Function at 0x4de1b0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x4c]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4dea21
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x542850]
mov eax, dword [eax]
xor edx, edx
call fcn.00460390
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x30]
xor edx, edx
xor eax, eax
call fcn.0041a66c
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
push 0
push 0x32
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004da648
test eax, eax
jle 0x4de2e3
mov ebx, dword [ebp - 4]
mov esi, dword [ebx + 0x30]
mov eax, esi
call fcn.004da648
mov edx, eax
mov eax, esi
dec edx
call fcn.004da650
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
or ebx, ebx
jl 0x4de2cf
mov eax, esi
call fcn.004da648
cmp ebx, eax
jge 0x4de2cf
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004da650
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4de2bb
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004da648
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4de2bb
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
inc edx
call fcn.004da650
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
or eax, eax
je 0x4de2cf
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004dd728
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
or ebx, ebx
je 0x4de2f9
mov eax, ebx
call fcn.00447ed4
call fcn.00478730
mov byte [ebp - 6], 1
jmp 0x4de9de
cmp byte [ebp - 6], 0
jne 0x4de30d
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4de9bd
mov eax, dword [edi + 4]
cmp eax, 0x113
jg 0x4de345
je 0x4de445
sub eax, 0x12
je 0x4de439
sub eax, 0x34
je 0x4de356
add eax, 0xffffffa5
sub eax, 9
jb 0x4de439
jmp 0x4de4d7
sub eax, 0x201
je 0x4de367
sub eax, 3
je 0x4de367
jmp 0x4de4d7
push ebp
call fcn.004de15c
pop ecx
call fcn.00404270
jmp 0x4dea28
mov eax, dword [edi + 0xc]
lea edx, [ebp - 0xe]
call fcn.00407fb4
lea ebx, [ebp - 0xe]
push ebx
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
lea ecx, [ebp - 0x54]
mov eax, dword [ebp - 0xe]
lea edx, [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044133c
mov ebx, dword [ebp - 0x54]
mov dword [ebp - 0xe], ebx
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0xa], ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
or ebx, ebx
je 0x4de3e6
lea eax, [ebx + 0x95]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4de3e6
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
jmp 0x4de4d7
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4de418
lea edx, [ebp - 0x16]
lea ecx, [ebp - 0xe]
mov eax, dword [esi + 0x3c]
call fcn.0044133c
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
sub eax, 0xffffff6b
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4de415
mov bl, 1
mov esi, dword [esi + 0x68]
test esi, esi
je 0x4de420
or bl, bl
je 0x4de3ed
test bl, bl
jne 0x4de4d7
push ebp
call fcn.004de15c
pop ecx
call fcn.00404270
jmp 0x4dea28
push ebp
call fcn.004de15c
pop ecx
jmp 0x4de9bd
cmp dword [edi], 0
jne 0x4de4d7
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_GetCursorPos
test eax, eax
je 0x4de4d7
sub dword [ebp - 0x1c], 0xffffffce
lea edx, [ebp - 0x28]
mov eax, dword [0x5427e4]
mov eax, dword [eax]
call fcn.0044c670
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jne 0x4de4c6
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jne 0x4de4c6
cmp dword [ebp - 0x1c], 0x1f4
jl 0x4de4cb
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x64]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov eax, dword [esi + 0x3c]
call fcn.00441198
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4de4bf
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4de4cb
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
or eax, eax
je 0x4de9bd
mov eax, dword [edi + 4]
mov edx, eax
sub edx, 0x7b
je 0x4de9bd
sub edx, 0x85
sub edx, 9
jb 0x4de52e
add edx, 0xffffff09
sub edx, 0xb
jb 0x4de7ef
sub edx, 0x264
jne 0x4de9b7
mov eax, dword [ebp - 4]
call fcn.004dde0c
jmp 0x4de9bd
push 1
call sub.user32.dll_GetKeyState
or ax, ax
jl 0x4de9bd
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4de564
sub eax, 2
je 0x4de796
sub eax, 2
je 0x4de564
sub eax, 2
je 0x4de796
jmp 0x4de9bd
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4de5a7
je 0x4de659
cmp eax, 0x12
jg 0x4de590
je 0x4de77f
sub eax, 9
je 0x4de9bd
sub eax, 4
je 0x4de5cc
jmp 0x4de78b
sub eax, 0x1b
je 0x4de631
sub eax, 5
je 0x4de9bd
jmp 0x4de78b
sub eax, 0x26
je 0x4de742
dec eax
je 0x4de6c3
dec eax
je 0x4de75c
sub eax, 0x51
je 0x4de77f
jmp 0x4de78b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4de5df
mov si, 0xffef
call fcn.00403bf4
mov eax, dword [ebp - 4]
call fcn.004dde0c
test al, al
jne 0x4de9bd
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4de9bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4dea38
call fcn.00405208
je 0x4de9bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4de9bd
push ebp
call fcn.004de15c
pop ecx
jmp 0x4de9bd
mov edi, dword [ebp - 4]
mov edi, dword [edi + 0x68]
test edi, edi
je 0x4de63f
mov byte [edi + 0x44], 0
xor edi, edi
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x40], edi
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.00404270
jmp 0x4dea28
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4de66f
mov eax, dword [ebp - 4]
call fcn.004de01c
jmp 0x4de9bd
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x68]
or ebx, ebx
je 0x4de9bd
cmp byte [ebx + 0x34], 0
je 0x4de6a4
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
call fcn.00404270
jmp 0x4dea28
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
jmp 0x4de9bd
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4de6d9
mov eax, dword [ebp - 4]
call fcn.004ddeec
jmp 0x4de9bd
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4de9bd
mov eax, dword [ebp - 4]
call fcn.004dde0c
test al, al
jne 0x4de9bd
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x68]
cmp byte [ebx + 0x34], 0
je 0x4de723
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
call fcn.00404270
jmp 0x4dea28
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
jmp 0x4de9bd
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4de9bd
mov eax, dword [ebp - 4]
call fcn.004de01c
jmp 0x4de9bd
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4de772
mov eax, dword [ebp - 4]
call fcn.004ddeec
jmp 0x4de9bd
mov eax, dword [ebp - 4]
call fcn.004dde0c
jmp 0x4de9bd
push ebp
call fcn.004de15c
pop ecx
jmp 0x4de9bd
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4de9bd
mov eax, dword [ebp - 4]
mov dl, byte [edi + 8]
mov eax, dword [eax + 0x30]
call fcn.004dcc1c
or eax, eax
je 0x4de9bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004dcc1c
mov ebx, eax
test ebx, ebx
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
je 0x4de7d0
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
jmp 0x4de9bd
sub eax, 0x200
je 0x4de804
sub eax, 2
je 0x4de8f4
jmp 0x4de9bd
lea edx, [ebp - 0xe]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0xc]
call fcn.00407fb4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x54757c]
jne 0x4de83a
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x547580]
je 0x4de9bd
lea edx, [ebp - 0x64]
mov esi, dword [ebp - 4]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x3c]
call fcn.00441198
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
or eax, eax
je 0x4de867
mov eax, esi
lea edx, [ebp - 0xe]
call fcn.004dd728
jmp 0x4de8dd
mov esi, dword [ebp - 4]
jmp 0x4de86e
mov esi, eax
mov eax, dword [esi + 0x68]
test eax, eax
jne 0x4de86c
test esi, esi
je 0x4de8dd
mov eax, esi
lea edx, [ebp - 0xe]
mov ebx, dword [esi + 0x40]
call fcn.004dd728
cmp ebx, dword [esi + 0x40]
je 0x4de8d6
cmp esi, dword [ebp - 4]
je 0x4de8d6
mov edi, dword [ebp - 4]
cmp esi, edi
je 0x4de8b5
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [edi + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
mov edi, dword [edi + 0x68]
cmp esi, edi
jne 0x4de897
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
call fcn.00404270
jmp 0x4dea28
mov esi, dword [esi + 0x6c]
test esi, esi
jne 0x4de879
mov eax, dword [ebp - 0xe]
mov dword [0x54757c], eax
mov eax, dword [ebp - 0xa]
mov dword [0x547580], eax
jmp 0x4de9bd
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407fb4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
lea edx, [ebp - 0xe]
lea ecx, [ebp - 0x54]
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov ebx, dword [ebp - 0xa]
mov dword [ebp - 0x12], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044133c
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
or ebx, ebx
je 0x4de970
lea eax, [ebx + 0x95]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
push eax
call sub.user32.dll_PtInRect
or eax, eax
je 0x4de970
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447ed4
push eax
call sub.user32.dll_PostMessageA
jmp 0x4de9bd
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4de9a2
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.0044133c
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
or eax, eax
je 0x4de99f
mov bl, 1
mov esi, dword [esi + 0x68]
or esi, esi
je 0x4de9aa
test bl, bl
je 0x4de977
test bl, bl
jne 0x4de9bd
push ebp
call fcn.004de15c
pop ecx
jmp 0x4de9bd
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004de188
pop ecx
test al, al
je 0x4de9de
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4de316
push ebp
call fcn.004de188
pop ecx
or al, al
jne 0x4de302
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dea28
mov eax, dword [ebp - 0x20]
push eax
push 0
call sub.user32.dll_KillTimer
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4dea14
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.00478750
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret