Function at 0x14004b860
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x50
mov rax, rdx
mov rbp, rdx
shr rax, 0x10
mov r14, rcx
movzx edi, ax
test edi, edi
je 0x14004bd42
mov rcx, qword [0x1401925d8]
mov qword [rsp + 0x40], r15
xor r15d, r15d
mov r8d, r15d
mov r9d, dword [rcx]
test r9d, r9d
je 0x14004bd3d
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x70], rbx
nop dword [rax + rax]
mov eax, r8d
mov rbx, qword [rcx + rax*8]
cmp dword [rbx + 0x2c], edi
je 0x14004b8c9
inc r8d
cmp r8d, r9d
jb 0x14004b8b0
jmp 0x14004bd38
mov qword [rsp + 0x48], rsi
mov rsi, qword [rbx + 0x38]
test rsi, rsi
je 0x14004b8f7
mov rcx, rsi
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
mov r9, qword [rbx + 0x10]
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call rsi
test al, al
jne 0x14004bd33
movzx ecx, bp
cmp ecx, 0x205
ja 0x14004bb20
je 0x14004babc
sub ecx, 0x7b
je 0x14004babc
sub ecx, 0x186
je 0x14004ba5d
sub ecx, 1
je 0x14004b995
cmp ecx, 1
jne 0x14004bd33
lea rcx, str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
jne 0x14004bd33
cmp byte [0x140197678], r15b
je 0x14004b989
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea edx, [rax + 2]
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea r9, [0x14004e240]
mov edx, 3
mov byte [0x1401946c6], r15b
mov r8d, 0x3e8
mov byte [0x1401946c5], 1
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
jmp 0x14004bd22
lea rcx, str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
jne 0x14004bd33
cmp byte [0x140197678], r15b
je 0x14004bd33
cmp byte [0x1401946c6], r15b
je 0x14004bd33
lea r8, [rsp + 0x78]
mov rdx, rbx
mov ecx, edi
call fcn.14004e0e0
test al, al
je 0x14004ba46
lea rcx, [0x140194a48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r8, qword [0x140194a40]
test r8, r8
je 0x14004ba05
mov rcx, qword [0x140196670]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [0x140194a40], r15
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14004ba1b
call sym.ProcessHacker.exe_PhDuplicateStringZ
mov qword [0x140194a40], rax
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea r9, [0x14004e1f0]
mov edx, 2
lea r8d, [rax + 0x8c]
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x14004bd33
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, 2
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x14004bd33
lea rcx, str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14004bab0
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8090
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea r9, [0x14004e240]
mov edx, 3
mov byte [0x1401946c5], 1
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x14004bd33
mov byte [0x1401946c6], 1
jmp 0x14004bd33
lea rcx, str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
jne 0x14004bae5
cmp byte [0x140197678], r15b
je 0x14004bae5
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea edx, [rax + 2]
call qword [sym.imp.USER32.dll_KillTimer]
or edx, 0xffffffff
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
lea ecx, [rdx + 2]
call fcn.1400398e0
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsp + 0x80]
call fcn.1400301b0
jmp 0x14004bd33
sub ecx, 0x401
je 0x14004bd10
sub ecx, 4
je 0x14004bbd3
sub ecx, 1
je 0x14004bb63
cmp ecx, 1
jne 0x14004bd33
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov r8d, 0x15e
mov qword [rsp + 0x20], r15
or edx, 0xffffffff
call fcn.1400398e0
jmp 0x14004bd33
cmp byte [0x140197678], r15b
je 0x14004bd33
cmp byte [0x1401946c5], r15b
jne 0x14004bd33
lea r8, [rsp + 0x30]
mov rdx, rbx
mov ecx, edi
call fcn.14004e0e0
test al, al
je 0x14004bd33
lea rcx, [rsp + 0x88]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x88]
mov edx, 1
mov qword [rsp + 0x28], rax
mov r9d, 4
mov rax, qword [rsp + 0x30]
xor r8d, r8d
mov ecx, edx
mov qword [rsp + 0x20], rax
call fcn.1400398e0
jmp 0x14004bd33
mov eax, dword [0x1401978b0]
sub eax, 1
je 0x14004bc8a
sub eax, 3
je 0x14004bbf5
sub eax, 0xc
je 0x14004bbf5
cmp eax, 0x10
jne 0x14004bd33
mov rcx, qword [0x140197830]
test rcx, rcx
je 0x14004bd33
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhReferenceServiceItem
mov rbx, rax
test rax, rax
je 0x14004bd33
mov rcx, qword [0x140197730]
xor r9d, r9d
mov edx, 0x8082
movsxd r8, dword [rcx + 0x28]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov r9, rbx
xor r8d, r8d
mov edx, 0x8086
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
mov edx, 0x807f
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004bd33
call fcn.1400c8bc0
jmp 0x14004bd33
mov rdx, qword [0x140197830]
mov rax, rdx
shr rax, 2
movzx ecx, al
lea rax, [0x140192f30]
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x14004bd33
nop
cmp rdx, qword [rax + 0x28]
lea rbx, [rax - 0x40]
je 0x14004bcc4
mov rax, qword [rax]
test rax, rax
jne 0x14004bcb0
jmp 0x14004bd33
mov rax, qword [0x140197770]
xor r9d, r9d
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, 0x8082
movsxd r8, dword [rax + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov r9, rbx
xor r8d, r8d
mov edx, 0x8085
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, 0x807f
mov r8d, 1
jmp 0x14004bd2a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
cmp rax, rcx
je 0x14004bd33
xor r8d, r8d
mov edx, 0x8090
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x40]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret