Function at 0x449250
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
xor esi, esi
cmp ebx, dword [edi + 0x270]
mov dword [edi + 0x28c], esi
jne 0x449291
mov eax, dword [ebp + 0x10]
cmp eax, dword [edi + 0x274]
jne 0x449291
mov edx, dword [edi]
mov eax, dword [edx + 0x84]
push 1
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
or eax, 0xffffffff
cmp byte [edi + 0x1e8], 0
mov dword [edi + 0x274], eax
mov dword [edi + 0x270], eax
jne 0x4493a0
cmp dword [edi + 8], esi
jle 0x4492d0
mov ecx, dword [edi + 4]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx + esi*4]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [ebp + 8]
push ebx
push eax
call edx
add esi, 1
cmp esi, dword [edi + 8]
jl 0x4492b2
cmp dword [edi + 0x1ec], 1
je 0x44948f
mov ecx, dword [ebp + 0x10]
mov eax, dword [edi]
mov edx, dword [eax + 0x64]
push ecx
push ebx
mov ecx, edi
call edx
test eax, eax
je 0x449380
cmp byte [edi + 0x38], 0
jne 0x449306
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
mov byte [edi + 0x38], 1
call edx
cmp byte [0x5b9f49], 0
jne 0x44948f
push ebx
mov ebx, dword [ebp + 0x10]
call fcn.00452f70
test eax, eax
jge 0x449363
cmp byte [edi + 0x1e8], 0
je 0x449346
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [edi + 0x38], 0
je 0x44948f
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
mov byte [edi + 0x38], 0
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edi + 0x1ec], esi
je 0x4493e0
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
add eax, 1
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4493e0
mov ecx, dword [ebp + 0x10]
mov eax, dword [edi]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
push ecx
push ebx
push edx
mov ecx, edi
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1ec]
test al, 2
je 0x44943e
lea esi, [edi + 0x1f8]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [edi + 0x1ac], 0
je 0x44940e
mov ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x34]
sub ecx, dword [edi + 0x28]
sub eax, dword [edi + 0x2c]
jmp 0x449412
xor eax, eax
xor ecx, ecx
mov edx, dword [edi]
mov edx, dword [edx + 0x54]
push 1
push eax
mov eax, dword [edi + 0x1fc]
sub eax, dword [edi + 0x1f4]
push ecx
mov ecx, dword [esi]
sub ecx, dword [edi + 0x1f0]
push eax
push ecx
mov ecx, edi
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test al, 1
je 0x44948f
lea esi, [edi + 0x1f8]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [esp + 0x10]
mov eax, edi
mov dword [edi + 0x1ec], 2
call fcn.00452ef0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edi]
mov eax, dword [eax + 0x54]
push 1
push ecx
mov ecx, dword [edi + 0x1fc]
sub ecx, dword [edi + 0x1f4]
push edx
mov edx, dword [esi]
sub edx, dword [edi + 0x1f0]
push ecx
push edx
mov ecx, edi
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc