Function at 0x43ae70
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov eax, edx
mov dword [ebp - 0xc], ecx
push edi
mov edi, eax
mov dword [ebp - 4], eax
shr edi, 0x10
test edi, edi
je case.0x43b1b5.2
mov ecx, dword [0x549278]
xor eax, eax
mov edx, dword [ecx]
test edx, edx
je case.0x43b1b5.2
mov ecx, dword [ecx + 8]
mov esi, dword [ecx]
cmp dword [esi + 0x18], edi
je 0x43aeb9
inc eax
add ecx, 4
cmp eax, edx
jb 0x43aea3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esi + 0x20]
test ebx, ebx
je 0x43aedc
push dword [esi + 8]
mov ecx, ebx
push dword [ebp - 4]
push dword [ebp - 0xc]
push esi
call dword [0x4fe8dc]
call ebx
test al, al
jne case.0x43b1b5.2
mov eax, dword [ebp - 4]
movzx eax, ax
cmp eax, 0x201
ja 0x43af52
je 0x43aefb
cmp eax, 0x7b
je 0x43af7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x43af44
push 0
push 0
push 0x8090
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x43d1d0
push 0x3e8
push 3
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov byte [0x549c08], 1
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x549c09], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x401
ja 0x43b119
je 0x43b0ee
sub eax, 0x202
je 0x43b039
sub eax, 1
je 0x43afcf
sub eax, 2
jne case.0x43b1b5.2
push str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
jne 0x43afa0
cmp byte [0x54c1a0], al
je 0x43afa0
push 2
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
or edx, 0xffffffff
push 0
push 0
lea ecx, [edx + 2]
call fcn.0042c890
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00424e60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
jne case.0x43b1b5.2
cmp byte [0x54c1a0], al
je 0x43b01d
push 2
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x43d1d0
push 0x3e8
push 3
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov byte [0x549c09], 0
mov byte [0x549c08], 1
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0x8090
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
jne case.0x43b1b5.2
cmp byte [0x54c1a0], al
je case.0x43b1b5.2
cmp byte [0x549c09], al
je case.0x43b1b5.2
lea eax, [ebp - 0xc]
mov edx, esi
push eax
mov ecx, edi
call fcn.0043d0e0
test al, al
je 0x43b0d9
push 0x549c10
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x549c0c]
test eax, eax
je 0x43b0a1
push eax
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [0x549c0c], 0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x43b0b3
push eax
call sym.ProcessHacker.exe_PhDuplicateStringZ
mov dword [0x549c0c], eax
push 0x43d1a0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
add eax, 0x8c
push eax
push 2
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
cmp eax, ecx
je case.0x43b1b5.2
push 0
push 0
push 0x8090
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, 0x405
je 0x43b19f
sub eax, 1
je 0x43b148
sub eax, 1
jne case.0x43b1b5.2
push eax
push eax
push eax
push 0x15e
or edx, 0xffffffff
lea ecx, [eax + 1]
call fcn.0042c890
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x54c1a0], 0
je case.0x43b1b5.2
cmp byte [0x549c08], 0
jne case.0x43b1b5.2
lea eax, [ebp - 0xc]
mov edx, esi
push eax
mov ecx, edi
call fcn.0043d0e0
test al, al
je case.0x43b1b5.2
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
mov edx, 1
push eax
push dword [ebp - 0xc]
mov ecx, edx
push 4
push 0
call fcn.0042c890
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x54c31c]
dec eax
cmp eax, 0x1f
ja case.0x43b1b5.2
movzx eax, byte [eax + 0x43b2a0]
jmp dword [eax*4 + 0x43b294]
push dword [0x54c2dc]
call sym.ProcessHacker.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je case.0x43b1b5.2
mov ecx, dword [0x54c258]
push 0
push dword [ecx + 0x14]
push 0x8082
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push 0x8085
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x807f
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x54c2dc]
test eax, eax
je case.0x43b1b5.2
push dword [eax + 4]
call sym.ProcessHacker.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x43b1b5.2
mov ecx, dword [0x54c208]
push 0
push dword [ecx + 0x14]
push 0x8082
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push 0x8086
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x807f
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x43b1b5.2
call fcn.004a2a20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret