Function at 0x5147d0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push edi
mov edi, dword [esp + 0x30]
xor ebp, ebp
push ebp
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
cmp dword [ebx + 0x60], ebp
je 0x5147fb
push ebp
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
cmp dword [esp + 0x38], ebp
je 0x514e9c
push esi
mov esi, dword [esp + 0x38]
lea eax, [esi - 9]
cmp eax, 0x38
ja case.0x514819.10
movzx eax, byte [eax + 0x514ee4]
jmp dword [eax*4 + 0x514ebc]
mov esi, ebx
call fcn.00514020
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov esi, ebx
call fcn.005140a0
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
test ax, ax
jge case.0x514819.10
push 0x10
call esi
test ax, ax
jge 0x514876
push ebp
or eax, 0xffffffff
push ebp
push edi
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov ecx, dword [ebx + 0xa0]
mov dword [ebx + 0x34], ebp
dec ecx
push ebp
push ebp
push edi
mov dword [ebx + 0x38], ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
test ax, ax
push 0x10
jge 0x51493f
mov dword [ebx + 0x54], ebp
call esi
test ax, ax
mov eax, dword [ebx + 0x34]
jge 0x514908
cmp eax, 0xffffffff
je 0x5148e8
dec eax
cmp eax, ebp
mov dword [ebx + 0x34], eax
jge 0x5148cf
mov edx, dword [ebx + 0xa0]
dec edx
mov dword [ebx + 0x34], edx
mov eax, dword [ebx + 0x34]
push ebp
push ebp
push edi
mov dword [ebx + 0x38], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov eax, dword [ebx + 0xa0]
push ebp
dec eax
push ebp
push edi
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
cmp eax, 0xffffffff
je 0x514926
mov ecx, dword [ebx + 0xa0]
inc eax
cmp eax, ecx
mov dword [ebx + 0x34], eax
jl 0x51491e
mov dword [ebx + 0x34], ebp
mov ecx, dword [ebx + 0x34]
jmp 0x514880
push ebp
push ebp
push edi
mov dword [ebx + 0x34], ebp
mov dword [ebx + 0x38], ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
call esi
test ax, ax
push ebp
jge 0x514963
push 1
push 0x28
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
push ebp
jmp 0x514949
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge case.0x514819.10
cmp dword [ebx + 0x34], 0xffffffff
je case.0x514819.10
mov edx, dword [ebx + 0xa0]
push ebp
push ebp
dec edx
push edi
mov dword [ebx + 0x38], edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge case.0x514819.10
cmp dword [ebx + 0x34], 0xffffffff
je case.0x514819.10
push ebp
push ebp
push edi
mov dword [ebx + 0x34], ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
xor eax, eax
cmp esi, 0x26
setne al
push 0x11
lea eax, [eax + eax - 1]
mov esi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x514a68
cmp dword [ebx + 0x34], 0xffffffff
je case.0x514819.10
cmp esi, ebp
je case.0x514819.10
xor edi, edi
xor edx, edx
cmp esi, ebp
jge 0x514a08
neg esi
jmp 0x514a0c
mov edx, esi
xor esi, esi
lea ebp, [esp + 0x10]
push ebp
xor ecx, ecx
push ecx
xor eax, eax
push eax
push edx
push edi
push esi
push eax
call fcn.00512a30
test eax, eax
je case.0x514819.10
mov ecx, dword [esp + 0x34]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebx + 0x6c]
test eax, eax
je case.0x514819.10
movzx edx, word [ebx + 0x38]
movzx ecx, word [ebx + 0x34]
shl edx, 0x10
or edx, ecx
push edx
push 0
push 0x612
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
cmp dword [ebx + 0x24], 0xffffffff
je case.0x514819.10
lea edx, [esp + 0x20]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
add eax, esi
cmp eax, ecx
mov dword [esp + 0x14], eax
jge case.0x514819.10
cmp eax, dword [esp + 0x24]
jl case.0x514819.10
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
cmp esi, 0x25
setne dl
push 0x11
lea edx, [edx + edx - 1]
mov esi, edx
call edi
test ax, ax
jge 0x514b58
cmp dword [ebx + 0x34], 0xffffffff
je 0x514baf
cmp esi, ebp
je case.0x514819.10
xor edi, edi
cmp esi, ebp
jge 0x514afa
neg esi
mov edi, esi
xor esi, esi
lea ebp, [esp + 0x10]
push ebp
xor edx, edx
push edx
xor ecx, ecx
push ecx
push ecx
push edi
xor eax, eax
push eax
push esi
call fcn.00512a30
test eax, eax
je case.0x514819.10
mov eax, dword [esp + 0x34]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebx + 0x6c]
test eax, eax
je case.0x514819.10
movzx ecx, word [ebx + 0x38]
movzx edx, word [ebx + 0x34]
shl ecx, 0x10
or ecx, edx
push ecx
push 0
push 0x612
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
cmp dword [ebx + 0x24], 0xffffffff
je 0x514baf
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
add eax, esi
cmp eax, ecx
mov dword [esp + 0x10], eax
jge case.0x514819.10
cmp eax, dword [esp + 0x20]
jl case.0x514819.10
mov ecx, dword [esp + 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
push 0x10
call edi
test ax, ax
jge case.0x514819.10
cmp esi, ebp
mov eax, dword [ebx + 0x34]
jle 0x514c65
cmp eax, 0xffffffff
je 0x514c48
cmp dword [ebx + 0x54], ebp
je 0x514c15
mov ecx, dword [ebx + 0x38]
cmp ecx, eax
je 0x514c15
inc eax
cmp ecx, eax
mov dword [ebx + 0x34], eax
jge 0x514cd6
mov edx, dword [ebx + 0xa0]
dec edx
cmp eax, edx
jle 0x514bf2
mov dword [ebx + 0x34], edx
mov eax, dword [ebx + 0x34]
mov edx, dword [esp + 0x34]
push ebp
push ebp
push edx
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x54], ebp
mov dword [ebx + 0x38], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov esi, dword [ebx + 0x38]
mov ecx, dword [ebx + 0xa0]
inc esi
mov eax, esi
dec ecx
cmp eax, ecx
mov dword [ebx + 0x38], esi
jl 0x514c2b
mov eax, ecx
mov edx, dword [esp + 0x34]
push ebp
push ebp
push edx
mov dword [ebx + 0x54], ebp
mov dword [ebx + 0x38], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov edx, dword [esp + 0x34]
push ebp
push ebp
push edx
mov dword [ebx + 0x34], ebp
mov dword [ebx + 0x38], ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
cmp eax, 0xffffffff
je 0x514cc9
mov ecx, dword [ebx + 0x38]
cmp eax, ecx
mov edx, 1
jne 0x514c79
mov dword [ebx + 0x54], edx
cmp dword [ebx + 0x54], ebp
je 0x514ca0
dec eax
cmp eax, ebp
mov dword [ebx + 0x34], eax
jge 0x514cd6
mov edx, dword [esp + 0x34]
push ebp
push ebp
push edx
mov dword [ebx + 0x34], ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
dec ecx
cmp ecx, eax
mov dword [ebx + 0x38], ecx
jge 0x514cd6
cmp ecx, ebp
jge 0x514caf
mov dword [ebx + 0x38], ebp
push ebp
mov dword [ebx + 0x54], edx
mov edx, dword [esp + 0x38]
push ebp
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov eax, dword [ebx + 0xa0]
dec eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov edx, dword [esp + 0x34]
push ebp
push ebp
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, edi
je 0x514d25
movzx eax, word [esp + 0x44]
movzx ecx, word [esp + 0x40]
shl eax, 0x10
or eax, ecx
push eax
push esi
push 0x100
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
mov eax, dword [ebx + 0x4c]
mov ebp, dword [sym.imp.USER32.dll_GetDC]
xor esi, esi
cmp eax, esi
je 0x514dab
cmp dword [ebx + 0x44], esi
jl 0x514dab
mov edx, dword [esp + 0x34]
push edx
call ebp
mov ecx, dword [ebx + 0x3c]
mov edi, eax
mov eax, dword [ebx + 0x40]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x44]
cmp eax, esi
mov dword [esp + 0x10], ecx
jge 0x514d5d
mov dword [esp + 0x18], esi
jmp 0x514d73
mov ecx, dword [ebx + 0x80]
sub ecx, dword [ebx + 0x78]
dec ecx
cmp eax, ecx
mov dword [esp + 0x18], ecx
jg 0x514d73
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x48]
cmp eax, esi
jge 0x514d80
mov dword [esp + 0x1c], esi
jmp 0x514d96
mov ecx, dword [ebx + 0x84]
sub ecx, dword [ebx + 0x7c]
dec ecx
cmp eax, ecx
mov dword [esp + 0x1c], ecx
jg 0x514d96
mov dword [esp + 0x1c], eax
lea esi, [esp + 0x10]
call fcn.00511e80
mov edx, dword [esp + 0x34]
push edi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x514dc1
mov eax, dword [esp + 0x34]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esi, dword [ebx + 0x24]
or eax, 0xffffffff
xor edi, edi
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x28], edi
mov dword [ebx + 0x4c], edi
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x1c], edi
je case.0x514819.10
mov ecx, dword [esp + 0x34]
push ecx
call ebp
cmp esi, dword [ebx + 0x34]
jl 0x514e26
cmp esi, dword [ebx + 0x38]
jg 0x514e26
mov edx, dword [ebx + 0x2c]
xor ecx, ecx
cmp edx, edi
jle 0x514e3b
jmp 0x514e00
mov edx, dword [ebx + 0x28]
mov esi, dword [ebx + 0x34]
mov ebp, dword [edx + ecx*8]
mov edi, dword [ebx + 0xb4]
add esi, ecx
mov dword [edi + esi*8], ebp
mov edx, dword [edx + ecx*8 + 4]
mov dword [edi + esi*8 + 4], edx
mov edx, dword [ebx + 0x2c]
inc ecx
cmp ecx, edx
jl 0x514e00
jmp 0x514e3b
mov ecx, dword [ebx + 0x28]
mov edi, dword [ecx]
mov edx, dword [ebx + 0xb4]
mov dword [edx + esi*8], edi
mov ecx, dword [ecx + 4]
mov dword [edx + esi*8 + 4], ecx
mov edi, dword [esp + 0x34]
push eax
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [ebx + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebx + 0x28]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
push esi
push esi
push edi
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ebx, dword [ebx + 0x6c]
cmp ebx, esi
je case.0x514819.10
push 0xffffffffffffffff
push esi
push 0x612
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
cmp dword [esp + 0x34], 0x1b
jne 0x51488d
push ebp
push ebp
push ebp
push edi
call fcn.00514400
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 0x14