Function at 0x30002c70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebx + 0x2c], edi
mov eax, dword [edx + 4]
cmp eax, 0x414
mov dword [ebp - 4], edi
je 0x3002d0ac
push 0xa9
push 0xa0
mov dword [ebx], eax
push eax
call fcn.30002d2a
test eax, eax
jne 0x3002d0c0
call fcn.30002d43
test eax, eax
jne 0x3002d0d7
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
and eax, 0x8001
cmp eax, 1
je 0x30002d0f
mov dword [ebp + 8], edi
mov eax, dword [ebx]
cmp eax, 0x12
jle 0x30002d1f
mov ecx, 0x113
cmp eax, ecx
jle 0x3002d11a
lea ecx, [eax - 0x200]
cmp ecx, 0xa
jbe switch.0x3002d336
cmp eax, dword [0x3017d188]
je case.0x3002d336.522
mov dword [ebx], edi
push 7
pop ecx
lea edi, [ebx + 0xc]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret 0xc
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x30002ccc
jmp 0x3002d0cb
cmp eax, 0x12
jne 0x3002d0e2
jmp 0x30002d00
push 7
pop ecx
lea edi, [ebx + 0xc]
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 4]
mov dword [ebx], eax
jmp 0x30002d08
add dword [ebx], 0x160
jmp 0x30002caf
mov dword [ebp + 8], 1
jmp 0x30002ccf
mov esi, dword [ebp + 0xc]
mov dword [ebp + 8], edi
jmp 0x30002ccf
cmp eax, 0xf
jne case.default.0x3002d336
push dword [esi]
call fcn.30001b47
test eax, eax
je 0x3002d116
cmp dword [0x3017dbf4], edi
push edi
push dword [esi]
jne 0x3002d10e
call fcn.30028a30
mov dword [ebx + 4], eax
jmp 0x30002d00
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x3002d106
xor eax, eax
jmp 0x3002d106
cmp eax, ecx
je 0x3002d32e
mov ecx, eax
mov edi, 0x100
sub ecx, edi
je 0x3002d178
dec ecx
je 0x3002d152
dec ecx
je 0x3002d274
dec ecx
dec ecx
je 0x3002d162
dec ecx
je 0x3002d14c
dec ecx
je 0x3002d274
xor edi, edi
jmp case.default.0x3002d336
mov dword [ebx], 0x101
mov al, byte [esi + 8]
and word [ebx + 4], 0
mov byte [ebx + 6], al
jmp 0x30002d00
call fcn.30002d43
test eax, eax
jne 0x30002d00
mov dword [ebp - 4], 1
mov dword [ebx], edi
mov eax, dword [ebp + 0x10]
and eax, 1
mov dword [ebp + 0x10], eax
je 0x3002d195
cmp dword [0x3017da20], 0
je 0x3002d195
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov eax, dword [esi + 8]
cmp eax, 3
je 0x3002d2ea
cmp eax, 9
je 0x3002d2d4
cmp eax, 0xf
jbe 0x3002d1c1
cmp eax, 0x12
jbe 0x3002d2c6
cmp eax, 0x1b
je 0x3002d2ea
mov al, byte [esi + 8]
cmp dword [ebp + 8], 0
mov byte [ebx + 6], al
je 0x3002d324
cmp dword [0x3017dbf4], 0
mov eax, dword [esi + 4]
jne 0x3002d30c
push 1
add eax, 2
push eax
push eax
push dword [esi]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x3002d324
push 7
pop ecx
push dword [ebp - 0x18]
lea edi, [ebx + 0x28]
lea esi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
call fcn.3015794a
mov esi, dword [ebp + 0xc]
mov word [ebx + 4], ax
mov edi, 0x100
mov cx, word [esi + 0xe]
mov al, byte [ebx + 7]
and cx, 0x4000
sub cx, 0x4000
and al, 0x7f
neg cx
push 0x7f
sbb ecx, ecx
inc ecx
shl cl, 7
or al, cl
mov byte [ebx + 7], al
movsx eax, word [esi + 0xc]
push eax
call fcn.30028c90
mov cl, byte [ebx + 7]
mov dl, cl
xor dl, al
and dl, 0x7f
xor dl, cl
mov byte [ebx + 7], dl
test word [esi + 0xe], di
je 0x30002d00
cmp dword [esi + 8], 0xd
jne 0x30002d00
mov byte [ebx + 6], 0x2b
jmp 0x30002d00
and byte [ebx + 6], 0
mov dword [ebx], edi
push dword [esi + 8]
call fcn.3015794a
mov word [ebx + 4], ax
mov ax, word [esi + 0xe]
and ax, 0x4000
sub ax, 0x4000
mov cl, byte [ebx + 7]
neg ax
push 0x7f
sbb eax, eax
inc eax
shl al, 7
and cl, 0x7f
or al, cl
mov byte [ebx + 7], al
movsx eax, word [esi + 0xc]
push eax
call fcn.30028c90
mov cl, byte [ebx + 7]
mov dl, cl
xor dl, al
and dl, 0x7f
xor dl, cl
mov byte [ebx + 7], dl
jmp 0x30002d00
and dword [ebx], 0
mov al, byte [esi + 8]
mov byte [ebx + 6], al
jmp 0x30002d00
cmp dword [ebp + 0x10], 0
je 0x3002d1c1
and byte [0x3017da75], 0xfb
jmp 0x3002d1c1
cmp dword [ebp - 4], 0
jne 0x3002d2f6
mov dword [ebx], 0x400
cmp dword [ebp + 0x10], 0
je 0x3002d1c1
and dword [0x3017da74], 0xfffffffe
jmp 0x3002d1c1
push 1
add eax, 2
push eax
push eax
push dword [esi]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x3002d1f4
and word [ebx + 4], 0
jmp 0x3002d21b
mov eax, dword [esi + 8]
jmp 0x3002d106
jmp dword [ecx*4 + 0x3002d3a7]
cmp dword [esi + 4], 0xa4
jne 0x3002d36f
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setge cl
add ecx, 0x200
mov dword [ebx], ecx
mov eax, dword [esi + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 8], eax
jmp 0x30002d00
mov eax, dword [esi + 8]
not eax
and eax, 1
or ah, 2
mov dword [ebx], eax
jmp case.0x3002d336.512
mov eax, dword [esi + 8]
not eax
and eax, 1
or ah, 1
shl eax, 1
jmp 0x3002d37a
mov eax, dword [esi + 8]
and al, 1
neg al
sbb eax, eax
and al, 0xfd
add eax, 0x203
jmp 0x3002d37a
mov dword [ebx], 0x20a
jmp case.0x3002d336.512