Function at 0x140091440
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
lea r13, [0x1400c6a00]
mov rdi, r9
mov r15, rdx
mov rcx, r13
call fcn.14003dd90
movsxd rcx, eax
mov dword [rsp + 0x138], eax
mov rax, qword [0x1400c6aa0]
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdi + 0x10]
mov r12, qword [rcx]
mov ecx, 0xfffffe6e
cmp eax, ecx
ja 0x140091783
je 0x14009170f
cmp eax, 0xfffffd09
je 0x1400916e1
cmp eax, 0xfffffd0e
je 0x1400916cf
cmp eax, 0xfffffd0f
je 0x14009169b
cmp eax, 0xfffffd16
je 0x140091696
cmp eax, 0xfffffdd9
je 0x14009167d
cmp eax, 0xfffffdda
je 0x14009161f
cmp eax, 0xfffffdee
je 0x140091593
cmp eax, 0xfffffe3d
je 0x14009170f
cmp eax, 0xfffffe64
jne 0x140091e9a
mov rsi, qword [rdi]
mov edx, 0xfffffff0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 8
jae 0x140091e9a
mov eax, SafeArrayAllocDescriptor
cmp word [rdi + 0x18], ax
jne 0x140091e9a
lea r8d, [rax - 0x17]
xor r9d, r9d
mov edx, 0x110a
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
cmp rax, rbx
je 0x140091e9a
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x113e
mov rcx, rsi
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x140091e9a
mov edx, dword [rsp + 0xa0]
xor r8d, r8d
mov rcx, r13
call fcn.1400740c0
jmp 0x140091e9a
xor ebx, ebx
cmp qword [r12 + 0x290], rbx
je 0x140091e9a
mov r9d, dword [0x1400c6ae4]
mov r10, qword [0x1400c6ac8]
lea edx, [rbx + 3]
cmp edx, r9d
lea esi, [rbx + 1]
jg 0x140091e9a
lea r8, [r10 + 0x18]
mov rax, qword [r8]
cmp qword [rax], rbx
je 0x1400915dc
mov rax, qword [rax]
movzx ecx, byte [rax + 0xf7]
cmp rcx, qword [rdi + 8]
je 0x1400915e7
add edx, esi
add r8, 8
cmp edx, r9d
jle 0x1400915c4
cmp edx, r9d
jg 0x140091e9a
movsxd rcx, edx
mov r8d, 0x4f
mov rdx, qword [r10 + rcx*8]
lea rcx, [rdi + 0x20]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0x98]
call fcn.14001760c
mov word [rdi + 0xbe], bx
mov rax, rsi
jmp 0x140091eb6
mov ecx, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
cmp ax, bx
jge 0x140091e9a
lea ecx, [rbx + 9]
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jge 0x140091e9a
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [rbx + 0x10]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jge 0x140091670
dec ebp
jmp 0x140091672
inc ebp
mov r8d, ebp
mov edx, dword [rdi + 8]
jmp 0x140091586
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, rax
jmp 0x140091675
mov r8d, eax
jmp 0x140091675
mov esi, 1
cmp byte [r12 + 0x2a6], sil
jne 0x1400916b8
mov edx, dword [rdi + 8]
mov r8d, eax
mov rcx, r13
call fcn.1400740c0
xor ebx, ebx
mov byte [r12 + 0x2a6], bl
mov byte [r12 + 0x2a5], bl
jmp 0x140091e9a
mov esi, 1
mov byte [r12 + 0x2a5], sil
jmp 0x140091e9a
xor ebx, ebx
mov esi, 1
mov byte [r12 + 0x2a6], sil
cmp byte [r12 + 0x2a5], bl
jne 0x140091e9a
mov byte [r12 + 0x2a6], bl
mov r8d, dword [rdi + 0x10]
jmp 0x140091675
mov rcx, qword [rdi]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
cmp rax, rbx
je 0x140091e9a
mov rcx, qword [rdi]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x140091e9a
mov rax, qword [rdi + 0x88]
cmp qword [rdi + 0x50], rax
je 0x140091e9a
cmp dword [rdi + 0x18], 0x1000
je 0x140091e9a
lea esi, [rbx + 1]
cmp dword [rdi + 0x18], esi
jmp 0x140091576
cmp eax, 0xfffffec0
je 0x140091e8b
cmp eax, 0xfffffed4
je 0x140091e8b
cmp eax, 0xffffff93
je 0x140091dc0
cmp eax, 0xffffff94
je 0x140091d06
cmp eax, 0xfffffff0
je 0x140091cfb
cmp eax, 0xfffffff4
je 0x140091bca
cmp eax, 0xfffffffb
je 0x14009193c
cmp eax, 0xfffffffe
jne 0x140091e9a
mov r8d, 1
mov rdx, r12
mov rcx, r13
call fcn.140065d80
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rdi]
mov rcx, r13
call fcn.14004e150
cmp eax, 0xffffffff
je 0x140091e9a
movsxd rcx, eax
mov rax, qword [0x1400c6ac8]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov cl, byte [rax + 0xf4]
cmp cl, 0x10
jb 0x140091e9a
cmp cl, 0x11
jbe 0x1400918a6
cmp cl, 0x13
jne 0x140091e9a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x1012
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x140091e9a
mov rcx, qword [rdi]
lea r9, [rsp + 0xa8]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0xac], eax
mov dword [rsp + 0xa8], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x40], 0xe
je 0x140091e9a
mov edx, dword [rsp + 0xd0]
jmp 0x140091583
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1111
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
cmp rax, rbx
je 0x140091e9a
mov rcx, qword [rdi]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], recvfrom
mov dword [rsp + 0x84], 0xf000
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x58], 0x46
je 0x140091e9a
mov rcx, qword [rdi]
xor r9d, r9d
mov ebx, 0x110b
lea r8d, [r9 + 9]
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rsp + 0x60]
mov r8d, 9
mov edx, ebx
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140091e9a
xor ebx, ebx
mov rdx, r12
mov rcx, r13
lea esi, [rbx + 1]
mov r14b, bl
mov r8d, esi
call fcn.140065d80
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rdi]
mov rcx, r13
call fcn.14004e150
mov ebp, eax
mov dword [rsp + 0x120], eax
cmp eax, 0xffffffff
jne 0x1400919ad
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, r13
mov rdx, rax
call fcn.14004e150
mov ebp, eax
mov dword [rsp + 0x120], eax
cmp eax, 0xffffffff
je 0x140091e9a
mov r14b, sil
mov rax, qword [0x1400c6ac8]
movsxd rcx, ebp
mov r13d, ebp
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov cl, byte [rax + 0xf4]
cmp cl, 0x10
je 0x140091ae2
cmp cl, 0x13
jne 0x140091e9a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x1012
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jle 0x140091a91
cmp r14b, bl
jne 0x140091a91
mov rcx, qword [rdi]
lea r9, [rsp + 0xa8]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0xac], eax
mov dword [rsp + 0xa8], 4
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, rbx
je 0x140091e9a
test byte [rsp + 0x40], 0xe
je 0x140091a91
mov edx, dword [rsp + 0xd0]
lea r9, [rsp + 0x120]
lea r8, [rsp + 0x138]
lea rcx, [0x1400c6a00]
call fcn.14004e0b0
cmp al, bl
je 0x140091a91
movsxd rbp, dword [rsp + 0x120]
mov rax, qword [0x1400c6ac8]
mov rax, qword [rax + rbp*8]
cmp qword [rax], rbx
je 0x140091a8e
mov rax, qword [rax]
cmp qword [rax + 0x10], rbx
jne 0x140091a91
mov ebp, r13d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [0x1400c6ac8]
movsxd rcx, ebp
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x10]
cmp rcx, rbx
je 0x140091e9a
mov rax, qword [r12]
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x140091e9a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1111
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, rbx
je 0x140091b76
mov rcx, qword [rdi]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x58], 0x46
je 0x140091b76
mov edx, dword [rsp + 0xa0]
lea r9, [rsp + 0x120]
lea r8, [rsp + 0x138]
lea rcx, [0x1400c6a00]
call fcn.14004e0b0
cmp al, bl
je 0x140091b76
movsxd rbp, dword [rsp + 0x120]
mov rax, qword [0x1400c6ac8]
mov rcx, qword [rax + rbp*8]
mov rax, qword [rcx]
cmp qword [rax + 0x10], rbx
cmove ebp, r13d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [0x1400c6ac8]
movsxd rcx, ebp
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x10]
cmp rcx, rbx
je 0x140091e9a
mov rax, qword [r12]
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov edx, 0x80
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x140091617
mov rdx, qword [rdi]
mov rcx, r13
call fcn.14004e150
mov dword [rsp + 0x120], eax
cmp eax, 0xffffffff
je 0x140091e9a
mov r13, qword [0x1400c6ac8]
cdqe
mov rax, qword [r13 + rax*8]
mov rcx, qword [rax]
mov al, byte [rcx + 0xf4]
cmp al, 0x10
je 0x140091c08
cmp al, 0x13
jne 0x140091e9a
mov eax, dword [rdi + 0x18]
mov esi, 1
sub eax, esi
je 0x140091cf1
cmp eax, 0x10000
jne 0x140091e9a
mov edx, dword [rdi + 0x48]
xor ebx, ebx
cmp dword [rcx + 0x88], 0xfe000000
lea r9, [rsp + 0x120]
lea r8, [rsp + 0x138]
lea rcx, [0x1400c6a00]
movzx r12d, bl
cmove r12d, esi
call fcn.14004e0b0
cmp al, bl
jne 0x140091c61
xor eax, eax
jmp 0x140091eb6
movsxd rbp, dword [rsp + 0x120]
mov edx, 0xfffffff0
mov rax, qword [r13 + rbp*8]
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1b
jb 0x140091c5a
test byte [rdi + 0x40], 0x10
mov rdx, qword [0x1400c6ac8]
jne 0x140091c99
test byte [rdi + 0x40], sil
je 0x140091cad
mov rax, qword [rdx + rbp*8]
mov rcx, qword [rax]
cmp byte [rcx + 0xf4], 0x14
jne 0x140091e9a
mov rax, qword [rdx + rbp*8]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x8c]
cmp eax, 0xffffffff
je 0x140091cc9
mov dword [rdi + 0x50], eax
mov rdx, qword [0x1400c6ac8]
mov rax, qword [rdx + rbp*8]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x88]
cmp eax, ebx
jl 0x140091c5a
cmp r12b, bl
je 0x140091ce9
test byte [rdi + 0x38], sil
je 0x140091c5a
mov dword [rdi + 0x54], eax
jmp 0x140091c5a
mov eax, SafeArrayAllocDescriptor
jmp 0x140091eb6
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x140091e9a
mov ebp, dword [rdi + 8]
lea r9, [rsp + 0x120]
lea r8, [rsp + 0x138]
mov edx, ebp
mov rcx, r13
call fcn.14004e0b0
xor ebx, ebx
cmp al, bl
je 0x140091e9a
mov rax, qword [0x1400c6ac8]
movsxd rsi, dword [rsp + 0x120]
xor r8d, r8d
mov rcx, qword [rax + rsi*8]
movzx eax, word [rdi + 0x1c]
mov rdx, qword [rcx]
mov rcx, r13
mov word [rdx + 0xfa], ax
mov edx, dword [rdi + 8]
call fcn.1400740c0
mov r11, qword [0x1400c6ac8]
mov rax, qword [r11 + rsi*8]
mov rcx, qword [rax]
cmp qword [rcx + 0x48], rbx
jbe 0x140091e9a
mov dword [0x1400c6a58], ebp
mov rax, qword [r11 + rsi*8]
lea rcx, [0x1400c6a60]
mov rdx, qword [rax]
add rdx, 0x40
call fcn.140012600
mov r11, qword [0x1400c6ac8]
lea r9, [0x140093980]
mov rax, qword [r11 + rsi*8]
mov edx, 0x1030
mov rcx, qword [rax]
mov al, byte [rcx + 0xfc]
mov byte [0x1400c6a80], al
movsxd r8, dword [rdi + 0x1c]
jmp 0x14009192e
mov rcx, qword [0x1400c6b20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.COMCTL32.dll_ImageList_SetDragCursorImage]
mov rcx, qword [0x1400c6b20]
xor edx, edx
lea r9d, [rdx - 0x10]
lea r8d, [rdx - 8]
call qword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
mov rcx, r15
call qword [sym.imp.USER32.dll_SetCapture]
mov rbp, qword [rsp + 0x130]
xor ebx, ebx
lea esi, [rbx + 1]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov dword [0x1400c6b28], ebp
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], esi
call fcn.140007a40
lea rdx, str._GUI_DRAGID
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebp
call fcn.140001d30
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [0x1400c69c8]
mov r9d, esi
mov dword [rsp + 0x20], 2
call fcn.140082f90
lea rcx, [rsp + 0x50]
call fcn.140002610
mov rcx, qword [rdi]
lea rdx, [rdi + 0x2c]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r8d, dword [rdi + 0x30]
mov edx, dword [rdi + 0x2c]
xor ecx, ecx
call qword [sym.imp.COMCTL32.dll_ImageList_DragEnter]
lea rcx, [rsp + 0x38]
call fcn.140007a40
jmp 0x140091ea2
mov rcx, qword [rdi]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rbp, qword [rsp + 0x130]
movsxd r8, ebp
mov r9, rdi
mov edx, 0x4e
mov rcx, r15
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret