Function at 0x10021dd
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
cmp eax, 0x12
push ebx
push esi
push edi
mov ebx, ecx
jbe 0x101067c
sub eax, 0x15
jne 0x1020147
call sub.SHELL32.dll_Ordinal_733
pop edi
pop esi
pop ebx
leave
ret 4
je 0x1025bcd
dec eax
dec eax
je 0x1025afd
dec eax
je 0x1025a85
sub eax, 5
jne 0x1025a1e
push 8
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
push 0x559
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1002204
dec eax
je 0x1020190
dec eax
jne 0x1020173
lea esi, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
xor edi, edi
cmp dword [esi], edi
jne 0x1025c01
push 0x17
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebx + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], edi
jmp 0x1002204
dec eax
jne 0x1025bee
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
push 0x18
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x1002204
mov ecx, ebx
call fcn.0102fff2
jmp 0x1002204
sub eax, 4
je 0x1025a43
sub eax, 5
jne 0x1002204
push 0x11
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, ebx
call fcn.0103178b
jmp 0x1002204
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xc
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, dword [sym.imp.SHELL32.dll_DAD_ShowDragImage]
push 0
call esi
push 0
push 1
push 0xf3
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call esi
jmp 0x1002204
cmp dword [ebx + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0
jne 0x1002204
test byte [ebx + 0x44], 1
je 0x1002204
push 3
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, 0xfffff001
mov dword [ebx + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
mov dword [ebx + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
test byte [ebx + 0x44], 2
je 0x1002204
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x1002204
mov ecx, ebx
call fcn.0100aa97
jmp 0x1002204
cmp dword [ebx + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0
jne 0x1002204
mov eax, dword [ebx + 0x44]
test al, 1
je 0x1002204
test al, 2
jne 0x1002204
push dword [ebx + 0x40]
call fcn.01030ad1
test eax, eax
je 0x1002204
cmp dword [ebx + 0x20], 0
jne 0x1002204
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [ebx + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
add esi, 5
shl esi, 4
add esi, ebx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
shl eax, 2
push eax
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
movsd dword es:[edi], dword [esi]
shl eax, 2
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x18]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_InflateRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1002204
mov ecx, ebx
call fcn.0101c5e5
test eax, eax
jne 0x1002204
cmp dword [ebx + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 1
je 0x1002204
push eax
push eax
push 0x439
push dword [ebx + 0x3b8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x1002204
mov ecx, ebx
call fcn.010328cf
jmp 0x1002204
push 0x12
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, ebx
call fcn.01030a8c
mov dword [ebx + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 1
jmp 0x1002204
dec eax
jne 0x1002204
mov ecx, ebx
call fcn.01010855
jmp 0x1002204
call sub.SHELL32.dll_Ordinal_753
mov dword [esi], edi
jmp 0x1002204