Function at 0x4cc730
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x4c]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4ccfa1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x4e3bf0]
mov eax, dword [eax]
xor edx, edx
call fcn.00460094
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x30]
xor edx, edx
xor eax, eax
call fcn.0041b0e8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
push 0
push 0x32
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004c8bc8
test eax, eax
jle 0x4cc863
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004c8bc8
mov edx, eax
dec edx
mov eax, ebx
call fcn.004c8bd0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4cc84f
mov eax, esi
call fcn.004c8bc8
cmp ebx, eax
jge 0x4cc84f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004c8bd0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4cc83b
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004c8bc8
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4cc83b
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004c8bd0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4cc84f
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004cbca8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4cc879
mov eax, ebx
call fcn.00447c80
call fcn.004786e8
mov byte [ebp - 6], 1
jmp 0x4ccf5e
cmp byte [ebp - 6], 0
jne 0x4cc88d
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4ccf3d
mov eax, dword [edi + 4]
cmp eax, 0x113
jg 0x4cc8c5
je 0x4cc9c5
sub eax, 0x12
je 0x4cc9b9
sub eax, 0x34
je 0x4cc8d6
add eax, 0xffffffa5
sub eax, 9
jb 0x4cc9b9
jmp 0x4cca57
sub eax, 0x201
je 0x4cc8e7
sub eax, 3
je 0x4cc8e7
jmp 0x4cca57
push ebp
call fcn.004cc6dc
pop ecx
call fcn.004040e8
jmp 0x4ccfa8
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407c18
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00441100
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4cc966
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4cc966
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
jmp 0x4cca57
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4cc998
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00441100
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4cc995
mov bl, 1
mov esi, dword [esi + 0x68]
test esi, esi
je 0x4cc9a0
test bl, bl
je 0x4cc96d
test bl, bl
jne 0x4cca57
push ebp
call fcn.004cc6dc
pop ecx
call fcn.004040e8
jmp 0x4ccfa8
push ebp
call fcn.004cc6dc
pop ecx
jmp 0x4ccf3d
cmp dword [edi], 0
jne 0x4cca57
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_GetCursorPos
test eax, eax
je 0x4cca57
add dword [ebp - 0x1c], 0x32
lea edx, [ebp - 0x28]
mov eax, dword [0x4e3bb4]
mov eax, dword [eax]
call fcn.0044c41c
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jne 0x4cca46
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jne 0x4cca46
cmp dword [ebp - 0x1c], 0x1f4
jl 0x4cca4b
mov esi, dword [ebp - 4]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.00440f5c
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4cca3f
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4cca4b
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4ccf3d
mov eax, dword [edi + 4]
mov edx, eax
sub edx, 0x7b
je 0x4ccf3d
add edx, 0xffffff7b
sub edx, 9
jb 0x4ccaae
add edx, 0xffffff09
sub edx, 0xb
jb 0x4ccd6f
sub edx, 0x264
jne 0x4ccf37
mov eax, dword [ebp - 4]
call fcn.004cc38c
jmp 0x4ccf3d
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4ccf3d
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4ccae4
sub eax, 2
je 0x4ccd16
sub eax, 2
je 0x4ccae4
sub eax, 2
je 0x4ccd16
jmp 0x4ccf3d
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4ccb27
je 0x4ccbd9
cmp eax, 0x12
jg 0x4ccb10
je 0x4cccff
sub eax, 9
je 0x4ccf3d
sub eax, 4
je 0x4ccb4c
jmp 0x4ccd0b
sub eax, 0x1b
je 0x4ccbb1
sub eax, 5
je 0x4ccf3d
add al, 0
invalid
jmp 0x4ccd0b
sub eax, 0x26
je 0x4cccc2
dec eax
je 0x4ccc43
dec eax
je 0x4cccdc
sub eax, 0x51
je 0x4cccff
jmp 0x4ccd0b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4ccb5f
mov si, 0xffef
call fcn.00403a6c
mov eax, dword [ebp - 4]
call fcn.004cc38c
test al, al
jne 0x4ccf3d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4ccf3d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4ccfb8
call fcn.00405054
je 0x4ccf3d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4ccf3d
push ebp
call fcn.004cc6dc
pop ecx
jmp 0x4ccf3d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4ccbbf
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.004040e8
jmp 0x4ccfa8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4ccbef
mov eax, dword [ebp - 4]
call fcn.004cc59c
jmp 0x4ccf3d
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x68]
test ebx, ebx
je 0x4ccf3d
cmp byte [ebx + 0x34], 0
je 0x4ccc24
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
call fcn.004040e8
jmp 0x4ccfa8
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
jmp 0x4ccf3d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4ccc59
mov eax, dword [ebp - 4]
call fcn.004cc46c
jmp 0x4ccf3d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4ccf3d
mov eax, dword [ebp - 4]
call fcn.004cc38c
test al, al
jne 0x4ccf3d
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x68]
cmp byte [ebx + 0x34], 0
je 0x4ccca3
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
call fcn.004040e8
jmp 0x4ccfa8
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
jmp 0x4ccf3d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4ccf3d
mov eax, dword [ebp - 4]
call fcn.004cc59c
jmp 0x4ccf3d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4cccf2
mov eax, dword [ebp - 4]
call fcn.004cc46c
jmp 0x4ccf3d
mov eax, dword [ebp - 4]
call fcn.004cc38c
jmp 0x4ccf3d
push ebp
call fcn.004cc6dc
pop ecx
jmp 0x4ccf3d
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4ccf3d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004cb19c
test eax, eax
je 0x4ccf3d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004cb19c
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
test ebx, ebx
je 0x4ccd50
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
jmp 0x4ccf3d
sub eax, 0x200
je 0x4ccd84
sub eax, 2
je 0x4cce74
jmp 0x4ccf3d
xor eax, eax
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407c18
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x4e85f0]
jne 0x4ccdba
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x4e85f4]
je 0x4ccf3d
mov esi, dword [ebp - 4]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.00440f5c
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4ccde7
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004cbca8
jmp 0x4cce5d
mov esi, dword [ebp - 4]
jmp 0x4ccdee
mov esi, eax
mov eax, dword [esi + 0x68]
test eax, eax
jne 0x4ccdec
test esi, esi
je 0x4cce5d
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004cbca8
cmp ebx, dword [esi + 0x40]
je 0x4cce56
cmp esi, dword [ebp - 4]
je 0x4cce56
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x4cce35
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x68]
cmp esi, ebx
jne 0x4cce17
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
call fcn.004040e8
jmp 0x4ccfa8
mov esi, dword [esi + 0x6c]
test esi, esi
jne 0x4ccdf9
mov eax, dword [ebp - 0xe]
mov dword [0x4e85f0], eax
mov eax, dword [ebp - 0xa]
mov dword [0x4e85f4], eax
jmp 0x4ccf3d
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407c18
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00441100
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4ccef0
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4ccef0
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00447c80
push eax
call sub.user32.dll_PostMessageA
jmp 0x4ccf3d
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4ccf22
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00441100
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4ccf1f
mov bl, 1
mov esi, dword [esi + 0x68]
test esi, esi
je 0x4ccf2a
test bl, bl
je 0x4ccef7
test bl, bl
jne 0x4ccf3d
push ebp
call fcn.004cc6dc
pop ecx
jmp 0x4ccf3d
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004cc708
pop ecx
test al, al
je 0x4ccf5e
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4cc896
push ebp
call fcn.004cc708
pop ecx
test al, al
jne 0x4cc882
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccfa8
mov eax, dword [ebp - 0x20]
push eax
push 0
call sub.user32.dll_KillTimer
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4ccf94
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.00478708
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret