Function at 0x4fbe14
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x58]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4fc6d4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x555d0c]
mov eax, dword [eax]
xor edx, edx
call fcn.0046f3f0
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x3c]
xor edx, edx
xor eax, eax
call fcn.00418bac
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
push 0
push 0x32
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004f82b0
test eax, eax
jle 0x4fbf47
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004f82b0
mov edx, eax
dec edx
mov eax, ebx
call fcn.004f82b8
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4fbf33
mov eax, esi
call fcn.004f82b0
cmp ebx, eax
jge 0x4fbf33
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004f82b8
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4fbf1f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004f82b0
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4fbf1f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004f82b8
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4fbf33
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004fb38c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4fbf5d
mov eax, ebx
call fcn.004573c0
call fcn.00492da8
mov byte [ebp - 6], 1
jmp 0x4fc691
cmp byte [ebp - 6], 0
jne 0x4fbf71
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4fc670
mov eax, dword [edi + 4]
cmp eax, 0x113
jg 0x4fbfa9
je 0x4fc0b5
sub eax, 0x12
je 0x4fc0a9
sub eax, 0x34
je 0x4fbfba
add eax, 0xffffffa5
sub eax, 9
jb 0x4fc0a9
jmp 0x4fc147
sub eax, 0x201
je 0x4fbfcb
sub eax, 3
je 0x4fbfcb
jmp 0x4fc147
push ebp
call fcn.004fbdc0
pop ecx
call fcn.00404174
jmp 0x4fc6db
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407bec
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x60]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00450638
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4fc04e
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fc04e
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fc147
mov ebx, dword [ebp - 4]
mov byte [ebp - 0x21], 0
jmp 0x4fc084
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [ebx + 0x3c]
call fcn.00450638
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebx + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fc081
mov byte [ebp - 0x21], 1
mov ebx, dword [ebx + 0x68]
test ebx, ebx
je 0x4fc08e
cmp byte [ebp - 0x21], 0
je 0x4fc057
cmp byte [ebp - 0x21], 0
jne 0x4fc147
push ebp
call fcn.004fbdc0
pop ecx
call fcn.00404174
jmp 0x4fc6db
push ebp
call fcn.004fbdc0
pop ecx
jmp 0x4fc670
cmp dword [edi], 0
jne 0x4fc147
lea eax, [ebp - 0x34]
push eax
call sub.user32.dll_GetCursorPos
test eax, eax
je 0x4fc147
add dword [ebp - 0x28], 0x32
lea edx, [ebp - 0x34]
mov eax, dword [0x555cb8]
mov eax, dword [eax]
call fcn.0045bcb0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x3c]
jne 0x4fc136
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x38]
jne 0x4fc136
cmp dword [ebp - 0x28], 0x1f4
jl 0x4fc13b
mov ebx, dword [ebp - 4]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea edx, [ebp - 0x70]
mov eax, dword [ebx + 0x3c]
call fcn.00450494
lea eax, [ebp - 0x70]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fc12f
push 0
push 0
push 0x46f
mov eax, dword [ebx + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x4fc13b
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4fc670
mov eax, dword [edi + 4]
sub eax, 0x7b
je 0x4fc670
add eax, 0xffffff7b
sub eax, 9
jb 0x4fc199
add eax, 0xffffff09
sub eax, 0xb
jb 0x4fc47c
sub eax, 0x264
jne 0x4fc66a
mov eax, dword [ebp - 4]
call fcn.004fba70
jmp 0x4fc670
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4fc670
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4fc1cf
sub eax, 2
je 0x4fc41c
sub eax, 2
je 0x4fc1cf
sub eax, 2
je 0x4fc41c
jmp 0x4fc670
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4fc212
je 0x4fc2ce
cmp eax, 0x12
jg 0x4fc1fb
je 0x4fc405
sub eax, 9
je 0x4fc670
sub eax, 4
je 0x4fc237
jmp 0x4fc411
sub eax, 0x1b
je 0x4fc2a1
sub eax, 5
je 0x4fc670
jmp 0x4fc411
sub eax, 0x26
je 0x4fc3c8
dec eax
je 0x4fc343
dec eax
je 0x4fc3e2
sub eax, 0x51
je 0x4fc405
jmp 0x4fc411
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4fc24f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov si, 0xffef
call fcn.00403af0
mov eax, dword [ebp - 4]
call fcn.004fba70
test al, al
jne 0x4fc670
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4fc670
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4fc6ec
call fcn.004050cc
je 0x4fc670
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4fc670
push ebp
call fcn.004fbdc0
pop ecx
jmp 0x4fc670
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4fc2b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.00404174
jmp 0x4fc6db
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4fc2e4
mov eax, dword [ebp - 4]
call fcn.004fbc80
jmp 0x4fc670
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4fc670
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
cmp byte [eax + 0x34], 0
je 0x4fc324
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov eax, dword [eax + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
call fcn.00404174
jmp 0x4fc6db
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fc670
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4fc359
mov eax, dword [ebp - 4]
call fcn.004fbb50
jmp 0x4fc670
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4fc670
mov eax, dword [ebp - 4]
call fcn.004fba70
test al, al
jne 0x4fc670
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
cmp byte [eax + 0x34], 0
je 0x4fc3a9
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov eax, dword [eax + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
call fcn.00404174
jmp 0x4fc6db
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fc670
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4fc670
mov eax, dword [ebp - 4]
call fcn.004fbc80
jmp 0x4fc670
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4fc3f8
mov eax, dword [ebp - 4]
call fcn.004fbb50
jmp 0x4fc670
mov eax, dword [ebp - 4]
call fcn.004fba70
jmp 0x4fc670
push ebp
call fcn.004fbdc0
pop ecx
jmp 0x4fc670
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4fc670
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004fa880
test eax, eax
je 0x4fc670
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004fa880
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4fc45d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fc670
mov eax, dword [edi + 4]
sub eax, 0x200
je 0x4fc494
sub eax, 2
je 0x4fc59b
jmp 0x4fc670
xor eax, eax
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407bec
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x56dcf0]
jne 0x4fc4ca
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x56dcf4]
je 0x4fc670
mov ebx, dword [ebp - 4]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea edx, [ebp - 0x70]
mov eax, dword [ebx + 0x3c]
call fcn.00450494
lea eax, [ebp - 0x70]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fc4fa
lea edx, [ebp - 0xe]
mov eax, ebx
call fcn.004fb38c
jmp 0x4fc584
mov ebx, dword [ebp - 4]
jmp 0x4fc502
mov ebx, dword [ebx + 0x68]
cmp dword [ebx + 0x68], 0
jne 0x4fc4ff
test ebx, ebx
je 0x4fc584
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0xe]
mov eax, ebx
call fcn.004fb38c
mov eax, dword [ebx + 0x40]
cmp eax, dword [ebp - 0x1c]
je 0x4fc57d
cmp ebx, dword [ebp - 4]
je 0x4fc57d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp ebx, dword [ebp - 0x20]
je 0x4fc55c
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x20], eax
cmp ebx, dword [ebp - 0x20]
jne 0x4fc534
push 0
push 0
push 0x46f
mov eax, dword [ebx + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
call fcn.00404174
jmp 0x4fc6db
mov ebx, dword [ebx + 0x6c]
test ebx, ebx
jne 0x4fc50c
mov eax, dword [ebp - 0xe]
mov dword [0x56dcf0], eax
mov eax, dword [ebp - 0xa]
mov dword [0x56dcf4], eax
jmp 0x4fc670
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407bec
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x60]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00450638
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4fc61b
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fc61b
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004573c0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fc670
mov ebx, dword [ebp - 4]
mov byte [ebp - 0x21], 0
jmp 0x4fc651
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [ebx + 0x3c]
call fcn.00450638
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebx + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fc64e
mov byte [ebp - 0x21], 1
mov ebx, dword [ebx + 0x68]
test ebx, ebx
je 0x4fc65b
cmp byte [ebp - 0x21], 0
je 0x4fc624
cmp byte [ebp - 0x21], 0
jne 0x4fc670
push ebp
call fcn.004fbdc0
pop ecx
jmp 0x4fc670
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004fbdec
pop ecx
test al, al
je 0x4fc691
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4fbf7a
push ebp
call fcn.004fbdec
pop ecx
test al, al
jne 0x4fbf66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc6db
mov eax, dword [ebp - 0x2c]
push eax
push 0
call sub.user32.dll_KillTimer
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4fc6c7
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.00492dc8
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret