Function at 0x4d61b4
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x4c]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4d6a25
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x5648c8]
mov eax, dword [eax]
xor edx, edx
call fcn.004647e4
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x30]
xor edx, edx
xor eax, eax
call fcn.0041b890
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
push 0
push 0x32
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004d264c
test eax, eax
jle 0x4d62e7
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004d264c
mov edx, eax
dec edx
mov eax, ebx
call fcn.004d2654
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4d62d3
mov eax, esi
call fcn.004d264c
cmp ebx, eax
jge 0x4d62d3
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004d2654
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4d62bf
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004d264c
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4d62bf
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004d2654
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4d62d3
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004d572c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4d62fd
mov eax, ebx
call fcn.0044c390
call fcn.0047fa44
mov byte [ebp - 6], 1
jmp 0x4d69e2
cmp byte [ebp - 6], 0
jne 0x4d6311
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4d69c1
mov eax, dword [edi + 4]
cmp eax, 0x113
jg 0x4d6349
je 0x4d6449
sub eax, 0x12
je 0x4d643d
sub eax, 0x34
je 0x4d635a
add eax, 0xffffffa5
sub eax, 9
jb 0x4d643d
jmp 0x4d64db
sub eax, 0x201
je 0x4d636b
sub eax, 3
je 0x4d636b
jmp 0x4d64db
push ebp
call fcn.004d6160
pop ecx
call fcn.00404068
jmp 0x4d6a2c
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407d5c
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004457f8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4d63ea
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4d63ea
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
jmp 0x4d64db
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4d641c
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.004457f8
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4d6419
mov bl, 1
mov esi, dword [esi + 0x68]
test esi, esi
je 0x4d6424
test bl, bl
je 0x4d63f1
test bl, bl
jne 0x4d64db
push ebp
call fcn.004d6160
pop ecx
call fcn.00404068
jmp 0x4d6a2c
push ebp
call fcn.004d6160
pop ecx
jmp 0x4d69c1
cmp dword [edi], 0
jne 0x4d64db
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_GetCursorPos
test eax, eax
je 0x4d64db
add dword [ebp - 0x1c], 0x32
lea edx, [ebp - 0x28]
mov eax, dword [0x564858]
mov eax, dword [eax]
call fcn.00450b2c
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jne 0x4d64ca
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jne 0x4d64ca
cmp dword [ebp - 0x1c], 0x1f4
jl 0x4d64cf
mov esi, dword [ebp - 4]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.00445654
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4d64c3
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4d64cf
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4d69c1
mov eax, dword [edi + 4]
mov edx, eax
sub edx, 0x7b
je 0x4d69c1
add edx, 0xffffff7b
sub edx, 9
jb 0x4d6532
add edx, 0xffffff09
sub edx, 0xb
jb 0x4d67f3
sub edx, 0x264
jne 0x4d69bb
mov eax, dword [ebp - 4]
call fcn.004d5e10
jmp 0x4d69c1
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4d69c1
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4d6568
sub eax, 2
je 0x4d679a
sub eax, 2
je 0x4d6568
sub eax, 2
je 0x4d679a
jmp 0x4d69c1
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4d65ab
je 0x4d665d
cmp eax, 0x12
jg 0x4d6594
je 0x4d6783
sub eax, 9
je 0x4d69c1
sub eax, 4
je 0x4d65d0
jmp 0x4d678f
sub eax, 0x1b
je 0x4d6635
sub eax, 5
je 0x4d69c1
jmp 0x4d678f
sub eax, 0x26
je 0x4d6746
dec eax
je 0x4d66c7
dec eax
je 0x4d6760
sub eax, 0x51
je 0x4d6783
jmp 0x4d678f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4d65e3
mov si, 0xffef
call fcn.004039ec
mov eax, dword [ebp - 4]
call fcn.004d5e10
test al, al
jne 0x4d69c1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4d69c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4d6a3c
call fcn.0040500c
je 0x4d69c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4d69c1
push ebp
call fcn.004d6160
pop ecx
jmp 0x4d69c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4d6643
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.00404068
jmp 0x4d6a2c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4d6673
mov eax, dword [ebp - 4]
call fcn.004d6020
jmp 0x4d69c1
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x68]
test ebx, ebx
je 0x4d69c1
cmp byte [ebx + 0x34], 0
je 0x4d66a8
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
call fcn.00404068
jmp 0x4d6a2c
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
jmp 0x4d69c1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4d66dd
mov eax, dword [ebp - 4]
call fcn.004d5ef0
jmp 0x4d69c1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4d69c1
mov eax, dword [ebp - 4]
call fcn.004d5e10
test al, al
jne 0x4d69c1
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x68]
cmp byte [ebx + 0x34], 0
je 0x4d6727
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
call fcn.00404068
jmp 0x4d6a2c
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
jmp 0x4d69c1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4d69c1
mov eax, dword [ebp - 4]
call fcn.004d6020
jmp 0x4d69c1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4d6776
mov eax, dword [ebp - 4]
call fcn.004d5ef0
jmp 0x4d69c1
mov eax, dword [ebp - 4]
call fcn.004d5e10
jmp 0x4d69c1
push ebp
call fcn.004d6160
pop ecx
jmp 0x4d69c1
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4d69c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004d4c20
test eax, eax
je 0x4d69c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004d4c20
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
test ebx, ebx
je 0x4d67d4
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
jmp 0x4d69c1
sub eax, 0x200
je 0x4d6808
sub eax, 2
je 0x4d68f8
jmp 0x4d69c1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407d5c
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x57ce3c]
jne 0x4d683e
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x57ce40]
je 0x4d69c1
mov esi, dword [ebp - 4]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.00445654
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4d686b
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004d572c
jmp 0x4d68e1
mov esi, dword [ebp - 4]
jmp 0x4d6872
mov esi, eax
mov eax, dword [esi + 0x68]
test eax, eax
jne 0x4d6870
test esi, esi
je 0x4d68e1
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004d572c
cmp ebx, dword [esi + 0x40]
je 0x4d68da
cmp esi, dword [ebp - 4]
je 0x4d68da
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x4d68b9
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x68]
cmp esi, ebx
jne 0x4d689b
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
call fcn.00404068
jmp 0x4d6a2c
mov esi, dword [esi + 0x6c]
test esi, esi
jne 0x4d687d
mov eax, dword [ebp - 0xe]
mov dword [0x57ce3c], eax
mov eax, dword [ebp - 0xa]
mov dword [0x57ce40], eax
jmp 0x4d69c1
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407d5c
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004457f8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4d6974
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4d6974
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c390
push eax
call sub.user32.dll_PostMessageA
jmp 0x4d69c1
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4d69a6
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.004457f8
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4d69a3
mov bl, 1
mov esi, dword [esi + 0x68]
test esi, esi
je 0x4d69ae
test bl, bl
je 0x4d697b
test bl, bl
jne 0x4d69c1
push ebp
call fcn.004d6160
pop ecx
jmp 0x4d69c1
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004d618c
pop ecx
test al, al
je 0x4d69e2
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4d631a
push ebp
call fcn.004d618c
pop ecx
test al, al
jne 0x4d6306
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6a2c
mov eax, dword [ebp - 0x20]
push eax
push 0
call sub.user32.dll_KillTimer
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4d6a18
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.0047fa64
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret