Function at 0x300d2435
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.3009320d
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
test ax, ax
setl al
push 0x11
mov byte [esi + 9], al
call edi
test ax, ax
jge 0x300d246a
push 0x12
call edi
test ax, ax
jl 0x300d246a
xor eax, eax
inc eax
jmp 0x300d246c
xor eax, eax
and dword [esi + 0x10], 0
push 0x90
mov byte [esi + 0xa], al
mov byte [esi + 8], 0
mov byte [esi + 0xb], 0
mov byte [esi + 0xc], 0
mov byte [esi + 0xd], 1
call edi
xor ebx, ebx
mov bx, ax
and ebx, 1
cmp byte [esp + 0x18], 0
je 0x300d26e2
mov ebp, dword [esp + 0x14]
push ebp
call edi
test ax, ax
push 0x10
setl al
pop ecx
cmp ebp, ecx
mov byte [esi + 0xc], al
jne 0x300d24c1
mov dword [esi], 0x65
push 0xa1
jmp 0x300d24d3
push 0x11
pop edx
cmp ebp, edx
jne 0x300d24ea
mov dword [esi], 0x66
push 0xa3
mov byte [esi + 8], 1
call edi
xor ecx, ecx
test ax, ax
setl cl
inc ecx
mov dword [esi + 0x10], ecx
jmp 0x300d26e8
test ebx, ebx
je 0x300d24fd
cmp ebp, 0x5f
jle 0x300d24fd
cmp ebp, 0x6a
jge 0x300d24fd
add ebp, 0xffffffd0
jmp 0x300d250a
cmp ebp, 0x69
jle 0x300d251c
cmp ebp, 0x70
jge 0x300d251c
add ebp, 0xffffffc0
mov byte [esi + 0xb], 1
mov dword [esi], ebp
mov dword [esi + 0x10], 3
jmp 0x300d26e8
cmp ebp, 0x6f
jle 0x300d2534
cmp ebp, 0x7f
jge 0x300d2534
add ebp, 0xffffffb9
mov byte [esi + 8], 1
mov dword [esi], ebp
jmp 0x300d26e8
cmp ebp, 0x24
jg 0x300d2616
je 0x300d2607
cmp ebp, 0x14
jg 0x300d25b6
je 0x300d25a7
push 8
mov eax, ebp
pop ecx
sub eax, ecx
je 0x300d2634
dec eax
je 0x300d2598
sub eax, 3
je 0x300d2589
dec eax
je 0x300d257a
sub eax, 6
jne 0x300d2696
mov byte [esi + 8], 1
mov dword [esi], 0x16
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0xd
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 7
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0x12
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0x17
jmp 0x300d26e8
mov eax, ebp
sub eax, 0x1b
je 0x300d25f8
sub eax, 5
je 0x300d25e9
dec eax
je 0x300d2634
dec eax
je 0x300d25de
dec eax
jne 0x300d2696
mov byte [esi + 8], 1
mov dword [esi], 4
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], edx
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0x20
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0x13
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 3
jmp 0x300d26e8
cmp ebp, 0x2e
jg 0x300d2681
je 0x300d2675
mov eax, ebp
sub eax, 0x25
je 0x300d2669
dec eax
je 0x300d265d
dec eax
je 0x300d264e
dec eax
je 0x300d263f
push 5
pop ecx
sub eax, ecx
jne 0x300d2696
mov byte [esi + 8], 1
mov dword [esi], ecx
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0xf
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 2
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0xe
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 1
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 6
jmp 0x300d26e8
mov eax, ebp
sub eax, 0x5b
je 0x300d26d6
dec eax
je 0x300d26ca
dec eax
je 0x300d26be
sub eax, 0x33
je 0x300d26b2
dec eax
je 0x300d26a6
push ebp
mov ecx, esi
call fcn.300d2389
movzx eax, al
mov dword [esi + 4], ebp
jmp 0x300d26e6
mov byte [esi + 8], 1
mov dword [esi], 0x19
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0x18
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0x3a
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0x39
jmp 0x300d26e8
mov byte [esi + 8], 1
mov dword [esi], 0x38
jmp 0x300d26e8
mov eax, dword [esp + 0x14]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8