Function at 0x1400b0ad4
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x108
lea r13, [0x1400efcc0]
mov rdi, r9
mov rcx, r13
call fcn.140003a60
mov rcx, qword [0x1400efd60]
movsxd r11, eax
mov eax, 0xfffffe6e
mov dword [rsp + 0x38], r11d
mov r10, qword [rcx + r11*8]
mov ecx, dword [rdi + 0x10]
mov r15, qword [r10]
cmp ecx, eax
ja 0x1400b0e16
je 0x1400b0da1
cmp ecx, 0xfffffd09
je 0x1400b0d75
cmp ecx, 0xfffffd0e
je 0x1400b0d63
cmp ecx, 0xfffffd0f
je 0x1400b0d3a
cmp ecx, 0xfffffd16
je 0x1400b0d35
cmp ecx, 0xfffffdd9
je 0x1400b0d1c
cmp ecx, 0xfffffdda
je 0x1400b0cb6
cmp ecx, 0xfffffdee
je 0x1400b0c26
cmp ecx, 0xfffffe3d
je 0x1400b0da1
cmp ecx, 0xfffffe64
jne 0x1400b14c3
mov rbx, qword [rdi]
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 8
jae 0x1400b14c3
mov eax, reloc.OLEAUT32.dll_RegisterActiveObject
cmp word [rdi + 0x18], ax
jne 0x1400b14c3
xor r9d, r9d
lea r8d, [rax - 0x17]
mov edx, 0x110a
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400b14c3
lea r9, [rsp + 0x78]
mov qword [rbp - 0x80], rax
xor r8d, r8d
mov dword [rsp + 0x78], 4
mov edx, 0x113e
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1400b14c3
mov edx, dword [rbp - 0x58]
xor r8d, r8d
call fcn.1400aede0
jmp 0x1400b14c3
xor esi, esi
cmp qword [r15 + 0x2b0], rsi
je 0x1400b14c3
mov edx, dword [0x1400efda4]
lea ecx, [rsi + 3]
cmp edx, ecx
jl 0x1400b14c3
mov r10, qword [0x1400efd88]
lea r14d, [rsi + 1]
lea r8, [r10 + 0x18]
mov rax, qword [r8]
mov r9, qword [rax]
test r9, r9
je 0x1400b0c74
cmp dword [r9 + 8], r11d
jne 0x1400b0c74
movzx eax, byte [r9 + 0xff]
cmp rax, qword [rdi + 8]
je 0x1400b0c7f
add ecx, r14d
add r8, 8
cmp ecx, edx
jle 0x1400b0c55
cmp ecx, edx
jg 0x1400b14c3
movsxd rcx, ecx
mov r8d, 0x4f
mov rdx, qword [r10 + rcx*8]
lea rcx, [rdi + 0x20]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0xa0]
call fcn.140030594
mov word [rdi + 0xbe], si
mov rax, r14
jmp 0x1400b14df
mov ecx, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400b14c3
mov ecx, 9
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400b14c3
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, reloc.WSOCK32.dll_recv
mov rbx, rax
call qword [sym.imp.USER32.dll_GetKeyState]
or r12d, 0xffffffff
mov r8d, 1
test ax, ax
cmovs r8d, r12d
add r8d, ebx
mov edx, dword [rdi + 8]
jmp 0x1400b0c1c
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, rax
jmp 0x1400b0d14
mov r8d, ecx
jmp 0x1400b0d14
mov r14d, 1
cmp byte [r15 + 0x2c6], r14b
jne 0x1400b0d54
mov edx, dword [rdi + 8]
mov r8d, ecx
call fcn.1400aede0
xor esi, esi
mov word [r15 + 0x2c5], si
jmp 0x1400b14c3
mov r14d, 1
mov byte [r15 + 0x2c5], r14b
jmp 0x1400b14c3
xor esi, esi
mov r14d, 1
mov byte [r15 + 0x2c6], r14b
cmp byte [r15 + 0x2c5], sil
jne 0x1400b14c3
mov byte [r15 + 0x2c6], sil
mov r8d, dword [rdi + 0x10]
jmp 0x1400b0d14
mov rcx, qword [rdi]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400b14c3
mov rcx, qword [rdi]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rbp - 0x80], rax
mov edx, 0x113e
mov dword [rsp + 0x78], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1400b14c3
mov rax, qword [rdi + 0x88]
cmp qword [rdi + 0x50], rax
je 0x1400b14c3
cmp dword [rdi + 0x18], 0x1000
je 0x1400b14c3
mov r14d, 1
cmp dword [rdi + 0x18], r14d
jmp 0x1400b0c10
cmp ecx, 0xfffffec0
je 0x1400b14b4
cmp ecx, 0xfffffed4
je 0x1400b14b4
cmp ecx, 0xffffff93
je 0x1400b13ec
cmp ecx, 0xffffff94
je 0x1400b1338
cmp ecx, 0xfffffff0
je 0x1400b132d
cmp ecx, 0xfffffff4
je 0x1400b1219
cmp ecx, 0xfffffffb
je 0x1400b0fbe
cmp ecx, 0xfffffffe
jne 0x1400b14c3
mov r8d, 1
mov rdx, r15
mov rcx, r13
call fcn.140003660
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rdi]
mov rcx, r13
call fcn.140003a0c
or r12d, 0xffffffff
cmp eax, r12d
je 0x1400b14c3
movsxd rcx, eax
mov rax, qword [0x1400efd88]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov cl, byte [rax + 0xfc]
cmp cl, 0x10
jb 0x1400b14c3
cmp cl, 0x11
jbe 0x1400b0f2f
cmp cl, 0x13
jne 0x1400b14c3
mov rax, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x1012
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r12d
je 0x1400b14c3
mov rcx, qword [rdi]
lea r9, [rbp - 0x50]
xor r8d, r8d
mov dword [rbp - 0x4c], eax
mov edx, 0x104b
mov dword [rbp - 0x50], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x48], 0xe
je 0x1400b14c3
mov edx, dword [rbp - 0x28]
jmp 0x1400b0c19
mov rax, qword [rsp + 0x30]
lea r9, [rsp + 0x58]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x1111
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400b14c3
mov rcx, qword [rdi]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rbp - 0x80], rax
mov edx, 0x113e
mov dword [rsp + 0x78], reloc.WSOCK32.dll_ioctlsocket
mov dword [rbp - 0x74], 0xf000
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x60], 0x46
je 0x1400b14c3
mov rcx, qword [rdi]
xor r9d, r9d
mov ebx, 0x110b
mov edx, ebx
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rsp + 0x68]
mov r8d, 9
mov edx, ebx
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400b14c3
xor esi, esi
mov rdx, r15
mov rcx, r13
mov byte [rbp + 0x50], sil
lea r14d, [rsi + 1]
mov r8d, r14d
call fcn.140003660
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rdi]
mov rcx, r13
call fcn.140003a0c
or r12d, 0xffffffff
mov dword [rbp + 0x68], eax
mov ebx, eax
cmp eax, r12d
jne 0x1400b102e
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov rdx, rax
mov rcx, r13
call fcn.140003a0c
mov dword [rbp + 0x68], eax
mov ebx, eax
cmp eax, r12d
je 0x1400b14c3
mov byte [rbp + 0x50], r14b
mov rax, qword [0x1400efd88]
movsxd r13, ebx
mov rcx, qword [rax + r13*8]
mov rax, qword [rcx]
mov cl, byte [rax + 0xfc]
cmp cl, 0x10
je 0x1400b113d
cmp cl, 0x13
jne 0x1400b14c3
mov rax, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x1012
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r12d
jle 0x1400b10ed
cmp byte [rbp + 0x50], sil
jne 0x1400b10ed
mov rcx, qword [rdi]
lea r9, [rbp - 0x50]
xor r8d, r8d
mov dword [rbp - 0x4c], eax
mov edx, 0x104b
mov dword [rbp - 0x50], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400b14c3
test byte [rsp + 0x48], 0xe
je 0x1400b10ed
mov edx, dword [rbp - 0x28]
lea r9, [rbp + 0x68]
lea r8, [rsp + 0x38]
lea rcx, [0x1400efcc0]
call fcn.140003778
test al, al
je 0x1400b10ea
mov rax, qword [0x1400efd88]
movsxd rbx, dword [rbp + 0x68]
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx]
test rax, rax
je 0x1400b10ea
cmp qword [rax + 0x18], rsi
jne 0x1400b10ed
mov ebx, r13d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [0x1400efd88]
movsxd rcx, ebx
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400b14c3
mov rax, qword [r15]
xor edx, edx
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x1400b14c3
mov rax, qword [rsp + 0x30]
lea r9, [rsp + 0x58]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x1111
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400b11c6
mov rcx, qword [rdi]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rbp - 0x80], rax
mov edx, 0x113e
mov dword [rsp + 0x78], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x60], 0x46
je 0x1400b11c6
mov edx, dword [rbp - 0x58]
lea r9, [rbp + 0x68]
lea r8, [rsp + 0x38]
lea rcx, [0x1400efcc0]
call fcn.140003778
test al, al
jne 0x1400b11ac
mov ebx, r13d
jmp 0x1400b11c6
movsxd rbx, dword [rbp + 0x68]
mov rax, qword [0x1400efd88]
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx]
cmp qword [rax + 0x18], rsi
cmove ebx, r13d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [0x1400efd88]
movsxd rcx, ebx
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400b14c3
mov rax, qword [r15]
mov edx, 0x80
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x1400b0cae
mov rdx, qword [rdi]
mov rcx, r13
call fcn.140003a0c
or r12d, 0xffffffff
mov dword [rbp + 0x68], eax
cmp eax, r12d
je 0x1400b14c3
mov r11, qword [0x1400efd88]
cdqe
mov rcx, qword [r11 + rax*8]
mov rdx, qword [rcx]
mov al, byte [rdx + 0xfc]
cmp al, 0x10
je 0x1400b1256
cmp al, 0x13
jne 0x1400b14c3
mov ecx, dword [rdi + 0x18]
sub ecx, 1
je 0x1400b1323
cmp ecx, 0x10000
jne 0x1400b14c3
mov r14d, dword [rdx + 0x90]
lea r9, [rbp + 0x68]
mov edx, dword [rdi + 0x48]
lea r8, [rsp + 0x38]
mov rcx, r13
call fcn.140003778
test al, al
jne 0x1400b1294
xor eax, eax
jmp 0x1400b14df
movsxd rbx, dword [rbp + 0x68]
mov edx, 0xfffffff0
mov rax, qword [r11 + rbx*8]
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x68]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1b
jb 0x1400b128d
test byte [rdi + 0x40], 0x11
mov rdx, qword [0x1400efd88]
je 0x1400b12d5
mov rax, qword [rdx + rbx*8]
mov rcx, qword [rax]
cmp byte [rcx + 0xfc], 0x14
jne 0x1400b14c3
mov rax, qword [rdx + rbx*8]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x94]
cmp eax, r12d
je 0x1400b12f1
mov dword [rdi + 0x50], eax
mov rdx, qword [0x1400efd88]
mov rax, qword [rdx + rbx*8]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x90]
test eax, eax
js 0x1400b128d
cmp r14d, 0xfe000000
jne 0x1400b131b
mov r14d, 1
test byte [rdi + 0x38], r14b
je 0x1400b128d
mov dword [rdi + 0x54], eax
jmp 0x1400b128d
mov eax, reloc.OLEAUT32.dll_RegisterActiveObject
jmp 0x1400b14df
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x1400b14c3
mov r14d, dword [rdi + 8]
lea r9, [rbp + 0x68]
mov edx, r14d
lea r8, [rsp + 0x38]
mov rcx, r13
call fcn.140003778
xor esi, esi
test al, al
je 0x1400b14c3
mov rax, qword [0x1400efd88]
xor r8d, r8d
movsxd rbx, dword [rbp + 0x68]
mov rcx, qword [rax + rbx*8]
movzx eax, word [rdi + 0x1c]
mov rdx, qword [rcx]
mov word [rdx + 0x102], ax
mov edx, dword [rdi + 8]
call fcn.1400aede0
mov r8, qword [0x1400efd88]
mov rax, qword [r8 + rbx*8]
mov rcx, qword [rax]
cmp qword [rcx + 0x50], rsi
jbe 0x1400b14c3
mov dword [0x1400efd18], r14d
lea rcx, [0x1400efd20]
mov rax, qword [r8 + rbx*8]
mov rdx, qword [rax]
add rdx, 0x48
cmp rcx, rdx
je 0x1400b13c4
call fcn.140009694
mov r8, qword [0x1400efd88]
mov rax, qword [r8 + rbx*8]
lea r9, [0x1400aedd0]
mov edx, 0x1030
mov rcx, qword [rax]
mov al, byte [rcx + 0x104]
mov byte [0x1400efd40], al
movsxd r8, dword [rdi + 0x1c]
jmp 0x1400b0fb0
mov rcx, qword [0x1400efde0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.COMCTL32.dll_ImageList_SetDragCursorImage]
mov rcx, qword [0x1400efde0]
xor edx, edx
lea r9d, [rdx - 0x10]
lea r8d, [rdx - 8]
call qword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
mov r15, qword [rbp + 0x58]
mov rcx, r15
call qword [sym.imp.USER32.dll_SetCapture]
mov r12, qword [rbp + 0x60]
lea rcx, [rsp + 0x40]
xor esi, esi
mov dword [0x1400efde8], r12d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
lea r14d, [rsi + 1]
mov dword [rsp + 0x50], r14d
call fcn.14000c050
lea rdx, str._GUI_DRAGID
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x40], r12d
call fcn.1400094fc
mov r9d, r14d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [0x1400f11c0]
call fcn.14000b000
lea rcx, [rsp + 0x58]
call fcn.1400079ac
mov rcx, qword [rdi]
lea rdx, [rdi + 0x2c]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r8d, dword [rdi + 0x30]
xor ecx, ecx
mov edx, dword [rdi + 0x2c]
call qword [sym.imp.COMCTL32.dll_ImageList_DragEnter]
lea rcx, [rsp + 0x40]
call fcn.14000c050
jmp 0x1400b14cb
mov rcx, qword [rdi]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov r15, qword [rbp + 0x58]
mov r12, qword [rbp + 0x60]
movsxd r8, r12d
mov r9, rdi
mov edx, 0x4e
mov rcx, r15
call qword [sym.imp.USER32.dll_DefDlgProcW]
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret