Function at 0x1400a7574
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x108
lea r12, [0x1400e3de0]
mov rdi, r9
mov rcx, r12
call fcn.140004570
movsxd rcx, eax
mov dword [rbp + 0x68], eax
mov rax, qword [0x1400e3e80]
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdi + 0x10]
mov r15, qword [rcx]
mov ecx, 0xfffffe6e
cmp eax, ecx
ja 0x1400a789d
je 0x1400a7829
cmp eax, 0xfffffd09
je 0x1400a77fe
cmp eax, 0xfffffd0e
je 0x1400a77ed
cmp eax, 0xfffffd0f
je 0x1400a77c5
cmp eax, 0xfffffd16
je 0x1400a77c0
cmp eax, 0xfffffdd9
je 0x1400a77a7
cmp eax, 0xfffffdda
je 0x1400a7745
cmp eax, 0xfffffdee
je 0x1400a76bc
cmp eax, 0xfffffe3d
je 0x1400a7829
cmp eax, 0xfffffe64
jne 0x1400a7f3a
mov rsi, qword [rdi]
mov edx, 0xfffffff0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 8
jae 0x1400a7f3a
mov eax, reloc.OLEAUT32.dll_RegisterActiveObject
cmp word [rdi + 0x18], ax
jne 0x1400a7f3a
lea r8d, [rax - 0x17]
xor r9d, r9d
mov edx, 0x110a
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400a7f3a
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x113e
mov rcx, rsi
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1400a7f3a
mov edx, dword [rbp - 0x60]
xor r8d, r8d
call fcn.1400a58f8
jmp 0x1400a7f3a
xor ebx, ebx
cmp qword [r15 + 0x2b0], rbx
je 0x1400a7f3a
mov edx, dword [0x1400e3ec4]
lea ecx, [rbx + 3]
cmp edx, ecx
jl 0x1400a7f3a
mov r10, qword [0x1400e3ea8]
lea esi, [rbx + 1]
lea r8d, [rbx + 0x18]
mov rax, qword [r8 + r10]
mov r9, qword [rax]
test r9, r9
je 0x1400a7704
movzx eax, byte [r9 + 0xff]
cmp rax, qword [rdi + 8]
je 0x1400a770e
add ecx, esi
add r8, 8
cmp ecx, edx
jle 0x1400a76ea
cmp ecx, edx
jg 0x1400a7f3a
movsxd rcx, ecx
mov r8d, 0x4f
mov rdx, qword [r10 + rcx*8]
lea rcx, [rdi + 0x20]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0xa0]
call fcn.1400287b8
mov word [rdi + 0xbe], bx
mov rax, rsi
jmp 0x1400a7f56
mov ecx, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400a7f3a
mov ecx, 9
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400a7f3a
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, reloc.WSOCK32.dll_recv
mov r14, rax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400a7799
dec r14d
jmp 0x1400a779c
inc r14d
mov r8d, r14d
mov edx, dword [rdi + 8]
jmp 0x1400a76b2
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, rax
jmp 0x1400a779f
mov r8d, eax
jmp 0x1400a779f
mov esi, 1
cmp byte [r15 + 0x2c6], sil
jne 0x1400a77de
mov edx, dword [rdi + 8]
mov r8d, eax
call fcn.1400a58f8
xor ebx, ebx
mov word [r15 + 0x2c5], bx
jmp 0x1400a7f3a
mov esi, 1
mov byte [r15 + 0x2c5], sil
jmp 0x1400a7f3a
xor ebx, ebx
mov esi, 1
mov byte [r15 + 0x2c6], sil
cmp byte [r15 + 0x2c5], bl
jne 0x1400a7f3a
mov byte [r15 + 0x2c6], bl
mov r8d, dword [rdi + 0x10]
jmp 0x1400a779f
mov rcx, qword [rdi]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400a7f3a
mov rcx, qword [rdi]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1400a7f3a
mov rax, qword [rdi + 0x88]
cmp qword [rdi + 0x50], rax
je 0x1400a7f3a
cmp dword [rdi + 0x18], 0x1000
je 0x1400a7f3a
mov esi, 1
cmp dword [rdi + 0x18], esi
jmp 0x1400a76a6
cmp eax, 0xfffffec0
je 0x1400a7f2b
cmp eax, 0xfffffed4
je 0x1400a7f2b
cmp eax, 0xffffff93
je 0x1400a7e65
cmp eax, 0xffffff94
je 0x1400a7db7
cmp eax, 0xfffffff0
je 0x1400a7dac
cmp eax, 0xfffffff4
je 0x1400a7c92
cmp eax, 0xfffffffb
je 0x1400a7a40
cmp eax, 0xfffffffe
jne 0x1400a7f3a
mov r8d, 1
mov rdx, r15
mov rcx, r12
call fcn.1400041b8
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rdi]
mov rcx, r12
call fcn.14000451c
cmp eax, 0xffffffff
je 0x1400a7f3a
movsxd rcx, eax
mov rax, qword [0x1400e3ea8]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov cl, byte [rax + 0xfc]
cmp cl, 0x10
jb 0x1400a7f3a
cmp cl, 0x11
jbe 0x1400a79b0
cmp cl, 0x13
jne 0x1400a7f3a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x1012
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x1400a7f3a
mov rcx, qword [rdi]
lea r9, [rbp - 0x50]
xor r8d, r8d
mov edx, 0x104b
mov dword [rbp - 0x4c], eax
mov dword [rbp - 0x50], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x40], 0xe
je 0x1400a7f3a
mov edx, dword [rbp - 0x28]
jmp 0x1400a76af
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1111
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400a7f3a
mov rcx, qword [rdi]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], reloc.WSOCK32.dll_ioctlsocket
mov dword [rbp - 0x7c], 0xf000
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x58], 0x46
je 0x1400a7f3a
mov rcx, qword [rdi]
xor r9d, r9d
mov ebx, 0x110b
lea r8d, [r9 + 9]
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rsp + 0x60]
mov r8d, 9
mov edx, ebx
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400a7f3a
xor ebx, ebx
mov rdx, r15
mov rcx, r12
lea esi, [rbx + 1]
mov r13b, bl
mov r8d, esi
call fcn.1400041b8
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rdi]
mov rcx, r12
call fcn.14000451c
mov r14d, eax
mov dword [rbp + 0x50], eax
cmp eax, 0xffffffff
jne 0x1400a7aab
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, r12
mov rdx, rax
call fcn.14000451c
mov r14d, eax
mov dword [rbp + 0x50], eax
cmp eax, 0xffffffff
je 0x1400a7f3a
mov r13b, sil
mov rax, qword [0x1400e3ea8]
movsxd rcx, r14d
mov r12d, r14d
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov cl, byte [rax + 0xfc]
cmp cl, 0x10
je 0x1400a7bbb
cmp cl, 0x13
jne 0x1400a7f3a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x1012
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jle 0x1400a7b6b
test r13b, r13b
jne 0x1400a7b6b
mov rcx, qword [rdi]
lea r9, [rbp - 0x50]
xor r8d, r8d
mov edx, 0x104b
mov dword [rbp - 0x4c], eax
mov dword [rbp - 0x50], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400a7f3a
test byte [rsp + 0x40], 0xe
je 0x1400a7b6b
mov edx, dword [rbp - 0x28]
lea r9, [rbp + 0x50]
lea r8, [rbp + 0x68]
lea rcx, [0x1400e3de0]
call fcn.1400042a0
test al, al
je 0x1400a7b6b
mov rax, qword [0x1400e3ea8]
movsxd r14, dword [rbp + 0x50]
mov rcx, qword [rax + r14*8]
mov rax, qword [rcx]
test rax, rax
je 0x1400a7b68
cmp qword [rax + 0x18], rbx
jne 0x1400a7b6b
mov r14d, r12d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [0x1400e3ea8]
movsxd rcx, r14d
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a7f3a
mov rax, qword [r15]
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x1400a7f3a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1111
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400a7c3f
mov rcx, qword [rdi]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x58], 0x46
je 0x1400a7c3f
mov edx, dword [rbp - 0x60]
lea r9, [rbp + 0x50]
lea r8, [rbp + 0x68]
lea rcx, [0x1400e3de0]
call fcn.1400042a0
test al, al
je 0x1400a7c3f
movsxd r14, dword [rbp + 0x50]
mov rax, qword [0x1400e3ea8]
mov rcx, qword [rax + r14*8]
mov rax, qword [rcx]
cmp qword [rax + 0x18], rbx
cmove r14d, r12d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [0x1400e3ea8]
movsxd rcx, r14d
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a7f3a
mov rax, qword [r15]
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov edx, 0x80
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x1400a773d
mov rdx, qword [rdi]
mov rcx, r12
call fcn.14000451c
mov dword [rbp + 0x50], eax
cmp eax, 0xffffffff
je 0x1400a7f3a
mov r11, qword [0x1400e3ea8]
cdqe
mov rax, qword [r11 + rax*8]
mov rdx, qword [rax]
mov al, byte [rdx + 0xfc]
cmp al, 0x10
je 0x1400a7ccb
cmp al, 0x13
jne 0x1400a7f3a
mov ecx, dword [rdi + 0x18]
dec ecx
je 0x1400a7da2
cmp ecx, 0x10000
jne 0x1400a7f3a
xor ebx, ebx
cmp dword [rdx + 0x90], 0xfe000000
mov edx, dword [rdi + 0x48]
lea esi, [rbx + 1]
lea r9, [rbp + 0x50]
lea r8, [rbp + 0x68]
movzx r15d, bl
mov rcx, r12
cmove r15d, esi
call fcn.1400042a0
test al, al
jne 0x1400a7d17
xor eax, eax
jmp 0x1400a7f56
movsxd r14, dword [rbp + 0x50]
mov edx, 0xfffffff0
mov rax, qword [r11 + r14*8]
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x68]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1b
jb 0x1400a7d10
test byte [rdi + 0x40], 0x10
mov rdx, qword [0x1400e3ea8]
jne 0x1400a7d4a
test byte [rdi + 0x40], sil
je 0x1400a7d5e
mov rax, qword [rdx + r14*8]
mov rcx, qword [rax]
cmp byte [rcx + 0xfc], 0x14
jne 0x1400a7f3a
mov rax, qword [rdx + r14*8]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x94]
cmp eax, 0xffffffff
je 0x1400a7d7a
mov dword [rdi + 0x50], eax
mov rdx, qword [0x1400e3ea8]
mov rax, qword [rdx + r14*8]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x90]
test eax, eax
js 0x1400a7d10
test r15b, r15b
je 0x1400a7d9a
test byte [rdi + 0x38], sil
je 0x1400a7d10
mov dword [rdi + 0x54], eax
jmp 0x1400a7d10
mov eax, reloc.OLEAUT32.dll_RegisterActiveObject
jmp 0x1400a7f56
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x1400a7f3a
mov r14d, dword [rdi + 8]
lea r9, [rbp + 0x50]
lea r8, [rbp + 0x68]
mov edx, r14d
mov rcx, r12
call fcn.1400042a0
xor ebx, ebx
test al, al
je 0x1400a7f3a
mov rax, qword [0x1400e3ea8]
movsxd rsi, dword [rbp + 0x50]
xor r8d, r8d
mov rcx, qword [rax + rsi*8]
movzx eax, word [rdi + 0x1c]
mov rdx, qword [rcx]
mov word [rdx + 0x102], ax
mov edx, dword [rdi + 8]
call fcn.1400a58f8
mov rdx, qword [0x1400e3ea8]
mov rax, qword [rdx + rsi*8]
mov rcx, qword [rax]
cmp qword [rcx + 0x50], rbx
jbe 0x1400a7f3a
mov dword [0x1400e3e38], r14d
mov rax, qword [rdx + rsi*8]
lea rcx, [0x1400e3e40]
mov rdx, qword [rax]
add rdx, 0x48
call fcn.14001f504
mov rax, qword [0x1400e3ea8]
lea r9, [0x1400a58e8]
mov rcx, qword [rax + rsi*8]
mov edx, 0x1030
mov rax, qword [rcx]
mov cl, byte [rax + 0x104]
mov byte [0x1400e3e60], cl
movsxd r8, dword [rdi + 0x1c]
jmp 0x1400a7a32
mov rcx, qword [0x1400e3f00]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.COMCTL32.dll_ImageList_SetDragCursorImage]
mov rcx, qword [0x1400e3f00]
xor edx, edx
lea r9d, [rdx - 0x10]
lea r8d, [rdx - 8]
call qword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
mov r14, qword [rbp + 0x58]
mov rcx, r14
call qword [sym.imp.USER32.dll_SetCapture]
mov r15, qword [rbp + 0x60]
xor ebx, ebx
lea esi, [rbx + 1]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov dword [0x1400e3f08], r15d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], esi
call fcn.140006850
lea rdx, str._GUI_DRAGID
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x38], r15d
call fcn.14001f29c
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r9d, esi
mov dword [rsp + 0x20], 2
call fcn.140004fa4
lea rcx, [rsp + 0x50]
call fcn.14001c5f8
mov rcx, qword [rdi]
lea rdx, [rdi + 0x2c]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r8d, dword [rdi + 0x30]
mov edx, dword [rdi + 0x2c]
xor ecx, ecx
call qword [sym.imp.COMCTL32.dll_ImageList_DragEnter]
lea rcx, [rsp + 0x38]
call fcn.140006850
jmp 0x1400a7f42
mov rcx, qword [rdi]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov r14, qword [rbp + 0x58]
mov r15, qword [rbp + 0x60]
movsxd r8, r15d
mov r9, rdi
mov edx, 0x4e
mov rcx, r14
call qword [sym.imp.USER32.dll_DefDlgProcW]
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret