Function at 0x1000cdc3
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [0x10016b88]
call fcn.1000ee82
mov edi, eax
xor ebx, ebx
cmp dword [edi], ebx
mov dword [ebp - 4], 0xd0d0d0d1
jne 0x1000cf42
cmp dword [ebp + 0xc], 0x112
jne 0x1000d19f
mov esi, dword [ebp + 0x10]
mov eax, esi
and eax, 0xfff0
cmp eax, 0xf000
jne 0x1000d19f
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0x26
call dword [sym.imp.USER32.DLL_SystemParametersInfoA]
cmp dword [ebp - 8], ebx
je 0x1000d19f
lea eax, [edi + 0x10]
and esi, 0xf
push eax
push dword [ebp + 8]
mov dword [edi + 0x30], esi
mov esi, dword [sym.imp.USER32.DLL_GetWindowRect]
mov dword [edi], 1
call esi
lea eax, [edi + 0x20]
push eax
push dword [ebp + 8]
call esi
mov esi, dword [sym.imp.USER32.DLL_GetSystemMetrics]
push 0x3d
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
call esi
push 0x3e
mov dword [edi + 0x3c], eax
call esi
push 0xfffffffffffffff0
push dword [ebp + 8]
mov dword [edi + 0x40], eax
call dword [sym.imp.USER32.DLL_GetWindowLongA]
test eax, 0x800000
je 0x1000ce7b
push 5
call esi
push 6
jmp 0x1000ce92
push 0xffffffffffffffec
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongA]
test ax, 0x100
je 0x1000ce9c
push 0x2d
call esi
push 0x2e
mov dword [edi + 0x44], eax
call esi
mov dword [edi + 0x48], eax
jmp 0x1000cea2
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
push 0x22
call esi
push 0x23
mov dword [edi + 0x4c], eax
call esi
push 0x3b
mov dword [edi + 0x50], eax
call esi
push 0x3c
mov dword [edi + 0x54], eax
call esi
mov esi, dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [edi + 0x58], eax
lea eax, [edi + 0x34]
push eax
push ebx
push 0x24
push dword [ebp + 8]
call esi
push 1
call dword [sym.imp.USER32.DLL_GetKeyState]
test ax, ax
jne 0x1000ceea
push ebx
push 1
push 0x201
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SetCapture]
push ebx
push ebx
push 0x231
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_PostMessageA]
cmp dword [edi + 0x30], ebx
jne 0x1000cf3a
mov dword [edi + 4], 1
add edi, 8
push edi
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0x8040
push ebx
push ebx
push 2
push 0x7f86
push ebx
call dword [sym.imp.USER32.DLL_LoadImageA]
push eax
call dword [sym.imp.USER32.DLL_SetCursor]
jmp 0x1000d19c
mov dword [edi + 4], ebx
jmp 0x1000d19c
mov eax, dword [ebp + 0xc]
cmp eax, 0x200
jne 0x1000cfad
mov eax, dword [ebp + 0x14]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [edi + 4], ebx
push 1
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ecx
call dword [sym.imp.USER32.DLL_MapWindowPoints]
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, edi
call fcn.1000cc45
pop ecx
lea esi, [edi + 0x10]
push esi
push dword [edi + 0x30]
push 0x214
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SendMessageA]
sub esp, 0x10
mov edi, esp
push dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000cd27
add esp, 0x14
jmp 0x1000d19c
cmp eax, 0x100
jne 0x1000d16b
mov eax, dword [ebp + 0x10]
sub eax, 0xd
je 0x1000d163
sub eax, 0xe
je 0x1000d163
push 0xa
pop esi
sub eax, esi
je 0x1000d10e
dec eax
je 0x1000d0b1
dec eax
je 0x1000d05e
dec eax
jne 0x1000d19f
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
mov ecx, dword [edi + 0x30]
cmp ecx, ebx
jne 0x1000d011
mov eax, dword [edi + 0x1c]
dec eax
dec eax
mov dword [edi + 0x30], 6
push eax
push dword [ebp - 0x10]
push 0x7f85
jmp 0x1000d04c
push 2
pop eax
cmp ecx, eax
jne 0x1000d032
mov ecx, dword [edi + 0x1c]
sub ecx, eax
push ecx
mov ecx, dword [edi + 0x18]
mov dword [edi + 0x30], 8
sub ecx, eax
push ecx
push 0x7f82
jmp 0x1000d04c
cmp ecx, 1
jne 0x1000d056
mov ecx, dword [edi + 0x1c]
sub ecx, eax
push ecx
push dword [edi + 0x10]
mov dword [edi + 0x30], 7
push 0x7f83
call fcn.1000cc17
jmp 0x1000d15e
add dword [ebp - 0xc], esi
jmp 0x1000d14e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
mov eax, dword [edi + 0x30]
cmp eax, ebx
jne 0x1000d085
mov ecx, dword [edi + 0x18]
push 2
pop eax
mov dword [edi + 0x30], eax
push dword [ebp - 0xc]
sub ecx, eax
push ecx
push 0x7f84
jmp 0x1000d04c
cmp eax, 3
jne 0x1000d09c
mov eax, dword [edi + 0x18]
push dword [edi + 0x14]
dec eax
dec eax
mov dword [edi + 0x30], 5
push eax
jmp 0x1000d047
cmp eax, 6
jne 0x1000d0a9
push 2
pop eax
jmp 0x1000d018
add dword [ebp - 0x10], esi
jmp 0x1000d14e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
mov ecx, dword [edi + 0x30]
cmp ecx, ebx
jne 0x1000d0d1
push dword [edi + 0x14]
mov dword [edi + 0x30], 3
jmp 0x1000d007
push 2
pop eax
cmp ecx, eax
jne 0x1000d0ed
mov ecx, dword [edi + 0x18]
push dword [edi + 0x14]
sub ecx, eax
mov dword [edi + 0x30], 5
push ecx
jmp 0x1000d047
cmp ecx, 1
jne 0x1000d109
mov ecx, dword [edi + 0x14]
add ecx, eax
push ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x30], 4
add ecx, eax
jmp 0x1000d02a
sub dword [ebp - 0xc], esi
jmp 0x1000d14e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
mov eax, dword [edi + 0x30]
cmp eax, ebx
jne 0x1000d131
mov dword [edi + 0x30], 1
push dword [ebp - 0xc]
push dword [edi + 0x10]
jmp 0x1000d07e
cmp eax, 3
jne 0x1000d13b
push 2
pop eax
jmp 0x1000d0f2
cmp eax, 6
jne 0x1000d14b
mov eax, dword [edi + 0x1c]
dec eax
dec eax
push eax
jmp 0x1000d03d
sub dword [ebp - 0x10], esi
push dword [ebp - 0xc]
mov eax, edi
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.1000cd75
add esp, 0xc
jmp 0x1000d19f
call dword [sym.imp.USER32.DLL_ReleaseCapture]
jmp 0x1000d19c
cmp eax, 0x202
je 0x1000d163
cmp eax, 0x215
jne 0x1000d19f
push ebx
push ebx
push 0x232
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_PostMessageA]
cmp dword [edi + 4], ebx
mov dword [edi], ebx
je 0x1000d19c
push dword [edi + 0xc]
push dword [edi + 8]
call dword [sym.imp.USER32.DLL_SetCursorPos]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10