Function at 0x300011c8
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp ebx, 5
push edi
jbe 0x3000124d
cmp ebx, 0x15
jbe 0x30001265
push 0x21
pop esi
cmp ebx, esi
jbe 0x30029ab3
mov eax, 0xa1
cmp ebx, eax
jbe 0x30001281
mov eax, 0x113
cmp ebx, eax
jbe 0x30029d91
mov esi, 0x210
cmp ebx, esi
ja 0x30029e85
cmp ebx, esi
jne 0x30029e4a
xor edi, edi
cmp dword [ebp + 0x10], 0x201
je 0x30029e61
cmp dword [0x3017dbec], edi
jne 0x30029e6e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.30001312
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp ebx, 5
je 0x30029a40
mov eax, ebx
dec eax
jne 0x30001237
mov eax, dword [ebp + 8]
mov dword [0x3017d99c], eax
jmp 0x30001237
cmp ebx, 0x15
je 0x30029a94
cmp ebx, 0xc
jne 0x30001237
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push ebx
call fcn.30002187
jmp 0x30001237
cmp ebx, eax
je 0x30029d42
add eax, 0xffffffe0
cmp ebx, eax
jne 0x30001237
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp + 0x10]
cmp dword [0x3017dbf4], edi
push eax
push dword [ebp + 8]
je 0x300012f9
call dword [sym.imp.USER32.dll_DefWindowProcW]
cmp eax, edi
je 0x30029b4f
push edi
push dword [0x3017dd10]
cmp dword [0x3017dbf4], edi
push edi
push dword [ebp + 8]
mov eax, dword [0x3017d038]
push edi
push edi
push edi
push edi
push 0x56800000
push edi
push 0x3001e388
je 0x30001301
neg eax
sbb eax, eax
and eax, 0x200
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
xor eax, eax
cmp dword [0x3017cfd0], edi
setne al
jmp 0x30001246
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x300012aa
neg eax
sbb eax, eax
and eax, 0x200
push eax
call fcn.30019c54
jmp 0x300012e9
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsIconic]
xor edi, edi
cmp dword [0x3017cfd0], edi
mov dword [0x3017dca8], eax
je 0x30029a68
push edi
push dword [ebp + 0x14]
push 5
call fcn.30002187
jmp 0x30001246
cmp eax, edi
jne 0x30001237
cmp dword [ebp + 0x10], 2
je 0x30029a7f
cmp dword [ebp + 0x10], edi
jne 0x30001237
push dword [ebp + 8]
push 0x30f
push dword [ebp + 8]
call fcn.3016765a
jmp 0x30001237
push dword [0x3017d988]
call fcn.3014f79b
push dword [0x3017c7f8]
call fcn.3014f79b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
jmp 0x30029a5e
cmp ebx, esi
je 0x30029c9d
cmp ebx, 0x1c
jne 0x30001237
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExW]
xor edi, edi
cmp dword [0x3017da20], edi
je 0x30029b37
cmp dword [0x3017dbec], edi
je 0x30029b37
cmp dword [ebp + 0x10], edi
je 0x30029b37
cmp dword [0x3017e518], edi
jne 0x30029b37
cmp dword [0x3017dbf4], edi
jne 0x30029b56
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e494]
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [0x3017dbf4], edi
mov dword [0x3017e518], eax
jne 0x30029b6b
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e4e4]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x3017e75c], eax
xor ecx, ecx
cmp dword [ebp + 0x10], edi
mov eax, dword [0x3017da20]
setne cl
cmp eax, ecx
jne 0x30029b80
push edi
push eax
call fcn.300837f1
xor eax, eax
jmp 0x30001246
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e494]
push 2
call ebx
jmp 0x30029b0e
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e4e4]
push 0xffffffffffffffff
call ebx
jmp 0x30029b32
cmp dword [0x3017dbec], edi
jne 0x30029b98
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x1c
push dword [ebp + 8]
call fcn.30001312
cmp dword [ebp + 0x10], edi
je 0x30029c49
cmp dword [0x3017e518], edi
jne 0x30029bf1
cmp dword [0x3017dbf4], edi
jne 0x30029c1f
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e494]
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [0x3017dbf4], edi
mov dword [0x3017e518], eax
jne 0x30029c34
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e4e4]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x3017e75c], eax
mov dword [0x3017da20], 1
call fcn.30157e71
cmp dword [0x3017dbec], edi
jne 0x30029c77
cmp dword [0x3017cfd0], edi
jne 0x30029c8b
xor esi, esi
cmp dword [ebp + 0x10], edi
jne 0x30029c79
mov dword [0x3017da20], edi
jmp 0x30029c79
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e494]
push 2
call ebx
jmp 0x30029bc8
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e4e4]
push 0xffffffffffffffff
call ebx
jmp 0x30029bec
mov eax, dword [0x3017e518]
cmp eax, edi
je 0x30029c6f
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push eax
call esi
push dword [0x3017e75c]
call esi
mov dword [0x3017e518], edi
mov dword [0x3017e75c], edi
cmp dword [0x3017dbec], edi
je 0x30029bfb
xor esi, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.30083717
mov eax, esi
jmp 0x30001246
push edi
push dword [ebp + 0x10]
push 0x1c
call fcn.30002187
mov esi, eax
jmp 0x30029c12
xor edi, edi
cmp dword [0x3017dbec], edi
jne 0x30029cbc
cmp dword [0x3017da20], edi
jne 0x30029cde
push edi
push edi
push 0xc
call fcn.3007cec0
test eax, eax
je 0x30029cd6
push edi
push edi
push esi
call fcn.30002187
cmp eax, 4
jne 0x30029cd0
push eax
pop eax
jmp 0x30001246
mov dword [0x3017da20], edi
cmp dword [0x3017da20], edi
je 0x30029d0a
call fcn.30002d43
test eax, eax
jne 0x30029d0a
cmp dword [0x3017d178], edi
push 3
pop eax
je 0x30001246
movsx ecx, word [ebp + 0x14]
sub ecx, eax
je 0x30029d06
dec ecx
dec ecx
jne 0x30001246
push 1
jmp 0x30029cca
push dword [ebp + 0x14]
cmp dword [0x3017dbf4], edi
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
jne 0x30029d3a
call dword [sym.imp.USER32.dll_DefWindowProcA]
cmp ax, 1
jne 0x30001246
cmp word [ebp + 0x14], ax
jg 0x30001246
push 2
jmp 0x30029cca
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x30029d22
xor edi, edi
cmp dword [0x3017da20], edi
je 0x30001237
cmp dword [ebp + 0x10], 2
jne 0x30001237
cmp dword [0x3017d178], edi
je 0x30001237
cmp dword [0x3017dbf4], edi
push 0xfffffffffffffff0
push dword [ebp + 8]
jne 0x30029d89
call fcn.30028a30
shr eax, 0x10
test ah, 1
je 0x30001237
jmp 0x30029b4f
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x30029d78
cmp ebx, eax
je 0x30029aaa
cmp ebx, 0xa3
jne 0x30001237
xor edi, edi
cmp dword [0x301793b8], edi
je 0x30001237
cmp dword [0x3017dca8], edi
jne 0x30001237
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
call esi
add dword [ebp - 0x10], eax
mov eax, dword [0x3017cd08]
push 0x21
mov eax, dword [eax + 0x6c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
call esi
add eax, dword [0x3017e758]
push 0xf
add dword [ebp - 0xc], eax
call esi
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movzx ecx, ax
shr eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x30001237
push edi
mov eax, dword [0x3017d170]
push 0xf060
cmp dword [0x3017dbf4], edi
push 0x112
push dword [eax]
jne 0x30029e3f
call fcn.300144c5
jmp 0x30029b4f
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x30029b4f
mov eax, 0x121
cmp ebx, eax
jne 0x30001237
push 0
push 2
push eax
jmp 0x3000127a
push 1
push edi
call fcn.3014f4c3
jmp 0x3000122b
push edi
push dword [ebp + 0x10]
push esi
call fcn.30002187
test eax, eax
jne 0x30001237
jmp 0x30029b4f
cmp ebx, 0x305
je 0x30029aaa
cmp ebx, 0x307
je 0x30029aaa
cmp ebx, 0x30f
je 0x30029eca
cmp ebx, 0x311
je 0x30029eca
cmp ebx, 0x3ef
jbe 0x30001237
cmp ebx, 0x3f1
ja 0x30001237
jmp 0x30029aaa
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.3016765a
jmp 0x30001246