Function at 0x140069a80
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sti
mov qword [rsp + 0x20], r9
push rdi
push r12
push r14
sub rsp, 0xd0
mov rdi, rcx
mov rcx, qword [rcx + 0xf0]
mov r14, rdx
xor edx, edx
mov r12, r8
call fcn.1400671c0
test al, al
jne 0x14006a51d
mov rax, qword [rdi]
mov rdx, rdi
mov rcx, rdi
call qword [rax + 0x518]
test al, al
je 0x14006a51d
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0xb0], r15
nop
mov r9d, 0x108
lea rcx, [rsp + 0x38]
xor edx, edx
lea r8d, [r9 - 8]
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140069ae0
mov rsi, qword [rdi + 0x40]
lea rcx, [rdi + 0x108]
mov qword [rsp + 0xf8], rbx
mov rdx, rsi
mov qword [rsp + 0xc8], rbp
call fcn.1400b00f0
mov rax, qword [rdi]
or byte [rdi + 0x254], 8
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x568]
xor r15d, r15d
cmp dword [rsp + 0x108], r15d
jle 0x140069eaa
cmp dword [rsp + 0x10c], r15d
jle 0x140069eaa
call qword [sym.imp.USER32.dll_WaitMessage]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], r15d
mov dword [rsp + 0xf0], r15d
mov dword [rsp + 0xf4], r15d
call qword [sym.imp.USER32.dll_GetCursorPos]
xor bpl, bpl
nop dword [rax]
test bpl, bpl
jne 0x140069eaa
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140069b90
nop word [rax + rax]
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140069b90
mov r9d, 0x202
lea rcx, [rsp + 0x78]
mov rdx, rsi
mov r8d, r9d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp dword [rsp + 0x80], 0x202
je 0x140069e31
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140069e82
mov rdx, qword [rsp + 0x38]
cmp rdx, rsi
jne 0x140069d1a
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x200
jne 0x140069c92
lea rcx, [rsp + 0xf0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0xf0]
sub eax, dword [rsp + 0x30]
cdq
mov ecx, eax
mov eax, dword [rsp + 0xf4]
sub eax, dword [rsp + 0x34]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
cmp ecx, dword [rsp + 0x108]
jge 0x140069e1c
cmp eax, dword [rsp + 0x10c]
jge 0x140069e1c
mov r9d, 0x200
lea rcx, [rsp + 0x38]
mov rdx, rsi
mov r8d, r9d
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x140069e06
cmp ecx, 0x1c
je 0x140069e82
cmp ecx, 0x1f
je 0x140069e82
cmp ecx, 0x7b
je 0x140069e82
cmp ecx, 0x215
je 0x140069d0a
cmp ecx, 0x100
jb 0x140069cc5
cmp ecx, 0x108
jbe 0x140069cd4
lea eax, [rcx - 0x200]
cmp eax, 9
ja 0x140069d87
cmp ecx, 0x100
jne 0x140069e82
cmp qword [rsp + 0x48], 0x11
jne 0x140069e82
mov r9d, ecx
mov r8d, ecx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x140069e06
cmp qword [rsp + 0x50], rsi
jne 0x140069e82
jmp 0x140069e06
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x1c
je 0x140069e82
cmp ecx, 0x1f
je 0x140069e82
cmp ecx, 0x7b
je 0x140069e82
cmp ecx, 0x100
jb 0x140069d49
cmp ecx, 0x108
jbe 0x140069d54
lea eax, [rcx - 0x200]
cmp eax, 9
ja 0x140069d87
cmp ecx, 0x100
jne 0x140069e82
cmp qword [rsp + 0x48], 0x11
jne 0x140069e82
mov r9d, ecx
mov r8d, ecx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x140069e06
call fcn.14000d854
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0xb8]
test eax, eax
je 0x140069e24
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140069e82
cmp byte [0x1402727b0], r15b
je 0x140069def
mov ebx, r15d
call fcn.14000d854
xor edx, edx
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0xc0]
test eax, eax
je 0x140069def
inc ebx
call fcn.14000d854
mov edx, ebx
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0xc0]
test eax, eax
jne 0x140069dd5
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140069e82
call qword [sym.imp.USER32.dll_WaitMessage]
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140069bb0
jmp 0x140069b90
mov bpl, 1
jmp 0x140069b90
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x140069b90
mov rcx, qword [rdi + 0x40]
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
mov rcx, rax
call fcn.14001256c
mov rbx, rax
test rax, rax
je 0x140069e6a
mov rdx, qword [rax + 0x40]
mov rcx, rdi
call fcn.140067160
test al, al
je 0x140069e82
mov rcx, rbx
call fcn.14000a83c
jmp 0x140069e82
mov rdx, qword [rdi + 0x40]
mov rcx, rdi
call fcn.140067160
test al, al
je 0x140069e82
mov rcx, rdi
call fcn.14000a83c
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140069e9e
call sub.USER32.dll_GetCapture
cmp rax, rsi
jne 0x140069e9e
call sub.USER32.dll_ReleaseCapture
and byte [rdi + 0x254], 0xf7
jmp 0x14006a4f5
lea rcx, [rdi + 0x108]
mov rdx, rsi
call fcn.1400b00f0
mov r11, qword [rdi]
mov rdx, r14
mov rcx, rdi
call qword [r11 + 0x568]
and byte [rdi + 0x254], 0xf7
lea rcx, vtable.CExtControlBar::InternalDraggingState_t.0
xor edx, edx
mov qword [0x140260678], rdi
mov qword [0x1402606b0], rdi
call fcn.140064880
mov r11, qword [rdi]
mov r9b, 1
mov r8d, 1
mov rdx, rdi
mov rcx, rdi
mov byte [rsp + 0x20], r15b
call qword [r11 + 0x530]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x558]
mov rax, qword [rdi]
or byte [rdi + 0x254], 4
mov rcx, rdi
call qword [rax + 0x350]
lea rdx, [rsp + 0x68]
mov ecx, dword [rax]
mov dword [rdx], ecx
mov ecx, dword [rax + 4]
mov dword [rdx + 4], ecx
mov ecx, dword [rax + 8]
mov eax, dword [rax + 0xc]
mov dword [rdx + 8], ecx
mov dword [rdx + 0xc], eax
mov rbx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
mov ecx, ebx
shr rbx, 0x20
sub ecx, eax
shr rax, 0x20
sub ebx, eax
cmp ecx, ebx
cmovl ebx, ecx
cmp ebx, 2
jle 0x140069f72
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov ebp, eax
jmp 0x140069f84
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
mov ebp, eax
cmp ebx, 2
jg 0x140069f9b
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
mov dword [rsp + 0xf0], ebx
mov dword [rsp + 0xf4], ebp
mov rax, qword [rsp + 0xf0]
mov qword [rdi + 0x264], rax
mov qword [rdi + 0x26c], rax
mov qword [rdi + 0x274], rax
cmp dword [r12], r15d
jne 0x140069fd3
cmp dword [r12 + 4], r15d
je 0x14006a010
mov rcx, rdi
call fcn.140061ce0
test al, al
je 0x140069fec
mov rax, qword [r12]
mov qword [rdi + 0x264], rax
jmp 0x14006a010
mov rcx, rdi
call fcn.140061bf0
test al, al
je 0x14006a005
mov rax, qword [r12]
mov qword [rdi + 0x26c], rax
jmp 0x14006a010
mov rax, qword [r12]
mov qword [rdi + 0x274], rax
mov ebx, 0x11
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov rdx, r14
mov rcx, rdi
movzx r11d, ax
mov rax, qword [rdi]
shr r11d, 0xf
test r11d, r11d
setne r8b
call qword [rax + 0x550]
mov r11, qword [rdi]
lea r8d, [rbx - 0x10]
xor r9d, r9d
mov rdx, rdi
mov rcx, rdi
mov byte [rsp + 0x20], r15b
call qword [r11 + 0x530]
lea r8d, [rbx + 0x21]
xor r9d, r9d
mov edx, 0x1004
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetTimer]
test byte [rdi + 0x254], 4
je 0x14006a4be
lea r13, [0x140000000]
mov r12d, 0x8000
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14006a4be
call qword [sym.imp.USER32.dll_WaitMessage]
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14006a458
nop
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14006a458
mov edx, dword [rsp + 0x40]
xor bpl, bpl
cmp edx, 0xa8
ja 0x14006a10b
cmp edx, 0xa7
jae case.0x14006a109.28
lea eax, [rdx - 0x1c]
cmp eax, 0x89
ja case.0x14006a109.29
movzx eax, byte [r13 + rax + 0x6a534]
mov ecx, dword [r13 + rax*4 + 0x6a52c]
add rcx, r13
jmp rcx
cmp edx, 0x113
je 0x14006a383
cmp edx, 0x200
je 0x14006a147
cmp edx, 0x204
je case.0x14006a109.28
cmp edx, 0x206
jbe case.0x14006a109.29
cmp edx, 0x208
ja case.0x14006a109.29
mov bpl, 1
jmp 0x14006a406
mov r9d, 0x200
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, r9d
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
mov r9d, 0x200
lea rcx, [rsp + 0x38]
mov r8d, r9d
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14006a1cd
nop word [rax + rax]
mov r9d, 0x200
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, r9d
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
mov r9d, 0x200
lea rcx, [rsp + 0x38]
mov r8d, r9d
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14006a190
mov ecx, dword [rsp + 0x50]
movsx eax, cx
shr rcx, 0x10
mov dword [rsp + 0x68], eax
movsx eax, cx
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x6c], eax
cmp rcx, qword [rdi + 0x40]
je 0x14006a208
lea rdx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rdi]
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x48]
mov rcx, rdi
call qword [rax + 0x6a8]
test al, al
je 0x14006a241
mov rax, qword [rdi]
xor r9d, r9d
mov rdx, rdi
lea r8d, [r9 + 1]
mov rcx, rdi
mov byte [rsp + 0x20], r15b
call qword [rax + 0x530]
jmp 0x14006a42d
mov edx, dword [rsp + 0x40]
lea eax, [rdx - 0x100]
cmp eax, 8
ja 0x14006a31d
cmp byte [0x1402727b3], r15b
jne 0x14006a406
cmp edx, 0x100
je 0x14006a275
cmp edx, 0x101
jne 0x14006a315
cmp qword [rsp + 0x48], 0x11
jne 0x14006a315
lea rcx, [rsp + 0xf0]
mov dword [rsp + 0xf0], r15d
mov dword [rsp + 0xf4], r15d
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0xf0]
cmp dword [rdi + 0x280], eax
jne 0x14006a2c8
mov rax, qword [rsp + 0xf0]
shr rax, 0x20
cmp dword [rdi + 0x284], eax
jne 0x14006a2c8
dec dword [rdi + 0x280]
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0xf0]
call qword [sym.imp.USER32.dll_ScreenToClient]
movzx r9d, word [rsp + 0xf4]
movzx eax, word [rsp + 0xf0]
mov rcx, qword [rdi + 0x40]
shl r9d, 0x10
mov r8, r15
or r9, rax
cmp dword [rsp + 0x40], 0x100
mov edx, 0x200
cmove r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14006a406
mov bpl, 1
jmp 0x14006a406
mov rcx, rdi
call fcn.140004970
mov rbx, rax
call sub.USER32.dll_GetCapture
cmp rax, rbx
je 0x14006a33f
mov bpl, 1
mov ebx, 0x11
jmp 0x14006a406
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test r12w, ax
je 0x14006a376
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test r12w, ax
jne 0x14006a376
mov ecx, 4
call qword [sym.imp.USER32.dll_GetKeyState]
test r12w, ax
je 0x14006a401
mov bpl, 1
mov ebx, 0x11
jmp 0x14006a406
cmp dword [rsp + 0x48], 0x1004
jne 0x14006a406
mov r9d, 0x113
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, r9d
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], r15d
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
movzx r9d, word [rsp + 0x34]
movzx eax, word [rsp + 0x30]
mov rcx, qword [rdi + 0x40]
shl r9d, 0x10
mov r8, r15
or r9, rax
cmp dword [rsp + 0x40], 0x100
mov edx, 0x200
cmove r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14006a42d
mov ebx, 0x11
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14006a458
test bpl, bpl
jne 0x14006a44a
call fcn.14000d854
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0xb8]
test eax, eax
je 0x14006a440
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14006a0b0
jmp 0x14006a458
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x14006a458
mov rax, qword [rdi]
mov dl, 1
mov rcx, rdi
call qword [rax + 0x548]
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14006a4be
test byte [rdi + 0x254], 4
je 0x14006a4ac
cmp byte [0x1402727b0], r15b
je 0x14006a4ac
mov ebx, r15d
call fcn.14000d854
xor edx, edx
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0xc0]
test eax, eax
je 0x14006a4ac
inc ebx
call fcn.14000d854
mov edx, ebx
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0xc0]
test eax, eax
jne 0x14006a492
test byte [rdi + 0x254], 4
mov ebx, 0x11
jne 0x14006a086
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14006a4f5
mov edx, 0x1004
mov rcx, rsi
call qword [sym.imp.USER32.dll_KillTimer]
mov r11, qword [rdi]
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, rdi
mov rcx, rdi
mov byte [rsp + 0x20], 1
call qword [r11 + 0x530]
mov rbp, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xb0]
add rsp, 0xd0
pop r14
pop r12
pop rdi
ret