Function at 0x3001a160
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov dword [ebx + 4], eax
jmp 0x3001a20c
mov eax, dword [esi + 8]
jmp 0x30013d68
je 0x3005c383
cmp eax, 0x113
je 0x30013d70
cmp eax, 0x1ff
jle 0x3001a1fd
cmp eax, 0x203
jg 0x3005c365
mov eax, dword [esi + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 8], eax
jmp 0x3001a20c
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x3001a1ba
mov dword [ebp + 8], edi
jmp 0x3001a1be
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
and dword [ebx + 0x2c], 0
mov eax, dword [edx + 4]
cmp eax, 0x414
push esi
push edi
je 0x3005c17e
push 0xa9
push 0xa0
push eax
mov dword [ebx], eax
call fcn.30056058
test eax, eax
jne 0x3005c192
call fcn.3001a11e
mov esi, dword [ebp + 0xc]
xor edi, edi
inc edi
test eax, eax
jne 0x3001a1ba
mov eax, dword [ebp + 0x10]
and eax, 0x8001
cmp eax, edi
je 0x3001a150
and dword [ebp + 8], 0
mov eax, dword [ebx]
mov ecx, 0x10f
cmp eax, ecx
jle 0x3004818f
mov ecx, 0x206
cmp eax, ecx
jle 0x30013f11
mov ecx, eax
sub ecx, 0x207
je 0x3005c395
dec ecx
je 0x3005c377
dec ecx
je 0x3005c383
dec ecx
je 0x3004821f
cmp eax, dword [0x301e46a4]
je 0x3004821f
and dword [ebx], 0
mov esi, dword [ebp + 0xc]
push 7
lea edi, [ebx + 0xc]
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x30013d68
sub ecx, 3
je 0x3001a20c
sub ecx, 0xee
jne 0x3005c19d
cmp byte [0x301e4d0d], 0
je 0x300480f0
call fcn.30008131
push dword [0x301e4728]
call fcn.300080c9
cmp byte [0x301e4d0d], 0
je 0x300480f0
test byte [0x301e469e], 8
jne 0x3005c2a0
mov edi, dword [ebp + 0x10]
and edi, 1
jne 0x300481eb
mov eax, dword [esi + 8]
cmp eax, 3
je 0x30048120
cmp eax, 9
je 0x30048212
cmp eax, 0xf
jbe 0x30048134
cmp eax, 0x12
jbe 0x3005c338
cmp eax, 0x1b
jne 0x30048134
cmp dword [ebp - 4], 0
jne 0x3004812c
mov dword [ebx], 0x400
test edi, edi
jne 0x30048206
cmp dword [ebp + 8], 0
mov al, byte [esi + 8]
mov byte [ebx + 6], al
jne 0x30048dd1
and word [ebx + 4], 0
mov esi, dword [ebp + 0xc]
mov ax, word [esi + 0xe]
mov cl, byte [ebx + 7]
and ax, 0x4000
cmp ax, 0x4000
sete al
shl al, 7
and cl, 0x7f
or al, cl
mov byte [ebx + 7], al
movsx eax, word [esi + 0xc]
push 0x7f
push eax
call fcn.30055f82
mov cl, byte [ebx + 7]
xor cl, al
and cl, 0x7f
xor byte [ebx + 7], cl
test byte [esi + 0xf], 1
jne 0x3005c352
jmp 0x3001a20c
je 0x3005c1ca
add ecx, 0xfffffff3
cmp eax, ecx
jg 0x3005c1a9
je 0x3005c20c
mov ecx, eax
sub ecx, 0xf
jne 0x300480ac
push dword [esi]
call fcn.30056092
test eax, eax
je 0x30040c11
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x30013d68
cmp dword [0x301e4790], 0
je 0x300480fc
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x300480fc
and dword [0x301e46f4], 0xfffffffe
jmp 0x30048134
test edi, edi
je 0x30048134
jmp 0x3005c346
mov dword [ebx], 0x20a
jmp 0x30013f38
cmp byte [0x301e4d0d], 0
mov ecx, fcn.3001a2e7
je 0x3005c2f4
mov eax, dword [esi + 4]
push 1
add eax, 2
push eax
push eax
push dword [esi]
lea eax, [ebp - 0x20]
push eax
call ecx
test eax, eax
je 0x30048144
call dword [sym.imp.KERNEL32.dll_GetACP]
push 7
lea edi, [ebx + 0x28]
pop ecx
lea esi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
cmp byte [0x301e4d0d], 0
je 0x30048e7a
cmp eax, 0x3a4
je 0x3005c2ff
cmp eax, 0x3b5
je 0x3005c2ff
cmp eax, 0x3b6
je 0x3005c2ff
cmp eax, 0x3a8
je 0x3005c2ff
cmp eax, 0x2711
je 0x3005c2ff
cmp eax, 0x2713
je 0x3005c2ff
cmp eax, 0x2712
je 0x3005c2ff
cmp eax, 0x272f
je 0x3005c2ff
cmp eax, 0x2729
je 0x3005c2ff
mov esi, dword [ebp + 0xc]
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.30048cc7
mov word [ebx + 4], ax
jmp 0x3004814c
push 7
lea edi, [ebx + 0xc]
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 4]
mov dword [ebx], eax
jmp 0x3001a217
add dword [ebx], 0x160
jmp 0x3001a19f
dec ecx
je 0x3005c26c
jmp 0x3001a1fd
mov ecx, eax
sub ecx, 0x104
je 0x3005c27c
dec ecx
je 0x3005c266
dec ecx
je 0x3005c20c
sub ecx, 7
jne 0x3001a1fd
cmp byte [0x301e4d0d], 0
je 0x3001a1fd
cmp dword [0x301e4520], 0x7f
jne 0x3001a20c
call dword [sym.imp.MSO.DLL_Ordinal_497]
test eax, eax
jne 0x3001a20c
mov esi, dword [esi]
cmp esi, dword [0x301e47a0]
jne 0x3001a20c
push eax
push esi
call fcn.30126575
jmp 0x3001a20c
mov dword [ebx], 0x100
mov byte [ebx + 6], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
push dword [esi]
push dword [ebp + 0x10]
push dword [esi + 8]
call fcn.30048cc7
mov cl, byte [ebx + 7]
mov word [ebx + 4], ax
mov ax, word [esi + 0xe]
and ax, 0x4000
cmp ax, 0x4000
sete al
shl al, 7
and cl, 0x7f
or al, cl
mov byte [ebx + 7], al
movsx eax, word [esi + 0xc]
push 0x7f
push eax
call fcn.30055f82
mov cl, byte [ebx + 7]
xor cl, al
and cl, 0x7f
xor byte [ebx + 7], cl
jmp 0x3001a20c
mov dword [ebx], 0x101
mov al, byte [esi + 8]
and word [ebx + 4], 0
mov byte [ebx + 6], al
jmp 0x3001a20c
call fcn.3001a11e
test eax, eax
je 0x3005c292
call fcn.3010cfac
test eax, eax
je 0x3001a20c
mov dword [ebp - 4], edi
mov dword [ebx], 0x100
jmp 0x300480c1
movsx eax, word [esi + 0xe]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 2
push 1
push eax
call edi
push eax
call edi
cmp dword [esi + 8], 0xe5
jne 0x3005c2ce
cmp eax, 8
jne 0x3005c2ce
and dword [0x301ddd64], 0xfffffffb
jmp 0x300480f0
test eax, eax
jbe 0x300480f0
cmp eax, 0xd
je 0x300480f0
cmp eax, 9
je 0x300480f0
or dword [0x301ddd64], 4
jmp 0x300480f0
mov ecx, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x30048de3
mov esi, dword [ebp + 0xc]
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.30048cc7
mov word [ebx + 4], ax
cmp byte [0x301e4d0d], 0
je 0x3004814c
test byte [0x301e469e], 0x10
je 0x3004814c
movzx eax, ax
mov dword [ebx + 0x30], eax
jmp 0x3004814c
and dword [ebx], 0
mov al, byte [esi + 8]
mov byte [ebx + 6], al
jmp 0x3001a20c
and byte [0x301e46f5], 0xfb
jmp 0x30048134
cmp dword [esi + 8], 0xd
jne 0x3001a20c
mov byte [ebx + 6], 0x2b
jmp 0x3001a20c
cmp eax, 0x204
je 0x3005c395
cmp eax, 0x205
jne 0x3001a1fd
mov eax, dword [esi + 8]
add eax, eax
not eax
and eax, 2
jmp 0x3005c3b5
mov eax, dword [esi + 8]
and al, 1
neg al
sbb eax, eax
and al, 0xfd
add eax, 0x203
jmp 0x3005c3b8
cmp dword [esi + 4], 0xa4
jne 0x3005c3ae
call fcn.300afbe9
neg eax
sbb eax, eax
add eax, 0x201
jmp 0x3005c3b8
mov eax, dword [esi + 8]
not eax
and eax, edi
or ah, 2
mov dword [ebx], eax
jmp 0x30013f38