Function at 0x491100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65302c
mov eax, dword fs:[0]
push eax
sub esp, 0x7f4
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x464]
test ecx, ecx
je 0x49114d
mov edx, dword [ebx + 0x468]
test edx, edx
je 0x49114d
mov eax, dword [ecx]
push 0
push edx
push ecx
call dword [eax + 0x28]
push 1
mov ecx, ebx
call fcn.00490420
push 0
call fcn.0056160b
add esp, 4
lea eax, [ebp - 0x7c4]
push 0x3b8
push 0
push eax
call fcn.005e0dd0
mov eax, dword [ebx + 0x248]
add esp, 0xc
mov dword [ebp - 0x7c4], eax
lea eax, [ebp - 0x7c8]
mov dword [ebp - 0x7c8], 0x3bc
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push dword [ebx + 0x248]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
je 0x491205
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x491205
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x7cc]
push eax
push 0x6621ac
push 1
push 0
push 0x6621cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x491205
mov eax, dword [ebp - 0x7cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x7cc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x7cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [ebp - 0x7fc]
call fcn.00471300
lea esi, [ebx + 0x59c]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x800], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
lea edi, [ebx + 0x56c]
mov eax, dword [ebx + 0x564]
lea ecx, [ebp - 0x7fc]
push edi
mov dword [ebp - 0x7cc], eax
call fcn.0049f5a0
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x7f0]
call fcn.0049f5a0
add edi, 0x18
lea ecx, [ebp - 0x7e4]
push edi
call fcn.0049f5a0
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x7d8]
call fcn.0049f5a0
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x7ec], 0
je 0x4912cb
cmp dword [ebp - 0x7f8], 0
mov byte [ebx + 0x5be], 1
jne 0x4912ad
push 0x6aea98
lea ecx, [ebp - 0x7fc]
call fcn.0049f520
mov edx, dword [ebp - 0x7fc]
mov ecx, dword [ebp - 0x7f0]
push 0
call fcn.0042f0f0
mov esi, dword [ebp - 0x7cc]
add esp, 4
jmp 0x491336
mov esi, dword [ebp - 0x7cc]
test esi, esi
jne 0x49133a
mov byte [ebx + 0x5be], 1
cmp dword [ebp - 0x7d4], esi
je 0x491336
cmp dword [ebp - 0x7e0], esi
jne 0x4912fc
push 0x6aea98
lea ecx, [ebp - 0x7e4]
call fcn.0049f520
lea ecx, [ebp - 0x408]
call fcn.004e3040
lea eax, [ebp - 0x7d8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x20]
call fcn.0049f5a0
push 0
lea ecx, [ebp - 0x408]
call fcn.0054e4aa
lea ecx, [ebp - 0x408]
mov byte [ebp - 4], 0
call fcn.004e3150
test esi, esi
je 0x491369
cmp byte [ebx + 0x4de], 0
jne 0x491369
mov ecx, ebx
mov byte [ebx + 0x4dd], 1
mov byte [ebx + 0x5be], 1
call fcn.00491c00
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 0x98]
jmp 0x4913f9
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 0x98]
push 0xffffffffffffffff
push str.shutdown
lea ecx, [ebx + 4]
call fcn.00554534
mov esi, eax
test esi, esi
je 0x4913e0
mov edx, dword [esi]
mov ecx, esi
push 0x6ae180
call dword [edx + 4]
test eax, eax
je 0x4913e0
mov ecx, esi
call fcn.00555733
test eax, eax
je 0x4913f9
cmp byte [ebx + 0x4de], 0
jne 0x4913f9
lea ecx, [ebp - 0x3c8]
call fcn.004e0a00
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c8]
mov al, byte [ebx + 0x5b8]
push 0
mov byte [ebp - 0x18], al
call fcn.0054e4aa
lea ecx, [ebp - 0x3c8]
call fcn.004e0ab0
jmp 0x4913f9
push 0xffffffffffffffff
push str.shutdown
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
push dword [ebp - 0x7d8]
call fcn.00545b61
add esp, 4
push dword [ebp - 0x7e4]
call fcn.00545b61
add esp, 4
push dword [ebp - 0x7f0]
call fcn.00545b61
add esp, 4
push dword [ebp - 0x7fc]
call fcn.00545b61
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret