Function at 0x4b6a00
Capabilities:
Check for unmoving mouse cursor
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x57eda5
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
mov ebx, edx
lea eax, [ecx - 0xcd]
cmp eax, 0x34
ja case.0x4b6a45.206
movzx eax, byte [eax + 0x4b7018]
jmp dword [eax*4 + 0x4b6fcc]
mov ecx, dword [ebx + 0x1c]
push 0xff
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
xor ebp, ebp
cmp dword [ebx + 0x18e0], ebp
jne case.0x4b6a45.206
push 0x4fc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebp
mov dword [esp + 0xf0], ebp
je 0x4b6a8e
mov edi, eax
call fcn.004d6a30
jmp 0x4b6a90
xor eax, eax
mov dword [esp + 0xf0], 0xffffffff
mov edx, dword [ebx + 0x1c]
push ebp
push edx
mov dword [ebx + 0x18e0], eax
call fcn.004817c0
mov eax, dword [ebx + 0x18e0]
mov ecx, dword [ebx + 0x1c]
mov dword [eax + 0x370], ecx
mov eax, dword [ebx + 0x18e0]
call fcn.004d6e60
push ebp
mov ecx, str.schoolinvestigateex
call fcn.0046ffc0
add esp, 4
jmp case.0x4b6a45.206
mov edx, dword [ebx + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0043b8b0
call fcn.004c7f50
xor ebp, ebp
cmp dword [ebx + 0xa7c], ebp
jne case.0x4b6a45.206
push 0x370
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
cmp esi, ebp
mov dword [esp + 0xf0], 1
je 0x4b6b38
push 0x85
push esi
call fcn.0044f6f0
mov dword [esi], vtable.KForceSchoolModeDlg.0
mov dword [esi + 0x314], ebp
mov eax, esi
jmp 0x4b6b3a
xor eax, eax
mov dword [esp + 0xf0], 0xffffffff
mov ecx, dword [ebx + 0x1c]
push ebp
push ecx
mov dword [ebx + 0xa7c], eax
call fcn.004817c0
mov eax, dword [ebx + 0xa7c]
call fcn.004a28c0
jmp case.0x4b6a45.206
lea edx, [esp + 0x14]
xor ebp, ebp
push edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.004bca70
test eax, eax
je 0x4b6bd8
mov ecx, dword [ebx + 0xab0]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4b6bd8
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4b6bd8
cmp dword [ebx + 0xa84], ebp
je 0x4b6bd8
push ebx
call fcn.004bac90
mov dword [ebx + 0xa84], ebp
mov edx, dword [ebx + 0x1c]
push 0xcf
push edx
call dword [sym.imp.USER32.dll_KillTimer]
jmp case.0x4b6a45.206
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.004bca70
test eax, eax
je 0x4b6c4f
mov edx, dword [ebx + 0xab0]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4b6c4f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne case.0x4b6a45.206
mov ecx, dword [ebx + 0x1884]
cmp ecx, ebp
je case.0x4b6a45.206
lea esi, [esp + 0x14]
call fcn.004dbd00
test eax, eax
je case.0x4b6a45.206
mov eax, dword [ebx + 0x1c]
push 0xd0
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, dword [ebx + 0x1884]
call fcn.004dbc00
mov dword [ebx + 0xa84], 1
jmp case.0x4b6a45.206
mov edi, ebx
call fcn.004b7050
jmp case.0x4b6a45.206
call fcn.00435040
test eax, eax
jne case.0x4b6a45.206
mov ecx, dword [ebx + 0x1c]
push 0xe6
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
lea edx, [ebx + 0xad4]
push edx
lea eax, [ebx + 0xad0]
push eax
push 3
mov ecx, 0x5e0274
call fcn.004e8540
mov eax, 0x200
mov ecx, ebx
call fcn.004b7770
jmp case.0x4b6a45.206
call fcn.00435040
test eax, eax
jne case.0x4b6a45.206
mov ecx, dword [ebx + 0x1c]
push 0xe7
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebx + 0xacc]
mov ecx, ebx
call fcn.004b7770
jmp case.0x4b6a45.206
mov edx, dword [ebx + 0x1c]
push 0xd7
push edx
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
call fcn.004bcc00
jmp case.0x4b6a45.206
mov eax, dword [0x619c9c]
add eax, 1
cmp eax, 0xa
mov dword [0x619c9c], eax
jle 0x4b6d5f
mov eax, dword [ebx + 0x1c]
push 0xe8
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, ebx
call fcn.004bd0e0
jmp case.0x4b6a45.206
call fcn.0051d3b0
mov esi, eax
test esi, esi
jle 0x4b6d80
mov ecx, dword [ebx + 0x1c]
push 0xe8
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, ebx
call fcn.004bd0e0
push esi
push str.KUtility::HasConnectedNetwork___return:_d
push 0x6180b8
call fcn.00435820
add esp, 0xc
jmp case.0x4b6a45.206
mov edx, dword [ebx + 0x1c]
push 0xf3
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebx + 0x1c]
push 2
push 0
push 0x4dc
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x4b6a45.206
mov ecx, ebx
call fcn.004bf620
jmp case.0x4b6a45.206
xor ebp, ebp
push ebp
mov ecx, str.ToolGuidePop
call fcn.0046ffc0
mov ecx, dword [ebx + 0x1c]
add esp, 4
push 0xf9
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebx + 0x18c4], ebp
jne 0x4b6e38
push 0x378
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebp
mov dword [esp + 0xf0], 2
je 0x4b6e1b
mov esi, eax
call fcn.004d9c00
jmp 0x4b6e1d
xor eax, eax
mov dword [esp + 0xf0], 0xffffffff
mov edx, dword [ebx + 0x1c]
push ebp
push edx
mov dword [ebx + 0x18c4], eax
call fcn.004817c0
mov ebx, dword [ebx + 0x18c4]
call fcn.0049e940
mov eax, dword [ebx + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x4b6a45.206
mov ecx, dword [ebx + 0x1c]
push 0xfa
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
xor ebp, ebp
push ebp
push ebp
push ebx
push 0x4c2d80
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x1bb0], eax
jmp case.0x4b6a45.206
mov edx, dword [ebx + 0x1c]
push 0xfb
push edx
call dword [sym.imp.USER32.dll_KillTimer]
xor ebp, ebp
push ebp
push ebp
push ebx
push 0x4c2d20
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x1bb4], eax
jmp case.0x4b6a45.206
mov eax, dword [ebx + 0x1c]
push 0x100
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor ebp, ebp
push ebp
push ebp
push ebx
push 0x4c34a0
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x1bbc], eax
jmp case.0x4b6a45.206
mov ecx, dword [ebx + 0x1c]
push 0x101
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
xor ebp, ebp
push ebp
push ebp
push ebx
push 0x4c3280
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x1bc0], eax
jmp case.0x4b6a45.206
mov edx, dword [ebx + 0x1c]
push 0xfc
push edx
call dword [sym.imp.USER32.dll_KillTimer]
xor ecx, ecx
push ecx
mov eax, 0x4c3840
push eax
push ebx
call fcn.004f8fd0
add esp, 0xc
lea esi, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.00443ce0
jmp case.0x4b6a45.206
mov eax, dword [ebx + 0x1c]
push 0xfd
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor ebp, ebp
cmp dword [ebx + 0xaa8], ebp
jne case.0x4b6a45.206
push 2
lea esi, [ebp + 1]
call fcn.00404e50
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
call fcn.00532cf0
push esi
push 0x5a0468
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0xfc], 3
call fcn.00532dd0
push str.caipiaopop
lea eax, [esp + 0x30]
push eax
call fcn.00532e10
push ebp
mov ecx, 0x599a18
call fcn.0046ffc0
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0xf0], 0xffffffff
call fcn.004c8180
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe0
ret