Function at 0x4f3700
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
cmp edi, ebp
mov esi, edx
mov dword [esp + 0x18], edi
je case.default.0x4f3800
cmp byte [edi], 0
je case.default.0x4f3800
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f3730
sub eax, edx
cmp eax, 0x5a
jae case.default.0x4f3800
cmp esi, ebp
je case.default.0x4f3800
mov ecx, esi
call fcn.005612a0
test eax, eax
je case.default.0x4f3800
mov ecx, dword [esi + 0xbe8]
call fcn.004f0af0
test eax, eax
je case.default.0x4f3800
cmp dword [esi + 0x71c], 1
jne case.default.0x4f3800
lea eax, [esi + 0x6c4]
xor ebx, ebx
push eax
xor edx, edx
mov ecx, edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
call fcn.00495040
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x4f37f0
mov eax, dword [esi + 0x6b8]
test eax, eax
mov ebp, dword [ecx + 0x20]
mov ebx, dword [ecx + 0x1c]
mov dword [esp + 0x1c], ebp
je 0x4f37da
lea esp, [esp]
cmp eax, ecx
je 0x4f37d6
mov edi, dword [esp + 0x10]
mov eax, dword [eax + 0x40]
inc edi
test eax, eax
mov dword [esp + 0x10], edi
jne 0x4f37c0
jmp 0x4f37da
test eax, eax
jne 0x4f37f0
xor ebp, ebp
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0xa0]
cmp eax, 3
ja case.default.0x4f3800
jmp dword [eax*4 + 0x4f3fe4]
test ebx, ebx
je 0x4f3a0c
test ecx, ecx
je 0x4f3a0c
mov eax, dword [esi + 0xbe8]
mov ecx, dword [eax + 0x21b8]
test ecx, ecx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x4f38a9
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x88c]
push 0
push ecx
push 0x187
push edx
call edi
cmp eax, 0xffffffff
je 0x4f385c
test eax, eax
jle 0x4f385c
mov eax, dword [esi + 0xbe8]
mov ecx, dword [eax + 0x21b8]
or ecx, 4
jmp 0x4f386b
mov eax, dword [esi + 0xbe8]
mov ecx, dword [eax + 0x21b8]
or ecx, 8
mov dword [eax + 0x21b8], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x88c]
push 0
push eax
push 0x199
push ecx
call edi
cmp eax, 0xffffffff
mov dword [0x5bfc88], eax
je 0x4f3899
test eax, eax
jl 0x4f3899
cmp eax, 0xf
jle 0x4f38a3
mov dword [0x5bfc88], 0x63
mov dword [0x5bfc84], ebp
mov eax, dword [0x5f92f4]
test eax, eax
mov dword [esp + 0x2c], 0xffffffff
je 0x4f391d
mov edx, dword [esi]
cmp edx, dword [0x5f92f8]
jne 0x4f391d
mov eax, dword [esi + 0x74c]
test eax, eax
je 0x4f391d
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call ebp
test ah, ah
js 0x4f38e4
push 2
call ebp
test ah, ah
jns 0x4f391d
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x88c]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx eax, word [esp + 0x30]
mov ecx, dword [esi + 0x88c]
shl eax, 0x10
or eax, 1
push eax
push 0
push 0x202
push ecx
call edi
mov edx, dword [esi + 0x88c]
push 0
push 0
push 0x18e
push edx
call edi
push 0
push 0
mov ebp, eax
mov eax, dword [esi + 0x88c]
push 0x19f
push eax
call edi
mov ecx, dword [esi + 0x88c]
push 0
push 0
push 0xb
push ecx
mov dword [esp + 0x24], eax
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x88c]
push 0
push edx
push 0x182
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
jg 0x4f3978
dec ebp
jns 0x4f3978
xor ebp, ebp
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jg 0x4f3991
mov eax, ecx
dec eax
mov dword [esp + 0x14], eax
jns 0x4f3991
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
push ecx
mov edx, ebp
mov ecx, esi
call fcn.00421590
mov edx, dword [esi + 0x88c]
push 0
push ebp
push 0x197
push edx
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4f39ca
push 0
push eax
mov eax, dword [esi + 0x88c]
push 0x19e
push eax
call edi
mov ecx, dword [esi + 0x88c]
push 0
push 1
push 0xb
push ecx
call edi
mov edx, dword [esi + 0x88c]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esp + 0x20]
mov ecx, dword [esi + 0x6b8]
call fcn.004d3ac0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x6b8], eax
call fcn.004950e0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x8c
ret 8
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x4f3fc6
test ebx, ebx
je 0x4f3a5c
test eax, eax
jle 0x4f3a45
test eax, ebx
jne 0x4f3fc6
add eax, ebx
mov dword [esp + 0xa4], eax
jmp 0x4f3a64
neg eax
test eax, ebx
je 0x4f3fc6
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0xa4], ecx
jmp 0x4f3a64
test eax, eax
jl case.default.0x4f3800
mov eax, dword [0x5f92f4]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x2c], 0xffffffff
je 0x4f3ade
mov eax, dword [esi]
cmp eax, dword [0x5f92f8]
jne 0x4f3ade
mov eax, dword [esi + 0x74c]
test eax, eax
je 0x4f3ade
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ah, ah
js 0x4f3aa5
push 2
call edi
test ah, ah
jns 0x4f3ade
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x88c]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx ecx, word [esp + 0x30]
mov edx, dword [esi + 0x88c]
shl ecx, 0x10
or ecx, 1
push ecx
push 0
push 0x202
push edx
call ebp
mov eax, dword [esi + 0x88c]
push 0
push 0
push 0x18e
push eax
call ebp
mov ecx, dword [esi + 0x88c]
push 0
push 0
push 0x19f
push ecx
mov dword [esp + 0x44], eax
call ebp
mov edx, dword [esi + 0x88c]
push 0
push 0
push 0xb
push edx
mov dword [esp + 0x24], eax
call ebp
test ebx, ebx
je 0x4f3bf8
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4f3bf8
mov eax, dword [edi + 0x10]
mov ecx, dword [esi + 0xbe8]
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 0x21b8]
test eax, eax
je 0x4f3bc3
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x88c]
push 0
push edx
push 0x187
push eax
call ebp
cmp eax, 0xffffffff
je 0x4f3b73
test eax, eax
jle 0x4f3b73
mov eax, dword [esi + 0xbe8]
mov ecx, dword [eax + 0x21b8]
or ecx, 4
jmp 0x4f3b82
mov eax, dword [esi + 0xbe8]
mov ecx, dword [eax + 0x21b8]
or ecx, 8
mov dword [eax + 0x21b8], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x88c]
push 0
push ecx
push 0x199
push edx
call ebp
cmp eax, 0xffffffff
mov dword [0x5bfc88], eax
je 0x4f3bb0
test eax, eax
jl 0x4f3bb0
cmp eax, 0xf
jle 0x4f3bba
mov dword [0x5bfc88], 0x63
mov eax, dword [esp + 0x1c]
mov dword [0x5bfc84], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x88c]
push 0
push ecx
push 0x182
push edx
call ebp
mov ecx, dword [esi + 0x6b8]
mov edx, edi
call fcn.004d3ac0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x6b8], eax
call fcn.004950e0
mov ecx, dword [esi + 0xbe8]
mov dl, byte [ecx + 0x1cf8]
xor ebp, ebp
xor eax, eax
test dl, dl
mov dword [esp + 0x20], ebp
mov ebx, 1
je 0x4f3c54
lea edx, [ecx + 0x1d5c]
jmp 0x4f3c20
mov edi, dword [edx]
test dword [esp + 0xa4], edi
jne 0x4f3c41
mov edi, dword [esi + 0xbe8]
inc eax
add edx, 4
cmp byte [edi + eax + 0x1cf8], 0
jne 0x4f3c20
jmp 0x4f3c54
movzx ebp, byte [ecx + eax + 0x1cf8]
mov ebx, dword [ecx + eax*4 + 0x1d5c]
mov dword [esp + 0x20], ebp
mov edi, dword [esi + 0x6b8]
test edi, edi
mov dword [esp + 0x10], 0
je 0x4f3c9e
lea ebp, [ebx + ebx]
lea esp, [esp]
mov eax, dword [edi + 0x1c]
cmp eax, ebp
jge 0x4f3c8f
test ebx, eax
je 0x4f3c9a
mov eax, dword [edi]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.005a299c
add esp, 8
test eax, eax
jl 0x4f3c9a
inc dword [esp + 0x10]
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x4f3c70
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4f3cbd
mov edx, dword [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x40]
push str._c_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4f3cd1
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x38]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4f3cc7
mov eax, dword [esi + 0x6bc]
test eax, eax
je 0x4f3d44
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx]
push edx
call fcn.00591fd2
mov ebp, dword [esi + 0x6bc]
add esp, 4
test ebp, ebp
mov ebx, eax
je 0x4f3d44
cmp dword [ebp + 0xc], ebx
jne 0x4f3d11
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
push eax
push ecx
call fcn.005a299c
add esp, 8
test eax, eax
je 0x4f3d1a
mov ebp, dword [ebp + 0x40]
test ebp, ebp
jne 0x4f3cf7
jmp 0x4f3d44
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x20]
mov dword [0x5bfc88], edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x6bc]
mov edx, ebp
mov dword [esp + 0x1c], eax
call fcn.004d3ac0
mov dword [esi + 0x6bc], eax
mov edx, dword [esi + 0xbe8]
mov eax, dword [edx + 0x21b8]
test eax, eax
mov ebx, dword [esp + 0x18]
je 0x4f3d66
mov eax, dword [0x5bfc84]
cmp eax, 0xffffffff
je 0x4f3d66
mov dword [esp + 0x1c], eax
or ebp, 0xffffffff
test edi, edi
mov dword [0x5bfc84], ebp
je 0x4f3dd3
mov eax, dword [esp + 0xa4]
push eax
mov edx, ebx
xor ecx, ecx
call fcn.004d38f0
mov ebp, eax
test ebp, ebp
je 0x4f3e25
movzx ecx, byte [ebx]
push ecx
call fcn.00591fd2
mov edx, dword [esp + 0x20]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
add esp, 4
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [esi + 0x6b8]
push ebp
mov edx, edi
call fcn.004d3b40
mov ecx, dword [esp + 0x28]
push ecx
push 0xffffffffffffffff
mov edx, ebp
mov ecx, ebx
mov dword [esi + 0x6b8], eax
call fcn.00494ee0
mov edi, ebp
jmp 0x4f3e25
mov edx, dword [esp + 0xa4]
mov ecx, dword [esi + 0x6b8]
push edx
mov edx, ebx
call fcn.004d38f0
test eax, eax
je 0x4f3e21
mov dword [esi + 0x6b8], eax
mov edi, dword [eax + 0x44]
movzx eax, byte [ebx]
push eax
call fcn.00591fd2
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
add esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x28]
push eax
mov dword [edi + 0x20], ecx
mov dword [edi + 0x10], edx
push ebp
mov edx, edi
mov ecx, ebx
call fcn.00494ee0
mov dword [esp + 0x10], ebp
test edi, edi
je 0x4f3f5a
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x88c]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x181
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4f3f5a
cmp ebp, 0xfffffffe
je 0x4f3f5a
mov eax, dword [esi + 0xbe8]
mov ecx, dword [eax + 0x21b8]
test ecx, ecx
je 0x4f3eb1
test cl, 4
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x4f3e89
mov ecx, dword [esi + 0x88c]
push ebp
push 1
push 0x185
push ecx
call edi
mov edx, dword [0x5bfc88]
mov eax, dword [esi + 0x88c]
push edx
push ebp
push 0x19a
push eax
call edi
mov ecx, dword [esi + 0xbe8]
mov dword [ecx + 0x21b8], 0
jmp 0x4f3f0b
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4f3ec0
mov eax, dword [0x5bfc88]
jmp 0x4f3eed
mov ecx, dword [esp + 0xa4]
push eax
mov eax, dword [edi + 0x10]
push 2
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ecx
mov ecx, dword [esi]
mov edx, ebx
call fcn.00433c20
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x4f3ef1
mov eax, 0x63
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x88c]
push eax
push ebp
push 0x19a
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esp + 0x34]
cmp ebp, ebx
jg 0x4f3f14
inc ebx
mov eax, dword [esp + 0x14]
cmp ebp, eax
jg 0x4f3f21
inc eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov edx, ebx
mov ecx, esi
call fcn.00421590
mov ecx, dword [esi + 0x88c]
push 0
push ebx
push 0x197
push ecx
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4f3f5a
mov edx, dword [esi + 0x88c]
push 0
push eax
push 0x19e
push edx
call edi
mov eax, dword [esi + 0x88c]
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0x88c]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
mov ecx, dword [esp + 0xa4]
test ecx, ecx
mov eax, ebx
je 0x4f3fd7
and eax, ecx
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x8c
ret 8
test ebx, ebx
je 0x4f3fc6
test ecx, ecx
je 0x4f3fc6
mov edx, dword [esp + 0xa4]
mov dword [ecx + 0x18], edx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x8c
ret 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8