Function at 0x401000
Capabilities:
Check for unmoving mouse cursor
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x28]
push edi
push eax
call esi
mov ebx, 0x12c
mov dword [esp + 0x14], ebx
nop dword [eax]
lea eax, [esp + 0x24]
push eax
call esi
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x2c], edi
jne 0x40106e
mov esi, dword [esp + 0x28]
cmp dword [esp + 0x30], esi
jne 0x40106e
push 0xf0
push 0
push 0x405438
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [0x405528], 0
jmp 0x4011f3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x24]
mov ebx, eax
mov edi, dword [esp + 0x28]
push 0xc
call fcn.0040126d
mov edx, dword [0x405528]
add esp, 4
mov dword [eax + 8], ebx
mov dword [eax + 4], edi
lea ecx, [edx + edx*2]
mov dword [eax], esi
lea ebx, [edx + 1]
movq xmm0, qword [eax]
xor edi, edi
movq qword [ecx*4 + 0x405438], xmm0
mov eax, dword [eax + 8]
mov dword [ecx*4 + 0x405440], eax
mov eax, 0xcccccccd
mul ebx
mov dword [esp + 0xc], edi
shr edx, 4
lea eax, [edx + edx*4]
shl eax, 2
sub ebx, eax
mov dword [esp + 0x18], ebx
mov dword [0x405528], ebx
cmp ebx, 1
jbe 0x401127
lea eax, [ebx - 1]
mov ecx, 0x405438
mov ebx, dword [0x405438]
mov dword [esp + 0x10], eax
nop dword [eax]
mov eax, dword [ecx + 4]
lea esi, [ecx + 0xc]
sub eax, dword [ecx + 0x10]
sub ebx, dword [esi]
cdq
mov ecx, eax
mov eax, ebx
mov ebx, dword [esi]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
dec ecx
sub eax, edx
add eax, dword [esp + 0xc]
add eax, ecx
sub dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
lea ecx, [esi]
jne 0x4010f0
mov ebx, dword [esp + 0x18]
xor esi, esi
jmp 0x401130
xor esi, esi
test ebx, ebx
je 0x401199
nop dword [eax]
xor ecx, ecx
lea edi, [esi + esi*2]
mov edx, 0x405440
nop word [eax + eax]
cmp esi, ecx
je 0x40114f
mov eax, dword [edi*4 + 0x405440]
cmp eax, dword [edx]
jb 0x4011a7
inc ecx
add edx, 0xc
cmp ecx, ebx
jb 0x401140
mov eax, dword [edi*4 + 0x405440]
mov dword [esp + 0x1c], eax
xor esi, esi
xor eax, eax
lea edi, [esi + esi*2]
mov edx, 0x405440
nop
cmp esi, eax
je 0x40117f
mov ecx, dword [edi*4 + 0x405440]
cmp ecx, dword [edx]
ja 0x4011af
inc eax
add edx, 0xc
cmp eax, ebx
jb 0x401170
lea eax, [esi + esi*2]
mov ecx, dword [eax*4 + 0x405440]
mov dword [esp + 0x20], ecx
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x20]
jne 0x4011b7
xor eax, eax
jmp 0x4011cd
mov esi, ecx
cmp ecx, ebx
jb 0x401130
jmp 0x401162
mov esi, eax
cmp eax, ebx
jb 0x401164
jmp 0x401195
mov eax, 0x66666667
imul ecx
mov eax, edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
idiv ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401230
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x14]
push 0x32
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x401030
mov ecx, dword [esp + 0x34]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040125f
mov esp, ebp
pop ebp
ret