Function at 0x4b2241
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, 0x5569f8
cmp byte [edi], 0
je 0x4b2263
push edi
call fcn.005183dc
pop ecx
cmp eax, 0x64
jb 0x4b226a
xor eax, eax
jmp 0x4b2d13
test esi, esi
je 0x4b2278
push esi
call fcn.004f7de3
test eax, eax
jne 0x4b227f
xor eax, eax
jmp 0x4b2d13
cmp byte [esi + 0x638], 1
je 0x4b228f
xor eax, eax
jmp 0x4b2d13
xor edx, edx
mov dword [0x556a00], edx
xor ecx, ecx
mov dword [0x556a04], ecx
xor eax, eax
mov dword [ebx], eax
cmp dword [esi + 0x614], 0
je 0x4b2317
lea edx, [esi + 0x610]
push edx
push edi
call fcn.0046b3fb
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4b236b
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [0x556a04], eax
mov edx, dword [esi + 0x608]
mov dword [0x5569fc], edx
jmp 0x4b22eb
mov ecx, dword [eax + 0x30]
mov dword [0x5569fc], ecx
inc dword [0x556a00]
mov eax, dword [0x5569fc]
test eax, eax
je 0x4b22f8
cmp eax, dword [ebx]
jne 0x4b22dc
cmp dword [0x5569fc], 0
jne 0x4b236b
xor edx, edx
mov dword [0x556a00], edx
xor ecx, ecx
mov dword [0x556a04], ecx
xor eax, eax
mov dword [ebx], eax
jmp 0x4b236b
xor edx, edx
mov dl, byte [edi]
push edx
call fcn.00520834
pop ecx
mov dword [0x556a08], eax
mov ecx, dword [esi + 0x608]
mov dword [ebx], ecx
jmp 0x4b2366
mov eax, dword [ebx]
mov edx, dword [eax + 8]
cmp edx, dword [0x556a08]
jne 0x4b2359
push edi
push dword [eax]
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4b2359
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [0x556a04], eax
jmp 0x4b236b
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
inc dword [0x556a00]
cmp dword [ebx], 0
jne 0x4b2331
mov eax, dword [ebp + 0x10]
sub eax, 1
jb 0x4b238c
je 0x4b25e9
dec eax
je 0x4b2cd3
dec eax
je 0x4b2cf4
jmp 0x4b2d11
cmp dword [0x556a04], 0
je 0x4b25df
cmp dword [ebx], 0
je 0x4b25df
cmp dword [0x531414], 0
je 0x4b2426
push 0
push dword [0x556a00]
push 0x187
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov dword [0x556a0c], eax
mov eax, dword [0x556a0c]
cmp eax, 0xffffffff
je 0x4b23e2
test eax, eax
jle 0x4b23e2
mov dword [0x531414], 2
jmp 0x4b23ec
mov dword [0x531414], 3
push 0
push dword [0x556a00]
push 0x199
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov dword [0x556a10], eax
mov eax, dword [0x556a10]
cmp eax, 0xffffffff
je 0x4b241c
test eax, eax
jl 0x4b241c
cmp eax, 0xf
jle 0x4b2426
mov dword [0x556a10], 0x63
mov dword [0x556a1c], 0xffffffff
cmp dword [0x537428], 0
je 0x4b249e
mov edx, dword [esi]
cmp edx, dword [0x53742c]
jne 0x4b249e
cmp byte [esi + 0x651], 0
je 0x4b249e
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4b2464
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4b249e
push 0x556a1c
call sub.USER32.dll_GetCursorPos
push 0x556a1c
push dword [esi + 0x748]
call sub.USER32.dll_ScreenToClient
movzx ecx, word [0x556a20]
shl ecx, 0x10
or ecx, 1
push ecx
push 0
push 0x202
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0x18e
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov dword [0x556a14], eax
push 0
push 0
push 0x19f
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov dword [0x556a18], eax
push 0
push 0
push 0xb
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push 0
push dword [0x556a00]
push 0x182
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov eax, dword [0x556a00]
cmp eax, dword [0x556a14]
jg 0x4b251d
dec dword [0x556a14]
cmp dword [0x556a14], 0
jge 0x4b251d
xor edx, edx
mov dword [0x556a14], edx
cmp eax, dword [0x556a18]
jg 0x4b253c
dec dword [0x556a18]
cmp dword [0x556a18], 0
jge 0x4b253c
xor ecx, ecx
mov dword [0x556a18], ecx
mov eax, dword [0x556a14]
cmp eax, dword [0x556a18]
jle 0x4b2555
mov dword [0x556a18], 0xffffffff
jmp 0x4b2566
push 0x556a18
push dword [0x556a14]
push esi
call fcn.004b21e8
push 0
push dword [0x556a14]
push 0x197
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
cmp dword [0x556a18], 0xffffffff
je 0x4b259f
push 0
push dword [0x556a18]
push 0x19e
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push 0
push 1
push 0xb
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push 0
push 0
push dword [esi + 0x748]
call sub.USER32.dll_InvalidateRect
push dword [ebx]
push dword [esi + 0x608]
call fcn.0049dd87
mov dword [esi + 0x608], eax
add esi, 0x610
push esi
push edi
call fcn.0046b47f
mov eax, dword [0x556a04]
jmp 0x4b2d13
cmp dword [ebp + 0x14], 0
jne 0x4b25f9
mov eax, dword [0x556a04]
jmp 0x4b2d13
mov eax, dword [0x556a04]
test eax, eax
je 0x4b2635
cmp dword [ebp + 0x14], 0
jle 0x4b2618
mov edx, eax
and edx, dword [ebp + 0x14]
jne 0x4b2d13
add dword [ebp + 0x14], eax
jmp 0x4b263f
mov ecx, dword [ebp + 0x14]
mov edx, ecx
neg ecx
mov dword [ebp + 0x14], ecx
mov ecx, eax
and ecx, dword [ebp + 0x14]
je 0x4b2d13
sub eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
jmp 0x4b263f
cmp dword [ebp + 0x14], 0
jl 0x4b2d13
mov dword [0x556a1c], 0xffffffff
cmp dword [0x537428], 0
je 0x4b26b7
mov eax, dword [esi]
cmp eax, dword [0x53742c]
jne 0x4b26b7
cmp byte [esi + 0x651], 0
je 0x4b26b7
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4b267d
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4b26b7
push 0x556a1c
call sub.USER32.dll_GetCursorPos
push 0x556a1c
push dword [esi + 0x748]
call sub.USER32.dll_ScreenToClient
movzx eax, word [0x556a20]
shl eax, 0x10
or eax, 1
push eax
push 0
push 0x202
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0x18e
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov dword [0x556a14], eax
push 0
push 0
push 0x19f
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov dword [0x556a18], eax
push 0
push 0
push 0xb
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
cmp dword [0x556a04], 0
je 0x4b27d0
cmp dword [ebx], 0
je 0x4b27d0
cmp dword [0x531414], 0
je 0x4b2798
push 0
push dword [0x556a00]
push 0x187
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov dword [0x556a0c], eax
cmp dword [0x556a0c], 0xffffffff
je 0x4b2754
cmp dword [0x556a0c], 0
jle 0x4b2754
mov dword [0x531414], 2
jmp 0x4b275e
mov dword [0x531414], 3
push 0
push dword [0x556a00]
push 0x199
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov dword [0x556a10], eax
mov eax, dword [0x556a10]
cmp eax, 0xffffffff
je 0x4b278e
test eax, eax
jl 0x4b278e
cmp eax, 0xf
jle 0x4b2798
mov dword [0x556a10], 0x63
push 0
push dword [0x556a00]
push 0x182
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push dword [ebx]
push dword [esi + 0x608]
call fcn.0049dd87
mov dword [esi + 0x608], eax
lea edx, [esi + 0x610]
push edx
push edi
call fcn.0046b47f
xor ecx, ecx
mov dword [0x556a00], ecx
mov eax, dword [esi + 0x608]
mov dword [ebx], eax
test byte [ebp + 0x14], 0x10
je 0x4b2835
jmp 0x4b2804
push dword [eax]
push edi
call fcn.005185a0
add esp, 8
test eax, eax
jl 0x4b2810
inc dword [0x556a00]
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
je 0x4b2810
test byte [eax + 0x18], 0x10
jne 0x4b27e8
push esi
push edi
mov esi, 0x533848
mov edi, 0x556ab0
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push edi
push 0x556ab0
call fcn.00518300
add esp, 8
jmp 0x4b2a36
test byte [ebp + 0x14], 2
je 0x4b28a3
jmp 0x4b2848
inc dword [0x556a00]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4b2872
test byte [eax + 0x18], 0x10
jne 0x4b283d
jmp 0x4b2872
push dword [eax]
push edi
call fcn.005185a0
add esp, 8
test eax, eax
jl 0x4b287e
inc dword [0x556a00]
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
je 0x4b287e
test byte [eax + 0x18], 2
jne 0x4b2856
push esi
push edi
mov esi, 0x53384b
mov edi, 0x556ab0
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push edi
push 0x556ab0
call fcn.00518300
add esp, 8
jmp 0x4b2a36
test byte [ebp + 0x14], 8
je 0x4b292e
jmp 0x4b28ba
inc dword [0x556a00]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4b28d3
test byte [eax + 0x18], 0x10
jne 0x4b28af
jmp 0x4b28d3
inc dword [0x556a00]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4b28fd
test byte [eax + 0x18], 2
jne 0x4b28c8
jmp 0x4b28fd
push dword [eax]
push edi
call fcn.005185a0
add esp, 8
test eax, eax
jl 0x4b2909
inc dword [0x556a00]
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
je 0x4b2909
test byte [eax + 0x18], 8
jne 0x4b28e1
push esi
push edi
mov esi, 0x53384e
mov edi, 0x556ab0
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push edi
push 0x556ab0
call fcn.00518300
add esp, 8
jmp 0x4b2a36
test byte [ebp + 0x14], 4
je 0x4b29da
jmp 0x4b2945
inc dword [0x556a00]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4b295e
test byte [eax + 0x18], 0x10
jne 0x4b293a
jmp 0x4b295e
inc dword [0x556a00]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4b2977
test byte [eax + 0x18], 2
jne 0x4b2953
jmp 0x4b2977
inc dword [0x556a00]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4b29a1
test byte [eax + 0x18], 8
jne 0x4b296c
jmp 0x4b29a1
push dword [eax]
push edi
call fcn.005185a0
add esp, 8
test eax, eax
jl 0x4b29ad
inc dword [0x556a00]
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
je 0x4b29ad
test byte [eax + 0x18], 4
jne 0x4b2985
push esi
push edi
mov esi, 0x533851
mov edi, 0x556ab0
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push edi
push 0x556ab0
call fcn.00518300
add esp, 8
jmp 0x4b2a36
inc dword [0x556a00]
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4b2a04
cmp dword [eax + 0x18], 1
jne 0x4b29cf
jmp 0x4b2a04
push dword [eax]
push edi
call fcn.005185a0
add esp, 8
test eax, eax
jl 0x4b2a10
inc dword [0x556a00]
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
je 0x4b2a10
cmp dword [eax + 0x18], 1
je 0x4b29e8
push esi
push edi
mov esi, 0x556ab0
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [ebx], 0
je 0x4b2a9c
push dword [ebp + 0x14]
push 0
push edi
push 0
call fcn.0049d9f0
mov dword [0x5569fc], eax
cmp dword [0x5569fc], 0
je 0x4b2af6
xor eax, eax
mov al, byte [edi]
push eax
call fcn.00520834
pop ecx
mov edx, dword [0x5569fc]
mov dword [edx + 8], eax
push dword [0x5569fc]
push dword [ebx]
push dword [esi + 0x608]
call fcn.0049de47
mov dword [esi + 0x608], eax
lea ecx, [esi + 0x610]
push ecx
push dword [0x5569fc]
push edi
call fcn.0046b2e8
jmp 0x4b2af6
push dword [ebp + 0x14]
push 0
push edi
push dword [esi + 0x608]
call fcn.0049d9f0
mov ebx, eax
mov dword [0x5569fc], ebx
test ebx, ebx
je 0x4b2aec
mov dword [esi + 0x608], ebx
xor eax, eax
mov al, byte [edi]
push eax
call fcn.00520834
pop ecx
mov edx, dword [esi + 0x608]
mov ecx, dword [edx + 0x34]
mov dword [ecx + 8], eax
lea eax, [esi + 0x610]
push eax
mov edx, dword [esi + 0x608]
push dword [edx + 0x34]
push edi
call fcn.0046b2e8
mov dword [0x556a00], 0xffffffff
push 0x556ab0
push dword [0x556a00]
push 0x181
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
mov ebx, eax
mov dword [0x556a0c], ebx
cmp ebx, 0xffffffff
je 0x4b2c20
cmp dword [0x531414], 0
je 0x4b2b6f
cmp dword [0x531414], 2
jne 0x4b2b47
push ebx
push 1
push 0x185
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push dword [0x556a10]
push dword [0x556a0c]
push 0x19a
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
xor eax, eax
mov dword [0x531414], eax
jmp 0x4b2c20
push 0x63
push dword [0x556a0c]
push 0x19a
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
cmp dword [esi + 0x60c], 0
je 0x4b2c20
xor edx, edx
mov dl, byte [edi]
push edx
call fcn.00520834
pop ecx
mov dword [0x556a08], eax
mov ecx, dword [esi + 0x60c]
mov dword [0x5569fc], ecx
jmp 0x4b2c17
mov eax, dword [0x5569fc]
mov edx, dword [eax + 8]
cmp edx, dword [0x556a08]
jne 0x4b2c09
push edi
push dword [eax]
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4b2c09
mov ecx, dword [0x5569fc]
push dword [ecx + 4]
push dword [0x556a0c]
push 0x19a
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push dword [0x5569fc]
push dword [esi + 0x60c]
call fcn.0049dd87
mov dword [esi + 0x60c], eax
jmp 0x4b2c20
mov eax, dword [0x5569fc]
mov edx, dword [eax + 0x30]
mov dword [0x5569fc], edx
cmp dword [0x5569fc], 0
jne 0x4b2bb2
mov eax, dword [0x556a0c]
cmp eax, 0xffffffff
je 0x4b2cae
cmp eax, dword [0x556a14]
jg 0x4b2c3c
inc dword [0x556a14]
cmp eax, dword [0x556a18]
jg 0x4b2c4a
inc dword [0x556a18]
mov edx, dword [0x556a14]
cmp edx, dword [0x556a18]
jle 0x4b2c64
mov dword [0x556a18], 0xffffffff
jmp 0x4b2c75
push 0x556a18
push dword [0x556a14]
push esi
call fcn.004b21e8
push 0
push dword [0x556a14]
push 0x197
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
cmp dword [0x556a18], 0xffffffff
je 0x4b2cae
push 0
push dword [0x556a18]
push 0x19e
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push 0
push 1
push 0xb
push dword [esi + 0x748]
call sub.USER32.dll_SendMessageA
push 0
push 0
push dword [esi + 0x748]
call sub.USER32.dll_InvalidateRect
mov eax, dword [ebp + 0x14]
jmp 0x4b2d13
cmp dword [ebp + 0x14], 0
je 0x4b2ced
mov edx, dword [0x556a04]
and edx, dword [ebp + 0x14]
je 0x4b2ce9
mov eax, dword [ebp + 0x14]
jmp 0x4b2d13
xor eax, eax
jmp 0x4b2d13
mov eax, dword [0x556a04]
jmp 0x4b2d13
cmp dword [0x556a04], 0
je 0x4b2d0a
cmp dword [ebx], 0
je 0x4b2d0a
mov edx, dword [ebx]
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0x14], ecx
mov eax, dword [0x556a04]
jmp 0x4b2d13
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10