Function at 0x140039df0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
movaps xmmword [r11 - 0x38], xmm6
mov rax, qword [0x14004b040]
xor rax, rsp
mov qword [rbp + 0x1f], rax
movss xmm6, dword [0x14004387c]
xorps xmm0, xmm0
movups xmmword [0x14004cfc0], xmm0
xor esi, esi
movabs r13, 0x7fffffffffffffff
movups xmmword [0x14004cfd0], xmm0
mov r15d, 0xff
movabs r14, 0x4e94914f0000
movups xmmword [0x14004cfe0], xmm0
movabs r12, 0x431bde82d7b634db
mov qword [r11 + 8], rdi
nop dword [rax]
mov rdx, qword [0x14004cff0]
lea rcx, [0x14004cfc0]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140039eb0
lea rcx, [0x14004cfc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x14004cfc0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0x23
mov rbx, rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x14003a550
mov rcx, qword [0x14004cfb8]
cmp rbx, rcx
jne 0x140039f13
mov edx, 3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindow]
mov rcx, qword [0x14004cff0]
xor r9d, r9d
mov dword [rsp + 0x30], 3
mov rdx, rax
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14004cfb8]
xorps xmm0, xmm0
mov qword [rbp - 0x11], rsi
lea rdx, [rbp - 1]
movups xmmword [rbp - 1], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x14004cfb8]
lea rdx, [rbp - 0x11]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp - 0x11]
lea rcx, [rbp + 0xf]
mov rbx, qword [0x14004cfb0]
mov dword [rbp - 1], eax
mov eax, dword [rbp - 0xd]
mov dword [rbp + 3], eax
mov rax, qword [0x14004cfb8]
mov qword [rbx + 0x108], rax
mov dword [rbx + 0x18], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0xf]
mov ecx, 1
sub eax, dword [rbp - 0x11]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x118], xmm0
mov eax, dword [rbp + 0x13]
sub eax, dword [rbp - 0xd]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x11c], xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140039fc1
mov byte [rbx + 0x120], 1
mov eax, dword [rbx + 0x11c]
mov dword [rbx + 0x3dc], eax
mov byte [rbx + 0x430], 1
jmp 0x140039fc8
mov byte [rbx + 0x120], sil
mov eax, dword [0x140082d80]
mov ecx, dword [rbp + 0xb]
mov edx, dword [rbp + 7]
cmp dword [rbp - 1], eax
jne 0x140039ff4
cmp edx, dword [0x140082d88]
jne 0x140039ff4
mov eax, dword [0x140082d84]
cmp dword [rbp + 3], eax
jne 0x140039ff4
cmp ecx, dword [0x140082d8c]
je 0x14003a055
movups xmm0, xmmword [rbp - 1]
mov r9d, dword [rbp - 0xd]
mov r8d, dword [rbp - 0x11]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov dword [0x14007e21c], edx
mov dword [0x14007e218], ecx
mov dword [0x14004d000], edx
xor edx, edx
mov dword [0x14004d004], ecx
mov rcx, qword [0x14004cff0]
movups xmmword [0x140082d80], xmm0
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14004d040]
lea rdx, [0x14004d000]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp qword [0x1400828c8], rsi
jne 0x14003a063
call fcn.14002d770
mov rcx, qword [0x1400828e8]
lea rdx, [rbp - 0x21]
mov rdi, qword [0x14004cfb0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x19]
lea rcx, [rbp + 0x17]
sub eax, dword [rbp - 0x21]
movd xmm1, eax
mov eax, dword [rbp - 0x15]
sub eax, dword [rbp - 0x1d]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x17]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1400828f0]
cvtsi2ss xmm0, qword [0x1400828f8]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1400828f0], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x130], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x131], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [0x14004cfb0]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x133], sil
mov byte [rdi + 0x132], al
lea rbx, [rcx + 0x118]
cmp byte [rcx + 0x3af], sil
je 0x14003a16a
cvttss2si eax, dword [rbx]
lea rdx, [rbp - 9]
mov dword [rbp - 9], eax
cvttss2si eax, dword [rcx + 0x11c]
mov rcx, qword [0x1400828e8]
mov dword [rbp - 5], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 5]
mov ecx, dword [rbp - 9]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x1400828e8]
jne 0x14003a1c2
lea rcx, [rbp - 0x29]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14003a1c2
mov rcx, qword [0x1400828e8]
lea rdx, [rbp - 0x29]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14003a1c2
movd xmm0, dword [rbp - 0x29]
movd xmm1, dword [rbp - 0x25]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xd0], sil
je 0x14003a1d2
mov eax, 0xffffffff
jmp 0x14003a1df
mov rax, qword [0x14004cfb0]
mov eax, dword [rax + 0x1d70]
cmp dword [0x14004c688], eax
je 0x14003a1f2
mov dword [0x14004c688], eax
call fcn.14002d8e0
call fcn.140010ed0
call fcn.140039b10
call fcn.14003a800
call fcn.140011fd0
mov rcx, qword [0x14004d040]
xor r8d, r8d
mov edx, 7
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x14004d040]
xor r8d, r8d
mov edx, 0x1b
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x14004d040]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x14004d040]
mov r9d, 1
mov dword [rsp + 0x30], esi
xor r8d, r8d
movss dword [rsp + 0x28], xmm6
xor edx, edx
mov dword [rsp + 0x20], esi
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x14004d040]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14003a2bb
call fcn.140012480
mov rax, qword [0x14004cfb0]
mov rcx, rsi
add rax, 0x1c70
cmp byte [rax], cl
cmovne rcx, rax
call fcn.14002ce70
mov rcx, qword [0x14004d040]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14004d040]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
lea rcx, [rbp - 0x39]
mov edi, eax
call fcn.140005140
mov rbx, qword [rbp - 0x39]
movabs rax, 0x7ffffffffff0bdbe
cmp rbx, rax
jg 0x14003a2ff
add rbx, 0xf4240
jmp 0x14003a302
mov rbx, r13
lea rcx, [rbp - 0x31]
call fcn.140005140
mov rax, qword [rbp - 0x31]
cmp rbx, rax
je 0x14003a364
mov ecx, 1
cmovl ecx, r15d
test cl, cl
jle 0x14003a364
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jge 0x14003a358
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003a34f
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14003a302
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14003a302
cmp edi, 0x88760868
jne 0x14003a40a
mov rcx, qword [0x14004d040]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14003a40a
cmp qword [0x1400828d8], rsi
je 0x14003a3ee
mov rcx, qword [0x1400828e0]
test rcx, rcx
je 0x14003a3aa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400828e0], rsi
mov rcx, qword [0x1400828d0]
test rcx, rcx
je 0x14003a3c3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400828d0], rsi
mov rcx, qword [0x1400828c8]
mov rbx, qword [0x14004cfb0]
test rcx, rcx
je 0x14003a3dc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400828c8], rsi
mov rax, qword [rbx + 0xa0]
mov qword [rax + 8], rsi
mov rcx, qword [0x14004d040]
lea rdx, [0x14004d000]
mov rax, qword [rcx]
call qword [rax + 0x80]
call fcn.14002d770
cmp dword [0x14004cfc8], 0x12
jne 0x140039e70
cmp qword [0x1400828d8], rsi
je 0x14003a47d
mov rcx, qword [0x1400828e0]
test rcx, rcx
je 0x14003a439
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400828e0], rsi
mov rcx, qword [0x1400828d0]
test rcx, rcx
je 0x14003a452
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400828d0], rsi
mov rcx, qword [0x1400828c8]
mov rbx, qword [0x14004cfb0]
test rcx, rcx
je 0x14003a46b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400828c8], rsi
mov rax, qword [rbx + 0xa0]
mov qword [rax + 8], rsi
mov rbx, qword [0x14004cfb0]
mov rcx, rbx
mov qword [0x1400828d8], rsi
mov qword [0x1400828e8], rsi
call fcn.140011760
cmp qword [0x14004cfb0], rbx
jne 0x14003a4aa
mov qword [0x14004cfb0], rsi
test rbx, rbx
je 0x14003a4d2
mov rcx, rbx
call fcn.14001e3a0
mov rax, qword [0x14004cfb0]
test rax, rax
je 0x14003a4c9
dec dword [rax + 0x3c8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14004d040]
test rcx, rcx
je 0x14003a4f4
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14004d040]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14004cff8]
test rcx, rcx
je 0x14003a506
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14004cff0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rax, qword [0x14004cfd0]
mov rdi, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14003c4e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3