Function at 0x41c519
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push ebx
push esi
push edi
mov edi, ecx
push dword [ebp + 8]
call fcn.0041bea0
mov edx, dword [ebp + 0xc]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 4], ebx
jne 0x41c54d
cmp edx, 1
je 0x41c54d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edx
jmp 0x41ccbf
mov esi, dword [edi + ebx*4 + 0x2c]
lea eax, [edi + ebx*4 + 0x2c]
mov ecx, 0x111
mov dword [ebp - 0x10], eax
cmp edx, ecx
ja 0x41ca1d
je 0x41c9a6
cmp edx, 0x20
ja 0x41c68d
je 0x41c5c9
dec edx
je 0x41cb23
dec edx
je 0x41c5bc
sub edx, 3
je 0x41c59d
dec edx
dec edx
jne 0x41ccb6
push dword [esi + 0x14]
mov ecx, edi
push ebx
call fcn.0041ce9d
jmp 0x41ccb6
mov eax, dword [ebp + 0x14]
push dword [ebp + 8]
shr eax, 0x10
push eax
mov ecx, edi
movzx eax, word [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.0041d06d
jmp 0x41cb23
push ebx
mov ecx, edi
call fcn.0041d8cc
jmp 0x41ccb6
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x30]
jl 0x41ccb6
cmp eax, dword [ebp - 0x28]
jg 0x41ccb6
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jl 0x41ccb6
cmp eax, dword [ebp - 0x24]
jg 0x41ccb6
xor ebx, ebx
cmp byte [esi + 0x40f4], bl
je 0x41c66d
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, ebx
je 0x41c66d
cmp eax, dword [ebp + 8]
je 0x41c66d
push eax
mov ecx, edi
push dword [ebp - 4]
call fcn.0041bed2
cmp eax, 0xffffffff
je 0x41c66d
mov eax, dword [esi + eax*4 + 0x38]
mov ax, word [eax + 0x50]
cmp ax, 0xffff
je 0x41c66d
movsx eax, ax
push eax
mov ecx, edi
call fcn.0041cfab
jmp 0x41c685
mov eax, dword [ebp - 0x10]
mov ecx, edi
mov eax, dword [eax]
push dword [eax + 4]
call fcn.0041cfab
cmp dword [esi + 8], ebx
je 0x41ccb6
push 1
pop eax
jmp 0x41ccc8
cmp edx, 0x24
je 0x41c98e
cmp edx, 0x4e
je 0x41c762
cmp edx, 0x53
je 0x41c742
cmp edx, 0x7b
jne 0x41ccb6
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x41c6e4
xor ebx, ebx
cmp dword [esi + 0x4134], ebx
je 0x41cb23
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push dword [esi + 0x4134]
jmp 0x41c737
push eax
push ebx
mov ecx, edi
call fcn.0041bed2
cmp eax, 0xffffffff
je 0x41cb23
lea edi, [esi + eax*4 + 0x38]
mov eax, dword [esi + eax*4 + 0x38]
mov cl, byte [eax + 0x5c]
cmp cl, 0xe
je 0x41cb23
cmp cl, 0xf
je 0x41cb23
xor ebx, ebx
cmp dword [eax + 4], ebx
je 0x41cb23
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push ebx
mov eax, dword [edi]
push dword [esi]
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x41cb23
add esi, 0x18
mov ecx, esi
call fcn.00401367
test al, al
jne 0x41ccb6
push dword [esi]
mov ecx, edi
call fcn.0041c496
jmp 0x41cb23
mov eax, dword [ebp + 0x14]
mov ecx, 0xfffffdda
mov eax, dword [eax + 8]
cmp eax, ecx
ja 0x41c86e
je 0x41c814
cmp eax, 0xfffffd09
je 0x41c7f0
cmp eax, 0xfffffd0e
je 0x41c7e4
mov ecx, 0xfffffd0f
cmp eax, ecx
je 0x41c7ba
cmp eax, 0xfffffdd9
jne 0x41ccb6
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push ebx
push ebx
push 0x130b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
push dword [esi + 4]
jmp 0x41c862
cmp byte [esi + 0x412d], 1
jne 0x41c7d1
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, edi
push dword [eax + 4]
call fcn.00421811
xor ebx, ebx
mov byte [esi + 0x412d], bl
mov byte [esi + 0x412c], bl
jmp 0x41ccb6
mov byte [esi + 0x412c], 1
jmp 0x41ccb6
lea eax, [esi + 0x412d]
xor ebx, ebx
cmp byte [esi + 0x412c], bl
mov byte [eax], 1
jne 0x41ccb6
mov byte [eax], bl
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
push dword [eax + 4]
jmp 0x41c862
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ax, ax
jge 0x41ccb6
push 9
call esi
test ax, ax
jge 0x41ccb6
xor ebx, ebx
push ebx
push ebx
mov ebx, dword [ebp + 0x14]
push 0x130b
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
mov dword [ebp - 4], eax
call esi
test ax, ax
jge 0x41c859
dec dword [ebp - 4]
jmp 0x41c85c
inc dword [ebp - 4]
push dword [ebp - 4]
push dword [ebx + 4]
mov ecx, edi
call fcn.00421811
jmp 0x41ccb6
cmp eax, 0xffffff93
je 0x41c932
cmp eax, 0xffffff94
je 0x41c918
cmp eax, 0xfffffffe
jne 0x41ccb6
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
xor ebx, ebx
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x40]
push eax
push ebx
push 0x1111
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
call esi
cmp eax, ebx
je 0x41ccb6
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp + 0x14]
push ebx
push 0x110c
push dword [eax]
mov dword [ebp - 0x68], 0xc
mov dword [ebp - 0x5c], 0xf000
call esi
test byte [ebp - 0x38], 0x46
je 0x41ccb6
push dword [ebp - 0x34]
mov eax, dword [ebp + 0x14]
push 9
push 0x110b
push dword [eax]
call esi
push ebx
push dword [ebp - 0x44]
jmp 0x41c862
mov eax, dword [ebp + 0x14]
push 0
mov ecx, dword [eax + 4]
mov dl, byte [eax + 0x10]
mov ecx, dword [esi + ecx*4 + 0x38]
mov byte [ecx + 0x5d], dl
push dword [eax + 4]
jmp 0x41c862
xor ebx, ebx
lea esi, [edi + 0x1550]
push ebx
push ebx
push ebx
push dword [esi]
call dword [sym.imp.COMCTL32.dll_ImageList_SetDragCursorImage]
push 0xfffffffffffffff0
push 0xfffffffffffffff8
push ebx
push dword [esi]
call dword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetCapture]
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 4]
call fcn.0041bf05
mov dword [edi + 0x1554], eax
mov edi, dword [ebp + 0x14]
lea esi, [edi + 0x20]
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [edi + 0x24]
push dword [esi]
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_DragEnter]
jmp 0x41ccb6
movsx edx, word [esi + 0x2e]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [eax]
movsx eax, word [eax + 0x30]
mov dword [ecx + 0x1c], eax
jmp 0x41cb23
cmp word [ebp + 0x10], 2
jne 0x41c9d0
xor ebx, ebx
cmp byte [edi], bl
je 0x41cb23
push ebx
push 0xf060
push 0x112
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41cb23
mov esi, dword [ebp + 0x10]
xor ebx, ebx
shr esi, 0x10
cmp si, bx
jne 0x41c9e8
cmp dword [ebp + 0x14], ebx
jne 0x41c9e8
movzx eax, word [ebp + 0x10]
jmp 0x41ca09
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp - 4]
call fcn.0041bed2
cmp eax, 0xffffffff
je 0x41ccb6
push eax
mov ecx, edi
push dword [ebp - 4]
call fcn.0041bf05
movzx ecx, word [ebp + 0x10]
cmp eax, ecx
jne 0x41ccb6
movzx ecx, si
jmp 0x41caaa
mov eax, 0x138
cmp edx, eax
ja 0x41cb60
je 0x41cb4d
cmp edx, 0x112
je 0x41cae3
add eax, 0xffffffdb
cmp edx, eax
je 0x41cabd
jbe 0x41ccb6
cmp edx, 0x115
jbe 0x41ca7c
cmp edx, 0x134
jbe 0x41ccb6
cmp edx, 0x137
ja 0x41ccb6
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push ebx
call fcn.0041d321
jmp 0x41ccc8
cmp word [ebp + 0x10], 8
jne 0x41ccb6
push dword [ebp + 0x14]
mov ecx, edi
push ebx
call fcn.0041bed2
cmp eax, 0xffffffff
je 0x41ccb6
push eax
push ebx
mov ecx, edi
call fcn.0041bf05
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
push ecx
push eax
mov ecx, edi
call fcn.00421811
test al, al
je 0x41ccb6
jmp 0x41cb23
mov eax, dword [ebp + 0x10]
dec eax
dec eax
jne 0x41ccb6
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dword [ebp + 8], eax
jne 0x41ccb6
push 1
push esi
mov ecx, edi
call fcn.0041cda7
jmp 0x41cb23
mov eax, dword [ebp + 0x10]
sub eax, 0xf020
je 0x41cb33
sub eax, 0x10
je 0x41cb2a
sub eax, 0x30
je 0x41cb15
sub eax, 0xc0
jne 0x41ccb6
xor ebx, ebx
push ebx
push ebx
push esi
push 0xfffffffffffffffb
mov ecx, edi
call fcn.0041c32a
jmp 0x41ccb6
xor ebx, ebx
mov ecx, edi
push ebx
push ebx
push esi
push 0xfffffffffffffffd
call fcn.0041c32a
xor eax, eax
jmp 0x41ccc8
xor ebx, ebx
push ebx
push ebx
push esi
push 0xfffffffffffffffa
jmp 0x41cb09
xor ebx, ebx
mov ecx, edi
push ebx
push ebx
push esi
push 0xfffffffffffffffc
call fcn.0041c32a
mov ecx, edi
call fcn.0041cefc
jmp 0x41ccb6
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push ebx
call fcn.0041d3e3
jmp 0x41ccc8
sub edx, 0x200
je 0x41cc81
dec edx
dec edx
je 0x41cbea
sub edx, 0x31
jne 0x41ccb6
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_DragQueryPoint]
push ebx
push esi
push dword [ebp - 8]
mov ecx, edi
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0041cccf
cmp eax, 0xffffffff
je 0x41ccb6
mov eax, dword [esi + eax*4 + 0x38]
push 0x104
xor ebx, ebx
mov esi, dword [eax]
lea eax, [ebp - 0x170]
push eax
push ebx
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
lea eax, [ebp - 0x170]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0xffffffffffffffff
push ebx
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_DragFinish]
jmp 0x41cb23
xor ebx, ebx
cmp dword [edi + 0x1554], ebx
je 0x41ccb6
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_DragLeave]
call dword [sym.imp.COMCTL32.dll_ImageList_EndDrag]
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp + 0x14]
push dword [ebp - 4]
movsx eax, word [ebp + 0x14]
shr ecx, 0x10
movsx ecx, cx
push esi
push ecx
push eax
mov ecx, edi
push dword [ebp + 8]
call fcn.0041cccf
cmp eax, 0xffffffff
je 0x41ccb6
mov eax, dword [esi + eax*4 + 0x38]
mov ecx, edi
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x1554]
call fcn.0041deac
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
push dword [ebp - 0x10]
call fcn.0041deac
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [ebp - 4]
call fcn.00428f1b
pop ecx
push 0xffffffffffffffff
push ebx
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [edi + 0x1554], ebx
jmp 0x41ccb6
cmp dword [edi + 0x1554], 0
je 0x41ccb6
movsx eax, word [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.COMCTL32.dll_ImageList_DragMove]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefDlgProcA]
pop edi
pop esi
pop ebx
leave
ret 0x10