Function at 0x14018a930
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov ebx, dword [rcx + 0x3148]
lea r14, [rcx + 0x838]
lea rsi, [rcx + 0x18]
mov dword [rsp + 0x28], edx
mov r8, r14
mov r10, rsi
mov r15d, edx
mov rdi, rcx
mov r11d, 0x100
xor r12d, r12d
cmp qword [r8], r12
je 0x14018a9d1
mov r9, qword [r8 - 0x20]
mov rdx, qword [r8 - 8]
test r9, r9
jne 0x14018a99c
mov r9, r12
jmp 0x14018a99f
mov r9, qword [r9]
mov rax, qword [r9 + 0x10]
mov rcx, rdx
dec rax
shr rcx, 2
and rcx, rax
and edx, 3
mov rax, qword [r9 + 8]
mov rax, qword [rax + rcx*8]
mov ecx, dword [rax + rdx*4]
mov dword [r10], ecx
sub qword [r8], 1
jne 0x14018a9cd
mov qword [r8 - 8], r12
jmp 0x14018a9d1
inc qword [r8 - 8]
add r10, 4
add r8, 0x28
sub r11, 1
jne 0x14018a985
mov edx, dword [rdi + 0x3148]
cmp edx, 2
jne 0x14018aa9d
mov dword [rdi + 0x3148], 3
lea edx, [r11 + 3]
mov rcx, qword [rdi + 0x3138]
mov rax, qword [rcx]
cmp rax, rcx
je 0x14018aacb
nop
movsxd r8, dword [rax + 0x1c]
lea rdx, [r8 + r8*4]
cmp qword [rdi + rdx*8 + 0x838], r12
jne 0x14018aa8c
cmp byte [rdi + r8 + 0x3018], r12b
jne 0x14018aa8c
mov rdx, qword [rax + 0x10]
cmp byte [rdx + 0x19], r12b
je 0x14018aa58
mov rdx, qword [rax + 8]
cmp byte [rdx + 0x19], r12b
jne 0x14018aa53
cmp rax, qword [rdx + 0x10]
jne 0x14018aa53
mov rax, rdx
mov rdx, qword [rdx + 8]
cmp byte [rdx + 0x19], r12b
je 0x14018aa40
mov rax, rdx
jmp 0x14018aa7f
mov r8, qword [rdx]
mov rax, rdx
cmp byte [r8 + 0x19], r12b
jne 0x14018aa7f
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r8]
mov rax, r8
mov r8, rdx
cmp byte [rdx + 0x19], r12b
je 0x14018aa70
cmp rax, rcx
jne 0x14018aa10
mov edx, dword [rdi + 0x3148]
jmp 0x14018aacb
mov dword [rdi + 0x3148], 2
mov edx, 2
jmp 0x14018aacb
cmp edx, 3
jne 0x14018aacb
mov dword [rdi + 0x3130], 0xbf800000
mov edx, r12d
mov dword [rdi + 0x3134], 0xbf800000
mov qword [rdi + 0x3120], 0xffffffffffffffff
mov dword [rdi + 0x3148], r12d
cmp ebx, 2
jne 0x14018ab22
cmp edx, 3
jne 0x14018ab7c
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi + 0x3158]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rdi + 0x3168]
lea rcx, [rdi + 0x3168]
mov edx, dword [rsp + 0x20]
call qword [rax + 0x18]
mov rax, qword [rdi + 0x3168]
lea rcx, [rdi + 0x3168]
mov edx, dword [rsp + 0x24]
call qword [rax + 0x20]
jmp 0x14018ab7c
cmp ebx, 3
jne 0x14018ab7c
test edx, edx
jne 0x14018ab7c
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi + 0x3158]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rdi + 0x3168]
lea rcx, [rdi + 0x3168]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp dword [rsp + 0x20], eax
jne 0x14018ab7c
mov rax, qword [rdi + 0x3168]
lea rcx, [rdi + 0x3168]
call qword [rax + reloc.WS2_32.dll_recv]
cmp dword [rsp + 0x24], eax
jne 0x14018ab7c
mov dword [rdi + 0x3148], ebx
cmp dword [rdi + 0x3148], r12d
mov ebx, r12d
mov rbp, r12
setne al
mov byte [rdi + 0x3161], al
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x88]
cmp eax, 1
jbe 0x14018ac66
cmp qword [r14], r12
jne 0x14018ac66
cmp byte [rdi + rbp + 0x3018], r12b
jne 0x14018ac66
cmp ebx, 1
jne 0x14018abd7
cmp dword [rdi + 0x3148], ebx
je 0x14018ac66
cmp byte [rdi + 0x3160], r12b
je 0x14018abf4
cmp ebx, 1
jne 0x14018abea
lea ecx, [rbx + 1]
jmp 0x14018abf6
mov ecx, 1
cmp ebx, 2
je 0x14018abf6
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rsi]
test ax, ax
jns 0x14018ac55
test ecx, 0xfffffffb
je 0x14018ac27
mov dword [rsi], 2
mov eax, dword [rdi + 8]
add eax, dword [rsi + 0x400]
cmp eax, r15d
jae 0x14018ac34
mov dword [rsi], 3
jmp 0x14018ac34
mov dword [rsi], 1
mov dword [rsi + 0x400], r15d
cmp dword [rdi + 0x3148], 3
jne 0x14018ac66
lea eax, [rbx - 1]
cmp eax, 1
ja 0x14018ac66
mov dword [rdi + 0x3148], r12d
mov byte [rdi + 0x3161], r12b
jmp 0x14018ac66
lea eax, [rcx - 1]
mov ecx, 4
cmp eax, 2
cmova ecx, r12d
mov dword [rsi], ecx
inc ebx
inc rbp
add rsi, 4
add r14, 0x28
cmp ebx, 0x100
jl 0x14018aba0
mov rcx, qword [rdi + 0x3180]
test rcx, rcx
je 0x14018af2e
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov rcx, qword [rdi + 0x3180]
lea r8, [rsp + 0x30]
mov edx, 0x50
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
je 0x14018acd0
cmp eax, 0x8007001e
jne 0x14018af2e
mov rcx, qword [rdi + 0x3180]
mov rax, qword [rcx]
call qword [rax + gethostname]
jmp 0x14018af2e
mov rbx, qword [rsp + 0x4c]
lea r11, [rsp + 0x60]
mov esi, dword [rsp + 0x48]
lea r9, [rdi + 0x3188]
mov ebp, dword [rsp + 0x44]
lea rcx, [0x140000000]
mov r14d, dword [rsp + 0x40]
mov r10d, 0xffffffd0
mov r15d, dword [rsp + 0x3c]
mov r12d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x30]
nop word [rax + rax]
xor dl, dl
lea eax, [r10 + 0x30]
cmp eax, 0x20
jge 0x14018ad27
movzx edx, byte [r11]
shr dl, 7
jmp case.default.0x14018ad50
cmp eax, 0x30
jge 0x14018ae3b
lea eax, [r10 + 0x10]
cmp eax, 0xf
ja case.default.0x14018ad50
cdqe
mov ecx, dword [rcx + rax*4 + 0x18af5c]
lea rax, [0x140000000]
add rcx, rax
jmp rcx
cmp r8d, 0xfffffe0c
setle dl
jmp case.default.0x14018ad50
cmp dword [rsp + 0x34], 0xfffffe0c
setle dl
jmp case.default.0x14018ad50
cmp r8d, 0x1f4
setge dl
jmp case.default.0x14018ad50
cmp dword [rsp + 0x34], 0x1f4
setge dl
jmp case.default.0x14018ad50
cmp r12d, 0xfffffe0c
setle dl
jmp case.default.0x14018ad50
cmp r12d, 0x1f4
setge dl
jmp case.default.0x14018ad50
cmp r15d, 0xfffffe0c
setle dl
jmp case.default.0x14018ad50
cmp r14d, 0xfffffe0c
setle dl
jmp case.default.0x14018ad50
cmp r15d, 0x1f4
setge dl
jmp case.default.0x14018ad50
cmp r14d, 0x1f4
setge dl
jmp case.default.0x14018ad50
cmp ebp, 0xfffffe0c
setle dl
jmp case.default.0x14018ad50
cmp ebp, 0x1f4
setge dl
jmp case.default.0x14018ad50
cmp esi, 0xfffffe0c
setle dl
jmp case.default.0x14018ad50
cmp esi, 0x1f4
setge dl
jmp case.default.0x14018ad50
cmp ebx, 0xfffffe0c
setle dl
jmp case.default.0x14018ad50
cmp ebx, 0x1f4
setge dl
jmp case.default.0x14018ad50
mov ecx, r10d
mov eax, r10d
and ecx, 3
test r10d, r10d
jns 0x14018ae50
lea eax, [r10 + 3]
sub ecx, 4
sar eax, 2
movsxd r8, eax
mov eax, 0xffff
cmp word [rsp + r8*4 + 0x50], ax
je 0x14018aeb4
test ecx, ecx
je 0x14018aea2
sub ecx, 1
je 0x14018ae8e
sub ecx, 1
je 0x14018ae82
cmp ecx, 1
jne 0x14018aeb4
mov eax, dword [rsp + r8*4 + 0x50]
sub eax, 0x34bc
jmp 0x14018aeac
mov eax, dword [rsp + r8*4 + 0x50]
sub eax, 0x1194
jmp 0x14018aeac
mov eax, dword [rsp + r8*4 + 0x50]
sub eax, 0x1194
cmp eax, 0x6977
seta dl
jmp 0x14018aeb4
mov eax, dword [rsp + r8*4 + 0x50]
sub eax, 0x57e4
cmp eax, 0x2327
setbe dl
mov r8d, dword [rsp + 0x30]
mov eax, dword [r9]
test dl, dl
je 0x14018aefb
test eax, 0xfffffffb
je 0x14018aee7
mov eax, dword [r9 + 0x100]
mov dword [r9], 2
add eax, dword [rdi + 8]
cmp eax, dword [rsp + 0x28]
jae 0x14018af10
mov dword [r9], 3
jmp 0x14018af10
mov eax, dword [rsp + 0x28]
mov dword [r9 + 0x100], eax
mov dword [r9], 1
jmp 0x14018af10
dec eax
mov ecx, 4
cmp eax, 2
mov eax, 0
cmova ecx, eax
mov dword [r9], ecx
inc r10d
lea rcx, [0x140000000]
add r9, 4
inc r11
lea eax, [r10 + 0x30]
cmp eax, 0x40
jl 0x14018ad10
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14023ed20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret