Function at 0x412a50
Capabilities:
Create thread
Find taskbar

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4707b0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x48e820]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, dword [0x492cf8]
call fcn.0043adc8
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x412a9e
push 0x80004005
call fcn.0040fef0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x60], edi
push ecx
mov dword [esp + 0x2c], esi
call fcn.00408cd0
add esp, 4
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x64], 1
call fcn.004104e0
mov byte [esp + 0x60], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412af7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x30]
push edx
push 0x40c580
push edi
push edi
mov dword [esp + 0x48], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x30]
push eax
call fcn.0040c490
add esp, 4
cmp dword [esp + 0x30], 2
jne 0x412b64
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
push edi
push edi
push 0x10
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x60], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x412fcb
mov edi, dword [ebp + 8]
push 0
push 0
push 0
mov ebx, 1
push ebx
lea esi, [edi + 0xf48]
push 0x71
push esi
mov dword [0x492cfc], ebx
mov dword [esp + 0x30], esi
call fcn.0043dbc8
push 0x47b3d4
push 0x4901b0
push 0
push 0
push 4
push 0x66
push esi
call fcn.0043dbc8
mov ecx, dword [edi + 0x20]
add esp, 0x34
push ebx
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
lea ecx, [edi + 0x46c]
mov dword [0x492cdc], ebx
call fcn.0043db4a
lea ecx, [edi + 0x71c]
push 0
mov dword [esp + 0x20], ecx
call fcn.0043db4a
push 0
lea ecx, [edi + 0x9cc]
call fcn.0043db4a
lea ecx, [edi + 0xc7c]
push 0
mov dword [esp + 0x24], ecx
call fcn.0043db4a
mov dword [0x492ce4], ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
call ebx
push 0
mov esi, eax
call ebx
mov edx, dword [0x492e04]
xor ecx, ecx
push 0x47b014
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov ebx, eax
call fcn.0045599c
add esp, 8
test eax, eax
sete al
test al, al
push 1
je 0x412c85
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x320
cdq
sub eax, edx
sar eax, 1
push 0
mov dword [edi + 0xf30], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x384
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0xf2c], eax
add eax, 0x384
mov dword [edi + 0xf34], eax
mov eax, dword [edi + 0xf30]
add eax, 0x320
mov dword [edi + 0xf38], eax
jmp 0x412cd0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x258
cdq
sub eax, edx
sar eax, 1
push 0
mov dword [edi + 0xf30], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [edi + 0xf30]
sub eax, 0x320
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0xf2c], eax
add eax, 0x320
add ecx, 0x258
mov dword [edi + 0xf34], eax
mov dword [edi + 0xf38], ecx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x412d21
lea edx, [esp + 0x44]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x412d21
mov eax, dword [esp + 0x44]
test eax, eax
jg 0x412d1f
mov eax, dword [esp + 0x48]
test eax, eax
jg 0x412d1b
mov eax, dword [esp + 0x4c]
cmp eax, dword [esp + 0x14]
jge 0x412d11
mov dword [esp + 0x34], eax
jmp 0x412d21
mov eax, dword [esp + 0x50]
mov dword [esp + 0x38], eax
jmp 0x412d21
mov esi, eax
jmp 0x412d21
mov ebx, eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 1
sub esi, eax
push esi
sub ebx, ecx
push ebx
push eax
push ecx
mov ecx, edi
call fcn.0043db0c
mov esi, dword [esp + 0x1c]
mov dword [edi + 0xf3c], 1
mov edi, 0x47b840
mov eax, esi
call fcn.00422e30
call fcn.0043a4fb
mov edi, dword [eax + 0xc]
mov ebx, dword [sym.imp.USER32.dll_LoadImageA]
push 0
push 0
push 0
push 0
push 0xfb
push edi
call ebx
push 0
push 0
push 0
push 0
push 0xf8
push edi
mov dword [esp + 0x2c], eax
call ebx
push 0
push 0
push 0
push 0
push 0x102
push edi
mov dword [esp + 0x34], eax
call ebx
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
call fcn.00422ca0
mov eax, dword [esp + 0x20]
mov esi, dword [ebp + 8]
mov dword [eax + 0x5c], 1
mov dword [eax + 0x60], 0
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x492e04]
push 0x47b014
push edx
call fcn.0045599c
add esp, 8
test eax, eax
sete al
test al, al
je 0x412e92
call fcn.0043adc8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x412e02
push 0x80004005
call fcn.0040fef0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x60], 2
cmp dword [0x492cec], 0
je 0x412e33
mov ecx, dword [0x492de4]
push ecx
push str.c:ipepmemfile_pwfcreate_08_09_17_file__s_view2.html
lea edx, [esp + 0x1c]
push edx
jmp 0x412e43
mov eax, dword [0x492de4]
push eax
push str.c:ipepmemfile_pwfcreate_08_09_17_file__s_view1.html
lea ecx, [esp + 0x1c]
push ecx
call fcn.00410070
mov ecx, dword [esp + 0x24]
add esp, 0xc
push 0
call fcn.0043db4a
lea edi, [esi + 0x74]
push 5
mov ecx, edi
call fcn.0043db4a
mov ebx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
push 0
push ebx
mov ecx, edi
call fcn.0043ea1d
lea eax, [ebx - 0x10]
mov byte [esp + 0x60], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x412f79
call fcn.0043adc8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x412eac
push 0x80004005
call fcn.0040fef0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x60], 3
mov ecx, dword [0x492de4]
push ecx
lea edx, [esp + 0x18]
push str.c:ipepmemfile_pwfcreate_08_09_17_file__s_reader.swf
push edx
call fcn.00410070
add esp, 0xc
call fcn.00413170
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push edi
push 0
push 0x4901b4
push 0
push 0
push 1
push 0x8e
push ebx
call fcn.0043dbc8
add esp, 0x20
push 5
mov ecx, ebx
call fcn.0043db4a
push 0x492d04
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0xffffffffffffffff
push 0
mov ecx, 0x492ea0
call fcn.0043101f
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x20]
push eax
push 0
push esi
push 0x416c60
push 0
push 0
call ebx
mov ecx, dword [esi + 0x20]
push 0
push 0x64
push 0xce
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
lea edx, [esp + 0x20]
push edx
push 0
push esi
push 0x407030
push 0
push 0
call ebx
lea eax, [edi - 0x10]
mov byte [esp + 0x60], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412f85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 0x3f4], 0
je 0x412faf
mov eax, dword [esi + 0x3ec]
mov ecx, dword [esi + 0x228]
imul eax, eax, 0x3e8
push 0
push eax
push 0xcd
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esp + 0x60], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412fd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4