Function at 0x3004ce7b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov edi, eax
mov dword [ebp - 4], ebx
call fcn.3004b362
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [ebp - 0x10], eax
call esi
push 0x11
shr eax, 8
movzx eax, al
mov dword [ebp - 0xc], eax
call esi
push 4
push dword [ebp + 8]
shr eax, 8
movzx eax, al
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x30096364]
mov dword [ebp - 0x10], eax
mov eax, dword [0x300963d4]
cmp eax, ebx
mov esi, 0x300971e0
jne 0x3004cf05
cmp ecx, 0x18
je 0x3004cf05
cmp ecx, 0x17
je 0x3004cf05
mov dword [ebp - 4], 1
jmp case.0x3004cf18.17
add ecx, 0xfffffff7
cmp ecx, 0xf
ja case.0x3004cf18.17
movzx ecx, byte [ecx + 0x3004d444]
jmp dword [ecx*4 + 0x3004d41c]
mov eax, dword [0x300963cc]
cmp eax, dword [0x300971b8]
jne 0x3004d0ea
mov eax, dword [0x300963d0]
cmp eax, dword [0x300971bc]
jne 0x3004d0ea
mov dword [ebp - 4], 1
jmp 0x3004d0ea
mov eax, dword [0x300963e0]
cmp eax, ebx
je case.0x3004cf18.9
push eax
push edi
call dword [sym.imp.GDI32.dll_InvertRgn]
push 0x5a0049
push esi
push edi
call fcn.30065c09
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [0x30096360]
or dword [0x300971c0], 0xffffffff
push 1
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp + 8]
mov word [0x300971cc], bx
call fcn.3004bb6e
cmp word [0x300971c2], bx
jge case.0x3004cf18.17
push dword [ebp + 8]
mov dword [ebp - 4], 1
call fcn.3004cdf8
cmp word [0x300971cc], bx
jne case.0x3004cf18.17
push 0x1e
call fcn.30048b2d
jmp case.0x3004cf18.17
mov eax, dword [0x300963cc]
cmp eax, dword [0x300971b8]
jne 0x3004d083
mov eax, dword [0x300963d0]
cmp eax, dword [0x300971bc]
jne 0x3004d083
mov dword [ebp - 4], 1
jmp 0x3004d083
mov eax, dword [0x300963cc]
cmp eax, dword [0x300971b8]
jne 0x3004d01a
mov eax, dword [0x300963d0]
cmp eax, dword [0x300971bc]
je 0x3004d05a
call dword [sym.imp.USER32.dll_GetMessageTime]
mov ecx, dword [0x300963f0]
add ecx, 0x12c
cmp eax, ecx
jge case.0x3004cf18.20
mov eax, dword [0x300963cc]
sub eax, dword [0x300971b8]
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jge case.0x3004cf18.20
mov eax, dword [0x300963d0]
sub eax, dword [0x300971bc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jge case.0x3004cf18.20
mov dword [ebp - 4], 1
mov eax, dword [0x300963ec]
cmp eax, ebx
je 0x3004d083
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [0x300963ec]
mov dword [eax + 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x300963ec]
movzx eax, word [0x300971cc]
push dword [0x300963c8]
push dword [0x300963c4]
push esi
push eax
movzx eax, word [0x300971ce]
push eax
push dword [0x300963e8]
push ebx
jmp 0x3004d0da
push dword [0x300963ec]
movzx eax, word [0x300971cc]
push dword [0x300963d0]
push dword [0x300963cc]
push esi
push eax
movzx eax, word [0x300971ce]
push eax
push dword [0x300963e8]
push 1
push edi
call fcn.3002d9d7
jmp case.0x3004cf18.17
cmp eax, ebx
je 0x3004cef9
push 0x5a0049
push esi
push edi
call fcn.30065c09
jmp case.0x3004cf18.17
cmp eax, ebx
je 0x3004d10a
push 0x5a0049
push esi
push edi
call fcn.30065c09
jmp 0x3004d111
mov dword [ebp - 4], 1
cmp dword [0x300963d8], ebx
je case.0x3004cf18.17
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push ebx
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp + 8]
call fcn.3004bb6e
push dword [ebp - 0x10]
mov dword [0x300963d4], ebx
push edi
mov dword [0x300963d8], ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x14]
push edi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [0x300963e0]
cmp eax, ebx
je 0x3004d165
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x30096364]
lea ecx, [eax - 9]
cmp ecx, 0xf
mov dword [0x300963e0], ebx
ja case.default.0x3004d17c
jmp dword [ecx*4 + 0x3004d454]
cmp dword [ebp - 4], ebx
jne case.default.0x3004d17c
mov eax, dword [0x300963cc]
sub dword [0x300971b8], eax
mov eax, dword [0x300963d0]
sub dword [0x300971bc], eax
cmp dword [ebp - 8], ebx
je 0x3004d415
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [0x300971bc]
push dword [0x300971b8]
push eax
push dword [ebp + 8]
call fcn.3000dbc1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp case.default.0x3004d17c
cmp dword [ebp - 4], ebx
jne case.default.0x3004d17c
mov ecx, dword [0x300971bc]
sub ecx, dword [0x300963d0]
push ecx
push eax
push dword [0x300971c8]
push dword [ebp + 8]
call fcn.30007f2a
jmp case.default.0x3004d17c
cmp dword [ebp - 4], ebx
jne case.default.0x3004d17c
mov ecx, dword [0x300971b8]
sub ecx, dword [0x300963cc]
jmp 0x3004d1ec
cmp dword [ebp - 4], ebx
jne case.default.0x3004d17c
push dword [ebp + 8]
call fcn.3004cdf8
push dword [ebp - 0x18]
push dword [0x30096364]
push dword [0x300971c0]
push dword [0x300971c8]
push dword [ebp + 8]
call 0x30008343
jmp case.default.0x3004d17c
mov eax, dword [0x300963ec]
cmp eax, ebx
je case.default.0x3004d17c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [eax + 0x138]
push dword [0x300963ec]
imul ecx, ecx, 0x50
xor edx, edx
cmp dword [ecx + eax + 0x48], ebx
setl dl
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp edi, ebx
je case.0x3004d17c.18
push 0x28
call fcn.30048b2d
push dword [0x300963ec]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.default.0x3004d17c
push dword [0x300963fc]
push 1
push dword [0x300963ec]
push dword [0x300963d0]
push dword [0x300963cc]
push esi
call fcn.3002db39
push eax
movzx eax, word [0x300971ce]
push esi
push eax
push dword [ebp + 8]
call fcn.30026d7b
jmp case.default.0x3004d17c
mov eax, dword [0x300963ec]
cmp eax, ebx
je case.default.0x3004d17c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [eax + 0x138]
push dword [0x300963ec]
imul ecx, ecx, 0x50
xor edx, edx
cmp dword [ecx + eax + 0x48], ebx
setl dl
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp edi, ebx
jne 0x3004d283
push dword [0x300963ec]
push dword [0x300963d0]
push dword [0x300963cc]
push esi
call fcn.3002db39
push eax
movzx eax, word [0x300971ce]
push esi
push eax
push dword [ebp + 8]
call fcn.300272e3
jmp case.default.0x3004d17c
movzx eax, word [0x300971ce]
push 1
push ebx
push dword [ebp - 0xc]
push eax
push dword [0x300963e8]
call fcn.3002d113
jmp case.default.0x3004d17c
xor eax, eax
cmp dword [ebp - 4], ebx
push 1
sete al
push eax
push dword [ebp - 0xc]
movzx eax, word [0x300971ce]
push eax
push dword [0x300963e8]
call fcn.3002d113
mov eax, dword [0x300971bc]
sub eax, dword [0x300963d0]
push eax
mov eax, dword [0x300971b8]
sub eax, dword [0x300963cc]
push eax
push dword [ebp + 8]
call fcn.30027650
jmp case.default.0x3004d17c
xor eax, eax
cmp dword [ebp - 4], ebx
push 1
sete al
push eax
push dword [ebp - 0xc]
movzx eax, word [0x300971ce]
push eax
push dword [0x300963e8]
call fcn.3002d113
cmp dword [ebp - 4], ebx
push dword [0x300963ec]
jne 0x3004d290
movzx eax, word [0x300971ce]
push eax
push dword [ebp + 8]
call fcn.3002779b
jmp case.default.0x3004d17c
cmp dword [ebp - 4], ebx
jne case.default.0x3004d17c
push esi
jmp 0x3004d3f3
cmp dword [ebp - 4], ebx
jne case.default.0x3004d17c
cmp dword [ebp - 0x1c], ebx
push esi
je 0x3004d3fd
push dword [ebp + 8]
call fcn.3005f943
jmp case.default.0x3004d17c
push edi
push dword [ebp + 8]
call fcn.3002178c
push esi
push dword [ebp + 8]
call fcn.3002d2d1
mov dword [0x300963ec], ebx
pop edi
pop esi
pop ebx
leave
ret 4