Function at 0x4013c0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
push edi
push 0x408128
push 0x68
push esi
mov dword [0x40aa04], esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
mov eax, dword [0x40aa04]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [0x40aa04]
push edi
push ecx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x408124
push str.Microsoft.bin
mov ebx, eax
call fcn.00401879
mov edi, eax
add esp, 8
test edi, edi
je 0x401432
push edi
push 1
push ebx
push ebp
call fcn.0040174f
push edi
call fcn.004016f9
add esp, 0x14
push 0x38
call fcn.004016eb
xor edi, edi
add esp, 4
cmp eax, edi
je 0x40144b
mov ecx, eax
call fcn.00401000
jmp 0x40144d
xor eax, eax
push 0x67
push esi
mov dword [0x40aa08], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edi
mov dword [0x40a9a0], eax
mov dword [esp + 0x30], 3
mov dword [esp + 0x34], 0x401270
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call dword [sym.imp.GDI32.dll_GetStockObject]
lea edx, [esp + 0x2c]
mov dword [esp + 0x4c], edi
push edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], str.tooltips_class32
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x401612
push edi
push esi
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x40aa18
push str.tooltips_class32
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push edi
push eax
mov dword [0x40aa00], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x40aa00]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.004012c0
mov ecx, dword [0x40aa08]
push edi
push edi
call dword [ecx]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
add esp, 8
test eax, eax
jne 0x40154b
push edi
push edi
lea edx, [esp + 0x18]
push edi
push edx
call esi
test eax, eax
je 0x40153a
lea eax, [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
call ebp
mov edx, dword [0x40aa08]
push edi
push edi
call dword [edx]
add esp, 8
test eax, eax
je 0x40151e
mov eax, dword [esp + 0x60]
push eax
call fcn.004016e0
mov ecx, dword [0x40aa08]
push eax
call dword [ecx + 0x28]
add esp, 8
mov byte [0x40aa10], 1
push edi
push edi
push edi
push 0x401320
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
lea edx, [esp + 0x18]
push edi
push edx
mov dword [0x40aa14], eax
call esi
test eax, eax
je 0x4015a8
lea eax, [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
call ebp
push edi
push edi
lea edx, [esp + 0x18]
push edi
push edx
call esi
test eax, eax
jne 0x40158c
mov al, byte [0x40aa10]
test al, al
je 0x4015d0
mov eax, dword [0x40aa14]
cmp eax, edi
je 0x4015d0
push 0xffffffffffffffff
push eax
mov byte [0x40aa10], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x40aa14], edi
mov eax, dword [0x40aa08]
call dword [eax + 0x1c]
mov esi, dword [0x40aa08]
cmp esi, edi
je 0x4015f2
mov ecx, esi
call fcn.00401120
push esi
call fcn.0040164a
add esp, 4
push str.Microsoft.bin
mov dword [0x40aa08], edi
call fcn.00401620
add esp, 4
push 0x40a9a8
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0x10