Function at 0x5aafc5
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x194]
test al, al
jne 0x5ab6a2
mov ebx, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
push ebx
push ecx
push edx
mov ecx, esi
call fcn.005a8410
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x6c]
test eax, eax
je 0x5ab010
mov ecx, dword [eax + 0x50]
test ecx, ecx
jne 0x5ab6a2
or eax, 0xffffffff
test bl, bl
mov dword [esi + 0xd8], eax
mov dword [esi + 0xd4], eax
jne 0x5ab039
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0xf8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 0xc
mov ecx, esi
call fcn.005a9d50
test eax, eax
mov dword [esp + 0x14], eax
jne 0x5ab05e
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xf8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 0xc
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10c]
mov ebp, eax
mov ebx, 3
mov dword [esp + 0x24], ebp
lea edi, [esi + 0x90]
mov ecx, dword [edi - 4]
mov edx, dword [edi - 0xc]
lea eax, [edi - 0xc]
cmp ecx, edx
jle 0x5ab0aa
mov edx, dword [edi]
mov ecx, dword [edi - 8]
cmp edx, ecx
jle 0x5ab0aa
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x5ab0b5
inc ebx
add edi, 0x10
cmp ebx, 7
jle 0x5ab079
jmp 0x5ab0bb
mov dword [esi + 0xd4], ebx
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xf8]
cmp dword [esi + 0xd4], 0xffffffff
je 0x5ab6a2
mov ecx, dword [esi + 4]
call fcn.00572ae0
mov edx, dword [esi]
mov ecx, esi
test al, al
sete byte [esp + 0x13]
call dword [edx + 0x34]
test al, al
je 0x5ab0f3
mov byte [esp + 0x13], 1
mov edi, dword [esi + 0xd4]
lea eax, [esp + 0x30]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x28], edi
call fcn.005aaf60
mov eax, dword [esi + 4]
xor ebx, ebx
cmp eax, ebx
jne 0x5ab119
mov dword [esp + 0x18], ebx
jmp 0x5ab120
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x2c], eax
lea eax, [edi - 3]
cmp eax, 4
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x88], 0
ja case.default.0x5ab14a
jmp dword [eax*4 + 0x5ab6ac]
mov byte [esp + 0x88], 1
mov ebx, 1
mov dword [esp + 0x1c], ebx
mov edi, dword [esp + 0x14]
cmp ebx, edi
jbe 0x5ab1a5
mov ebx, edi
mov dword [esp + 0x1c], ebx
jmp 0x5ab1a5
mov byte [esp + 0x88], 1
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x114]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x1c], ebx
jne 0x5ab162
jmp case.0x5ab14a.6
mov eax, dword [esi]
push ebx
mov ecx, esi
mov dword [esi + 0xd8], edi
call dword [eax + 0xf8]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetCapture]
test ebx, ebx
je 0x5ab1c8
mov edx, dword [esp + 0x18]
push 0
push 0x32
push 0x191
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x5ab256.513
push 0
push 0
push 0
lea ecx, [esp + 0x6c]
push 0
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x5ab210
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x5ab256.513
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x5ab62f
mov eax, dword [esp + 0x64]
xor bl, bl
cmp eax, 0x113
ja 0x5ab240
je 0x5ab2fc
add eax, 0xffffffe4
cmp eax, 0xe5
ja case.0x5ab256.515
xor ecx, ecx
mov cl, byte [eax + 0x5ab6c8]
jmp dword [ecx*4 + 0x5ab6c0]
add eax, 0xfffffe00
cmp eax, 0x15
ja case.0x5ab256.515
xor edx, edx
mov dl, byte [eax + 0x5ab7c0]
jmp dword [edx*4 + 0x5ab7b0]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x68]
cmp ecx, eax
jne case.0x5ab256.513
jmp 0x5ab4e5
cmp dword [esp + 0x20], 7
jne 0x5ab2f0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je case.0x5ab256.513
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne case.0x5ab256.513
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne case.0x5ab256.513
call fcn.00559b10
test eax, eax
jne case.0x5ab256.513
mov eax, dword [esp + 0x64]
push 1
push eax
push eax
lea ecx, [esp + 0x6c]
push 0
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
lea edx, [esp + 0x28]
mov bl, 1
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
jmp 0x5ab4e5
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5ab4e5
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je case.0x5ab256.513
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne case.0x5ab256.513
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne case.0x5ab256.513
call fcn.00559b10
test eax, eax
jne case.0x5ab256.513
mov eax, dword [esp + 0x64]
cmp eax, 0x113
jne 0x5ab355
cmp dword [esp + 0x68], 0x191
jne 0x5ab4e5
push 1
push eax
push eax
lea edx, [esp + 0x6c]
push 0
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x5ab3c2
cmp dword [esi + 0xd8], 0xffffffff
je 0x5ab62f
mov eax, dword [esi]
push 1
mov ecx, esi
mov dword [esi + 0xd8], 0xffffffff
call dword [eax + 0xf8]
jmp 0x5ab62f
mov al, byte [esp + 0x88]
test al, al
je 0x5ab3ff
test ebp, ebp
jne 0x5ab3ef
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10c]
mov ecx, esi
mov ebp, eax
call fcn.005a9d50
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x5ab4e5
mov eax, dword [esp + 0x1c]
cmp ebp, eax
jae 0x5ab3fb
xor ebp, ebp
jmp 0x5ab433
sub ebp, eax
jmp 0x5ab433
cmp ebp, edi
jb 0x5ab421
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
mov ecx, esi
mov ebp, eax
call fcn.005a9d50
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x5ab4e5
mov eax, dword [esp + 0x1c]
mov ecx, edi
sub ecx, ebp
cmp eax, ecx
jbe 0x5ab431
mov ebp, edi
jmp 0x5ab433
add ebp, eax
mov edx, dword [esi]
push ebp
mov ecx, esi
call dword [edx + 0x110]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
mov ecx, esi
mov ebp, eax
call fcn.005a9d50
mov edx, dword [esi]
mov edi, eax
mov ecx, esi
mov dword [esp + 0x14], edi
call dword [edx + 0x13c]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x40]
push eax
push ecx
mov ecx, esi
call fcn.005aaf60
mov edx, dword [eax]
push 1
mov dword [esp + 0x34], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [eax + 8]
mov dword [esp + 0x3c], edx
mov edx, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [esi + 0xd8], ecx
mov ecx, esi
mov dword [esp + 0x40], eax
call dword [edx + 0xf8]
jmp 0x5ab4e5
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je case.0x5ab256.513
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne case.0x5ab256.513
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne case.0x5ab256.513
call fcn.00559b10
test eax, eax
jne case.0x5ab256.513
test edi, edi
je case.0x5ab256.513
test bl, bl
je 0x5ab61f
mov al, byte [esp + 0x13]
test al, al
je 0x5ab522
mov ecx, dword [esi + 0x7c]
mov ebx, dword [esi + 0xcc]
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x80]
mov edx, dword [esi + 0x74]
sub ecx, ebx
sub edi, eax
mov eax, dword [esi + 0xc4]
sub ecx, edx
jmp 0x5ab548
mov ecx, dword [esi + 0xc8]
mov ebx, dword [esi + 0xd0]
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x84]
mov edx, dword [esi + 0x78]
sub ecx, ebx
sub edi, eax
mov eax, dword [esi + 0x80]
sub ecx, edx
add ecx, eax
test ecx, ecx
jle case.0x5ab256.513
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jle 0x5ab565
test edi, edi
mov edi, ecx
jge 0x5ab565
neg edi
test edi, edi
je 0x5ab57f
mov eax, edi
mov ebp, dword [esp + 0x14]
cdq
xor eax, edx
push ecx
sub eax, edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x5ab585
mov ebp, dword [esp + 0x14]
xor eax, eax
mov ecx, dword [esp + 0x24]
test edi, edi
jge 0x5ab599
cmp eax, ecx
jb 0x5ab595
xor ecx, ecx
jmp 0x5ab5af
sub ecx, eax
jmp 0x5ab5af
cmp ecx, ebp
jae 0x5ab643
mov edx, ebp
sub edx, ecx
cmp eax, edx
jbe 0x5ab5ad
mov ecx, ebp
jmp 0x5ab5af
add ecx, eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x110]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10c]
mov ecx, esi
mov ebp, eax
call fcn.005a9d50
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x13c]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x50]
push edi
push ecx
mov ecx, esi
call fcn.005aaf60
mov edx, dword [eax]
push 1
mov dword [esp + 0x34], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x38], ecx
mov ecx, esi
mov edx, dword [eax + 8]
mov dword [esp + 0x3c], edx
mov edx, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [esi + 0xd8], edi
mov dword [esp + 0x40], eax
call dword [edx + 0xf8]
mov edi, dword [esp + 0x14]
jmp 0x5ab62f
call fcn.005ddc59
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x5c]
test eax, eax
je case.0x5ab256.513
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x5ab256.513
jmp 0x5ab1db
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10c]
mov ecx, esi
call fcn.005a9d50
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5ab6a2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5ab677
push 0x191
push edi
call dword [sym.imp.USER32.dll_KillTimer]
or eax, 0xffffffff
push 1
mov dword [esi + 0xd8], eax
mov dword [esi + 0xd4], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf8]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, edi
jne 0x5ab6a2
call dword [sym.imp.USER32.dll_ReleaseCapture]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 0xc
push 0
push esi
push 5
mov ecx, eax
call dword [edx + 0x38]
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.005ee0f0
lea ecx, [esp + 0x40]
mov dword [esp + 0x5c], 0xffffffff
call fcn.005e11c0
jmp 0x5bbcb8
xor eax, eax
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0xc