Function at 0x41f1dc
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, ecx
mov dword [0x547b14], 1
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
mov eax, dword [esi + 0x87a0]
test eax, eax
je 0x41f233
push dword [eax + 4]
call edi
test eax, eax
je 0x41f21b
mov eax, dword [esi + 0x87a0]
push 0
push 0
push 0x10
push dword [eax + 4]
call ebx
mov ecx, dword [esi + 0x87a0]
test ecx, ecx
je 0x41f233
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi + 0x87a0], 0
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push 0x2710
push 0x422074
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x510bfc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [esi + 0x86d0], 1
push dword [esi + 0x86c0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x878c]
test eax, eax
je 0x41f2b4
push dword [eax + 4]
call edi
test eax, eax
je 0x41f29c
mov eax, dword [esi + 0x878c]
push 0
push 0
push 0x10
push dword [eax + 4]
call ebx
mov ecx, dword [esi + 0x878c]
test ecx, ecx
je 0x41f2b4
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi + 0x878c], 0
mov eax, dword [0x548408]
cmp dword [eax - 8], 0
je 0x41f2dd
xor eax, eax
push eax
push eax
push eax
push 0x465279
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esi + 0x86ec]
call fcn.00431e8d
mov eax, dword [esi + 0x87b0]
test eax, eax
je 0x41f30c
push dword [eax + 4]
call edi
test eax, eax
je 0x41f30c
mov eax, dword [esi + 0x87b0]
push 0
push 0
push 0x10
push dword [eax + 4]
call ebx
mov ecx, dword [esi + 0x87b0]
test ecx, ecx
je 0x41f324
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi + 0x87b0], 0
lea eax, [esi + 0x16c]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [esi + 0x628]
test eax, eax
je 0x41f346
push eax
push 0
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x52c]
xor edi, edi
sub eax, dword [esi + 0x528]
test eax, 0xfffffffc
jle 0x41f38c
mov eax, dword [esi + 0x528]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x41f378
push ecx
call fcn.004b93c0
mov eax, dword [esi + 0x528]
and dword [eax + edi*4], 0
mov eax, dword [esi + 0x52c]
inc edi
sub eax, dword [esi + 0x528]
sar eax, 2
cmp edi, eax
jl 0x41f35b
push dword [esi + 0x538]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41f3aa
push 0
push 0
push 0x10
push dword [esi + 0x538]
call ebx
lea ecx, [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x8734]
call fcn.004482c1
mov ecx, esi
call fcn.00447765
mov ecx, dword [0x547d50]
test ecx, ecx
je 0x41f3de
mov eax, dword [ecx]
push 1
call dword [eax]
xor ebx, ebx
mov dword [0x547d50], ebx
jmp 0x41f3e0
xor ebx, ebx
mov ecx, dword [0x547d4c]
test ecx, ecx
je 0x41f3f6
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x547d4c], ebx
mov ecx, dword [0x547d48]
test ecx, ecx
je 0x41f40c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x547d48], ebx
call fcn.004b4f5e
mov eax, dword [0x548ed4]
mov ecx, 0x548ed4
push dword [eax + 4]
call fcn.00469520
mov eax, dword [0x548ed4]
mov edi, 0x547af0
mov dword [eax + 4], eax
mov eax, dword [0x548ed4]
mov dword [eax], eax
mov eax, dword [0x548ed4]
mov dword [eax + 8], eax
mov dword [0x548ed8], ebx
cmp dword [edi], 0
je 0x41f452
push dword [edi]
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [edi], ebx
add edi, 4
cmp edi, 0x547b0c
jl 0x41f445
mov ecx, dword [esi + 0x873c]
test ecx, ecx
je 0x41f475
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x873c], ebx
mov edi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41f48e
push 0x64
call ebx
add edi, 0x64
cmp edi, 0xbb8
ja 0x41f497
cmp dword [0x548238], 0
jne 0x41f47f
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0x1f4
call ebx
push dword [esi + 0x87a4]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x5478e4], 0
xor eax, eax
pop edi
pop esi
pop ebx
ret 0x10