Function at 0x140092d80
Capabilities:
Check for unmoving mouse cursor
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1650]
mov eax, 0x1750
call fcn.1401722d0
sub rsp, rax
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1778], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x1640], rax
mov rdi, rcx
cmp r8, 0x457
jne 0x140092dd0
call fcn.140095f70
jmp 0x1400937d4
cmp r8, 0x458
jne 0x140092ec7
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f8], xmm0
lea rdx, [rbp + 0x1f8]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400937d4
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x1400937d4
cmp dword [rdi + 0x560], 0
je 0x140092ea2
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.1400956d0
cmp dword [rdi + 0x564], 0
je 0x140092e74
mov rbx, qword [rdi + 0x4b0]
test rbx, rbx
je 0x140092e74
mov rbx, qword [rbx]
call fcn.1400666d0
mov rcx, rax
call fcn.1400790d0
mov rcx, qword [rdi + 0x4b0]
jmp 0x140092e97
mov rbx, qword [rdi + 0x4f0]
test rbx, rbx
je 0x140092ea2
mov rbx, qword [rbx]
call fcn.1400666d0
mov rcx, rax
call fcn.1400790d0
mov rcx, qword [rdi + 0x4f0]
test eax, eax
setne dl
call qword [rbx + 0x228]
mov dword [rbp - 0x60], SafeArrayCopy
mov dword [rbp - 0x5c], 2
mov rax, qword [rdi + 8]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
jmp 0x1400937d4
cmp r8, 0x459
jne 0x140092fbf
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x208], xmm0
lea rdx, [rbp + 0x208]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400937d4
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x208]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1400937d4
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400956d0
cmp dword [rdi + 0x564], 0
je 0x140092f7c
cmp qword [rdi + 0x4b0], 0
je 0x140092f7c
cmp dword [rdi + 0x560], 0
jne 0x140092f65
call fcn.1400666d0
mov rcx, rax
call fcn.1400790d0
test eax, eax
je 0x140092f65
mov dl, 1
jmp 0x140092f67
xor edx, edx
mov rcx, qword [rdi + 0x4b0]
mov rax, qword [rcx]
call qword [rax + 0x228]
jmp 0x1400937d4
cmp qword [rdi + 0x4f0], 0
je 0x1400937d4
cmp dword [rdi + 0x560], 0
jne 0x140092fa8
call fcn.1400666d0
mov rcx, rax
call fcn.1400790d0
test eax, eax
je 0x140092fa8
mov dl, 1
jmp 0x140092faa
xor edx, edx
mov rcx, qword [rdi + 0x4f0]
mov rax, qword [rcx]
call qword [rax + 0x228]
jmp 0x1400937d4
cmp r8, 0x45a
jne 0x140093035
call fcn.140010050
mov rcx, rax
call fcn.140074ef0
test eax, eax
je 0x1400937d4
call fcn.1400b9e40
mov eax, dword [rax + 0xec]
test eax, eax
js 0x1400937d4
call fcn.140010050
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.140074e50
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov r8d, 0xffffffff
lock xadd dword [rdx + 0x10], r8d
sub r8d, 1
jg 0x140093026
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
mov rcx, rdi
call fcn.140087490
jmp 0x1400937d4
cmp r8, 0x45b
jne 0x140093062
mov rcx, qword [rcx + 0x5f0]
test rcx, rcx
je 0x1400937d4
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call fcn.1400f6360
jmp 0x1400937d4
cmp r8, 0x45c
jne 0x14009309f
call fcn.140010050
mov rcx, rax
call fcn.140074ef0
test eax, eax
je 0x1400937d4
call fcn.1400b9e40
mov rcx, rax
xor r9d, r9d
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x4c]
call fcn.1400c1e00
jmp 0x1400937d4
cmp r8, 0x45d
jne 0x1400934b7
call fcn.1400d2220
test eax, eax
je 0x1400932c5
call fcn.1400e97a0
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + InitCommonControls]
cmp al, 1
jne 0x14009329c
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x228], xmm0
mov byte [rbp + 0x218], 0
mov r8d, 0x40
lea rdx, [0x1402fcad0]
lea rcx, [rbp + 0x218]
call fcn.14000c230
nop
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x1c8], xmm0
mov byte [rbp + 0x1b8], 0
mov r8d, 3
lea rdx, [0x1402ecb4c]
lea rcx, [rbp + 0x1b8]
call fcn.14000c230
nop
call fcn.1400e97a0
mov rsi, rax
mov r9d, 0x6bb
lea r8, [rbp + 0x218]
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp - 0x28]
call fcn.14000e2f0
mov rbx, rax
lea rdx, str.network_connect...
lea rcx, [rbp + 0x258]
call fcn.14006c570
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140093181
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.14000ca40
nop
mov rdx, qword [rbp + 0x270]
cmp rdx, 8
jb 0x1400931d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x258]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400931ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140093803
call fcn.140171af0
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rbp + 0x268], xmm0
xor ecx, ecx
mov word [rbp + 0x258], cx
mov rax, qword [rsi]
mov rdx, rbx
mov rcx, rsi
call qword [rax + 0x38]
nop
lea rcx, [rbp - 0x28]
call fcn.14000f8a0
nop
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0x10
jb 0x140093244
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009323f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140093809
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x1c8], xmm0
mov byte [rbp + 0x1b8], 0
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x14009329c
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140093297
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009380f
call fcn.140171af0
mov edx, 0x45d
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_KillTimer]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x43a
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400937d4
call fcn.1400e97a0
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + InitCommonControls]
cmp al, 1
jne 0x1400937d4
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x248], xmm0
mov byte [rbp + 0x238], 0
mov r8d, 0x40
lea rdx, [0x1402fcad0]
lea rcx, [rbp + 0x238]
call fcn.14000c230
nop
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x1e8], xmm0
mov byte [rbp + 0x1d8], 0
mov r8d, 3
lea rdx, [0x1402ecb4c]
lea rcx, [rbp + 0x1d8]
call fcn.14000c230
nop
call fcn.1400e97a0
mov rdi, rax
mov r9d, 0x6c1
lea r8, [rbp + 0x238]
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0xc0]
call fcn.14000e2f0
mov rbx, rax
lea rdx, str.network_break...
lea rcx, [rbp + 0x278]
call fcn.14006c570
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140093390
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.14000ca40
nop
mov rdx, qword [rbp + 0x290]
cmp rdx, 8
jb 0x1400933e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400933dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140093815
call fcn.140171af0
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rbp + 0x288], xmm0
xor ecx, ecx
mov word [rbp + 0x278], cx
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
nop
lea rcx, [rbp + 0xc0]
call fcn.14000f8a0
nop
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0x10
jb 0x140093456
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140093451
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009381b
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x1e8], xmm0
mov byte [rbp + 0x1d8], 0
mov rdx, qword [rbp + 0x250]
cmp rdx, 0x10
jb 0x1400937d4
inc rdx
mov rcx, qword [rbp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400934ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140093821
call fcn.140171af0
jmp 0x1400937d4
cmp r8, 0x45e
jne 0x1400934ca
call fcn.140093830
jmp 0x1400937d4
cmp r8, 0x460
jne 0x14009367a
mov rdx, r8
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
call fcn.1400666d0
mov rcx, rax
call fcn.140078bb0
cmp eax, 1
jle 0x1400937d4
call fcn.140089380
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400897b0
nop
mov rax, qword [rsp + 0x68]
cmp dword [rax - 0x10], 0
je 0x14009366b
mov rax, qword [rsp + 0x78]
cmp dword [rax - 0x10], 0
je 0x14009366b
call fcn.1400666d0
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.140079120
nop
mov r9, qword [rsp + 0x78]
test r9, r9
je 0x1400937f8
mov rax, qword [rsp + 0x40]
mov rcx, rax
sub r9, rax
nop word [rax + rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x140093576
add rcx, 2
test edx, edx
jne 0x140093560
test r8d, r8d
jne 0x140093584
lea rdx, [rax - 0x18]
jmp 0x14009364f
mov ecx, dword [rbp - 0x78]
test ecx, ecx
jg 0x140093594
lea rdx, [rax - 0x18]
jmp 0x14009364f
mov eax, 0x64
cmp ecx, eax
cmovg ecx, eax
mov dword [rbp - 0x78], ecx
call fcn.1400df284
mov dword [rbp + 0x1634], 0xffffffff
mov dword [rbp + 0x2b4], eax
mov edx, 1
mov r8d, edx
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + r8*4 + 0x2b4], eax
inc edx
inc r8
cmp r8, 0x270
jl 0x1400935c0
mov dword [rbp + 0x2b0], 0x270
lea rax, [rbp + 0x2b0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 0x20
mov dword [rbp - 0x38], 0xffffffff
mov edx, 0x65
lea rcx, [rbp - 0x48]
call fcn.140086aa0
mov r8d, 0x80000000
lea ecx, [rax + r8]
lea edx, [rcx - 0x80000000]
cmp ecx, r8d
cmovae edx, eax
cmp edx, dword [rbp - 0x78]
jg 0x140093646
xor r9d, r9d
xor r8d, r8d
mov edx, 0x43d
mov rcx, rdi
call fcn.1400f6360
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov r8d, 0xffffffff
lock xadd dword [rdx + 0x10], r8d
sub r8d, 1
jg 0x14009366b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x68]
call fcn.140086770
jmp 0x1400937d4
cmp r8, 0x45f
jne 0x1400937d4
mov rdx, r8
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
mov rax, qword [rdi + 0xd00]
cmp dword [rax - 0x10], 0
je 0x1400937c8
lea rcx, [rdi + 0x800]
call fcn.1400f5ac0
test rax, rax
jne 0x1400936cd
lea rdx, [rdi + 0x618]
mov r8, qword [rdi + 8]
lea rcx, [rdi + 0x800]
call fcn.1400a3dc0
lea rcx, [rdi + 0x800]
call fcn.1400f5ac0
mov rbx, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1a8], xmm0
lea rdx, [rbp + 0x1a8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rbp + 0x1b4]
sub r8d, dword [rbp + 0x1ac]
mov edx, dword [rbp + 0x1b0]
sub edx, dword [rbp + 0x1a8]
movss xmm3, dword [0x1402f7e28]
lea rcx, [rbp + 0x298]
call fcn.1400bd3d0
movups xmm0, xmmword [rax]
movdqu xmmword [rbp + 0x1a8], xmm0
movq r9, xmm0
shr r9, 0x20
mov dword [rsp + 0x30], reloc.WS2_32.dll_setsockopt
mov r8d, 0xffffffff
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
movd r8d, xmm0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 5
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rdx, qword [rdi + 0xd00]
lea r8, str.infoservice
xor ecx, ecx
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400937c8
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400937c8
add rcx, 2
cmp rcx, 0xc
jne 0x140093791
xor r9d, r9d
mov edx, 0x41b
lea r8d, [rcx - 6]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rdi + 0xd00]
call fcn.14000af40
xor eax, eax
mov rcx, qword [rbp + 0x1640]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x1778]
add rsp, 0x1750
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000adf0
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
int3