Function at 0x30170550
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x18]
mov esi, dword [eax + 0x10]
mov al, byte [esi + 0x1b1c]
test al, al
mov dword [ebp - 0x28], edi
mov byte [ebp - 1], 0
mov dword [ebp - 0x24], esi
jne 0x301705a7
mov eax, dword [esi + 0x1840]
xor ebx, ebx
cmp eax, ebx
je 0x301705a7
mov cl, byte [eax + 0x974]
test cl, cl
jne 0x301705a7
mov cl, byte [eax + 0x975]
test cl, cl
jne 0x301705a7
cmp esi, dword [eax + 0x24]
jne 0x301705a7
mov eax, 1
jmp 0x301705ab
xor ebx, ebx
xor eax, eax
test al, al
je 0x3017067e
mov eax, dword [esi + 8]
push ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], eax
call fcn.3016e590
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push ebx
push edx
mov ecx, edi
call fcn.3016f660
test al, al
je 0x301707a0
mov eax, dword [ebp - 0x2c]
and eax, 0xfffffff0
push esi
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x2c], eax
call fcn.301c5f6e
mov eax, dword [ebp - 0x2c]
and eax, 0xfffffff2
lea ecx, [ebp - 0x74]
or eax, 2
push ebx
push ecx
mov dword [ebp - 0x2c], eax
call fcn.301c609d
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + 0x17c4]
add esp, 8
cmp eax, ebx
jne 0x30170786
mov edx, dword [esi + 0x1b5c]
mov eax, dword [edx + 0x2a8]
cmp eax, ebx
jne 0x3017063e
push 0xaa
mov ecx, esi
call fcn.3018a8f0
mov ebx, dword [ebp - 0x28]
push eax
mov eax, ebx
or eax, 1
push eax
mov ecx, esi
call fcn.301c29a7
test al, al
je 0x3017066e
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x30170689
push 0xaa
or eax, 1
push eax
mov ecx, esi
call fcn.3000ece0
test al, al
jne 0x30170689
lea ecx, [ebp - 0x80]
call fcn.301c5fbe
lea ecx, [ebp - 0x18]
call fcn.301671a0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov esi, dword [esi + 0x1840]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x3c]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
mov eax, dword [esi]
mov ecx, esi
setl byte [ebp - 2]
call dword [eax + 0x3c]
push 0x12
call edi
mov edx, dword [esi]
test ax, ax
mov ecx, esi
setl byte [ebp - 5]
call dword [edx + 0x3c]
push 0x10
call edi
fld qword [ebp + 0x14]
mov edx, dword [esi + 0x648]
test ax, ax
setl byte [ebp - 4]
cmp edx, 1
sete byte [ebp - 3]
call fcn.3002ddb0
fld qword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
call fcn.3002ddb0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x301706f7
mov eax, ebx
mov edx, dword [eax + 0x44]
push 1
lea ecx, [ebp - 0x20]
push ecx
push edx
mov ecx, esi
call fcn.300fa740
fild dword [ebp - 0x1c]
mov eax, dword [ebp + 0x28]
movzx ecx, byte [ebp - 3]
movzx edx, byte [ebp - 4]
fmul qword [0x30296da0]
push eax
movzx eax, byte [ebp - 5]
push ecx
movzx ecx, byte [ebp - 2]
push edx
mov edx, dword [ebp + 0x24]
push eax
movzx eax, byte [ebp + 0x10]
push ecx
movzx ecx, byte [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
sub esp, 0x10
fstp qword [esp + 8]
fild dword [ebp - 0x20]
fmul qword [0x30296da0]
fstp qword [esp]
push eax
push ecx
push edx
push str.Sbbnnobbbbi
push 0x76
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
call fcn.30170150
mov eax, dword [esi + 0x768]
add esp, 0x48
test eax, eax
je 0x30170796
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xb4]
mov dword [esi + 0x768], 0
jmp 0x30170796
lea ecx, [ebp - 0x80]
call fcn.301c5ff0
push edi
mov ecx, esi
call fcn.3018a130
lea ecx, [ebp - 0x80]
call fcn.301c5fbe
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x301707bc
mov eax, dword [ebp - 0x18]
push eax
call fcn.302095c0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.30208320
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24