Function at 0x486bfc
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x486f2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [0x486f40]
cmp ax, word [ebx + 0x20]
jne 0x486f19
cmp byte [ebx + 0xbd4], 0
je 0x486cec
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
mov eax, dword [0x49ea50]
mov edx, dword [0x49ea54]
cmp edx, dword [ebp - 4]
jne 0x486c56
cmp eax, dword [ebp - 8]
je 0x486cec
mov eax, dword [ebp - 8]
mov dword [0x49ea50], eax
mov eax, dword [ebp - 4]
mov dword [0x49ea54], eax
push dword [ebp - 4]
push dword [ebp - 8]
call sub.user32.dll_WindowFromPoint
lea edx, [ebp - 0xc]
call fcn.00486bc8
mov eax, dword [ebp - 0xc]
mov edx, 0x486f4c
call fcn.00403f40
je 0x486cec
mov eax, dword [ebx + 0xd454]
cmp byte [eax + 0x238], 0
je 0x486caa
mov eax, ebx
call fcn.0043afa4
mov edi, eax
jmp 0x486cb1
call fcn.0043afa4
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ebx + 0xc50]
jne 0x486ccf
cmp eax, dword [ebx + 0xc4c]
je 0x486cec
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040f0d8
push eax
push 0
push 0x200
push edi
call sub.user32.dll_SendMessageA
mov eax, ebx
call fcn.004914d8
test al, al
cmp dword [esi + 4], 0x4cf
jne 0x486f19
cmp byte [ebx + 0xc31], 0
je 0x486f19
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
setne al
and eax, 0x7f
inc eax
push eax
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x486d41
xor edx, edx
mov eax, ebx
call fcn.00486aec
jmp 0x486f19
mov ecx, dword [ebp - 8]
sub ecx, dword [ebx + 0xc38]
mov esi, dword [ebp - 4]
sub esi, dword [ebx + 0xc3c]
cmp byte [ebx + 0xb68], 5
je 0x486dff
test ecx, ecx
jne 0x486d6c
test esi, esi
je 0x486dff
cmp byte [ebx + 0xc31], 0
je 0x486dff
cmp byte [ebx + 0xda4], 0
jne 0x486dff
cmp byte [ebx + 0xda5], 0
je 0x486dff
mov byte [ebx + 0xda4], 1
mov edx, dword [ebx + 0xb74]
mov eax, ebx
call fcn.004346f0
mov edx, dword [ebx + 0xb78]
mov eax, ebx
call fcn.00434710
mov edx, dword [ebx + 0xb7c]
sub edx, dword [ebx + 0xb74]
mov eax, ebx
call fcn.00434734
mov edx, dword [ebx + 0xb80]
sub edx, dword [ebx + 0xb78]
mov eax, ebx
call fcn.00434754
mov eax, dword [ebx + 0x38]
sar eax, 1
jns 0x486ddc
adc eax, 0
add eax, dword [ebx + 0x30]
mov dword [ebx + 0xc38], eax
mov eax, dword [ebx + 0x34]
add eax, 5
mov dword [ebx + 0xc3c], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebx + 0xc38]
mov esi, dword [ebp - 4]
sub esi, eax
cmp byte [ebx + 0xc32], 0
jne 0x486e4c
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jge 0x486e24
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jl 0x486f19
xor ecx, ecx
xor esi, esi
xor eax, eax
mov dword [ebx + 0xc54], eax
xor eax, eax
mov dword [ebx + 0xc58], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0xc40], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0xc44], eax
jmp 0x486e6e
mov eax, dword [ebx + 0xc40]
add eax, ecx
sub eax, dword [ebx + 0x30]
mov dword [ebx + 0xc54], eax
mov eax, dword [ebx + 0xc44]
add eax, esi
sub eax, dword [ebx + 0x34]
mov dword [ebx + 0xc58], eax
mov eax, dword [ebx + 0xc40]
add eax, ecx
cmp eax, dword [ebx + 0x30]
jne 0x486e88
mov edx, dword [ebx + 0xc44]
add edx, esi
cmp edx, dword [ebx + 0x34]
je 0x486ed3
mov dword [ebx + 0xc6c], eax
add esi, dword [ebx + 0xc44]
mov dword [ebx + 0xc70], esi
cmp byte [ebx + 0xcfd], 0
je 0x486eae
mov dl, 1
mov eax, ebx
call fcn.004936a0
jmp 0x486ed3
push 0xffffffffffffffff
mov eax, dword [ebx + 0x3c]
push eax
mov eax, dword [ebx + 0x38]
push eax
mov eax, dword [ebx + 0xc70]
push eax
mov eax, dword [ebx + 0xc6c]
push eax
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_MoveWindow
mov eax, dword [ebx + 0xc7c]
xor edx, edx
call fcn.004044c4
je 0x486ef8
mov ecx, 0x486f58
mov edx, dword [ebx + 0xc7c]
mov eax, dword [ebx + 0xd454]
call fcn.00451598
mov eax, dword [ebx + 0xc8c]
test eax, eax
je 0x486f12
push 0
mov ecx, eax
mov edx, pe_nt_image_headers32
mov eax, ebx
call fcn.0049a11c
mov byte [ebx + 0xc32], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486f36
lea eax, [ebp - 0xc]
call fcn.00403bb0
ret