Function at 0x4b9cae
Capabilities:
Check for unmoving mouse cursor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x74
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x24], edi
mov eax, dword [edi + 0x2c]
mov esi, dword [eax + 0x2c]
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
cmp dword [esi + 0xa4], eax
je 0x4b9dce
cmp byte [esi + 0x9a], al
jne 0x4b9dc4
push 2
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x22
push ebx
push dword [esp + 0x28]
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetDCEx]
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x5a0049
push 2
push dword [esi + 0xa4]
mov dword [esp + 0x1c], eax
push dword [esi + 0xa0]
push dword [esi + 0x9c]
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
mov ecx, dword [esi + 0xa0]
mov eax, dword [esi + 0xa8]
add ecx, 0xfffffffe
push 0x5a0049
push 2
push dword [esi + 0xa4]
add eax, ecx
push eax
push dword [esi + 0x9c]
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [esi + 0xa8]
push 0x5a0049
sub eax, 4
push eax
mov eax, dword [esi + 0xa0]
push 2
add eax, 2
push eax
push dword [esi + 0x9c]
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa4]
sub eax, 4
push 0x5a0049
push eax
mov eax, dword [esi + 0xa0]
add ecx, 0xfffffffe
push 2
add eax, 2
push eax
mov eax, dword [esi + 0x9c]
add eax, ecx
push eax
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [esi + 0xa4], 0
cmp byte [ebp + 0x18], 0
je 0x4b9e70
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x28]
push eax
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
cmp dword [esp + 0x28], ecx
jl 0x4b9e30
mov edx, dword [ebp + 0xc]
cmp dword [esp + 0x2c], edx
jl 0x4b9e30
lea eax, [ecx + esi]
cmp dword [esp + 0x28], eax
jg 0x4b9e30
mov eax, dword [ebp + 0x14]
add eax, edx
cmp dword [esp + 0x2c], eax
jle 0x4b9e73
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x14]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp + 0xc]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x4b9e73
mov esi, dword [ebp + 0x10]
cmp esi, 4
jl 0x4b9f8b
cmp dword [ebp + 0x14], 4
jl 0x4b9f8b
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0x9a], 0
jne 0x4b9f40
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x4b9eab
push 2
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edi, eax
test ebx, ebx
jne 0x4b9ebe
push 0x22
push ebx
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_GetDCEx]
mov ebx, eax
cmp dword [esp + 0x10], 0
jne 0x4b9ed1
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
mov edi, dword [ebp + 8]
push 0x5a0049
push 2
push esi
push dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp + 0xc]
push 0x5a0049
push 2
push esi
mov esi, dword [ebp + 0x14]
add eax, 0xfffffffe
add eax, esi
push eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 0xc]
add esi, 0xfffffffc
mov ecx, dword [ebp + 8]
add edi, 2
push 0x5a0049
push esi
push 2
push edi
push ecx
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp + 8]
push 0x5a0049
push esi
mov esi, dword [ebp + 0x10]
add eax, 0xfffffffe
push 2
push edi
add eax, esi
push eax
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
add eax, 0xac
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [eax + 0x9c], ecx
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x2c]
mov dword [eax + 0xa0], ecx
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax + 0x2c]
mov dword [eax + 0xa4], esi
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
mov dword [eax + 0xa8], ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b9f9b
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
test ebx, ebx
je 0x4b9faa
push ebx
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_ReleaseDC]
test esi, esi
je 0x4ba347
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [edi + 0x2c]
mov ebx, dword [esp + 0x18]
mov eax, dword [eax + 0x2c]
mov edi, dword [eax + 0x18]
mov dword [esp + 0x20], edi
test ebx, ebx
js 0x4ba32b
mov ecx, dword [esp + 0x1c]
test ecx, ecx
js 0x4ba32b
mov eax, dword [edi + 0x28]
cmp ebx, dword [eax + 0x2c]
jg 0x4ba32b
cmp ecx, dword [eax + 0x30]
jg 0x4ba32b
lea ecx, [ecx]
mov edx, dword [edi + 0x30]
test edx, edx
je 0x4ba075
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x4ba055
mov esi, dword [ecx + 0x24]
cmp ebx, esi
jl 0x4ba055
mov eax, dword [ecx + 0x2c]
add eax, esi
cmp ebx, eax
jg 0x4ba055
mov edi, dword [ecx + 0x28]
cmp dword [esp + 0x1c], edi
jl 0x4ba055
mov eax, dword [ecx + 0x30]
mov ecx, dword [esp + 0x1c]
add eax, edi
cmp ecx, eax
jle 0x4ba059
mov edx, dword [edx]
jmp 0x4ba021
mov edi, dword [edx + 0xc]
sub ebx, esi
mov dword [esp + 0x18], ebx
mov eax, dword [edx + 0xc]
mov dword [esp + 0x20], edi
mov eax, dword [eax + 0x28]
sub ecx, dword [eax + 0x28]
mov dword [esp + 0x1c], ecx
jmp 0x4ba01e
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push ecx
fldz
push edi
mov eax, dword [edi]
fstp qword [esp + 0x18]
call dword [eax + 0x14]
mov eax, dword [edi + 0x2c]
mov ebx, dword [esp + 0x20]
mov edx, dword [eax + 0x2c]
mov eax, dword [edx + 0xb4]
cmp eax, ebx
je 0x4ba1b3
test eax, eax
je 0x4ba19b
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x64]
mov esi, dword [eax + 0x80]
test esi, esi
je 0x4ba19b
mov esi, dword [esi + 0x34]
test esi, esi
je 0x4ba0ff
mov edx, dword [esi + 4]
test edx, edx
je 0x4ba0f9
mov eax, dword [edi + 0x2c]
mov ecx, dword [edx]
push 1
sub esp, 0x10
mov eax, dword [eax + 0x2c]
fld qword [eax + 0xc8]
fstp qword [esp + 8]
fld qword [eax + 0xc0]
fstp qword [esp]
push dword [eax + 0xb8]
push edx
call dword [ecx + 0xa4]
mov esi, dword [esi]
test esi, esi
jne 0x4ba0c5
cmp dword [edi + 0x9c], 0xffffffff
mov esi, dword [edi + 0x2c]
je 0x4ba19b
mov edx, dword [esi + 0x24]
xor eax, eax
mov ecx, dword [edx + 0x18]
mov dword [esp + 0x34], eax
add ecx, 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, 9
mov word [esp + 0x70], ax
mov dword [esp + 0x38], 4
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 0xb8]
mov dword [esp + 0x78], eax
mov eax, 4
mov word [esp + 0x60], ax
mov eax, dword [esi + 0x2c]
fld qword [eax + 0xc0]
mov eax, 4
mov word [esp + 0x50], ax
fstp dword [esp + 0x68]
mov eax, dword [esi + 0x2c]
fld qword [eax + 0xc8]
mov eax, 2
mov word [esp + 0x40], ax
mov eax, 1
mov word [esp + 0x48], ax
lea eax, [esp + 0x30]
push eax
push dword [edi + 0x9c]
fstp dword [esp + 0x60]
call fcn.004c13c4
mov eax, dword [edi + 0x2c]
xor ecx, ecx
mov dword [esp + 0x20], 0
mov eax, dword [eax + 0x2c]
mov dword [eax + 0xb4], ebx
jmp 0x4ba1dd
mov dword [esp + 0x20], 1
mov ecx, 1
test eax, eax
je 0x4ba1dd
push dword [edx + 0xbc]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0x20], 1
mov ecx, 1
fild dword [esp + 0x18]
movzx eax, cx
mov dword [esp + 0x24], eax
fstp qword [esp + 0x28]
fld qword [esp + 0x28]
fdiv qword [esp + 0x10]
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + 0x64]
fmul qword [eax + 0x60]
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
fstp qword [eax + 0xc0]
fild dword [esp + 0x1c]
fstp qword [esp + 0x28]
fld qword [esp + 0x28]
fdiv qword [esp + 0x10]
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + 0x64]
fmul qword [eax + 0x68]
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
fstp qword [eax + 0xc8]
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + 0x64]
mov esi, dword [eax + 0x80]
test esi, esi
je 0x4ba357
mov esi, dword [esi + 0x34]
test esi, esi
je 0x4ba28d
jmp 0x4ba24e
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x4ba287
mov eax, dword [edi + 0x2c]
mov edx, dword [ebx]
mov ecx, dword [eax + 0x2c]
mov eax, dword [esp + 0x20]
add eax, eax
push eax
fld qword [ecx + 0xc8]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ecx + 0xc0]
fstp qword [esp]
push dword [ecx + 0xb8]
push ebx
call dword [edx + 0xa4]
mov esi, dword [esi]
test esi, esi
jne 0x4ba24e
mov ebx, dword [edi + 0x9c]
cmp ebx, 0xffffffff
je 0x4ba357
mov ecx, dword [edi + 0x2c]
xor eax, eax
mov edi, 4
mov edx, dword [ecx + 0x24]
mov esi, dword [edx + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, 9
mov word [esp + 0x70], ax
mov dword [esp + 0x38], 4
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0xb8]
mov dword [esp + 0x78], eax
mov word [esp + 0x60], di
mov eax, dword [ecx + 0x2c]
fld qword [eax + 0xc0]
fstp dword [esp + 0x68]
mov word [esp + 0x50], di
mov eax, dword [ecx + 0x2c]
lea ecx, [esi + 4]
fld qword [eax + 0xc8]
mov eax, 2
mov word [esp + 0x40], ax
mov eax, dword [esp + 0x24]
add eax, eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x30]
push eax
push ebx
fstp dword [esp + 0x60]
call fcn.004c13c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [str.xnf]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x4ba357
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x2c]
mov dword [eax + 0xb4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14