Function at 0x47f84b
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push eax
push 0x4a5de0
call fcn.00436009
mov ecx, dword [0x4a5e40]
mov edx, dword [ecx + eax*4]
mov ecx, dword [ebx + 8]
mov edi, dword [edx]
mov dword [esp + 0x20], eax
mov eax, ecx
cmp eax, 0xfffffe6e
ja 0x47fae4
je case.0x47f952.451
cmp eax, 0xfffffdd9
ja 0x47f93f
je 0x47f909
add eax, 0x2f7
cmp eax, 0xd
ja case.0x47fb0a.319
movzx eax, byte [eax + 0x48014b]
jmp dword [eax*4 + 0x480137]
mov byte [edi + 0x18d], 1
jmp case.0x47fb0a.319
cmp byte [edi + 0x18d], 0
mov byte [edi + 0x18e], 1
jne case.0x47fb0a.319
mov byte [edi + 0x18e], 0
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 4]
push ecx
push edx
jmp 0x47f920
cmp byte [edi + 0x18e], 1
jne 0x47f8f2
mov eax, dword [ebx + 4]
push ecx
push eax
call fcn.00460934
mov byte [edi + 0x18e], 0
mov byte [edi + 0x18d], 0
jmp case.0x47fb0a.319
push ecx
mov ecx, dword [ebx + 4]
push ecx
jmp 0x47f920
mov edx, dword [ebx]
push 0
push 0
push 0x130b
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov eax, dword [ebx + 4]
push eax
call fcn.00460934
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push eax
push 0x4e
push ecx
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add eax, 0x226
cmp eax, 0x8a
ja case.0x47fb0a.319
movzx ecx, byte [eax + 0x48016f]
jmp dword [ecx*4 + 0x48015b]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jge case.0x47fb0a.319
push 9
call edi
test ax, ax
jge case.0x47fb0a.319
mov edx, dword [ebx]
push 0
push 0
push 0x130b
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x10
mov esi, eax
call edi
test ax, ax
jge 0x47f992
dec esi
push esi
jmp 0x47f91c
inc esi
push esi
jmp 0x47f91c
mov esi, dword [ebx]
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x100
je case.0x47fb0a.319
cmp word [ebx + 0xc], 0x20
jne case.0x47fb0a.319
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push esi
call edi
test eax, eax
je case.0x47fb0a.319
lea ecx, [esp + 0x50]
push ecx
push 0
push 0x113e
push esi
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], 4
call edi
test eax, eax
je case.0x47fb0a.319
mov edx, dword [esp + 0x74]
push 0
push edx
jmp 0x47f920
cmp dword [edi + 0x17c], 0
je case.0x47fb0a.319
mov esi, dword [0x4a5e64]
mov eax, 3
cmp esi, eax
jl case.0x47fb0a.319
mov edx, dword [0x4a5e54]
jmp 0x47fa2b
mov ecx, dword [edx + eax*4]
cmp dword [ecx], 0
je 0x47fa41
mov ecx, dword [ecx]
movzx ecx, byte [ecx + 0x8b]
cmp ecx, dword [ebx + 4]
je 0x47fa4b
inc eax
cmp eax, esi
jle 0x47fa2b
jmp case.0x47fb0a.319
cmp eax, esi
jg case.0x47fb0a.319
mov edx, dword [edx + eax*4]
mov eax, dword [edx]
mov ecx, dword [eax + 0x50]
push 0x4f
push ecx
lea edx, [ebx + 0x10]
push edx
call fcn.004145fa
add esp, 0xc
xor eax, eax
mov word [ebx + 0xae], ax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebx]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push ecx
call esi
test eax, eax
je case.0x47fb0a.319
lea edx, [esp + 0x50]
push edx
push 0
mov dword [esp + 0x5c], eax
mov eax, dword [ebx]
push 0x113e
push eax
mov dword [esp + 0x60], 4
call esi
test eax, eax
je case.0x47fb0a.319
mov ecx, dword [ebx + 0x34]
cmp ecx, dword [ebx + 0x5c]
je case.0x47fb0a.319
mov eax, dword [ebx + 0xc]
cmp eax, 0x1000
je case.0x47fb0a.319
cmp eax, 1
jmp 0x47f9ee
cmp eax, 0xfffffff0
ja 0x47fc7e
je 0x47fc73
add eax, 0x140
cmp eax, 0xd4
ja case.0x47fb0a.319
movzx eax, byte [eax + 0x48020b]
jmp dword [eax*4 + 0x4801fb]
mov ecx, dword [ebx]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x47fb0a.319
mov esi, dword [ebx + 4]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
push esi
push 0x4a5de0
call fcn.00444b1c
test al, al
je case.0x47fb0a.319
mov ecx, dword [0x4a5e54]
mov edi, dword [esp + 0x14]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
mov cx, word [ebx + 0x10]
mov word [eax + 0x8e], cx
mov edx, dword [ebx + 4]
push 0
push edx
call fcn.00460934
mov eax, dword [0x4a5e54]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx]
cmp dword [edx + 0x24], 0
jbe case.0x47fb0a.319
mov dword [0x4a5e1c], esi
mov eax, dword [eax + edi*4]
mov ecx, dword [eax]
add ecx, 0x20
push ecx
mov esi, 0x4a5e20
call fcn.0040ece0
mov edx, dword [0x4a5e54]
mov eax, dword [edx + edi*4]
mov ecx, dword [eax]
mov dl, byte [ecx + 0x90]
mov byte [0x4a5e30], dl
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx]
push 0x482052
push eax
push 0x1030
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x47fb0a.319
mov edx, dword [0x4a5e8c]
xor esi, esi
push esi
push esi
push esi
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_SetDragCursorImage]
mov eax, dword [0x4a5e8c]
push 0xfffffffffffffff0
push 0xfffffffffffffff8
push esi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetCapture]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], esi
lea esi, [esp + 0x28]
mov dword [0x4a5e90], edi
mov dword [esp + 0x30], 1
call fcn.00404b80
mov dword [esp + 0x28], edi
mov edi, 0x48d248
lea esi, [esp + 0x3c]
mov dword [esp + 0x30], 1
call fcn.00405a50
mov eax, 2
lea ecx, [eax - 1]
lea edx, [esp + 0x28]
call fcn.0040d4d0
mov ecx, esi
call fcn.004059c0
mov edx, dword [ebx]
lea esi, [ebx + 0x20]
push esi
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebx + 0x24]
mov ecx, dword [esi]
push eax
push ecx
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_DragEnter]
lea esi, [esp + 0x28]
call fcn.00404b80
jmp case.0x47fb0a.319
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp case.0x47fb0a.319
cmp eax, 0xfffffff4
je 0x480033
cmp eax, 0xfffffffb
je 0x47fdea
cmp eax, 0xfffffffe
jne case.0x47fb0a.319
push 1
push edi
push 0x4a5de0
call fcn.00454cb4
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [ebx]
push edx
push 0x4a5de0
call fcn.00444ba2
cmp eax, 0xffffffff
je case.0x47fb0a.319
mov ecx, dword [0x4a5e54]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov al, byte [eax + 0x88]
cmp al, 0x10
jb case.0x47fb0a.319
cmp al, 0x11
jbe 0x47fd67
cmp al, 0x13
jne case.0x47fb0a.319
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x3c]
push eax
push 0
mov dword [esp + 0x44], ecx
mov ecx, dword [ebx]
push 0x1012
push ecx
mov dword [esp + 0x50], edx
call esi
cmp eax, 0xffffffff
je case.0x47fb0a.319
lea edx, [esp + 0x78]
push edx
push 0
mov dword [esp + 0x84], eax
mov eax, dword [ebx]
push 0x104b
push eax
mov dword [esp + 0x88], 4
call esi
test byte [esp + 0x44], 0xe
je case.0x47fb0a.319
mov ecx, dword [esp + 0x98]
push 0
push ecx
jmp 0x47f920
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x28]
push ecx
push 0
mov dword [esp + 0x30], edx
mov edx, dword [ebx]
push 0x1111
push edx
mov dword [esp + 0x3c], eax
call esi
test eax, eax
je case.0x47fb0a.319
mov ecx, dword [ebx]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x50]
push eax
push 0
push 0x113e
push ecx
mov dword [esp + 0x60], 0xc
mov dword [esp + 0x6c], 0xf000
call esi
test byte [esp + 0x30], 0x46
je case.0x47fb0a.319
mov edx, dword [ebx]
push 0
push 9
push 0x110b
push edx
call esi
mov eax, dword [esp + 0x34]
mov ecx, dword [ebx]
push eax
push 9
push 0x110b
push ecx
call esi
jmp case.0x47fb0a.319
push 1
push edi
push 0x4a5de0
mov byte [esp + 0x1f], 0
call fcn.00454cb4
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [ebx]
push edx
push 0x4a5de0
call fcn.00444ba2
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jne 0x47fe55
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0x4a5de0
call fcn.00444ba2
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je case.0x47fb0a.319
mov byte [esp + 0x13], 1
mov ecx, dword [0x4a5e54]
mov edx, dword [ecx + esi*4]
mov eax, dword [edx]
mov al, byte [eax + 0x88]
mov dword [esp + 0x24], esi
cmp al, 0x10
je 0x47ff60
cmp al, 0x13
jne case.0x47fb0a.319
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push eax
push 0
mov dword [esp + 0x44], ecx
mov ecx, dword [ebx]
push 0x1012
push ecx
mov dword [esp + 0x50], edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jle 0x47ff1f
cmp byte [esp + 0x13], 0
jne 0x47ff1f
lea edx, [esp + 0x78]
push edx
push 0
mov dword [esp + 0x84], eax
mov eax, dword [ebx]
push 0x104b
push eax
mov dword [esp + 0x88], 4
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x47fb0a.319
test byte [esp + 0x44], 0xe
je 0x47ff1f
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
push 0x4a5de0
call fcn.00444b1c
test al, al
je 0x47ff1b
mov esi, dword [esp + 0x14]
mov ecx, dword [0x4a5e54]
mov eax, dword [ecx + esi*4]
cmp dword [eax], 0
je 0x47ff1b
mov edx, dword [eax]
cmp dword [edx + 8], 0
jne 0x47ff1f
mov esi, dword [esp + 0x24]
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [0x4a5e54]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
test eax, eax
je case.0x47fb0a.319
mov edx, dword [edi]
mov ecx, dword [esp + 0x1c]
push 0
push edx
mov edx, dword [esp + 0x20]
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp case.0x47fb0a.319
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push 0
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
push 0x1111
push eax
mov dword [esp + 0x3c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x47ffe6
mov edx, dword [ebx]
lea ecx, [esp + 0x50]
push ecx
push 0
push 0x113e
push edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], 4
call dword [sym.imp.USER32.dll_SendMessageW]
test byte [esp + 0x30], 0x46
je 0x47ffe6
mov edx, dword [esp + 0x74]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x4a5de0
call fcn.00444b1c
test al, al
je 0x47ffe2
mov esi, dword [esp + 0x14]
mov eax, dword [0x4a5e54]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
cmp dword [edx + 8], 0
jne 0x47ffe6
mov esi, dword [esp + 0x24]
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [0x4a5e54]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
test eax, eax
je case.0x47fb0a.319
mov edx, dword [edi]
mov ecx, dword [esp + 0x1c]
push 0
push edx
mov edx, dword [esp + 0x20]
push ecx
push edx
push 0x80
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx]
push eax
push 0x4a5de0
call fcn.00444ba2
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je case.0x47fb0a.319
mov edi, dword [0x4a5e54]
mov ecx, dword [edi + eax*4]
mov eax, dword [ecx]
mov cl, byte [eax + 0x88]
cmp cl, 0x10
je 0x48006c
cmp cl, 0x13
jne case.0x47fb0a.319
mov ecx, dword [ebx + 0xc]
sub ecx, 1
je 0x480129
sub ecx, 0x10000
jne case.0x47fb0a.319
cmp dword [eax + 0x44], 0xfe000000
mov byte [esp + 0x13], cl
jne 0x480096
mov byte [esp + 0x13], 1
mov ecx, dword [ebx + 0x2c]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
push ecx
push 0x4a5de0
call fcn.00444b1c
test al, al
je 0x48011e
mov esi, dword [esp + 0x14]
mov eax, dword [edi + esi*4]
mov edx, dword [eax]
mov eax, dword [edx + 0x30]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x8000000
jne 0x48011e
test byte [ebx + 0x28], 0x11
mov ecx, dword [0x4a5e54]
je 0x4800ec
mov edx, dword [ecx + esi*4]
mov eax, dword [edx]
cmp byte [eax + 0x88], 0x14
jne case.0x47fb0a.319
mov edx, dword [ecx + esi*4]
mov eax, dword [edx]
mov eax, dword [eax + 0x48]
cmp eax, 0xffffffff
je 0x480102
mov dword [ebx + 0x30], eax
mov ecx, dword [0x4a5e54]
mov ecx, dword [ecx + esi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
test eax, eax
jl 0x48011e
cmp byte [esp + 0x13], 0
je 0x48011b
test byte [ebx + 0x24], 1
je 0x48011e
mov dword [ebx + 0x34], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 0x20
pop ebx
mov esp, ebp
pop ebp
ret 0xc