Function at 0x44d794
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, ecx
xor edx, edx
cmp esi, edx
jne 0x44d7aa
xor al, al
jmp 0x44db0e
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
push edi
cmp eax, 0xffffff6a
je 0x44da6a
cmp eax, 0xffffff4f
je 0x44da6a
cmp eax, 0xffffff94
jne 0x44d840
call fcn.0044d663
lea edi, [esi + 0x10]
mov eax, dword [edi]
push 0xffffffffffffffff
and eax, 0x7f
push eax
mov ecx, esi
call fcn.0044b07e
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x44d7f2
inc edi
mov ecx, dword [ebx + 0x10]
mov eax, dword [esi + 0x28]
mov al, byte [eax + ecx]
mov cl, byte [edi]
mov dl, cl
and dl, 0x7f
cmp dl, al
jne 0x44d810
movzx eax, cl
xor eax, 0x80
jmp 0x44d813
movzx eax, al
mov byte [edi], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, esi
call fcn.0044c267
mov eax, dword [esi + 0x10]
mov ecx, eax
shr ecx, 7
not ecx
and ecx, 1
push ecx
and eax, 0x7f
push eax
mov ecx, esi
call fcn.0044b07e
jmp 0x44db0a
cmp eax, 0xfffffff4
jne 0x44d976
mov edi, 0x10000
cmp byte [0x4c9246], dl
je 0x44d874
test dword [ebx + 0xc], edi
je 0x44d880
test byte [ebx + 0x24], 1
je 0x44d880
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call fcn.0044c588
mov dword [ebx + 0x34], eax
jmp 0x44d880
mov eax, dword [esi + 4]
cmp dword [eax + 0x24], edx
je 0x44da11
mov eax, dword [ebx + 0xc]
dec eax
je 0x44d967
sub eax, edi
je 0x44d957
sub eax, 0x20000
je 0x44d8a1
dec eax
je 0x44d8ec
jmp 0x44db0a
mov ecx, dword [esi + 0xc]
push 0x10
call fcn.0044f512
mov eax, dword [esi + 4]
cmp dword [eax + 0x34], 0
je 0x44d8d5
mov edx, dword [esi + 0x28]
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebx + 0x38]
movzx ecx, byte [ecx + edx]
push dword [esi + 0xc]
mov edx, dword [ebx + 0x24]
call dword [eax + 0x34]
test al, al
je 0x44d8d5
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], eax
cmp byte [0x4c90a8], 0
je 0x44db0a
cmp dword [ebx + 0x38], 0
jne 0x44db0a
mov ecx, dword [esi + 0x28]
mov eax, dword [ebx + 0x38]
mov cl, byte [eax + ecx]
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [esi + 4]
test dword [ecx + 0x24], edx
jne 0x44d906
push 0
jmp 0x44d969
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x24]
mov dword [ebp - 0x14], 2
push 0x1038
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esi + 0x28]
sub dword [ebp - 0x14], eax
mov ecx, dword [ebx + 0x38]
movzx ecx, byte [ecx + edx]
push dword [esi + 0xc]
mov eax, dword [esi + 4]
push ecx
lea edx, [ebp - 0x14]
mov ecx, ebx
call dword [eax + 0x20]
mov ecx, dword [esi + 0xc]
test al, al
je 0x44d953
push 4
jmp 0x44d96c
push 0
jmp 0x44d96c
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x24]
neg eax
sbb eax, eax
and eax, 0x20
push eax
jmp 0x44d969
push 0x20
mov ecx, dword [esi + 0xc]
call fcn.0044f512
jmp 0x44db0a
cmp eax, 0xffffff65
jne 0x44da18
cmp word [ebx + 0xc], 0x41
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jne 0x44d9b8
push 0x11
call edi
test ax, ax
jge 0x44d9b8
push 2
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44db0a
cmp word [ebx + 0xc], 0x43
jne 0x44d9d4
push 0x11
call edi
test ax, ax
jge 0x44d9d4
mov ecx, esi
call fcn.0044d167
jmp 0x44db0a
cmp word [ebx + 0xc], 0x71
jne 0x44da11
mov eax, dword [esi + 4]
test byte [eax + 0x30], 1
je 0x44da11
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jl 0x44da11
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push edi
push 0x1076
push dword [ebx]
call esi
xor al, al
jmp 0x44db0c
cmp eax, 0xffffff4d
jne 0x44da11
mov eax, dword [esi + 4]
cmp dword [eax + 0x2c], edx
je 0x44da11
mov eax, dword [ebx + 0x10]
or dword [ebp - 4], 0xffffffff
test al, 2
je 0x44da62
mov edi, dword [ebx + 0xc]
and eax, 0x20
mov dword [ebp + 8], eax
cmp edi, dword [esi + 0x14]
jb 0x44da4a
xor edi, edi
cmp dword [ebp + 8], edi
je 0x44da62
mov dword [ebp + 8], edi
push dword [esi + 0xc]
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0x14]
mov ecx, edi
call dword [eax + 0x2c]
test al, al
jne 0x44da5f
inc edi
jmp 0x44da3b
mov dword [ebp - 4], edi
push dword [ebp - 4]
jmp 0x44d969
lea edi, [ebx + 0xc]
test byte [edi], 1
mov ecx, dword [edi + 0x18]
mov dword [ebp - 4], ecx
je 0x44da95
mov eax, 0x104
cmp ecx, eax
jge 0x44da83
mov eax, ecx
mov dword [edi + 0x18], eax
xor eax, eax
mov word [0x4c7008], ax
mov dword [edi + 0x14], 0x4c7008
mov ecx, dword [edi + 8]
mov dword [edi + 0x24], edx
mov eax, dword [esi + 0x28]
mov dword [ebp + 8], ecx
cmp eax, edx
je 0x44daab
movzx eax, byte [eax + ecx]
jmp 0x44daad
xor eax, eax
mov dword [edi + 8], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0xc]
imul edx, dword [edi + 4]
push dword [esi + 0xc]
add edx, dword [esi + 0x18]
mov ecx, edi
call dword [eax + 0x1c]
test byte [edi], 1
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
je 0x44daf4
mov eax, dword [edi + 0x14]
mov esi, 0x4c7008
cmp eax, esi
je 0x44daf4
test eax, eax
jne 0x44dae5
mov eax, 0x4945b8
push dword [edi + 0x18]
mov edx, eax
mov ecx, esi
call fcn.00411c42
mov dword [edi + 0x14], esi
mov eax, dword [ebp - 4]
mov dword [edi + 0x18], eax
cmp dword [ebx + 8], 0xffffff6a
jne 0x44db0a
mov ecx, edi
call fcn.0046945e
mov al, 1
pop edi
pop ebx
pop esi
leave
ret 4