Function at 0x14003fe80
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x14015bd4c]
sub eax, 1
je 0x140029ad9
sub eax, 3
je 0x140029a48
sub eax, 0xc
je 0x140029a48
cmp eax, 0x10
jne 0x140029b6b
mov rcx, qword [0x14015c2b0]
test rcx, rcx
je 0x140029b6b
mov rcx, qword [rcx + 8]
call sym.ProcessJacker.exe_PhReferenceServiceItem
mov rbx, rax
test rax, rax
je 0x140029b6b
movsxd r8, dword [0x14015c178]
xor r9d, r9d
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
mov edx, 0x8082
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
mov r9, rbx
xor r8d, r8d
mov edx, 0x8086
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
xor r9d, r9d
mov edx, 0x807f
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140029b6b
add rsp, 0x20
pop rbx
jmp fcn.1400ae900
mov rax, qword [0x14015c2b0]
lea rdx, [0x14015a8e0]
mov rcx, rax
shr rcx, 2
movzx ecx, cl
mov rcx, qword [rdx + rcx*8]
test rcx, rcx
je 0x140029b6b
nop word [rax + rax]
cmp rax, qword [rcx + 0x28]
lea rbx, [rcx - 0x40]
je 0x140029b18
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140029b00
add rsp, 0x20
pop rbx
ret
movsxd r8, dword [0x14015c1d8]
xor r9d, r9d
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
mov edx, 0x8082
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
mov r9, rbx
xor r8d, r8d
mov edx, 0x8085
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
xor r9d, r9d
mov edx, 0x807f
lea r8d, [r9 + 1]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rax, rdx
shr rax, 0x10
mov rsi, rdx
movzx edi, ax
mov ebx, ebp
cmp edi, 0x20
jae 0x14003fed5
lea rdx, [0x140159e30]
mov rdx, qword [rdx + rdi*8]
test rdx, rdx
je 0x14003fed5
mov rax, qword [rdx + 0x38]
mov rbx, rdx
test rax, rax
je 0x14003fed5
mov r9, qword [rdx + 0x10]
mov r8, rsi
mov rdx, rcx
mov rcx, rbx
call rax
test al, al
jne 0x14004020d
movzx ecx, si
cmp ecx, 0x205
jg 0x140040120
je 0x1400400ba
sub ecx, 0x7b
je 0x1400400ba
sub ecx, 0x186
je 0x14004004b
sub ecx, 1
je 0x14003ff73
cmp ecx, 1
jne 0x14004020d
lea rcx, str.IconSingleClick
call sym.ProcessJacker.exe_PhGetIntegerSetting
test eax, eax
jne 0x14004020d
cmp byte [0x14015f220], bpl
je 0x14003ff67
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
lea edx, [rax + 2]
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
lea r9, [0x140042380]
mov edx, 3
mov byte [0x14015c555], bpl
mov r8d, 0x3e8
mov byte [0x14015c554], 1
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
jmp 0x1400401fc
lea rcx, str.IconSingleClick
call sym.ProcessJacker.exe_PhGetIntegerSetting
test eax, eax
jne 0x14004020d
cmp byte [0x14015f220], bpl
je 0x14004020d
cmp byte [0x14015c555], bpl
je 0x14004020d
lea r8, [rsp + 0x58]
mov rdx, rbx
mov ecx, edi
call fcn.140042280
test al, al
je 0x14004002c
lea rcx, [0x14015c588]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r8, qword [0x14015c580]
test r8, r8
je 0x14003ffe3
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [0x14015c580], rbp
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003fff9
call sym.ProcessJacker.exe_PhDuplicateStringZ
mov qword [0x14015c580], rax
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
lea r9, [0x140042330]
mov edx, 2
lea r8d, [rax + 0x8c]
call qword [sym.imp.USER32.dll_SetTimer]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
mov edx, 2
call qword [sym.imp.USER32.dll_KillTimer]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.IconSingleClick
call sym.ProcessJacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400400a6
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8090
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
lea r9, [0x140042380]
mov edx, 3
mov byte [0x14015c554], 1
mov r8d, 0x3e8
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.USER32.dll_SetTimer]
mov byte [0x14015c555], 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.IconSingleClick
call sym.ProcessJacker.exe_PhGetIntegerSetting
test eax, eax
jne 0x1400400e3
cmp byte [0x14015f220], bpl
je 0x1400400e3
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
lea edx, [rax + 2]
call qword [sym.imp.USER32.dll_KillTimer]
or edx, 0xffffffff
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor r8d, r8d
lea ecx, [rdx + 2]
call fcn.140033fa0
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsp + 0x58]
call fcn.140029630
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
sub ecx, 0x401
je 0x1400401ea
sub ecx, 4
je 0x1400401d9
sub ecx, 1
je 0x14004016b
cmp ecx, 1
jne 0x14004020d
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov r8d, 0x15e
mov qword [rsp + 0x20], rbp
or edx, 0xffffffff
call fcn.140033fa0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp byte [0x14015f220], bpl
je 0x14004020d
cmp byte [0x14015c554], bpl
jne 0x14004020d
lea r8, [rsp + 0x60]
mov rdx, rbx
mov ecx, edi
call fcn.140042280
test al, al
je 0x14004020d
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x58]
mov edx, 1
mov qword [rsp + 0x28], rax
mov r9d, 4
mov rax, qword [rsp + 0x60]
xor r8d, r8d
mov ecx, edx
mov qword [rsp + 0x20], rax
call fcn.140033fa0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp 0x140029a20
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [sym.ProcessJacker.exe_PhMainWndHandle]
cmp rax, rcx
je 0x14004020d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8090
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret