Function at 0x430d75
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov dword [ebp - 0x214], ecx
mov dword [ebp - 8], 3
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x430fbb
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
sar ecx, 0xf
mov word [ebp - 4], cx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
sub ecx, 0x1b
mov dword [ebp - 0x218], ecx
cmp dword [ebp - 0x218], 0xd
ja case.0x430ddb.1
mov edx, dword [ebp - 0x218]
jmp dword [edx*4 + 0x431065]
mov dword [ebp - 8], 1
jmp 0x430fb6
movsx eax, word [ebp - 4]
test eax, eax
je 0x430e11
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x214]
call fcn.00430afe
mov dword [ebp - 8], 1
jmp 0x430e18
mov dword [ebp - 8], 2
jmp 0x430fb6
movsx eax, word [ebp - 4]
test eax, eax
je 0x430e40
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x214]
call fcn.00430990
mov dword [ebp - 8], 1
jmp 0x430e47
mov dword [ebp - 8], 2
jmp 0x430fb6
movsx eax, word [ebp - 4]
test eax, eax
je 0x430e68
mov ecx, dword [ebp - 0x214]
call fcn.0042e3a4
mov dword [ebp - 8], 1
jmp 0x430e6f
mov dword [ebp - 8], 2
jmp 0x430fb6
movsx ecx, word [ebp - 4]
test ecx, ecx
je 0x430e90
mov ecx, dword [ebp - 0x214]
call fcn.0042e3b7
mov dword [ebp - 8], 1
jmp 0x430e97
mov dword [ebp - 8], 2
jmp 0x430fb6
movsx edx, word [ebp - 4]
test edx, edx
je 0x430eca
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
sar eax, 0xf
test eax, eax
je 0x430eca
mov ecx, dword [ebp - 0x214]
call fcn.00430c80
mov dword [ebp - 8], 1
jmp 0x430ed1
mov dword [ebp - 8], 2
jmp 0x430fb6
movsx ecx, word [ebp - 4]
test ecx, ecx
je 0x430f04
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
sar edx, 0xf
test edx, edx
je 0x430f04
mov ecx, dword [ebp - 0x214]
call fcn.00430d0b
mov dword [ebp - 8], 1
jmp 0x430f0b
mov dword [ebp - 8], 2
jmp 0x430fb6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
mov edx, dword [eax]
cmp edx, dword [ecx + 0x20]
je 0x430fa6
push 0x104
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.Edit
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x430f9d
push str.ComboBox
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x430f9d
push str.Theme_Edit_Class
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x430f9d
push str.Theme_ComboBox_Class
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x430f9d
mov dword [ebp - 8], 3
jmp 0x430fa4
mov dword [ebp - 8], 2
jmp 0x430fad
mov dword [ebp - 8], 3
jmp 0x430fb6
mov dword [ebp - 8], 3
jmp 0x43105c
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0x101
jne 0x43105c
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
sar edx, 0xf
mov word [ebp - 4], dx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x21c], ecx
cmp dword [ebp - 0x21c], 0x25
je 0x430ffd
cmp dword [ebp - 0x21c], 0x27
je 0x431029
jmp 0x431055
movsx edx, word [ebp - 4]
test edx, edx
je 0x431020
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x214]
call fcn.00430afe
mov dword [ebp - 8], 1
jmp 0x431027
mov dword [ebp - 8], 2
jmp 0x43105c
movsx edx, word [ebp - 4]
test edx, edx
je 0x43104c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x214]
call fcn.00430990
mov dword [ebp - 8], 1
jmp 0x431053
mov dword [ebp - 8], 2
jmp 0x43105c
mov dword [ebp - 8], 3
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4