Function at 0x44beb0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp eax, 0x84
mov esi, ecx
mov dword [edi], ebx
ja 0x44bfad
je 0x44bf5a
add eax, 0xfffffffe
cmp eax, 0x1e
ja case.0x44bfc4.276
movzx eax, byte [eax + 0x44c218]
jmp dword [eax*4 + 0x44c204]
mov ecx, dword [esi + 0x68]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0x68], ebx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0044a5c0
mov dword [edi], ebx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esi + 0xd9], bl
je 0x44bf31
call fcn.004a77b8
push 0x7f89
jmp 0x44bf3b
call fcn.004a77b8
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [edi], 1
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esi + 0xd9], bl
je 0x44bf7e
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 2
call ebx
test ax, ax
jl 0x44bf7e
push 4
call ebx
test ax, ax
jge case.0x44bfc4.276
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 0x68]
push edx
push eax
push 0x84
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
cmp eax, 1
mov dword [edi], eax
jne 0x44bfa2
mov dword [edi], 0xffffffff
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
add eax, 0xfffffeed
cmp eax, 0xef
ja case.0x44bfc4.276
movzx edx, byte [eax + 0x44c24c]
jmp dword [edx*4 + 0x44c238]
cmp dword [ebp + 0x10], 1
jne case.0x44bfc4.276
cmp byte [esi + 0x120], bl
mov byte [esi + 0x138], 1
jne 0x44c111
call fcn.0041e670
mov ecx, dword [esi + 0x130]
mov ebx, eax
mov eax, dword [esi + 0x128]
mov edi, edx
cdq
mov dword [esp + 0x10], eax
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x1c], edi
sbb edi, dword [esi + 0x134]
mov dword [esp + 0x18], ebx
cmp edi, edx
mov dword [esp + 0x20], eax
jl 0x44c111
jg 0x44c02c
cmp eax, dword [esp + 0x10]
jb 0x44c111
mov edi, ebx
sub edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
sbb ebx, edx
lea eax, [esi + 0x108]
sub edi, ecx
sbb ebx, dword [esi + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0xb8]
mov edx, dword [ecx]
mov eax, dword [esi + 0x124]
mov edx, dword [edx + 0x48]
push eax
call edx
mov ecx, dword [esi + 0xb8]
add dword [esi + 0x124], 1
mov dword [esi + 0x12c], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
call edx
cmp dword [esi + 0x124], eax
jl 0x44c08d
mov dword [esi + 0x124], 0
mov ecx, dword [esi + 0xb8]
mov eax, dword [ecx]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 0x2c]
call eax
mov ecx, eax
mov eax, dword [esi + 0x124]
add eax, 1
xor edx, edx
div ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb8]
push eax
mov eax, dword [edx + 0x44]
call eax
mov dword [esi + 0x128], eax
cdq
sub eax, edi
sbb edx, ebx
test edx, edx
jg 0x44c0da
jl 0x44c0d2
test eax, eax
jae 0x44c0da
xor eax, eax
mov dword [esp + 0x24], eax
jmp 0x44c0de
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x128], eax
lea eax, [esi + 0x108]
push eax
mov dword [esi + 0x130], ecx
mov dword [esi + 0x134], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi]
mov edx, dword [eax + 0xdc]
mov ecx, esi
call edx
mov byte [esi + 0x138], 0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.004a137e
lea ecx, [esp + 0x18]
push ecx
mov byte [esi + 0xda], 1
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0xdc], eax
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe0], ecx
mov dword [esi + 0xe8], ecx
mov dword [edi], ebx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esi + 0xda], bl
je 0x44c1c8
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
sub ebx, dword [esi + 0xe8]
sub edi, dword [esi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x54]
push ebx
push edi
mov ecx, esi
call edx
add dword [esi + 0xe4], edi
add dword [esi + 0xe8], ebx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [esi + 0xda], bl
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10