Function at 0x4a4aa0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9338
push eax
mov dword fs:[0], esp
mov eax, dword [0x52fe30]
sub esp, 0x34
cmp byte [eax + 0x112a0], 0
push esi
mov esi, ecx
jne 0x4a4adf
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
push ebx
push edi
mov edi, dword [ebp + 0x20]
mov dword [edi], 0
mov ecx, dword [0x52fe2c]
cmp dword [ecx + 0x40a4], 0
jne 0x4a4cb9
mov eax, dword [0x52fe30]
cmp byte [eax + 0x112a0], 0
je 0x4a4cb9
cmp byte [eax + 0x1131d], 0
jne 0x4a4cb9
cmp dword [ecx + 0x40e4], 0x51f
jne 0x4a4cb9
cmp byte [esi + 0xb254], 0
jne 0x4a4b52
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push ecx
push edx
lea eax, [esi + 0xb244]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4a4cb9
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
cmp ebx, 0x201
ja 0x4a4bf6
je 0x4a4bb0
cmp ebx, 0x20
je 0x4a4b81
cmp ebx, 0x200
je 0x4a4c02
jmp 0x4a4cbc
push 0x7f82
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [edi], 1
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
lea ecx, [esi + 0xb258]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x52fe14]
lea edx, [esi + 0xb260]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov byte [esi + 0xb254], 1
mov ecx, dword [0x52fe14]
push ecx
call dword [sym.imp.USER32.dll_SetCapture]
mov ecx, dword [0x52fe2c]
push 1
call fcn.0041ff60
jmp 0x4a4cbc
cmp ebx, 0x202
jne 0x4a4cbc
cmp byte [esi + 0xb254], 0
je 0x4a4c93
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x4a4c93
mov eax, dword [esi + 0xb268]
sub eax, dword [esi + 0xb258]
mov edx, dword [esi + 0xb260]
mov ecx, dword [esi + 0xb26c]
sub ecx, dword [esi + 0xb25c]
mov edi, dword [esi + 0xb264]
sub eax, edx
add eax, dword [ebp - 0x14]
sub ecx, edi
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x40], edx
add edx, eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], edi
add edi, ecx
mov ecx, dword [0x52fe2c]
push eax
push 8
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edi
call fcn.0041a300
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
push 0x104
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x40]
sub edx, ecx
push edx
push eax
mov eax, dword [0x52fe14]
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, 0x202
jne 0x4a4cbc
push 0
call dword [sym.imp.USER32.dll_SetCapture]
mov ecx, dword [0x52fe2c]
push 0
call fcn.00416b10
mov byte [esi + 0xb254], 0
jmp 0x4a4cbc
mov ebx, dword [ebp + 0xc]
mov ecx, dword [0x52fe2c]
push 0
call fcn.0041aac0
test al, al
jne 0x4a50ae
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push ecx
push edx
lea eax, [esi + 0xb0a4]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4a50ae
lea eax, [ebx - 0x200]
cmp eax, 5
ja case.0x4a4f0f.5
movzx ecx, byte [eax + 0x4a5118]
jmp dword [ecx*4 + 0x4a5110]
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor edi, edi
lea ebx, [esi + 0x298]
cmp dword [ebx - 0x294], 0
je 0x4a4d41
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4a4dfe
inc edi
add ebx, 0x2a4
cmp edi, 0x22
jb 0x4a4d21
push 0x22
mov ecx, esi
call fcn.004a3800
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x112a0], 0
je 0x4a4d8e
cmp dword [0x52fe14], 0
je 0x4a4d8e
or byte [esi + 0xb28a], 1
xor eax, eax
lea edx, [ebp - 0x40]
push edx
mov ecx, esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call fcn.004a2a00
mov edi, dword [ebp + 0xc]
cmp edi, 0x201
je 0x4a4ee3
cmp edi, 0x203
je 0x4a4ee3
cmp edi, 0x205
jne case.0x4a4f0f.5
mov ecx, dword [0x52fe14]
push 2
lea eax, [ebp - 0x30]
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 0xb284]
sub eax, 1
je 0x4a4e70
sub eax, 0x1b
je 0x4a4e70
mov ecx, esi
call fcn.004a3880
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
test edi, edi
jne 0x4a4e26
mov eax, dword [esi + 0x2a0]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x50
jle 0x4a4e17
mov eax, 0x50
cmp dword [ebp + 0x18], eax
mov ecx, esi
jg 0x4a4e22
push 0
jmp 0x4a4e35
push 0x22
jmp 0x4a4e35
mov ecx, edi
imul ecx, ecx, 0x2a4
mov edx, dword [ecx + esi + 8]
push edx
mov ecx, esi
call fcn.004a3800
imul edi, edi, 0x2a4
mov eax, dword [edi + esi + 0x298]
mov ecx, dword [edi + esi + 0x29c]
mov edx, dword [edi + esi + 0x2a0]
lea edi, [edi + esi + 0x298]
mov dword [ebp - 0x30], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
jmp 0x4a4d56
lea ecx, [ebp - 0x20]
call fcn.004bc8c0
lea edx, [ebp - 0x20]
push 0
push edx
mov dword [ebp - 4], 0
call fcn.004b69a0
add esp, 8
test eax, eax
jl 0x4a4ebf
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.00425060
add esp, 8
push 0x20
push edx
push eax
lea ecx, [ebp - 0x20]
call fcn.004bc9d0
mov edx, dword [0x52fe2c]
mov ecx, dword [edx + 0x409c]
push eax
call fcn.0044b250
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.004bc960
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [0x52fe14]
push 2
lea eax, [ebp - 0x30]
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 0xb284]
dec eax
cmp eax, 0x1c
ja case.0x4a4f0f.5
movzx edx, byte [eax + 0x4a5140]
jmp dword [edx*4 + 0x4a5120]
cmp edi, 0x201
jne case.0x4a4f0f.5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.00425060
add esp, 8
push edx
push eax
mov ecx, esi
call fcn.004a2870
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
cmp edi, 0x201
jne case.0x4a4f0f.5
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
sete dl
movzx eax, dl
mov edx, dword [0x52fe2c]
push eax
push 0x20
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [edx + 0x409c]
call fcn.0044a820
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
cmp edi, 0x201
jne case.0x4a4f0f.5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
push eax
push ecx
call fcn.00425060
add esp, 8
push edx
push eax
mov ecx, esi
call fcn.004a44a0
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, dword [0x52fe2c]
cmp dword [eax + 0x40a4], 0
je case.0x4a4f0f.5
mov eax, dword [eax + 0x40a4]
cmp byte [eax + 9], 0
pop edi
sete dl
pop ebx
mov byte [eax + 9], dl
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x14
call esi
push 0
push 2
push 0
push 0x14
call esi
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x90
call esi
push 0
push 2
push 0
push 0x90
call esi
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x91
call esi
push 0
push 2
push 0
push 0x91
call esi
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 0x22
cmp dword [esi + 0xb284], eax
je 0x4a50f8
mov dword [esi + 0xb284], eax
mov eax, dword [0x52fe30]
cmp byte [eax + 0x112a0], 0
je 0x4a50f8
cmp dword [0x52fe14], 0
je 0x4a50f8
or byte [esi + 0xb28a], 1
xor eax, eax
lea ecx, [ebp - 0x40]
push ecx
mov ecx, esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call fcn.004a2a00
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c