ecx, 0x100
je 0x4424c8
cmp ecx, 0x104
je 0x4424c8
cmp ecx, 0x101
je 0x442460
cmp ecx, 0x105
je 0x442460
cmp ecx, 8
jne 0x442365
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00415910
mov edi, eax
mov eax, edi
jmp 0x442599
mov eax, 0x2111
cmp ecx, eax
jne 0x4423ba
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
mov edx, 0x300
cmp cx, dx
jne 0x442392
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push eax
call fcn.00440c00
jmp 0x44235c
mov eax, 0x400
cmp cx, ax
jne 0x44235e
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x44235e
cmp ecx, 0x2133
je 0x4423dd
cmp ecx, 0x2138
je 0x4423dd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00413837
jmp 0x442599
mov ecx, dword [esi + 0x20]
call fcn.00440ec3
cmp eax, 0xffffffff
je 0x44230e
push 1
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esi + 0x20]
call fcn.0042680a
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x24], edi
jne 0x442458
mov ecx, dword [esi + 0x20]
call fcn.00440ec3
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ecx, cl
shl edx, 8
shr eax, 0x10
or ecx, edx
movzx eax, al
shl ecx, 8
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
jmp 0x442599
mov ecx, dword [esi + 0x20]
call fcn.00441240
cmp eax, 1
jae 0x44230e
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x442487
push 0
jmp 0x442489
push 1
call fcn.004411e1
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x44249e
push 0
jmp 0x4424a0
push 1
call fcn.004411bf
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x4424b5
push 0
jmp 0x4424b7
push 1
call fcn.0044119d
mov ecx, esi
call fcn.004421d0
jmp 0x44230e
mov ecx, dword [esi + 0x20]
call fcn.00441216
test eax, eax
je 0x4424dc
mov ecx, dword [esi + 0x20]
call fcn.0044124e
mov ecx, dword [esi + 0x20]
call fcn.00441224
test eax, eax
je 0x4424f0
mov ecx, dword [esi + 0x20]
call fcn.0044125e
mov ecx, dword [esi + 0x20]
call fcn.00441232
test eax, eax
je 0x442504
mov ecx, dword [esi + 0x20]
call fcn.0044126e
mov ecx, dword [esi + 0x20]
call fcn.00441240
mov ecx, dword [esi + 0x20]
push 0
mov edx, eax
call fcn.00441203
test edx, edx
jbe 0x442525
mov ecx, dword [esi + 0x20]
push edx
call fcn.0044127e
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x44253b
push 0
jmp 0x44253d
push 1
call fcn.004411e1
push 0x10
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x442552
push 0
jmp 0x442554
push 1
call fcn.004411bf
push 0x11
call edi
mov ecx, dword [esi + 0x20]
test ax, ax
jge 0x442569
push 0
jmp 0x44256b
push 1
call fcn.0044119d
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x44258f
cmp eax, 0x11
je 0x44258f
cmp eax, 0x10
je 0x44258f
cmp eax, 0x12
je 0x44258f
mov ecx, dword [esi + 0x20]
push eax
call fcn.00441203
mov ecx, esi
call fcn.004421d0
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc