Function at 0x4aab0c
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, 0x5168bc
cmp byte [esi], 0
je 0x4aab2e
push esi
call fcn.00401318
pop ecx
cmp eax, 0x64
jb 0x4aab35
xor eax, eax
jmp 0x4ab498
test edi, edi
je 0x4aab43
push edi
call fcn.004e8a54
test eax, eax
jne 0x4aab4a
xor eax, eax
jmp 0x4ab498
cmp byte [edi + 0x4cc], 1
je 0x4aab5a
xor eax, eax
jmp 0x4ab498
xor edx, edx
mov dword [0x5168c4], edx
xor ecx, ecx
mov dword [0x5168c8], ecx
xor eax, eax
mov al, byte [esi]
push eax
call fcn.00408bd0
pop ecx
mov dword [0x5168cc], eax
mov edx, dword [edi + 0x4b0]
mov dword [ebx], edx
jmp 0x4aabbb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
cmp edx, dword [0x5168cc]
jne 0x4aabae
push esi
mov ecx, dword [eax]
push ecx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4aabae
mov eax, dword [ebx]
mov edx, dword [eax + 0x18]
mov dword [0x5168c8], edx
jmp 0x4aabc0
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x30]
mov dword [ebx], eax
inc dword [0x5168c4]
cmp dword [ebx], 0
jne 0x4aab84
mov edx, dword [ebp + 0x10]
sub edx, 1
jb 0x4aabe1
je 0x4aae36
dec edx
je 0x4ab458
dec edx
je 0x4ab479
jmp 0x4ab496
cmp dword [0x5168c8], 0
je 0x4aae2c
cmp dword [ebx], 0
je 0x4aae2c
cmp dword [0x4f9238], 0
je 0x4aac7c
push 0
mov ecx, dword [0x5168c4]
push ecx
push 0x187
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_SendMessageA
mov dword [0x5168d0], eax
mov eax, dword [0x5168d0]
cmp eax, 0xffffffff
je 0x4aac39
test eax, eax
jle 0x4aac39
mov dword [0x4f9238], 2
jmp 0x4aac43
mov dword [0x4f9238], 3
push 0
mov edx, dword [0x5168c4]
push edx
push 0x199
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
mov dword [0x5168d4], eax
mov eax, dword [0x5168d4]
cmp eax, 0xffffffff
je 0x4aac70
test eax, eax
jge 0x4aac7c
mov edx, dword [0x4f29ec]
mov dword [0x5168d4], edx
mov dword [0x5168e0], 0xffffffff
cmp dword [0x4fd9f4], 0
je 0x4aacf6
mov ecx, dword [edi]
cmp ecx, dword [0x4fd9f8]
jne 0x4aacf6
cmp byte [edi + 0x4e5], 0
je 0x4aacf6
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4aacba
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4aacf6
push 0x5168e0
call sub.USER32.dll_GetCursorPos
push 0x5168e0
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_ScreenToClient
movzx edx, word [0x5168e4]
shl edx, 0x10
or edx, 1
push edx
push 0
push 0x202
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0x18e
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_SendMessageA
mov dword [0x5168d8], eax
push 0
push 0
push 0x19f
mov edx, dword [edi + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
mov dword [0x5168dc], eax
push 0
push 0
push 0xb
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
push 0
mov eax, dword [0x5168c4]
push eax
push 0x182
mov edx, dword [edi + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
mov eax, dword [0x5168c4]
cmp eax, dword [0x5168d8]
jg 0x4aad79
dec dword [0x5168d8]
cmp dword [0x5168d8], 0
jge 0x4aad79
xor edx, edx
mov dword [0x5168d8], edx
cmp eax, dword [0x5168dc]
jg 0x4aad98
dec dword [0x5168dc]
cmp dword [0x5168dc], 0
jge 0x4aad98
xor ecx, ecx
mov dword [0x5168dc], ecx
mov eax, dword [0x5168d8]
cmp eax, dword [0x5168dc]
jle 0x4aadb1
mov dword [0x5168dc], 0xffffffff
jmp 0x4aadbd
push 0x5168dc
push eax
push edi
call fcn.004aaab0
push 0
mov edx, dword [0x5168d8]
push edx
push 0x197
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, dword [0x5168dc]
cmp eax, 0xffffffff
je 0x4aadf5
push 0
push eax
push 0x19e
mov edx, dword [edi + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 1
push 0xb
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
push 0
push 0
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_InvalidateRect
mov edx, dword [ebx]
push edx
mov ecx, dword [edi + 0x4b0]
push ecx
call fcn.00498fb0
mov dword [edi + 0x4b0], eax
mov eax, dword [0x5168c8]
jmp 0x4ab498
cmp dword [ebp + 0x14], 0
jne 0x4aae46
mov eax, dword [0x5168c8]
jmp 0x4ab498
mov eax, dword [0x5168c8]
test eax, eax
je 0x4aae82
cmp dword [ebp + 0x14], 0
jle 0x4aae65
mov edx, eax
and edx, dword [ebp + 0x14]
jne 0x4ab498
add dword [ebp + 0x14], eax
jmp 0x4aae8c
mov ecx, dword [ebp + 0x14]
mov edx, ecx
neg ecx
mov dword [ebp + 0x14], ecx
mov ecx, eax
and ecx, dword [ebp + 0x14]
je 0x4ab498
sub eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
jmp 0x4aae8c
cmp dword [ebp + 0x14], 0
jl 0x4ab498
mov dword [0x5168e0], 0xffffffff
cmp dword [0x4fd9f4], 0
je 0x4aaf06
mov eax, dword [edi]
cmp eax, dword [0x4fd9f8]
jne 0x4aaf06
cmp byte [edi + 0x4e5], 0
je 0x4aaf06
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4aaeca
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4aaf06
push 0x5168e0
call sub.USER32.dll_GetCursorPos
push 0x5168e0
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_ScreenToClient
movzx edx, word [0x5168e4]
shl edx, 0x10
or edx, 1
push edx
push 0
push 0x202
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0x18e
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_SendMessageA
mov dword [0x5168d8], eax
push 0
push 0
push 0x19f
mov edx, dword [edi + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
mov dword [0x5168dc], eax
push 0
push 0
push 0xb
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
cmp dword [0x5168c8], 0
je 0x4ab015
cmp dword [ebx], 0
je 0x4ab015
cmp dword [0x4f9238], 0
je 0x4aafe6
push 0
mov eax, dword [0x5168c4]
push eax
push 0x187
mov edx, dword [edi + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
mov dword [0x5168d0], eax
mov eax, dword [0x5168d0]
cmp eax, 0xffffffff
je 0x4aafa3
test eax, eax
jle 0x4aafa3
mov dword [0x4f9238], 2
jmp 0x4aafad
mov dword [0x4f9238], 3
push 0
mov edx, dword [0x5168c4]
push edx
push 0x199
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
mov dword [0x5168d4], eax
mov eax, dword [0x5168d4]
cmp eax, 0xffffffff
je 0x4aafda
test eax, eax
jge 0x4aafe6
mov edx, dword [0x4f29ec]
mov dword [0x5168d4], edx
push 0
mov ecx, dword [0x5168c4]
push ecx
push 0x182
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_SendMessageA
mov edx, dword [ebx]
push edx
mov ecx, dword [edi + 0x4b0]
push ecx
call fcn.00498fb0
mov dword [edi + 0x4b0], eax
xor eax, eax
mov dword [0x5168c4], eax
mov edx, dword [edi + 0x4b0]
mov dword [ebx], edx
test byte [ebp + 0x14], 0x10
je 0x4ab07a
jmp 0x4ab049
mov ecx, dword [eax]
push ecx
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jl 0x4ab055
inc dword [0x5168c4]
mov eax, dword [ebx]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ab055
test byte [eax + 0x18], 0x10
jne 0x4ab02c
push esi
push edi
mov esi, 0x4faa24
mov edi, 0x5168e8
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push esi
push 0x5168e8
call fcn.0040123c
add esp, 8
jmp 0x4ab281
test byte [ebp + 0x14], 2
je 0x4ab0e9
jmp 0x4ab08d
inc dword [0x5168c4]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ab0b8
test byte [eax + 0x18], 0x10
jne 0x4ab082
jmp 0x4ab0b8
mov edx, dword [eax]
push edx
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jl 0x4ab0c4
inc dword [0x5168c4]
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x30]
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
je 0x4ab0c4
test byte [eax + 0x18], 2
jne 0x4ab09b
push esi
push edi
mov esi, 0x4faa27
mov edi, 0x5168e8
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push esi
push 0x5168e8
call fcn.0040123c
add esp, 8
jmp 0x4ab281
test byte [ebp + 0x14], 8
je 0x4ab175
jmp 0x4ab100
inc dword [0x5168c4]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ab119
test byte [eax + 0x18], 0x10
jne 0x4ab0f5
jmp 0x4ab119
inc dword [0x5168c4]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ab144
test byte [eax + 0x18], 2
jne 0x4ab10e
jmp 0x4ab144
mov edx, dword [eax]
push edx
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jl 0x4ab150
inc dword [0x5168c4]
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x30]
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
je 0x4ab150
test byte [eax + 0x18], 8
jne 0x4ab127
push esi
push edi
mov esi, 0x4faa2a
mov edi, 0x5168e8
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push esi
push 0x5168e8
call fcn.0040123c
add esp, 8
jmp 0x4ab281
test byte [ebp + 0x14], 4
je 0x4ab222
jmp 0x4ab18c
inc dword [0x5168c4]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ab1a5
test byte [eax + 0x18], 0x10
jne 0x4ab181
jmp 0x4ab1a5
inc dword [0x5168c4]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ab1be
test byte [eax + 0x18], 2
jne 0x4ab19a
jmp 0x4ab1be
inc dword [0x5168c4]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ab1e9
test byte [eax + 0x18], 8
jne 0x4ab1b3
jmp 0x4ab1e9
mov edx, dword [eax]
push edx
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jl 0x4ab1f5
inc dword [0x5168c4]
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x30]
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
je 0x4ab1f5
test byte [eax + 0x18], 4
jne 0x4ab1cc
push esi
push edi
mov esi, 0x4faa2d
mov edi, 0x5168e8
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push esi
push 0x5168e8
call fcn.0040123c
add esp, 8
jmp 0x4ab281
inc dword [0x5168c4]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ab24d
cmp dword [eax + 0x18], 1
jne 0x4ab217
jmp 0x4ab24d
mov edx, dword [eax]
push edx
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jl 0x4ab259
inc dword [0x5168c4]
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x30]
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
je 0x4ab259
cmp dword [eax + 0x18], 1
je 0x4ab230
push esi
push edi
mov edi, esi
mov esi, 0x5168e8
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [ebx], 0
je 0x4ab2d3
mov eax, dword [ebp + 0x14]
push eax
push 0
push esi
push 0
call fcn.00498c08
mov dword [0x5168c0], eax
cmp dword [0x5168c0], 0
je 0x4ab319
xor edx, edx
mov dl, byte [esi]
push edx
call fcn.00408bd0
pop ecx
mov ecx, dword [0x5168c0]
mov dword [ecx + 8], eax
mov eax, dword [0x5168c0]
push eax
mov edx, dword [ebx]
push edx
mov ecx, dword [edi + 0x4b0]
push ecx
call fcn.00499070
mov dword [edi + 0x4b0], eax
jmp 0x4ab319
mov eax, dword [ebp + 0x14]
push eax
push 0
push esi
mov edx, dword [edi + 0x4b0]
push edx
call fcn.00498c08
mov ebx, eax
mov dword [0x5168c0], ebx
test ebx, ebx
je 0x4ab30f
mov dword [edi + 0x4b0], ebx
xor eax, eax
mov al, byte [esi]
push eax
call fcn.00408bd0
pop ecx
mov edx, dword [edi + 0x4b0]
mov ecx, dword [edx + 0x34]
mov dword [ecx + 8], eax
mov dword [0x5168c4], 0xffffffff
push 0x5168e8
mov eax, dword [0x5168c4]
push eax
push 0x181
mov edx, dword [edi + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
mov ebx, eax
mov dword [0x5168d0], ebx
cmp ebx, 0xffffffff
je 0x4ab3af
cmp dword [0x4f9238], 0
je 0x4ab391
cmp dword [0x4f9238], 2
jne 0x4ab368
push ebx
push 1
push 0x185
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_SendMessageA
mov edx, dword [0x5168d4]
push edx
mov ecx, dword [0x5168d0]
push ecx
push 0x19a
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_SendMessageA
xor edx, edx
mov dword [0x4f9238], edx
jmp 0x4ab3af
mov ecx, dword [0x4f29ec]
push ecx
mov eax, dword [0x5168d0]
push eax
push 0x19a
mov edx, dword [edi + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
mov eax, dword [0x5168d0]
cmp eax, dword [0x5168d8]
jg 0x4ab3c2
inc dword [0x5168d8]
cmp eax, dword [0x5168dc]
jg 0x4ab3d0
inc dword [0x5168dc]
mov eax, dword [0x5168d8]
cmp eax, dword [0x5168dc]
jle 0x4ab3e9
mov dword [0x5168dc], 0xffffffff
jmp 0x4ab3f5
push 0x5168dc
push eax
push edi
call fcn.004aaab0
push 0
mov edx, dword [0x5168d8]
push edx
push 0x197
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
cmp dword [0x5168dc], 0xffffffff
je 0x4ab431
push 0
mov eax, dword [0x5168dc]
push eax
push 0x19e
mov edx, dword [edi + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 1
push 0xb
mov ecx, dword [edi + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
push 0
push 0
mov eax, dword [edi + 0x5d4]
push eax
call sub.USER32.dll_InvalidateRect
mov eax, dword [ebp + 0x14]
jmp 0x4ab498
cmp dword [ebp + 0x14], 0
je 0x4ab472
mov edx, dword [0x5168c8]
and edx, dword [ebp + 0x14]
je 0x4ab46e
mov eax, dword [ebp + 0x14]
jmp 0x4ab498
xor eax, eax
jmp 0x4ab498
mov eax, dword [0x5168c8]
jmp 0x4ab498
cmp dword [0x5168c8], 0
je 0x4ab48f
cmp dword [ebx], 0
je 0x4ab48f
mov edx, dword [ebx]
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0x14], ecx
mov eax, dword [0x5168c8]
jmp 0x4ab498
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10