Function at 0x140055ff0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x61f8]
mov eax, 0x62f8
call fcn.1400ab0e0
sub rsp, rax
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x61e0], rax
xor eax, eax
xor r13d, r13d
mov r15, r9
mov qword [rbp - 0x58], r9
mov r12, r8
mov qword [rbp + 0x28], r8
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov dword [rbp - 0x6c], eax
mov esi, edx
mov dword [rsp + 0x40], edx
mov r14, rcx
cmp edx, 0x4e
ja 0x1400564ec
je 0x140056221
cmp edx, 7
jb 0x140056919
cmp edx, 8
jbe 0x1400561f8
cmp edx, 0x14
je 0x1400560db
cmp edx, 0x20
jne 0x140056919
cmp rcx, qword [0x14012bbe8]
jne 0x1400560ae
mov rcx, qword [0x14012bc90]
jmp 0x1400560cb
xor ecx, ecx
cmp dword [0x140130fc4], eax
mov edx, 0x7f8a
jne 0x1400560c2
mov edx, 0x7f00
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x140056aa9
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140056919
lea rdx, [rbp + 0x38]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClientRect]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, r14
mov dword [rbp + 0x48], r13d
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rbp + 0x48]
mov edx, 0x100e
dec eax
mov rcx, r14
movsxd r8, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rbp + 0x50]
mov ecx, 5
mov dword [rbp + 0x18], eax
mov eax, dword [rbp + 0x40]
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x3c]
mov dword [rbp + 0x1c], eax
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x24], eax
call qword [sym.imp.USER32.dll_GetSysColorBrush]
lea rdx, [rbp + 0x18]
mov r8, rax
mov rcx, r12
call qword [sym.imp.USER32.dll_FillRect]
mov eax, dword [rbp + 0x38]
mov ecx, 5
mov dword [rbp + 0x18], eax
mov eax, dword [rbp + 0x40]
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x54]
mov dword [rbp + 0x1c], eax
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x24], eax
call qword [sym.imp.USER32.dll_GetSysColorBrush]
lea rdx, [rbp + 0x18]
mov r8, rax
mov rcx, r12
call qword [sym.imp.USER32.dll_FillRect]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1027
mov rcx, r14
mov dword [rbp + 0x48], r13d
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rbp + 0x48]
mov edx, 0x100e
movsxd r8, eax
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rbp + 0x40]
mov ecx, 5
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x4c]
mov qword [rbp + 0x18], r13
mov dword [rbp + 0x24], eax
call qword [sym.imp.USER32.dll_GetSysColorBrush]
lea rdx, [rbp + 0x18]
mov r8, rax
mov rcx, r12
call qword [sym.imp.USER32.dll_FillRect]
mov eax, 1
jmp 0x140056aa9
mov rcx, qword [0x14012bbd8]
cmp r14, rcx
jne 0x140056919
cmp r8, rcx
je 0x140056919
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x140056919
xor r9d, r9d
xor r8d, r8d
mov edx, 0x104e
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [r15], rax
jne 0x140056919
mov eax, dword [r15 + 0x10]
cmp eax, 0xfffffdee
je 0x14005635a
cmp eax, 0xfffffdf7
jne 0x140056919
or rbx, 0xffffffffffffffff
cmp dword [0x140126558], 1
mov eax, 0xfffffffc
lea rcx, [rbp]
cmovge ebx, eax
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.USER32.dll_ScreenToClient]
lea r9, [rbp]
xor r8d, r8d
mov edx, 0x1039
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x54], eax
cmp eax, 0xffffffff
je 0x140056317
mov r8d, dword [rbp + 0x10]
cmp r8d, 0xffffffff
je 0x140056317
mov edx, dword [rbp + 0xc]
lea r9, [rbp + 0x28]
mov rcx, r14
call fcn.140056ad0
mov eax, dword [rbp + 0x28]
lea rdx, [rbp]
mov dword [rbp], eax
mov eax, dword [rbp + 0x2c]
mov rcx, r14
mov dword [rbp + 4], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edi, dword [rbp + 4]
add ebx, dword [rbp]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x104e
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x30], reloc.COMCTL32.dll_InitCommonControls
lea r9d, [rdi - 1]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
jmp 0x140056aa9
mov edi, dword [rbp + 4]
add ebx, dword [rbp]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x104e
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x30], reloc.OLEAUT32.dll_SafeArrayGetDim
lea r9d, [rdi - 1]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x140056919
cmp dword [0x140126558], 1
jge 0x140056919
mov rcx, qword [0x140126ae0]
mov r9, r12
mov r8d, 0x4e
mov rdx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_CallWindowProcW]
lea rcx, [rbp]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.USER32.dll_ScreenToClient]
lea r9, [rbp]
xor r8d, r8d
mov edx, 0x1039
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x1400564e4
test byte [rbp + 8], 0xe
je 0x1400564e4
mov eax, dword [rbp + 0x10]
test eax, eax
js 0x1400564e4
lea rcx, [rbp + 0x1e0]
mov dword [rsp + 0x58], eax
mov eax, dword [rbp + 0xc]
mov qword [rsp + 0x68], rcx
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rcx, r14
mov edx, 0x104b
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x70], 0x1000
mov dword [rsp + 0x54], eax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp word [rbp + 0x1e0], r13w
je 0x1400564db
movsxd r8, dword [rbp + 0x10]
lea r9, [rbp - 0x50]
mov edx, 0x105f
mov rcx, r14
mov dword [rbp - 0x50], 2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetDC]
mov rdx, qword [0x140126ac8]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea r9, [rbp + 0x28]
lea rdx, [rbp + 0x1e0]
or r8d, 0xffffffff
mov rcx, rbx
mov dword [rsp + 0x20], 0xd00
call qword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [rbp + 0x30]
sub ecx, dword [rbp + 0x28]
add ecx, 6
cmp ecx, dword [rbp - 0x48]
jle 0x1400564be
movsxd r8, dword [rbp + 0x10]
lea rax, [rbp + 0x1e0]
lea rdx, str.hitrow
mov rcx, r14
mov qword [r15 + 0x18], rax
call qword [sym.imp.USER32.dll_SetPropW]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, rdi
jmp 0x140056aa9
mov qword [r15 + 0x18], r13
mov rdx, rbx
mov rcx, r14
mov word [r15 + 0x20], r13w
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, rdi
jmp 0x140056aa9
mov qword [r15 + 0x18], r13
mov word [r15 + 0x20], r13w
mov rax, rdi
jmp 0x140056aa9
cmp edx, 0x100
je 0x140056650
cmp edx, 0x200
jne 0x140056919
cmp dword [0x140126558], 1
jge 0x140056597
xor r9d, r9d
xor r8d, r8d
mov edx, 0x104e
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor r8d, r8d
mov rcx, r14
test eax, eax
je 0x140056575
movsx eax, r15w
lea r9, [rbp]
mov edx, 0x1039
mov dword [rbp], eax
mov rax, r15
shr rax, 0x10
cwde
mov dword [rbp + 4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x140056597
lea rdx, str.hitrow
mov rcx, r14
call qword [sym.imp.USER32.dll_GetPropW]
cmp dword [rbp + 0x10], eax
je 0x140056597
xor r8d, r8d
mov rcx, r14
xor r9d, r9d
mov edx, 0x104e
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x41c
call qword [sym.imp.USER32.dll_SendMessageW]
cmp r14, qword [0x14012bbf0]
jne 0x140056919
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.USER32.dll_ScreenToClient]
lea r9, [rbp]
xor r8d, r8d
mov edx, 0x1039
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x140056919
movsxd rax, dword [rbp + 0x10]
lea rcx, [0x140127110]
cmp dword [rcx + rax*4], 0x686
jne 0x140056919
mov eax, dword [rbp + 0xc]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x104b
mov rcx, r14
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x54], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x1a0]
call fcn.1400a3fe0
test al, al
je 0x140056919
mov rcx, qword [0x140126550]
lea rdx, [0x1400e1e88]
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x140056919
mov rax, r8
sub rax, 9
je 0x140056a1f
sub rax, 4
je 0x1400569cb
sub rax, 0x16
je 0x14005696c
dec rax
je 0x140056939
cmp rax, 0x1f
jne 0x1400568fc
cmp rcx, qword [0x14012bbd8]
je 0x1400568fc
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x1400568fc
mov edx, 0xffffffeb
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
lea r9, [rbp + 0x60]
mov edx, 0x103b
mov r8d, eax
mov rcx, r14
mov rbx, rax
mov qword [rbp - 0x60], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x14005673f
mov edx, r13d
test ebx, ebx
je 0x14005673f
cmp ebx, 8
jb 0x140056725
movdqa xmm1, xmmword [0x1400e6410]
mov eax, ebx
mov r8d, ebx
and eax, 7
sub r8d, eax
lea ecx, [rdx + 4]
movd xmm0, edx
mov eax, edx
add edx, 8
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movdqu xmmword [rbp + rax*4 + 0x60], xmm0
movd xmm0, ecx
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movdqu xmmword [rbp + rcx*4 + 0x60], xmm0
cmp edx, r8d
jb 0x1400566f2
cmp edx, ebx
jae 0x14005673f
lea rcx, [rbp + 0x60]
mov eax, edx
lea rcx, [rcx + rax*4]
mov dword [rcx], edx
inc edx
lea rcx, [rcx + 4]
cmp edx, ebx
jb 0x140056733
or rax, 0xffffffffffffffff
xor edi, edi
mov edx, 0x100c
lea r9d, [rdi + 2]
mov rcx, r14
mov r8, rax
mov rsi, r13
mov dword [rsp + 0x54], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
mov dword [rsp + 0x54], eax
cmp eax, 0xffffffff
je 0x1400568c3
xor eax, eax
mov r15d, eax
test ebx, ebx
je 0x140056874
lea r12, [rbp + 0x60]
mov eax, dword [r12]
movsxd r8, ecx
lea r9, [rbp - 0x50]
mov dword [rbp - 0x48], eax
lea rax, [rbp + 0x21e0]
mov edx, 0x1073
mov rcx, r14
mov dword [rbp - 0x30], 0x2000
mov qword [rbp - 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0x21e0]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400567c0
add r13d, 2
add r13d, eax
test rdi, rdi
je 0x140056807
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [r13 + 1]
xor r8d, r8d
movsxd rbx, eax
mov rcx, rsi
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
jmp 0x140056831
lea eax, [r13 + 1]
mov ecx, 0x2002
movsxd rbx, eax
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
xor eax, eax
mov word [rdi], ax
lea r8, [rbp + 0x21e0]
mov rdx, rbx
mov rcx, rdi
call fcn.1400abdb0
inc r15d
cmp r15d, dword [rbp - 0x60]
jae 0x14005685e
lea r8, [0x1400d22c4]
mov rdx, rbx
mov rcx, rdi
call fcn.1400abdb0
mov rbx, qword [rbp - 0x60]
add r12, 4
cmp r15d, ebx
jae 0x140056874
mov ecx, dword [rsp + 0x54]
jmp 0x140056782
lea eax, [r13 + 1]
lea r8, [0x1400d22d0]
mov rcx, rdi
movsxd rdx, eax
call fcn.1400abdb0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movsxd r8, dword [rsp + 0x54]
mov edx, 0x100c
mov r9d, 2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
mov dword [rsp + 0x54], eax
cmp eax, 0xffffffff
jne 0x140056771
mov r15, qword [rbp - 0x58]
mov r12, qword [rbp + 0x28]
mov rcx, r14
call qword [sym.imp.USER32.dll_SetFocus]
test rsi, rsi
je 0x1400568f8
mov rcx, r14
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400568f8
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rsi
mov ecx, ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetParent]
mov r9, r15
mov r8, r12
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140126ae0]
mov r9, r12
mov r8d, esi
mov rdx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_CallWindowProcW]
jmp 0x140056aa9
lea r9, [rbp - 0x50]
xor r8d, r8d
mov edx, 0x102b
mov dword [rbp - 0x40], 3
mov dword [rbp - 0x44], 3
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, 0x1013
mov rcx, r14
xor r8d, r8d
jmp 0x140056aa1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov dword [rbp - 0x40], 3
mov dword [rbp - 0x44], 3
call qword [sym.imp.USER32.dll_SendMessageW]
dec eax
lea r9, [rbp - 0x50]
mov edx, 0x102b
movsxd r8, eax
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x1013
mov rcx, r14
dec eax
xor r9d, r9d
movsxd r8, eax
jmp 0x140056aa1
cmp rcx, qword [0x14012bbd8]
jne 0x1400569db
mov ebx, 0x65
jmp 0x1400569ef
cmp rcx, qword [0x14012bbf0]
mov ebx, 0x66
mov eax, 0x68
cmove ebx, eax
mov r9d, 2
or r8, 0xffffffffffffffff
mov edx, 0x100c
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x54], eax
cmp eax, 0xffffffff
je 0x140056aa7
xor edx, edx
mov ecx, ebx
call fcn.1400598d0
jmp 0x140056aa7
mov rbx, qword [0x14012bbd8]
cmp rcx, rbx
jne 0x140056a41
mov rbx, qword [0x14012bbe8]
cmp byte [0x14012ae04], r13b
cmovne rbx, qword [0x14012bbf0]
mov r9d, 2
or r8, 0xffffffffffffffff
mov edx, 0x100c
mov rcx, rbx
mov qword [rsp + 0x54], r13
mov dword [rsp + 0x60], 2
mov dword [rsp + 0x50], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
cmp eax, 0xffffffff
cmove eax, r13d
mov dword [rsp + 0x54], eax
call qword [sym.imp.USER32.dll_SetFocus]
movsxd r8, dword [rsp + 0x54]
mov dword [rbp - 0x40], 3
mov dword [rbp - 0x44], 3
lea r9, [rbp - 0x50]
mov edx, 0x102b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov rcx, qword [rbp + 0x61e0]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x62f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r10, rdx
cmp ecx, 0x65
jne 0x14005b766
movzx ecx, word [rdx + 0x18]
cmp cx, 0x24
ja 0x14005b766
movabs rdx, 0x1800002200
bt rdx, rcx
jae 0x14005b766
movzx r8d, cx
mov rcx, qword [r10]
xor r9d, r9d
mov edx, 0x100
jmp 0x140055ff0
xor eax, eax
ret