Function at 0x300fdb39
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x3001d1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x30209448]
push ebx
mov dword [ebp - 0x260], eax
mov eax, dword [0x3022c6f4]
xor ebx, ebx
push esi
mov dword [ebp - 0x25c], eax
mov eax, dword [0x3020a2bc]
push edi
mov dword [0x30209448], ebx
mov dword [0x3022c6f4], ebx
mov ecx, dword [eax]
push eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x210], ebx
call dword [ecx + 0x84]
mov ecx, dword [0x3020a2bc]
mov edx, dword [ecx]
or eax, 0x20
push eax
push ecx
call dword [edx + 0x80]
mov edi, 0x80df
call dword [sym.imp.MSO.dll_Ordinal_91]
test eax, eax
je 0x300fdbc7
mov eax, dword [0x3022c6ec]
cmp eax, ebx
je 0x300fdbc7
push ebx
push ebx
push ebx
push 2
push 3
call eax
cmp dword [0x3022c6f4], ebx
je 0x300fdd0f
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x258], ebx
mov dword [0x3022c6f4], ebx
jmp 0x300fdd2c
cmp dword [0x3022bb48], ebx
je 0x300fdc0a
cmp dword [0x3022b698], ebx
jne 0x300fe198
cmp dword [0x30229ed8], ebx
jne 0x300fdd0f
call dword [sym.imp.MSO.dll_Ordinal_497]
test eax, eax
je 0x300fdcce
call dword [sym.imp.MSO.dll_Ordinal_68]
test eax, eax
jne 0x300fdcce
cmp dword [ebp - 0x214], ebx
mov esi, dword [0x302ae87c]
mov edx, dword [0x302ae78c]
jne 0x300fdc50
cmp dword [0x302ae814], ebx
je 0x300fdc5c
cmp edx, ebx
jne 0x300fdc60
cmp dword [0x3022b6b0], ebx
jne 0x300fdcbe
jmp 0x300fdcce
cmp dword [0x302ae814], ebx
je 0x300fdc5c
cmp edx, ebx
je 0x300fdcce
cmp edx, ebx
je 0x300fdc89
lea eax, [esi + 0x2ac]
cmp dword [eax], ebx
je 0x300fdc89
mov eax, dword [eax]
cmp dword [eax + 0x58], ebx
je 0x300fdc89
mov ecx, dword [0x302ae848]
cmp dword [eax + 0x7c], ecx
je 0x300fdc89
mov eax, dword [0x302ae8b8]
cmp eax, ebx
je 0x300fdcce
cmp eax, ecx
jne 0x300fdcce
cmp dword [ebp - 0x214], ebx
je 0x300fdcbe
test word [esi + 0x2b4], 0x1e0
je 0x300fdcbe
cmp edx, ebx
jne 0x300fdcbe
push 4
call dword [sym.imp.MSO.dll_Ordinal_497]
push eax
call dword [sym.imp.MSO.dll_Ordinal_114]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
cmp eax, dword [0x302ae694]
jne 0x300fdcce
xor eax, eax
inc eax
push eax
mov dword [ebp - 0x214], eax
call dword [sym.imp.MSO.dll_Ordinal_67]
push 3
push ebx
call fcn.30101689
test eax, eax
je 0x300fdce6
push ebx
push ebx
push ebx
push 1
push 0x11
call fcn.300cebca
cmp dword [0x3022b714], ebx
jne 0x300fdcf6
push ebx
push 2
call fcn.3005c0c6
cmp dword [0x3022b694], ebx
lea eax, [ebp - 0x258]
jne 0x300fdd26
push edi
push eax
call fcn.30060f6e
test eax, eax
jne 0x300fdd2c
push edi
lea eax, [ebp - 0x258]
push eax
call fcn.30060f68
test eax, eax
je 0x300fdbea
jmp 0x300fdd2c
push eax
call fcn.300fcf1f
lea eax, [ebp - 0x24c]
push eax
push dword [0x3020a2b8]
call dword [sym.imp.MSO.dll_Ordinal_800]
lea eax, [ebp - 0x24c]
push eax
call fcn.300e721e
test eax, eax
jne 0x300fe177
cmp dword [ebp - 0x248], 0x102
jne 0x300fdd6b
cmp dword [ebp - 0x22c], ebx
je 0x300fdeeb
call fcn.300605ef
mov esi, pe_nt_image_headers32
cmp dword [ebp - 0x258], esi
mov dword [0x3022a244], eax
jne 0x300fde59
mov eax, dword [ebp - 0x248]
sub eax, esi
je 0x300fddc3
sub eax, 4
jne 0x300fde10
cmp dword [ebp - 0x244], 0x75
jne 0x300fddc3
cmp dword [0x302ae8fc], ebx
je 0x300fddc3
push 0x20
push 0xf100
push 0x112
push dword [0x302ae694]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x300fe177
cmp byte [ebp - 0x252], 0xd
jne 0x300fddf8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x300fddf8
and byte [ebp - 0x1f7], 0x7f
and byte [ebp - 0x1f8], 0x7f
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [ebp - 0x252], 0x2b
jne 0x300fde08
mov byte [ebp - 0x252], 0xd
cmp dword [ebp - 0x258], esi
jne 0x300fde59
cmp byte [ebp - 0x252], 0x70
jne 0x300fde26
call fcn.30060712
test eax, eax
jne 0x300fe18b
xor esi, esi
inc esi
cmp dword [ebp - 0x20c], esi
jne 0x300fde3b
mov dword [ebp - 0x20c], 2
push dword [ebp - 0x252]
call fcn.300fcf56
test eax, eax
je 0x300fde59
cmp word [ebp - 0x254], bx
jne 0x300fde59
mov dword [ebp - 0x20c], esi
cmp dword [ebp - 0x258], 0x101
jne 0x300fde72
test byte [0x302ad06c], 0x20
jne 0x300fe18b
xor esi, esi
inc esi
cmp dword [0x3022bb48], esi
jne 0x300fdeeb
cmp dword [0x3022b698], ebx
jne 0x300fe198
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x210], ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x300fdeeb
mov dl, byte [ebp - 0xf6]
mov cl, byte [ebp - 0xf7]
mov al, byte [ebp - 0xf8]
mov byte [ebp - 6], dl
or dl, cl
or dl, al
test dl, dl
mov byte [ebp - 8], al
mov byte [ebp - 7], cl
jns 0x300fdeeb
and byte [ebp - 0xf8], 0x7f
and byte [ebp - 0xf7], 0x7f
and byte [ebp - 0xf6], 0x7f
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [0x3022a248]
cmp ecx, ebx
mov eax, dword [0x302ae81c]
je 0x300fdf03
cmp eax, dword [ecx + 0x40]
jne 0x300fdf03
xor edi, edi
jmp 0x300fdf05
mov edi, eax
mov esi, pe_nt_image_headers32
cmp dword [ebp - 0x258], esi
jne 0x300fdf24
call dword [sym.imp.MSO.dll_Ordinal_50]
push eax
call dword [sym.imp.MSO.dll_Ordinal_95]
cmp eax, 7
je 0x300fdf5a
cmp dword [0x3022bb48], 1
je 0x300fdf5a
test byte [0x302ad06c], 8
jne 0x300fdf5a
cmp dword [ebp - 0x258], 0x201
jne 0x300fdf4a
cmp dword [0x302ae6a4], ebx
jne 0x300fdf5a
cmp dword [ebp - 0x258], esi
jne 0x300fdf82
cmp dword [ebp - 0x20c], ebx
je 0x300fdf82
cmp byte [ebp - 0x252], 9
je 0x300fdf75
cmp byte [ebp - 0x252], 0xd
je 0x300fdf75
cmp byte [ebp - 0x252], 0x1b
jmp 0x300fdf7c
test byte [0x302ad06c], 8
je 0x300fdf82
xor esi, esi
jmp 0x300fdf91
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.MSO.dll_Ordinal_9]
mov esi, eax
cmp edi, ebx
je 0x300fdf98
push edi
jmp 0x300fdfa4
mov eax, dword [0x3022a248]
cmp eax, ebx
je 0x300fdfa9
push dword [eax + 0x40]
call fcn.3005131c
cmp dword [0x3022bb48], 1
jne 0x300fdfe2
cmp dword [ebp - 0x210], ebx
je 0x300fdfe2
mov al, byte [ebp - 8]
mov byte [ebp - 0xf8], al
mov al, byte [ebp - 7]
mov byte [ebp - 0xf7], al
mov al, byte [ebp - 6]
mov byte [ebp - 0xf6], al
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov eax, esi
sub eax, ebx
jne 0x300fe0af
cmp dword [0x30209448], ebx
jne 0x300fe177
mov eax, dword [ebp - 0x258]
sub eax, ebx
je 0x300fe141
sub eax, 0x100
je 0x300fe02b
sub eax, 0x101
je 0x300fe0c4
dec eax
dec eax
je 0x300fe0c4
sub eax, 0x1fd
jne 0x300fe16b
cmp byte [ebp - 0x252], 0x70
jne 0x300fe041
test byte [0x3022a244], 4
je 0x300fe129
push 2
push dword [0x3022a244]
lea eax, [ebp - 0x258]
push eax
call fcn.300fb69e
cmp eax, 0xffffffff
jne 0x300fe18b
push 7
pop ecx
lea eax, [ebp - 0x258]
lea esi, [ebp - 0x230]
lea edi, [ebp - 0x28c]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x22c], ebx
call fcn.3005b3ac
cmp dword [ebp - 0x288], ebx
je 0x300fe177
push 7
pop ecx
lea esi, [ebp - 0x28c]
lea edi, [ebp - 0x24c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x258], ebx
jmp 0x300fdeeb
dec eax
dec eax
jne 0x300fe177
push 2
call dword [sym.imp.MSO.dll_Ordinal_38]
jmp 0x300fe177
cmp dword [0x302ae6a4], ebx
je 0x300fe16b
call dword [sym.imp.MSO.dll_Ordinal_497]
push eax
call dword [sym.imp.MSO.dll_Ordinal_114]
mov esi, eax
cmp esi, ebx
je 0x300fe10b
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x270]
push eax
push esi
call edi
lea eax, [ebp - 0x268]
push eax
push esi
call edi
cmp dword [0x3022b68c], ebx
jne 0x300fe16b
lea eax, [ebp - 0x258]
push eax
call fcn.3005b3ac
cmp dword [0x3022b68c], ebx
je 0x300fe177
jmp 0x300fe16b
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.MSO.dll_Ordinal_9]
test eax, eax
jne 0x300fe18b
call fcn.300f1ff8
jmp 0x300fe18b
cmp dword [ebp - 0x248], 0x112
jne 0x300fe16b
cmp dword [ebp - 0x244], 0xf120
jne 0x300fe16b
call dword [sym.imp.MSO.dll_Ordinal_68]
test eax, eax
jne 0x300fe16b
push 1
call dword [sym.imp.MSO.dll_Ordinal_67]
lea eax, [ebp - 0x258]
push eax
call fcn.3005b3ac
call fcn.300a20c5
cmp dword [ebp - 0x20c], 2
jne 0x300fe18b
mov dword [ebp - 0x20c], ebx
cmp dword [0x30209448], ebx
jne 0x300fe1b5
jmp 0x300fdba6
push ebx
push 2
call fcn.300fcf0b
push 2
call dword [sym.imp.MSO.dll_Ordinal_38]
xor eax, eax
inc eax
mov dword [0x30209448], eax
mov dword [0x3022c6f4], eax
mov eax, dword [0x3020a2bc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x84]
mov ecx, dword [0x3020a2bc]
mov edx, dword [ecx]
and eax, 0xffffffdf
push eax
push ecx
call dword [edx + 0x80]
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x30209448], eax
mov eax, dword [ebp - 0x25c]
pop esi
xor ecx, ebp
mov dword [0x30209e30], 1
mov dword [0x3022c6f4], eax
pop ebx
call fcn.3020156b
leave
ret