Function at 0x478b84
Capabilities:
Check if file exists
Create directory
Create process on windows
Find taskbar
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov dword [ebp - 0x834], eax
xor edi, edi
push 0x4ab8a8
push str.Shell_TrayWnd
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
push 0xc8
mov dword [ebp - 0x830], eax
call esi
cmp dword [ebp - 0x830], edi
je 0x478bab
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
jmp 0x478bf1
push dword [ebp - 0x830]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x478bfd
push 0x1f4
call esi
push dword [ebp - 0x830]
call ebx
test eax, eax
je 0x478bda
push 0x7d0
call esi
push 0x40e
lea eax, [ebp - 0x82a]
push edi
push eax
mov word [ebp - 0x82c], di
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ebx, 0x206
push ebx
lea eax, [ebp - 0x41a]
push edi
push eax
mov word [ebp - 0x41c], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x212]
push edi
push eax
mov word [ebp - 0x214], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x478cf3
call dword [sym.imp.MSVCR80.dll_clock]
push eax
lea eax, [ebp - 0x41c]
push str.kxe_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push ebx
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push str..05D7B0F4_2121_4EFF_BF6B_ED3F69B894D9
push ebx
mov ebx, dword [sym.imp.MSVCR80.dll_wcscat_s]
lea eax, [ebp - 0x214]
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x82c]
push 0x208
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x478cf3
push edi
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x478df1
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x860], eax
lea eax, [ebp - 0x870]
push eax
mov dword [ebp - 0x870], 0x3c
mov dword [ebp - 0x86c], 0x2000040
mov dword [ebp - 0x868], edi
mov dword [ebp - 0x864], str.open
mov dword [ebp - 0x85c], edi
mov dword [ebp - 0x858], edi
mov dword [ebp - 0x854], edi
mov dword [ebp - 0x850], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x478df1
push 0x3e8
call esi
lea eax, [ebp - 0x214]
push eax
push str.CabinetWClass
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ebx, eax
cmp ebx, edi
jne 0x478da0
lea eax, [ebp - 0x41c]
push eax
push str.CabinetWClass
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ebx, eax
cmp ebx, edi
je 0x478df1
push edi
mov eax, 0xc8
push eax
push eax
mov eax, 0x1388
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push ebx
push dword [ebp - 0x834]
call fcn.00478967
push 0x3e8
call esi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x478dea
push dword [ebp - 0x834]
push 0x478a99
push ebx
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0x1f4
call esi
push ebx
call edi
test eax, eax
jne 0x478dd1
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495616
leave
ret 4