Function at 0x4ab7c0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 0x84
mov esi, ecx
jne 0x4ab7e7
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0xa0
jne 0x4ab902
cmp dword [esi + 0x80], 0
jne 0x4ab82d
cmp dword [esi + 0x8c], 5
jne 0x4ab82d
mov eax, dword [esi + 0x20]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x12
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov dword [esi + 0x80], eax
mov eax, dword [esi + 0x8c]
cmp eax, 0xb
je 0x4ab846
cmp eax, 9
jne 0x4ab8b6
cmp dword [esi + 0x114], 0
je 0x4ab8b6
mov eax, dword [ebp + 0x10]
movsx edi, ax
shr eax, 0x10
lea edx, [esp + 0x10]
movsx ebx, ax
mov eax, dword [esi + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
add dword [esp + 0x14], 0x1a
push ebx
push edi
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4ab8cf
mov ebx, 1
test byte [0x5c38e0], bl
jne 0x4ab89c
or dword [0x5c38e0], ebx
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x5c38e4], eax
call dword [sym.imp.USER32.dll_GetCursor]
mov ecx, dword [0x5c38e4]
cmp eax, ecx
je 0x4ab8b3
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push edi
mov ecx, esi
call fcn.00463f20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 2
test byte [0x5c38e0], al
jne 0x4ab8f4
or dword [0x5c38e0], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x5c38e8], eax
call dword [sym.imp.USER32.dll_GetCursor]
mov ecx, dword [0x5c38e8]
jmp 0x4ab8a8
cmp edi, 0x2a2
jne 0x4ab968
cmp dword [esi + 0x8c], 5
jne 0x4ab959
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4ab959
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.00427110
test eax, eax
jne 0x4ab959
push eax
mov ecx, esi
call fcn.004f3a53
mov dword [esi + 0x80], 0
jmp 0x4ab8b6
cmp edi, 0xa1
jne 0x4ab9f9
mov eax, dword [esi + 0x8c]
cmp eax, 5
je 0x4ab9af
cmp eax, 0xb
je 0x4ab9af
cmp eax, 9
jne 0x4ab992
cmp dword [esi + 0x114], 0
jne 0x4ab9af
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push 0xa1
mov ecx, esi
call fcn.00463f20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 0x20]
movsx edi, ax
shr eax, 0x10
movsx ebx, ax
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
add dword [esp + 0x14], 0x1a
push ebx
push edi
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4ab8b3
mov eax, esi
call fcn.004ac1e0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x111
jne 0x4aba48
mov eax, dword [ebp + 0xc]
mov ecx, eax
shr ecx, 0x10
jne 0x4ab8b6
cmp ax, 0x2712
je 0x4aba33
cmp ax, 0x4e22
je 0x4aba33
cmp ax, 2
mov eax, esi
jne 0x4ab9e6
call fcn.004aae30
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, esi
call fcn.004aae30
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x113
jne 0x4abb71
mov eax, dword [ebp + 0xc]
cmp eax, 0x3e9
jne 0x4abae3
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.00427110
test eax, eax
je 0x4abaa8
mov dword [esi + 0x78], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, 1
add dword [esi + 0x78], ebx
cmp dword [esi + 0x78], 0x50
jbe 0x4abad8
mov ecx, dword [esi + 0x20]
push 0x3e9
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 0x20]
push 0
push 0x64
push 0x3eb
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x3eb
jne 0x4abb3c
mov eax, dword [esi + 0x84]
test eax, eax
jne 0x4abb15
mov eax, dword [esi + 0x20]
push 0x3eb
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, esi
call fcn.004aae30
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add eax, 0xffffffff
mov edx, dword [esi + 0x20]
mov cl, 0x32
mov dword [esi + 0x84], eax
imul cl
push 2
push eax
push 0
push edx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x3ea
jne 0x4ab8b6
mov eax, dword [esi + 0x84]
cmp eax, 5
jne 0x4abb6c
mov eax, dword [esi + 0x20]
push 0x3ea
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add eax, 1
jmp 0x4abb18
cmp edi, 0x464
jne 0x4abbae
push 0
push 0x80000
push 0
call fcn.004f396c
push 8
mov ecx, esi
call fcn.004f3a53
mov eax, dword [esi + 0x20]
push 0
push 0x64
push 0x3ea
push eax
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x210
jne 0x4ab8b6
cmp word [ebp + 0xc], 0x201
jne 0x4ab8b6
cmp dword [esi + 0x8c], 9
jne 0x4ab8b6
cmp dword [esi + 0x114], 0
je 0x4ab8b6
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x7d01
mov ecx, esi
call fcn.004f3841
test eax, eax
je 0x4aba28
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00427110
test eax, eax
je 0x4ab8b6
mov eax, dword [esi + 0x20]
push 0
push 0x7d01
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4ab8b6