Function at 0x401bf3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push esi
push edi
mov dword [ebp - 4], 0
mov byte [0x4161d1], 0xcd
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
push 0x200
push dword [0x416146]
push 0x3b5
push dword [0x4161e3]
call fcn.004136a0
lea eax, [ebp - 8]
push eax
push 8
push 0
push dword [0x416146]
push 0x80000001
call fcn.004137f8
cmp eax, 0
jne 0x401d93
push 0x200
push dword [0x416146]
push 0x3b6
push dword [0x4161e3]
call fcn.004136a0
lea eax, [ebp - 0xc]
push eax
push 8
push 0
push dword [0x416146]
push dword [ebp - 8]
call fcn.004137f8
cmp eax, 0
jne 0x401d8b
push 0x200
push dword [0x416146]
push 0x137
push dword [0x4161e3]
call fcn.004136a0
lea eax, [ebp - 0x10]
push eax
push 8
push 0
push dword [0x416146]
push dword [ebp - 0xc]
call fcn.004137f8
cmp eax, 0
jne 0x401d83
push 0x200
push dword [0x416146]
push 0x3b7
push dword [0x4161e3]
call fcn.004136a0
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push dword [0x416146]
push dword [ebp - 0x10]
call fcn.004137f8
cmp eax, 0
jne 0x401d7b
mov dword [ebp - 0x34], 4
push 0x200
push dword [0x416146]
push 0x3b8
push dword [0x4161e3]
call fcn.004136a0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [0x416146]
push dword [ebp - 0x14]
call fcn.0041384e
mov dword [ebp - 0x34], 4
push 0x200
push dword [0x416146]
push 0x3b9
push dword [0x4161e3]
call fcn.004136a0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push dword [0x416146]
push dword [ebp - 0x14]
call fcn.0041384e
push dword [ebp - 0x14]
call sub.ADVAPI32.dll_RegCloseKey
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_RegCloseKey
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
push 0x40
push 0
push 0
push 1
push 0xaa
push dword [0x4161e3]
call fcn.00413675
mov dword [0x4161c6], eax
push eax
push 0
push 0x80
push dword [ebp + 8]
call fcn.0041349c
push 0x40
push 0
push 0
push 1
push 0xab
push dword [0x4161e3]
call fcn.00413675
mov dword [0x4161ca], eax
push eax
push 1
push 0x80
push dword [ebp + 8]
call fcn.0041349c
mov dword [ebp - 0x60], 0x2c
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 8]
call sub.USER32.dll_GetWindowPlacement
mov dword [ebp - 0x60], 0x2c
xor eax, eax
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
sub esi, dword [ebp - 0x44]
sub edi, dword [ebp - 0x40]
add esi, ebx
add edi, ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edi
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 8]
call sub.USER32.dll_SetWindowPlacement
push 0x28
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x4162dc], eax
push eax
call fcn.00401ec5
test eax, eax
je 0x401ebc
push 0
push dword [ebp + 8]
call fcn.00401f7b
test eax, eax
je 0x401ebc
mov byte [0x4161d1], 0xe6
push 0
push 0
push 0
push 0
call fcn.0041316b
test eax, eax
je 0x401ebc
mov dword [0x4161e7], eax
mov byte [0x4161d1], 0xe5
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 0x408cae
push 0x200
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
je 0x401ebc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4