Function at 0x100087ba
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, ecx
push esi
push edi
cmp edx, 0xffffffaf
jne 0x10008843
lea edi, [ebp + 0x20]
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call dword [eax + 0x60]
push 0xffffffffffffffaf
push dword [ebp + 0x1bc]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esp + 0x10]
push ecx
push ecx
mov ecx, esp
push 1
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, dword [edi]
xor ebx, ebx
test ax, ax
sets bl
lea esi, [esi + 0xe4]
call fcn.10007d84
push eax
push ebx
push 7
mov ecx, edi
call dword [esi]
test al, al
je 0x1000883c
push 0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
shr eax, 3
push eax
push 0xffffffffffffffae
push dword [ebp + 0x1bc]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
jmp 0x10008a29
cmp edx, 0xffffffae
jne 0x100088a1
lea edi, [ebp + 0x20]
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call dword [eax + 0x60]
mov eax, dword [esp + 0x10]
push ecx
push ecx
mov ecx, esp
push 1
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, dword [edi]
xor ebx, ebx
test ax, ax
sets bl
lea esi, [esi + 0xe4]
call fcn.10007d84
push eax
push ebx
push 7
mov ecx, edi
call dword [esi]
test al, al
jne 0x1000883c
push 0xffffffffffffffae
push dword [ebp + 0x1bc]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x1000883c
cmp edx, 0xffffffad
jne 0x10008971
push edx
push dword [ebp + 0x1bc]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov ecx, dword [ebp + 0x1bc]
mov dword [esp + 0x20], eax
cmp eax, ecx
je 0x1000883c
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebx
push ecx
call esi
push ebx
push dword [esp + 0x24]
mov edi, eax
call esi
cmp edi, eax
jne 0x10008927
mov ecx, dword [esp + 0x20]
call fcn.10007021
test eax, eax
je 0x10008927
mov edx, dword [eax]
mov ecx, eax
push 1
push dword [ebp + 0x70]
call dword [edx + 0x1dc]
test al, al
jne 0x1000883c
lea eax, [esp + 0x10]
push eax
push dword [ebp + 0x1bc]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x10]
push ecx
push ecx
mov ecx, esp
push ebx
push ebx
push 1
mov dword [ecx], eax
mov eax, dword [esp + 0x28]
mov dword [ecx + 4], eax
lea ecx, [ebp + 0x20]
mov eax, dword [ecx]
call dword [eax + 0xe4]
push 0xffffffffffffffab
push dword [ebp + 0x1bc]
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [ebp + 0x1c4], bl
jmp 0x1000883c
cmp edx, 0xffffffab
jne 0x10008a14
push edx
push dword [ebp + 0x1bc]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x10]
push eax
push dword [ebp + 0x1bc]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [esp + 0x10]
mov eax, esi
sub eax, dword [ebp + 0x220]
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jge 0x1000883c
mov eax, dword [esp + 0x14]
sub eax, dword [ebp + 0x224]
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jge 0x1000883c
push ecx
push ecx
mov ecx, esp
push 1
mov dword [ecx], esi
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, dword [ebp + 0x20]
test ax, ax
sets bl
call fcn.10007d84
push eax
push ebx
push 8
lea ecx, [ebp + 0x20]
call dword [edi + 0xe4]
jmp 0x1000883c
lea ecx, [ebp + 0x20]
mov eax, dword [ecx]
push edx
call dword [eax + 0x128]
xor ecx, ecx
test al, al
sete cl
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc