Function at 0x4539e0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x548ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5b2920]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
cmp edi, 0x100
mov ebx, dword [ebp + 0xc]
jne 0x453a70
cmp ebx, 0x56
je 0x453a2a
cmp ebx, 0x76
jne case.default.0x453cde
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.default.0x453cde
mov ecx, esi
call fcn.004f390e
test eax, 0x800
jne 0x453a56
push 0
push 0
push 1
mov ecx, esi
call fcn.004fe180
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x20
jne 0x453ab6
call fcn.004f390e
test eax, 0x800
je case.default.0x453cde
call fcn.004f3785
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [edi - 0x1f]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x201
jne 0x453b28
call fcn.004f390e
test eax, 0x800
je case.default.0x453cde
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.004edd60
test eax, eax
je 0x453af0
mov eax, dword [eax + 0x20]
movzx edx, word [esp + 0x20]
movzx ecx, word [esp + 0x1c]
shl edx, 0x10
or edx, ecx
push edx
push 2
push 0xa1
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x202
jne 0x453b91
call fcn.004f390e
test eax, 0x800
je case.default.0x453cde
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, esi
call fcn.00417360
test eax, eax
je 0x453b59
mov eax, dword [eax + 0x20]
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x1c]
shl ecx, 0x10
or ecx, edx
push ecx
push 2
push 0xa2
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x203
jne 0x453bf1
call fcn.004f390e
test eax, 0x800
je case.default.0x453cde
mov ecx, esi
call fcn.00417360
mov esi, eax
test esi, esi
je 0x453bd7
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
cmp eax, 1
jne 0x453bd7
mov ecx, dword [esi + 0x20]
push 0
push eax
push 0x409
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x204
jne 0x453c23
call fcn.004f390e
test eax, 0x800
je case.default.0x453cde
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x205
jne 0x453c73
call fcn.004f390e
test eax, 0x800
je case.default.0x453cde
mov ecx, esi
call fcn.00417360
test eax, eax
je 0x453c49
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x411
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x7b
jne 0x453cb3
call fcn.004f390e
test eax, 0x800
jne 0x453c99
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
push eax
push ecx
mov eax, esi
call fcn.00453900
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x111
jne case.default.0x453cde
mov edx, ebx
shr edx, 0x10
test dx, dx
jne case.default.0x453cde
movzx eax, bx
add eax, 0xffff7ff9
cmp eax, 6
ja case.default.0x453cde
jmp dword [eax*4 + 0x453eb4]
mov eax, dword [esi + 0x20]
push 0
push 0
push 0xc7
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x300
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi + 0x20]
push 0
push 0
push 0x301
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
push 1
call fcn.004fe180
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x303
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0xffffffffffffffff
push 0
call fcn.004fe157
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00417360
mov edi, eax
test edi, edi
je 0x453e78
mov ecx, dword [edi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
cmp eax, 1
jne 0x453e78
lea ecx, [esp + 0x10]
call fcn.00417a50
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x34], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
or eax, 0xffffffff
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x20]
push 0x434
push eax
call ebx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
mov ecx, esi
call fcn.004fe2f7
push 0x56828c
push 0x5697bc
lea ecx, [esp + 0x18]
push ecx
call fcn.00416fe0
mov edx, dword [esp + 0x10]
mov eax, dword [edi + 0x20]
push 0
push edx
push 0x405
push eax
call ebx
lea ecx, [esp + 0x10]
call fcn.004165f0
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
push edi
mov ecx, esi
call fcn.00432970
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc