Function at 0x433e50
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Get thread local storage value
Log keystrokes via polling
Log keystrokes via raw input data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d41e
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x60f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ecx]
mov edi, dword [ebp + 0xc]
call dword [eax + 0x28]
mov esi, dword [sym.imp.USER32.dll_GetRawInputData]
push 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0x10000003
push edi
mov dword [ebp - 0x24], 0
call esi
push dword [ebp - 0x24]
call fcn.00550807
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x24]
push 0x10
push eax
push ebx
push 0x10000003
push edi
call esi
cmp eax, dword [ebp - 0x24]
jne 0x4341a4
cmp dword [ebx], 1
movzx eax, word [ebx + 0x14]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
jne 0x433eee
cmp dword [ebx + 0x18], 0x100
jne 0x433eee
push ecx
mov ecx, edi
call fcn.00433a40
mov eax, dword [ebp - 0x30]
mov ecx, 1
test cl, al
je 0x434097
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x48]
lea eax, [ebp - 0x20]
push dword [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4341a4
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4341a4
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
cmp byte [0x61f288], 0
mov byte [edi + 0x104], al
jne 0x43405e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub esi, dword [0x61f284]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
cmp esi, eax
jae 0x434065
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov eax, dword [ebp - 0x2c]
sub eax, dword [0x61f294]
cdq
mov esi, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [0x61f298]
xor esi, edx
sub esi, edx
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
call fcn.00405db0
mov ecx, esi
movsd qword [ebp - 0x3c], xmm0
call fcn.00405db0
movsd xmm1, qword [ebp - 0x3c]
addsd xmm1, xmm0
cvttsd2si eax, xmm1
cmp eax, 0x10
jg 0x434065
push 0xc
mov byte [0x61f288], 1
call fcn.00550175
mov esi, eax
add esp, 4
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0xb4]
call fcn.00436210
mov dword [esi], vtable.DBClickTask.0
mov ecx, dword [ebp - 0x44]
mov dword [esi + 4], ecx
test ecx, ecx
je 0x434018
mov eax, 1
lock xadd dword [ecx], eax
mov eax, dword [ebp - 0x40]
mov dword [esi + 8], eax
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x434040
or eax, 0xffffffff
lock xadd dword [ecx], eax
sub eax, 1
jne 0x434040
test ecx, ecx
je 0x434040
push 8
push ecx
call fcn.0055053d
add esp, 8
mov dword [ebp - 4], 0xffffffff
call fcn.0046fec0
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.0046e090
jmp 0x434065
mov byte [0x61f288], 0
push 0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push eax
push 0x514
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x61f294
mov dword [0x61f284], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x434183
test al, 4
je 0x4340ab
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x61f28c], eax
jmp 0x434183
test al, 8
je 0x4340c3
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [0x61f28c], eax
call esi
jmp 0x434183
test al, 0x20
je 0x434188
call fcn.00457cf0
mov al, byte [eax + 0x23]
test al, al
je 0x434183
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x61f29c]
cmp eax, 0xc8
jb 0x434183
push 0xc
call fcn.00550175
mov esi, eax
add esp, 4
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push eax
lea ecx, [edi + 0xb4]
call fcn.00436210
mov dword [esi], vtable.MdClickTask.0
mov ecx, dword [ebp - 0x3c]
mov dword [esi + 4], ecx
test ecx, ecx
je 0x434130
mov eax, 1
lock xadd dword [ecx], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 8], eax
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x434158
or eax, 0xffffffff
lock xadd dword [ecx], eax
sub eax, 1
jne 0x434158
test ecx, ecx
je 0x434158
push 8
push ecx
call fcn.0055053d
add esp, 8
mov dword [ebp - 4], 0xffffffff
call fcn.0046fec0
push 0
push 0x64
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.0046e2e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x61f29c], eax
mov ecx, 1
cmp dword [ebx], 0
jne 0x4341a4
mov eax, dword [ebx + 0x20]
add eax, dword [ebx + 0x1c]
mov word [ebx + 0x10], cx
cmp eax, 1
jl 0x4341a4
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebx
call fcn.0055056e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550156
mov esp, ebp
pop ebp
ret 8