Function at 0x49ca90
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x87c
mov eax, dword [0x57c06c]
xor eax, esp
mov dword [esp + 0x878], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp + 0x18], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x24], ebx
push esi
mov esi, dword [ebp + 0x18]
mov dword [esp + 0x24], esi
push edi
mov edi, dword [ebp + 8]
cmp ecx, 0x100
ja 0x49d01b
je 0x49cf3c
lea eax, [ecx - 1]
cmp eax, 0x83
ja case.0x49d280.518
movzx eax, byte [eax + 0x49d618]
jmp dword [eax*4 + 0x49d5e4]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xd0]
call eax
jmp 0x49d4ba
push 0
push 0
push dword [edi + 0xfc]
push 0x8001
call dword [sym.imp.USER32.dll_NotifyWinEvent]
mov eax, dword [edi + 0x15c]
test eax, eax
je 0x49cb41
mov dword [eax + 8], 0
mov eax, dword [edi + 0x15c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push str.RegWndAccDataProp
push dword [edi + 0xfc]
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, dword [sym.imp.USER32.dll_SetPropW]
mov ebx, eax
test ebx, ebx
je 0x49cb78
push 0
push str.RegWndAccDataProp
push dword [edi + 0xfc]
call esi
push 8
push ebx
call fcn.004e251d
add esp, 8
cmp byte [edi + 0x160], 0
je 0x49cb87
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
push str.1E287BCD_7589_42C0_911D_4A79F12E75BD
push dword [edi + 0xfc]
call esi
mov eax, dword [esp + 0x24]
mov dword [edi + 0xfc], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14
push 0x40
lea eax, [esp + 0x34]
push 0
push eax
call fcn.004e5200
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x3c]
add esp, 0xc
push eax
push ebx
call dword [sym.imp.USER32.dll_BeginPaint]
mov ecx, edi
call fcn.0049d770
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [edi]
mov eax, esi
shr eax, 0x10
mov ecx, edi
cwde
push eax
movsx eax, si
push eax
mov eax, dword [edx + 0xd8]
push ebx
call eax
jmp 0x49d4ba
cmp byte [edi + 0x10d], 0
je 0x49cc3d
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [edi + 0x10d], 0
call fcn.004a0bd0
cmp dword [eax + 4], 0
je 0x49cc9c
call fcn.004a0bd0
mov esi, dword [eax + 4]
call fcn.004a0bd0
cmp dword [eax + 4], esi
jne 0x49cc9c
call fcn.004a0bd0
mov esi, dword [eax + 4]
call fcn.004a0bd0
push 0
push 0
mov ecx, esi
mov dword [eax + 4], 0
mov eax, dword [esi]
call dword [eax + 0x28]
mov byte [esi + 0x64], 1
mov byte [esi + 0x71], 0
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [edi]
mov ecx, edi
push ebx
mov eax, dword [eax + 0xf0]
call eax
jmp 0x49d4ba
mov edx, dword [edi]
mov eax, esi
shr eax, 0x10
mov ecx, edi
cwde
push eax
movsx eax, si
push eax
mov eax, dword [edx + 0xe0]
call eax
push 0
push 0
mov ecx, edi
mov bl, al
call fcn.0049ee80
test bl, bl
je 0x49d577
mov dword [esp + 0x24], 0
jmp 0x49d4bc
mov edx, dword [edi]
cmp ebx, 1
mov ecx, edi
sete al
movzx eax, al
push eax
mov eax, dword [edx + 0xe8]
call eax
jmp 0x49d4ba
mov edx, dword [edi]
lea eax, [esp + 0x24]
push eax
mov eax, esi
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
mov eax, dword [edx + 0xd4]
call eax
jmp 0x49d4ba
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xf4]
call eax
test al, al
jne 0x49d4c4
jmp 0x49d585
mov edx, dword [edi]
lea ecx, [esp + 0x24]
mov eax, esi
shr eax, 0x10
mov dword [esp + 0x70], eax
push ecx
cwde
mov ecx, edi
push eax
movsx eax, si
push eax
mov eax, dword [edx + 0x100]
push ebx
call eax
cmp byte [edi + 0x11e], 0
mov bl, al
je 0x49d4bc
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x49d4bc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x14]
movzx edx, si
movzx esi, ax
mov eax, dword [esp + 0x18]
cmp edx, dword [edi + 0x13c]
jne 0x49cdbf
cmp esi, dword [edi + 0x140]
jne 0x49cdbf
cmp ecx, dword [edi + 0x134]
jne 0x49cdbf
cmp eax, dword [edi + 0x138]
je 0x49d4bc
cmp byte [edi + 0x11e], 0
mov dword [edi + 0x134], ecx
mov dword [edi + 0x138], eax
mov dword [edi + 0x140], esi
mov dword [edi + 0x13c], edx
je 0x49d4bc
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x49d4bc
lea eax, [esp + 0x70]
xorps xmm0, xmm0
push eax
push dword [esp + 0x14]
movups xmmword [esp + 0x78], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x70]
movzx edx, ax
mov dword [esp + 0x18], eax
shl edx, 0x10
movzx eax, cx
or edx, eax
mov dword [esp + 0x14], ecx
cmp esi, 0x201
jne 0x49ce66
mov eax, edx
shr eax, 0x10
cwde
push eax
movsx eax, dx
push eax
push ecx
mov ecx, edi
call fcn.0049da00
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14
cmp esi, 0x204
jne 0x49ce9b
mov eax, edx
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, dx
push eax
call fcn.0049fd90
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [edi]
push edx
push 0
push esi
push dword [esp + 0x1c]
push edi
call dword [eax + 0xc0]
jmp 0x49d4bc
cmp edx, dword [edi + 0xfc]
jne case.0x49d280.518
cmp dword [edi + 0x15c], 0
je case.0x49d280.518
cmp byte [edi + 0x160], 0
jne 0x49cee2
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov byte [edi + 0x160], 1
push dword [edi + 0x15c]
push ebx
push 0x54c848
call dword [sym.imp.OLEACC.dll_LresultFromObject]
push 0x800
mov esi, eax
lea eax, [esp + 0x84]
push 0
push eax
call fcn.004e5200
add esp, 0xc
lea eax, [esp + 0x80]
push esi
push str.t_cuWindow::WndProc_____WM_GETOBJECT_____LresultFromObject______d
push eax
call fcn.0049e420
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], ebx
push ecx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [edi + 0x144]
call fcn.0049e340
mov esi, dword [esp + 0x14]
cmp esi, dword [edi + 0x144]
je 0x49d00e
cmp dword [esi + 0x10], ebx
jne 0x49d00e
mov edx, dword [esi + 0x14]
cmp byte [edx + 0x31], 0
je 0x49cfbd
cmp dword [edx + 0x84], edx
je 0x49cf92
mov ecx, dword [edx + 0x80]
test ecx, ecx
je 0x49cf92
call fcn.0049f520
test al, al
je 0x49cfbd
cmp byte [edx + 0x30], 0
je 0x49cfbd
mov ecx, dword [edx + 0x80]
test ecx, ecx
je 0x49cfab
call fcn.0049f550
test al, al
je 0x49cfbd
mov eax, dword [edx]
mov ecx, edx
push ebx
mov eax, dword [eax + 0x54]
call eax
test al, al
jne 0x49d581
cmp byte [esi + 0xd], 0
jne 0x49d002
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x49cfe2
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x49d002
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x49cfd6
jmp 0x49d002
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x49d000
nop dword [eax + eax]
cmp esi, dword [eax + 8]
jne 0x49d000
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x49cff0
mov esi, eax
cmp esi, dword [edi + 0x144]
jne 0x49cf65
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x54]
jmp 0x49d581
cmp ecx, 0x200
ja 0x49d268
je 0x49d132
mov eax, ecx
sub eax, 0x101
je 0x49d058
sub eax, 0x12
jne case.0x49d280.518
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [edi]
mov ecx, edi
push eax
push ebx
mov eax, dword [edx + 0xec]
call eax
jmp 0x49d4ba
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], ebx
push ecx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [edi + 0x144]
call fcn.0049e340
mov esi, dword [esp + 0x14]
cmp esi, dword [edi + 0x144]
je 0x49d125
cmp dword [esi + 0x10], ebx
jne 0x49d125
mov edx, dword [esi + 0x14]
cmp byte [edx + 0x31], 0
je 0x49d0d9
cmp dword [edx + 0x84], edx
je 0x49d0ae
mov ecx, dword [edx + 0x80]
test ecx, ecx
je 0x49d0ae
call fcn.0049f520
test al, al
je 0x49d0d9
cmp byte [edx + 0x30], 0
je 0x49d0d9
mov ecx, dword [edx + 0x80]
test ecx, ecx
je 0x49d0c7
call fcn.0049f550
test al, al
je 0x49d0d9
mov eax, dword [edx]
mov ecx, edx
push ebx
mov eax, dword [eax + 0x58]
call eax
test al, al
jne 0x49d581
cmp byte [esi + 0xd], 0
jne 0x49d119
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x49d0fe
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x49d119
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x49d0f2
jmp 0x49d119
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x49d117
cmp esi, dword [eax + 8]
jne 0x49d117
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x49d107
mov esi, eax
cmp esi, dword [edi + 0x144]
jne 0x49d081
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x58]
jmp 0x49d581
push dword [edi + 0xfc]
mov eax, esi
shr eax, 0x10
movsx ebx, ax
movsx eax, si
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x49d18a
mov eax, dword [edi + 0xfc]
xorps xmm0, xmm0
movq qword [esp + 0x74], xmm0
mov dword [esp + 0x78], eax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x80], 0
mov dword [esp + 0x74], 0x10
mov dword [esp + 0x78], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
call fcn.004a0bd0
cmp dword [eax + 4], 0
je 0x49d21c
call fcn.004a0bd0
mov esi, dword [eax + 4]
call fcn.004a0bd0
cmp dword [eax + 4], esi
jne 0x49d21c
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
inc eax
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
mov eax, dword [esp + 0x20]
jne 0x49d22d
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebx
call fcn.004a0bd0
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
push ecx
push dword [eax + 4]
mov ecx, edi
call fcn.0049d970
call fcn.004a0bd0
mov esi, dword [eax + 4]
call fcn.004a0bd0
push dword [esp + 0x1c]
mov ecx, esi
push dword [esp + 0x18]
mov dword [eax + 4], 0
mov eax, dword [esi]
call dword [eax + 0x28]
mov byte [esi + 0x64], 1
mov byte [esi + 0x71], 0
push ebx
push dword [esp + 0x24]
mov ecx, edi
call fcn.0049fa80
jmp 0x49d4ba
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
call fcn.004a0bd0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
push ecx
push dword [eax + 4]
mov ecx, edi
call fcn.0049d970
call fcn.004a0bd0
push dword [esp + 0x14]
push dword [esp + 0x20]
mov ecx, dword [eax + 4]
call fcn.0049fa80
jmp 0x49d4ba
lea eax, [ecx - 0x201]
cmp eax, 0xa2
ja case.0x49d280.518
movzx eax, byte [eax + 0x49d6cc]
jmp dword [eax*4 + 0x49d69c]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
sub eax, ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x70]
push ecx
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x24]
mov eax, dword [esi + 0xc]
push ecx
sub eax, edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x78], eax
lea ecx, [esp + 0x24]
mov eax, dword [edi]
push ecx
lea ecx, [esp + 0x20]
push ecx
mov eax, dword [eax + 0xdc]
mov ecx, edi
push ebx
call eax
mov bl, al
test bl, bl
je 0x49d577
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x70]
add eax, edx
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [esi + 0xc], eax
mov dword [esp + 0x24], 1
jmp 0x49d4bc
mov eax, esi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
push ecx
mov ecx, edi
call fcn.0049da00
jmp 0x49d4ba
xor bl, bl
call fcn.004a0bd0
cmp dword [eax + 4], 0
je 0x49d392
call fcn.004a0bd0
mov esi, dword [eax + 4]
call fcn.004a0bd0
cmp dword [eax + 4], esi
jne 0x49d392
mov ecx, dword [esp + 0x28]
movsx eax, cx
mov dword [esp + 0x14], eax
mov eax, ecx
shr eax, 0x10
cwde
mov dword [esp + 0x70], eax
call fcn.004a0bd0
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x18]
push ecx
push dword [eax + 4]
mov ecx, edi
call fcn.0049d970
call fcn.004a0bd0
mov esi, dword [eax + 4]
call fcn.004a0bd0
push dword [esp + 0x70]
mov ecx, esi
push dword [esp + 0x18]
mov dword [eax + 4], 0
mov eax, dword [esi]
call dword [eax + 0x28]
mov byte [esi + 0x71], bl
mov bl, 1
mov byte [esi + 0x64], 1
cmp byte [edi + 0x10d], 0
je 0x49d4bc
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [edi + 0x10d], 0
jmp 0x49d4bc
mov eax, esi
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
call fcn.0049fd90
jmp 0x49d4ba
mov eax, esi
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
call fcn.0049fe80
jmp 0x49d4ba
push ecx
call fcn.0049da40
jmp 0x49d4ba
call fcn.004a0bd0
cmp dword [eax], 0
je 0x49d4c4
call fcn.004a0bd0
mov esi, eax
mov ecx, ebx
shr ecx, 0x10
mov eax, 0x88888889
movsx ecx, cx
imul ecx
add edx, ecx
mov ecx, dword [esi]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
movzx eax, bx
push eax
call fcn.004a0070
jmp 0x49d4ba
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
sub eax, ecx
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x20]
mov eax, dword [esi + 0xc]
push ecx
sub eax, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x1c]
mov eax, dword [edi]
push ecx
lea ecx, [esp + 0x7c]
push ecx
mov eax, dword [eax + 0xe4]
mov ecx, edi
call eax
push 0
push 0
mov ecx, edi
mov bl, al
call fcn.0049ee80
test bl, bl
je 0x49d577
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x20]
add eax, edx
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [esi + 0xc], eax
mov dword [esp + 0x24], 1
jmp 0x49d4bc
mov eax, esi
mov ecx, edi
shr eax, 0x10
cwde
push eax
movsx eax, si
push eax
call fcn.0049ff70
mov bl, al
test bl, bl
je 0x49d57d
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14
cmp esi, dword [edi + 0xfc]
je case.0x49d280.518
cmp byte [edi + 0x10d], 0
je 0x49d501
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [edi + 0x10d], 0
call fcn.004a0bd0
cmp dword [eax + 4], 0
je 0x49d585
call fcn.004a0bd0
mov esi, dword [eax + 4]
call fcn.004a0bd0
cmp dword [eax + 4], esi
jne 0x49d581
lea eax, [esp + 0x70]
xorps xmm0, xmm0
push eax
movq qword [esp + 0x74], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x70]
push eax
push dword [edi + 0xfc]
call dword [sym.imp.USER32.dll_ScreenToClient]
call fcn.004a0bd0
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esp + 0x74]
push ecx
push dword [eax + 4]
mov ecx, edi
call fcn.0049d970
call fcn.004a0bd0
push dword [esp + 0x74]
push dword [esp + 0x74]
mov ecx, dword [eax + 4]
call fcn.0049fd60
jmp 0x49d581
mov ebx, dword [esp + 0x2c]
jmp 0x49d585
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
cmp byte [edi + 0x10e], 0
je 0x49d5c1
mov eax, dword [edi + 0x110]
test eax, eax
je 0x49d5c1
push esi
push ebx
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14
push esi
push ebx
push ecx
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp + 0x884]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x14