Function at 0x418e70
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
mov esi, dword [esp + 0x228]
mov ecx, dword [esi*4 + 0xd610f0]
lea eax, [esi*4 + 0xd610a0]
mov dword [esp + 0x18], eax
mov eax, dword [eax]
mov dword [0x457884], eax
lea eax, [esi*4 + 0xd610f0]
lea ebp, [esi + esi*4]
push edi
xor edi, edi
mov dword [esp + 0x20], eax
shl ebp, 3
lea eax, [ebp + 0xd60d80]
push eax
push 0x455748
mov dword [0x45788c], edi
mov dword [0x457878], edi
mov dword [0x45787c], edi
mov dword [0x457880], edi
mov dword [0x457554], edi
mov dword [0x457888], ecx
mov word [0x455748], di
mov dword [esp + 0x2c], eax
call fcn.00423280
mov edx, dword [esi*4 + 0x8efc90]
add esp, 8
lea eax, [esi*4 + 0x8efc90]
push 0x48
mov dword [esp + 0x1c], eax
mov eax, dword [0x4341ec]
push 0x5a
push eax
mov dword [0x457878], edx
mov dword [0x908dd0], 0x4188a0
mov dword [0x4578b4], edi
mov dword [0x4578b8], edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 0xc
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, eax
lea esp, [esp]
call fcn.00405ca0
cmp dword [0xc27124], 1
je 0x4192a8
call fcn.0041f360
cmp eax, 0x20
mov dword [0x45788c], eax
jne 0x418f73
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x418f78
mov eax, dword [0x45788c]
cmp eax, 0x15
jne 0x418fbf
push edi
push 0x455748
push edi
push 0xffffffffffffff9c
push 0xffffffffffffff9c
call fcn.00409740
mov eax, dword [0x434244]
add esp, 0x14
cmp eax, edi
jne 0x418faa
push 1
call fcn.00407c40
add esp, 4
xor eax, eax
mov dword [0x45788c], eax
jmp 0x4191d3
push edi
call fcn.00407c40
add esp, 4
xor eax, eax
mov dword [0x45788c], eax
jmp 0x4191d3
cmp eax, 0x1b
je 0x4192a8
cmp eax, 9
jne 0x418ffb
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov eax, dword [0x45787c]
mov ecx, 6
je 0x418fe9
add eax, 5
jmp 0x418fea
inc eax
cdq
idiv ecx
push edx
call fcn.00417c90
mov eax, dword [0x45788c]
add esp, 4
cmp eax, 0xfffffffd
jne 0x4190f6
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x4596d8]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x10]
cmp eax, 0x181
mov ecx, dword [esp + 0x14]
jle 0x41905e
cmp ecx, 0x183
jle 0x41905e
cmp eax, 0x1e6
jge 0x41905e
cmp ecx, 0x19b
jge 0x41905e
mov dword [0x4578b4], 1
call fcn.004188a0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, 0x1f1
jle 0x419093
cmp ecx, 0x183
jle 0x419093
cmp eax, 0x257
jge 0x419093
cmp ecx, 0x19b
jge 0x419093
mov dword [0x4578b8], 1
call fcn.004188a0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, 0xd7
jle 0x4190f1
cmp ecx, 0x14f
jle 0x4190f1
cmp eax, 0x1a4
jge 0x4190f1
cmp ecx, 0x16d
jge 0x4190f1
lea ecx, [eax - 0xd7]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0xff00
push 0xdf
lea edx, [eax + eax*2]
mov dword [0x457878], eax
mov eax, dword [edx*4 + 0x908e20]
push 0x1c5
push eax
call fcn.00406210
add esp, 0x10
mov eax, dword [0x45788c]
cmp eax, 0xfffffffe
jne 0x4191d3
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4596d8]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x10]
cmp ecx, 0xd7
mov eax, dword [esp + 0x14]
jle 0x419169
cmp eax, 0xf5
jle 0x419169
cmp ecx, 0x19f
jge 0x419169
cmp eax, 0x12c
jge 0x419169
lea ecx, [eax - 0xf5]
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
call fcn.00417c90
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add esp, 4
cmp ecx, 0x181
jle 0x4191a0
cmp eax, 0x183
jle 0x4191a0
cmp ecx, 0x1e6
jge 0x4191a0
cmp eax, 0x19b
jge 0x4191a0
push edi
call fcn.00417c90
add esp, 4
test eax, eax
je 0x419471
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp ecx, 0x1f1
jle 0x4191c2
cmp eax, 0x183
jle 0x4191c2
cmp ecx, 0x257
jge 0x4191c2
cmp eax, 0x19b
jl 0x4192a8
mov eax, dword [0x45788c]
mov dword [0x4578b4], edi
mov dword [0x4578b8], edi
mov ecx, dword [0x45787c]
cmp ecx, 5
jne 0x4191f2
cmp eax, 0xd
jne 0x418f40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
cmp ecx, 4
jne 0x4192b3
cmp eax, 0xd
jne 0x418f40
push esi
push 0x42cadc
lea ecx, [esp + 0x30]
push ecx
call fcn.004231fe
imul esi, esi, 0x190
mov edx, dword [0x457550]
mov eax, dword [0x430bb0]
mov ecx, dword [0x434244]
add esi, 0xc25078
push esi
push edx
push eax
mov eax, dword [0x457878]
push ecx
mov ecx, dword [0x457888]
lea edx, [ebp + 0xd611e0]
push edx
mov edx, dword [0x457884]
push 0xc27128
push edi
push edi
push eax
push ecx
push edx
lea eax, [esp + 0x60]
push 0x457348
push eax
call fcn.00415fd0
mov eax, dword [esp + 0x64]
add esp, 0x40
push 0x457348
push eax
mov word [eax], di
call fcn.00423280
mov ecx, dword [0x457884]
mov edx, dword [esp + 0x24]
mov eax, dword [0x457888]
mov dword [edx], ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [0x457878]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
add esp, 8
mov dword [eax], edx
mov word [0x455748], di
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
cmp ecx, 3
jne 0x419322
cmp eax, 0x27
jne 0x4192e3
mov eax, dword [0x457878]
inc eax
cmp eax, 5
mov dword [0x457878], eax
jle 0x4192d3
mov dword [0x457878], edi
mov dword [0x45788c], edi
call fcn.004188a0
mov eax, dword [0x45788c]
cmp eax, 0x25
jne 0x41930a
dec dword [0x457878]
jns 0x4192fa
mov dword [0x457878], 5
mov dword [0x45788c], edi
call fcn.004188a0
mov eax, dword [0x45788c]
cmp eax, 0xd
jne 0x418f40
push 4
call fcn.00417c90
add esp, 4
jmp 0x418f40
cmp ecx, 1
jne 0x419391
push 0x455748
call fcn.004231e8
add esp, 4
cmp eax, 2
jbe 0x41934e
mov eax, dword [0x45788c]
cmp eax, 0xd
je 0x41934e
cmp eax, 8
je 0x41934e
mov dword [0x45788c], edi
push 0x42c2bc
push edi
push ebx
call fcn.00405ec0
mov edx, dword [0x45788c]
push edx
push 0x455748
push edi
push 0x107
push 0x145
call fcn.00409740
add esp, 0x20
test eax, eax
je 0x419387
push 2
call fcn.00417c90
add esp, 4
call fcn.00405f40
jmp 0x418f40
cmp ecx, edi
jne 0x4193fe
push 0x455748
call fcn.00417bd0
add esp, 4
cmp eax, 0xa
jl 0x4193bc
mov eax, dword [0x45788c]
cmp eax, 0xd
je 0x4193bc
cmp eax, 8
je 0x4193bc
mov dword [0x45788c], edi
push 0x42c2bc
push edi
push ebx
call fcn.00405ec0
mov eax, dword [0x45788c]
push eax
push 0x455748
push edi
push 0xf5
push 0x145
call fcn.00409740
add esp, 0x20
test eax, eax
je 0x4193f4
push 1
call fcn.00417c90
add esp, 4
call fcn.00405f40
jmp 0x418f40
cmp ecx, 2
jne 0x418f40
push 0x455748
call fcn.004231e8
add esp, 4
cmp eax, 2
jbe 0x41942e
mov eax, dword [0x45788c]
cmp eax, 0xd
je 0x41942e
cmp eax, 8
je 0x41942e
mov dword [0x45788c], edi
push 0x42c2bc
push edi
push ebx
call fcn.00405ec0
mov ecx, dword [0x45788c]
push ecx
push 0x455748
push edi
push 0x119
push 0x145
call fcn.00409740
add esp, 0x20
test eax, eax
je 0x419467
push 3
call fcn.00417c90
add esp, 4
call fcn.00405f40
jmp 0x418f40
push edi
push edi
push 0x100
lea edx, [esp + 0x134]
push edx
push 0xffffffffffffffff
push 0x457348
push 0x200
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x128]
push eax
push str._s.dat
jmp 0x41920a