Function at 0x301707e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0xa8
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x18]
mov esi, dword [eax + 0x10]
mov al, byte [esi + 0x1b1c]
xor ebx, ebx
test al, al
mov dword [ebp + 0x58], edi
mov byte [ebp + 0x5f], 0
mov dword [ebp + 0x44], esi
jne 0x30170839
mov eax, dword [esi + 0x1840]
cmp eax, ebx
je 0x30170839
mov cl, byte [eax + 0x974]
test cl, cl
jne 0x30170839
mov cl, byte [eax + 0x975]
test cl, cl
jne 0x30170839
cmp esi, dword [eax + 0x24]
jne 0x30170839
mov eax, 1
jmp 0x3017083b
xor eax, eax
test al, al
je 0x30170907
push str._keyboardEvent_
push esi
lea ecx, [ebp - 0x48]
call fcn.301c7701
mov eax, dword [esi + 8]
push ebx
lea ecx, [ebp + 0x48]
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x54], eax
call fcn.3016e590
mov edx, dword [ebp + 0x68]
lea ecx, [ebp + 0x48]
push ecx
push ebx
push edx
mov ecx, edi
call fcn.3016f660
test al, al
je 0x301709bf
mov eax, dword [ebp + 0x40]
and eax, 0xfffffff0
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x40], eax
call fcn.301c5f6e
mov eax, dword [ebp + 0x40]
and eax, 0xfffffff2
lea ecx, [ebp - 8]
or eax, 2
push ebx
push ecx
mov dword [ebp + 0x40], eax
call fcn.301c609d
mov esi, dword [ebp + 0x44]
mov edi, dword [esi + 0x17c4]
add esp, 8
cmp eax, ebx
jne 0x301709d1
mov edx, dword [esi + 0x1b5c]
mov eax, dword [edx + 0x2a8]
cmp eax, ebx
jne 0x301708dc
push 0xaa
mov ecx, esi
call fcn.3018a8f0
push eax
mov eax, dword [ebp + 0x58]
or eax, 1
push eax
mov ecx, esi
call fcn.301c29a7
test al, al
jne 0x30170915
lea ecx, [ebp - 0x14]
call fcn.301c5fbe
lea ecx, [ebp + 0x48]
call fcn.301671a0
lea ecx, [ebp - 0x48]
call fcn.301c7748
xor al, al
pop edi
pop esi
pop ebx
add ebp, 0x60
mov esp, ebp
pop ebp
ret 0x18
mov esi, dword [esi + 0x1840]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x3c]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
mov eax, dword [esi]
mov ecx, esi
setl bl
call dword [eax + 0x3c]
push 0x12
call edi
mov edx, dword [esi]
test ax, ax
mov ecx, esi
setl byte [ebp + 0x5e]
call dword [edx + 0x3c]
push 0x10
call edi
movzx ecx, byte [ebp + 0x5e]
test ax, ax
setl al
movzx eax, al
push eax
mov eax, dword [ebp + 0x7c]
push ecx
mov ecx, dword [ebp + 0x78]
movzx edx, bl
push edx
mov edx, dword [ebp + 0x74]
push eax
movzx eax, byte [ebp + 0x70]
push ecx
movzx ecx, byte [ebp + 0x6c]
push edx
mov edx, dword [ebp + 0x68]
push eax
push ecx
push edx
mov edx, dword [ebp + 0x58]
push str.Sbbiiibbb
push 0x74
lea eax, [ebp + 0x5f]
push eax
lea ecx, [ebp + 0x48]
push ecx
push edx
call fcn.30170150
mov eax, dword [esi + 0x768]
add esp, 0x38
test eax, eax
je 0x301709b5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xb4]
mov dword [esi + 0x768], 0
xor ebx, ebx
lea ecx, [ebp - 0x14]
call fcn.301c5fbe
mov ecx, dword [ebp + 0x54]
cmp ecx, ebx
je 0x301709e3
mov edx, dword [ebp + 0x48]
push edx
call fcn.302095c0
jmp 0x301709ef
lea ecx, [ebp - 0x14]
call fcn.301c5ff0
push edi
mov ecx, esi
call fcn.3018a130
jmp 0x301709b7
mov eax, dword [ebp + 0x48]
push eax
call fcn.30208320
add esp, 4
lea ecx, [ebp - 0x48]
mov dword [ebp + 0x48], ebx
call fcn.301c7748
mov al, byte [ebp + 0x5f]
pop edi
pop esi
pop ebx
add ebp, 0x60
mov esp, ebp
pop ebp
ret 0x18