Function at 0x4e50f0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
cmp edi, ebp
mov esi, edx
mov dword [esp + 0x18], edi
je case.default.0x4e51f0
cmp byte [edi], 0
je case.default.0x4e51f0
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5120
sub eax, edx
cmp eax, 0x5a
jae case.default.0x4e51f0
cmp esi, ebp
je case.default.0x4e51f0
mov ecx, esi
call fcn.00542ed0
test eax, eax
je case.default.0x4e51f0
mov ecx, dword [esi + 0xbbc]
call fcn.004e2760
test eax, eax
je case.default.0x4e51f0
cmp dword [esi + 0x708], 1
jne case.default.0x4e51f0
lea eax, [esi + 0x6c4]
xor ebx, ebx
push eax
xor edx, edx
mov ecx, edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
call fcn.00491f60
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x4e51e0
mov eax, dword [esi + 0x6b8]
test eax, eax
mov ebp, dword [ecx + 0x20]
mov ebx, dword [ecx + 0x1c]
mov dword [esp + 0x1c], ebp
je 0x4e51ca
lea esp, [esp]
cmp eax, ecx
je 0x4e51c6
mov edi, dword [esp + 0x10]
mov eax, dword [eax + 0x40]
inc edi
test eax, eax
mov dword [esp + 0x10], edi
jne 0x4e51b0
jmp 0x4e51ca
test eax, eax
jne 0x4e51e0
xor ebp, ebp
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0xa0]
cmp eax, 3
ja case.default.0x4e51f0
jmp dword [eax*4 + 0x4e59d4]
test ebx, ebx
je 0x4e53fc
test ecx, ecx
je 0x4e53fc
mov eax, dword [esi + 0xbbc]
mov ecx, dword [eax + 0x20dc]
test ecx, ecx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x4e5299
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x874]
push 0
push ecx
push 0x187
push edx
call edi
cmp eax, 0xffffffff
je 0x4e524c
test eax, eax
jle 0x4e524c
mov eax, dword [esi + 0xbbc]
mov ecx, dword [eax + 0x20dc]
or ecx, 4
jmp 0x4e525b
mov eax, dword [esi + 0xbbc]
mov ecx, dword [eax + 0x20dc]
or ecx, 8
mov dword [eax + 0x20dc], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x874]
push 0
push eax
push 0x199
push ecx
call edi
cmp eax, 0xffffffff
mov dword [0x59bc1c], eax
je 0x4e5289
test eax, eax
jl 0x4e5289
cmp eax, 0xf
jle 0x4e5293
mov dword [0x59bc1c], 0x63
mov dword [0x59bc18], ebp
mov eax, dword [0x5b431c]
test eax, eax
mov dword [esp + 0x2c], 0xffffffff
je 0x4e530d
mov edx, dword [esi]
cmp edx, dword [0x5b4320]
jne 0x4e530d
mov eax, dword [esi + 0x738]
test eax, eax
je 0x4e530d
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call ebp
test ah, ah
js 0x4e52d4
push 2
call ebp
test ah, ah
jns 0x4e530d
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x874]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx eax, word [esp + 0x30]
mov ecx, dword [esi + 0x874]
shl eax, 0x10
or eax, 1
push eax
push 0
push 0x202
push ecx
call edi
mov edx, dword [esi + 0x874]
push 0
push 0
push 0x18e
push edx
call edi
push 0
push 0
mov ebp, eax
mov eax, dword [esi + 0x874]
push 0x19f
push eax
call edi
mov ecx, dword [esi + 0x874]
push 0
push 0
push 0xb
push ecx
mov dword [esp + 0x24], eax
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x874]
push 0
push edx
push 0x182
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
jg 0x4e5368
dec ebp
jns 0x4e5368
xor ebp, ebp
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jg 0x4e5381
mov eax, ecx
dec eax
mov dword [esp + 0x14], eax
jns 0x4e5381
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
push ecx
mov edx, ebp
mov ecx, esi
call fcn.0041f640
mov edx, dword [esi + 0x874]
push 0
push ebp
push 0x197
push edx
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4e53ba
push 0
push eax
mov eax, dword [esi + 0x874]
push 0x19e
push eax
call edi
mov ecx, dword [esi + 0x874]
push 0
push 1
push 0xb
push ecx
call edi
mov edx, dword [esi + 0x874]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esp + 0x20]
mov ecx, dword [esi + 0x6b8]
call fcn.004c7fe0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x6b8], eax
call fcn.00492000
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x8c
ret 8
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x4e59b6
test ebx, ebx
je 0x4e544c
test eax, eax
jle 0x4e5435
test eax, ebx
jne 0x4e59b6
add eax, ebx
mov dword [esp + 0xa4], eax
jmp 0x4e5454
neg eax
test eax, ebx
je 0x4e59b6
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0xa4], ecx
jmp 0x4e5454
test eax, eax
jl case.default.0x4e51f0
mov eax, dword [0x5b431c]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x2c], 0xffffffff
je 0x4e54ce
mov eax, dword [esi]
cmp eax, dword [0x5b4320]
jne 0x4e54ce
mov eax, dword [esi + 0x738]
test eax, eax
je 0x4e54ce
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ah, ah
js 0x4e5495
push 2
call edi
test ah, ah
jns 0x4e54ce
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x874]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx ecx, word [esp + 0x30]
mov edx, dword [esi + 0x874]
shl ecx, 0x10
or ecx, 1
push ecx
push 0
push 0x202
push edx
call ebp
mov eax, dword [esi + 0x874]
push 0
push 0
push 0x18e
push eax
call ebp
mov ecx, dword [esi + 0x874]
push 0
push 0
push 0x19f
push ecx
mov dword [esp + 0x44], eax
call ebp
mov edx, dword [esi + 0x874]
push 0
push 0
push 0xb
push edx
mov dword [esp + 0x24], eax
call ebp
test ebx, ebx
je 0x4e55e8
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4e55e8
mov eax, dword [edi + 0x10]
mov ecx, dword [esi + 0xbbc]
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 0x20dc]
test eax, eax
je 0x4e55b3
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x874]
push 0
push edx
push 0x187
push eax
call ebp
cmp eax, 0xffffffff
je 0x4e5563
test eax, eax
jle 0x4e5563
mov eax, dword [esi + 0xbbc]
mov ecx, dword [eax + 0x20dc]
or ecx, 4
jmp 0x4e5572
mov eax, dword [esi + 0xbbc]
mov ecx, dword [eax + 0x20dc]
or ecx, 8
mov dword [eax + 0x20dc], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x874]
push 0
push ecx
push 0x199
push edx
call ebp
cmp eax, 0xffffffff
mov dword [0x59bc1c], eax
je 0x4e55a0
test eax, eax
jl 0x4e55a0
cmp eax, 0xf
jle 0x4e55aa
mov dword [0x59bc1c], 0x63
mov eax, dword [esp + 0x1c]
mov dword [0x59bc18], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x874]
push 0
push ecx
push 0x182
push edx
call ebp
mov ecx, dword [esi + 0x6b8]
mov edx, edi
call fcn.004c7fe0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x6b8], eax
call fcn.00492000
mov ecx, dword [esi + 0xbbc]
mov dl, byte [ecx + 0x1cf0]
xor ebp, ebp
xor eax, eax
test dl, dl
mov dword [esp + 0x20], ebp
mov ebx, 1
je 0x4e5644
lea edx, [ecx + 0x1d54]
jmp 0x4e5610
mov edi, dword [edx]
test dword [esp + 0xa4], edi
jne 0x4e5631
mov edi, dword [esi + 0xbbc]
inc eax
add edx, 4
cmp byte [edi + eax + 0x1cf0], 0
jne 0x4e5610
jmp 0x4e5644
movzx ebp, byte [ecx + eax + 0x1cf0]
mov ebx, dword [ecx + eax*4 + 0x1d54]
mov dword [esp + 0x20], ebp
mov edi, dword [esi + 0x6b8]
test edi, edi
mov dword [esp + 0x10], 0
je 0x4e568e
lea ebp, [ebx + ebx]
lea esp, [esp]
mov eax, dword [edi + 0x1c]
cmp eax, ebp
jge 0x4e567f
test ebx, eax
je 0x4e568a
mov eax, dword [edi]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.005809c6
add esp, 8
test eax, eax
jl 0x4e568a
inc dword [esp + 0x10]
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x4e5660
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4e56ad
mov edx, dword [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x40]
push str._c_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4e56c1
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x38]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4e56b7
mov eax, dword [esi + 0x6bc]
test eax, eax
je 0x4e5734
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx]
push edx
call fcn.00570d82
mov ebp, dword [esi + 0x6bc]
add esp, 4
test ebp, ebp
mov ebx, eax
je 0x4e5734
cmp dword [ebp + 0xc], ebx
jne 0x4e5701
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
push eax
push ecx
call fcn.005809c6
add esp, 8
test eax, eax
je 0x4e570a
mov ebp, dword [ebp + 0x40]
test ebp, ebp
jne 0x4e56e7
jmp 0x4e5734
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x20]
mov dword [0x59bc1c], edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x6bc]
mov edx, ebp
mov dword [esp + 0x1c], eax
call fcn.004c7fe0
mov dword [esi + 0x6bc], eax
mov edx, dword [esi + 0xbbc]
mov eax, dword [edx + 0x20dc]
test eax, eax
mov ebx, dword [esp + 0x18]
je 0x4e5756
mov eax, dword [0x59bc18]
cmp eax, 0xffffffff
je 0x4e5756
mov dword [esp + 0x1c], eax
or ebp, 0xffffffff
test edi, edi
mov dword [0x59bc18], ebp
je 0x4e57c3
mov eax, dword [esp + 0xa4]
push eax
mov edx, ebx
xor ecx, ecx
call fcn.004c7e10
mov ebp, eax
test ebp, ebp
je 0x4e5815
movzx ecx, byte [ebx]
push ecx
call fcn.00570d82
mov edx, dword [esp + 0x20]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
add esp, 4
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [esi + 0x6b8]
push ebp
mov edx, edi
call fcn.004c8060
mov ecx, dword [esp + 0x28]
push ecx
push 0xffffffffffffffff
mov edx, ebp
mov ecx, ebx
mov dword [esi + 0x6b8], eax
call fcn.00491e00
mov edi, ebp
jmp 0x4e5815
mov edx, dword [esp + 0xa4]
mov ecx, dword [esi + 0x6b8]
push edx
mov edx, ebx
call fcn.004c7e10
test eax, eax
je 0x4e5811
mov dword [esi + 0x6b8], eax
mov edi, dword [eax + 0x44]
movzx eax, byte [ebx]
push eax
call fcn.00570d82
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
add esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x28]
push eax
mov dword [edi + 0x20], ecx
mov dword [edi + 0x10], edx
push ebp
mov edx, edi
mov ecx, ebx
call fcn.00491e00
mov dword [esp + 0x10], ebp
test edi, edi
je 0x4e594a
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x874]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x181
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4e594a
cmp ebp, 0xfffffffe
je 0x4e594a
mov eax, dword [esi + 0xbbc]
mov ecx, dword [eax + 0x20dc]
test ecx, ecx
je 0x4e58a1
test cl, 4
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x4e5879
mov ecx, dword [esi + 0x874]
push ebp
push 1
push 0x185
push ecx
call edi
mov edx, dword [0x59bc1c]
mov eax, dword [esi + 0x874]
push edx
push ebp
push 0x19a
push eax
call edi
mov ecx, dword [esi + 0xbbc]
mov dword [ecx + 0x20dc], 0
jmp 0x4e58fb
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4e58b0
mov eax, dword [0x59bc1c]
jmp 0x4e58dd
mov ecx, dword [esp + 0xa4]
push eax
mov eax, dword [edi + 0x10]
push 2
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ecx
mov ecx, dword [esi]
mov edx, ebx
call fcn.00431580
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x4e58e1
mov eax, 0x63
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x874]
push eax
push ebp
push 0x19a
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esp + 0x34]
cmp ebp, ebx
jg 0x4e5904
inc ebx
mov eax, dword [esp + 0x14]
cmp ebp, eax
jg 0x4e5911
inc eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov edx, ebx
mov ecx, esi
call fcn.0041f640
mov ecx, dword [esi + 0x874]
push 0
push ebx
push 0x197
push ecx
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4e594a
mov edx, dword [esi + 0x874]
push 0
push eax
push 0x19e
push edx
call edi
mov eax, dword [esi + 0x874]
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0x874]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
mov ecx, dword [esp + 0xa4]
test ecx, ecx
mov eax, ebx
je 0x4e59c7
and eax, ecx
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x8c
ret 8
test ebx, ebx
je 0x4e59b6
test ecx, ecx
je 0x4e59b6
mov edx, dword [esp + 0xa4]
mov dword [ecx + 0x18], edx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x8c
ret 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8