Function at 0x4c6ccd
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, 0x57d89c
cmp byte [edi], 0
je 0x4c6cef
push edi
call fcn.005395b8
pop ecx
cmp eax, 0x64
jb 0x4c6cf6
xor eax, eax
jmp 0x4c7706
test esi, esi
je 0x4c6d04
push esi
call fcn.00514157
test eax, eax
jne 0x4c6d0b
xor eax, eax
jmp 0x4c7706
cmp byte [esi + 0x64c], 1
je 0x4c6d1b
xor eax, eax
jmp 0x4c7706
xor edx, edx
mov dword [0x57d8a8], edx
xor ecx, ecx
mov dword [0x57d8ac], ecx
xor eax, eax
mov dword [0x57d8a4], eax
xor edx, edx
mov dword [ebx], edx
cmp dword [esi + 0x614], 0
je 0x4c6dc6
lea ecx, [esi + 0x610]
push ecx
push 0
push edi
call fcn.0047ae1e
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4c6e44
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
mov dword [0x57d8ac], edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x20]
mov dword [0x57d8a4], eax
mov edx, dword [esi + 0x608]
mov dword [0x57d8a0], edx
jmp 0x4c6d8f
mov ecx, dword [eax + 0x34]
mov dword [0x57d8a0], ecx
inc dword [0x57d8a8]
mov eax, dword [0x57d8a0]
test eax, eax
je 0x4c6d9c
cmp eax, dword [ebx]
jne 0x4c6d80
cmp dword [0x57d8a0], 0
jne 0x4c6e44
xor edx, edx
mov dword [0x57d8a8], edx
xor ecx, ecx
mov dword [0x57d8ac], ecx
xor eax, eax
mov dword [0x57d8a4], eax
xor edx, edx
mov dword [ebx], edx
jmp 0x4c6e44
xor ecx, ecx
mov cl, byte [edi]
push ecx
call fcn.00541e80
pop ecx
mov dword [0x57d8b0], eax
mov eax, dword [esi + 0x608]
mov dword [ebx], eax
jmp 0x4c6e1f
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
cmp edx, dword [0x57d8b0]
jne 0x4c6e12
push edi
push dword [eax]
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4c6e12
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
mov dword [0x57d8ac], edx
mov ecx, dword [eax + 0x20]
mov dword [0x57d8a4], ecx
jmp 0x4c6e24
mov eax, dword [ebx]
mov edx, dword [eax + 0x34]
mov dword [ebx], edx
inc dword [0x57d8a8]
cmp dword [ebx], 0
jne 0x4c6de0
cmp dword [ebx], 0
jne 0x4c6e44
xor ecx, ecx
mov dword [0x57d8a8], ecx
xor eax, eax
mov dword [0x57d8ac], eax
xor edx, edx
mov dword [0x57d8a4], edx
xor ecx, ecx
mov dword [ebx], ecx
mov eax, dword [ebp + 0x10]
sub eax, 1
jb 0x4c6e65
je 0x4c70c3
dec eax
je 0x4c76c6
dec eax
je 0x4c76e7
jmp 0x4c7704
cmp dword [0x57d8ac], 0
je 0x4c70b9
cmp dword [ebx], 0
je 0x4c70b9
cmp dword [0x5549d4], 0
je 0x4c6f09
push 0
push dword [0x57d8a8]
push 0x187
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov dword [0x57d8b4], eax
mov eax, dword [0x57d8b4]
cmp eax, 0xffffffff
je 0x4c6ebc
test eax, eax
jle 0x4c6ebc
or dword [0x5549d4], 4
jmp 0x4c6ec3
or dword [0x5549d4], 8
push 0
push dword [0x57d8a8]
push 0x199
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov dword [0x57d8b8], eax
mov eax, dword [0x57d8b8]
cmp eax, 0xffffffff
je 0x4c6ef3
test eax, eax
jl 0x4c6ef3
cmp eax, 0xf
jle 0x4c6efd
mov dword [0x57d8b8], 0x63
mov edx, dword [0x57d8a4]
mov dword [0x557164], edx
mov dword [0x57d8c4], 0xffffffff
cmp dword [0x55b3d0], 0
je 0x4c6f81
mov ecx, dword [esi]
cmp ecx, dword [0x55b3d4]
jne 0x4c6f81
cmp byte [esi + 0x665], 0
je 0x4c6f81
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4c6f47
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4c6f81
push 0x57d8c4
call sub.USER32.dll_GetCursorPos
push 0x57d8c4
push dword [esi + 0x75c]
call sub.USER32.dll_ScreenToClient
movzx eax, word [0x57d8c8]
shl eax, 0x10
or eax, 1
push eax
push 0
push 0x202
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0x18e
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov dword [0x57d8bc], eax
push 0
push 0
push 0x19f
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov dword [0x57d8c0], eax
push 0
push 0
push 0xb
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push 0
push dword [0x57d8a8]
push 0x182
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov eax, dword [0x57d8a8]
cmp eax, dword [0x57d8bc]
jg 0x4c7000
dec dword [0x57d8bc]
cmp dword [0x57d8bc], 0
jge 0x4c7000
xor edx, edx
mov dword [0x57d8bc], edx
cmp eax, dword [0x57d8c0]
jg 0x4c701f
dec dword [0x57d8c0]
cmp dword [0x57d8c0], 0
jge 0x4c701f
xor ecx, ecx
mov dword [0x57d8c0], ecx
mov eax, dword [0x57d8bc]
cmp eax, dword [0x57d8c0]
jle 0x4c7038
mov dword [0x57d8c0], 0xffffffff
jmp 0x4c7044
push 0x57d8c0
push eax
push esi
call fcn.004c6c74
push 0
push dword [0x57d8bc]
push 0x197
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov eax, dword [0x57d8c0]
cmp eax, 0xffffffff
je 0x4c7079
push 0
push eax
push 0x19e
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push 0
push 1
push 0xb
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push 0
push 0
push dword [esi + 0x75c]
call sub.USER32.dll_InvalidateRect
push dword [ebx]
push dword [esi + 0x608]
call fcn.004b103a
mov dword [esi + 0x608], eax
add esi, 0x610
push esi
push edi
call fcn.0047aeba
mov eax, dword [0x57d8ac]
jmp 0x4c7706
cmp dword [ebp + 0x14], 0
jne 0x4c70d3
mov eax, dword [0x57d8ac]
jmp 0x4c7706
mov eax, dword [0x57d8ac]
test eax, eax
je 0x4c710f
cmp dword [ebp + 0x14], 0
jle 0x4c70f2
mov edx, eax
and edx, dword [ebp + 0x14]
jne 0x4c7706
add dword [ebp + 0x14], eax
jmp 0x4c7119
mov ecx, dword [ebp + 0x14]
mov edx, ecx
neg ecx
mov dword [ebp + 0x14], ecx
mov ecx, eax
and ecx, dword [ebp + 0x14]
je 0x4c7706
sub eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
jmp 0x4c7119
cmp dword [ebp + 0x14], 0
jl 0x4c7706
mov dword [0x57d8c4], 0xffffffff
cmp dword [0x55b3d0], 0
je 0x4c7191
mov eax, dword [esi]
cmp eax, dword [0x55b3d4]
jne 0x4c7191
cmp byte [esi + 0x665], 0
je 0x4c7191
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4c7157
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4c7191
push 0x57d8c4
call sub.USER32.dll_GetCursorPos
push 0x57d8c4
push dword [esi + 0x75c]
call sub.USER32.dll_ScreenToClient
movzx eax, word [0x57d8c8]
shl eax, 0x10
or eax, 1
push eax
push 0
push 0x202
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0x18e
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov dword [0x57d8bc], eax
push 0
push 0
push 0x19f
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov dword [0x57d8c0], eax
push 0
push 0
push 0xb
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
cmp dword [0x57d8ac], 0
je 0x4c72b0
cmp dword [ebx], 0
je 0x4c72b0
cmp dword [0x5549d4], 0
je 0x4c7278
push 0
push dword [0x57d8a8]
push 0x187
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov dword [0x57d8b4], eax
mov eax, dword [0x57d8b4]
cmp eax, 0xffffffff
je 0x4c722b
test eax, eax
jle 0x4c722b
or dword [0x5549d4], 4
jmp 0x4c7232
or dword [0x5549d4], 8
push 0
push dword [0x57d8a8]
push 0x199
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov dword [0x57d8b8], eax
mov eax, dword [0x57d8b8]
cmp eax, 0xffffffff
je 0x4c7262
test eax, eax
jl 0x4c7262
cmp eax, 0xf
jle 0x4c726c
mov dword [0x57d8b8], 0x63
mov edx, dword [0x57d8a4]
mov dword [0x557164], edx
push 0
push dword [0x57d8a8]
push 0x182
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push dword [ebx]
push dword [esi + 0x608]
call fcn.004b103a
mov dword [esi + 0x608], eax
lea ecx, [esi + 0x610]
push ecx
push edi
call fcn.0047aeba
xor eax, eax
mov dword [0x57d8cc], eax
xor edx, edx
mov dword [0x57d8d0], edx
mov dword [0x57d8d4], 1
jmp 0x4c7303
mov ecx, dword [0x57d8d0]
mov eax, dword [ecx*4 + 0x58075c]
mov ecx, eax
and ecx, dword [ebp + 0x14]
je 0x4c72fd
mov ecx, dword [0x57d8d0]
mov dword [0x57d8d4], eax
mov eax, dword [0x57d8d0]
and edx, 0xff
mov dword [0x57d8cc], edx
jmp 0x4c7312
inc dword [0x57d8d0]
mov eax, dword [0x57d8d0]
mov dl, byte [eax + 0x558830]
test dl, dl
jne 0x4c72cb
xor ecx, ecx
mov dword [0x57d8a8], ecx
mov eax, dword [esi + 0x608]
mov dword [ebx], eax
jmp 0x4c735c
mov edx, dword [eax + 0x1c]
mov ecx, dword [0x57d8d4]
add ecx, ecx
cmp edx, ecx
jge 0x4c734f
mov edx, dword [ebx]
mov ecx, dword [edx + 0x1c]
and ecx, dword [0x57d8d4]
je 0x4c7362
push dword [eax]
push edi
call fcn.0053977c
add esp, 8
test eax, eax
jl 0x4c7362
inc dword [0x57d8a8]
mov eax, dword [ebx]
mov eax, dword [eax + 0x34]
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4c7324
cmp dword [0x57d8cc], 0
je 0x4c7386
push edi
push dword [0x57d8cc]
push 0x557180
push 0x57d964
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x4c73ac
push esi
push edi
mov esi, 0x57d964
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [esi + 0x60c], 0
je 0x4c7443
xor eax, eax
mov al, byte [edi]
push eax
call fcn.00541e80
pop ecx
mov dword [0x57d8b0], eax
mov edx, dword [esi + 0x60c]
mov dword [0x57d8a0], edx
jmp 0x4c743a
mov eax, dword [0x57d8a0]
mov edx, dword [eax + 0xc]
cmp edx, dword [0x57d8b0]
jne 0x4c742c
push edi
push dword [eax]
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4c742c
mov ecx, dword [0x57d8a0]
mov eax, dword [ecx + 8]
mov dword [0x57d8b8], eax
mov edx, dword [0x57d8a0]
mov ecx, dword [edx + 0x20]
mov dword [0x57d8a4], ecx
push dword [0x57d8a0]
push dword [esi + 0x60c]
call fcn.004b103a
mov dword [esi + 0x60c], eax
jmp 0x4c7443
mov eax, dword [0x57d8a0]
mov edx, dword [eax + 0x34]
mov dword [0x57d8a0], edx
cmp dword [0x57d8a0], 0
jne 0x4c73d7
cmp dword [0x5549d4], 0
je 0x4c7461
cmp dword [0x557164], 0xffffffff
je 0x4c7461
mov ecx, dword [0x557164]
mov dword [0x57d8a4], ecx
mov dword [0x557164], 0xffffffff
cmp dword [ebx], 0
je 0x4c74e1
push dword [ebp + 0x14]
push 0
push edi
push 0
call fcn.004b0c4c
mov dword [0x57d8a0], eax
cmp dword [0x57d8a0], 0
je 0x4c754d
xor eax, eax
mov al, byte [edi]
push eax
call fcn.00541e80
pop ecx
mov edx, dword [0x57d8a0]
mov dword [edx + 0xc], eax
mov ecx, dword [0x57d8a0]
mov eax, dword [0x57d8a4]
mov dword [ecx + 0x20], eax
push dword [0x57d8a0]
push dword [ebx]
push dword [esi + 0x608]
call fcn.004b1135
mov dword [esi + 0x608], eax
lea edx, [esi + 0x610]
push edx
push 0xffffffffffffffff
push dword [0x57d8a0]
push edi
call fcn.0047acb8
jmp 0x4c754d
push dword [ebp + 0x14]
push 0
push edi
push dword [esi + 0x608]
call fcn.004b0c4c
mov dword [0x57d8a0], eax
cmp dword [0x57d8a0], 0
je 0x4c7543
mov ecx, dword [0x57d8a0]
mov dword [esi + 0x608], ecx
mov eax, dword [esi + 0x608]
mov edx, dword [eax + 0x38]
mov dword [ebx], edx
xor ecx, ecx
mov cl, byte [edi]
push ecx
call fcn.00541e80
pop ecx
mov edx, dword [ebx]
mov dword [edx + 0xc], eax
mov eax, dword [ebx]
mov ecx, dword [0x57d8a4]
mov dword [eax + 0x20], ecx
lea eax, [esi + 0x610]
push eax
push 0xffffffffffffffff
push dword [ebx]
push edi
call fcn.0047acb8
mov dword [0x57d8a8], 0xffffffff
push 0x57d964
push dword [0x57d8a8]
push 0x181
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov ebx, eax
mov dword [0x57d8b4], ebx
cmp ebx, 0xffffffff
je 0x4c761d
cmp dword [0x5549d4], 0
je 0x4c75c3
test byte [0x5549d4], 4
je 0x4c759e
push ebx
push 1
push 0x185
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push dword [0x57d8b8]
push dword [0x57d8b4]
push 0x19a
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
xor eax, eax
mov dword [0x5549d4], eax
jmp 0x4c761d
cmp dword [0x57d8a4], 0
je 0x4c75da
mov edx, dword [0x57d8b8]
mov dword [0x57d8a8], edx
jmp 0x4c7601
push 2
push 0
push 0x57d8a8
push dword [ebp + 0x14]
push edi
push dword [esi]
call fcn.0042c85d
cmp dword [0x57d8a8], 0xffffffff
jne 0x4c7601
mov dword [0x57d8a8], 0x63
push dword [0x57d8a8]
push dword [0x57d8b4]
push 0x19a
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
mov eax, dword [0x57d8b4]
cmp eax, 0xffffffff
je 0x4c76a1
cmp eax, dword [0x57d8bc]
jg 0x4c7635
inc dword [0x57d8bc]
cmp eax, dword [0x57d8c0]
jg 0x4c7643
inc dword [0x57d8c0]
mov eax, dword [0x57d8bc]
cmp eax, dword [0x57d8c0]
jle 0x4c765c
mov dword [0x57d8c0], 0xffffffff
jmp 0x4c7668
push 0x57d8c0
push eax
push esi
call fcn.004c6c74
push 0
push dword [0x57d8bc]
push 0x197
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
cmp dword [0x57d8c0], 0xffffffff
je 0x4c76a1
push 0
push dword [0x57d8c0]
push 0x19e
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push 0
push 1
push 0xb
push dword [esi + 0x75c]
call sub.USER32.dll_SendMessageA
push 0
push 0
push dword [esi + 0x75c]
call sub.USER32.dll_InvalidateRect
mov eax, dword [ebp + 0x14]
jmp 0x4c7706
cmp dword [ebp + 0x14], 0
je 0x4c76e0
mov edx, dword [0x57d8ac]
and edx, dword [ebp + 0x14]
je 0x4c76dc
mov eax, dword [ebp + 0x14]
jmp 0x4c7706
xor eax, eax
jmp 0x4c7706
mov eax, dword [0x57d8ac]
jmp 0x4c7706
cmp dword [0x57d8ac], 0
je 0x4c76fd
cmp dword [ebx], 0
je 0x4c76fd
mov edx, dword [ebx]
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0x18], ecx
mov eax, dword [0x57d8ac]
jmp 0x4c7706
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10