Function at 0x4de770
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
cmp edi, ebp
mov esi, edx
mov dword [esp + 0x18], edi
je case.default.0x4de870
cmp byte [edi], 0
je case.default.0x4de870
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4de7a0
sub eax, edx
cmp eax, 0x5a
jae case.default.0x4de870
cmp esi, ebp
je case.default.0x4de870
mov ecx, esi
call fcn.00536900
test eax, eax
je case.default.0x4de870
mov ecx, dword [esi + 0xbb4]
call fcn.004dbea0
test eax, eax
je case.default.0x4de870
cmp dword [esi + 0x700], 1
jne case.default.0x4de870
lea eax, [esi + 0x6c0]
xor ebx, ebx
push eax
xor edx, edx
mov ecx, edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
call fcn.0048cfc0
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x4de860
mov eax, dword [esi + 0x6b4]
test eax, eax
mov ebp, dword [ecx + 0x20]
mov ebx, dword [ecx + 0x1c]
mov dword [esp + 0x1c], ebp
je 0x4de84a
lea esp, [esp]
cmp eax, ecx
je 0x4de846
mov edi, dword [esp + 0x10]
mov eax, dword [eax + 0x40]
inc edi
test eax, eax
mov dword [esp + 0x10], edi
jne 0x4de830
jmp 0x4de84a
test eax, eax
jne 0x4de860
xor ebp, ebp
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0xa0]
cmp eax, 3
ja case.default.0x4de870
jmp dword [eax*4 + 0x4df054]
test ebx, ebx
je 0x4dea7c
test ecx, ecx
je 0x4dea7c
mov eax, dword [esi + 0xbb4]
mov ecx, dword [eax + 0x1f9c]
test ecx, ecx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x4de919
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x86c]
push 0
push ecx
push 0x187
push edx
call edi
cmp eax, 0xffffffff
je 0x4de8cc
test eax, eax
jle 0x4de8cc
mov eax, dword [esi + 0xbb4]
mov ecx, dword [eax + 0x1f9c]
or ecx, 4
jmp 0x4de8db
mov eax, dword [esi + 0xbb4]
mov ecx, dword [eax + 0x1f9c]
or ecx, 8
mov dword [eax + 0x1f9c], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x86c]
push 0
push eax
push 0x199
push ecx
call edi
cmp eax, 0xffffffff
mov dword [0x589b24], eax
je 0x4de909
test eax, eax
jl 0x4de909
cmp eax, 0xf
jle 0x4de913
mov dword [0x589b24], 0x63
mov dword [0x589b20], ebp
mov eax, dword [0x5a1b08]
test eax, eax
mov dword [esp + 0x2c], 0xffffffff
je 0x4de98d
mov edx, dword [esi]
cmp edx, dword [0x5a1b0c]
jne 0x4de98d
mov eax, dword [esi + 0x730]
test eax, eax
je 0x4de98d
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call ebp
test ah, ah
js 0x4de954
push 2
call ebp
test ah, ah
jns 0x4de98d
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x86c]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx eax, word [esp + 0x30]
mov ecx, dword [esi + 0x86c]
shl eax, 0x10
or eax, 1
push eax
push 0
push 0x202
push ecx
call edi
mov edx, dword [esi + 0x86c]
push 0
push 0
push 0x18e
push edx
call edi
push 0
push 0
mov ebp, eax
mov eax, dword [esi + 0x86c]
push 0x19f
push eax
call edi
mov ecx, dword [esi + 0x86c]
push 0
push 0
push 0xb
push ecx
mov dword [esp + 0x24], eax
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x86c]
push 0
push edx
push 0x182
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
jg 0x4de9e8
dec ebp
jns 0x4de9e8
xor ebp, ebp
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jg 0x4dea01
mov eax, ecx
dec eax
mov dword [esp + 0x14], eax
jns 0x4dea01
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
push ecx
mov edx, ebp
mov ecx, esi
call fcn.0041e920
mov edx, dword [esi + 0x86c]
push 0
push ebp
push 0x197
push edx
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4dea3a
push 0
push eax
mov eax, dword [esi + 0x86c]
push 0x19e
push eax
call edi
mov ecx, dword [esi + 0x86c]
push 0
push 1
push 0xb
push ecx
call edi
mov edx, dword [esi + 0x86c]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esp + 0x20]
mov ecx, dword [esi + 0x6b4]
call fcn.004c2730
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x6b4], eax
call fcn.0048d060
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x8c
ret 8
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x4df036
test ebx, ebx
je 0x4deacc
test eax, eax
jle 0x4deab5
test eax, ebx
jne 0x4df036
add eax, ebx
mov dword [esp + 0xa4], eax
jmp 0x4dead4
neg eax
test eax, ebx
je 0x4df036
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0xa4], ecx
jmp 0x4dead4
test eax, eax
jl case.default.0x4de870
mov eax, dword [0x5a1b08]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x2c], 0xffffffff
je 0x4deb4e
mov eax, dword [esi]
cmp eax, dword [0x5a1b0c]
jne 0x4deb4e
mov eax, dword [esi + 0x730]
test eax, eax
je 0x4deb4e
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ah, ah
js 0x4deb15
push 2
call edi
test ah, ah
jns 0x4deb4e
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x86c]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx ecx, word [esp + 0x30]
mov edx, dword [esi + 0x86c]
shl ecx, 0x10
or ecx, 1
push ecx
push 0
push 0x202
push edx
call ebp
mov eax, dword [esi + 0x86c]
push 0
push 0
push 0x18e
push eax
call ebp
mov ecx, dword [esi + 0x86c]
push 0
push 0
push 0x19f
push ecx
mov dword [esp + 0x44], eax
call ebp
mov edx, dword [esi + 0x86c]
push 0
push 0
push 0xb
push edx
mov dword [esp + 0x24], eax
call ebp
test ebx, ebx
je 0x4dec68
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4dec68
mov eax, dword [edi + 0x10]
mov ecx, dword [esi + 0xbb4]
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 0x1f9c]
test eax, eax
je 0x4dec33
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x86c]
push 0
push edx
push 0x187
push eax
call ebp
cmp eax, 0xffffffff
je 0x4debe3
test eax, eax
jle 0x4debe3
mov eax, dword [esi + 0xbb4]
mov ecx, dword [eax + 0x1f9c]
or ecx, 4
jmp 0x4debf2
mov eax, dword [esi + 0xbb4]
mov ecx, dword [eax + 0x1f9c]
or ecx, 8
mov dword [eax + 0x1f9c], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x86c]
push 0
push ecx
push 0x199
push edx
call ebp
cmp eax, 0xffffffff
mov dword [0x589b24], eax
je 0x4dec20
test eax, eax
jl 0x4dec20
cmp eax, 0xf
jle 0x4dec2a
mov dword [0x589b24], 0x63
mov eax, dword [esp + 0x1c]
mov dword [0x589b20], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x86c]
push 0
push ecx
push 0x182
push edx
call ebp
mov ecx, dword [esi + 0x6b4]
mov edx, edi
call fcn.004c2730
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x6b4], eax
call fcn.0048d060
mov ecx, dword [esi + 0xbb4]
mov dl, byte [ecx + 0x1c18]
xor ebp, ebp
xor eax, eax
test dl, dl
mov dword [esp + 0x20], ebp
mov ebx, 1
je 0x4decc4
lea edx, [ecx + 0x1c7c]
jmp 0x4dec90
mov edi, dword [edx]
test dword [esp + 0xa4], edi
jne 0x4decb1
mov edi, dword [esi + 0xbb4]
inc eax
add edx, 4
cmp byte [edi + eax + 0x1c18], 0
jne 0x4dec90
jmp 0x4decc4
movzx ebp, byte [ecx + eax + 0x1c18]
mov ebx, dword [ecx + eax*4 + 0x1c7c]
mov dword [esp + 0x20], ebp
mov edi, dword [esi + 0x6b4]
test edi, edi
mov dword [esp + 0x10], 0
je 0x4ded0e
lea ebp, [ebx + ebx]
lea esp, [esp]
mov eax, dword [edi + 0x1c]
cmp eax, ebp
jge 0x4decff
test ebx, eax
je 0x4ded0a
mov eax, dword [edi]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.00572b46
add esp, 8
test eax, eax
jl 0x4ded0a
inc dword [esp + 0x10]
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x4dece0
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4ded2d
mov edx, dword [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x40]
push str._c_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4ded41
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x38]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4ded37
mov eax, dword [esi + 0x6b8]
test eax, eax
je 0x4dedb4
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx]
push edx
call fcn.00563f22
mov ebp, dword [esi + 0x6b8]
add esp, 4
test ebp, ebp
mov ebx, eax
je 0x4dedb4
cmp dword [ebp + 0xc], ebx
jne 0x4ded81
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
push eax
push ecx
call fcn.00572b46
add esp, 8
test eax, eax
je 0x4ded8a
mov ebp, dword [ebp + 0x40]
test ebp, ebp
jne 0x4ded67
jmp 0x4dedb4
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x20]
mov dword [0x589b24], edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x6b8]
mov edx, ebp
mov dword [esp + 0x1c], eax
call fcn.004c2730
mov dword [esi + 0x6b8], eax
mov edx, dword [esi + 0xbb4]
mov eax, dword [edx + 0x1f9c]
test eax, eax
mov ebx, dword [esp + 0x18]
je 0x4dedd6
mov eax, dword [0x589b20]
cmp eax, 0xffffffff
je 0x4dedd6
mov dword [esp + 0x1c], eax
or ebp, 0xffffffff
test edi, edi
mov dword [0x589b20], ebp
je 0x4dee43
mov eax, dword [esp + 0xa4]
push eax
mov edx, ebx
xor ecx, ecx
call fcn.004c2560
mov ebp, eax
test ebp, ebp
je 0x4dee95
movzx ecx, byte [ebx]
push ecx
call fcn.00563f22
mov edx, dword [esp + 0x20]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
add esp, 4
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [esi + 0x6b4]
push ebp
mov edx, edi
call fcn.004c27b0
mov ecx, dword [esp + 0x28]
push ecx
push 0xffffffffffffffff
mov edx, ebp
mov ecx, ebx
mov dword [esi + 0x6b4], eax
call fcn.0048ce60
mov edi, ebp
jmp 0x4dee95
mov edx, dword [esp + 0xa4]
mov ecx, dword [esi + 0x6b4]
push edx
mov edx, ebx
call fcn.004c2560
test eax, eax
je 0x4dee91
mov dword [esi + 0x6b4], eax
mov edi, dword [eax + 0x44]
movzx eax, byte [ebx]
push eax
call fcn.00563f22
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
add esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x28]
push eax
mov dword [edi + 0x20], ecx
mov dword [edi + 0x10], edx
push ebp
mov edx, edi
mov ecx, ebx
call fcn.0048ce60
mov dword [esp + 0x10], ebp
test edi, edi
je 0x4defca
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x86c]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x181
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4defca
cmp ebp, 0xfffffffe
je 0x4defca
mov eax, dword [esi + 0xbb4]
mov ecx, dword [eax + 0x1f9c]
test ecx, ecx
je 0x4def21
test cl, 4
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x4deef9
mov ecx, dword [esi + 0x86c]
push ebp
push 1
push 0x185
push ecx
call edi
mov edx, dword [0x589b24]
mov eax, dword [esi + 0x86c]
push edx
push ebp
push 0x19a
push eax
call edi
mov ecx, dword [esi + 0xbb4]
mov dword [ecx + 0x1f9c], 0
jmp 0x4def7b
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4def30
mov eax, dword [0x589b24]
jmp 0x4def5d
mov ecx, dword [esp + 0xa4]
push eax
mov eax, dword [edi + 0x10]
push 2
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ecx
mov ecx, dword [esi]
mov edx, ebx
call fcn.0042fe80
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x4def61
mov eax, 0x63
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x86c]
push eax
push ebp
push 0x19a
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esp + 0x34]
cmp ebp, ebx
jg 0x4def84
inc ebx
mov eax, dword [esp + 0x14]
cmp ebp, eax
jg 0x4def91
inc eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov edx, ebx
mov ecx, esi
call fcn.0041e920
mov ecx, dword [esi + 0x86c]
push 0
push ebx
push 0x197
push ecx
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4defca
mov edx, dword [esi + 0x86c]
push 0
push eax
push 0x19e
push edx
call edi
mov eax, dword [esi + 0x86c]
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0x86c]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
mov ecx, dword [esp + 0xa4]
test ecx, ecx
mov eax, ebx
je 0x4df047
and eax, ecx
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x8c
ret 8
test ebx, ebx
je 0x4df036
test ecx, ecx
je 0x4df036
mov edx, dword [esp + 0xa4]
mov dword [ecx + 0x18], edx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x8c
ret 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8