Function at 0x140011361
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
jmp 0x14001d560
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x438
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x458]
mov rax, qword [0x140034040]
xor rax, rbp
mov qword [rbp + 0x408], rax
lea rcx, [0x14003c0fe]
call fcn.140011ad7
cmp dword [section..data], 1
jne 0x14001d640
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rbp + 8]
mov rcx, qword [0x1400346f0]
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x14001d63b
mov eax, dword [rbp + 8]
mov ecx, dword [rbp + 0x10]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x34], eax
mov eax, dword [rbp + 0xc]
mov ecx, dword [rbp + 0x14]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x54], eax
mov eax, dword [rbp + 8]
mov ecx, dword [rbp + 0x10]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x74], eax
mov eax, dword [rbp + 0xc]
mov ecx, dword [rbp + 0x14]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x94], eax
mov eax, dword [rbp + 0x94]
mov ecx, dword [rbp + 0xc]
add ecx, eax
mov eax, ecx
mov ecx, dword [rbp + 0x74]
mov edx, dword [rbp + 8]
add edx, ecx
mov ecx, edx
mov edx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001da36
cmp dword [section..data], 2
jne 0x14001d7bf
lea rcx, [rbp + 0xb8]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001d7ba
lea rdx, [rbp + 0xb8]
mov rcx, qword [rbp + 0x430]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001d7ba
lea rax, [rbp + 0xd8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rbp + 0xd8]
mov rcx, qword [0x1400346f0]
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x14001d7ba
mov eax, dword [rbp + 0xd8]
mov ecx, dword [rbp + 0xe0]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0xdc]
mov ecx, dword [rbp + 0xe4]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x124], eax
mov eax, dword [rbp + 0xd8]
mov ecx, dword [rbp + 0xe0]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x144], eax
mov eax, dword [rbp + 0xdc]
mov ecx, dword [rbp + 0xe4]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0x164], eax
lea rcx, [rbp + 0x188]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001d7ba
cmp dword [rbp + 0xb8], 1
jge 0x14001d746
mov eax, dword [rbp + 0xd8]
add eax, 0xa
mov edx, dword [rbp + 0x18c]
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001d7ba
mov eax, dword [rbp + 0x104]
sub eax, 0x12
cmp dword [rbp + 0xb8], eax
jle 0x14001d770
mov eax, dword [rbp + 0xe0]
sub eax, 0xa
mov edx, dword [rbp + 0x18c]
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001d7ba
cmp dword [rbp + 0xbc], 0x23
jge 0x14001d792
mov eax, dword [rbp + 0xdc]
add eax, 0x1e
mov edx, eax
mov ecx, dword [rbp + 0x188]
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001d7ba
mov eax, dword [rbp + 0x124]
sub eax, 0xa
cmp dword [rbp + 0xbc], eax
jle 0x14001d7ba
mov eax, dword [rbp + 0xe4]
sub eax, 0xa
mov edx, eax
mov ecx, dword [rbp + 0x188]
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001da36
cmp dword [section..data], 3
jne 0x14001da36
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001d802
movzx eax, byte [0x1400346f9]
test eax, eax
jne 0x14001d800
mov byte [0x1400346f9], 1
lea rcx, [0x140034700]
call qword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x14001d826
movzx eax, byte [0x1400346f9]
test eax, eax
je 0x14001d826
mov edx, dword [0x140034704]
mov ecx, dword [0x140034700]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov byte [0x1400346f9], 0
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001da36
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rbp + 0x430]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001da36
lea rax, [rbp + 0x1c8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1c8]
mov rcx, qword [0x1400346f0]
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x14001da36
mov eax, dword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x1d0]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x1f4], eax
mov eax, dword [rbp + 0x1cc]
mov ecx, dword [rbp + 0x1d4]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x214], eax
lea rcx, [rbp + 0x238]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001da36
movzx eax, byte [0x1400346f9]
test eax, eax
je 0x14001d991
mov eax, dword [0x140034700]
cmp dword [rbp + 0x238], eax
jne 0x14001d8f6
mov eax, dword [0x140034704]
cmp dword [rbp + 0x23c], eax
je 0x14001d991
mov eax, dword [rbp + 0x238]
mov dword [rbp + 0x254], eax
mov eax, dword [rbp + 0x23c]
mov dword [rbp + 0x274], eax
mov eax, dword [rbp + 0x1c8]
cmp dword [rbp + 0x254], eax
jge 0x14001d92a
mov eax, dword [rbp + 0x1c8]
mov dword [rbp + 0x254], eax
jmp 0x14001d944
mov eax, dword [rbp + 0x1d0]
cmp dword [rbp + 0x254], eax
jle 0x14001d944
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x254], eax
mov eax, dword [rbp + 0x1cc]
cmp dword [rbp + 0x274], eax
jge 0x14001d960
mov eax, dword [rbp + 0x1cc]
mov dword [rbp + 0x274], eax
jmp 0x14001d97a
mov eax, dword [rbp + 0x1d4]
cmp dword [rbp + 0x274], eax
jle 0x14001d97a
mov eax, dword [rbp + 0x1d4]
mov dword [rbp + 0x274], eax
mov edx, dword [rbp + 0x274]
mov ecx, dword [rbp + 0x254]
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001da36
movzx eax, byte [0x1400346f9]
test eax, eax
jne 0x14001da36
cmp dword [rbp + 0x1a8], 1
jge 0x14001d9c2
mov eax, dword [rbp + 0x1c8]
add eax, 0xa
mov edx, dword [rbp + 0x23c]
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001da36
mov eax, dword [rbp + 0x1f4]
sub eax, 0x12
cmp dword [rbp + 0x1a8], eax
jle 0x14001d9ec
mov eax, dword [rbp + 0x1d0]
sub eax, 0xa
mov edx, dword [rbp + 0x23c]
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001da36
cmp dword [rbp + 0x1ac], 0x23
jge 0x14001da0e
mov eax, dword [rbp + 0x1cc]
add eax, 0x1e
mov edx, eax
mov ecx, dword [rbp + 0x238]
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14001da36
mov eax, dword [rbp + 0x214]
sub eax, 0xa
cmp dword [rbp + 0x1ac], eax
jle 0x14001da36
mov eax, dword [rbp + 0x1d4]
sub eax, 0xa
mov edx, eax
mov ecx, dword [rbp + 0x238]
call qword [sym.imp.USER32.dll_SetCursorPos]
lea rcx, [rbp - 0x20]
lea rdx, [0x14002c590]
call fcn.140011910
mov rcx, qword [rbp + 0x408]
xor rcx, rbp
call fcn.140011564
lea rsp, [rbp + 0x418]
pop rdi
pop rbp
ret