Function at 0x505a50
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sub esp, 0x88
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x9c]
xor ebp, ebp
cmp edi, ebp
je case.default.0x505b57
cmp byte [edi], 0
je case.default.0x505b57
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x505a80
sub eax, edx
cmp eax, 0x5a
jae case.default.0x505b57
mov esi, dword [esp + 0xa0]
cmp esi, ebp
je case.default.0x505b57
push esi
call fcn.00582ac0
add esp, 4
test eax, eax
je case.default.0x505b57
mov eax, dword [esi + 0xbf4]
push eax
call fcn.00502a60
add esp, 4
test eax, eax
je case.default.0x505b57
cmp dword [esi + 0x71c], 1
jne case.default.0x505b57
lea eax, [esi + 0x6c4]
push eax
xor ebx, ebx
push ebx
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], eax
call fcn.0049ffe0
mov ecx, eax
add esp, 0xc
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x505b47
mov eax, dword [esi + 0x6b8]
test eax, eax
mov ebp, dword [ecx + 0x20]
mov ebx, dword [ecx + 0x1c]
mov dword [esp + 0x18], ebp
je 0x505b31
cmp eax, ecx
je 0x505b2d
mov edi, dword [esp + 0x10]
mov eax, dword [eax + 0x40]
inc edi
test eax, eax
mov dword [esp + 0x10], edi
jne 0x505b17
jmp 0x505b31
test eax, eax
jne 0x505b47
xor ebp, ebp
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0xa4]
cmp eax, 3
ja case.default.0x505b57
jmp dword [eax*4 + 0x506360]
test ebx, ebx
je 0x505d72
test ecx, ecx
je 0x505d72
mov ecx, dword [esi + 0xbf4]
mov eax, dword [ecx + 0x21b8]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x505c00
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x88c]
push 0
push edx
push 0x187
push eax
call edi
cmp eax, 0xffffffff
je 0x505bb3
test eax, eax
jle 0x505bb3
mov eax, dword [esi + 0xbf4]
mov ecx, dword [eax + 0x21b8]
or ecx, 4
jmp 0x505bc2
mov eax, dword [esi + 0xbf4]
mov ecx, dword [eax + 0x21b8]
or ecx, 8
mov dword [eax + 0x21b8], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x88c]
push 0
push ecx
push 0x199
push edx
call edi
cmp eax, 0xffffffff
mov dword [0x609ce8], eax
je 0x505bf0
test eax, eax
jl 0x505bf0
cmp eax, 0xf
jle 0x505bfa
mov dword [0x609ce8], 0x63
mov dword [0x609ce4], ebp
mov eax, dword [0x64532c]
test eax, eax
mov dword [esp + 0x28], 0xffffffff
je 0x505c78
mov eax, dword [esi]
cmp eax, dword [0x645330]
jne 0x505c78
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [esi + 0x88c], eax
jne 0x505c78
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call ebp
test ah, ah
js 0x505c3f
push 2
call ebp
test ah, ah
jns 0x505c78
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x88c]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx ecx, word [esp + 0x2c]
mov edx, dword [esi + 0x88c]
shl ecx, 0x10
or ecx, 1
push ecx
push 0
push 0x202
push edx
call edi
mov eax, dword [esi + 0x88c]
push 0
push 0
push 0x18e
push eax
call edi
mov ecx, dword [esi + 0x88c]
push 0
push 0
push 0x19f
push ecx
mov ebp, eax
call edi
mov edx, dword [esi + 0x88c]
push 0
push 0
push 0xb
push edx
mov dword [esp + 0x24], eax
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x88c]
push 0
push eax
push 0x182
push ecx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
jg 0x505cd3
dec ebp
jns 0x505cd3
xor ebp, ebp
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jg 0x505cec
mov eax, ecx
dec eax
mov dword [esp + 0x14], eax
jns 0x505cec
mov dword [esp + 0x14], 0
lea edx, [esp + 0x14]
push edx
push ebp
push esi
call fcn.00424320
mov eax, dword [esi + 0x88c]
add esp, 0xc
push 0
push ebp
push 0x197
push eax
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x505d26
mov ecx, dword [esi + 0x88c]
push 0
push eax
push 0x19e
push ecx
call edi
mov edx, dword [esi + 0x88c]
push 0
push 1
push 0xb
push edx
call edi
mov eax, dword [esi + 0x88c]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x6b8]
push ecx
push edx
call fcn.004e3140
mov ecx, dword [esp + 0xa4]
mov dword [esi + 0x6b8], eax
mov eax, dword [esp + 0x28]
push eax
push ecx
call fcn.004a0080
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x506343
test ebx, ebx
je 0x505dc0
test eax, eax
jle 0x505da9
test eax, ebx
jne 0x506343
add eax, ebx
mov dword [esp + 0xa8], eax
jmp 0x505dc8
neg eax
test eax, ebx
je 0x506343
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0xa8], ecx
jmp 0x505dc8
test eax, eax
jl case.default.0x505b57
mov eax, dword [0x64532c]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x28], 0xffffffff
je 0x505e46
mov edx, dword [esi]
cmp edx, dword [0x645330]
jne 0x505e46
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [esi + 0x88c], eax
jne 0x505e46
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ah, ah
js 0x505e0d
push 2
call edi
test ah, ah
jns 0x505e46
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x88c]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx eax, word [esp + 0x2c]
mov ecx, dword [esi + 0x88c]
shl eax, 0x10
or eax, 1
push eax
push 0
push 0x202
push ecx
call ebp
mov edx, dword [esi + 0x88c]
push 0
push 0
push 0x18e
push edx
call ebp
push 0
push 0
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x88c]
push 0x19f
push eax
call ebp
mov ecx, dword [esi + 0x88c]
push 0
push 0
push 0xb
push ecx
mov dword [esp + 0x24], eax
call ebp
test ebx, ebx
je 0x505f6d
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x505f6d
mov eax, dword [esi + 0xbf4]
mov ecx, dword [eax + 0x21b8]
test ecx, ecx
mov edx, dword [edi + 0x10]
mov dword [esp + 0x24], edx
je 0x505f30
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x88c]
push 0
push ecx
push 0x187
push edx
call ebp
cmp eax, 0xffffffff
je 0x505edf
test eax, eax
jle 0x505edf
mov eax, dword [esi + 0xbf4]
mov ecx, dword [eax + 0x21b8]
or ecx, 4
jmp 0x505eee
mov eax, dword [esi + 0xbf4]
mov ecx, dword [eax + 0x21b8]
or ecx, 8
mov dword [eax + 0x21b8], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x88c]
push 0
push eax
push 0x199
push ecx
call ebp
cmp eax, 0xffffffff
mov dword [0x609ce8], eax
je 0x505f1c
test eax, eax
jl 0x505f1c
cmp eax, 0xf
jle 0x505f26
mov dword [0x609ce8], 0x63
mov edx, dword [esp + 0x18]
mov dword [0x609ce4], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x88c]
push 0
push eax
push 0x182
push ecx
call ebp
mov edx, dword [esi + 0x6b8]
push edi
push edx
call fcn.004e3140
mov ecx, dword [esp + 0xa4]
mov dword [esi + 0x6b8], eax
mov eax, dword [esp + 0x28]
push eax
push ecx
call fcn.004a0080
add esp, 0x10
mov ecx, dword [esi + 0xbf4]
mov dl, byte [ecx + 0x1cf0]
xor ebp, ebp
xor eax, eax
test dl, dl
mov dword [esp + 0x1c], ebp
mov ebx, 1
je 0x505fc4
lea edx, [ecx + 0x1d54]
mov edi, dword [esp + 0xa8]
test dword [edx], edi
jne 0x505fb1
mov edi, dword [esi + 0xbf4]
inc eax
add edx, 4
cmp byte [edi + eax + 0x1cf0], 0
jne 0x505f90
jmp 0x505fc4
movzx ebp, byte [ecx + eax + 0x1cf0]
mov ebx, dword [ecx + eax*4 + 0x1d54]
mov dword [esp + 0x1c], ebp
mov edi, dword [esi + 0x6b8]
test edi, edi
mov dword [esp + 0x10], 0
je 0x506011
lea ebp, [ebx + ebx]
lea esp, [esp]
mov eax, dword [edi + 0x1c]
cmp eax, ebp
jge 0x506002
test ebx, eax
je 0x50600d
mov edx, dword [edi]
mov eax, dword [esp + 0x9c]
push edx
push eax
call fcn.005e31f5
add esp, 8
test eax, eax
jl 0x50600d
inc dword [esp + 0x10]
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x505fe0
mov ebp, dword [esp + 0x1c]
test ebp, ebp
lea edx, [esp + 0x34]
je 0x506033
mov ecx, dword [esp + 0x9c]
push ecx
push ebp
push str._c_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x50604a
mov eax, dword [esp + 0x9c]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x506040
mov eax, dword [esi + 0x6bc]
test eax, eax
je 0x5060c6
mov eax, dword [esp + 0x9c]
movzx ecx, byte [eax]
push ecx
call fcn.005cd370
mov ebp, dword [esi + 0x6bc]
add esp, 4
test ebp, ebp
mov ebx, eax
je 0x5060c6
cmp dword [ebp + 0xc], ebx
jne 0x506090
mov edx, dword [esp + 0x9c]
mov eax, dword [ebp]
push edx
push eax
call fcn.005e31f5
add esp, 8
test eax, eax
je 0x506099
mov ebp, dword [ebp + 0x40]
test ebp, ebp
jne 0x506073
jmp 0x5060c6
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x10]
mov dword [0x609ce8], ecx
mov ecx, dword [esi + 0x6bc]
push ebp
push ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], eax
call fcn.004e3140
add esp, 8
mov dword [esi + 0x6bc], eax
mov edx, dword [esi + 0xbf4]
mov eax, dword [edx + 0x21b8]
test eax, eax
mov ebx, dword [esp + 0x9c]
je 0x5060eb
mov eax, dword [0x609ce4]
cmp eax, 0xffffffff
je 0x5060eb
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xa8]
or ebp, 0xffffffff
test edi, edi
push eax
mov dword [0x609ce4], ebp
push ebx
je 0x506158
push 0
call fcn.004e2f90
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x5061a2
movzx ecx, byte [ebx]
push ecx
call fcn.005cd370
mov edx, dword [esp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [esi + 0x6b8]
push edi
push ecx
call fcn.004e31c0
mov edx, dword [esp + 0x30]
push edx
push 0xffffffffffffffff
push ebp
push ebx
mov dword [esi + 0x6b8], eax
call fcn.0049fe80
add esp, 0x20
mov edi, ebp
jmp 0x5061a2
mov ecx, dword [esi + 0x6b8]
push ecx
call fcn.004e2f90
add esp, 0xc
test eax, eax
je 0x50619e
mov dword [esi + 0x6b8], eax
movzx edx, byte [ebx]
mov edi, dword [eax + 0x44]
push edx
call fcn.005cd370
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push edx
push ebp
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x24]
push edi
push ebx
mov dword [edi + 0x20], eax
mov dword [edi + 0x10], ecx
call fcn.0049fe80
add esp, 0x14
mov dword [esp + 0x10], ebp
test edi, edi
je 0x5062db
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x88c]
lea eax, [esp + 0x34]
push eax
push ecx
push 0x181
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x5062db
cmp ebp, 0xfffffffe
je 0x5062db
mov eax, dword [esi + 0xbf4]
mov ecx, dword [eax + 0x21b8]
test ecx, ecx
je 0x50622e
test cl, 4
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x506206
mov eax, dword [esi + 0x88c]
push ebp
push 1
push 0x185
push eax
call edi
mov ecx, dword [0x609ce8]
mov edx, dword [esi + 0x88c]
push ecx
push ebp
push 0x19a
push edx
call edi
mov eax, dword [esi + 0xbf4]
mov dword [eax + 0x21b8], 0
jmp 0x50628b
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x50623d
mov eax, dword [0x609ce8]
jmp 0x50626d
mov edx, dword [edi + 0x10]
push eax
mov eax, dword [esp + 0xac]
push 2
push 0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi]
push edx
push eax
push ebx
push ecx
call fcn.00439cc0
mov eax, dword [esp + 0x30]
add esp, 0x20
cmp eax, 0xffffffff
jne 0x506271
mov eax, 0x63
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x88c]
push eax
push ebp
push 0x19a
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esp + 0x30]
cmp ebp, ebx
jg 0x506294
inc ebx
mov eax, dword [esp + 0x14]
cmp ebp, eax
jg 0x5062a1
inc eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push ebx
push esi
call fcn.00424320
mov ecx, dword [esi + 0x88c]
add esp, 0xc
push 0
push ebx
push 0x197
push ecx
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x5062db
mov edx, dword [esi + 0x88c]
push 0
push eax
push 0x19e
push edx
call edi
mov eax, dword [esi + 0x88c]
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0x88c]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
mov ecx, dword [esp + 0xa8]
test ecx, ecx
mov eax, ebx
je 0x506352
and eax, ecx
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x88
ret
test ebx, ebx
je 0x506343
test ecx, ecx
je 0x506343
mov edx, dword [esp + 0xa8]
mov dword [ecx + 0x18], edx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x88
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret