Function at 0x30009ade
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
inc esi
push ebx
mov dword [ebp - 8], esi
call fcn.3000ba03
test eax, eax
mov edi, eax
jne 0x30009b03
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, 0x112
cmp eax, ecx
ja 0x30009eff
je 0x30009e68
cmp eax, 0x21
ja 0x30009cfb
je 0x30009cb8
cmp eax, 2
je 0x30009c72
cmp eax, 6
je 0x30009c31
cmp eax, 7
je 0x30009c0a
cmp eax, 0xf
jbe 0x30009fad
cmp eax, 0x11
jbe 0x30009b9e
cmp eax, 0x20
jne 0x30009fad
cmp byte [0x300952ad], 0
jne 0x30009b78
push dword [ebp + 0x1c]
push dword [0x30096f7c]
call fcn.30002e1c
pop ecx
pop ecx
jmp 0x3000a040
mov eax, dword [0x30096e7c]
mov ecx, dword [eax + 0x16]
xor esi, esi
cmp ecx, esi
je 0x30009b99
push dword [ebp + 0x1c]
push ecx
call fcn.30002e1c
pop ecx
pop ecx
mov dword [ebp - 8], esi
jmp 0x3000a0dd
mov dword [eax + 0x1a], esi
jmp 0x30009b91
push ebx
call fcn.3000fb93
test eax, eax
pop ecx
je 0x30009bc5
push 0x24
push 0
push 0
push 0xf0003
call fcn.30006363
add esp, 0x10
cmp eax, 7
je 0x3000a0dd
test byte [0x30096cf4], 1
je 0x30009bdd
push ebx
call fcn.3003050c
test eax, eax
pop ecx
jne 0x30009fad
test byte [0x30096cf4], 2
jne 0x30009fad
push 0
push 0x23
push 0xd0000
push ebx
call fcn.3000c828
add esp, 0x10
cmp eax, 2
je 0x3000a0dd
jmp 0x30009fad
push ebx
call fcn.3000ba26
test eax, eax
pop ecx
jne 0x30009c24
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x30009fad
push 0
call fcn.3007e68f
pop ecx
jmp 0x3000a0dd
push ebx
call fcn.3000bb8c
test eax, eax
pop ecx
je 0x30009fad
cmp dword [ebp + 0x18], 0
je 0x30009c50
mov eax, ebx
mov dword [0x300952e8], ebx
jmp 0x30009c67
cmp dword [0x300952e8], ebx
mov eax, dword [0x300952e4]
je 0x30009c60
mov eax, dword [ebp + 0x1c]
and dword [0x300952e8], 0
push eax
call fcn.3002e37b
jmp 0x30009fc3
push edi
call fcn.3000be82
test eax, eax
pop ecx
je 0x30009c8c
mov esi, dword [eax + 0x28]
push edi
push ebx
call fcn.30009ab2
pop ecx
xor esi, esi
pop ecx
inc esi
push ebx
call fcn.3000bb8c
test eax, eax
pop ecx
jne 0x30009fad
and edi, 0xff00
cmp edi, 0xc00
je 0x30009fad
mov dword [0x30096dc4], esi
jmp 0x30009fad
push ebx
call fcn.3000bb8c
test eax, eax
pop ecx
jne 0x30009ceb
and edi, 0xff00
cmp edi, 0xc00
je 0x30009ceb
cmp ebx, dword [0x300952e4]
je 0x30009ceb
cmp word [ebp + 0x1c], si
jne 0x30009ceb
mov dword [ebp - 4], 2
jmp 0x3000a0dd
mov eax, dword [0x30096e7c]
cmp byte [eax], 0
je 0x30009f40
jmp 0x30009cdf
sub eax, 0x22
je 0x30009d93
sub eax, 0x5f
je 0x30009d6f
dec eax
je 0x30009d4d
sub eax, 0x8f
jne 0x30009fad
cmp word [ebp + 0x1c], 0
jne 0x30009fad
cmp dword [ebp + 0x18], 0xf000
jb 0x30009d3e
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ecx
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x3000a0dd
push dword [ebp + 0x18]
push ebx
call fcn.3000aeb3
pop ecx
jmp 0x30009c2b
push edi
call fcn.3000be82
test eax, eax
pop ecx
je 0x30009d64
mov esi, dword [eax + 0x2c]
push edi
push ebx
call fcn.30009ab2
pop ecx
pop ecx
push ebx
call fcn.3000c5d5
jmp 0x30009fc3
mov esi, dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0
push ebx
call esi
push 0
push 2
push ebx
call esi
push edi
push ebx
call fcn.3002e2fe
pop ecx
pop ecx
test eax, eax
jmp 0x30009bff
push 2
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x30009fad
cmp dword [0x300952c8], 0
jne 0x30009fad
push ebx
call fcn.3000bb8c
test eax, eax
pop ecx
jne 0x30009fad
cmp ebx, dword [0x300952e4]
je 0x30009fad
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
test ah, ah
js 0x30009de6
push 2
call esi
test ah, ah
jns 0x30009fad
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x30009fad
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x30009fad
movzx eax, word [ebp - 0xc]
movzx ecx, word [ebp - 0x10]
shl eax, 0x10
or eax, ecx
push eax
push 0
push 0x84
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 2
je 0x30009e5a
cmp eax, 4
je 0x30009e5a
cmp eax, 9
jbe 0x30009fad
cmp eax, 0x11
ja 0x30009fad
push 0
push 0
push 0x5f9
jmp 0x30009d32
cmp dword [0x3009526c], 0
je 0x30009e7f
push esi
push dword [ebp + 0x18]
call fcn.300067e3
jmp 0x30009d47
mov eax, dword [ebp + 0x18]
and eax, 0xfff0
sub eax, 0xf020
je 0x30009ee7
sub eax, 0x10
je 0x30009ea8
sub eax, 0x10
je 0x30009ece
sub eax, 0x20
je 0x30009ec4
sub eax, 0xc0
jne 0x30009fad
cmp ebx, dword [0x300952e4]
jne 0x30009fad
push esi
push ebx
push ebx
call fcn.3000996b
add esp, 0xc
jmp 0x30009fad
call fcn.30002e6a
jmp 0x30009fad
push ebx
call fcn.3000bb8c
test eax, eax
pop ecx
jne 0x30009fad
call fcn.3000a714
jmp 0x3000a0dd
push 2
push ebx
push ebx
call fcn.3000996b
add esp, 0xc
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x30009fad
mov ecx, 0x222
cmp eax, ecx
ja 0x30009ffc
je 0x30009fb6
cmp eax, 0x114
jb 0x30009fad
cmp eax, 0x115
jbe 0x30009fa0
cmp eax, 0x117
je 0x30009f83
cmp eax, 0x11f
je 0x30009f61
cmp eax, 0x121
je 0x30009f4e
cmp eax, 0x201
jne 0x30009fad
cmp dword [0x3009526c], 0
je 0x30009fad
jmp 0x30009cdf
push esi
call fcn.3000acea
push dword [ebp + 0x18]
call fcn.300090cc
jmp 0x30009d47
mov eax, dword [0x30096e7c]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x158], ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [0x30096e7c]
mov dword [ecx + 0x15c], eax
jmp 0x3000a0dd
mov eax, dword [ebp + 0x1c]
shr eax, 0x10
push eax
movzx eax, word [ebp + 0x1c]
push eax
push dword [ebp + 0x18]
push ebx
call fcn.3000b0e3
add esp, 0x10
jmp 0x3000a0dd
cmp dword [0x3009526c], 0
jne 0x3000a0dd
and dword [ebp - 8], 0
jmp 0x3000a0dd
xor esi, esi
cmp dword [ebp + 0x1c], esi
jne 0x30009fc6
push esi
call fcn.3000a0ef
pop ecx
jmp 0x30009fad
cmp dword [ebp + 0x1c], ebx
jne 0x30009fad
push 2
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x30009fad
push ebx
call fcn.3000ba26
test eax, eax
pop ecx
jne 0x30009ff1
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x30009ff1
push ebx
jmp 0x30009fbe
push esi
call fcn.3000a0ef
jmp 0x30009c2b
sub eax, 0x30f
je 0x3000a066
dec eax
dec eax
je 0x3000a048
sub eax, 0x2e7
je 0x3000a034
dec eax
jne 0x30009fad
push ebx
call fcn.3000bb8c
test eax, eax
pop ecx
jne 0x3000a0dd
push ebx
call fcn.3000ba26
test eax, eax
pop ecx
je 0x3000a031
mov ebx, dword [0x300952e4]
push ebx
jmp 0x30009ff2
cmp word [ebp + 0x1c], 0xc04
jne 0x30009fad
mov dword [ebp - 4], esi
jmp 0x3000a0dd
mov eax, dword [ebp + 0x18]
cmp eax, dword [0x30095284]
je 0x30009fad
push eax
call fcn.3000bd58
test eax, eax
pop ecx
jne 0x30009fad
push ebx
call fcn.3000bb8c
test eax, eax
pop ecx
je 0x30009fad
mov eax, dword [0x30096e7c]
cmp dword [eax + 0x72], 0
je 0x30009fad
push 0
push ebx
call fcn.30079671
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x30009fad
mov eax, dword [0x30096e7c]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
push 0
push dword [eax + 0x72]
push ebx
call edi
test eax, eax
mov dword [ebp + 0x1c], eax
je 0x3000a0cb
mov esi, dword [sym.imp.GDI32.dll_RealizePalette]
push ebx
call esi
push 1
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push ebx
call edi
push ebx
call esi
jmp 0x3000a0cf
and dword [ebp - 4], 0
push 0
push ebx
push dword [ebp + 0x10]
call fcn.300796c2
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax], ecx
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x18