Function at 0x41fe5b
Capabilities:
Check for unmoving mouse cursor
Find taskbar
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
xor ebx, ebx
cmp dword [0x4a7140], ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
jne 0x41fe7d
cmp dword [0x4a6a90], ebx
je 0x42001e
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
jne 0x41fe98
mov dword [0x4a7a00], ebx
jmp 0x42001e
cmp dword [0x4a7a00], ebx
jne 0x42001e
mov dword [0x4a7a00], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041f94e
mov esi, eax
pop ecx
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x42001e
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 4], esi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41feff
push 0xfffffffffffffff0
push esi
call edi
test eax, 0xc00000
jne 0x41feff
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov esi, eax
jmp 0x41fed9
push 0xfffffffffffffff0
push esi
call edi
test eax, 0xc00000
je 0x42001e
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [0x4a6a90], ebx
je 0x41ffb9
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], ebx
push eax
push esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x54]
push eax
push esi
call edi
test eax, eax
je 0x41ff61
lea eax, [ebp - 0x4c]
push eax
push esi
call edi
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x50]
sub dword [ebp - 0x4c], 0x34
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x58], eax
sub eax, ecx
cmp eax, 0x1e
jge 0x41ff85
add ecx, 0x1e
mov dword [ebp - 0x58], ecx
push dword [ebp - 0x28]
lea eax, [ebp - 0x64]
push dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x41ffb6
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x41ffb6
push dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
call fcn.0041fb6e
jmp 0x4203b4
mov esi, dword [ebp - 8]
cmp dword [0x4a7140], ebx
je 0x42001e
cmp dword [0x47f824], 6
push 0x18
pop ecx
push 0x16
pop eax
jb 0x41ffd6
push 0x34
pop ecx
push 0x21
pop eax
mov edx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x14]
sub edx, ecx
mov ecx, dword [ebp - 0x40]
add ecx, eax
cmp esi, dword [edi + 4]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x38], ecx
je 0x42001e
push dword [ebp - 0x28]
lea eax, [ebp - 0x44]
push dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x42001e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
push esi
mov ecx, edi
je 0x420019
call fcn.0041fb6e
jmp 0x42001e
call fcn.0041e513
cmp dword [0x4a713c], ebx
je 0x4203b4
test byte [0x47f210], 1
jne 0x420044
or byte [0x47f210], 1
call sub.MSVCRT.dll_clock
mov dword [0x47f20c], eax
test byte [0x47f210], 2
jne 0x42005e
or byte [0x47f210], 2
call sub.MSVCRT.dll_clock
mov dword [0x47f208], eax
mov eax, dword [0x4a7150]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x443db8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4a7154]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0042d4a4
pop ecx
mov dword [ebp - 8], eax
pop ecx
push ebx
push ebx
push 0x1018
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x4200b0
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4200b0
push 1
pop esi
jmp 0x4200b2
xor esi, esi
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
cmp esi, ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x420118
call sub.MSVCRT.dll_clock
mov dword [0x47f20c], eax
mov eax, dword [ebp - 0x34]
mov dword [0x4a7a04], 0x32
mov dword [0x47f200], eax
mov eax, dword [ebp - 0x30]
mov dword [0x47f204], eax
lea eax, [ebp - 0x34]
push eax
mov dword [0x4a7a08], 0xfa
call fcn.0041f94e
cmp eax, dword [ebp - 8]
pop ecx
jne 0x42013a
call sub.MSVCRT.dll_clock
mov dword [0x47f20c], eax
jmp 0x4201a8
mov eax, dword [0x47f200]
cmp eax, dword [ebp - 0x34]
jne 0x4200d6
mov eax, dword [0x47f204]
cmp eax, dword [ebp - 0x30]
jne 0x4200d6
dec dword [0x4a7a04]
dec dword [0x4a7a08]
jmp 0x4201a8
cmp dword [ebp - 0xc], eax
jne 0x4201a8
cmp dword [0x4a7158], ebx
je 0x4201a8
call sub.MSVCRT.dll_clock
push 5
mov dword [0x47f20c], eax
push dword [ebp - 8]
call esi
push ebx
push str.Shell_TrayWnd
call edi
cmp dword [0x4a715c], ebx
mov dword [ebp - 4], eax
je 0x420180
cmp eax, ebx
je 0x420180
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x420180
push ebx
push dword [ebp - 4]
call esi
push ebx
push str.Shell_SecondaryTrayWnd
call edi
cmp dword [0x4a715c], ebx
mov dword [ebp - 4], eax
je 0x4201a8
cmp eax, ebx
je 0x4201a8
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4201a8
push ebx
push dword [ebp - 4]
call esi
push ebx
push str.Shell_TrayWnd
call edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
cmp dword [0x4a715c], ebx
mov dword [ebp - 0x10], ebx
je 0x420207
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x30]
lea eax, [ebp - 0x64]
push dword [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
push dword [ebp - 4]
test eax, eax
je 0x420220
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4201f6
push 5
push dword [ebp - 4]
call esi
call sub.MSVCRT.dll_clock
mov dword [0x47f208], eax
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x18], ebx
jne 0x420251
push ebx
push str.Shell_SecondaryTrayWnd
mov dword [ebp - 0x18], 1
call edi
mov dword [ebp - 4], eax
jmp 0x4201b6
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x420207
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x420207
call sub.MSVCRT.dll_clock
sub eax, dword [0x47f208]
cmp eax, 0xbb8
jle 0x420200
push ebx
push dword [ebp - 4]
call esi
jmp 0x420207
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
je 0x42026c
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x8000
test edi, eax
jne 0x4202ac
jmp 0x420271
mov edi, 0x8000
cmp dword [ebp - 0x24], ebx
je 0x420282
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test edi, eax
jne 0x4202ac
cmp dword [ebp - 0x28], ebx
je 0x420293
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test edi, eax
jne 0x4202ac
cmp dword [0x4a7138], ebx
je 0x420336
mov dword [0x4a7138], ebx
mov dword [ebp - 0x18], 1
push dword [ebp - 8]
mov edi, dword [sym.imp.USER32.dll_IsWindowVisible]
call edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
call fcn.0041f94e
cmp dword [ebp - 0x28], ebx
pop ecx
jne 0x420325
cmp eax, dword [ebp - 0xc]
je 0x4202d3
cmp dword [ebp - 0x18], ebx
je 0x42033c
mov dword [0x4a7a04], 0x32
mov dword [0x4a7a08], 0xfa
call sub.MSVCRT.dll_clock
push 5
mov dword [0x47f20c], eax
push dword [ebp - 8]
call esi
cmp dword [0x4a715c], ebx
je 0x4203b4
cmp dword [ebp - 4], ebx
je 0x4203b4
push dword [ebp - 4]
call edi
test eax, eax
jne 0x4203b4
push ebx
push dword [ebp - 4]
call esi
jmp 0x4203b4
cmp eax, dword [ebp - 8]
jne 0x42033c
call sub.MSVCRT.dll_clock
mov dword [0x47f20c], eax
jmp 0x42033c
mov edi, dword [sym.imp.USER32.dll_IsWindowVisible]
call sub.MSVCRT.dll_clock
mov ecx, dword [0x443dbc]
sub eax, dword [0x47f20c]
imul ecx, ecx, 0x3e8
cmp eax, ecx
mov dword [ebp - 0x28], eax
jle 0x420386
push dword [ebp - 8]
call edi
test eax, eax
je 0x420369
push ebx
push dword [ebp - 8]
call esi
cmp dword [0x4a715c], ebx
je 0x4203b4
cmp dword [ebp - 4], ebx
je 0x4203b4
cmp dword [ebp - 0x10], ebx
jne 0x4203b4
push dword [ebp - 4]
call edi
test eax, eax
je 0x4203b4
jmp 0x42031a
mov eax, dword [ebp - 0x14]
push 0x3f1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [0x443dbc]
push ebx
imul ecx, ecx, 0x3e8
sub ecx, dword [ebp - 0x28]
push ecx
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret