Function at 0x444f96
Capabilities:
Encrypt data using rc4 ksa
Find taskbar

Disassembly:
push 0xb8
mov eax, 0x4bbe00
call fcn.00495a70
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x61], bl
call fcn.00444edc
test eax, eax
jne 0x445158
mov eax, dword [esi + 0x2c]
cmp eax, ebx
je 0x445158
lea ecx, [ebp - 0x20]
push ecx
push edi
call eax
cmp eax, ebx
je 0x444ff9
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x445158
cmp dword [esi + 0x4c], ebx
jne 0x445015
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [esi + 0x4c], eax
cmp eax, ebx
je 0x445158
cmp dword [esi + 0x48], ebx
jne 0x445049
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
push ebx
push str.TrayNotifyWnd
push ebx
push dword [esi + 0x4c]
call edi
cmp eax, ebx
je 0x445158
push ebx
push str.Button
push ebx
push eax
call edi
mov dword [esi + 0x48], eax
cmp eax, ebx
je 0x445158
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x40]
push eax
push dword [esi + 0x4c]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x62], bl
call edi
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov ecx, dword [ebp - 0x5c]
cmp dword [ebp - 0x3c], ecx
jle 0x445098
mov ecx, dword [ebp - 0x34]
mov eax, ecx
sub eax, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x54]
mov dword [ebp - 0x68], ebx
jmp 0x4450e0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x54]
jge 0x4450af
sub eax, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x68], 1
jmp 0x4450e0
mov ecx, dword [ebp - 0x60]
cmp dword [ebp - 0x40], ecx
jle 0x4450cb
mov ecx, dword [ebp - 0x38]
mov eax, ecx
sub eax, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x58]
mov dword [ebp - 0x68], 3
jmp 0x4450e0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x58]
jge 0x4450eb
sub eax, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x68], 2
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
setg byte [ebp - 0x62]
lea eax, [ebp - 0x30]
push eax
push dword [esi + 0x48]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x445118
mov byte [ebp - 0x61], 1
jmp 0x445158
cmp byte [ebp - 0x62], bl
je 0x445122
mov byte [ebp - 0x61], bl
jmp 0x445158
mov eax, dword [ebp - 0x68]
sub eax, ebx
je 0x44514e
dec eax
je 0x445142
dec eax
je 0x44513a
dec eax
jne 0x445158
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x30]
jmp 0x445154
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jmp 0x445148
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
setg byte [ebp - 0x61]
jmp 0x445158
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
setl byte [ebp - 0x61]
mov al, byte [ebp - 0x61]
cmp byte [esi + 0x30], al
jne 0x445176
lea eax, [esi + 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x44548f
mov al, byte [ebp - 0x61]
mov ecx, dword [ebp - 0x68]
sub ecx, ebx
mov byte [esi + 0x30], al
lea edi, [esi + 0x34]
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, 0x2bc
movsd dword es:[edi], dword [esi]
mov esi, eax
je 0x4451ae
dec ecx
je 0x4451a9
dec ecx
je 0x4451a2
dec ecx
jne 0x4451ae
add esi, 2
jmp 0x4451ae
mov esi, 0x2bf
jmp 0x4451ae
mov esi, 0x2bd
lea ecx, [ebp - 0xc4]
call fcn.004419ef
mov dword [ebp - 4], ebx
cmp byte [ebp - 0x61], bl
je 0x44546c
push esi
mov esi, dword [ebp - 0x84]
push 0x4d3aa8
lea eax, [ebp - 0xc4]
push eax
mov ecx, esi
call fcn.00442857
test al, al
je 0x445484
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDC]
cmp dword [ebp - 0xac], 0x20
mov dword [ebp - 0x88], eax
jne 0x445297
mov dword [ebp - 0x6c], ebx
cmp dword [ebp - 0xb8], ebx
jle 0x445297
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0xb4], ebx
jle 0x445285
mov eax, dword [ebp - 0xac]
imul eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xb0]
imul ecx, dword [ebp - 0x7c]
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [ebp - 0xbc]
mov esi, 0xff
add ecx, eax
movzx edx, byte [ecx + 3]
movzx eax, byte [ecx]
imul eax, edx
mov dword [ebp - 0x78], edx
cdq
mov edi, esi
idiv edi
mov byte [ecx], al
movzx eax, byte [ecx + 1]
imul eax, dword [ebp - 0x78]
cdq
idiv edi
mov byte [ecx + 1], al
movzx eax, byte [ecx + 2]
imul eax, dword [ebp - 0x78]
cdq
idiv esi
inc dword [ebp - 0x7c]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0xb4]
jl 0x44521d
inc dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0xb8]
jl 0x445212
mov eax, dword [ebp - 0xb8]
push dword [ebp - 0x88]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x70], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0x70]
mov edi, eax
push dword [ebp - 0x74]
push dword [ebp - 0x88]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push edi
mov dword [ebp - 0x6c], eax
call esi
push dword [ebp - 0x70]
lea ecx, [ebp - 0xc4]
push dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
push ebx
push ebx
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push ebx
push ebx
push edi
call fcn.00442103
push 2
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x90]
push eax
push edi
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x84]
push ebx
push dword [ebp - 0x88]
mov dword [ebp - 0x90], ebx
push dword [eax + 4]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x80], 0x1ff0000
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
push dword [ebp - 0x78]
push edi
call esi
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x68]
xor ecx, ecx
xor eax, eax
sub edx, ebx
je 0x4453c5
dec edx
je 0x4453a2
dec edx
je 0x445382
dec edx
jne 0x4453e6
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
sub ecx, 0x168
sub eax, 0x2e
jmp 0x4453e6
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
add ecx, 6
sub eax, 0x30
jmp 0x4453e6
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
sub ecx, 0x13e
add eax, 7
jmp 0x4453e6
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
sub ecx, 0x131
sub eax, 0x68
lea esi, [ebp - 0x20]
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
push ecx
lea eax, [ebp - 0x50]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x74]
add edx, dword [ebp - 0x70]
add ecx, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
lea esi, [ebp - 0x50]
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x24]
add dword [ebp - 0x2c], 0x12
mov edi, dword [ebp - 0x84]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
lea edx, [eax + 0xf]
mov eax, dword [ebp - 0x28]
push 0x40
sub ecx, 0x12
sub ecx, dword [ebp - 0x2c]
sub eax, 0xf
push ecx
sub eax, edx
push eax
push dword [ebp - 0x2c]
push edx
push 0xffffffffffffffff
push dword [edi + 0x24]
call esi
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
push 0x48
push eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x50]
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0xffffffffffffffff
push dword [edi + 4]
call esi
jmp 0x445484
mov edi, dword [ebp - 0x84]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [edi + 4]
call esi
push ebx
push dword [edi + 0x24]
call esi
lea ecx, [ebp - 0xc4]
call fcn.00442256
mov al, byte [ebp - 0x61]
call fcn.00495af3
ret 4