Function at 0x14007ca60
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14d, r9d
mov ebx, r8d
mov ebp, edx
mov r15, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov sil, byte [rcx + 0x1c0]
call fcn.140034ca0
test sil, 1
jne 0x14007cb11
movabs r13, 0xaaaaaaaaaaaaaaaa
test al, al
je 0x14007cb84
lea rcx, [rsp + 0x30]
mov qword [rcx], r13
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x14007cada
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [rsp + 0x30], ecx
sar eax, 0x10
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_WindowFromPoint]
test rax, rax
je 0x14007ce76
mov rsi, qword [sym.imp.USER32.dll_GetParent]
cmp rax, qword [r15 + 0x1b0]
je 0x14007cb84
mov rcx, rax
call rsi
test rax, rax
jne 0x14007caf5
jmp 0x14007ce76
test al, al
je 0x14007ce76
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x14007cb49
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [rsp + 0x30], ecx
sar eax, 0x10
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_WindowFromPoint]
test rax, rax
je 0x14007cb77
mov rsi, qword [sym.imp.USER32.dll_GetParent]
cmp rax, qword [r15 + 0x1b0]
je 0x14007ce76
mov rcx, rax
call rsi
test rax, rax
jne 0x14007cb60
mov rcx, r15
call fcn.14007cf40
jmp 0x14007ce76
or byte [r15 + 0x1c0], 1
cmp byte [0x14032fa80], 0
jne 0x14007cced
movabs rdi, 0x8000000000000010
mov ecx, 0x20
call fcn.1401ef3e0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], SafeArrayGetDim
lea rcx, [rax + 0x18]
lea rdx, [0x1402e0538]
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14007cf31
movups xmm0, xmmword [0x1402e0538]
movups xmmword [rax], xmm0
movabs rcx, 0x6c006c0064002e
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], 0
xorps xmm0, xmm0
lea rsi, [rsp + 0x30]
movups xmmword [rsi + 0x18], xmm0
lea rcx, [rsp + 0xb0]
mov qword [rcx], 0
mov rdx, rsi
mov r8d, 0x68
call fcn.14010d230
mov rcx, qword [rsi + 0x18]
call fcn.140071eb0
cmp byte [rsi + 0x17], 0
jns 0x14007cc41
mov rcx, qword [rsp + 0x30]
call fcn.1401ef41c
mov rsi, qword [rsp + 0xb0]
test rsi, rsi
je 0x14007cce6
mov ecx, 0x28
call fcn.1401ef3e0
mov qword [rsp + 0x30], rax
add rdi, 4
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rax + 0x20]
lea rdx, str._TrackMouseEvent
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14007cf31
movups xmm0, xmmword [0x1402e0562]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str._TrackMouseEvent]
movups xmmword [rax], xmm0
mov word [rax + 0x20], 0
xorps xmm0, xmm0
lea rdi, [rsp + 0x30]
movups xmmword [rdi + 0x18], xmm0
mov rcx, rsi
mov rdx, rdi
call fcn.14010de80
mov qword [0x14032fa78], rax
mov rcx, qword [rdi + 0x18]
call fcn.140071eb0
cmp byte [rdi + 0x17], 0
jns 0x14007cce6
mov rcx, qword [rsp + 0x30]
call fcn.1401ef41c
mov byte [0x14032fa80], 1
mov rax, qword [0x14032fa78]
test rax, rax
je 0x14007cd24
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], 0
movabs rdx, 0x200000018
mov qword [rcx], rdx
mov rdx, qword [r15 + 0x1b0]
mov qword [rcx + 8], rdx
call qword [0x14030c820]
lea rsi, [0x1402e04b8]
lea r12, [rsp + 0x30]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdi, r12
rep movsq qword [rdi], qword [rsi]
mov edx, dword [0x1403314dc]
mov rcx, r12
call fcn.1400c7360
lea rsi, [rsp + 0xb0]
mov qword [rsi], r13
mov rax, qword [r15]
mov rax, qword [rax + 0xf0]
mov rcx, r15
mov rdx, rsi
call qword [0x14030c820]
mov eax, ebp
sub eax, dword [rsi]
mov dword [r12 + 0x54], eax
mov eax, ebx
sub eax, dword [rsi + 4]
mov dword [r12 + 0x58], eax
mov ecx, r14d
shr cl, 1
and cl, 2
mov dl, byte [r12 + 0x50]
mov al, byte [r12 + 0x51]
and dl, 0xfc
mov r8d, r14d
shr r8b, 3
mov r9d, r8d
and r9b, 1
or r9b, cl
or r9b, dl
mov byte [r12 + 0x50], r9b
mov ecx, r14d
and cl, 1
and al, 0xe0
and r8b, 2
or r8b, cl
lea ecx, [r14 + r14]
and cl, 4
or cl, r8b
mov edx, r14d
shr dl, 2
and dl, 0x18
or dl, cl
or dl, al
mov byte [r12 + 0x51], dl
mov ecx, SafeArrayUnlock
call qword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [r12 + 0x50]
shr eax, 0xd
and al, 4
and cl, 0xfb
or cl, al
mov byte [r12 + 0x50], cl
call qword [sym.imp.USER32.dll_GetMessageTime]
mov dword [r12 + 0x1c], eax
mov qword [r12 + 0x10], r15
mov eax, dword [r15 + 0x78]
mov dword [r12 + 0x20], eax
lea rsi, [rsp + 0xbc]
mov dword [rsi], ebp
lea rdi, [rsp + 0xb8]
mov dword [rdi], ebx
mov rax, qword [r15]
mov rax, qword [rax + 0x4d0]
mov rcx, r15
mov rdx, rsi
mov r8, rdi
call qword [0x14030c820]
mov eax, dword [rsi]
mov ecx, dword [rdi]
shl rcx, 0x20
or rcx, rax
mov qword [0x14032f858], rcx
mov eax, dword [r12 + 0x18]
mov dword [0x14032f860], eax
mov rcx, r15
mov rdx, r12
call fcn.14009f1b0
lea rax, [0x140285cb0]
mov qword [r12], rax
mov rcx, r12
call fcn.1400b9c50
mov eax, dword [0x14032f860]
cmp eax, dword [0x1403314d0]
je 0x14007cedc
cmp eax, dword [0x1403314c0]
je 0x14007cedc
cmp eax, dword [0x1403314c8]
je 0x14007cedc
cmp eax, dword [0x1403314d8]
je 0x14007cedc
mov dword [rsp + 0x20], r14d
mov rcx, r15
mov edx, 0x200
mov r8d, ebp
mov r9d, ebx
call fcn.14007d1c0
mov esi, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401f08b0
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x30]
mov dword [rsi], ebp
lea r8, [rsp + 0xb0]
mov dword [r8], ebx
mov rax, qword [r15]
mov rax, qword [rax + 0x4d0]
mov rcx, r15
mov rdx, rsi
call qword [0x14030c820]
mov eax, dword [rsi]
cmp eax, dword [0x14032f858]
jne 0x14007ce9c
mov eax, dword [0x14032f85c]
cmp dword [rsp + 0xb0], eax
jne 0x14007ce9c
mov eax, dword [0x1403314d8]
mov dword [0x14032f860], eax
xor esi, esi
jmp 0x14007ceb6
ud2