Function at 0x493380
Capabilities:
Check for peb beingdebugged flag
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6f8b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x51e080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
cmp ecx, 0x20
ja 0x493629
je 0x493530
mov eax, ecx
sub eax, 1
je 0x4933d4
sub eax, 0xe
je 0x493792
jmp 0x49350e
push 0
push dword [0x5223e0]
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push 0xa
push dword [ebp + 8]
push 0
push 0
push 0
push 0
push 0x56810080
push 0
push 0x50d9a0
push 0x200
call esi
mov ecx, dword [edi + 0x84]
push 0
push 0xff
push 0xc5
mov dword [ecx + 0x7c], eax
mov eax, dword [edi + 0x84]
push dword [eax + 0x7c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x84]
push 0x490bd0
push 0xfffffffffffffffc
push dword [eax + 0x7c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x88
mov dword [0x5223fc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0xd3ea6cb
call fcn.004d3886
add esp, 4
mov dword [ebp + 0x14], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push edi
mov ecx, eax
call fcn.0045e220
mov dword [ebp - 4], 0xffffffff
push 0x88
mov dword [edi + 0x70], eax
mov dword [ebp - 0x14], 0x1c00d4f7
call fcn.004d3886
add esp, 4
mov dword [ebp + 0x14], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
push ecx
push edi
mov ecx, eax
call fcn.0045e220
mov dword [ebp - 4], 0xffffffff
push 0x88
mov dword [edi + 0x74], eax
mov dword [ebp - 0x14], 0xcbd515a0
call fcn.004d3886
add esp, 4
mov dword [ebp + 0x14], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
push ecx
push edi
mov ecx, eax
call fcn.0045e220
push 0
push dword [0x5223e0]
mov dword [edi + 0x78], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0
push 0x56000037
push 0
push 0x50e740
push 0
call esi
mov ecx, dword [edi + 0x84]
mov dword [ecx + 0x78], eax
mov ecx, dword [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [edi + 0x84]
mov esi, dword [edx + 0x78]
cmp dword [ebp + 0x10], esi
jne 0x49350e
mov eax, ebx
shr eax, 0x10
mov ecx, eax
mov dword [ebp + 0x14], ecx
mov ecx, 0x207
cmp ax, cx
mov ecx, dword [ebp + 0xc]
jne 0x4935e7
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x1111
push esi
call edi
test byte [ebp - 0x24], 0x56
jne 0x4935b8
push 0
push 0
push 0x110a
push esi
call edi
push eax
push 9
push 0x110b
push esi
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x493a04
push eax
push 9
push 0x110b
push esi
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x208
cmp word [ebp + 0x14], ax
jne 0x49350e
push 0
push dword [edx + 0x7c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [edi + 0x84]
push dword [eax + 0x7c]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, 0x4e
je 0x4937a4
cmp ecx, 0x111
jne 0x49350e
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x493792
movzx eax, cx
mov ecx, eax
cmp eax, 0xa6cb
jne 0x493675
push 0
mov ecx, edi
call fcn.0048ea90
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp eax, 0xd4f7
jne 0x493695
mov ecx, edi
call fcn.0048e950
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp eax, 0x15a0
jne 0x4936b7
push 1
mov ecx, edi
call fcn.0048ea90
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp eax, 0x12c
jne 0x4936f0
mov eax, dword [edi + 0x84]
push 0
push dword [eax + 0x7c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [edi + 0x84]
push dword [eax + 0x7c]
call dword [sym.imp.USER32.dll_SetFocus]
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp eax, 0x12d
jne 0x493710
mov ecx, edi
call fcn.0048ed00
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp eax, 0x132
jne 0x493732
push 1
mov ecx, edi
call fcn.0048eec0
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp eax, 0x133
jne 0x493754
push 0
mov ecx, edi
call fcn.0048eec0
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp eax, 0x134
jne 0x493774
mov ecx, edi
call fcn.0048efb0
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp eax, 0x12e
jne 0x49377f
push 0
jmp 0x49378b
mov eax, 0x13b
cmp cx, ax
jne 0x493792
push 1
mov ecx, edi
call fcn.00490a60
sub esp, 8
mov ecx, edi
push dword [ebp + 8]
call fcn.004931c0
jmp 0x49350b
cmp dword [ebp + 0x10], 0
jne 0x49350e
mov eax, dword [edi + 0x84]
mov esi, dword [eax + 0x78]
mov eax, dword [ebx + 8]
cmp eax, 0xfffffe64
jne 0x493870
movzx esi, word [ebx + 0xc]
cmp esi, 0x2e
jne 0x4937ec
mov ecx, edi
call fcn.0048ed00
lea eax, [esi - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 8
test al, al
je 0x49350b
cmp esi, 0x58
jne 0x493824
push 1
mov ecx, edi
call fcn.0048eec0
lea eax, [esi - 0x57]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 0x43
jne 0x493849
push 0
mov ecx, edi
call fcn.0048eec0
lea eax, [esi - 0x42]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 0x56
jne 0x49350b
mov ecx, edi
call fcn.0048efb0
lea eax, [esi - 0x55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xfffffe61
je 0x493b42
cmp eax, 0xfffffe3d
jne 0x4938a1
push 0
mov ecx, edi
call fcn.0048e760
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xfffffff9
jne 0x4938c5
push 1
mov ecx, edi
call fcn.0048e760
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xfffffffe
jne 0x493989
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x1111
push esi
call ebx
test byte [ebp - 0x24], 0x10
je 0x49390e
mov ecx, dword [edi + 0x84]
mov eax, dword [ebp - 0x20]
mov dword [ecx + 0xb0], eax
jmp 0x493956
test byte [ebp - 0x24], 0x46
je 0x493956
mov eax, dword [edi + 0x84]
push 0
push 9
push 0x110a
push esi
mov dword [eax + 0xb0], 0
call ebx
mov dword [ebp + 0xc], eax
cmp eax, dword [ebp - 0x20]
jne 0x493956
push 0
push 0
push 0x110a
push esi
call ebx
cmp dword [ebp + 0xc], eax
je 0x493956
push dword [ebp - 0x20]
push 2
push 0x1102
push esi
call ebx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x493b42
test byte [ebp - 0x24], 0x46
je 0x493b42
push eax
mov ecx, edi
call fcn.0048e6e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xfffffffb
jne 0x493a1d
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x1111
push esi
call ebx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4939d8
push eax
push eax
push 0x110a
push esi
call ebx
push eax
push 9
push 0x110b
push esi
call ebx
mov eax, dword [edi + 0x84]
push 0
push dword [ebp + 8]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 2
push dword [eax + 0x94]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xfffffff4
jne 0x49350e
mov eax, dword [ebx + 0xc]
cmp eax, 1
jne 0x493a47
mov eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test eax, 0x10001
je 0x49350e
mov eax, dword [edi + 0x60]
mov esi, dword [ebx + 0x2c]
mov eax, dword [eax + 0x304]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x28]
test al, 1
je 0x493a8c
mov ecx, dword [edi + 0x68]
test al, 0x10
lea eax, [ebp + 0xc]
push eax
je 0x493a7a
push 0x855bb354
jmp 0x493a7f
push 0xd54834f2
push 0
call fcn.0046fe20
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x44]
cmp eax, dword [ebp + 8]
jl 0x493a9b
mov eax, 0x712d1050
jmp 0x493aae
cmp dword [esi], 0
je 0x493aa9
test eax, eax
mov eax, 0x7e970190
je 0x493aae
mov eax, 0x3b5d8260
mov edx, dword [ebx + 0x28]
test dl, 1
je 0x493b0e
mov ecx, dword [edi + 0x68]
test dl, 0x10
lea edx, [ebp + 0xc]
push edx
je 0x493ae7
inc eax
push eax
push 0
call fcn.0046fe20
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x30], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
add eax, 2
push eax
push 0
call fcn.0046fe20
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x30], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [edi + 0x68]
push eax
push 0
call fcn.0046fe20
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x30], eax
cmp byte [esi + 0x12], 2
jne 0x493b42
mov ecx, dword [edi + 0x68]
lea eax, [ebp + 0xc]
push eax
push 0xc2078d70
push 0
call fcn.0046fe20
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x34], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10