Function at 0x486c50
Capabilities:
Check for unmoving mouse cursor
Check if file exists
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f330
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
cmp eax, 0x3e9
jne 0x486c9e
push eax
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_KillTimer]
push ecx
mov ecx, ebx
call fcn.00486af0
jmp 0x4870d5
cmp eax, 0x3ea
jne 0x486cc0
push eax
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00409c60
mov ecx, eax
call fcn.0045a0f0
jmp 0x4870d5
cmp eax, 0x3eb
jne 0x486d34
push eax
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call esi
push 2
movzx edi, ax
call esi
and eax, 0x80
and edi, 0x80
jne 0x486cf7
test eax, eax
je 0x4870d5
mov eax, dword [ebx + 0x11c]
cmp dword [eax - 0xc], 0
je 0x4870d5
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4870d5
push 1
push 0
push 0
push dword [ebx + 0x11c]
push 0x5bc458
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4870d5
cmp eax, 0x3ec
jne 0x486d57
push eax
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, ebx
call fcn.00489d10
inc dword [0x6434ac]
jmp 0x4870d5
cmp eax, 0x3ed
jne 0x486ea9
lea eax, [ebp - 0x2c]
push eax
call fcn.00489910
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x486e8f
mov ecx, dword [ebx + 0x100]
test ecx, ecx
je 0x486e8f
cmp dword [ecx + 0x104], esi
je 0x486e8f
mov eax, dword [ecx + 0x174]
sub eax, dword [ecx + 0x170]
test eax, 0xfffffffc
je 0x486e8f
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00407a70
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x486e7e
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.004b0f50
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x34]
push eax
call fcn.004bbfa0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
mov dword [ebp - 0x38], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x38]
lea eax, [ebp - 0x20]
push dword [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x486e7e
mov ecx, esi
call fcn.00407ab0
cmp eax, 1
jne 0x486e50
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x38]
add eax, 0xa
cmp ecx, eax
jg 0x486e35
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
add eax, 0xfffffff6
push eax
call fcn.004bbe60
jmp 0x486e7e
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff6
cmp ecx, eax
jl 0x486e7e
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
add eax, 0xa
push eax
call fcn.004bbe60
jmp 0x486e7e
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x3c]
add eax, 0xa
cmp ecx, eax
jg 0x486e65
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff6
jmp 0x486e75
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff6
cmp ecx, eax
jl 0x486e7e
mov eax, dword [ebp - 0x34]
add eax, 0xa
mov ecx, dword [ebp - 0x24]
push eax
call fcn.004bbf00
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x486e8f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4870d5
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x4870d5
cmp eax, 0x3ee
jne 0x486eef
lea ecx, [ebp - 0x2c]
call fcn.004fb3a0
push 0
push 0
push str._active_dr
push dword [eax]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x2c]
call fcn.0040c450
push 0
push 0x36ee80
push 0x3ee
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4870d5
cmp eax, 0x3ef
jne 0x486f67
mov ecx, dword [ebx + 0x100]
test ecx, ecx
je 0x4870d5
mov eax, dword [ecx + 0x174]
sub eax, dword [ecx + 0x170]
test eax, 0xfffffffc
jne 0x486f2e
push ecx
mov ecx, esp
push str.SetAllSplitterVisible
call fcn.0040c2d0
xor ecx, ecx
call fcn.0040b980
add esp, 4
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, dword [ebx + 0x34]
je 0x4870d5
mov ecx, dword [ebx + 0x100]
lea eax, [ebp - 0x25]
push eax
push 0
mov byte [ebp - 0x25], 1
call fcn.004732d0
jmp 0x4870d5
cmp eax, 0x3f0
jne 0x486fd8
lea eax, [ebp - 0x20]
push eax
call fcn.004866b0
mov ecx, dword [ebx + 0x428]
mov eax, dword [ebp - 0x18]
sub ecx, dword [ebx + 0x420]
sub eax, dword [ebp - 0x20]
cmp eax, ecx
jne 0x486fa3
mov ecx, dword [ebx + 0x42c]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebx + 0x424]
sub eax, dword [ebp - 0x1c]
cmp eax, ecx
je 0x486fad
sub esp, 0x10
mov ecx, ebx
call fcn.004867e0
mov ecx, dword [ebx + 0x430]
lea eax, [ecx + 1]
mov dword [ebx + 0x430], eax
cmp ecx, 0xa
jl 0x4870d5
push 0x3f0
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x4870d5
cmp eax, 0x3f1
jne 0x4870aa
call fcn.00519160
push 0x3f1
push dword [ebx + 0x34]
test eax, eax
je 0x487080
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x6434a8], 0
jne 0x487024
push 4
call fcn.00551c81
add esp, 4
test eax, eax
je 0x48701d
mov dword [eax], vtable.r.0
jmp 0x48701f
xor eax, eax
mov dword [0x6434a8], eax
call fcn.0050b280
test al, al
jne 0x4870d5
call fcn.004f7d70
test eax, eax
je 0x4870d5
lea ecx, [ebp - 0x2c]
call fcn.00485ec0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0040c450
test esi, esi
je 0x4870d5
lea ecx, [ebp - 0x24]
call fcn.00485ec0
push 0
push 0
push 0
push dword [eax]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x24]
call fcn.0040c450
jmp 0x4870d5
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x635694]
imul ecx, eax, 0x1d4c0
inc eax
push 0
mov dword [0x635694], eax
push ecx
push 0x3f1
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4870d5
cmp eax, 0x3f2
jne 0x4870d5
push eax
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0048a120
mov ecx, eax
call fcn.004f8190
test eax, eax
jne 0x4870d5
call fcn.0048a120
call fcn.004f7ff0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055199a
mov esp, ebp
pop ebp
ret 0x10