Function at 0x10155b70
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1023c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
cmp eax, 3
jne 0x10155c94
cmp dword [esi + 0x34], 0
jne 0x10155ba2
test dword [esi + 0x208], 0x4000
jne 0x10155c13
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10155c13
movups xmm0, xmmword [esi + 0x68]
movups xmmword [ebp - 0x14], xmm0
inc dword [ebp - 8]
psrldq xmm0, 8
movd eax, xmm0
inc eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x54]
call sym.HncOfficeFramework.dll_void___cdecl_ClientToScreen_struct_HWND_____struct_tagRECT__
mov ecx, dword [ebp - 0x1c]
add esp, 8
cmp dword [ebp - 0x14], ecx
jg 0x10155c03
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], eax
jg 0x10155c03
cmp dword [ebp - 0xc], ecx
jle 0x10155c03
cmp dword [ebp - 8], eax
jle 0x10155c03
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, dword [esi + 4]
je 0x10155c13
cmp eax, dword [esi + 0x54]
je 0x10155c13
push 0
mov ecx, esi
mov dword [esi + 0x34], 0
call fcn.10154920
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test dword [esi + 0x208], 0x4000
je 0x10155d40
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x54]
call sym.HncOfficeFramework.dll_void___cdecl_ClientToScreen_struct_HWND_____struct_tagRECT__
add esp, 8
lea ecx, [esi + 0x58]
lea edx, [ebp - 0x14]
mov edi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10155c77
add ecx, 4
add edx, 4
sub edi, 4
jae 0x10155c52
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 0x10
push 0
mov ecx, esi
call fcn.10154920
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 1
jne 0x10155d18
test dword [esi + 0x208], 0x4000
je 0x10155ccc
mov eax, dword [esi + 0x78]
movups xmm0, xmmword [esi + 0x68]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x54]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x10155ce2
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10155d14
movups xmm0, xmmword [esi + 0x68]
movups xmmword [ebp - 0x14], xmm0
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x54]
call sym.HncOfficeFramework.dll_void___cdecl_ClientToScreen_struct_HWND_____struct_tagRECT__
mov ecx, dword [ebp - 0x1c]
add esp, 8
cmp dword [ebp - 0x14], ecx
jg 0x10155d14
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], eax
jg 0x10155d14
cmp dword [ebp - 0xc], ecx
jle 0x10155d14
cmp dword [ebp - 8], eax
jle 0x10155d14
push 1
mov ecx, esi
call fcn.10154920
push 1
jmp 0x10155d2d
cmp eax, 2
jne 0x10155d36
push 0
mov dword [esi + 0x34], 1
call fcn.10154920
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x200], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1008548c
mov esp, ebp
pop ebp
ret 0x10