Function at 0x4442c7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
push edi
mov esi, ecx
je 0x4442e0
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x4442ea
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x4442f4
mov byte [esi + 0x17], 1
xor eax, eax
cmp byte [esi + 0x14], al
je 0x444303
cmp byte [esi + 0x1a], al
je 0x444303
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x444310
cmp byte [esi + 0x1b], al
je 0x444310
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x44431d
cmp byte [esi + 0x1c], al
je 0x44431d
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x44432a
cmp byte [esi + 0x1d], al
je 0x44432a
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x444337
cmp byte [esi + 0x1e], al
je 0x444337
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x4443d9
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x44450f
mov cl, byte [esi + 0x1a]
movzx eax, byte [ebp - 0x6c]
xor edx, edx
test cl, cl
cmove eax, edx
mov dl, byte [esi + 0x1b]
mov byte [ebp - 0x6c], al
movzx eax, byte [ebp - 0x6b]
xor edi, edi
test dl, dl
cmove eax, edi
mov byte [ebp - 0x6b], al
test cl, cl
jne 0x44438d
movzx eax, byte [ebp - 0xfc]
test dl, dl
cmove eax, edi
mov byte [ebp - 0xfc], al
movzx eax, byte [ebp - 0xfb]
xor edx, edx
cmp byte [esi + 0x1c], dl
cmove eax, edx
cmp byte [esi + 0x1d], dl
mov byte [ebp - 0xfb], al
movzx eax, byte [ebp - 0xfa]
cmove eax, edx
mov byte [ebp - 0xfa], al
movzx eax, byte [ebp - 0xb1]
test cl, cl
cmove eax, edx
mov byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x44450f
push ebx
lea ecx, [ebp - 0xc]
call fcn.00443f1c
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x444410
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x44442e
cmp byte [esi + 0x1a], 0
jne 0x44442e
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.00445691
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f0d
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x444450
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x44446e
cmp byte [esi + 0x1b], 0
jne 0x44446e
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.00445691
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f0d
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x44448a
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x4444a5
cmp byte [esi + 0x1c], 0
jne 0x4444a5
push 0x11
lea ecx, [ebp - 0xc]
call fcn.00445691
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f0d
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4444c1
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x4444dc
cmp byte [esi + 0x1d], 0
jne 0x4444dc
push 0x12
lea ecx, [ebp - 0xc]
call fcn.00445691
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f0d
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x4444f3
push 0x5b
call edi
test bx, ax
je 0x44450e
cmp byte [esi + 0x1e], 0
jne 0x44450e
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.00445691
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00444f0d
pop ebx
pop edi
pop esi
leave
ret 4