Function at 0x4c0af0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.005c0c5b
mov ecx, dword [esi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_GetClientRect]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
add edi, 0x30
push ecx
mov dword [esp + 0x18], edi
call ebx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.005b3de7
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4c0b55
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
jmp 0x4c0b61
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.005adc36
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x1c]
push edx
push eax
call ebx
mov ebx, 0xffff
push 1
mov dword [esp + 0x44], ebx
mov ebp, ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x4c0cf1
jmp 0x4c0bb0
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x10]
lea esp, [esp]
push 1
push 0x20d
push 0x200
push 0
push edi
call dword [0x652d3c]
test eax, eax
jne 0x4c0bb0
call fcn.005b0dc0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x5c]
test eax, eax
je 0x4c0cea
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
sub ecx, eax
mov eax, dword [esp + 0x18]
sub eax, edx
cmp ebx, 0xffff
jne 0x4c0c1f
mov ebx, dword [esi + 0x420]
sub ebx, ecx
mov dword [esp + 0x40], ebx
cmp ebp, 0xffff
mov edi, dword [esp + 0x28]
jne 0x4c0c3a
mov ebp, edi
sub ebp, dword [esi + 0x424]
sub ebp, edx
sub ebp, eax
sub ebp, 6
xor edx, edx
add ecx, ebx
add eax, ebp
test ecx, ecx
setle dl
dec edx
and ecx, edx
xor edx, edx
test eax, eax
setle dl
dec edx
and eax, edx
mov edx, dword [esp + 0x24]
add edx, 0xfffffffa
cmp ecx, edx
jl 0x4c0c5f
mov ecx, edx
lea ebx, [edi - 6]
cmp eax, ebx
jl 0x4c0c68
mov eax, ebx
cmp ecx, 8
jge 0x4c0c6f
xor ecx, ecx
cmp eax, 8
jge 0x4c0c76
xor eax, eax
mov ebx, dword [esp + 0x24]
add ebx, 0xfffffff2
cmp ecx, ebx
jle 0x4c0c83
mov ecx, edx
lea edx, [edi - 0xe]
cmp eax, edx
jle 0x4c0c8d
lea eax, [edi - 6]
cmp ecx, dword [esi + 0x420]
jne 0x4c0caa
mov ebx, dword [esi + 0x424]
mov edx, edi
sub edx, ebx
sub edx, dword [esp + 0x20]
sub edx, 6
cmp eax, edx
je 0x4c0cd8
sub edi, dword [esp + 0x20]
sub edi, eax
push 0
mov dword [esi + 0x420], ecx
sub edi, 6
push 0
mov ecx, esi
mov dword [esi + 0x424], edi
call fcn.004c0280
mov eax, dword [esi + 0x1c]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x4c0ba4
jmp 0x4c0cf1
push 0
call fcn.005c2f23
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret 4