Function at 0x4100cd
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x60f820
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x668e38
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.0041093d
mov esi, eax
mov eax, dword [0x6be7b0]
xor ebp, ebp
mov eax, dword [eax + 0x1a40]
push ebp
add eax, 0xe0
push ebp
push 0x147
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esi + 0x38e]
mov ebx, dword [edx + eax*4]
fld qword [ebx + 0x5c]
fcomp qword [0x66e938]
fnstsw ax
test ah, 0x41
je 0x61017c
fld qword [ebx + 0x64]
fcomp qword [0x66e938]
fnstsw ax
test ah, 0x41
je 0x61017c
fld qword [ebx + 0x6c]
fcomp qword [0x66e938]
fnstsw ax
test ah, 0x41
je 0x61017c
mov ecx, esi
call fcn.00403bc0
fld qword [ebx + 8]
mov dword [esp + 0x8c], eax
call sub.MSVCRT.dll__ftol
mov dword [edi + 0x1e8], eax
mov eax, dword [esp + 0x8c]
cmp eax, ebp
je 0x60f8e2
fld qword [eax + 0x10]
call sub.MSVCRT.dll__ftol
mov dword [edi + 0x1e8], eax
cmp dword [edi + 0x118], ebp
je 0x60f8f6
mov eax, dword [edi + 0x11c]
mov dword [edi + 0x1e8], eax
push edi
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CClientDC::CClientDC
lea ecx, [esp + 0x68]
mov dword [esp + 0x84], ebp
call sub.MFC42.DLL_CDC::SaveDC
push ebp
push ebp
push 2
mov ecx, edi
mov dword [edi + 0x18c], ebp
call fcn.0040a2f9
mov ecx, dword [esi + 0x50a]
lea eax, [esp + 0x28]
push eax
mov edx, dword [ecx]
call dword [edx]
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov ebx, dword [edx + 8]
mov dword [esp + 0x40], ebx
mov edx, dword [edx + 0xc]
mov dword [esp + 0x44], edx
mov edx, dword [edi + 0x11c]
add edx, 0x13880
cmp eax, edx
jg 0x61007a
mov eax, dword [edi + 0x1ec]
add eax, 0x3e8
cmp ecx, eax
jg 0x61007a
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004037a6
mov edx, eax
mov eax, dword [edx]
cmp eax, ebp
mov dword [esp + 0x28], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x2c], ecx
jle 0x60f99f
mov eax, dword [esi + 0x50a]
mov byte [esp + 0x8c], 1
test byte [eax + 0x70], 1
jne 0x60f9a7
mov byte [esp + 0x8c], 0
cmp ecx, ebp
jle 0x60f9bc
mov ecx, dword [esi + 0x50a]
mov byte [esp + 0x13], 1
test byte [ecx + 0x70], 2
jne 0x60f9c1
mov byte [esp + 0x13], 0
mov eax, dword [edi + 0x20]
lea edx, [esp + 0x48]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x48]
push ecx
mov ecx, edi
call fcn.004024cd
mov edx, dword [esp + 0x94]
mov eax, dword [esp + 0x90]
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
push edx
lea ecx, [esp + 0x4c]
push eax
push ecx
call ebx
test eax, eax
je 0x60ff30
mov ecx, dword [esi + 0x50a]
lea eax, [esp + 0x18]
push eax
mov edx, dword [ecx]
call dword [edx]
mov ecx, eax
mov ebx, dword [sym.imp.zmathdll.dll_public:_void___thiscall_ZPiece::Offset_class_CSize_const__]
mov eax, dword [ecx]
cmp eax, ebp
mov dword [esp + 0x38], eax
mov edx, dword [ecx + 4]
mov dword [esp + 0x3c], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], edx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x44], ecx
jge 0x60fa70
mov cl, byte [esp + 0x8c]
test cl, cl
je 0x60fa51
mov ecx, dword [esp + 0x28]
cdq
idiv ecx
mov eax, dword [esp + 0x38]
add edx, ecx
sub eax, edx
mov ecx, dword [esi + 0x50a]
lea edx, [esp + 0x18]
neg eax
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
call ebx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x38], ebp
mov ecx, dword [edi + 0x1e8]
cmp edx, ecx
mov dword [esp + 0x18], ecx
jle 0x60fac9
cmp ecx, ebp
jle 0x60fac9
mov al, byte [esp + 0x8c]
test al, al
je 0x60faa8
mov ecx, dword [esp + 0x28]
mov eax, edx
cdq
idiv ecx
mov eax, dword [esp + 0x40]
sub ecx, edx
add eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], eax
mov edx, eax
sub ecx, edx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x50a]
push eax
mov dword [esp + 0x20], ebp
call ebx
mov ecx, dword [edi + 0x1e8]
mov dword [esp + 0x40], ecx
mov eax, dword [esp + 0x3c]
cmp eax, ebp
jge 0x60fb07
mov cl, byte [esp + 0x13]
test cl, cl
je 0x60faec
mov ecx, dword [esp + 0x2c]
cdq
idiv ecx
mov eax, dword [esp + 0x3c]
add edx, ecx
sub eax, edx
mov dword [esp + 0x3c], eax
mov ecx, dword [esi + 0x50a]
lea edx, [esp + 0x18]
neg eax
push edx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
call ebx
mov dword [esp + 0x3c], ebp
mov eax, dword [edi + 0x1ec]
mov ecx, dword [esp + 0x44]
cmp ecx, eax
mov dword [esp + 0x18], eax
jle 0x60fb5f
mov dl, byte [esp + 0x13]
test dl, dl
je 0x60fb3e
mov eax, ecx
mov ecx, dword [esp + 0x2c]
cdq
idiv ecx
mov eax, dword [esp + 0x44]
sub ecx, edx
add eax, ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x44]
sub eax, ecx
mov ecx, dword [esi + 0x50a]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ebp
call ebx
mov ecx, dword [edi + 0x1ec]
mov dword [esp + 0x44], ecx
push 0x41
mov ebp, 0xf
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x60fbd8
mov edx, dword [esi + 0x50a]
mov ecx, edi
push edx
call fcn.0040d71f
test eax, eax
je 0x60fd26
mov ecx, dword [esi + 0x1a15]
lea edx, [esp + 0x58]
push edx
mov eax, dword [ecx]
call dword [eax]
mov ecx, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], 0
mov edx, dword [ecx + 8]
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov ecx, dword [ecx + 0xc]
push edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x3c]
sub eax, ecx
mov ecx, dword [esi + 0x50a]
mov dword [esp + 0x1c], eax
call ebx
mov ebp, 0xe
jmp 0x60fd26
push 0x53
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x60fc4c
mov eax, dword [esi + 0x50a]
mov ecx, edi
push eax
call fcn.0040d71f
test eax, eax
je 0x60fd26
mov ecx, dword [esi + 0x1a15]
lea eax, [esp + 0x58]
push eax
mov edx, dword [ecx]
call dword [edx]
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x18]
mov eax, dword [ecx + 4]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x44]
sub eax, ecx
mov ecx, dword [esi + 0x50a]
mov dword [esp + 0x1c], eax
call ebx
mov ebp, 0xd
jmp 0x60fd26
push 0x57
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x60fcbd
mov eax, dword [esi + 0x50a]
mov ecx, edi
push eax
call fcn.0040d71f
test eax, eax
je 0x60fd26
mov ecx, dword [esi + 0x1a15]
lea eax, [esp + 0x58]
push eax
mov edx, dword [ecx]
call dword [edx]
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov ecx, dword [ecx + 0xc]
push edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
sub eax, ecx
mov ecx, dword [esi + 0x50a]
mov dword [esp + 0x20], eax
call ebx
mov ebp, 0xb
jmp 0x60fd26
push 0x5a
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x60fd26
mov eax, dword [esi + 0x50a]
mov ecx, edi
push eax
call fcn.0040d71f
test eax, eax
je 0x60fd26
mov ecx, dword [esi + 0x1a15]
lea eax, [esp + 0x58]
push eax
mov edx, dword [ecx]
call dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], 0
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x18]
mov ecx, dword [eax + 8]
push edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x48]
mov eax, dword [eax + 0xc]
sub eax, ecx
mov ecx, dword [esi + 0x50a]
mov dword [esp + 0x20], eax
call ebx
mov ebp, 7
mov eax, dword [edi + 0x1e8]
mov ecx, dword [esp + 0x40]
cmp ecx, eax
jne 0x60fd3d
test eax, eax
jle 0x60fd3d
and ebp, 0xfffffffd
jmp 0x60fd5a
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x60fe94
mov eax, dword [esp + 0x44]
mov ecx, dword [edi + 0x1ec]
cmp eax, ecx
jne 0x60fd5a
and ebp, 0xfffffff7
mov ecx, dword [esi + 0x50a]
push ebp
push ecx
mov ecx, edi
call fcn.00403b61
mov ebx, eax
mov dword [esp + 0x18], 0
test ebx, ebx
jne 0x60fd96
mov edx, dword [esi + 0x50a]
push ebp
push edx
mov ecx, edi
call fcn.00403b61
mov ebx, eax
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 4
mov dword [esp + 0x18], eax
jl 0x60fd73
mov ecx, dword [esi + 0x50a]
lea edx, [esp + 0x58]
push edx
mov eax, dword [ecx]
call dword [eax]
mov edx, eax
test ebx, ebx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov ebp, dword [edx + 8]
mov edx, dword [edx + 0xc]
je 0x60feb7
xor ebx, ebx
cmp eax, ebx
jl 0x60feb7
cmp ecx, ebx
jl 0x60feb7
cmp edx, dword [edi + 0x1ec]
jg 0x60feb7
mov eax, dword [edi + 0x1e8]
cmp eax, ebx
jle 0x60fdea
cmp ebp, eax
jg 0x60feb7
lea eax, [edi + 0x19c]
push ebx
push eax
mov ecx, esi
call fcn.004039d1
mov ecx, dword [esi + 0x50a]
mov dword [edi + 0x1f8], ecx
mov edx, dword [esi + 0x50a]
mov ecx, esi
mov dword [edx + 0x1f0], ebx
mov dword [esi + 0x50a], ebx
call fcn.0040213f
cmp dword [edi + 0x210], ebx
je 0x60fe9c
mov eax, dword [edi + 0x200]
push 1
push ebx
mov ecx, dword [eax]
mov dword [esi + 0x50a], ecx
lea ecx, [edi + 0x1fc]
call sub.MFC42.DLL_CPtrArray::RemoveAt
cmp dword [edi + 0x204], ebx
jne 0x60fe50
mov dword [edi + 0x210], ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CDC::RestoreDC
mov edx, dword [edi + 0x20]
mov eax, 0x7fffffff
push 1
mov ecx, eax
push ebx
mov dword [edi + 0x120], eax
push edx
mov dword [edi + 0x124], ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x68]
mov dword [esp + 0x84], 0xffffffff
call fcn.0063d950
jmp 0x61019b
and ebp, 0xfffffffb
jmp 0x60fd5a
mov eax, dword [edi + 0x20]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, edi
call fcn.00402c52
xor ebp, ebp
jmp 0x60ff96
mov ecx, dword [esi + 0x50a]
lea eax, [esp + 0x18]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov al, byte [esp + 0x8c]
test al, al
je 0x60fef0
mov ebp, dword [esp + 0x90]
mov eax, ebp
sub eax, ecx
cdq
idiv dword [esp + 0x28]
sub ebp, edx
mov dword [esp + 0x90], ebp
mov al, byte [esp + 0x13]
test al, al
je 0x60ff11
mov ecx, dword [esp + 0x94]
mov eax, ecx
sub eax, ebx
cdq
idiv dword [esp + 0x2c]
sub ecx, edx
mov dword [esp + 0x94], ecx
lea ecx, [esp + 0x90]
push ecx
mov ecx, dword [esi + 0x50a]
call dword [sym.imp.zmathdll.dll_public:_void___thiscall_ZPiece::MoveTo_class_CPoint_const__]
push 0
push 0
push 0
jmp 0x61003c
mov eax, dword [edi + 0x20]
lea edx, [esp + 0x48]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
call ebx
test eax, eax
je 0x610039
mov ecx, esi
call fcn.00408076
mov ecx, dword [esi + 0x50a]
mov ebx, eax
push ecx
mov ecx, esi
call fcn.00402617
push eax
mov ecx, edi
call fcn.004084b3
mov ecx, esi
call fcn.00408076
dec ebx
cmp eax, ebx
jge 0x60ff96
mov edx, dword [edi + 0x20]
push 1
push ebp
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 0x7fffffff
mov dword [esi + 0x50a], ebp
mov ecx, eax
mov dword [edi + 0x120], eax
mov dword [edi + 0x124], ecx
push 0xffffffffffffffff
lea ecx, [esp + 0x6c]
mov dword [edi + 0x198], ebp
call sub.MFC42.DLL_CDC::RestoreDC
lea ecx, [esp + 0x14]
mov dword [esi + 0x1043], ebp
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x14]
mov ecx, esi
push eax
mov byte [esp + 0x88], 2
call fcn.00410df2
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x90], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, esi
call fcn.00403058
mov eax, 1
lea ecx, [esp + 0x14]
mov dword [esi + 0x1043], eax
mov dword [esi + 0x1b45], eax
mov byte [esp + 0x84], 0
call fcn.0063d7fa
lea ecx, [esp + 0x68]
mov dword [esp + 0x84], 0xffffffff
call fcn.0063d950
jmp 0x61019b
push ebp
push ebp
push ebp
mov ecx, edi
call fcn.0040a2f9
push 0xffffffffffffffff
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CDC::RestoreDC
mov eax, 0x7fffffff
mov ecx, eax
mov dword [edi + 0x120], eax
mov dword [edi + 0x124], ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x84], 0xffffffff
call fcn.0063d950
jmp 0x61019b
mov eax, 0x7fffffff
mov dword [edi + 0x198], ebp
mov ecx, eax
mov dword [edi + 0x120], eax
mov dword [edi + 0x124], ecx
mov eax, dword [esi + 0x50a]
mov dword [eax + 0x1f0], 2
mov dword [esi + 0x50a], ebp
cmp dword [edi + 0x210], ebp
je 0x6100f8
mov ecx, dword [edi + 0x200]
push 1
push ebp
mov edx, dword [ecx]
lea ecx, [edi + 0x1fc]
mov dword [esi + 0x50a], edx
call sub.MFC42.DLL_CPtrArray::RemoveAt
cmp dword [edi + 0x204], ebp
jne 0x6100db
mov dword [edi + 0x210], ebp
push 0xffffffffffffffff
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CDC::RestoreDC
mov eax, dword [edi + 0x20]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x610061
mov ecx, dword [edi + 0x20]
mov ebx, 1
push ebx
push ebp
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x8c]
mov dword [esi + 0x1043], ebp
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x8c]
mov ecx, esi
push edx
mov byte [esp + 0x88], bl
call fcn.00410df2
push ecx
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, esi
call fcn.00403058
push 0xffffffffffffffff
lea ecx, [esp + 0x6c]
mov dword [esi + 0x1043], ebx
mov dword [esi + 0x1b45], ebx
call sub.MFC42.DLL_CDC::RestoreDC
lea ecx, [esp + 0x8c]
mov byte [esp + 0x84], 0
call fcn.0063d7fa
jmp 0x610061
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
mov eax, dword [esp + 0x8c]
push ecx
push edx
push eax
mov ecx, edi
call fcn.0040536c
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x78
ret 0xc