Function at 0x1402022b0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x50
xor r15d, r15d
mov r13d, edx
mov rbx, rcx
mov r12d, r15d
test r8d, r8d
je 0x1402027d2
test rcx, rcx
je 0x1402027d2
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x1402027d2
movsxd rcx, dword [rcx + 0x44]
mov eax, dword [r8]
test ecx, ecx
js 0x140202307
dec eax
cmp ecx, eax
jg 0x140202307
mov rax, qword [r8 + 0x10]
mov rbp, qword [rax + rcx*8]
jmp 0x14020230a
mov rbp, r15
test rbp, rbp
je 0x1402027d2
test byte [rbp + 0x14], 4
jne 0x1402027d2
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r14
mov esi, dword [rax]
lea eax, [r13 - 9]
mov r14, qword [rbx + 0x50]
cmp eax, 0x38
ja case.0x14020235b.10
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x20280c]
mov ecx, dword [rdx + rax*4 + 0x2027e4]
add rcx, rdx
jmp rcx
mov rdx, rbp
mov rcx, rbx
call fcn.140201d80
mov rcx, qword [rbx + 0x50]
lea rdx, [rbx + 0x1c]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov r12d, 1
mov eax, r12d
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
mov ecx, dword [rbx + 0x4c]
test ecx, ecx
je 0x140202368
lea r8d, [rcx - 1]
add r8d, dword [rbx + 0x48]
cmp r8d, esi
jae 0x140202368
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], r15d
mov rdx, rbp
mov rcx, rbx
call fcn.1401ffa50
add dword [rsp + 0x30], 0xa
mov rdx, rbp
dec dword [rsp + 0x34]
mov rcx, rbx
mov r8, qword [rsp + 0x30]
call fcn.140201820
dec eax
cmp eax, 0xfffffffd
ja 0x140202368
mov rcx, qword [rbx + 0x50]
lea rdx, [rbx + 0x1c]
inc dword [rbx + 0x4c]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x140202368
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.0x14020235b.10
mov eax, dword [rbx + 0x4c]
lea rdx, [rbx + 0x1c]
test eax, eax
mov r12d, 1
cmove r15d, esi
neg eax
sbb eax, eax
xor r8d, r8d
mov dword [rbx + 0x48], eax
mov dword [rbx + 0x4c], r15d
mov rcx, qword [rbx + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x14020235b.10
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.0x14020235b.10
mov r12d, 1
cmp dword [rbx + 0x4c], r15d
je case.0x14020235b.10
mov rcx, qword [rbx + 0x50]
lea rdx, [rbx + 0x1c]
sub esi, dword [rbx + 0x48]
xor r8d, r8d
mov dword [rbx + 0x4c], esi
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x14020235b.10
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.0x14020235b.10
mov ecx, dword [rbx + 0x4c]
mov r12d, 1
test ecx, ecx
je case.0x14020235b.10
add ecx, dword [rbx + 0x48]
lea rdx, [rbx + 0x1c]
mov dword [rbx + 0x4c], ecx
xor r8d, r8d
mov rcx, qword [rbx + 0x50]
mov dword [rbx + 0x48], r15d
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x14020235b.10
mov edi, 1
mov r12d, edi
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140202533
movsd xmm1, qword [0x1404538b8]
cmp r13d, 0x26
jne 0x140202508
movaps xmm0, xmm1
jmp 0x140202510
movsd xmm0, qword [0x140453a08]
cmp dword [rbx + 0x4c], r15d
je case.0x14020235b.10
cvtpd2ps xmm0, xmm0
mov dword [rsp + 0x28], edi
xor r8d, r8d
movsd qword [rsp + 0x20], xmm1
cvtps2pd xmm3, xmm0
jmp 0x140202634
cmp dword [r14 + 0x10], 0xffffffff
je case.0x14020235b.10
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [r14]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [rsp + 0x34]
cmp r13d, 0x26
mov ecx, 0xffffffff
cmove edi, ecx
add edx, edi
mov dword [rsp + 0x34], edx
cmp edx, dword [rbx + 0x28]
jge case.0x14020235b.10
cmp edx, dword [rbx + 0x20]
jl case.0x14020235b.10
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp case.0x14020235b.10
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [rbx + 0x50]
mov rcx, qword [rcx]
test ax, ax
jns 0x1402025c4
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
mov rcx, rax
lea edx, [r9 + 0x28]
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x14020235b.10
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x14020235b.10
mov edi, 1
mov ecx, 0xffffffff
mov eax, edi
cmp r13d, 0x25
mov r12d, edi
cmove eax, ecx
lea ecx, [rdi + 0x10]
mov dword [rsp + 0x90], eax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140202660
cmp dword [rbx + 0x4c], r15d
je 0x1402026b4
movsd xmm0, qword [0x1404538b8]
xorps xmm3, xmm3
movsxd r8, dword [rsp + 0x90]
mov dword [rsp + 0x28], edi
movsd qword [rsp + 0x20], xmm0
mov rdx, rbp
mov rcx, rbx
call fcn.140201e20
test eax, eax
je case.0x14020235b.10
mov rcx, qword [rbx + 0x50]
lea rdx, [rbx + 0x1c]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x14020235b.10
cmp dword [r14 + 0x10], 0xffffffff
je 0x1402026b4
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbx + 0x50]
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [rsp + 0x90]
add ecx, dword [rsp + 0x30]
mov dword [rsp + 0x30], ecx
cmp ecx, dword [rbx + 0x24]
jge case.0x14020235b.10
cmp ecx, dword [rbx + 0x1c]
jl case.0x14020235b.10
mov edx, dword [rsp + 0x34]
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp case.0x14020235b.10
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.0x14020235b.10
mov eax, dword [rbx + 0x4c]
cmp r13d, 0x25
je 0x140202729
test eax, eax
je 0x140202723
mov ecx, dword [r14 + 0x38]
cmp eax, edi
jne 0x1402026e7
and ecx, 0xffffffdf
mov dword [r14 + 0x38], ecx
mov eax, dword [rbx + 0x4c]
mov edx, dword [rbx + 0x48]
test cl, 0x20
je 0x140202715
lea ecx, [rdx + 1]
cmp eax, edi
jbe 0x140202700
dec eax
mov dword [rbx + 0x48], ecx
mov dword [rbx + 0x4c], eax
jmp 0x14020276c
lea eax, [rsi - 1]
mov dword [rbx + 0x4c], edi
cmp ecx, eax
cmovae ecx, eax
mov dword [rbx + 0x48], ecx
and dword [r14 + 0x38], 0xffffffdf
jmp 0x14020276c
sub esi, edx
inc eax
cmp eax, esi
cmovae eax, esi
mov dword [rbx + 0x4c], eax
jmp 0x14020276c
mov dword [rbx + 0x48], r15d
jmp 0x140202769
test eax, eax
je 0x140202763
mov ecx, dword [r14 + 0x38]
cmp eax, edi
jne 0x14020273c
or ecx, 0x20
mov dword [r14 + 0x38], ecx
test cl, 0x20
je 0x140202752
mov eax, dword [rbx + 0x48]
test eax, eax
je 0x14020276c
dec eax
inc dword [rbx + 0x4c]
mov dword [rbx + 0x48], eax
jmp 0x14020276c
add dword [rbx + 0x4c], 0xffffffff
jne 0x14020276c
mov eax, dword [rbx + 0x48]
test eax, eax
je 0x140202769
dec eax
jmp 0x140202766
lea eax, [rsi - 1]
mov dword [rbx + 0x48], eax
mov dword [rbx + 0x4c], edi
mov rcx, qword [rbx + 0x50]
lea rdx, [rbx + 0x1c]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x14020235b.10
mov rsi, qword [r14]
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, rsi
je 0x14020237c
movzx eax, word [rsp + 0x98]
mov rcx, rsi
movzx edi, word [rsp + 0xa0]
shl rdi, 0x10
or rdi, rax
call qword [sym.imp.USER32.dll_GetParent]
mov r9, rdi
mov r8, r13
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x140202385
xor eax, eax
add rsp, 0x50
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret