Function at 0x481b30
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528440
push 0x51d25e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [ebx + 4], esi
mov eax, dword [ebp + 0x10]
cmp eax, 0x202
ja 0x481da1
je case.0x481daf.520
cmp eax, 0x104
ja 0x481bbf
je 0x481ba8
cmp eax, 0x20
je 0x481b8c
cmp eax, 0x100
je 0x481ba8
jmp case.0x481daf.518
xor eax, eax
cmp dword [ebx + 0x14], 0xffffffff
setne al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx + 0x44]
test eax, eax
je case.0x481daf.518
mov ecx, ebx
call fcn.004826d0
jmp case.0x481daf.518
sub eax, 0x200
je 0x481c4a
dec eax
jne case.0x481daf.518
mov eax, dword [ebx + 0x44]
test eax, eax
je case.0x481daf.518
push 1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
shr eax, 8
test al, al
je case.0x481daf.518
push 2
call esi
shr eax, 8
test al, al
je case.0x481daf.518
lea edx, [ebx + 0x2d]
mov edi, 0x5615e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push edx
mov ecx, ebx
call fcn.004822b0
mov eax, 1
mov dword [ebx + 0x54], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor esi, esi
cmp dword [ebx + 0x60], esi
je 0x481c9f
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x481c9f
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebx + 0x58]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jge 0x481c94
mov eax, dword [ebp - 0x30]
sub eax, dword [ebx + 0x5c]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jl case.0x481daf.518
mov edx, dword [ebp + 0xc]
push edx
mov ecx, ebx
call fcn.004831b0
mov dword [ebx + 0x60], esi
cmp dword [ebx + 0x54], esi
je 0x481cb8
push esi
lea eax, [ebx + 0x2d]
push eax
mov ecx, ebx
call fcn.004822b0
jmp case.0x481daf.518
cmp dword [ebx + 0x44], esi
je case.0x481daf.518
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
jne 0x481ce1
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x60], esi
mov dword [0x5be9d0], esi
jmp case.0x481daf.518
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.00482200
test eax, eax
je 0x481d6d
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, ebx
call fcn.004821b0
cmp dword [ebx + 0x40], esi
jne 0x481d44
lea edi, [ebx + 0x2d]
mov byte [edi], 0
mov edx, dword [ebx + 0x38]
cmp dword [ebx + 0x3c], edx
je 0x481d34
mov al, byte [ebx + edx + 0x28]
mov byte [edi + esi], al
inc esi
mov byte [edi + esi], 0
lea eax, [edx + 1]
cdq
idiv dword [ebx + 0x34]
cmp dword [ebx + 0x3c], edx
jne 0x481d1c
test esi, esi
jle 0x481d42
push 0
push edi
mov ecx, ebx
call fcn.004822b0
xor esi, esi
mov ecx, dword [ebp - 0x20]
mov dword [ebx + 0x20], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebx + 0x24], edx
cmp dword [ebx + 0x40], esi
je 0x481d6d
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test byte [0x59e79c], 2
je 0x481d89
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, ebx
call fcn.00481a10
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
add eax, 0xfffffdfc
cmp eax, 6
ja case.0x481daf.518
jmp dword [eax*4 + 0x482194]
mov eax, dword [ebx + 0x44]
test eax, eax
je case.0x481daf.518
push 2
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
movsx eax, ax
shr eax, 0x10
je case.0x481daf.518
push 4
call esi
movsx ecx, ax
shr ecx, 0x10
jne case.0x481daf.518
mov dword [ebx + 0x48], 1
mov eax, dword [ebp + 0x14]
shr eax, 0x10
test ax, ax
lea edx, [ebx + 0x2d]
mov edi, 0x5615e4
jg 0x481e06
mov edi, 0x5615e0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea esi, [ebx + 0x2d]
push esi
mov ecx, ebx
call fcn.004822b0
test eax, eax
je 0x481e3a
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 1
push esi
mov ecx, ebx
call fcn.004822b0
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor esi, esi
cmp dword [ebx + 0x50], esi
je 0x481ea3
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x44], esi
mov dword [0x5be9d0], esi
mov dword [ebx + 0x60], esi
mov dword [ebx + 0x54], esi
call dword [sym.imp.USER32.dll_ReleaseCapture]
test byte [0x59e79c], 2
je 0x481e8b
mov ecx, ebx
call fcn.00482a50
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebx + 0x44], esi
je 0x481fe3
mov dword [ebp - 4], esi
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x60], esi
mov dword [0x5be9d0], esi
mov dword [ebx + 0x14], 0xffffffff
mov ecx, ebx
call fcn.00482780
call dword [sym.imp.USER32.dll_ReleaseCapture]
test byte [0x59e79c], 2
mov edi, dword [ebp + 0x18]
je 0x481efd
movsx eax, di
mov dword [ebp - 0x50], eax
mov ecx, edi
shr ecx, 0x10
movsx ecx, cx
mov dword [ebp - 0x4c], ecx
cmp dword [ebx + 0x58], eax
jne 0x481ef6
cmp dword [ebx + 0x5c], ecx
je 0x481efd
mov ecx, ebx
call fcn.00482a50
cmp dword [ebx + 0x48], esi
je 0x481f24
mov dword [ebx + 0x48], esi
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebx + 0x40], esi
je 0x481f73
mov dword [ebx + 0x40], esi
cmp dword [ebx + 0x4c], esi
je 0x481f53
mov dword [ebx + 0x4c], esi
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push edi
mov edx, dword [ebp + 0x14]
push edx
push 0x204
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
jmp case.0x481daf.518
xor ecx, ecx
mov dword [ebp - 0x48], ecx
lea esi, [ebx + 0x2d]
mov byte [esi], cl
mov edi, dword [ebx + 0x38]
cmp dword [ebx + 0x3c], edi
je 0x481fa1
mov dl, byte [edi + ebx + 0x28]
mov byte [esi + ecx], dl
inc ecx
mov dword [ebp - 0x48], ecx
mov byte [esi + ecx], 0
mov eax, dword [ebx + 0x38]
inc eax
cdq
idiv dword [ebx + 0x34]
mov dword [ebx + 0x38], edx
jmp 0x481f7d
test ecx, ecx
jle 0x481fd7
push 1
push esi
mov ecx, ebx
call fcn.004822b0
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebp - 4], 0xffffffff
jmp case.0x481daf.518
mov ecx, ebx
call fcn.00483140
test eax, eax
je case.0x481daf.518
cmp dword [0x57a904], 2
jne case.0x481daf.518
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0x204
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x481daf.518
mov eax, dword [ebx + 0x44]
test eax, eax
je case.0x481daf.518
push 4
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
shr eax, 8
test al, al
je case.0x481daf.518
push 2
call esi
shr eax, 8
test al, al
je case.0x481daf.518
lea edx, [ebx + 0x2d]
mov edi, 0x5615dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x54], 1
push 0
push edx
mov ecx, ebx
call fcn.004822b0
test eax, eax
je case.0x481daf.518
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx + 0x54]
test eax, eax
je case.0x481daf.518
lea eax, [ebx + 0x2d]
push 1
push eax
mov ecx, ebx
call fcn.004822b0
mov dword [ebx + 0x54], 0
mov ecx, ebx
call fcn.00482780
mov edi, 0x5713b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
lea edi, [ebx + 0x2d]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
mov dword [ebx + 0x50], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx + 0x44]
test eax, eax
jne case.0x481daf.518
test esi, esi
je case.0x481daf.518
mov edi, dword [ebp + 0xc]
push edi
mov eax, dword [esi + 4]
push eax
call fcn.0050b3b0
add esp, 8
test eax, eax
jne 0x482137
mov ecx, esi
call fcn.0046a7e0
cmp eax, edi
je 0x482137
mov dword [ebx + 0x10], 0
jmp case.0x481daf.518
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x60], 1
lea esi, [ebx + 0x58]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi]
mov dword [ebx + 0x20], ecx
mov edx, dword [esi + 4]
mov dword [ebx + 0x24], edx
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov ecx, ebx
call fcn.00483140
test eax, eax
je 0x482175
mov dword [0x57a904], 1
jmp case.0x481daf.518
push edi
mov ecx, ebx
call fcn.004831b0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14