Function at 0x4016e0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x3c4
mov eax, dword [0x43d0a0]
xor eax, esp
mov dword [esp + 0x3c0], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [esp + 0x1d5]
push ebx
push eax
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1dc], bl
call fcn.00422370
add esp, 0xc
push 5
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov ebp, dword [sym.imp.USER32.dll_GetClassNameA]
push 0x100
lea ecx, [esp + 0x1d4]
mov edi, eax
push ecx
push edi
call ebp
mov esi, str.TrayNotifyWnd
lea eax, [esp + 0x1d0]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x401774
cmp cl, bl
je 0x401770
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x401774
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401754
xor eax, eax
jmp 0x401779
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4017d9
lea ecx, [ecx]
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
cmp edi, ebx
je 0x4017d9
push 0x100
lea edx, [esp + 0x1d4]
push edx
push edi
call ebp
mov esi, str.TrayNotifyWnd
lea eax, [esp + 0x1d0]
jmp 0x4017b0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4017d0
cmp cl, bl
je 0x4017cc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4017d0
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4017b0
xor eax, eax
jmp 0x4017d5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401780
push 5
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
push 0x100
lea eax, [esp + 0x1d4]
push eax
push edi
call ebp
mov esi, str.SysPager
lea eax, [esp + 0x1d0]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x401820
cmp cl, bl
je 0x40181c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x401820
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401800
xor eax, eax
jmp 0x401825
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x401889
lea esp, [esp]
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
cmp edi, ebx
je 0x401889
push 0x100
lea ecx, [esp + 0x1d4]
push ecx
push edi
call ebp
mov esi, str.SysPager
lea eax, [esp + 0x1d0]
jmp 0x401860
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x401880
cmp cl, bl
je 0x40187c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x401880
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401860
xor eax, eax
jmp 0x401885
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401830
push 5
push edi
call dword [sym.imp.USER32.dll_GetWindow]
push 0x100
lea edx, [esp + 0x1d4]
mov edi, eax
push edx
push edi
mov dword [esp + 0x20], edi
call ebp
mov esi, str.ToolbarWindow32
lea eax, [esp + 0x1d0]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4018d4
cmp cl, bl
je 0x4018d0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4018d4
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4018b4
xor eax, eax
jmp 0x4018d9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x401943
lea ecx, [ecx]
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
cmp edi, ebx
je 0x40193f
push 0x100
lea eax, [esp + 0x1d4]
push eax
push edi
call ebp
mov esi, str.ToolbarWindow32
lea eax, [esp + 0x1d0]
jmp 0x401910
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x401930
cmp cl, bl
je 0x40192c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x401930
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401910
xor eax, eax
jmp 0x401935
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4018e0
mov dword [esp + 0x14], edi
jmp 0x401943
mov dword [esp + 0x14], eax
push 4
push 0x3000
push 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [esp + 0x44]
push ecx
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x44]
push edx
push ebx
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 4
push 0x3000
push 0x14
push ebx
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push ebx
push ebx
push 0x418
push edi
mov ebp, eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x402051
mov edi, 0xf
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebp
push eax
push 0x417
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [esp + 0x40]
push edx
push 0x14
push eax
push ebp
push ecx
call esi
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 4]
mov ecx, dword [esp + 0x14]
push ebp
push eax
push 0x42d
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x40]
push edx
push 0x100
lea eax, [esp + 0x2d8]
push eax
push ebp
push ecx
call esi
push 0xffffffffffffffff
push ebx
push 0x4415d4
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00415960
push 7
push str._Server
lea eax, [esp + 0x2c]
call fcn.00415cd0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x188]
mov dword [esp + 0x1a0], edi
mov dword [esp + 0x19c], ebx
mov byte [esp + 0x18c], bl
call fcn.00415960
cmp dword [esp + 0x3c], 0x10
jb 0x401a70
mov edx, dword [esp + 0x28]
push edx
call fcn.0041dadc
add esp, 4
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0xfc]
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
mov dword [esp + 0x114], edi
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.00415960
push ebx
push 0x44160c
or eax, 0xffffffff
lea esi, [esp + 0xf8]
call fcn.00415be0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x150]
mov dword [esp + 0x168], edi
mov dword [esp + 0x164], ebx
mov byte [esp + 0x154], bl
call fcn.00415960
cmp dword [esp + 0x108], 0x10
jb 0x401afc
mov ecx, dword [esp + 0xf4]
push ecx
call fcn.0041dadc
add esp, 4
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x14c]
push edx
lea ecx, [esp + 0xc4]
mov dword [esp + 0x114], edi
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
mov dword [esp + 0xdc], edi
mov dword [esp + 0xd8], ebx
mov byte [esp + 0xc8], bl
call fcn.00415960
push 3
push 0x432efc
lea eax, [esp + 0xc0]
call fcn.00415cd0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xa8]
mov dword [esp + 0xc0], edi
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
call fcn.00415960
cmp dword [esp + 0xd0], 0x10
jb 0x401b8f
mov eax, dword [esp + 0xbc]
push eax
call fcn.0041dadc
add esp, 4
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xa4]
push ecx
lea ecx, [esp + 0x70]
mov dword [esp + 0xdc], edi
mov dword [esp + 0xd8], ebx
mov byte [esp + 0xc8], bl
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
call fcn.00415960
push ebx
push 0x441840
or eax, 0xffffffff
lea esi, [esp + 0x6c]
call fcn.00415be0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8c]
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
call fcn.00415960
cmp dword [esp + 0x7c], 0x10
jb 0x401c15
mov edx, dword [esp + 0x68]
push edx
call fcn.0041dadc
add esp, 4
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x118]
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
mov dword [esp + 0x130], edi
mov dword [esp + 0x12c], ebx
mov byte [esp + 0x11c], bl
call fcn.00415960
push 1
push 0x432ef8
lea eax, [esp + 0x114]
call fcn.00415cd0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x134]
mov dword [esp + 0x14c], edi
mov dword [esp + 0x148], ebx
mov byte [esp + 0x138], bl
call fcn.00415960
cmp dword [esp + 0x124], 0x10
jb 0x401ca5
mov ecx, dword [esp + 0x110]
push ecx
call fcn.0041dadc
add esp, 4
movzx edx, word [0x441880]
push edx
lea esi, [esp + 0x19c]
mov dword [esp + 0x128], edi
mov dword [esp + 0x124], ebx
mov byte [esp + 0x114], bl
call fcn.004167e0
push 0xffffffffffffffff
mov esi, eax
push ebx
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0xe0]
mov dword [esp + 0xf8], edi
mov dword [esp + 0xf4], ebx
mov byte [esp + 0xe4], bl
call fcn.00415960
push ebx
push esi
or eax, 0xffffffff
lea esi, [esp + 0xdc]
call fcn.00415be0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x16c]
mov dword [esp + 0x184], edi
mov dword [esp + 0x180], ebx
mov byte [esp + 0x170], bl
call fcn.00415960
cmp dword [esp + 0xec], 0x10
jb 0x401d4c
mov ecx, dword [esp + 0xd8]
push ecx
call fcn.0041dadc
add esp, 4
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x168]
push edx
lea ecx, [esp + 0x54]
mov dword [esp + 0xf8], edi
mov dword [esp + 0xf4], ebx
mov byte [esp + 0xe4], bl
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
call fcn.00415960
push 2
push 0x432ef4
lea eax, [esp + 0x50]
call fcn.00415cd0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x1d8], edi
mov dword [esp + 0x1d4], ebx
mov byte [esp + 0x1c4], bl
call fcn.00415960
mov esi, 0x10
cmp dword [esp + 0x60], esi
jb 0x401dce
mov eax, dword [esp + 0x4c]
push eax
call fcn.0041dadc
add esp, 4
cmp dword [esp + 0x178], esi
jb 0x401de7
mov ecx, dword [esp + 0x164]
push ecx
call fcn.0041dadc
add esp, 4
mov dword [esp + 0x178], edi
mov dword [esp + 0x174], ebx
mov byte [esp + 0x164], bl
cmp dword [esp + 0x140], esi
jb 0x401e15
mov edx, dword [esp + 0x12c]
push edx
call fcn.0041dadc
add esp, 4
mov dword [esp + 0x140], edi
mov dword [esp + 0x13c], ebx
mov byte [esp + 0x12c], bl
cmp dword [esp + 0x98], esi
jb 0x401e43
mov eax, dword [esp + 0x84]
push eax
call fcn.0041dadc
add esp, 4
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
cmp dword [esp + 0xb4], esi
jb 0x401e71
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.0041dadc
add esp, 4
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
cmp dword [esp + 0x15c], esi
jb 0x401e9f
mov edx, dword [esp + 0x148]
push edx
call fcn.0041dadc
add esp, 4
mov dword [esp + 0x15c], edi
mov dword [esp + 0x158], ebx
mov byte [esp + 0x148], bl
cmp dword [esp + 0x194], esi
jb 0x401ecd
mov eax, dword [esp + 0x180]
push eax
call fcn.0041dadc
add esp, 4
mov dword [esp + 0x194], edi
mov dword [esp + 0x190], ebx
mov byte [esp + 0x180], bl
cmp dword [esp + 0x1b0], esi
jb 0x401efb
mov ecx, dword [esp + 0x19c]
push ecx
call fcn.0041dadc
add esp, 4
mov esi, dword [esp + 0x1c8]
lea eax, [esp + 0x2d0]
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401f18
sub eax, edx
push eax
lea edx, [esp + 0x2d4]
push edx
lea ecx, [esp + 0x50]
call fcn.00415de0
push esi
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00415960
cmp dword [esp + 0x1cc], 0x10
mov ecx, dword [esp + 0x1b8]
jae 0x401f67
lea ecx, [esp + 0x1b8]
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x1c8]
cmp esi, eax
jae 0x401f78
mov eax, esi
cmp dword [esp + 0x3c], 0x10
mov edx, dword [esp + 0x28]
jae 0x401f87
lea edx, [esp + 0x28]
call fcn.00401080
cmp eax, ebx
jne 0x401fab
mov eax, dword [esp + 0x1c8]
cmp esi, eax
jae 0x401fa0
or eax, 0xffffffff
jmp 0x401fa9
xor ecx, ecx
cmp esi, eax
setne cl
mov eax, ecx
cmp eax, ebx
sete byte [esp + 0x13]
cmp dword [esp + 0x3c], 0x10
jb 0x401fc4
mov edx, dword [esp + 0x28]
push edx
call fcn.0041dadc
add esp, 4
cmp dword [esp + 0x60], 0x10
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
jb 0x401fe4
mov eax, dword [esp + 0x4c]
push eax
call fcn.0041dadc
add esp, 4
cmp byte [esp + 0x13], bl
je 0x402014
cmp byte [esp + 0x3d8], 1
jne 0x40200f
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebp
push esi
push 0x416
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
dec esi
mov dword [esp + 0x18], esi
mov byte [esp + 0x12], 1
cmp dword [esp + 0x1cc], 0x10
jb 0x40202e
mov edx, dword [esp + 0x1b8]
push edx
call fcn.0041dadc
add esp, 4
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebx
push ebx
push 0x418
inc esi
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, eax
jl 0x4019a7
mov ecx, dword [esp + 0x1c]
push 0x8000
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov esi, dword [esp + 0x20]
push 0x8000
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x3d0]
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c9bc
add esp, 0x3c4
ret