Function at 0x3006013c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x302ae884], edi
jne 0x300601e7
call fcn.3013fae5
test eax, eax
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, fcn.3007faae
jne 0x30060171
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
je 0x300601b2
cmp byte [0x30225c9d], 0
mov eax, ebx
jne 0x3006017e
mov eax, esi
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x1c]
push ecx
call eax
test eax, eax
je 0x300601b2
call fcn.3013fae5
test eax, eax
je 0x300601a5
cmp dword [ebp - 0x18], 0x400
jne 0x300601b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x14]
add eax, 0xfffffe00
cmp eax, 0xd
jbe 0x3006019e
cmp byte [0x30225c9d], 0
je 0x300601bd
mov esi, ebx
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x3006019e
cmp byte [0x30225c9d], 0
mov eax, 0x3007fbac
jne 0x300601df
mov eax, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x1c]
push ecx
call eax
jmp 0x3006019e
mov eax, dword [0x3022bb48]
cmp eax, edi
je 0x300601f5
cmp eax, 1
je 0x3006019e
test byte [0x302ae770], 1
je 0x30060203
xor eax, eax
inc eax
jmp 0x300601a0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 3
call esi
movzx ebx, ax
push 0x1b
and ebx, 1
call esi
movzx edi, ax
push 9
and edi, 1
call esi
test al, 1
je 0x3006022f
or dword [0x302ae770], 0x400
test ebx, ebx
je 0x30060241
xor eax, eax
inc eax
or dword [0x302ae770], eax
jmp 0x300601a0
test edi, edi
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
jne 0x30060414
mov edi, 0x112
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x30060264
mov eax, ebx
push 0
push 0x108
mov esi, pe_nt_image_headers32
push esi
push 0
lea ecx, [ebp - 0x1c]
push ecx
call eax
test eax, eax
je 0x3006039e
mov eax, dword [ebp - 0x18]
and eax, 0xfffffffb
sub eax, esi
je 0x3006032c
dec eax
jne 0x3006039e
cmp dword [ebp - 0x14], 0x1b
jne 0x30060306
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x30060306
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x300602b9
mov eax, ebx
xor esi, esi
push esi
push edi
push edi
push esi
lea ecx, [ebp - 0x1c]
push ecx
call eax
test eax, eax
je 0x30060306
cmp dword [ebp - 0x14], 0xf130
jne 0x30060306
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x300602e2
mov eax, ebx
push 1
push edi
push edi
push esi
lea ecx, [ebp - 0x1c]
push ecx
call eax
cmp byte [0x30225c9d], 0
mov eax, 0x3007fbac
jne 0x30060300
mov eax, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x1c]
push ecx
call eax
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x30060316
mov eax, ebx
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call eax
jmp 0x30060254
mov eax, dword [ebp - 0x14]
cmp eax, 9
je 0x3006038d
cmp eax, 0xf
jbe 0x3006039e
cmp eax, 0x11
jbe 0x30060306
cmp eax, 0x12
jne 0x3006039e
test word [0x302ae770], 0x400
je 0x3006039e
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x3006035e
mov eax, ebx
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call eax
cmp byte [0x30225c9d], 0
mov eax, 0x3007fbac
jne 0x30060382
mov eax, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x1c]
push ecx
call eax
jmp 0x30060254
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x300604f8
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x3006019e
mov edi, 0x200
mov esi, fcn.3007faae
cmp byte [0x30225c9d], 0
mov eax, esi
jne 0x300603c3
mov eax, ebx
push 0
push 0x20d
push edi
push 0
lea ecx, [ebp - 0x1c]
push ecx
call eax
test eax, eax
je 0x3006019e
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x300603f4
dec eax
dec eax
je 0x300603f4
sub eax, 3
je 0x300603f4
sub eax, 3
jne 0x3006019e
cmp byte [0x30225c9d], 0
mov eax, esi
jne 0x30060401
mov eax, ebx
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call eax
jmp 0x300603b6
cmp dword [0x3022bb48], 0
jne 0x3006039e
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0x112
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x30060438
mov eax, ebx
push 0
push 0x108
push pe_nt_image_headers32
push 0
lea ecx, [ebp - 0x1c]
push ecx
call eax
test eax, eax
je 0x3006039e
mov eax, dword [ebp - 0x18]
and eax, 0xfffffffb
cmp eax, 0x101
jne 0x300604c9
cmp dword [ebp - 0x14], 0x1b
jne 0x300604c9
push 0x11
call esi
test ax, ax
jge 0x300604c9
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x30060480
mov eax, ebx
xor ebx, ebx
push ebx
push edi
push edi
push ebx
lea ecx, [ebp - 0x38]
push ecx
call eax
test eax, eax
je 0x3006049d
cmp dword [ebp - 0x30], 0xf130
je 0x30060559
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x300604b3
mov eax, ebx
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call eax
jmp 0x30060428
mov eax, dword [ebp - 0x18]
and eax, 0xfffffffb
cmp eax, 0x100
jne 0x300604a3
cmp dword [ebp - 0x14], 9
je 0x3006054b
cmp dword [ebp - 0x14], 0x1b
jne 0x300604a3
push 0x11
call esi
test ax, ax
jl 0x300604f8
push 0x12
call esi
test ax, ax
jge 0x30060233
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x30060508
mov eax, ebx
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call eax
test eax, eax
je 0x3006019e
mov eax, dword [ebp - 0x18]
and eax, 0xfffffffb
cmp eax, 0x100
jne 0x300601cc
cmp dword [ebp - 0x14], 9
jne 0x300601cc
and dword [0x302ae770], 0xfffffbff
jmp 0x300601cc
push 0x12
call esi
test ax, ax
jl 0x300604f8
jmp 0x300604a3
cmp byte [0x30225c9d], 0
mov eax, fcn.3007faae
jne 0x3006056c
mov eax, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push edi
push edi
push ebx
lea ecx, [ebp - 0x38]
push ecx
call eax
cmp byte [0x30225c9d], 0
mov eax, 0x3007fbac
jne 0x3006058a
mov eax, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x38]
jmp 0x300601e2