Function at 0x4bba70
Capabilities:
Find taskbar
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x4f655f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x38]
push eax
push 0x65
call sub.mfc90.dll_Ordinal_374
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esi], vtable.CTrojanCutDlg.0
mov dword [esi + 0x90], vtable.CArray_class_CLabelItem__class_CLabelItem__.0
mov dword [esi + 0x94], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0x98], ebx
mov byte [esp + 0x30], 1
mov dword [esi + 0xa4], vtable.CMenu.0
mov dword [esi + 0xa8], ebx
mov byte [esp + 0x30], 2
lea edi, [esi + 0xe4]
mov ecx, edi
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x30], 3
lea ebp, [esi + 0xe8]
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x30], 4
lea ecx, [esi + 0xec]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x30], 5
lea ecx, [esi + 0xf4]
call fcn.004624c0
mov byte [esp + 0x30], 6
lea ecx, [esi + 0x180]
call fcn.00449fa0
mov byte [esp + 0x30], 7
push 0xa
lea ecx, [esi + 0x321fc]
call sub.mfc90.dll_Ordinal_581
mov byte [esp + 0x30], 8
push 0x81
lea ecx, [esi + 0x3221c]
call fcn.00462ae0
mov byte [esp + 0x30], 9
lea ecx, [esi + 0x32450]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x30], 0xa
lea ecx, [esi + 0x324f4]
call sub.mfc90.dll_Ordinal_580
mov byte [esp + 0x30], 0xb
push 0x5116d8
mov ecx, edi
mov dword [esi + 0x324c8], 1
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov byte [esi + 0xac], bl
mov byte [esi + 0xad], bl
mov dword [esi + 0x321f4], ebx
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_820]
lea ecx, [esp + 0x38]
push ecx
mov byte [esi + 0xf0], bl
call fcn.00465390
add esp, 4
mov byte [esp + 0x30], 0xc
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x4bbc1e
push ebx
push str.TrayNotifyWnd
push ebx
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, ebx
je 0x4bbc1e
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
call sub.mfc90.dll_Ordinal_1137
mov eax, dword [eax + 8]
push ebx
push 0x20
push 0x20
push 1
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
mov dword [esi + 0x32434], eax
call fcn.004924e0
push 0x78
mov dword [esi + 0x32438], eax
mov dword [esi + 0x32440], ebx
mov dword [esi + 0x32444], ebx
mov dword [esi + 0x32448], ebx
mov dword [esi + 0x32464], ebx
mov byte [esi + 0x3244c], bl
mov byte [esi + 0x3244e], bl
mov byte [esi + 0x3244d], bl
mov dword [esi + 0x324e8], ebx
mov dword [esi + 0x3246c], ebx
call fcn.004096b0
mov edi, eax
mov eax, dword [0x53f36c]
add esp, 8
cmp eax, ebx
je 0x4bbca5
push eax
call sub.mfc90.dll_Ordinal_266
add esp, 4
mov dword [0x53f36c], ebx
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90.dll_Ordinal_265
xor ecx, ecx
add esp, 4
cmp eax, ebx
setne cl
mov dword [0x53f36c], eax
cmp ecx, ebx
jne 0x4bbcd5
call sub.mfc90.dll_Ordinal_1252
lea ecx, [edi*4]
push ecx
push ebx
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [0x53eb68]
add esp, 0xc
mov dword [0x53f370], edi
cmp eax, ebx
je 0x4bbd05
push eax
call sub.mfc90.dll_Ordinal_266
add esp, 4
mov dword [0x53eb68], ebx
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90.dll_Ordinal_265
xor ecx, ecx
add esp, 4
cmp eax, ebx
setne cl
mov dword [0x53eb68], eax
cmp ecx, ebx
jne 0x4bbd35
call sub.mfc90.dll_Ordinal_1252
lea ecx, [edi*4]
push ecx
push ebx
push eax
call sub.MSVCR90.dll_memset
push 0x4b0
mov dword [0x53eb6c], edi
call fcn.004096b0
mov edi, eax
mov eax, dword [0x53eb84]
add esp, 0x10
cmp eax, ebx
je 0x4bbd71
push eax
call sub.mfc90.dll_Ordinal_266
add esp, 4
mov dword [0x53eb84], ebx
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90.dll_Ordinal_265
xor ecx, ecx
add esp, 4
cmp eax, ebx
setne cl
mov dword [0x53eb84], eax
cmp ecx, ebx
jne 0x4bbda1
call sub.mfc90.dll_Ordinal_1252
lea ecx, [edi*4]
push ecx
push ebx
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [0x53ebbc]
add esp, 0xc
mov dword [0x53eb88], edi
cmp eax, ebx
je 0x4bbdd1
push eax
call sub.mfc90.dll_Ordinal_266
add esp, 4
mov dword [0x53ebbc], ebx
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90.dll_Ordinal_265
xor ecx, ecx
add esp, 4
cmp eax, ebx
setne cl
mov dword [0x53ebbc], eax
cmp ecx, ebx
jne 0x4bbe01
call sub.mfc90.dll_Ordinal_1252
lea ecx, [edi*4]
push ecx
push ebx
push eax
call sub.MSVCR90.dll_memset
push 0xea60
mov dword [0x53ebc0], edi
call fcn.004096b0
mov edi, eax
mov eax, dword [0x53f2cc]
add esp, 0x10
cmp eax, ebx
je 0x4bbe3d
push eax
call sub.mfc90.dll_Ordinal_266
add esp, 4
mov dword [0x53f2cc], ebx
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90.dll_Ordinal_265
xor ecx, ecx
add esp, 4
cmp eax, ebx
setne cl
mov dword [0x53f2cc], eax
cmp ecx, ebx
jne 0x4bbe6d
call sub.mfc90.dll_Ordinal_1252
lea ecx, [edi*4]
push ecx
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, 0x53f368
mov dword [0x53f2d0], edi
call fcn.0042f390
mov byte [0x10da2bb], bl
mov byte [0x10da2c0], bl
mov byte [0x10da2c2], bl
mov byte [0x10da2c3], bl
mov byte [0x10da2c4], bl
push 0x5116d8
lea ecx, [esi + 0x32450]
mov dword [esi + 0x32478], ebx
mov dword [esi + 0x3247c], ebx
mov dword [esi + 0x32480], ebx
mov dword [esi + 0x32484], ebx
mov dword [esi + 0x32488], ebx
mov dword [esi + 0x3248c], ebx
mov dword [esi + 0x32490], ebx
mov dword [esi + 0x32494], ebx
mov dword [esi + 0x32498], ebx
mov dword [esi + 0x3249c], ebx
mov dword [esi + 0x324a0], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x324a4], ebx
mov dword [esi + 0x324a8], ebx
mov dword [esi + 0x324ac], ebx
mov dword [esi + 0x324b0], ebx
mov dword [esi + 0x324b4], ebx
mov dword [esi + 0x324e0], ebx
mov dword [esi + 0x324b8], ebx
mov dword [esi + 0x324bc], ebx
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, 0x10dd284
mov dword [esi + 0x324d8], ebx
mov dword [esi + 0x3245c], ebx
mov dword [esi + 0x32460], ebx
mov dword [esi + 0x32458], ebx
mov dword [esi + 0x3243c], ebx
mov dword [esi + 0x32454], ebx
call sub.mfc90.dll_Ordinal_5869
push ebx
push 0x26
push 0x103a370
mov byte [esi + 0x32218], bl
mov dword [esi + 0x321f8], ebx
mov dword [esi + 0x324e4], ebx
mov dword [esi + 0xe0], ebx
mov dword [0x10da2dc], esi
push ebx
mov byte [esi + 0x32470], bl
mov byte [esi + 0xae], bl
mov byte [esi + 0x324dd], bl
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x200
push 0x103a570
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x103a570
call dword [sym.imp.MSVCR90.dll__strupr]
add esp, 4
push 0x200
push 0x1038d30
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1038d30
call dword [sym.imp.MSVCR90.dll__strlwr]
add esp, 4
mov byte [esp + 0x30], 0xb
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x30], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4