Function at 0x1001f460
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1007c080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
cmp byte [edi + 0x24], 0
jne 0x1001f4b5
cmp dword [edi + 0x74], 0
je 0x1001f7f2
lea ecx, [edi + 0x6c]
call fcn.10019db0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037c60
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [0x7f94cc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1007cba8]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1001f56f
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x13
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x6c]
call fcn.10023260
mov eax, dword [eax]
cmp byte [eax + 0xc], 0
je 0x1001f56c
mov eax, dword [0x1007cba8]
mov eax, dword [eax]
test eax, eax
jne 0x1001f504
push 1
mov ecx, edi
call fcn.1001eb60
jmp 0x1001f509
cmp eax, 5
jne 0x1001f56c
movss xmm0, dword [edi + 0x3c]
movss xmm1, dword [edi + 8]
movss dword [ebp - 8], xmm0
addss xmm0, dword [edi + 0x40]
comiss xmm0, xmm1
movss dword [edi + 0x40], xmm0
jbe 0x1001f52f
movss dword [edi + 0x40], xmm1
movaps xmm0, xmm1
xorps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x1001f53e
mov dword [edi + 0x40], 0
mov ecx, edi
call fcn.1001e680
test al, al
je 0x1001f56c
movss xmm1, dword [ebp - 8]
comiss xmm1, dword [0x1006f2e0]
jbe 0x1001f56c
movss xmm0, dword [edi + 0x40]
mov ecx, edi
subss xmm0, xmm1
movss dword [edi + 0x40], xmm0
call fcn.1001e680
mov eax, dword [ebp - 0x14]
cmp byte [0x7985ea], 0
jne 0x1001f69d
cmp byte [0x798614], 0
je 0x1001f69d
cmp eax, 5
jne 0x1001f69d
mov eax, 0xe6ff
cmp word [0x798582], ax
jae 0x1001f69d
mov eax, dword [0x809db4]
test eax, eax
je 0x1001f5b7
cmp dword [eax + 0x3c], 0
jne 0x1001f69d
mov eax, dword [edi + 0x50]
or eax, dword [edi + 0x54]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
jne 0x1001f5db
lea eax, [edi + 0x58]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [edi + 0x60], 1
call esi
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], edx
call esi
mov esi, eax
mov ecx, edx
sub esi, dword [edi + 0x50]
mov eax, dword [edi + 0x44]
sbb ecx, dword [edi + 0x54]
cdq
cmp ecx, edx
jb 0x1001f6df
ja 0x1001f5fd
cmp esi, eax
jbe 0x1001f6df
push str.eqw.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1001f614
mov esi, dword [eax + 0x97a4]
jmp 0x1001f616
xor esi, esi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp esi, eax
jne 0x1001f6df
cmp byte [edi + 0x60], 0
je 0x1001f688
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, eax
mov ecx, edx
sub esi, dword [edi + 0x50]
mov eax, dword [edi + 0x44]
sbb ecx, dword [edi + 0x54]
cdq
cmp ecx, edx
jb 0x1001f688
ja 0x1001f658
cmp esi, eax
jbe 0x1001f688
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x53edef
call esi
lea eax, [ebp - 8]
mov byte [0x53edef], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x53edef
call esi
mov byte [edi + 0x60], 0
mov ecx, edi
call fcn.1001ee50
push dword [edi + 0x5c]
push dword [edi + 0x58]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x1001f6df
mov eax, dword [edi + 0x50]
or eax, dword [edi + 0x54]
je 0x1001f6d1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x53edef
call esi
lea eax, [ebp - 8]
mov byte [0x53edef], 0x75
push eax
push dword [ebp - 8]
push 1
push 0x53edef
call esi
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov edi, dword [edi + 0x70]
mov esi, dword [edi]
cmp esi, edi
je 0x1001f7f2
movss xmm5, dword [0x1006f3d0]
movss xmm4, dword [0x1006f300]
nop dword [eax]
cmp byte [esi + 0xc], 0
je case.0x1001f720.7
mov eax, dword [esi + 8]
add eax, 0xfffffffb
cmp eax, 0xe
ja case.0x1001f720.7
movzx eax, byte [eax + 0x1001f818]
jmp dword [eax*4 + 0x1001f808]
call fcn.10017ec0
test al, al
je case.0x1001f720.7
cmp dword [ebp - 0x14], 5
jne case.0x1001f720.7
mov ecx, dword [ebp - 0x1c]
mov al, byte [ecx + 0xb1]
cmp al, 0x64
je 0x1001f753
cmp al, 0x6f
jne case.0x1001f720.7
mov eax, dword [ebp - 0x18]
movss xmm3, dword [ecx + 0x54]
movss xmm2, dword [eax + 0x34]
movaps xmm1, xmm2
subss xmm1, xmm3
andps xmm1, xmm5
comiss xmm1, dword [0x1006f37c]
jbe 0x1001f781
movss xmm0, dword [0x1006f384]
subss xmm0, xmm1
jmp 0x1001f784
movaps xmm0, xmm1
andps xmm0, xmm5
comiss xmm0, dword [0x1006f340]
jbe 0x1001f7a5
movss xmm0, dword [eax + 0x2c]
comiss xmm0, dword [0x1006f350]
jbe 0x1001f7a5
movss dword [ecx + 0x54], xmm2
jmp case.0x1001f720.7
movss dword [eax + 0x34], xmm3
jmp case.0x1001f720.7
mov eax, dword [ebp - 0x18]
movss xmm0, dword [eax + 0x40]
comiss xmm0, dword [0x1006f2e0]
jbe case.0x1001f720.7
subss xmm0, xmm4
movss dword [eax + 0x40], xmm0
jmp case.0x1001f720.7
mov eax, dword [ebp - 0x18]
movss xmm0, dword [eax + 0x40]
movss xmm1, dword [eax + 8]
addss xmm0, xmm4
comiss xmm0, xmm1
movss dword [eax + 0x40], xmm0
jbe case.0x1001f720.7
movss dword [eax + 0x40], xmm1
mov esi, dword [esi]
cmp esi, edi
jne 0x1001f700
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10037c60
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret