Function at 0x3011d9f5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xd0
mov eax, dword [0x301e4ae8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp + 0x60], eax
lea eax, [ebp - 0x58]
push edi
push eax
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x74], edi
mov dword [ebp + 0x70], edi
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x68], edi
mov dword [0x301e4ae8], eax
call sub.MSVCRT.dll__setjmp3
test eax, eax
pop ecx
pop ecx
je 0x3011da7f
cmp dword [ebp + 0x70], edi
mov eax, dword [ebp + 0x60]
mov esi, dword [sym.imp.MSO.DLL_Ordinal_957]
mov dword [0x301e4ae8], eax
je 0x3011da4e
push 0x100
push dword [ebp + 0x70]
call esi
cmp dword [ebp + 0x68], edi
je 0x3011da5d
push 0x103
push dword [ebp + 0x68]
call esi
push edi
push 2
call fcn.3011c9fe
push 2
call dword [sym.imp.MSO.DLL_Ordinal_38]
xor eax, eax
inc eax
mov dword [0x301e5768], eax
mov dword [0x301e6cac], eax
jmp 0x3011e09d
mov esi, 0x1020
push esi
push 0x100
call fcn.300563f8
push esi
push 0x103
mov dword [ebp + 0x70], eax
call fcn.300563f8
mov ebx, eax
mov eax, dword [ebp + 0x60]
mov dword [0x301e4ae8], eax
mov eax, dword [0x301e5768]
mov dword [ebp + 0x14], eax
mov eax, dword [0x301e6cac]
mov dword [ebp + 0x18], eax
mov eax, dword [0x301e4b58]
mov dword [0x301e5768], edi
mov dword [0x301e6cac], edi
mov ecx, dword [eax]
push eax
mov dword [ebp + 0x68], ebx
call dword [ecx + 0x84]
mov ecx, dword [0x301e4b58]
mov edx, dword [ecx]
or al, 0x20
push eax
push ecx
call dword [edx + 0x80]
call dword [sym.imp.MSO.DLL_Ordinal_91]
xor edi, edi
test eax, eax
je 0x3011db04
mov eax, dword [0x301e6ca4]
cmp eax, edi
je 0x3011db04
push edi
push edi
push edi
push 2
push 3
call eax
cmp dword [0x301e6cac], edi
je 0x3011db1d
mov dword [ebp + 0x2c], edi
mov dword [ebp + 0x1c], edi
mov dword [0x301e6cac], edi
jmp 0x3011dc63
mov esi, 0x80df
jmp 0x3011dc49
cmp dword [0x301e46ec], edi
je 0x3011db47
cmp dword [0x301e515c], edi
jne 0x3011dd74
cmp dword [0x301e7790], edi
jne 0x3011dc49
call dword [sym.imp.MSO.DLL_Ordinal_497]
test eax, eax
je 0x3011dc06
call dword [sym.imp.MSO.DLL_Ordinal_68]
test eax, eax
jne 0x3011dc06
cmp dword [ebp + 0x6c], edi
mov edx, dword [0x301e4aec]
mov eax, dword [0x301e36d8]
jne 0x3011db88
cmp eax, edi
je 0x3011db90
cmp edx, edi
jne 0x3011db92
cmp dword [0x301df2e8], edi
jne 0x3011db90
cmp dword [ebp + 0x6c], edi
je 0x3011dc06
cmp eax, edi
je 0x3011db90
cmp edx, edi
je 0x3011dc06
cmp edx, edi
mov esi, dword [0x301e4bd0]
je 0x3011dbc7
mov eax, dword [esi + 0x2b8]
cmp eax, edi
je 0x3011dbc7
cmp dword [eax + 0xbe], edi
je 0x3011dbc7
mov ecx, dword [0x301e43bc]
cmp dword [eax + 0xda], ecx
je 0x3011dbc7
mov eax, dword [0x301e4450]
cmp eax, edi
je 0x3011dc06
cmp eax, ecx
jne 0x3011dc06
cmp dword [ebp + 0x6c], edi
je 0x3011dbf9
test word [esi + 0x2c0], 0x1e0
je 0x3011dbf9
cmp edx, edi
jne 0x3011dbf9
push 4
call dword [sym.imp.MSO.DLL_Ordinal_497]
push eax
call dword [sym.imp.MSO.DLL_Ordinal_114]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
cmp eax, dword [0x301e47a0]
jne 0x3011dc06
xor eax, eax
inc eax
push eax
mov dword [ebp + 0x6c], eax
call dword [sym.imp.MSO.DLL_Ordinal_67]
push 3
push edi
call fcn.30120981
test eax, eax
je 0x3011dc1e
push edi
push edi
push edi
push 1
push 0x11
call fcn.300f6a15
cmp dword [0x301e451c], edi
jne 0x3011dc2e
push edi
push 2
call fcn.30019e1d
cmp dword [0x301e5158], edi
lea eax, [ebp + 0x1c]
jne 0x3011dc5d
mov esi, 0x80df
push esi
push eax
call fcn.300afbfc
test eax, eax
jne 0x3011dc63
lea eax, [ebp + 0x1c]
push esi
push eax
call fcn.3001a21e
test eax, eax
je 0x3011db27
jmp 0x3011dc63
push eax
call fcn.3011ca60
lea eax, [ebp + 0x28]
push eax
push dword [0x301e4b08]
call dword [sym.imp.MSO.DLL_Ordinal_800]
lea eax, [ebp + 0x28]
push eax
call fcn.3001a135
test eax, eax
jne 0x3011e025
cmp dword [ebp + 0x2c], 0x102
jne 0x3011dc96
cmp dword [ebp + 0x48], eax
je 0x3011dde9
call fcn.30049bfb
mov edi, 0x100
cmp dword [ebp + 0x1c], edi
mov dword [0x301e36e8], eax
jne 0x3011dd4c
mov eax, dword [ebp + 0x2c]
sub eax, edi
je 0x3011dce6
sub eax, 4
jne 0x3011dd0f
cmp dword [ebp + 0x30], 0x75
jne 0x3011dce6
cmp dword [0x301e68e0], 0
je 0x3011dce6
push 0x20
push 0xf100
push 0x112
push dword [0x301e47a0]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x3011e025
cmp byte [ebp + 0x22], 0xd
jne 0x3011dd05
mov esi, dword [ebp + 0x70]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
and byte [esi + 0x11], 0x7f
and byte [esi + 0x10], 0x7f
push esi
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [ebp + 0x22], 0x2b
jne 0x3011dd0f
mov byte [ebp + 0x22], 0xd
cmp dword [ebp + 0x1c], edi
jne 0x3011dd4c
cmp byte [ebp + 0x22], 0x70
jne 0x3011dd27
call fcn.300afbe9
test eax, eax
jne 0x3011e034
xor esi, esi
inc esi
cmp dword [ebp + 0x74], esi
jne 0x3011dd36
mov dword [ebp + 0x74], 2
push dword [ebp + 0x22]
call fcn.3011ca94
test eax, eax
je 0x3011dd4c
cmp word [ebp + 0x20], 0
jne 0x3011dd4c
mov dword [ebp + 0x74], esi
cmp dword [ebp + 0x1c], 0x101
jne 0x3011dd62
test byte [0x301e4940], 0x20
jne 0x3011e034
cmp dword [0x301e46ec], 1
jne 0x3011dde9
cmp dword [0x301e515c], 0
je 0x3011dd97
push 0
push 2
call fcn.3011c9fe
push 2
call dword [sym.imp.MSO.DLL_Ordinal_38]
xor eax, eax
inc eax
mov dword [0x301e5768], eax
mov dword [0x301e6cac], eax
jmp 0x3011e034
and dword [ebp + 0x64], 0
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov cl, byte [ebx + 0x10]
lea eax, [ebx + 0x100]
mov byte [eax], cl
mov cl, byte [ebx + 0x11]
lea esi, [ebx + 0x101]
mov byte [esi], cl
mov cl, byte [ebx + 0x12]
mov byte [ebx + 0x102], cl
test byte [eax], 0x80
jne 0x3011ddcf
test byte [esi], 0x80
jne 0x3011ddcf
test cl, cl
jns 0x3011dde9
and byte [ebx + 0x10], 0x7f
and byte [ebx + 0x11], 0x7f
and byte [ebx + 0x12], 0x7f
push ebx
mov dword [ebp + 0x64], 1
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [0x301e4914]
test ecx, ecx
mov eax, dword [0x301e4968]
je 0x3011de01
cmp eax, dword [ecx + 0x40]
jne 0x3011de01
xor edi, edi
jmp 0x3011de03
mov edi, eax
mov esi, 0x100
cmp dword [ebp + 0x1c], esi
jne 0x3011de1f
call dword [sym.imp.MSO.DLL_Ordinal_50]
push eax
call dword [sym.imp.MSO.DLL_Ordinal_95]
cmp eax, 7
je 0x3011de4e
cmp dword [0x301e46ec], 1
je 0x3011de4e
test byte [0x301e4940], 8
jne 0x3011de4e
cmp dword [ebp + 0x1c], 0x201
jne 0x3011de43
cmp dword [0x301df308], 0
jne 0x3011de4e
cmp dword [ebp + 0x1c], esi
jne 0x3011de6d
cmp dword [ebp + 0x74], 0
je 0x3011de6d
cmp byte [ebp + 0x22], 9
je 0x3011de60
cmp byte [ebp + 0x22], 0xd
je 0x3011de60
cmp byte [ebp + 0x22], 0x1b
jmp 0x3011de67
test byte [0x301e4940], 8
je 0x3011de6d
xor esi, esi
jmp 0x3011de79
lea eax, [ebp + 0x28]
push eax
call dword [sym.imp.MSO.DLL_Ordinal_9]
mov esi, eax
test edi, edi
je 0x3011de80
push edi
jmp 0x3011de8c
mov eax, dword [0x301e4914]
test eax, eax
je 0x3011de91
push dword [eax + 0x40]
call fcn.30056487
cmp dword [0x301e46ec], 1
jne 0x3011dec2
cmp dword [ebp + 0x64], 0
je 0x3011dec2
mov al, byte [ebx + 0x100]
mov byte [ebx + 0x10], al
mov al, byte [ebx + 0x101]
mov byte [ebx + 0x11], al
mov al, byte [ebx + 0x102]
push ebx
mov byte [ebx + 0x12], al
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov eax, esi
sub eax, 0
jne 0x3011df72
cmp dword [0x301e5768], 0
jne 0x3011e025
mov eax, dword [ebp + 0x1c]
sub eax, 0
je 0x3011dff8
sub eax, 0x100
je 0x3011df0b
sub eax, 0x101
je 0x3011df87
dec eax
dec eax
je 0x3011df87
sub eax, 0x1fd
jne 0x3011e01c
cmp byte [ebp + 0x22], 0x70
jne 0x3011df1e
test byte [0x301e36e8], 4
je 0x3011dfe3
push 2
push dword [0x301e36e8]
lea eax, [ebp + 0x1c]
push eax
call fcn.30049d07
cmp eax, 0xffffffff
jne 0x3011e034
push 7
pop ecx
lea eax, [ebp + 0x1c]
lea esi, [ebp + 0x44]
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
and dword [ebp + 0x48], 0
push eax
call fcn.3001a0b0
cmp dword [ebp - 0x14], 0
je 0x3011e025
push 7
pop ecx
lea esi, [ebp - 0x18]
lea edi, [ebp + 0x28]
rep movsd dword es:[edi], dword [esi]
and dword [ebp + 0x48], 0
and dword [ebp + 0x1c], 0
jmp 0x3011dde9
dec eax
dec eax
jne 0x3011e025
push 2
call dword [sym.imp.MSO.DLL_Ordinal_38]
jmp 0x3011e025
cmp dword [0x301df308], 0
je 0x3011e01c
call dword [sym.imp.MSO.DLL_Ordinal_497]
push eax
call dword [sym.imp.MSO.DLL_Ordinal_114]
mov esi, eax
test esi, esi
je 0x3011dfc6
lea eax, [ebp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp + 4]
push eax
push esi
call edi
lea eax, [ebp + 0xc]
push eax
push esi
call edi
cmp dword [0x301e5154], 0
jne 0x3011e01c
lea eax, [ebp + 0x1c]
push eax
call fcn.3001a0b0
cmp dword [0x301e5154], 0
je 0x3011e025
jmp 0x3011e01c
lea eax, [ebp + 0x28]
push eax
call dword [sym.imp.MSO.DLL_Ordinal_9]
test eax, eax
jne 0x3011e034
call fcn.30114618
jmp 0x3011e034
cmp dword [ebp + 0x2c], 0x112
jne 0x3011e01c
cmp dword [ebp + 0x30], 0xf120
jne 0x3011e01c
call dword [sym.imp.MSO.DLL_Ordinal_68]
test eax, eax
jne 0x3011e01c
push 1
call dword [sym.imp.MSO.DLL_Ordinal_67]
lea eax, [ebp + 0x1c]
push eax
call fcn.3001a0b0
call fcn.30019fd3
cmp dword [ebp + 0x74], 2
jne 0x3011e034
and dword [ebp + 0x74], 0
cmp dword [0x301e5768], 0
je 0x3011dae6
mov eax, dword [0x301e4b58]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x84]
mov ecx, dword [0x301e4b58]
mov edx, dword [ecx]
and al, 0xdf
push eax
push ecx
call dword [edx + 0x80]
cmp dword [ebp + 0x70], 0
mov eax, dword [ebp + 0x14]
mov esi, dword [sym.imp.MSO.DLL_Ordinal_957]
mov dword [0x301e5768], eax
mov eax, dword [ebp + 0x18]
mov dword [0x301e46f0], 1
mov dword [0x301e6cac], eax
je 0x3011e091
push 0x100
push dword [ebp + 0x70]
call esi
test ebx, ebx
je 0x3011e09d
push 0x103
push ebx
call esi
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret