Function at 0x49af18
Capabilities:
Check for unmoving mouse cursor
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x49af20
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404628
xor eax, eax
push ebp
push 0x49b4b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408464
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404210
mov eax, dword [ebp - 4]
mov edx, 0x49b4cc
call fcn.00404584
jne 0x49af87
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00499bc0
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b4dc
call fcn.00404584
jne 0x49afb7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049c734
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b4ec
call fcn.00404584
jne 0x49afe7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049ac70
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b4fc
call fcn.00404584
jne 0x49b017
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049ac68
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b50c
call fcn.00404584
jne 0x49b047
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049c280
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b51c
call fcn.00404584
jne 0x49b077
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049bea4
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b52c
call fcn.00404584
jne 0x49b0a7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049bd88
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b53c
call fcn.00404584
jne 0x49b0dd
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax + 0x30c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049c000
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b54c
call fcn.00404584
jne 0x49b113
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax + 0x310]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049c000
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b55c
call fcn.00404584
jne 0x49b149
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax + 0x314]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049c000
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b56c
call fcn.00404584
jne 0x49b17f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax + 0x318]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049c000
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b57c
call fcn.00404584
jne 0x49b1b5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax + 0x31c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0049c000
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b58c
call fcn.00404584
jne 0x49b1e1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
xor edx, edx
call fcn.0049c6b4
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b4fc
call fcn.00404584
jne 0x49b20d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
xor edx, edx
call fcn.0049ac68
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b59c
call fcn.00404584
jne 0x49b239
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
xor edx, edx
call fcn.0049c214
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b5b0
call fcn.00404584
jne 0x49b265
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
xor edx, edx
call fcn.0049aca8
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b5c0
call fcn.00404584
jne 0x49b291
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
xor edx, edx
call fcn.0049c84c
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b5d4
call fcn.00404584
jne 0x49b2d9
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
call sub.user32.dll_GetCursorPos
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x32c]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b5e8
call fcn.00404584
jne 0x49b321
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
call sub.user32.dll_GetCursorPos
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x308]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x49b494
mov eax, dword [ebp - 4]
mov edx, 0x49b5f8
call fcn.00404584
jne 0x49b34d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
xor edx, edx
call fcn.0049c288
jmp 0x49b494
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409024
mov eax, dword [ebp - 0x10]
mov edx, 0x49b608
call fcn.00404584
jne 0x49b494
lea eax, [ebp - 0x18]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404698
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004084a0
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x49b618
call fcn.004084a0
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00404584
jne 0x49b494
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov word [eax], 0xffff
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00493d64
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.00404210
mov dl, 1
mov eax, dword [0x417fcc]
call fcn.004033b8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49b48d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049430c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0xffffffff
jne 0x49b404
cmp eax, 0xffffffff
je 0x49b477
lea eax, [ebp - 0x28]
call fcn.004939f4
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0048f280
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00408fec
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00404440
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0041cac8
push 0
lea eax, [ebp - 0x34]
call fcn.004939f4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.0048f280
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00408fec
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00404440
mov eax, dword [ebp - 0x30]
call fcn.00404638
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b494
mov eax, dword [ebp - 8]
call fcn.004033e8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b4be
lea eax, [ebp - 0x38]
mov edx, 0xc
call fcn.0040419c
lea eax, [ebp - 4]
call fcn.00404178
ret