Function at 0x480717
Capabilities:
Check for unmoving mouse cursor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4be8a6
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x4fc504]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push esi
push edi
mov eax, dword [0x4fc504]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [esp + 0x28], edi
mov eax, dword [edi + 8]
cmp eax, 0x7d1
je 0x480d24
cmp eax, 0x7ec
je 0x480d08
cmp eax, 0xfffffdd9
je 0x480cd3
cmp eax, 0xfffffdee
je 0x480a44
cmp eax, 0xfffffffb
je 0x4807ea
cmp eax, 0xfffffffe
jne 0x480d6f
cmp dword [edi + 4], 0x161
jne 0x480d75
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x480d75
inc dword [esi + 0x798]
lea ecx, [esi + 0xa7c]
push ebx
push str.statusbar.number
call fcn.00452214
xor ecx, ecx
inc ecx
cmp dword [esi + 0x798], eax
jle 0x4807dd
mov dword [esi + 0x798], ecx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x34]
jmp 0x480d75
cmp dword [edi + 4], 0x162
jne 0x480d75
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0x770]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
push eax
push ebx
push 0x130d
push dword [esi + 0x770]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0xb18], eax
je 0x48086d
push 1
push eax
mov ecx, esi
call fcn.0046b7c0
mov ecx, esi
call fcn.004731b9
lea ecx, [esi + 0x774]
call fcn.00430fa3
mov eax, dword [esi]
xor edi, edi
inc edi
mov ecx, esi
push edi
push 0x69
push 0x4ea214
call dword [eax + 0x170]
mov eax, dword [esi]
mov ecx, esi
push edi
push ebx
push 0x4d3406
call dword [eax + 0x170]
mov eax, dword [esi]
mov ecx, esi
push edi
push 0x6a
push 0x4ed70c
call dword [eax + 0x170]
mov eax, dword [esi]
mov ecx, esi
push edi
push 0x6e
push str.Save_As
call dword [eax + 0x170]
mov eax, dword [esi]
mov ecx, esi
push edi
push ebx
push 0x4d3406
call dword [eax + 0x170]
mov byte [esp + 0x17], bl
mov edi, ebx
push str.command.name.
lea ecx, [esp + 0x30]
call fcn.004016ae
mov edx, edi
mov dword [esp + 0xd8], ebx
lea ecx, [esp + 0x98]
call fcn.00487f67
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xe4], 1
call fcn.00401d1b
push ebx
push 1
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe0], bl
call fcn.0040177c
push 0x4d7120
call fcn.004914f0
pop ecx
push eax
push 0x4d7120
lea ecx, [esp + 0x34]
call fcn.00401dc0
lea eax, [esp + 0x80]
push eax
lea ecx, [esi + 0x254]
call fcn.0042e93d
mov byte [esp + 0xd8], 2
cmp dword [eax + 0x14], 0x10
jb 0x480964
mov eax, dword [eax]
cmp dword [esp + 0x40], 0x10
mov ecx, dword [esp + 0x2c]
jae 0x480973
lea ecx, [esp + 0x2c]
push eax
push ecx
lea eax, [esp + 0x58]
push eax
lea ecx, [esi + 0xa7c]
call fcn.00452d54
push ebx
push 1
lea ecx, [esp + 0x88]
mov byte [esp + 0xe0], 4
call fcn.0040177c
cmp dword [esp + 0x60], 0
je 0x4809cb
cmp dword [esp + 0x64], 0x10
mov ecx, dword [esp + 0x50]
jae 0x4809b2
lea ecx, [esp + 0x50]
mov edx, dword [esi]
lea eax, [edi + 0x44c]
push 1
push eax
push ecx
mov ecx, esi
call dword [edx + 0x170]
mov byte [esp + 0x17], 1
push ebx
push 1
lea ecx, [esp + 0x58]
call fcn.0040177c
or dword [esp + 0xd8], 0xffffffff
lea ecx, [esp + 0x2c]
push ebx
push 1
call fcn.0040177c
inc edi
cmp edi, 0x32
jl 0x4808d9
mov al, byte [esp + 0x17]
test al, al
je 0x480a0f
mov eax, dword [esi]
mov ecx, esi
push 1
push ebx
push 0x4d3406
call dword [eax + 0x170]
mov eax, dword [esi]
mov ecx, esi
push 1
push 0x83
push 0x4ed71c
call dword [eax + 0x170]
lea eax, [esi + 0x73c]
push eax
push dword [esp + 0x20]
lea ecx, [esi + 0x774]
push dword [esp + 0x20]
call fcn.00430fc0
jmp 0x480d75
mov eax, dword [edi + 4]
mov ecx, 0xcc
push 6
pop ebx
cmp eax, ecx
ja 0x480add
je 0x480ad3
add ecx, 0xffffffb7
cmp eax, ecx
ja 0x480aa8
je 0x480a9e
sub eax, 0x65
je 0x480a94
dec eax
je 0x480a8a
sub eax, 3
je 0x480a80
dec eax
jne 0x480b17
mov eax, str.Save
jmp 0x480c41
mov eax, 0x4ed758
jmp 0x480c41
mov eax, str.Open
jmp 0x480c41
mov eax, 0x4ed738
jmp 0x480c41
mov eax, str.Print
jmp 0x480c41
sub eax, 0xc9
je 0x480ac9
dec eax
je 0x480abf
dec eax
jne 0x480b17
mov eax, 0x4ed770
jmp 0x480c41
mov eax, str.Redo
jmp 0x480c41
mov eax, str.Undo
jmp 0x480c41
mov eax, str.Copy
jmp 0x480c41
sub eax, 0xcd
je 0x480c3c
dec eax
je 0x480c35
sub eax, 4
je 0x480c2e
sub eax, ebx
je 0x480c27
sub eax, 0x5f
je 0x480c20
dec eax
je 0x480c19
dec eax
je 0x480c12
lea eax, [esp + 0x20]
xor ebx, ebx
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x770]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
push eax
push ebx
push 0x130d
push dword [esi + 0x770]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x480d75
imul eax, eax, 0xa0
add eax, dword [esi + 0xb24]
cmp dword [eax + 0x14], 8
jb 0x480b90
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x30]
call fcn.0042f8f2
mov dword [esp + 0xd8], 5
mov edi, ebx
push 0x4ea954
call fcn.00495da8
pop ecx
push eax
push edi
push 0x4ea954
lea ecx, [esp + 0x38]
call fcn.0042fbd1
mov edi, eax
cmp edi, 0xffffffff
je 0x480be9
push 0x4ea954
call fcn.00495da8
pop ecx
push eax
push 0x4ea954
push edi
lea ecx, [esp + 0x38]
call fcn.0046a2ad
add edi, 2
jmp 0x480ba7
cmp dword [esp + 0x40], 8
mov edx, dword [esp + 0x2c]
jae 0x480bf8
lea edx, [esp + 0x2c]
add esi, 0xd94
mov ecx, esi
call fcn.00482673
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
jmp 0x480cc3
mov eax, str.Run_Macro
jmp 0x480c41
mov eax, str.Stop_Recording
jmp 0x480c41
mov eax, str.Record_Macro
jmp 0x480c41
mov eax, 0x4ed7c4
jmp 0x480c41
mov eax, 0x4ed7b8
jmp 0x480c41
mov eax, str.Delete
jmp 0x480c41
mov eax, str.Paste
push eax
lea ecx, [esp + 0x6c]
call fcn.0042f8f2
lea edx, [esp + 0x68]
mov dword [esp + 0xd8], ebx
lea ecx, [esp + 0xb0]
call fcn.00430d1e
mov edx, eax
mov byte [esp + 0xd8], 7
cmp dword [edx + 0x14], 0x10
jb 0x480c74
mov edx, dword [edx]
push 1
lea ecx, [esi + 0xae4]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x58]
push edx
call dword [eax]
xor ebx, ebx
lea ecx, [esp + 0xb0]
push ebx
push 1
call fcn.0040177c
push ebx
push 1
lea ecx, [esp + 0x70]
call fcn.0040f05a
cmp dword [esp + 0x64], 8
mov edx, dword [esp + 0x50]
jae 0x480cb2
lea edx, [esp + 0x50]
add esi, 0xd94
mov ecx, esi
call fcn.00482673
lea ecx, [esp + 0x50]
push ebx
push 1
mov dword [edi + 0xc], esi
call fcn.0040f05a
jmp 0x480d75
cmp dword [edi + 4], 0x162
jne 0x480d75
xor ebx, ebx
push ebx
push ebx
push 0x130b
push dword [esi + 0x770]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
mov ecx, esi
call fcn.0046b7c0
mov ecx, esi
call fcn.004731b9
jmp 0x480d75
cmp dword [edi + 4], 0x15e
je 0x480d1a
cmp dword [edi + 4], 0x15f
jne 0x480d6f
mov eax, dword [edi]
mov dword [esi + 0x1274], eax
jmp 0x480d6f
cmp dword [edi + 4], 0x15f
jne 0x480d6d
lea ecx, [esi + 0x92c]
call fcn.0045cd11
test al, al
je 0x480d6d
mov ecx, dword [esi + 0x1218]
test ecx, ecx
je 0x480d6d
mov al, byte [edi + 0x10]
mov byte [esp + 0x17], al
cmp al, 0xd
je 0x480d75
xor ebx, ebx
lea eax, [esp + 0x28]
push ebx
push eax
push 1
lea eax, [esp + 0x23]
mov dword [esp + 0x34], ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x480d75
mov ecx, esi
push edi
call fcn.004675cb
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.004b65d5
mov esp, ebp
pop ebp
ret 4