Function at 0x450210
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x87c
mov eax, dword [0x57b070]
xor eax, esp
mov dword [esp + 0x878], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 0x1c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x18]
mov dword [esp + 0x28], esi
push edi
mov edi, dword [ebp + 8]
cmp ecx, 0x100
ja 0x450776
je 0x4506c4
lea eax, [ecx - 1]
cmp eax, 0x83
ja case.0x4509bd.518
movzx eax, byte [eax + 0x450d30]
jmp dword [eax*4 + 0x450cfc]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xd0]
call eax
jmp 0x450be5
push 0
push 0
push dword [edi + 0xfc]
push 0x8001
call dword [sym.imp.USER32.dll_NotifyWinEvent]
mov eax, dword [edi + 0x15c]
test eax, eax
je 0x4502bd
mov dword [eax + 8], 0
mov eax, dword [edi + 0x15c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push str.RegWndAccDataProp
push dword [edi + 0xfc]
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, dword [sym.imp.USER32.dll_SetPropW]
mov ebx, eax
test ebx, ebx
je 0x4502f4
push 0
push str.RegWndAccDataProp
push dword [edi + 0xfc]
call esi
push 8
push ebx
call fcn.004a3815
add esp, 8
cmp byte [edi + 0x160], 0
je 0x450303
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
push str.1E287BCD_7589_42C0_911D_4A79F12E75BD
push dword [edi + 0xfc]
call esi
mov eax, dword [esp + 0x28]
mov dword [edi + 0xfc], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14
push 0x40
lea eax, [esp + 0x34]
push 0
push eax
call fcn.004a64e0
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x3c]
add esp, 0xc
push eax
push ebx
call dword [sym.imp.USER32.dll_BeginPaint]
mov ecx, edi
call fcn.00450e90
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [edi]
mov eax, esi
shr eax, 0x10
mov ecx, edi
cwde
push eax
movsx eax, si
push eax
mov eax, dword [edx + 0xd8]
push ebx
call eax
jmp 0x450be5
cmp byte [edi + 0x10d], 0
je 0x4503b9
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [edi + 0x10d], 0
call fcn.00456d00
cmp dword [eax + 4], 0
je 0x450418
call fcn.00456d00
mov esi, dword [eax + 4]
call fcn.00456d00
cmp dword [eax + 4], esi
jne 0x450418
call fcn.00456d00
mov esi, dword [eax + 4]
call fcn.00456d00
push 0
push 0
mov ecx, esi
mov dword [eax + 4], 0
mov eax, dword [esi]
call dword [eax + 0x28]
mov byte [esi + 0x64], 1
mov byte [esi + 0x71], 0
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [edi]
mov ecx, edi
push ebx
mov eax, dword [eax + 0xf0]
call eax
jmp 0x450be5
mov edx, dword [edi]
mov eax, esi
shr eax, 0x10
mov ecx, edi
cwde
push eax
movsx eax, si
push eax
mov eax, dword [edx + 0xe0]
call eax
push 0
push 0
mov ecx, edi
mov byte [esp + 0x1b], al
call fcn.00455010
mov al, byte [esp + 0x13]
test al, al
je 0x450c9e
mov dword [esp + 0x28], 0
jmp 0x450be5
mov edx, dword [edi]
cmp ebx, 1
mov ecx, edi
sete al
movzx eax, al
push eax
mov eax, dword [edx + 0xe8]
call eax
jmp 0x450be5
mov edx, dword [edi]
lea eax, [esp + 0x28]
push eax
mov eax, esi
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
mov eax, dword [edx + 0xd4]
call eax
jmp 0x450be5
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xf4]
call eax
test al, al
jne 0x450bed
jmp 0x450c9e
mov edx, dword [edi]
lea ecx, [esp + 0x28]
mov eax, esi
shr eax, 0x10
mov dword [esp + 0x70], eax
push ecx
cwde
mov ecx, edi
push eax
movsx eax, si
push eax
mov eax, dword [edx + 0x100]
push ebx
call eax
cmp byte [edi + 0x11e], 0
mov byte [esp + 0x13], al
je 0x450be5
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x450a37
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x1c]
movzx edx, si
movzx esi, ax
mov eax, dword [esp + 0x20]
cmp edx, dword [edi + 0x13c]
jne 0x450543
cmp esi, dword [edi + 0x140]
jne 0x450543
cmp ecx, dword [edi + 0x134]
jne 0x450543
cmp eax, dword [edi + 0x138]
je 0x450a37
cmp byte [edi + 0x11e], 0
mov dword [edi + 0x134], ecx
mov dword [edi + 0x138], eax
mov dword [edi + 0x140], esi
mov dword [edi + 0x13c], edx
je 0x450a37
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x450a37
lea eax, [esp + 0x70]
xorps xmm0, xmm0
push eax
push dword [esp + 0x18]
movups xmmword [esp + 0x78], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x70]
movzx edx, ax
mov dword [esp + 0x20], eax
shl edx, 0x10
movzx eax, cx
or edx, eax
mov dword [esp + 0x1c], ecx
cmp esi, 0x201
jne 0x4505ea
mov eax, edx
shr eax, 0x10
cwde
push eax
movsx eax, dx
push eax
push ecx
mov ecx, edi
call fcn.00451170
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14
cmp esi, 0x204
jne 0x45061f
mov eax, edx
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, dx
push eax
call fcn.00455f60
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [edi]
push edx
push 0
push esi
push dword [esp + 0x20]
push edi
call dword [eax + 0xc0]
mov al, byte [esp + 0x13]
jmp 0x450be5
cmp edx, dword [edi + 0xfc]
jne case.0x4509bd.518
cmp dword [edi + 0x15c], 0
je case.0x4509bd.518
cmp byte [edi + 0x160], 0
jne 0x45066a
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov byte [edi + 0x160], 1
push dword [edi + 0x15c]
push ebx
push 0x514788
call dword [sym.imp.OLEACC.dll_LresultFromObject]
push 0x800
mov esi, eax
lea eax, [esp + 0x84]
push 0
push eax
call fcn.004a64e0
add esp, 0xc
lea eax, [esp + 0x80]
push esi
push 0x55df60
push eax
call fcn.004472f0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [edi + 0x144]
mov eax, ecx
mov edx, dword [ecx + 4]
cmp byte [edx + 0xd], 0
jne 0x4506e9
cmp dword [edx + 0x10], ebx
jae 0x4506df
mov edx, dword [edx + 8]
jmp 0x4506e3
mov eax, edx
mov edx, dword [edx]
cmp byte [edx + 0xd], 0
je 0x4506d5
cmp eax, ecx
je 0x4506f2
cmp ebx, dword [eax + 0x10]
jae 0x4506f4
mov eax, ecx
mov dword [esp + 0x18], eax
cmp eax, ecx
je 0x450769
nop dword [eax]
cmp dword [eax + 0x10], ebx
jne 0x450769
mov edx, dword [eax + 0x14]
cmp byte [edx + 0x31], 0
je 0x450754
cmp dword [edx + 0x84], edx
je 0x450729
mov ecx, dword [edx + 0x80]
test ecx, ecx
je 0x450729
call fcn.00455710
test al, al
je 0x450754
cmp byte [edx + 0x30], 0
je 0x450754
mov ecx, dword [edx + 0x80]
test ecx, ecx
je 0x450742
call fcn.00455740
test al, al
je 0x450754
mov eax, dword [edx]
mov ecx, edx
push ebx
mov eax, dword [eax + 0x54]
call eax
test al, al
jne 0x450c9e
lea ecx, [esp + 0x18]
call fcn.0041e730
mov eax, dword [esp + 0x18]
cmp eax, dword [edi + 0x144]
jne 0x450700
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x54]
jmp 0x450c9e
cmp ecx, 0x200
ja 0x4509a5
je 0x450866
mov eax, ecx
sub eax, 0x101
je 0x4507b3
sub eax, 0x12
jne case.0x4509bd.518
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [edi]
mov ecx, edi
push eax
push ebx
mov eax, dword [edx + 0xec]
call eax
jmp 0x450be5
mov ecx, dword [edi + 0x144]
mov eax, ecx
mov edx, dword [ecx + 4]
cmp byte [edx + 0xd], 0
jne 0x4507d8
cmp dword [edx + 0x10], ebx
jae 0x4507ce
mov edx, dword [edx + 8]
jmp 0x4507d2
mov eax, edx
mov edx, dword [edx]
cmp byte [edx + 0xd], 0
je 0x4507c4
cmp eax, ecx
je 0x4507e1
cmp ebx, dword [eax + 0x10]
jae 0x4507e3
mov eax, ecx
mov dword [esp + 0x18], eax
cmp eax, ecx
je 0x450859
nop dword [eax + eax]
cmp dword [eax + 0x10], ebx
jne 0x450859
mov edx, dword [eax + 0x14]
cmp byte [edx + 0x31], 0
je 0x450844
cmp dword [edx + 0x84], edx
je 0x450819
mov ecx, dword [edx + 0x80]
test ecx, ecx
je 0x450819
call fcn.00455710
test al, al
je 0x450844
cmp byte [edx + 0x30], 0
je 0x450844
mov ecx, dword [edx + 0x80]
test ecx, ecx
je 0x450832
call fcn.00455740
test al, al
je 0x450844
mov eax, dword [edx]
mov ecx, edx
push ebx
mov eax, dword [eax + 0x58]
call eax
test al, al
jne 0x450c9e
lea ecx, [esp + 0x18]
call fcn.0041e730
mov eax, dword [esp + 0x18]
cmp eax, dword [edi + 0x144]
jne 0x4507f0
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x58]
jmp 0x450c9e
push dword [edi + 0xfc]
mov eax, esi
shr eax, 0x10
cwde
mov dword [esp + 0x28], eax
movsx eax, si
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4508c0
mov eax, dword [edi + 0xfc]
xorps xmm0, xmm0
movq qword [esp + 0x74], xmm0
mov dword [esp + 0x78], eax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x80], 0
mov dword [esp + 0x74], 0x10
mov dword [esp + 0x78], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
call fcn.00456d00
cmp dword [eax + 4], 0
je 0x450952
call fcn.00456d00
mov esi, dword [eax + 4]
call fcn.00456d00
cmp dword [eax + 4], esi
jne 0x450952
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
inc eax
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
mov eax, dword [esp + 0x18]
jne 0x450966
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
call fcn.00456d00
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x74]
push ecx
push dword [eax + 4]
mov ecx, edi
call fcn.00451090
call fcn.00456d00
mov esi, dword [eax + 4]
call fcn.00456d00
push dword [esp + 0x1c]
mov ecx, esi
push dword [esp + 0x74]
mov dword [eax + 4], 0
mov eax, dword [esi]
call dword [eax + 0x28]
mov byte [esi + 0x64], 1
mov byte [esi + 0x71], 0
push dword [esp + 0x24]
mov ecx, edi
push dword [esp + 0x1c]
call fcn.00455c50
jmp 0x450be5
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x70], eax
call fcn.00456d00
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x20]
push ecx
push dword [eax + 4]
mov ecx, edi
call fcn.00451090
call fcn.00456d00
push dword [esp + 0x70]
push dword [esp + 0x20]
mov ecx, dword [eax + 4]
call fcn.00455c50
jmp 0x450be5
lea eax, [ecx - 0x201]
cmp eax, 0xa2
ja case.0x4509bd.518
movzx eax, byte [eax + 0x450de4]
jmp dword [eax*4 + 0x450db4]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
sub eax, ecx
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
mov eax, dword [esi + 0xc]
push ecx
sub eax, edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x24]
mov eax, dword [edi]
push ecx
lea ecx, [esp + 0x7c]
push ecx
mov eax, dword [eax + 0xdc]
mov ecx, edi
push ebx
call eax
mov byte [esp + 0x13], al
test al, al
je 0x450c9e
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x24]
add eax, edx
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [esi + 0xc], eax
mov dword [esp + 0x28], 1
mov al, byte [esp + 0x13]
jmp 0x450be5
mov eax, esi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
push ecx
mov ecx, edi
call fcn.00451170
jmp 0x450be5
mov byte [esp + 0x13], 0
call fcn.00456d00
cmp dword [eax + 4], 0
je 0x450ad8
call fcn.00456d00
mov esi, dword [eax + 4]
call fcn.00456d00
cmp dword [eax + 4], esi
jne 0x450ad8
mov ecx, dword [esp + 0x2c]
movsx eax, cx
mov dword [esp + 0x1c], eax
mov eax, ecx
shr eax, 0x10
cwde
mov dword [esp + 0x70], eax
call fcn.00456d00
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x20]
push ecx
push dword [eax + 4]
mov ecx, edi
call fcn.00451090
call fcn.00456d00
mov esi, dword [eax + 4]
call fcn.00456d00
push dword [esp + 0x70]
mov ecx, esi
push dword [esp + 0x20]
mov dword [eax + 4], 0
mov eax, dword [esi]
call dword [eax + 0x28]
mov byte [esi + 0x64], 1
mov byte [esi + 0x71], 0
mov byte [esp + 0x13], 1
cmp byte [edi + 0x10d], 0
je 0x450aee
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [edi + 0x10d], 0
mov al, byte [esp + 0x13]
jmp 0x450be5
mov eax, esi
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
call fcn.00455f60
jmp 0x450be5
mov eax, esi
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
call fcn.00456050
jmp 0x450be5
call fcn.00456d00
cmp dword [eax], 0
je 0x450bed
call fcn.004511b0
jmp 0x450be5
call fcn.00456d00
cmp dword [eax], 0
je 0x450bed
call fcn.00456d00
mov esi, eax
mov ecx, ebx
shr ecx, 0x10
mov eax, 0x88888889
movsx ecx, cx
imul ecx
add edx, ecx
mov ecx, dword [esi]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
movzx eax, bx
push eax
call fcn.00456240
jmp 0x450be5
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
sub eax, ecx
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
mov eax, dword [esi + 0xc]
push ecx
sub eax, edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x24]
mov eax, dword [edi]
push ecx
lea ecx, [esp + 0x7c]
push ecx
mov eax, dword [eax + 0xe4]
mov ecx, edi
call eax
push 0
push 0
mov ecx, edi
mov byte [esp + 0x1b], al
call fcn.00455010
cmp byte [esp + 0x13], 0
jmp 0x450a0a
mov eax, esi
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
call fcn.00456140
test al, al
je 0x450c9a
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14
cmp esi, dword [edi + 0xfc]
je case.0x4509bd.518
cmp byte [edi + 0x10d], 0
je 0x450c2a
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [edi + 0x10d], 0
call fcn.00456d00
cmp dword [eax + 4], 0
je 0x450c9e
call fcn.00456d00
mov esi, dword [eax + 4]
call fcn.00456d00
cmp dword [eax + 4], esi
jne 0x450c9a
lea eax, [esp + 0x70]
xorps xmm0, xmm0
push eax
movq qword [esp + 0x74], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x70]
push eax
push dword [edi + 0xfc]
call dword [sym.imp.USER32.dll_ScreenToClient]
call fcn.00456d00
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esp + 0x74]
push ecx
push dword [eax + 4]
mov ecx, edi
call fcn.00451090
call fcn.00456d00
push dword [esp + 0x74]
push dword [esp + 0x74]
mov ecx, dword [eax + 4]
call fcn.00455f30
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp + 0x10]
cmp byte [edi + 0x10e], 0
je 0x450cda
mov eax, dword [edi + 0x110]
test eax, eax
je 0x450cda
push esi
push ebx
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14
push esi
push ebx
push ecx
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp + 0x884]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 0x14