Function at 0x41b3d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x453a14]
sub esp, 8
mov eax, dword [ecx + 0x178]
push esi
test eax, eax
push edi
je 0x41b3ed
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov al, byte [ecx + 0x28]
mov edi, 2
test al, 2
je 0x41b4b1
mov eax, dword [ecx + 0x4d8]
test eax, eax
jg 0x41b514
call fcn.00405300
mov edx, dword [0x453a14]
mov ecx, eax
sub ecx, dword [edx + 0xc0]
jne 0x41b473
mov ax, word [edx + 0x30]
test ax, ax
jne 0x41b433
movsx eax, word [edx + 0x32]
pop edi
pop esi
add esp, 8
ret
cmp ax, 1
je 0x41b456
cmp ax, di
je 0x41b456
cmp ax, 0xfffe
je 0x41b456
cmp ax, 3
je 0x41b456
cmp ax, 0x64
je 0x41b456
cmp ax, 4
jne 0x41b469
push 0xfffefffd
call fcn.00442940
mov edx, dword [0x453a14]
add esp, 4
movsx eax, word [edx + 0x30]
pop edi
pop esi
add esp, 8
ret
mov dword [edx + 0xc0], eax
mov edx, dword [0x453a14]
mov eax, dword [edx + 0x4dc]
add ecx, eax
mov eax, dword [edx + 0xd0]
mov esi, ecx
sub ecx, eax
cmp ecx, 3
jle 0x41b49e
mov ecx, 3
lea esi, [eax + 3]
mov dword [edx + 0x4dc], esi
mov eax, dword [0x453a14]
mov dword [eax + 0x4d8], ecx
jmp 0x41b50e
call fcn.00405300
mov ecx, dword [0x453a14]
cmp eax, dword [ecx + 0xc0]
jne 0x41b4f9
mov edx, dword [0x453a0c]
mov esi, dword [edx + 0x1a8]
test esi, esi
jne 0x41b4f9
mov ax, word [ecx + 0x30]
test ax, ax
jne 0x41b4e7
movsx eax, word [ecx + 0x32]
pop edi
pop esi
add esp, 8
ret
cmp ax, 1
je 0x41ba23
cmp ax, di
jmp 0x41ba09
mov dword [ecx + 0xc0], eax
mov eax, dword [0x453a14]
mov dword [eax + 0x4d8], 1
mov ecx, dword [0x453a14]
mov eax, dword [ecx + 0xa4]
mov edx, dword [ecx + 0xa0]
mov dword [ecx + 0xa0], eax
mov ecx, dword [0x453a14]
push ebx
mov dword [ecx + 0xa4], edx
mov edx, dword [0x453a14]
mov dword [edx + 0x98], eax
mov ecx, dword [0x453a14]
mov edx, dword [ecx + 0x94]
shl edx, 0xa
add edx, eax
mov dword [ecx + 0x9c], edx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [0x453a14]
mov dword [esp + 0x10], 0
mov edx, dword [ecx + 0xd8]
sub eax, edx
mov edx, dword [ecx + 0xd4]
mov dword [ecx + 0xd4], eax
mov ecx, dword [0x453a14]
sub eax, edx
mov dword [ecx + 0xdc], eax
mov ecx, dword [0x453a14]
mov ebx, dword [ecx + 0x50c]
add ebx, eax
mov dword [ecx + 0x50c], ebx
mov ecx, dword [0x453a14]
mov esi, dword [ecx + 0xd0]
inc esi
mov dword [ecx + 0xd0], esi
mov ecx, dword [0x453a14]
mov edx, dword [ecx + 0x1c]
mov edx, dword [edx + 0x96c]
mov dword [esp + 0xc], edx
mov edx, dword [ecx + 0xdc]
fild qword [esp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
fild qword [esp + 0xc]
fmulp st(1)
fmul qword [0x44d490]
fstp qword [ecx + 0x440]
mov ecx, dword [0x453a14]
mov edx, dword [ecx + 0x1160]
mov dword [ecx + edx*4 + 0x1138], eax
mov eax, dword [0x453a14]
mov edx, dword [eax + 0x1160]
inc edx
mov dword [eax + 0x1160], edx
mov eax, dword [0x453a14]
cmp dword [eax + 0x1160], 0xa
jl 0x41b630
mov dword [eax + 0x1160], 0
mov eax, dword [0x453a14]
mov ecx, dword [eax + 0x2c]
mov dword [eax + 0x108], ecx
mov eax, dword [0x453a14]
movsx ecx, word [eax + 0x434]
dec ecx
je 0x41b658
dec ecx
jne 0x41b668
mov ecx, dword [eax + 0x438]
call fcn.004076f0
jmp 0x41b663
mov ecx, dword [eax + 0x438]
call fcn.00407460
mov eax, dword [0x453a14]
mov cx, word [eax + 0x434]
cmp cx, di
jne 0x41b68a
mov ecx, dword [eax + 0x438]
call fcn.00407840
mov edx, dword [0x453a14]
mov dword [edx + 0x2c], eax
jmp 0x41b695
cmp cx, 1
je 0x41b69a
call fcn.0041dd80
mov eax, dword [0x453a14]
mov cl, byte [eax + 0x27]
test cl, cl
je 0x41b7e2
cmp word [eax + 0x434], di
jne 0x41b6be
mov ecx, dword [eax + 0x438]
call fcn.00407860
mov eax, dword [0x453a14]
add eax, 0x150
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x453a14]
mov ecx, dword [eax + 0x510]
mov ebx, dword [eax + 0x150]
sub ebx, ecx
mov dword [eax + 0x150], ebx
mov eax, dword [0x453a14]
mov edx, dword [eax + 0x514]
mov esi, dword [eax + 0x154]
sub esi, edx
mov dword [eax + 0x154], esi
mov eax, dword [0x453a14]
mov ecx, dword [eax + 0x150]
test ecx, ecx
jne 0x41b715
mov ecx, dword [eax + 0x154]
test ecx, ecx
je 0x41b72e
mov ecx, dword [eax + 0x514]
mov edx, dword [eax + 0x510]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
mov eax, dword [0x453a14]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov byte [eax + 0x118], 0
mov eax, dword [0x453a14]
push 1
cmp word [eax + 0x434], di
jne 0x41b758
mov ecx, dword [eax + 0x438]
call fcn.00407850
jmp 0x41b75a
call esi
test ax, ax
jge 0x41b76b
mov eax, dword [0x453a14]
or byte [eax + 0x118], 0x10
mov eax, dword [0x453a14]
push edi
cmp word [eax + 0x434], di
jne 0x41b787
mov ecx, dword [eax + 0x438]
call fcn.00407850
jmp 0x41b789
call esi
test ax, ax
jge 0x41b79a
mov eax, dword [0x453a14]
or byte [eax + 0x118], 0x20
mov ecx, dword [0x453a14]
xor esi, esi
mov bl, byte [ecx + 0x26]
mov dl, byte [ecx + 0x27]
test bl, bl
lea eax, [ecx + 0x2c]
jbe 0x41b7ed
test dl, 1
je 0x41b7d3
mov bl, byte [eax]
and bl, 0xcf
mov byte [eax], bl
mov edi, dword [0x453a14]
mov cl, bl
mov bl, byte [edi + 0x118]
or bl, cl
mov byte [eax], bl
mov ecx, dword [0x453a14]
xor ebx, ebx
inc eax
mov bl, byte [ecx + 0x26]
shr dl, 1
inc esi
cmp esi, ebx
jl 0x41b7af
jmp 0x41b7ed
call fcn.0041ba40
mov ecx, dword [0x453a14]
mov edx, dword [ecx + 0x114]
mov edi, dword [ecx + 0x110]
mov esi, dword [ecx + 0x2c]
and edx, edi
and edx, esi
mov dword [ecx + 0x2c], edx
mov eax, dword [0x453a14]
xor edx, dword [eax + 0x108]
mov dword [eax + 0x10c], edx
mov eax, dword [0x453a14]
je 0x41b8c9
mov ecx, dword [eax + 0x2c]
and ecx, edx
test ecx, 0xf0f0f0f0
je 0x41b8aa
mov cl, byte [eax + 0x26]
xor edi, edi
test cl, cl
jbe 0x41b8c9
mov word [eax + 0xe8], di
mov eax, dword [0x453a14]
mov bl, byte [eax + edi + 0x10c]
mov byte [esp + 0xc], bl
mov esi, dword [esp + 0xc]
test bl, 0xf0
je 0x41b87b
mov edx, esi
push 0xfffcfff9
and edx, 0xff
push 0
mov dword [eax + 0xec], edx
call fcn.004429b0
mov eax, dword [0x453a14]
add esp, 8
test bl, 0xf
je 0x41b89e
and esi, 0xff
push 0xfffcfff9
mov dword [eax + 0xec], esi
call fcn.00442940
mov eax, dword [0x453a14]
add esp, 4
xor ecx, ecx
inc edi
mov cl, byte [eax + 0x26]
cmp edi, ecx
jl 0x41b839
jmp 0x41b8c9
mov edx, dword [eax + 0x78]
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x41b8c9
mov eax, dword [eax + 0x7c]
push 0
add eax, ecx
push eax
call fcn.00442da0
mov eax, dword [0x453a14]
add esp, 8
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41b936
mov esi, dword [eax + 0x1278]
mov edi, ecx
xor ebx, ebx
mov word [eax + 0x4bc], bx
mov eax, dword [esi]
cmp eax, ebx
jne 0x41b8f1
mov eax, dword [esi + 8]
add esi, 8
cmp eax, ebx
je 0x41b8e7
mov eax, dword [esi]
mov ecx, dword [eax + 0x2c]
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x28], ecx
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x41b916
mov edx, dword [0x453a14]
push eax
mov dword [edx + 0x4b8], esi
call dword [esi + 4]
add esp, 4
mov eax, dword [0x453a14]
add esi, 8
movsx ecx, word [eax + 0x4bc]
add edi, ecx
mov word [eax + 0x4bc], bx
mov eax, dword [0x453a14]
dec edi
jne 0x41b8da
inc word [eax + 0x1a4]
call fcn.00442be0
mov ecx, dword [0x453a14]
xor esi, esi
pop ebx
mov eax, dword [ecx + 0x84]
cmp eax, esi
je 0x41b96b
test byte [ecx + 0x28], 0x10
jne 0x41b96b
push esi
push eax
call fcn.00442da0
mov ecx, dword [0x453a14]
add esp, 8
cmp dword [ecx + 0x130], esi
je 0x41b978
call fcn.004428c0
call fcn.0041c7a0
call fcn.0041d450
mov edx, dword [0x453a14]
mov word [edx + 0x160], 0xffff
mov eax, dword [0x453a14]
mov dword [eax + 0x198], esi
mov eax, dword [0x453a14]
mov edx, dword [eax + 0x4e0]
inc edx
mov dword [eax + 0x4e0], edx
mov ecx, dword [0x453a14]
mov word [ecx + 0x484], si
mov eax, dword [0x453a14]
mov ecx, dword [eax + 0x4d8]
dec ecx
mov dword [eax + 0x4d8], ecx
mov ecx, dword [0x453a14]
cmp dword [ecx + 0x4d8], esi
jle 0x41b9e1
cmp word [ecx + 0x30], si
je 0x41b9ec
call fcn.0041c8e0
mov ecx, dword [0x453a14]
mov ax, word [ecx + 0x30]
cmp ax, si
jne 0x41b9ff
movsx eax, word [ecx + 0x32]
pop edi
pop esi
add esp, 8
ret
cmp ax, 1
je 0x41ba23
cmp ax, 2
je 0x41ba23
cmp ax, 0xfffe
je 0x41ba23
cmp ax, 3
je 0x41ba23
cmp ax, 0x64
je 0x41ba23
cmp ax, 4
jne 0x41ba36
push 0xfffefffd
call fcn.00442940
mov ecx, dword [0x453a14]
add esp, 4
movsx eax, word [ecx + 0x30]
pop edi
pop esi
add esp, 8
ret