Function at 0x140001150
Capabilities:
Check for unmoving mouse cursor
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xf0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rsp + 0x70], xmm13
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [0x140001070]
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
movsd xmm11, qword [0x140003378]
movsd xmm12, qword [0x140003388]
movsd xmm13, qword [0x140003380]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x288df0cb
imul r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x65
sub r8d, ecx
lea ecx, [r8 + 0xfa]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
jne 0x14000123d
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x3c], eax
je 0x1400011f0
lea rbx, [rsp + 0x40]
mov edi, 4
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x15
sub r8d, ecx
lea ecx, [r8 + 0x28]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetCursorPos]
add rbx, 8
sub rdi, 1
jne 0x140001247
mov edx, 1
lea rcx, [rsp + 0x3c]
nop
mov eax, dword [rcx - 4]
cmp dword [rcx + 4], eax
jne 0x1400012bd
mov eax, dword [rcx]
cmp dword [rcx + 8], eax
jne 0x1400012bd
inc rdx
add rcx, 8
cmp rdx, 5
jl 0x140001290
lea rcx, str.Posi
call fcn.140001010
jmp 0x1400011e5
xor ebx, ebx
xor edi, edi
mov ecx, dword [rsp + rdi + 0x44]
mov eax, ecx
sub eax, dword [rsp + rdi + 0x3c]
movd xmm0, eax
mov eax, dword [rsp + rdi + 0x4c]
sub eax, ecx
mov ecx, dword [rsp + rdi + 0x40]
cvtdq2pd xmm0, xmm0
movd xmm9, eax
mov eax, dword [rsp + rdi + 0x48]
movaps xmm8, xmm0
sub eax, ecx
sub ecx, dword [rsp + rdi + 0x38]
cvtdq2pd xmm9, xmm9
movd xmm6, ecx
cvtdq2pd xmm6, xmm6
movd xmm10, eax
movaps xmm1, xmm6
mulsd xmm8, xmm9
cvtdq2pd xmm10, xmm10
mulsd xmm1, xmm10
addsd xmm8, xmm1
movaps xmm1, xmm11
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm7, xmm0
movaps xmm1, xmm11
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm7
ja 0x140001344
sqrtsd xmm7, xmm7
jmp 0x14000134f
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movaps xmm7, xmm0
movaps xmm1, xmm11
movaps xmm0, xmm10
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
movaps xmm1, xmm11
movaps xmm0, xmm9
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x140001382
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x14000138a
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
mulsd xmm7, xmm0
divsd xmm8, xmm7
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_acos
mulsd xmm0, xmm12
comisd xmm0, xmm13
jae 0x14000140b
inc ebx
add rdi, 8
cmp ebx, 3
jl 0x1400012c1
lea rcx, str.Comportamento_humano_detectado._Continuando_execu
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001430
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop rdi
ret
lea rcx, [0x1400032f8]
call fcn.140001010
jmp 0x1400011e5