Function at 0x4d588a
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 8], 0
je 0x4d58b5
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x4d58b5
push dword [ebp + 8]
call fcn.0054e28c
pop ecx
cmp eax, 0x5a
jb 0x4d58bc
xor eax, eax
jmp 0x4d6117
test ebx, ebx
je 0x4d58ca
push ebx
call fcn.0051fd59
test eax, eax
jne 0x4d58d1
xor eax, eax
jmp 0x4d6117
push dword [ebx + 0xb6c]
call fcn.0041261f
test eax, eax
jne 0x4d58e7
xor eax, eax
jmp 0x4d6117
cmp dword [ebx + 0x6bc], 1
je 0x4d58f7
xor eax, eax
jmp 0x4d6117
xor edx, edx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x14], eax
lea edx, [ebx + 0x67c]
push edx
push 0
push dword [ebp + 8]
call fcn.0048e140
mov edi, eax
test edi, edi
je 0x4d5954
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0xc], eax
mov edx, dword [edi + 0x20]
mov dword [ebp - 0x14], edx
mov esi, dword [ebx + 0x674]
jmp 0x4d5937
mov esi, dword [esi + 0x40]
inc dword [ebp - 8]
test esi, esi
je 0x4d593f
cmp edi, esi
jne 0x4d5931
test esi, esi
jne 0x4d5954
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
xor edi, edi
mov eax, dword [ebp + 0x10]
sub eax, 1
jb 0x4d5975
je 0x4d5b9e
dec eax
je 0x4d60e4
dec eax
je 0x4d6100
jmp 0x4d6115
cmp dword [ebp - 0xc], 0
je 0x4d5b96
test edi, edi
je 0x4d5b96
mov edx, dword [ebx + 0xb6c]
cmp dword [edx + 0x1bf8], 0
je 0x4d5a12
push 0
push dword [ebp - 8]
push 0x187
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov esi, eax
cmp esi, 0xffffffff
je 0x4d59c5
test esi, esi
jle 0x4d59c5
mov eax, dword [ebx + 0xb6c]
or dword [eax + 0x1bf8], 4
jmp 0x4d59d2
mov edx, dword [ebx + 0xb6c]
or dword [edx + 0x1bf8], 8
push 0
push dword [ebp - 8]
push 0x199
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov dword [0x56bc30], eax
mov eax, dword [0x56bc30]
cmp eax, 0xffffffff
je 0x4d59ff
test eax, eax
jl 0x4d59ff
cmp eax, 0xf
jle 0x4d5a09
mov dword [0x56bc30], 0x63
mov edx, dword [ebp - 0x14]
mov dword [0x56bc34], edx
mov dword [ebp - 0x24], 0xffffffff
cmp dword [0x56f020], 0
je 0x4d5a98
mov ecx, dword [ebx]
cmp ecx, dword [0x56f024]
jne 0x4d5a98
cmp dword [ebx + 0x6ec], 0
je 0x4d5a98
push 1
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
je 0x4d5a63
push 2
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
jne 0x4d5a98
lea ecx, [ebp - 0x24]
push ecx
call sub.USER32.dll_GetCursorPos
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x820]
call sub.USER32.dll_ScreenToClient
movzx edx, word [ebp - 0x20]
shl edx, 0x10
or edx, 1
push edx
push 0
push 0x202
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0x18e
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0x18], eax
push 0
push 0
push 0x19f
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0xb
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push 0
push dword [ebp - 8]
push 0x182
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x18]
jg 0x4d5b02
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jge 0x4d5b02
xor eax, eax
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x1c]
jg 0x4d5b18
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0
jge 0x4d5b18
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push ebx
call fcn.004d582c
push 0
push dword [ebp - 0x18]
push 0x197
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4d5b55
push 0
push dword [ebp - 0x1c]
push 0x19e
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push 0
push 1
push 0xb
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push 0
push 0
push dword [ebx + 0x820]
call sub.USER32.dll_InvalidateRect
push edi
push dword [ebx + 0x674]
call fcn.004c6c7e
mov dword [ebx + 0x674], eax
add ebx, 0x67c
push ebx
push dword [ebp + 8]
call fcn.0048e1dc
mov eax, dword [ebp - 0xc]
jmp 0x4d6117
cmp dword [ebp + 0x14], 0
jne 0x4d5bac
mov eax, dword [ebp - 0xc]
jmp 0x4d6117
cmp dword [ebp - 0xc], 0
je 0x4d5bf5
cmp dword [ebp + 0x14], 0
jle 0x4d5bd0
mov edx, dword [ebp - 0xc]
and edx, dword [ebp + 0x14]
je 0x4d5bc8
mov eax, dword [ebp - 0xc]
jmp 0x4d6117
mov edx, dword [ebp - 0xc]
add dword [ebp + 0x14], edx
jmp 0x4d5c03
mov ecx, dword [ebp + 0x14]
mov eax, ecx
neg ecx
mov dword [ebp + 0x14], ecx
mov edx, dword [ebp - 0xc]
and edx, dword [ebp + 0x14]
jne 0x4d5bea
mov eax, dword [ebp - 0xc]
jmp 0x4d6117
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp + 0x14]
mov dword [ebp + 0x14], edx
jmp 0x4d5c03
cmp dword [ebp + 0x14], 0
jge 0x4d5c03
mov eax, dword [ebp - 0xc]
jmp 0x4d6117
mov dword [ebp - 0x24], 0xffffffff
cmp dword [0x56f020], 0
je 0x4d5c89
mov edx, dword [ebx]
cmp edx, dword [0x56f024]
jne 0x4d5c89
cmp dword [ebx + 0x6ec], 0
je 0x4d5c89
push 1
call sub.USER32.dll_GetKeyState
movsx ecx, ax
and ecx, 0x8000
cmp ecx, 0x8000
je 0x4d5c54
push 2
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x4d5c89
lea edx, [ebp - 0x24]
push edx
call sub.USER32.dll_GetCursorPos
lea ecx, [ebp - 0x24]
push ecx
push dword [ebx + 0x820]
call sub.USER32.dll_ScreenToClient
movzx eax, word [ebp - 0x20]
shl eax, 0x10
or eax, 1
push eax
push 0
push 0x202
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0x18e
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0x18], eax
push 0
push 0
push 0x19f
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0xb
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
cmp dword [ebp - 0xc], 0
je 0x4d5d9b
test edi, edi
je 0x4d5d9b
mov edx, dword [ebx + 0xb6c]
cmp dword [edx + 0x1bf8], 0
je 0x4d5d65
push 0
push dword [ebp - 8]
push 0x187
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov esi, eax
cmp esi, 0xffffffff
je 0x4d5d18
test esi, esi
jle 0x4d5d18
mov eax, dword [ebx + 0xb6c]
or dword [eax + 0x1bf8], 4
jmp 0x4d5d25
mov edx, dword [ebx + 0xb6c]
or dword [edx + 0x1bf8], 8
push 0
push dword [ebp - 8]
push 0x199
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov dword [0x56bc30], eax
mov eax, dword [0x56bc30]
cmp eax, 0xffffffff
je 0x4d5d52
test eax, eax
jl 0x4d5d52
cmp eax, 0xf
jle 0x4d5d5c
mov dword [0x56bc30], 0x63
mov edx, dword [ebp - 0x14]
mov dword [0x56bc34], edx
push 0
push dword [ebp - 8]
push 0x182
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push edi
push dword [ebx + 0x674]
call fcn.004c6c7e
mov dword [ebx + 0x674], eax
lea ecx, [ebx + 0x67c]
push ecx
push dword [ebp + 8]
call fcn.0048e1dc
xor eax, eax
mov dword [ebp - 4], eax
mov esi, 1
mov eax, dword [ebx + 0xb6c]
lea edx, [eax + 0x18dc]
mov ecx, dword [ebx + 0xb6c]
lea eax, [ecx + 0x1878]
jmp 0x4d5dd6
mov ecx, dword [edx]
mov edi, ecx
and edi, dword [ebp + 0x14]
je 0x4d5dd2
mov esi, ecx
movzx eax, byte [eax]
mov dword [ebp - 4], eax
jmp 0x4d5ddb
add edx, 4
inc eax
cmp byte [eax], 0
jne 0x4d5dbf
xor edx, edx
mov dword [ebp - 8], edx
mov edi, dword [ebx + 0x674]
test edi, edi
je 0x4d5e14
mov eax, dword [edi + 0x1c]
mov edx, esi
add edx, edx
cmp eax, edx
jge 0x4d5e0a
test eax, esi
je 0x4d5e14
push dword [edi]
push dword [ebp + 8]
call fcn.0054e450
add esp, 8
test eax, eax
jl 0x4d5e14
inc dword [ebp - 8]
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x4d5dea
cmp dword [ebp - 4], 0
je 0x4d5e36
push dword [ebp + 8]
push dword [ebp - 4]
push 0x56bc50
lea ecx, [ebp - 0x88]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x4d5e60
mov eax, dword [ebp + 8]
push edi
lea esi, [ebp - 0x88]
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
cmp dword [ebx + 0x678], 0
je 0x4d5ec7
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax]
push edx
call fcn.00556298
pop ecx
mov dword [ebp - 0x10], eax
mov esi, dword [ebx + 0x678]
test esi, esi
je 0x4d5ec7
mov eax, dword [esi + 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x4d5ec0
push dword [ebp + 8]
push dword [esi]
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x4d5ec0
mov edx, dword [esi + 8]
mov dword [0x56bc30], edx
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
push esi
push dword [ebx + 0x678]
call fcn.004c6c7e
mov dword [ebx + 0x678], eax
jmp 0x4d5ec7
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x4d5e84
mov eax, dword [ebx + 0xb6c]
cmp dword [eax + 0x1bf8], 0
je 0x4d5ee8
cmp dword [0x56bc34], 0xffffffff
je 0x4d5ee8
mov edx, dword [0x56bc34]
mov dword [ebp - 0x14], edx
mov dword [0x56bc34], 0xffffffff
test edi, edi
je 0x4d5f4d
push dword [ebp + 0x14]
push dword [ebp + 8]
push 0
call fcn.004c6a18
mov esi, eax
test esi, esi
je 0x4d5f9f
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax]
push edx
call fcn.00556298
pop ecx
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x20], ecx
push esi
push edi
push dword [ebx + 0x674]
call fcn.004c6cfe
mov dword [ebx + 0x674], eax
lea eax, [ebx + 0x67c]
push eax
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
call fcn.0048dfda
mov edi, esi
jmp 0x4d5f9f
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebx + 0x674]
call fcn.004c6a18
mov esi, eax
test esi, esi
je 0x4d5f98
mov eax, esi
mov dword [ebx + 0x674], eax
mov edi, dword [eax + 0x44]
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax]
push edx
call fcn.00556298
pop ecx
mov dword [edi + 0xc], eax
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x20], ecx
lea eax, [ebx + 0x67c]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp + 8]
call fcn.0048dfda
mov dword [ebp - 8], 0xffffffff
test edi, edi
je 0x4d60bf
lea edx, [ebp - 0x88]
push edx
push dword [ebp - 8]
push 0x181
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov esi, eax
cmp esi, 0xffffffff
je 0x4d60bf
cmp esi, 0xfffffffe
je 0x4d60bf
mov eax, dword [ebx + 0xb6c]
mov eax, dword [eax + 0x1bf8]
test eax, eax
je 0x4d6023
test al, 4
je 0x4d5ffc
push esi
push 1
push 0x185
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push dword [0x56bc30]
push esi
push 0x19a
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov edx, dword [ebx + 0xb6c]
xor ecx, ecx
mov dword [edx + 0x1bf8], ecx
jmp 0x4d6072
cmp dword [ebp - 0x14], 0
je 0x4d6033
mov eax, dword [0x56bc30]
mov dword [ebp - 8], eax
jmp 0x4d605e
push dword [ebx + 0xb6c]
push 2
push 0
lea edx, [ebp - 8]
push edx
push dword [edi + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebx]
call fcn.0043df7c
cmp dword [ebp - 8], 0xffffffff
jne 0x4d605e
mov dword [ebp - 8], 0x63
push dword [ebp - 8]
push esi
push 0x19a
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
cmp esi, dword [ebp - 0x18]
jg 0x4d607a
inc dword [ebp - 0x18]
cmp esi, dword [ebp - 0x1c]
jg 0x4d6082
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x18]
push ebx
call fcn.004d582c
push 0
push dword [ebp - 0x18]
push 0x197
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4d60bf
push 0
push dword [ebp - 0x1c]
push 0x19e
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push 0
push 1
push 0xb
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
push 0
push 0
push dword [ebx + 0x820]
call sub.USER32.dll_InvalidateRect
mov eax, dword [ebp + 0x14]
jmp 0x4d6117
cmp dword [ebp + 0x14], 0
je 0x4d60fb
mov edx, dword [ebp - 0xc]
and edx, dword [ebp + 0x14]
je 0x4d60f7
mov eax, dword [ebp + 0x14]
jmp 0x4d6117
xor eax, eax
jmp 0x4d6117
mov eax, dword [ebp - 0xc]
jmp 0x4d6117
cmp dword [ebp - 0xc], 0
je 0x4d6110
test edi, edi
je 0x4d6110
mov edx, dword [ebp + 0x14]
mov dword [edi + 0x18], edx
mov eax, dword [ebp - 0xc]
jmp 0x4d6117
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10