Function at 0x100118b0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f79ab
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x25c], edi
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
test eax, eax
je 0x10011903
push eax
call esi
mov eax, dword [edi + 0x34]
test eax, eax
je 0x1001190d
push eax
call esi
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
call fcn.100115e0
cmp eax, 1
mov dword [ebp - 0x264], 0
sete cl
mov byte [edi + 0x4b], cl
cmp eax, 2
jne 0x10011a42
mov edx, str.StartButtonPath
lea ecx, [ebp - 0x258]
call fcn.100aa8e0
mov ecx, dword [eax]
mov esi, ecx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10011961
sub esi, edx
sar esi, 1
cmp esi, 0x103
jle 0x1001197f
mov esi, 0x103
jmp 0x10011983
test esi, esi
jle 0x1001199c
movzx eax, word [ecx + esi*2]
mov edx, 0xdc00
cmp ax, dx
jb 0x1001199c
mov edx, 0xdfff
cmp ax, dx
ja 0x1001199c
dec esi
add esi, esi
lea eax, [ebp - 0x218]
push esi
push ecx
push eax
call fcn.100d7080
mov edx, dword [ebp - 0x258]
xor eax, eax
add esp, 0xc
mov word [ebp + esi - 0x218], ax
add edx, 0xfffffff0
mov dword [ebp - 4], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100119da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0xffffffff
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
mov esi, dword [0x1014e914]
cmp dword [esi], 0
je 0x10011a36
nop
mov eax, dword [esi + 4]
cmp eax, 2
je 0x10011a17
cmp eax, 3
je 0x10011a17
cmp eax, 4
je 0x10011a17
cmp eax, 5
jne 0x10011a2e
push str.StartButtonSize
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x10011bef
add esi, 0x60
cmp dword [esi], 0
jne 0x10011a00
xor esi, esi
mov dword [ebp - 0x268], esi
test esi, esi
jne 0x10011aaa
lea eax, [ebp - 0x260]
mov dword [ebp - 0x258], 0
push eax
lea edx, [ebp - 0x258]
lea ecx, [ebp - 0x218]
call fcn.100af750
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
add esp, 4
push 0
push str.Shell_TrayWnd
call esi
test eax, eax
jne 0x10011a8e
push eax
push str.Progman
call esi
test eax, eax
jne 0x10011a8e
push eax
push str.WorkerW
call esi
push 0x60
mov ecx, eax
call fcn.100b0ea0
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x268], eax
lea esi, [edi + 0x6c]
mov dword [edi + 0x5c], 0
push esi
push 2
mov ecx, esi
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 1
mov dword [edi + 0x68], 2
call fcn.100126e0
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [eax + 4], 1
mov dword [edi + 0x78], 0x12c
mov byte [edi + 0x7c], 1
sub edi, 0xffffff80
push edi
push 2
mov ecx, edi
call fcn.100126e0
mov eax, dword [edi]
mov dword [eax], 1
mov eax, dword [edi]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x25c]
mov dword [eax + 0x8c], 0x12c
mov byte [eax + 0x90], 1
cmp byte [eax + 0x4b], 0
je 0x10011c0d
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, dword [ebp - 0x25c]
mov esi, eax
push dword [edi + 0x44]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
xorps xmm0, xmm0
lea ecx, [ebp - 0x258]
mov edx, str.StartButtonText
movups xmmword [ebp - 0x228], xmm0
call fcn.100aa8e0
mov eax, dword [ebp - 0x258]
cmp word [eax], 0x24
jne 0x10011b7b
lea ecx, [eax + 2]
mov edx, str.Start
call fcn.100a4f10
push 0xc20
lea ecx, [ebp - 0x228]
push ecx
push 0xffffffffffffffff
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [ebp - 0x220]
mov ecx, dword [0x10158ae8]
add eax, 0xe
add eax, ecx
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x21c]
cmp eax, ecx
jge 0x10011bb4
mov dword [edi + 0x2c], ecx
mov eax, ecx
add eax, 0xa
push esi
mov dword [edi + 0x2c], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x258]
add edx, 0xfffffff0
mov dword [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10011f17
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10011f17
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov esi, dword [esi + 0x40]
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x10011a38
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 2
cmp word [ebp - 0x218], 0
je 0x10011c66
lea eax, [ebp - 0x224]
push eax
push 1
push 1
lea edx, [ebp - 0x268]
lea ecx, [ebp - 0x218]
call fcn.100af920
mov ecx, dword [ebp - 0x25c]
add esp, 0xc
mov dword [ecx + 0x30], eax
mov eax, ecx
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x10011cc1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, eax
call fcn.100b0ea0
cmp eax, 0x78
jge 0x10011c89
mov edx, 0x6f
jmp 0x10011ca4
cmp eax, 0x90
jge 0x10011c97
mov edx, 0x70
jmp 0x10011ca4
xor edx, edx
cmp eax, 0xa8
setge dl
add edx, 0x71
mov ecx, dword [0x1014be3c]
push 1
push 1
call fcn.100b00e0
mov ecx, dword [ebp - 0x25c]
add esp, 8
mov dword [ecx + 0x30], eax
mov ecx, eax
lea eax, [ebp - 0x240]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x224]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x238]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp - 0x22c]
mov dword [ecx + 0x38], eax
cmp edx, dword [ebp - 0x220]
jne 0x10011de4
cmp dword [ebp - 0x23c], 0xa
jl 0x10011dc5
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x414e4d
jne 0x10011dc5
mov eax, dword [ebp - 0x22c]
mov eax, dword [eax + 4]
and eax, 0xffffff
cmp eax, 0x42544e
jne 0x10011dc5
mov eax, dword [ebp - 0x22c]
movzx eax, byte [eax + 0xa]
mov dword [ecx + 0x5c], eax
cmp eax, dword [ebp - 0x238]
jle 0x10011d5a
mov eax, dword [ebp - 0x238]
mov dword [ecx + 0x5c], eax
test eax, eax
jle 0x10011dc5
imul eax, dword [ebp - 0x23c]
lea ecx, [ebp - 0x224]
push ecx
push eax
mov dword [ebp - 0x258], eax
call fcn.100126e0
mov ecx, dword [ebp - 0x258]
lea eax, [ecx*4]
mov ecx, dword [ebp - 0x25c]
push eax
push dword [ecx + 0x38]
push dword [ebp - 0x224]
call fcn.100d7080
mov edx, dword [ebp - 0x258]
add esp, 0xc
mov ecx, dword [ebp - 0x25c]
lea eax, [edx*4]
mov edx, dword [ebp - 0x224]
add dword [ecx + 0x38], eax
mov eax, dword [ebp - 0x238]
sub eax, dword [ecx + 0x5c]
mov dword [ecx + 0x2c], eax
cmp edx, dword [ebp - 0x220]
jne 0x10011de4
mov eax, 0x55555556
imul dword [ecx + 0x2c]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ecx + 0x2c], eax
jmp 0x10011ed4
mov eax, dword [edx + 8]
mov edx, 1
and eax, 0xff
cmp eax, 1
cmovb eax, edx
mov edx, dword [ebp - 0x238]
dec edx
cmp eax, edx
cmovle edx, eax
mov eax, dword [ecx + 0x2c]
mov dword [ebp - 0x264], edx
cdq
idiv dword [ebp - 0x264]
mov edx, dword [ebp - 0x224]
mov dword [ecx + 0x2c], eax
mov eax, dword [edx + 0xc]
and eax, 0xff
mov dword [ebp - 0x258], eax
mov dword [ecx + 0x60], eax
mov eax, dword [ebp - 0x264]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x258], eax
jle 0x10011e4b
mov dword [ecx + 0x60], eax
mov dword [ebp - 0x258], eax
mov eax, dword [edx + 0x10]
and eax, 0xff
cmp eax, dword [ebp - 0x260]
push dword [ebp - 0x264]
cmovg eax, dword [ebp - 0x260]
mov dword [ecx + 0x64], eax
mov eax, dword [edx + 0x14]
mov edx, dword [ebp - 0x258]
and eax, 0xff
cmp eax, dword [ebp - 0x260]
mov dword [ebp - 0x258], 6
cmovg eax, dword [ebp - 0x260]
mov dword [ecx + 0x68], eax
mov eax, dword [edi]
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], edx
mov eax, dword [edi]
mov ecx, dword [ecx + 0x64]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.10011720
push dword [ebp - 0x264]
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x224]
push eax
push edi
call fcn.10011720
mov edx, dword [ebp - 0x224]
test edx, edx
je 0x10011f11
mov ecx, dword [ebp - 0x21c]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10011f07
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10011fa3
push ecx
push edx
call fcn.100d4917
add esp, 8
mov edi, dword [ebp - 0x25c]
mov eax, dword [edi + 0x28]
test eax, eax
jle 0x10011f88
xorps xmm0, xmm0
mov dword [ebp - 0x254], 0x28
movups xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x250], eax
mov eax, dword [edi + 0x2c]
neg eax
movq qword [ebp - 0x230], xmm0
push 0
movups xmmword [ebp - 0x240], xmm0
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], 0x200001
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
mov esi, eax
lea eax, [edi + 0x3c]
push 0
push eax
push 0
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push esi
mov dword [edi + 0x34], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret
call fcn.100dca69
int3