Function at 0x401000
Capabilities:
Check for unmoving mouse cursor
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x2c]
push eax
xor esi, esi
call edi
mov ebx, 0x12c
mov dword [esp + 0x14], ebx
nop
lea eax, [esp + 0x24]
push eax
call edi
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x24]
jne 0x401090
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x28]
jne 0x401090
test esi, esi
je 0x401089
push 0xf0
push 0
push 0x405438
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [0x405528], 0
push 0x401520
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor esi, esi
jmp 0x401216
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x24]
mov ebx, eax
mov edi, dword [esp + 0x28]
push 0xc
call fcn.0040155d
mov edx, dword [0x405528]
add esp, 4
mov dword [eax + 8], ebx
mov dword [eax + 4], edi
lea ecx, [edx + edx*2]
mov dword [eax], esi
lea ebx, [edx + 1]
movq xmm0, qword [eax]
xor edi, edi
movq qword [ecx*4 + 0x405438], xmm0
mov eax, dword [eax + 8]
mov dword [ecx*4 + 0x405440], eax
mov eax, 0xcccccccd
mul ebx
mov dword [esp + 0xc], edi
shr edx, 4
lea eax, [edx + edx*4]
shl eax, 2
sub ebx, eax
mov dword [esp + 0x18], ebx
mov dword [0x405528], ebx
cmp ebx, 1
jbe 0x401147
lea eax, [ebx - 1]
mov ecx, 0x405438
mov ebx, dword [0x405438]
mov dword [esp + 0x10], eax
nop
mov eax, dword [ecx + 4]
lea esi, [ecx + 0xc]
sub eax, dword [ecx + 0x10]
sub ebx, dword [esi]
cdq
mov ecx, eax
mov eax, ebx
mov ebx, dword [esi]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
dec ecx
sub eax, edx
add eax, dword [esp + 0xc]
add eax, ecx
sub dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
lea ecx, [esi]
jne 0x401110
mov ebx, dword [esp + 0x18]
xor esi, esi
jmp 0x401150
xor esi, esi
test ebx, ebx
je 0x4011b9
nop dword [eax]
xor ecx, ecx
lea edi, [esi + esi*2]
mov edx, 0x405440
nop word [eax + eax]
cmp esi, ecx
je 0x40116f
mov eax, dword [edi*4 + 0x405440]
cmp eax, dword [edx]
jb 0x4011c7
inc ecx
add edx, 0xc
cmp ecx, ebx
jb 0x401160
mov eax, dword [edi*4 + 0x405440]
mov dword [esp + 0x1c], eax
xor esi, esi
xor eax, eax
lea edi, [esi + esi*2]
mov edx, 0x405440
nop
cmp esi, eax
je 0x40119f
mov ecx, dword [edi*4 + 0x405440]
cmp ecx, dword [edx]
ja 0x4011cf
inc eax
add edx, 0xc
cmp eax, ebx
jb 0x401190
lea eax, [esi + esi*2]
mov ecx, dword [eax*4 + 0x405440]
mov dword [esp + 0x20], ecx
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x20]
jne 0x4011d7
xor eax, eax
jmp 0x4011ed
mov esi, ecx
cmp ecx, ebx
jb 0x401150
jmp 0x401182
mov esi, eax
cmp eax, ebx
jb 0x401184
jmp 0x4011b5
mov eax, 0x66666667
imul ecx
mov eax, edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
idiv ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401520
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ebx, dword [esp + 0x14]
mov esi, 1
mov edi, dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push 0x32
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x401030
mov ecx, dword [esp + 0x34]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040154f
mov esp, ebp
pop ebp
ret