Function at 0x41a610
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x452594]
sub esp, 8
mov eax, dword [ecx + 0x178]
push esi
test eax, eax
push edi
je 0x41a62d
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov al, byte [ecx + 0x28]
mov edi, 2
test al, 2
je 0x41a6f1
mov eax, dword [ecx + 0x4d8]
test eax, eax
jg 0x41a754
call fcn.00404f30
mov edx, dword [0x452594]
mov ecx, eax
sub ecx, dword [edx + 0xc0]
jne 0x41a6b3
mov ax, word [edx + 0x30]
test ax, ax
jne 0x41a673
movsx eax, word [edx + 0x32]
pop edi
pop esi
add esp, 8
ret
cmp ax, 1
je 0x41a696
cmp ax, di
je 0x41a696
cmp ax, 0xfffe
je 0x41a696
cmp ax, 3
je 0x41a696
cmp ax, 0x64
je 0x41a696
cmp ax, 4
jne 0x41a6a9
push 0xfffefffd
call fcn.004424f0
mov edx, dword [0x452594]
add esp, 4
movsx eax, word [edx + 0x30]
pop edi
pop esi
add esp, 8
ret
mov dword [edx + 0xc0], eax
mov edx, dword [0x452594]
mov eax, dword [edx + 0x4dc]
add ecx, eax
mov eax, dword [edx + 0xd0]
mov esi, ecx
sub ecx, eax
cmp ecx, 3
jle 0x41a6de
mov ecx, 3
lea esi, [eax + 3]
mov dword [edx + 0x4dc], esi
mov eax, dword [0x452594]
mov dword [eax + 0x4d8], ecx
jmp 0x41a74e
call fcn.00404f30
mov ecx, dword [0x452594]
cmp eax, dword [ecx + 0xc0]
jne 0x41a739
mov edx, dword [0x45258c]
mov esi, dword [edx + 0x1a8]
test esi, esi
jne 0x41a739
mov ax, word [ecx + 0x30]
test ax, ax
jne 0x41a727
movsx eax, word [ecx + 0x32]
pop edi
pop esi
add esp, 8
ret
cmp ax, 1
je 0x41ac63
cmp ax, di
jmp 0x41ac49
mov dword [ecx + 0xc0], eax
mov eax, dword [0x452594]
mov dword [eax + 0x4d8], 1
mov ecx, dword [0x452594]
mov eax, dword [ecx + 0xa4]
mov edx, dword [ecx + 0xa0]
mov dword [ecx + 0xa0], eax
mov ecx, dword [0x452594]
push ebx
mov dword [ecx + 0xa4], edx
mov edx, dword [0x452594]
mov dword [edx + 0x98], eax
mov ecx, dword [0x452594]
mov edx, dword [ecx + 0x94]
shl edx, 0xa
add edx, eax
mov dword [ecx + 0x9c], edx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [0x452594]
mov dword [esp + 0x10], 0
mov edx, dword [ecx + 0xd8]
sub eax, edx
mov edx, dword [ecx + 0xd4]
mov dword [ecx + 0xd4], eax
mov ecx, dword [0x452594]
sub eax, edx
mov dword [ecx + 0xdc], eax
mov ecx, dword [0x452594]
mov ebx, dword [ecx + 0x50c]
add ebx, eax
mov dword [ecx + 0x50c], ebx
mov ecx, dword [0x452594]
mov esi, dword [ecx + 0xd0]
inc esi
mov dword [ecx + 0xd0], esi
mov ecx, dword [0x452594]
mov edx, dword [ecx + 0x1c]
mov edx, dword [edx + 0x96c]
mov dword [esp + 0xc], edx
mov edx, dword [ecx + 0xdc]
fild qword [esp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
fild qword [esp + 0xc]
fmulp st(1)
fmul qword [0x44c848]
fstp qword [ecx + 0x440]
mov ecx, dword [0x452594]
mov edx, dword [ecx + 0x1160]
mov dword [ecx + edx*4 + 0x1138], eax
mov eax, dword [0x452594]
mov edx, dword [eax + 0x1160]
inc edx
mov dword [eax + 0x1160], edx
mov eax, dword [0x452594]
cmp dword [eax + 0x1160], 0xa
jl 0x41a870
mov dword [eax + 0x1160], 0
mov eax, dword [0x452594]
mov ecx, dword [eax + 0x2c]
mov dword [eax + 0x108], ecx
mov eax, dword [0x452594]
movsx ecx, word [eax + 0x434]
dec ecx
je 0x41a898
dec ecx
jne 0x41a8a8
mov ecx, dword [eax + 0x438]
call fcn.00406740
jmp 0x41a8a3
mov ecx, dword [eax + 0x438]
call fcn.004064b0
mov eax, dword [0x452594]
mov cx, word [eax + 0x434]
cmp cx, di
jne 0x41a8ca
mov ecx, dword [eax + 0x438]
call fcn.00406890
mov edx, dword [0x452594]
mov dword [edx + 0x2c], eax
jmp 0x41a8d5
cmp cx, 1
je 0x41a8da
call fcn.0041cf90
mov eax, dword [0x452594]
mov cl, byte [eax + 0x27]
test cl, cl
je 0x41aa22
cmp word [eax + 0x434], di
jne 0x41a8fe
mov ecx, dword [eax + 0x438]
call fcn.004068b0
mov eax, dword [0x452594]
add eax, 0x150
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x452594]
mov ecx, dword [eax + 0x510]
mov ebx, dword [eax + 0x150]
sub ebx, ecx
mov dword [eax + 0x150], ebx
mov eax, dword [0x452594]
mov edx, dword [eax + 0x514]
mov esi, dword [eax + 0x154]
sub esi, edx
mov dword [eax + 0x154], esi
mov eax, dword [0x452594]
mov ecx, dword [eax + 0x150]
test ecx, ecx
jne 0x41a955
mov ecx, dword [eax + 0x154]
test ecx, ecx
je 0x41a96e
mov ecx, dword [eax + 0x514]
mov edx, dword [eax + 0x510]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
mov eax, dword [0x452594]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov byte [eax + 0x118], 0
mov eax, dword [0x452594]
push 1
cmp word [eax + 0x434], di
jne 0x41a998
mov ecx, dword [eax + 0x438]
call fcn.004068a0
jmp 0x41a99a
call esi
test ax, ax
jge 0x41a9ab
mov eax, dword [0x452594]
or byte [eax + 0x118], 0x10
mov eax, dword [0x452594]
push edi
cmp word [eax + 0x434], di
jne 0x41a9c7
mov ecx, dword [eax + 0x438]
call fcn.004068a0
jmp 0x41a9c9
call esi
test ax, ax
jge 0x41a9da
mov eax, dword [0x452594]
or byte [eax + 0x118], 0x20
mov ecx, dword [0x452594]
xor esi, esi
mov bl, byte [ecx + 0x26]
mov dl, byte [ecx + 0x27]
test bl, bl
lea eax, [ecx + 0x2c]
jbe 0x41aa2d
test dl, 1
je 0x41aa13
mov bl, byte [eax]
and bl, 0xcf
mov byte [eax], bl
mov edi, dword [0x452594]
mov cl, bl
mov bl, byte [edi + 0x118]
or bl, cl
mov byte [eax], bl
mov ecx, dword [0x452594]
xor ebx, ebx
inc eax
mov bl, byte [ecx + 0x26]
shr dl, 1
inc esi
cmp esi, ebx
jl 0x41a9ef
jmp 0x41aa2d
call fcn.0041ac80
mov ecx, dword [0x452594]
mov edx, dword [ecx + 0x114]
mov edi, dword [ecx + 0x110]
mov esi, dword [ecx + 0x2c]
and edx, edi
and edx, esi
mov dword [ecx + 0x2c], edx
mov eax, dword [0x452594]
xor edx, dword [eax + 0x108]
mov dword [eax + 0x10c], edx
mov eax, dword [0x452594]
je 0x41ab09
mov ecx, dword [eax + 0x2c]
and ecx, edx
test ecx, 0xf0f0f0f0
je 0x41aaea
mov cl, byte [eax + 0x26]
xor edi, edi
test cl, cl
jbe 0x41ab09
mov word [eax + 0xe8], di
mov eax, dword [0x452594]
mov bl, byte [eax + edi + 0x10c]
mov byte [esp + 0xc], bl
mov esi, dword [esp + 0xc]
test bl, 0xf0
je 0x41aabb
mov edx, esi
push 0xfffcfff9
and edx, 0xff
push 0
mov dword [eax + 0xec], edx
call fcn.00442560
mov eax, dword [0x452594]
add esp, 8
test bl, 0xf
je 0x41aade
and esi, 0xff
push 0xfffcfff9
mov dword [eax + 0xec], esi
call fcn.004424f0
mov eax, dword [0x452594]
add esp, 4
xor ecx, ecx
inc edi
mov cl, byte [eax + 0x26]
cmp edi, ecx
jl 0x41aa79
jmp 0x41ab09
mov edx, dword [eax + 0x78]
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x41ab09
mov eax, dword [eax + 0x7c]
push 0
add eax, ecx
push eax
call fcn.00442950
mov eax, dword [0x452594]
add esp, 8
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41ab76
mov esi, dword [eax + 0x1278]
mov edi, ecx
xor ebx, ebx
mov word [eax + 0x4bc], bx
mov eax, dword [esi]
cmp eax, ebx
jne 0x41ab31
mov eax, dword [esi + 8]
add esi, 8
cmp eax, ebx
je 0x41ab27
mov eax, dword [esi]
mov ecx, dword [eax + 0x2c]
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x28], ecx
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x41ab56
mov edx, dword [0x452594]
push eax
mov dword [edx + 0x4b8], esi
call dword [esi + 4]
add esp, 4
mov eax, dword [0x452594]
add esi, 8
movsx ecx, word [eax + 0x4bc]
add edi, ecx
mov word [eax + 0x4bc], bx
mov eax, dword [0x452594]
dec edi
jne 0x41ab1a
inc word [eax + 0x1a4]
call fcn.00442790
mov ecx, dword [0x452594]
xor esi, esi
pop ebx
mov eax, dword [ecx + 0x84]
cmp eax, esi
je 0x41abab
test byte [ecx + 0x28], 0x10
jne 0x41abab
push esi
push eax
call fcn.00442950
mov ecx, dword [0x452594]
add esp, 8
cmp dword [ecx + 0x130], esi
je 0x41abb8
call fcn.00442470
call fcn.0041b9b0
call fcn.0041c660
mov edx, dword [0x452594]
mov word [edx + 0x160], 0xffff
mov eax, dword [0x452594]
mov dword [eax + 0x198], esi
mov eax, dword [0x452594]
mov edx, dword [eax + 0x4e0]
inc edx
mov dword [eax + 0x4e0], edx
mov ecx, dword [0x452594]
mov word [ecx + 0x484], si
mov eax, dword [0x452594]
mov ecx, dword [eax + 0x4d8]
dec ecx
mov dword [eax + 0x4d8], ecx
mov ecx, dword [0x452594]
cmp dword [ecx + 0x4d8], esi
jle 0x41ac21
cmp word [ecx + 0x30], si
je 0x41ac2c
call fcn.0041baf0
mov ecx, dword [0x452594]
mov ax, word [ecx + 0x30]
cmp ax, si
jne 0x41ac3f
movsx eax, word [ecx + 0x32]
pop edi
pop esi
add esp, 8
ret
cmp ax, 1
je 0x41ac63
cmp ax, 2
je 0x41ac63
cmp ax, 0xfffe
je 0x41ac63
cmp ax, 3
je 0x41ac63
cmp ax, 0x64
je 0x41ac63
cmp ax, 4
jne 0x41ac76
push 0xfffefffd
call fcn.004424f0
mov ecx, dword [0x452594]
add esp, 4
movsx eax, word [ecx + 0x30]
pop edi
pop esi
add esp, 8
ret