Function at 0x3efa8d4
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff630
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x9d0], edx
mov dword [ebp - 0x9cc], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x3efab6f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
push 0
push 0x3efab80
call sub.user32.dll_FindWindowW
push 0
push 0x3efab9c
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x3efabb8
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x3efabcc
push 0
push eax
call sub.user32.dll_FindWindowExW
mov edi, eax
test edi, edi
je 0x3efab49
lea eax, [ebp - 0x14]
push eax
push edi
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x38
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 4
push 0x3000
push 0x1000
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
push 0
push 0
push 0x418
push edi
call sub.user32.dll_SendMessageW
dec eax
test eax, eax
jl 0x3efab20
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x14
call fcn.03cb5b68
lea eax, [ebp - 0x18]
push eax
push 0x14
lea eax, [ebp - 0x30]
push eax
push ebx
push esi
call sub.kernel32.dll_WriteProcessMemory
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0x417
push edi
call sub.user32.dll_SendMessageW
lea eax, [ebp - 0x18]
push eax
push 0x14
lea eax, [ebp - 0x30]
push eax
push ebx
push esi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [ebp - 0x20], 0xffffffff
je 0x3efab14
inc dword [ebp - 0x10]
push 0
mov eax, dword [ebp - 0x2c]
push eax
push 0x40c
push edi
call sub.user32.dll_SendMessageW
test al, al
jne 0x3efaad6
mov eax, ebx
add eax, 0x14
push eax
mov eax, dword [ebp - 0x2c]
push eax
push 0x44b
push edi
call sub.user32.dll_SendMessageW
lea eax, [ebp - 0x18]
push eax
push 0x802
lea eax, [ebp - 0x832]
push eax
mov eax, ebx
add eax, 0x14
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9cc], edx
movzx eax, byte [0x3efabec]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x9cc]
lea edx, [ebp - 0x832]
mov ecx, 0x401
call fcn.03cb8e3c
mov eax, dword [ebp - 0x9cc]
xor ecx, ecx
mov edx, 0x3efabfc
call fcn.03cda388
lea eax, [ebp - 0x9d0]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.03cb915c
mov eax, dword [ebp - 0x9d0]
mov edx, 0x3efac0c
call fcn.03cb9124
jne 0x3efab14
lea eax, [ebp - 4]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x3efac20
call fcn.03cb936c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.03cb915c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.03cb8f94
mov eax, dword [ebp - 8]
jmp 0x3efab14
mov eax, ebx
add eax, 0x14
push eax
mov eax, dword [ebp - 0x2c]
push eax
push 0x44b
push edi
call sub.user32.dll_SendMessageW
lea eax, [ebp - 0x18]
push eax
push 0x802
lea eax, [ebp - 0x832]
push eax
mov eax, ebx
add eax, 0x14
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9cc], edx
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x3efa99c
push 0x8000
push 0
push ebx
push esi
call sub.kernel32.dll_VirtualFreeEx
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x3efab49
mov eax, dword [ebp - 8]
mov edx, 0x3efac30
call fcn.03cb8230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3efab76
lea eax, [ebp - 0x9d0]
mov edx, 2
call fcn.03cb7eb0
lea eax, [ebp - 4]
call fcn.03cb7e50
ret