Function at 0x44fea6
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Get common file path
Log keystrokes via polling
Terminate process

Disassembly:
push 0x324
mov eax, 0x470e52
call fcn.0046c47e
push str.100001111100000101101010001010010110111100000111100101011111
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push ebx
push eax
mov dword [ebp - 0x330], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x45016c
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x44feda
push ebx
call fcn.0045a9d4
push eax
call fcn.00459716
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x114]
pop ecx
pop ecx
push eax
push ebx
push ebx
push 0x1c
push ebx
call esi
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44ff11
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
mov ecx, 0x485bf0
call fcn.00450deb
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44ff47
sub ecx, edx
lea eax, [ebp - 0x218]
push ecx
push eax
mov ecx, 0x485c08
call fcn.00450deb
lea eax, [ebp - 0x31c]
push eax
push ebx
push ebx
push 0x1a
push ebx
call esi
lea ecx, [ebp - 0x31c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44ff79
sub ecx, edx
lea eax, [ebp - 0x31c]
push ecx
push eax
mov ecx, 0x485b90
call fcn.00450deb
mov edi, ebx
mov dword [ebp - 0x324], ebx
mov esi, ebx
mov dword [ebp - 0x32c], edi
mov dword [ebp - 0x328], esi
and dword [ebp - 4], 0
xor ecx, ecx
push 0x16
pop edx
inc ecx
call fcn.004408e0
mov ecx, edi
mov dword [ebp - 0x320], eax
cmp ecx, esi
je 0x44ffd4
cmp dword [ecx], eax
je 0x44ffd0
add ecx, 4
cmp ecx, esi
jne 0x44ffc5
cmp ecx, esi
jne 0x44ffae
cmp esi, ebx
je 0x44ffe5
mov dword [esi], eax
add esi, 4
mov dword [ebp - 0x328], esi
jmp 0x45000a
lea eax, [ebp - 0x320]
push eax
push esi
lea ecx, [ebp - 0x32c]
call fcn.004517d1
mov ebx, dword [ebp - 0x324]
mov esi, dword [ebp - 0x328]
mov edi, dword [ebp - 0x32c]
mov eax, esi
sub eax, edi
sar eax, 2
cmp eax, 0x16
jb 0x44ffae
mov edx, 0x378
xor ecx, ecx
call fcn.004408e0
mov esi, 0x7d0
cmp eax, esi
jge 0x45017b
mov edx, 0x309
xor ecx, ecx
call fcn.004408e0
cmp eax, esi
jge 0x45017b
push ecx
mov edx, 0x5f5e100
call fcn.0042dc2f
pop ecx
lea ecx, [ebp - 0x32c]
mov dword [0x48726c], eax
call fcn.004501de
mov esi, eax
call fcn.004501da
mov edi, eax
jmp 0x450142
mov ecx, dword [esi]
dec ecx
cmp ecx, 0x15
ja case.default.0x450079
jmp dword [ecx*4 + 0x450182]
call fcn.0044ad84
jmp case.default.0x450079
call fcn.0044ba28
jmp case.default.0x450079
call fcn.00448127
jmp case.default.0x450079
call fcn.0044bd16
jmp case.default.0x450079
call fcn.0044a716
jmp case.default.0x450079
call fcn.00441885
jmp case.default.0x450079
call fcn.00441080
call fcn.00443089
jmp case.default.0x450079
call fcn.00443461
jmp case.default.0x450079
call fcn.00441476
jmp case.default.0x450079
call fcn.00449805
jmp case.default.0x450079
sub esp, 0x18
mov ecx, esp
push 0x485bf0
call fcn.00450b37
call fcn.00445729
add esp, 0x18
jmp case.default.0x450079
call fcn.00441c58
jmp case.default.0x450079
sub esp, 0x18
mov ecx, esp
push 0x485b90
jmp 0x4500e7
call fcn.0044215b
jmp case.default.0x450079
call fcn.00442513
jmp case.default.0x450079
call fcn.004428e9
jmp case.default.0x450079
call fcn.00442cc3
jmp case.default.0x450079
call fcn.0044942e
jmp case.default.0x450079
call fcn.0044a48b
jmp case.default.0x450079
call fcn.0044be87
jmp case.default.0x450079
call fcn.004474ee
add esi, 4
cmp esi, edi
jne 0x45006d
call fcn.0044f939
call fcn.0044bf48
mov ecx, dword [0x48726c]
call fcn.0042dcee
lea ecx, [ebp - 0x32c]
call fcn.004501e1
xor ebx, ebx
push dword [ebp - 0x330]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
jmp 0x45017d
push 0
call fcn.004596df
mov al, byte [eax]
inc ebp
add byte [eax + 0x25004500], al
add dword [ebp], eax
cmp al, byte [ecx]
inc ebp
add byte [edx - 0x43ffbb00], dh
add byte [ebp], al
xchg esp, eax
add byte [ebp], al
fld qword [eax]
inc ebp
add bh, cl
add byte [ebp], al
rol dword [eax], 0x45
add byte [esi - 50313984], bl
add byte [ebp], al
test byte [eax], 0x45
add byte [ebx], dh
add dword [ebp], eax
adc byte [ecx], al
inc ebp
add byte [edi], dl
add dword [ebp], eax
push ds
add dword [ebp], eax
salc
add byte [ebp], al
test al, 0
inc ebp
add al, cl
add byte [ebp], al
or dword [ecx], eax
inc ebp
add byte [ecx + eax], ch
inc ebp
add byte [ebx - 0x743cfbbf], cl
mov eax, dword [ecx + 4]
ret
mov eax, dword [ecx]
ret