Function at 0x30266fbc
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov eax, 0x302779da
call fcn.302773fc
sub esp, 0x250
push edi
mov dword [ebp - 0x254], ecx
lea eax, [ebp - 0x10]
call fcn.30261904
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax], 0x101
je 0x30266ff9
mov eax, dword [ebp + 8]
cmp dword [eax], 0x105
jne 0x30267163
mov eax, dword [ebp - 0x254]
cmp dword [eax + 0x3c], 0
je 0x30267163
push 0
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 0xffff
movzx eax, ax
and eax, 0xff
movzx eax, al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 0xffff
movzx eax, ax
shr eax, 8
movzx eax, al
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x254]
call fcn.30266f91
test eax, eax
jne 0x30267145
push 6
push 0
lea eax, [ebp - 0x130]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp - 0x24]
push 0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
je 0x302670d9
cmp dword [ebp - 0x258], 1
je 0x302670ef
cmp dword [ebp - 0x258], 2
je 0x30267109
jmp 0x30267139
push dword [ebp - 0x1c]
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x254]
call fcn.30267423
jmp 0x30267139
push dword [ebp - 0x1c]
push dword [ebp - 0x130]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x254]
call fcn.30267423
jmp 0x30267139
push dword [ebp - 0x1c]
push dword [ebp - 0x130]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x254]
call fcn.30267423
push dword [ebp - 0x1c]
push dword [ebp - 0x12e]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x254]
call fcn.30267423
mov eax, dword [ebp - 0x254]
and dword [eax + 0x3c], 0
jmp 0x30267163
mov edi, dword [ebp - 0x18]
and edi, 0xffff
lea eax, [ebp - 0x10]
call fcn.3026dd64
mov eax, dword [ebp - 0x254]
mov dword [eax + 0x3c], 1
mov eax, dword [ebp + 8]
cmp dword [eax], 0x100
je 0x3026717d
mov eax, dword [ebp + 8]
cmp dword [eax], 0x104
jne 0x3026730e
mov eax, dword [ebp - 0x254]
cmp dword [eax + 0x3c], 0
jne 0x3026730e
push 0
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 0xffff
movzx eax, ax
and eax, 0xff
movzx eax, al
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 0xffff
movzx eax, ax
shr eax, 8
movzx eax, al
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
mov ecx, dword [ebp - 0x254]
call fcn.30266f91
test eax, eax
jne 0x302672ed
push 6
push 0
lea eax, [ebp - 0x250]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp - 0x140]
push 0
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0x13c]
push dword [ebp - 0x138]
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
je 0x30267275
cmp dword [ebp - 0x25c], 1
je 0x3026728e
cmp dword [ebp - 0x25c], 2
je 0x302672ab
jmp 0x302672e1
push dword [ebp - 0x138]
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x254]
call fcn.30267423
jmp 0x302672e1
push dword [ebp - 0x138]
push dword [ebp - 0x250]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x254]
call fcn.30267423
jmp 0x302672e1
push dword [ebp - 0x138]
push dword [ebp - 0x250]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x254]
call fcn.30267423
push dword [ebp - 0x138]
push dword [ebp - 0x24e]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x254]
call fcn.30267423
mov eax, dword [ebp - 0x254]
and dword [eax + 0x3c], 0
jmp 0x3026730e
mov edi, dword [ebp - 0x134]
and edi, 0xffff
lea eax, [ebp - 0x10]
call fcn.3026dd64
mov eax, dword [ebp - 0x254]
mov dword [eax + 0x3c], 1
and dword [ebp - 0x14], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
and eax, 0x8000
je 0x3026732d
mov eax, dword [ebp - 0x14]
or eax, 8
mov dword [ebp - 0x14], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
and eax, 0x8000
je 0x30267348
mov eax, dword [ebp - 0x14]
or eax, 4
mov dword [ebp - 0x14], eax
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
and eax, 0x8000
je 0x30267365
mov eax, dword [ebp - 0x14]
or eax, 0x10000000
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x254]
cmp dword [eax + 4], 0
je 0x30267389
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov eax, dword [ebp - 0x254]
mov eax, dword [eax + 4]
call fcn.30268667
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
call fcn.3026dc08
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
leave
ret 4