Function at 0x40ace0
Capabilities:
Find taskbar
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x469886
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
push 0x206
xor ebp, ebp
lea ecx, [esp + 0x2a]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x30], ax
call fcn.0044e9d0
add esp, 0xc
push 0x104
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40ae43
push str.Wtsapi32.dll
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x40ae43
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
mov dword [esp + 0x1c], eax
cmp eax, ebp
je 0x40ad8a
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [esp + 0x20], ebp
xor esi, esi
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x40ade0
cmp ebx, ebp
je 0x40adb9
lea edx, [esp + 0x14]
push edx
push eax
call ebx
test eax, eax
jne 0x40ae4a
push ebp
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebp
jne 0x40ae82
push ebp
push 0x1f4
call edi
inc esi
cmp esi, 6
jb 0x40ad96
jmp 0x40aec2
push 9
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x10
mov edi, 7
xor eax, eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebp
push str.initredirectrule
mov word [esi + 4], ax
call fcn.004018a0
sub esp, 0x1c
mov dword [esp + 0x278], ebp
mov esi, esp
mov dword [esp + 0x54], esp
push 0xb
xor ecx, ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebp
push str.initruleerr
mov word [esi + 4], cx
call fcn.004018a0
mov dword [esp + 0x278], 0xffffffff
call fcn.00404e50
add esp, 0x3c
xor eax, eax
jmp 0x40af6d
test byte [0x4e0010], 1
jne 0x40ae60
or dword [0x4e0010], 1
mov dword [0x4e0014], ebp
push 0x4dfe78
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4dfe78
mov dword [0x4e0014], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x40aec2
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x18]
push eax
push ebp
push 0x80000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
je 0x40aec2
lea ecx, [esp + 0x14]
push ecx
push 0xb
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x244], ebp
je 0x40aee8
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x40aee8
lea edi, [esp + 0x20]
call fcn.0040ac80
test eax, eax
je 0x40aee8
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x40aef7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x14], ebp
jne 0x40af69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 9
mov edi, 7
xor eax, eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebp
push str.loopbreak
mov word [esi + 4], ax
call fcn.004018a0
sub esp, 0x1c
mov dword [esp + 0x278], 1
mov esi, esp
mov dword [esp + 0x54], esp
push 0xb
xor ecx, ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebp
push str.initruleerr
mov word [esi + 4], cx
call fcn.004018a0
mov dword [esp + 0x278], 0xffffffff
call fcn.00402b90
add esp, 0x3c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x22c
ret