Function at 0x1400c2de0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp - 8], rax
cmp dword [rbp + 0x70], 0
mov r15, r9
mov r13, qword [rbp + 0x68]
mov rbx, rcx
mov r12, qword [rbp + 0x60]
jne 0x1400c37e7
cmp r8d, 1
jne 0x1400c2f3d
cmp qword [rcx + 0x50], 8
lea rdx, [rcx + 0x38]
jb 0x1400c2e35
mov rdx, qword [rdx]
mov eax, dword [rcx + 0x88]
mov dword [rcx + 0x5e8], eax
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x1400c2e50
mov r8, rcx
lea rcx, [rbx + 0x610]
call fcn.14007ece0
mov ecx, dword [rbx + 0x90]
xor r8d, r8d
mov eax, dword [rbx + 0x88]
mov dword [rbx + 0x748], ecx
mov dword [rbx + 0x6d0], eax
mov edx, dword [rbx + 0x8c0]
lea ecx, [r8 + 0xc]
mov edi, dword [rbx + 0x88]
call fcn.140127140
mov qword [rbx + 0x7d0], rax
mov ecx, recv
mov qword [rbx + 0x7d8], rax
mov qword [rbx + 0x7e0], rax
mov edx, dword [rbx + 0x8c0]
call fcn.140127280
xor r8d, r8d
mov qword [rbx + 0x7f0], rax
mov qword [rbx + 0x7f8], rax
mov qword [rbx + 0x800], rax
mov edx, dword [rbx + 0x8c0]
lea ecx, [r8 + 0xe]
call fcn.140127140
mov qword [rbx + 0x810], rax
mov ecx, reloc.WLDAP32.dll_Ordinal_14
mov qword [rbx + 0x818], rax
mov qword [rbx + 0x820], rax
mov edx, dword [rbx + 0x8c0]
call fcn.140127280
mov qword [rbx + 0x830], rax
mov rcx, rbx
mov qword [rbx + 0x838], rax
mov qword [rbx + 0x840], rax
mov dword [rbx + 0x788], edi
call fcn.140130b00
xor r14d, r14d
mov qword [r13], r14
lea eax, [r14 + 1]
jmp 0x1400c37e9
cmp r8d, 0x85
jne 0x1400c2f5f
mov r9, r12
mov r8, r15
call fcn.14012d9d0
mov qword [r13], rax
mov eax, 1
jmp 0x1400c37e9
cmp r8d, 0x820
jne 0x1400c2f81
mov r9, r12
mov r8, r15
call fcn.14012def0
mov qword [r13], rax
mov eax, 1
jmp 0x1400c37e9
mov esi, 1
cmp r8d, 8
jne 0x1400c30a2
xor r14d, r14d
cmp r15, qword [rcx + 0xb8]
je 0x1400c3a11
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x30], r14
call qword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
lea rdx, [rbp - 0x28]
movzx r8d, sil
mov qword [rbp - 0x28], rax
mov rcx, rbx
mov qword [rbp - 0x20], rax
call fcn.14012ae10
mov eax, dword [rbx + 0xa8]
add eax, dword [rbp - 0x28]
sub dword [rbp - 0x30], eax
mov eax, dword [rbx + 0xac]
add eax, dword [rbp - 0x24]
sub dword [rbp - 0x2c], eax
cmp byte [rbx + 0xa4], r14b
je 0x1400c2ff4
mov rdx, r15
mov rcx, rbx
call fcn.140132450
add rbx, 0x780
mov rax, qword [rbx + 0x38]
sub rax, qword [rbx + 0x30]
sar rax, 4
cmp eax, esi
jle 0x1400c3a11
lea rcx, [rbx + 0xc]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1400c3a11
cmp byte [rbx + 0x13c], r14b
je 0x1400c3a11
cmp byte [rbx + 0x145], r14b
je 0x1400c3046
lea r8, [rbp - 0x30]
mov edx, r15d
mov rcx, rbx
call fcn.1401201a0
mov rax, qword [rbx + 0x38]
sub rax, qword [rbx + 0x30]
sar rax, 4
cmp eax, esi
jle 0x1400c3a11
lea rcx, [rbx + 0xc]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1400c3a11
cmp byte [rbx + 0x13c], r14b
je 0x1400c3a11
mov edx, dword [rbx + 0x48]
cmp edx, 0xffffffff
je 0x1400c3a11
mov rcx, rbx
call fcn.14011ea80
mov rcx, 0xffffffffffffffff
mov eax, esi
mov dword [rbx + 0x48], ecx
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x20a
jne 0x1400c3166
shr r15, 0x10
mov rax, r12
shr rax, 0x10
movsx ecx, ax
add ecx, dword [rbx + 0xac]
movsx eax, r12w
add eax, dword [rbx + 0xa8]
mov dword [rbp - 0x28], eax
mov rax, qword [rbx + 0x7b8]
sub rax, qword [rbx + 0x7b0]
sar rax, 4
movsx esi, r15w
mov dword [rbp - 0x24], ecx
cmp eax, 1
jle 0x1400c3143
lea rcx, [rbx + 0x78c]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1400c3143
cmp byte [rbx + 0x8bc], al
je 0x1400c3143
mov rdx, qword [rbp - 0x28]
lea rcx, [rbx + 0x78c]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x1400c3143
mov edx, Ordinal_41
mov eax, Ordinal_41
test esi, esi
mov rcx, rbx
cmovg edx, eax
call fcn.140132500
xor r14d, r14d
mov qword [r13], r14
lea eax, [r14 + 1]
jmp 0x1400c37e9
cmp byte [rbx + 0x74c], 0
je 0x1400c3156
mov edx, esi
mov rcx, rbx
call fcn.140133b80
xor r14d, r14d
mov qword [r13], r14
lea eax, [r14 + 1]
jmp 0x1400c37e9
xor r14d, r14d
cmp r8d, 0x200
jne 0x1400c31c4
cmp byte [rcx + 0x9d], r14b
je 0x1400c3180
call fcn.140132600
cmp byte [rbx + 0x74d], sil
je 0x1400c3a11
mov byte [rbx + 0x74d], sil
cmp byte [rbx + 0x74c], r14b
je 0x1400c3a11
mov ecx, dword [rbx + 0x6d0]
lea rdx, [rbx + 0x6d4]
mov r8d, 2
call fcn.1401260a0
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x2a3
jne 0x1400c321f
cmp byte [rcx + 0x9d], r14b
je 0x1400c31db
call fcn.140132700
cmp byte [rbx + 0x74d], r14b
je 0x1400c3a11
mov byte [rbx + 0x74d], r14b
cmp byte [rbx + 0x74c], r14b
je 0x1400c3a11
mov ecx, dword [rbx + 0x6d0]
lea rdx, [rbx + 0x6d4]
mov r8d, 2
call fcn.1401260a0
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0xa1
jne 0x1400c323e
mov r9, r12
mov r8, r15
call fcn.14012eb10
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0xa3
jne 0x1400c325d
mov r9, r12
mov r8, r15
call fcn.14012ed60
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0xa0
jne 0x1400c327c
mov r9, r12
mov r8, r15
call fcn.14012ef20
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0x2a2
jne 0x1400c3359
add rcx, 0x5d0
call fcn.140124970
cmp byte [rbx + 0x74c], r14b
je 0x1400c32f1
cmp byte [rbx + 0x74d], r14b
je 0x1400c32c6
mov ecx, dword [rbx + 0x6d0]
lea rdx, [rbx + 0x6d4]
mov r8d, 2
mov byte [rbx + 0x74d], r14b
call fcn.1401260a0
cmp dword [rbx + 0x734], 0xffffffff
je 0x1400c32f1
mov ecx, dword [rbx + 0x6d0]
lea rdx, [rbx + 0x6d4]
mov r8d, 2
mov dword [rbx + 0x734], 0xffffffff
call fcn.1401260a0
lea rdi, [rbx + 0x780]
mov rax, qword [rdi + 0x38]
sub rax, qword [rdi + 0x30]
sar rax, 4
cmp eax, esi
jle 0x1400c3339
lea rcx, [rdi + 0xc]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1400c3339
cmp byte [rdi + 0x13c], r14b
je 0x1400c3339
mov edx, dword [rdi + 0x48]
cmp edx, 0xffffffff
je 0x1400c3339
mov rcx, rdi
call fcn.14011ea80
mov rcx, 0xffffffffffffffff
mov dword [rdi + 0x48], ecx
cmp byte [rbx + 0x9d], r14b
je 0x1400c3a11
mov rcx, rbx
call fcn.140132700
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0xa2
jne 0x1400c34c6
movsx eax, r12w
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], eax
mov r8d, r15d
shr r12, 0x10
movsx eax, r12w
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
shr rax, 0x20
add eax, dword [rcx + 0xac]
mov dword [rbp - 0x2c], eax
mov eax, dword [rcx + 0xa8]
add rcx, 0x5d0
add dword [rbp - 0x30], eax
call fcn.140124320
test al, al
jne 0x1400c349f
lea rcx, [rbx + 0x780]
mov r8d, r15d
lea r9, [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.14011ed50
test al, al
jne 0x1400c349f
cmp byte [rbx + 0x74c], r14b
je 0x1400c3482
mov eax, dword [rbx + 0x738]
xor cl, cl
mov byte [rbx + 0x744], cl
mov qword [rbx + 0x73c], r14
cmp eax, 0xffffffff
je 0x1400c3482
cmp eax, 3
jbe 0x1400c3405
cmp eax, 5
jne 0x1400c346d
cmp byte [rbx + 0x704], r14b
je 0x1400c3469
mov edx, dword [rbx + 0x748]
mov r8d, 4
movsxd r9, dword [rbx + 0x724]
and edx, 0x200000
mov ecx, dword [rbx + 0x6d0]
or edx, 0x22800000
shr edx, 0x15
call fcn.140125f60
mov edx, dword [rbx + 0x748]
xor r9d, r9d
mov ecx, dword [rbx + 0x6d0]
and edx, 0x200000
or edx, 0x22800000
mov byte [rbx + 0x704], r14b
shr edx, 0x15
lea r8d, [r9 + 8]
call fcn.140125f60
movzx ecx, sil
mov dword [rbx + 0x738], 0xffffffff
mov dword [rbx + 0x734], r15d
test cl, cl
jne 0x1400c349f
cmp byte [rbx + 0xa4], r14b
je 0x1400c349f
cmp byte [rbx + 0xc1], r14b
jne 0x1400c349f
mov rdx, r15
mov rcx, rbx
call fcn.140132450
mov r9d, dword [rbx + 0x88]
xor r8d, r8d
mov rcx, qword [rbx + 0xb8]
mov edx, 0x804
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0xa5
je 0x1400c3a11
cmp r8d, 0x201
jne 0x1400c3514
cmp byte [rcx + 0x9d], r14b
je 0x1400c3a11
mov edi, dword [0x140492ccc]
test edi, edi
je 0x1400c3a11
call fcn.140132940
cmp eax, edi
je 0x1400c3a11
call fcn.1401261c0
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 5
jne 0x1400c353a
call fcn.140130da0
mov rcx, rbx
call fcn.14012bd20
mov rcx, rbx
call fcn.140130300
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, reloc.OLEAUT32.dll_VarUI4FromDisp
jne 0x1400c355b
mov r8, r15
mov edx, reloc.OLEAUT32.dll_VarUI4FromDisp
call fcn.14012ff40
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0x114
jne 0x1400c357c
mov r8, r15
mov edx, VarUI4FromDisp
call fcn.14012ff40
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0x20
jne 0x1400c3601
movsx eax, r12w
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x28], eax
shr r12, 0x10
movsx eax, r12w
mov dword [rbp - 0x24], eax
call fcn.14012e3f0
add eax, 0xfffffffe
cmp eax, 0xf
ja case.0x1400c35b6.3
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xc3b34]
add rcx, rdx
jmp rcx
mov edx, 0x7f84
jmp 0x1400c35e5
mov edx, 0x7f85
jmp 0x1400c35e5
mov edx, 0x7f82
jmp 0x1400c35e5
mov edx, 0x7f83
jmp 0x1400c35e5
mov rax, qword [rbx + 0x320]
test rax, rax
jne 0x1400c35ed
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x215
jne 0x1400c36d0
cmp r12, qword [rcx + 0xb8]
je 0x1400c3a11
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x30], r14
call qword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
lea rdx, [rbp - 0x28]
movzx r8d, sil
mov qword [rbp - 0x28], rax
mov rcx, rbx
mov qword [rbp - 0x20], rax
call fcn.14012ae10
mov eax, dword [rbx + 0xa8]
add eax, dword [rbp - 0x28]
sub dword [rbp - 0x30], eax
mov eax, dword [rbx + 0xac]
add eax, dword [rbp - 0x24]
sub dword [rbp - 0x2c], eax
cmp byte [rbx + 0xa4], r14b
je 0x1400c366f
mov rdx, r15
mov rcx, rbx
call fcn.140132450
add rbx, 0x780
mov rax, qword [rbx + 0x38]
sub rax, qword [rbx + 0x30]
sar rax, 4
cmp eax, esi
jle 0x1400c3a11
lea rcx, [rbx + 0xc]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1400c3a11
cmp byte [rbx + 0x13c], r14b
je 0x1400c3a11
cmp byte [rbx + 0x145], r14b
je 0x1400c3a11
lea r8, [rbp - 0x30]
mov edx, r15d
mov rcx, rbx
call fcn.1401201a0
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x100
jne 0x1400c380d
mov ecx, r14d
cmp r15, 0x25
jb 0x1400c37b5
cmp r15, 0x28
ja 0x1400c37b5
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffff8000
test cx, ax
je 0x1400c37a2
mov rax, qword [rbx + 0x7b8]
sub rax, qword [rbx + 0x7b0]
sar rax, 4
cmp eax, esi
jle 0x1400c379d
lea rcx, [rbx + 0x78c]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1400c379d
cmp byte [rbx + 0x8bc], r14b
je 0x1400c379d
mov edi, dword [rbx + 0x25c]
lea rcx, [rbx + 0x780]
add edi, 0x3e8
mov edx, edi
call fcn.1401200a0
lea r8d, [r15 - 0x25]
mov rcx, 0xffffffffffffffff
cmp r8d, esi
mov edx, edi
cmova ecx, esi
lea r8d, [rcx + rax]
lea rcx, [rbx + 0x780]
call fcn.14011fdd0
mov edx, edi
lea rcx, [rbx + 0x780]
call fcn.1401200a0
mov edx, dword [rbx + 0x25c]
mov r8d, eax
mov rcx, rbx
call fcn.14012a910
mov ecx, esi
jmp 0x1400c37b5
mov ecx, r14d
jmp 0x1400c37b5
mov edx, r15d
mov rcx, rbx
call fcn.140132500
test al, al
mov ecx, r14d
setne cl
test ecx, ecx
jne 0x1400c37db
mov eax, dword [rbx + 0x25c]
mov ecx, r14d
test eax, eax
je 0x1400c37db
mov r9, r12
mov r8, r15
mov edx, 0x100
mov ecx, eax
call fcn.140125f60
mov ecx, r14d
mov qword [r13], r14
test ecx, ecx
jne 0x1400c3a15
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401aed20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r8d, 0x2e0
jne 0x1400c3838
lea rax, [rbp - 0x30]
mov dword [rbp - 0x30], esi
mov r8, r15
mov qword [rsp + 0x20], rax
call fcn.14012e890
mov qword [r13], rax
cmp dword [rbp - 0x30], r14d
je 0x1400c37e7
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0x808
jne 0x1400c385a
test r12, r12
je 0x1400c3a11
mov r9, r12
call fcn.140130210
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x824
jne 0x1400c3876
mov r9, r12
call fcn.140130210
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0x830
jne 0x1400c38b9
test r12, r12
je 0x1400c3a11
add rcx, 0x780
mov rdx, r12
call fcn.14011fa00
mov ecx, dword [rbx + 0x25c]
mov edx, 0x808
mov r9, r12
lea r8d, [rdx + 0x28]
call fcn.140125f60
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x825
jne 0x1400c38dc
add rcx, 0x780
mov rdx, r12
call fcn.14011fa00
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x80f
jne 0x1400c38f8
mov r8, r15
call fcn.1401308e0
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0xbd8
jne 0x1400c3918
add rcx, 0x5d0
call fcn.140124a00
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x81f
jne 0x1400c3931
call fcn.140130300
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0x809
jne 0x1400c395e
cmp byte [rcx + 0x9c], r14b
jne 0x1400c3a11
mov dword [rcx + 0xa0], r14d
call fcn.140132600
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x80c
jne 0x1400c3a1c
xor eax, eax
lea rdx, [rbp - 0x18]
movzx r8d, sil
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
call fcn.14012ae10
mov edx, dword [rbx + 0xa8]
mov ecx, dword [rbx + 0xac]
movsx eax, r12w
sub eax, dword [rbp - 0x18]
sub eax, edx
shr r12, 0x10
mov dword [rbp - 0x28], eax
movsx eax, r12w
sub eax, dword [rbp - 0x14]
sub eax, ecx
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
add dword [rbp - 0x30], edx
shr rax, 0x20
add eax, ecx
mov dword [rbp - 0x2c], eax
mov rax, qword [rbx + 0x7b8]
sub rax, qword [rbx + 0x7b0]
sar rax, 4
cmp eax, esi
jle 0x1400c3a11
lea rcx, [rbx + 0x78c]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1400c3a11
cmp byte [rbx + 0x8bc], r14b
je 0x1400c3a11
lea rdx, [rbp - 0x30]
lea rcx, [rbx + 0x780]
call fcn.14011eb40
cmp eax, 0xffffffff
je 0x1400c3a11
mov edx, eax
lea rcx, [rbx + 0x780]
call fcn.14011ff50
mov qword [r13], r14
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0x80b
jne 0x1400c3a3e
cmp byte [rcx + 0x9c], r14b
je 0x1400c3a11
call fcn.140132700
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x80d
je 0x1400c3a11
cmp r8d, 0x822
jne 0x1400c3a66
mov r9, r12
mov r8, r15
call fcn.140130690
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9
cmp r8d, 0x829
jne 0x1400c3ab3
test dword [rcx + 0x90], 0xc00000
je 0x1400c3a92
test r12, r12
setne al
mov byte [rcx + 0x318], al
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
mov ecx, dword [rcx + 0x8c]
mov r9, r12
mov r8, r15
mov edx, 0x829
call fcn.140126000
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp r8d, 0x111
jne 0x1400c37e7
mov r8d, 0x3e9
cmp r8w, r15w
jne 0x1400c3b12
cmp byte [rcx + 0x9d], r14b
je 0x1400c3af8
cmp dword [rcx + 0xa0], esi
jne 0x1400c3af8
cmp byte [rcx + 0x9c], r14b
je 0x1400c3aff
xor edx, edx
call fcn.1401331d0
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
cmp byte [rcx + 0x9c], r14b
sete dl
call fcn.1401335d0
mov eax, esi
mov qword [r13], r14
jmp 0x1400c37e9
mov eax, 0x3eb
cmp ax, r15w
jne 0x1400c37e7
call fcn.140130970
mov qword [r13], rax
mov eax, esi
jmp 0x1400c37e9