Function at 0x14008c150
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
mov rdx, rcx
lea r14, [0x1400c0e50]
mov rdi, r8
mov rcx, r14
call fcn.140037fc0
mov ecx, 0xfffffe6e
movsxd r9, eax
mov dword [rbp + 0x7f], eax
mov rax, qword [0x1400c0ef0]
mov r9, qword [rax + r9*8]
mov eax, dword [rdi + 0x10]
mov r13, qword [r9]
cmp eax, ecx
ja 0x14008c470
je 0x14008c3ff
cmp eax, 0xfffffd09
je 0x14008c3d5
cmp eax, 0xfffffd0e
je 0x14008c3c4
cmp eax, 0xfffffd0f
je 0x14008c39d
cmp eax, 0xfffffd16
je 0x14008c399
cmp eax, 0xfffffdd9
je 0x14008c380
cmp eax, 0xfffffdda
je 0x14008c31e
cmp eax, 0xfffffdee
je 0x14008c293
cmp eax, 0xfffffe3d
je 0x14008c3ff
cmp eax, 0xfffffe64
jne 0x14008cafe
mov rsi, qword [rdi]
mov edx, 0xfffffff0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 8
jae 0x14008cafe
mov eax, reloc.OLEAUT32.dll_RegisterActiveObject
cmp word [rdi + 0x18], ax
jne 0x14008cafe
lea r8d, [rax - 0x17]
xor r9d, r9d
mov edx, 0x110a
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14008cafe
lea r9, [rbp - 0x59]
xor r8d, r8d
mov edx, 0x113e
mov rcx, rsi
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14008cafe
mov ecx, dword [rbp - 0x29]
xor edx, edx
call fcn.140070930
jmp 0x14008cafe
xor ebx, ebx
cmp qword [r13 + 0x2b0], rbx
je 0x14008cafe
mov r9d, dword [0x1400c0f34]
mov r10, qword [0x1400c0f18]
lea edx, [rbx + 3]
lea esi, [rbx + 1]
cmp edx, r9d
jg 0x14008cafe
lea r8, [r10 + 0x18]
mov rax, qword [r8]
cmp qword [rax], rbx
je 0x14008c2db
mov rax, qword [rax]
movzx ecx, byte [rax + 0xf7]
cmp rcx, qword [rdi + 8]
je 0x14008c2e6
add edx, esi
add r8, 8
cmp edx, r9d
jle 0x14008c2c3
cmp edx, r9d
jg 0x14008cafe
movsxd rcx, edx
mov r8d, 0x4f
mov rdx, qword [r10 + rcx*8]
lea rcx, [rdi + 0x20]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0x98]
call fcn.1400155ec
mov word [rdi + 0xbe], bx
mov rax, rsi
jmp 0x14008cb1a
mov ecx, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14008cafe
mov ecx, 9
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14008cafe
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, reloc.WSOCK32.dll_recv
mov r12, rax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14008c372
dec r12d
jmp 0x14008c375
inc r12d
mov edx, r12d
mov ecx, dword [rdi + 8]
jmp 0x14008c289
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rax
jmp 0x14008c378
mov edx, eax
jmp 0x14008c378
mov esi, 1
cmp byte [r13 + 0x2c6], sil
jne 0x14008c3b5
mov ecx, dword [rdi + 8]
mov edx, eax
call fcn.140070930
xor ebx, ebx
mov word [r13 + 0x2c5], bx
jmp 0x14008cafe
mov esi, 1
mov byte [r13 + 0x2c5], sil
jmp 0x14008cafe
xor ebx, ebx
mov esi, 1
mov byte [r13 + 0x2c6], sil
cmp byte [r13 + 0x2c5], bl
jne 0x14008cafe
mov byte [r13 + 0x2c6], bl
mov edx, dword [rdi + 0x10]
jmp 0x14008c378
mov rcx, qword [rdi]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14008cafe
mov rcx, qword [rdi]
lea r9, [rbp - 0x59]
xor r8d, r8d
mov edx, 0x113e
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14008cafe
mov rax, qword [rdi + 0x88]
cmp qword [rdi + 0x50], rax
je 0x14008cafe
cmp dword [rdi + 0x18], 0x1000
je 0x14008cafe
mov esi, 1
cmp dword [rdi + 0x18], esi
jmp 0x14008c27e
cmp eax, 0xfffffec0
je 0x14008caef
cmp eax, 0xfffffed4
je 0x14008caef
cmp eax, 0xffffff93
je 0x14008ca30
cmp eax, 0xffffff94
je 0x14008c983
cmp eax, 0xfffffff0
je 0x14008c978
cmp eax, 0xfffffff4
je 0x14008c85a
cmp eax, 0xfffffffb
je 0x14008c60c
cmp eax, 0xfffffffe
jne 0x14008cafe
mov r8d, 1
mov rdx, r13
mov rcx, r14
call fcn.140061eb0
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rdi]
mov rcx, r14
call fcn.14004a3d0
cmp eax, 0xffffffff
je 0x14008cafe
movsxd rcx, eax
mov rax, qword [0x1400c0f18]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov cl, byte [rax + 0xf4]
cmp cl, 0x10
jb 0x14008cafe
cmp cl, 0x11
jbe 0x14008c583
cmp cl, 0x13
jne 0x14008cafe
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x1012
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x14008cafe
mov rcx, qword [rdi]
lea r9, [rbp - 0x21]
xor r8d, r8d
mov edx, 0x104b
mov dword [rbp - 0x1d], eax
mov dword [rbp - 0x21], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x40], 0xe
je 0x14008cafe
mov ecx, dword [rbp + 7]
jmp 0x14008c287
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rbp - 0x79]
xor r8d, r8d
mov edx, 0x1111
mov qword [rbp - 0x79], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14008cafe
mov rcx, qword [rdi]
lea r9, [rbp - 0x59]
xor r8d, r8d
mov edx, 0x113e
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], recvfrom
mov dword [rbp - 0x45], 0xf000
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rbp - 0x71], 0x46
je 0x14008cafe
mov rcx, qword [rdi]
xor r9d, r9d
mov ebx, 0x110b
lea r8d, [r9 + 9]
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rbp - 0x69]
mov r8d, 9
mov edx, ebx
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14008cafe
xor ebx, ebx
mov rdx, r13
mov rcx, r14
lea esi, [rbx + 1]
mov r15b, bl
mov r8d, esi
call fcn.140061eb0
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rdi]
mov rcx, r14
call fcn.14004a3d0
mov r12d, eax
mov dword [rbp + 0x77], eax
cmp eax, 0xffffffff
jne 0x14008c677
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, r14
mov rdx, rax
call fcn.14004a3d0
mov r12d, eax
mov dword [rbp + 0x77], eax
cmp eax, 0xffffffff
je 0x14008cafe
mov r15b, sil
mov rax, qword [0x1400c0f18]
movsxd rcx, r12d
mov r14d, r12d
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov cl, byte [rax + 0xf4]
cmp cl, 0x10
je 0x14008c788
cmp cl, 0x13
jne 0x14008cafe
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x1012
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jle 0x14008c737
test r15b, r15b
jne 0x14008c737
mov rcx, qword [rdi]
lea r9, [rbp - 0x21]
xor r8d, r8d
mov edx, 0x104b
mov dword [rbp - 0x1d], eax
mov dword [rbp - 0x21], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14008cafe
test byte [rsp + 0x40], 0xe
je 0x14008c737
mov edx, dword [rbp + 7]
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x7f]
lea rcx, [0x1400c0e50]
call fcn.14004a330
test al, al
je 0x14008c737
movsxd r12, dword [rbp + 0x77]
mov rax, qword [0x1400c0f18]
mov rax, qword [rax + r12*8]
cmp qword [rax], rbx
je 0x14008c734
mov rax, qword [rax]
cmp qword [rax + 0x10], rbx
jne 0x14008c737
mov r12d, r14d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [0x1400c0f18]
movsxd rcx, r12d
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14008cafe
mov rax, qword [r13]
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x14008cafe
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rbp - 0x79]
xor r8d, r8d
mov edx, 0x1111
mov qword [rbp - 0x79], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14008c806
mov rcx, qword [rdi]
lea r9, [rbp - 0x59]
xor r8d, r8d
mov edx, 0x113e
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rbp - 0x71], 0x46
je 0x14008c806
mov edx, dword [rbp - 0x29]
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x7f]
lea rcx, [0x1400c0e50]
call fcn.14004a330
test al, al
je 0x14008c806
movsxd r12, dword [rbp + 0x77]
mov rax, qword [0x1400c0f18]
mov rcx, qword [rax + r12*8]
mov rax, qword [rcx]
cmp qword [rax + 0x10], rbx
cmove r12d, r14d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [0x1400c0f18]
movsxd rcx, r12d
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14008cafe
mov rax, qword [r13]
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov edx, 0x80
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x14008c316
mov rdx, qword [rdi]
mov rcx, r14
call fcn.14004a3d0
mov dword [rbp + 0x77], eax
cmp eax, 0xffffffff
je 0x14008cafe
mov r14, qword [0x1400c0f18]
cdqe
mov rax, qword [r14 + rax*8]
mov rdx, qword [rax]
mov al, byte [rdx + 0xf4]
cmp al, 0x10
je 0x14008c893
cmp al, 0x13
jne 0x14008cafe
mov ecx, dword [rdi + 0x18]
dec ecx
je 0x14008c96e
cmp ecx, 0x10000
jne 0x14008cafe
xor ebx, ebx
cmp dword [rdx + 0x88], 0xfe000000
mov edx, dword [rdi + 0x48]
lea esi, [rbx + 1]
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x7f]
lea rcx, [0x1400c0e50]
movzx r13d, bl
cmove r13d, esi
call fcn.14004a330
test al, al
jne 0x14008c8e3
xor eax, eax
jmp 0x14008cb1a
movsxd r12, dword [rbp + 0x77]
mov edx, 0xfffffff0
mov rax, qword [r14 + r12*8]
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1b
jb 0x14008c8dc
test byte [rdi + 0x40], 0x10
mov rdx, qword [0x1400c0f18]
jne 0x14008c916
test byte [rdi + 0x40], sil
je 0x14008c92a
mov rax, qword [rdx + r12*8]
mov rcx, qword [rax]
cmp byte [rcx + 0xf4], 0x14
jne 0x14008cafe
mov rax, qword [rdx + r12*8]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x8c]
cmp eax, 0xffffffff
je 0x14008c946
mov dword [rdi + 0x50], eax
mov rdx, qword [0x1400c0f18]
mov rax, qword [rdx + r12*8]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x88]
test eax, eax
js 0x14008c8dc
test r13b, r13b
je 0x14008c966
test byte [rdi + 0x38], sil
je 0x14008c8dc
mov dword [rdi + 0x54], eax
jmp 0x14008c8dc
mov eax, reloc.OLEAUT32.dll_RegisterActiveObject
jmp 0x14008cb1a
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x14008cafe
mov r12d, dword [rdi + 8]
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x7f]
mov edx, r12d
mov rcx, r14
call fcn.14004a330
xor ebx, ebx
test al, al
je 0x14008cafe
mov rax, qword [0x1400c0f18]
movsxd rsi, dword [rbp + 0x77]
mov rcx, qword [rax + rsi*8]
movzx eax, word [rdi + 0x1c]
mov rdx, qword [rcx]
mov word [rdx + 0xfa], ax
mov ecx, dword [rdi + 8]
xor edx, edx
call fcn.140070930
mov r11, qword [0x1400c0f18]
mov rax, qword [r11 + rsi*8]
mov rcx, qword [rax]
cmp qword [rcx + 0x48], rbx
jbe 0x14008cafe
mov dword [0x1400c0ea8], r12d
mov rax, qword [r11 + rsi*8]
lea rcx, [0x1400c0eb0]
mov rdx, qword [rax]
add rdx, 0x40
call fcn.1400108f0
mov r11, qword [0x1400c0f18]
lea r9, [0x14008e020]
mov rax, qword [r11 + rsi*8]
mov edx, 0x1030
mov rcx, qword [rax]
mov al, byte [rcx + 0xfc]
mov byte [0x1400c0ed0], al
movsxd r8, dword [rdi + 0x1c]
jmp 0x14008c5fe
mov rcx, qword [0x1400c0f70]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.COMCTL32.dll_ImageList_SetDragCursorImage]
mov rcx, qword [0x1400c0f70]
xor edx, edx
lea r9d, [rdx - 0x10]
lea r8d, [rdx - 8]
call qword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
mov r12, qword [rbp + 0x67]
mov rcx, r12
call qword [sym.imp.USER32.dll_SetCapture]
mov r13, qword [rbp + 0x6f]
xor ebx, ebx
lea esi, [rbx + 1]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov dword [0x1400c0f78], r13d
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], esi
call fcn.1400077c0
lea rdx, str._GUI_DRAGID
lea rcx, [rbp - 0x79]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], r13d
call fcn.140001ce0
lea r9d, [rbx + 2]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x79]
mov r8d, esi
call fcn.14007f9a0
lea rcx, [rbp - 0x79]
call fcn.140002530
mov rcx, qword [rdi]
lea rdx, [rdi + 0x2c]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r8d, dword [rdi + 0x30]
mov edx, dword [rdi + 0x2c]
xor ecx, ecx
call qword [sym.imp.COMCTL32.dll_ImageList_DragEnter]
lea rcx, [rsp + 0x38]
call fcn.1400077c0
jmp 0x14008cb06
mov rcx, qword [rdi]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov r13, qword [rbp + 0x6f]
mov r12, qword [rbp + 0x67]
movsxd r8, r13d
mov r9, rdi
mov edx, 0x4e
mov rcx, r12
call qword [sym.imp.USER32.dll_DefDlgProcW]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret