Function at 0x30060725
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
and dword [ebx + 0x2c], 0
mov eax, dword [edx + 4]
cmp eax, 0x414
push esi
push edi
jne 0x3006075a
push 7
lea edi, [ebx + 0xc]
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 4]
mov dword [ebx], eax
jmp 0x30060bda
lea ecx, [eax - 0xa0]
cmp ecx, 9
mov dword [ebx], eax
ja 0x3006076e
add eax, 0x160
mov dword [ebx], eax
call fcn.300e71ef
mov esi, dword [ebp + 0xc]
xor edi, edi
inc edi
test eax, eax
jne 0x30060799
mov eax, dword [ebp + 0x10]
and eax, 0x8001
cmp eax, edi
jne 0x30060799
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x30060799
mov dword [ebp + 8], edi
jmp 0x3006079d
and dword [ebp + 8], 0
mov eax, dword [ebx]
mov ecx, 0x10f
cmp eax, ecx
jg 0x30060b1b
je 0x30060825
add ecx, 0xfffffff3
cmp eax, ecx
jg 0x30060804
je 0x30060867
mov ecx, eax
sub ecx, 0xf
je 0x300607e3
sub ecx, 3
je 0x30060bcf
sub ecx, 0xee
je 0x300608f6
dec ecx
je 0x300608c7
jmp 0x30060b74
push dword [esi]
call fcn.3005b3e8
test eax, eax
je 0x300607fa
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x300607fc
xor eax, eax
mov dword [ebx + 4], eax
jmp 0x30060bcf
mov ecx, eax
sub ecx, 0x104
je 0x300608d7
dec ecx
je 0x300608c1
dec ecx
je 0x30060867
sub ecx, 7
jne 0x30060b74
cmp byte [0x30225c9d], 0
je 0x30060b74
cmp dword [0x30209e24], 0x7f
jne 0x30060bcf
call dword [sym.imp.MSO.dll_Ordinal_497]
test eax, eax
jne 0x30060bcf
mov esi, dword [esi]
cmp esi, dword [0x302ae694]
jne 0x30060bcf
push eax
push esi
call fcn.30106772
jmp 0x30060bcf
mov dword [ebx], pe_nt_image_headers32
mov byte [ebx + 6], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
push dword [esi]
push dword [ebp + 0x10]
push dword [esi + 8]
call fcn.3005fe25
mov cl, byte [ebx + 7]
mov word [ebx + 4], ax
mov ax, word [esi + 0xe]
and ax, 0x4000
cmp ax, 0x4000
sete al
shl al, 7
and cl, 0x7f
or al, cl
mov byte [ebx + 7], al
movsx eax, word [esi + 0xc]
push 0x7f
push eax
call fcn.3007f8d4
mov cl, byte [ebx + 7]
xor cl, al
and cl, 0x7f
xor byte [ebx + 7], cl
jmp 0x30060bcf
mov dword [ebx], 0x101
mov al, byte [esi + 8]
and word [ebx + 4], 0
mov byte [ebx + 6], al
jmp 0x30060bcf
call fcn.300e71ef
test eax, eax
je 0x300608ed
call fcn.300e7212
test eax, eax
je 0x30060bcf
mov dword [ebp - 4], edi
mov dword [ebx], pe_nt_image_headers32
cmp byte [0x30225c9d], 0
je 0x30060964
call fcn.30079beb
push dword [0x30225c28]
call fcn.30106282
cmp byte [0x30225c9d], 0
je 0x30060964
test dword [0x3022ca34], 0x80000
je 0x30060964
movsx eax, word [esi + 0xe]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 2
push 1
push eax
call edi
push eax
call edi
cmp dword [esi + 8], 0xe5
jne 0x3006094f
cmp eax, 8
jne 0x3006094f
and dword [0x30225cb8], 0xfffffffb
jmp 0x30060964
test eax, eax
jbe 0x30060964
cmp eax, 0xd
je 0x30060964
cmp eax, 9
je 0x30060964
or dword [0x30225cb8], 4
mov edi, dword [ebp + 0x10]
and edi, 1
je 0x3006097e
cmp dword [0x302ae884], 0
je 0x3006097e
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov eax, dword [esi + 8]
cmp eax, 3
je 0x300609a2
cmp eax, 9
je 0x30060a93
cmp eax, 0xf
jbe 0x300609b9
cmp eax, 0x12
jbe 0x30060a85
cmp eax, 0x1b
jne 0x300609b9
cmp dword [ebp - 4], 0
jne 0x300609ae
mov dword [ebx], 0x400
test edi, edi
je 0x300609b9
and dword [0x302ae770], 0xfffffffe
cmp dword [ebp + 8], 0
mov al, byte [esi + 8]
mov byte [ebx + 6], al
je 0x30060ac0
cmp byte [0x30225c9d], 0
mov ecx, fcn.3007faae
jne 0x300609dd
mov ecx, dword [sym.imp.USER32.dll_PeekMessageW]
mov eax, dword [esi + 4]
push 1
add eax, 2
push eax
push eax
push dword [esi]
lea eax, [ebp - 0x20]
push eax
call ecx
test eax, eax
je 0x30060ac0
call dword [sym.imp.KERNEL32.dll_GetACP]
push 7
lea edi, [ebx + 0x28]
pop ecx
lea esi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
cmp byte [0x30225c9d], 0
je 0x30060aaa
cmp eax, 0x3a4
je 0x30060a54
cmp eax, 0x3b5
je 0x30060a54
cmp eax, 0x3b6
je 0x30060a54
cmp eax, 0x3a8
je 0x30060a54
cmp eax, 0x2711
je 0x30060a54
cmp eax, 0x2713
je 0x30060a54
cmp eax, 0x2712
je 0x30060a54
cmp eax, 0x272f
je 0x30060a54
cmp eax, 0x2729
jne 0x30060aaa
mov esi, dword [ebp + 0xc]
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.3005fe25
mov word [ebx + 4], ax
cmp byte [0x30225c9d], 0
je 0x30060ac8
test dword [0x3022ca34], 0x100000
je 0x30060ac8
movzx eax, ax
mov dword [ebx + 0x30], eax
jmp 0x30060ac8
and dword [ebx], 0
mov al, byte [esi + 8]
mov byte [ebx + 6], al
jmp 0x30060bcf
test edi, edi
je 0x300609b9
and dword [0x302ae770], 0xfffffbff
jmp 0x300609b9
mov esi, dword [ebp + 0xc]
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.3005fe25
mov word [ebx + 4], ax
jmp 0x30060ac8
and word [ebx + 4], 0
mov esi, dword [ebp + 0xc]
mov ax, word [esi + 0xe]
mov cl, byte [ebx + 7]
and ax, 0x4000
cmp ax, 0x4000
sete al
shl al, 7
and cl, 0x7f
or al, cl
mov byte [ebx + 7], al
movsx eax, word [esi + 0xc]
push 0x7f
push eax
call fcn.3007f8d4
mov cl, byte [ebx + 7]
xor cl, al
and cl, 0x7f
xor byte [ebx + 7], cl
test word [esi + 0xe], 0x100
je 0x30060bcf
cmp dword [esi + 8], 0xd
jne 0x30060bcf
mov byte [ebx + 6], 0x2b
jmp 0x30060bcf
mov ecx, 0x206
cmp eax, ecx
jg 0x30060b61
je 0x30060b89
cmp eax, 0x113
je 0x30060b59
cmp eax, 0x1ff
jle 0x30060b74
cmp eax, 0x203
jle 0x30060bc3
cmp eax, 0x204
je 0x30060b9c
cmp eax, 0x205
jne 0x30060b74
mov eax, dword [esi + 8]
add eax, eax
not eax
and eax, 2
jmp 0x30060bbc
mov eax, dword [esi + 8]
jmp 0x300607fc
mov ecx, eax
sub ecx, 0x207
je 0x30060b9c
dec ecx
je 0x30060b4d
dec ecx
je 0x30060b89
dec ecx
je 0x30060b81
cmp eax, dword [0x302ae754]
je 0x30060b81
and dword [ebx], 0
jmp 0x30060bcf
mov dword [ebx], 0x20a
jmp 0x30060bc3
mov eax, dword [esi + 8]
and al, 1
neg al
sbb eax, eax
and eax, 0xfffffffd
add eax, 0x203
jmp 0x30060bc1
cmp dword [esi + 4], 0xa4
jne 0x30060bb5
call fcn.30060712
neg eax
sbb eax, eax
add eax, 0x201
jmp 0x30060bc1
mov eax, dword [esi + 8]
not eax
and eax, edi
or eax, 0x200
mov dword [ebx], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 8], eax
mov esi, dword [ebp + 0xc]
push 7
lea edi, [ebx + 0xc]
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret 0xc