Function at 0x18008f210
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x180315280]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rcx
xor r14d, r14d
mov r15d, r14d
mov dword [rbp + 0x2f], r14d
mov edx, dword [0x180316334]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rdi, qword [rax + rdx*8]
add rdi, rcx
mov eax, dword [rdi]
cmp dword [0x180318588], eax
jle 0x18008f2c3
lea rcx, [0x180318588]
call fcn.1800a9ad8
cmp dword [0x180318588], 0xffffffff
jne 0x18008f2c3
mov eax, 0x3e8
cdq
idiv dword [rsi + 0x58]
movsxd rbx, eax
mov qword [0x1803185a0], r14
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rdx, qword [rax]
mov qword [0x1803185a0], rdx
mov qword [0x1803185a8], rbx
lea rcx, [0x180318588]
call fcn.1800a9a6c
mov eax, dword [rdi]
cmp dword [0x180318570], eax
jle 0x18008f313
lea rcx, [0x180318570]
call fcn.1800a9ad8
cmp dword [0x180318570], 0xffffffff
jne 0x18008f313
movsxd rbx, dword [rsi + 0x6c]
mov qword [0x180318578], r14
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rdx, qword [rax]
mov qword [0x180318578], rdx
mov qword [0x180318580], rbx
lea rcx, [0x180318570]
call fcn.1800a9a6c
mov eax, dword [rdi]
cmp dword [0x18031858c], eax
jle 0x18008f363
lea rcx, [0x18031858c]
call fcn.1800a9ad8
cmp dword [0x18031858c], 0xffffffff
jne 0x18008f363
movsxd rbx, dword [rsi + 0x70]
mov qword [0x180318590], r14
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rdx, qword [rax]
mov qword [0x180318590], rdx
mov qword [0x180318598], rbx
lea rcx, [0x18031858c]
call fcn.1800a9a6c
cmp byte [rsi + 0x50], r14b
je 0x18008f3a2
cmp byte [0x180316798], r14b
jne 0x18008f3a2
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008f3a2
lea rdx, [rbp - 0x39]
mov rcx, qword [0x180316800]
call fcn.180065ec0
mov r15d, 1
cmp qword [rax + 8], r14
jne 0x18008f3a2
xor bl, bl
jmp 0x18008f3a4
mov bl, 1
test r15b, 1
je 0x18008f3d5
cmp byte [rbp - 0x29], 0
je 0x18008f3d5
cmp qword [0x180316340], 0
je 0x18008f3d5
mov rdx, qword [rbp - 0x31]
test rdx, rdx
je 0x18008f3d5
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
mov r8, qword [rax + 0xb0]
call r8
nop
test bl, bl
jne 0x18008fa54
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rcx, qword [rbp + 0x37]
mov rdx, rcx
sub rdx, qword [0x1803185a0]
movabs r12, 0x431bde82d7b634db
mov rax, r12
imul rdx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, qword [0x1803185a8]
je 0x18008f4b3
mov r8d, 1
mov r9d, 0xff
cmovl r8d, r9d
test r8b, r8b
jns 0x18008f4b3
cmp byte [rsi + 0x60], bl
je 0x18008fa54
cmp dword [rsi + 0x64], 2
jne 0x18008fa54
cmp byte [rsi + 0x74], bl
jne 0x18008fa54
mov qword [rbp + 0x37], r14
lea rcx, [rbp + 0x37]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rbp + 0x3b]
shl r9d, 0x10
movzx eax, word [rbp + 0x37]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rbp + 0x3b]
shl r9d, 0x10
movzx eax, word [rbp + 0x37]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x18008fa54
mov qword [0x1803185a0], rcx
lea rdx, [rbp - 1]
mov rcx, qword [0x180316800]
call fcn.180065cc0
nop
lea rdx, [rbp - 0x39]
mov rcx, rax
call fcn.180069ab0
mov r15, rax
mov rdi, qword [0x180316340]
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
mov r8d, 5
lea rdx, str.BLOCK
lea rcx, [rbp - 0x21]
call fcn.180004ea0
nop
lea rdx, [rbp - 0x21]
lea rcx, [0x180318130]
call fcn.180072650
mov rbx, rax
mov rdx, qword [0x180316340]
lea rcx, [0x180318130]
call fcn.1800723b0
mov rdx, rax
mov rax, qword [rdi]
mov r9, qword [rax + 0x488]
mov r8, rbx
mov rcx, rdi
call r9
mov r8, rax
mov qword [rbp + 0x17], rdi
mov byte [rbp + 0x27], 0
mov qword [rbp + 0x1f], rax
mov rdx, qword [r15 + 8]
cmp rdx, rax
jne 0x18008f55f
mov bl, 1
jmp 0x18008f582
test rdx, rdx
je 0x18008f580
test r8, r8
je 0x18008f580
mov rcx, qword [r15]
mov rax, qword [rcx]
mov r9, qword [rax + 0xc0]
call r9
cmp al, 1
sete bl
jmp 0x18008f582
xor bl, bl
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x18008f5c0
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f5bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18008f5bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800a9fd4
movdqa xmm0, xmmword [0x180304580]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
cmp byte [rbp - 0x29], 0
je 0x18008f5ff
cmp qword [0x180316340], 0
je 0x18008f5ff
mov rdx, qword [rbp - 0x31]
test rdx, rdx
je 0x18008f5ff
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
mov r8, qword [rax + 0xb0]
call r8
mov qword [rbp - 0x31], r14
cmp byte [rbp + 0xf], 0
je 0x18008f62a
cmp qword [0x180316340], 0
je 0x18008f62a
mov rdx, qword [rbp + 7]
test rdx, rdx
je 0x18008f62a
mov rcx, qword [rbp - 1]
mov rax, qword [rcx]
mov r8, qword [rax + 0xb0]
call r8
nop
test bl, bl
jne 0x18008fa54
mov qword [rbp + 0x2f], r14
lea rcx, [rbp + 0x2f]
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [rsi + 0x60], bl
je 0x18008f7fe
cmp dword [rsi + 0x64], 0
jne 0x18008f6b7
cmp byte [rsi + 0x75], bl
jne 0x18008f6b7
mov ebx, r14d
cmp dword [rsi + 0x68], ebx
jl 0x18008f6b7
nop dword [rax]
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
inc ebx
cmp ebx, dword [rsi + 0x68]
jle 0x18008f660
cmp byte [rsi + 0x60], 0
je 0x18008f7fe
cmp dword [rsi + 0x64], 1
jne 0x18008f6f5
cmp byte [rsi + 0x75], 0
jne 0x18008f6f5
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [rsi + 0x60], 0
je 0x18008f7fe
cmp dword [rsi + 0x64], 1
jne 0x18008f796
cmp byte [rsi + 0x75], 0
jne 0x18008f796
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rcx, qword [rbp + 0x37]
mov rdx, rcx
sub rdx, qword [0x180318578]
mov rax, r12
imul rdx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, qword [0x180318580]
je 0x18008f749
jl 0x18008f796
mov qword [0x180318578], rcx
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movsxd rbx, dword [rsi + 0x6c]
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rcx, qword [rax]
mov qword [0x180318578], rcx
mov qword [0x180318580], rbx
cmp byte [rsi + 0x60], 0
je 0x18008f7fe
cmp dword [rsi + 0x64], 2
jne 0x18008f7fe
cmp byte [rsi + 0x74], 0
je 0x18008f7fe
cmp byte [rsi + 0x75], 0
jne 0x18008f7fe
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x201
mov r8d, 1
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x202
mov r8d, 1
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [rsi + 0x60], 0
je 0x18008fa18
cmp dword [rsi + 0x64], 2
jne 0x18008f8ba
cmp byte [rsi + 0x74], 0
je 0x18008f8ba
cmp byte [rsi + 0x75], 0
je 0x18008f8ba
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [rsi + 0x60], 0
je 0x18008fa18
cmp dword [rsi + 0x64], 0
jne 0x18008f939
cmp byte [rsi + 0x75], 0
je 0x18008f939
cmp dword [rsi + 0x68], 0
jl 0x18008f939
nop word [rax + rax]
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
inc r14d
cmp r14d, dword [rsi + 0x68]
jle 0x18008f8e0
cmp byte [rsi + 0x60], 0
je 0x18008fa18
cmp dword [rsi + 0x64], 1
jne 0x18008f977
cmp byte [rsi + 0x75], 0
je 0x18008f977
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [rsi + 0x60], 0
je 0x18008fa18
cmp dword [rsi + 0x64], 1
jne 0x18008fa18
cmp byte [rsi + 0x75], 0
je 0x18008fa18
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rcx, qword [rbp + 0x37]
mov rdx, rcx
sub rdx, qword [0x180318578]
mov rax, r12
imul rdx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, qword [0x180318580]
je 0x18008f9cb
jl 0x18008fa18
mov qword [0x180318578], rcx
movzx r9d, word [rbp + 0x33]
shl r9d, 0x10
movzx eax, word [rbp + 0x2f]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1803167a0]
call qword [sym.imp.USER32.dll_PostMessageA]
movsxd rbx, dword [rsi + 0x6c]
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rcx, qword [rax]
mov qword [0x180318578], rcx
mov qword [0x180318580], rbx
mov ecx, dword [rsi + 0x58]
mov dword [rbp + 0x37], ecx
mov ecx, dword [rsi + 0x5c]
mov dword [rbp + 0x3b], ecx
lea rcx, [rbp + 0x37]
call fcn.180083410
mov ecx, eax
mov eax, 0x3e8
cdq
idiv ecx
movsxd rbx, eax
lea rcx, [rbp + 0x37]
call fcn.18009abf0
mov rcx, qword [rax]
mov qword [0x1803185a0], rcx
mov qword [0x1803185a8], rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1800a9a10
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret