Function at 0x2da1170
Capabilities:
Get keyboard layout
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp dword [0x2da304c], 0
je 0x2da1193
mov eax, dword [0x2da304c]
sub eax, 1
mov dword [0x2da304c], eax
xor eax, eax
jmp 0x2da13cc
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.IMM32.dll_ImmIsIME
test eax, eax
je 0x2da11d9
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x2da11d9
mov eax, dword [ebp - 0x14]
push eax
call sub.IMM32.dll_ImmGetVirtualKey
cmp eax, 0xe5
je 0x2da11d9
xor eax, eax
jmp 0x2da13cc
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
shr edx, 8
and edx, 0xff
movzx eax, dl
and eax, 0x40
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
shr eax, 8
and eax, 0xff
movzx ecx, al
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
push edx
call fcn.02da1100
add esp, 4
test eax, eax
je 0x2da1237
cmp dword [ebp - 8], 0
je 0x2da1237
xor eax, eax
jmp 0x2da13cc
mov eax, dword [ebp + 8]
push eax
call fcn.02da1140
add esp, 4
test eax, eax
je 0x2da1271
cmp dword [0x2da3048], 0
jne 0x2da1271
mov dword [0x2da3048], 1
mov ecx, dword [ebp - 0x10]
mov dword [0x2da3044], ecx
mov edx, dword [ebp - 4]
mov dword [0x2da3040], edx
jmp 0x2da13ca
push 0x100
call fcn.02da1000
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0xa
call fcn.02da1000
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 5
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x2da12c7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
jmp 0x2da12ce
mov dword [ebp - 0x30], 1
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], 0
jmp 0x2da12e6
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jge 0x2da1332
mov ecx, dword [ebp - 0x1c]
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
movzx eax, word [ecx + eax*2]
and eax, 0xffff
movzx ecx, ax
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [0x2da3030]
push ecx
mov edx, dword [section..JOE]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x2da12dd
mov eax, dword [ebp - 0x24]
push eax
call fcn.02da1020
add esp, 4
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.02da1020
add esp, 4
cmp dword [0x2da3048], 0
je 0x2da13ca
push 0
push 0
movzx edx, byte [0x2da3044]
push edx
movzx eax, byte [0x2da3040]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
movzx ecx, byte [0x2da3044]
push ecx
movzx edx, byte [0x2da3040]
push edx
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
movzx eax, byte [ebp - 0x10]
push eax
movzx ecx, byte [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
movzx edx, byte [ebp - 0x10]
push edx
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [0x2da3048], 0
mov dword [0x2da304c], 2
mov eax, 1
jmp 0x2da13cc
xor eax, eax
mov esp, ebp
pop ebp
ret