Function at 0x10020840
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10080080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0x24], 0
jne 0x1002087e
cmp dword [ebx + 0x74], 0
je 0x10020bb0
lea ecx, [ebx + 0x6c]
call fcn.1001ae80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a31d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x7f94cc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10080ba8]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x10020938
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x13
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x6c]
call fcn.100245a0
mov eax, dword [eax]
cmp byte [eax + 0xc], 0
je 0x10020935
mov eax, dword [0x10080ba8]
mov eax, dword [eax]
test eax, eax
jne 0x100208cd
push 1
mov ecx, ebx
call fcn.1001ff70
jmp 0x100208d2
cmp eax, 5
jne 0x10020935
movss xmm0, dword [ebx + 0x3c]
movss xmm1, dword [ebx + 8]
movss dword [ebp - 8], xmm0
addss xmm0, dword [ebx + 0x40]
comiss xmm0, xmm1
movss dword [ebx + 0x40], xmm0
jbe 0x100208f8
movss dword [ebx + 0x40], xmm1
movaps xmm0, xmm1
xorps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x10020907
mov dword [ebx + 0x40], 0
mov ecx, ebx
call fcn.1001fa90
test al, al
je 0x10020935
movss xmm1, dword [ebp - 8]
comiss xmm1, dword [0x10072850]
jbe 0x10020935
movss xmm0, dword [ebx + 0x40]
mov ecx, ebx
subss xmm0, xmm1
movss dword [ebx + 0x40], xmm0
call fcn.1001fa90
mov eax, dword [ebp - 0x14]
cmp byte [0x7985ea], 0
jne 0x10020a64
cmp byte [0x798614], 0
je 0x10020a64
cmp eax, 5
jne 0x10020a64
mov eax, 0xe6ff
cmp word [0x798582], ax
jae 0x10020a64
mov eax, dword [0x809db4]
test eax, eax
je 0x10020980
cmp dword [eax + 0x3c], 0
jne 0x10020a64
mov eax, dword [ebx + 0x50]
or eax, dword [ebx + 0x54]
mov edi, dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
jne 0x100209a6
lea eax, [ebx + 0x58]
push eax
call edi
mov byte [ebx + 0x60], 1
call esi
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], edx
call esi
mov esi, eax
mov ecx, edx
sub esi, dword [ebx + 0x50]
mov eax, dword [ebx + 0x44]
sbb ecx, dword [ebx + 0x54]
cdq
cmp ecx, edx
jb 0x10020aa6
ja 0x100209c8
cmp esi, eax
jbe 0x10020aa6
push str.eqw.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100209df
mov esi, dword [eax + 0x97a4]
jmp 0x100209e1
xor esi, esi
lea eax, [ebp - 0x10]
push eax
call edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp esi, eax
jne 0x10020aa6
cmp byte [ebx + 0x60], 0
je 0x10020a4f
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, eax
mov ecx, edx
sub esi, dword [ebx + 0x50]
mov eax, dword [ebx + 0x44]
sbb ecx, dword [ebx + 0x54]
cdq
cmp ecx, edx
jb 0x10020a4f
ja 0x10020a1f
cmp esi, eax
jbe 0x10020a4f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x53edef
call esi
lea eax, [ebp - 8]
mov byte [0x53edef], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x53edef
call esi
mov byte [ebx + 0x60], 0
mov ecx, ebx
call fcn.10020240
push dword [ebx + 0x5c]
push dword [ebx + 0x58]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x10020aa6
mov eax, dword [ebx + 0x50]
or eax, dword [ebx + 0x54]
je 0x10020a98
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x53edef
call esi
lea eax, [ebp - 8]
mov byte [0x53edef], 0x75
push eax
push dword [ebp - 8]
push 1
push 0x53edef
call esi
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov edi, dword [ebx + 0x70]
mov esi, dword [edi]
cmp esi, edi
je 0x10020bb0
movss xmm4, dword [0x10072870]
nop dword [eax + eax]
cmp byte [esi + 0xc], 0
je case.0x10020ae0.7
mov eax, dword [esi + 8]
add eax, 0xfffffffb
cmp eax, 0xe
ja case.0x10020ae0.7
movzx eax, byte [eax + 0x10020bd4]
jmp dword [eax*4 + 0x10020bc4]
call fcn.10018ee0
test al, al
je case.0x10020ae0.7
cmp dword [ebp - 0x14], 5
jne case.0x10020ae0.7
mov ecx, dword [ebp - 0x18]
mov al, byte [ecx + 0xb1]
cmp al, 0x64
je 0x10020b13
cmp al, 0x6f
jne case.0x10020ae0.7
movss xmm2, dword [ebx + 0x34]
movss xmm3, dword [ecx + 0x54]
movaps xmm0, xmm2
subss xmm0, xmm3
call fcn.100120c0
movaps xmm1, xmm0
comiss xmm1, dword [0x100728e4]
jbe 0x10020b43
movss xmm0, dword [0x100728ec]
subss xmm0, xmm1
jmp 0x10020b46
movaps xmm0, xmm1
call fcn.100120c0
comiss xmm0, dword [0x100728a8]
jbe 0x10020b69
movss xmm0, dword [ebx + 0x2c]
comiss xmm0, dword [0x100728b8]
jbe 0x10020b69
movss dword [ecx + 0x54], xmm2
jmp case.0x10020ae0.7
movss dword [ebx + 0x34], xmm3
jmp case.0x10020ae0.7
movss xmm0, dword [ebx + 0x40]
comiss xmm0, dword [0x10072850]
jbe case.0x10020ae0.7
subss xmm0, xmm4
movss dword [ebx + 0x40], xmm0
jmp case.0x10020ae0.7
movss xmm0, dword [ebx + 0x40]
movss xmm1, dword [ebx + 8]
addss xmm0, xmm4
comiss xmm0, xmm1
movss dword [ebx + 0x40], xmm0
jbe case.0x10020ae0.7
movss dword [ebx + 0x40], xmm1
mov esi, dword [esi]
cmp esi, edi
jne 0x10020ac0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a31d
mov esp, ebp
pop ebp
ret