Function at 0x1005f320
Capabilities:
Check os version
Find taskbar

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x24], edi
lea esi, [edi + 0x14]
cmp dword [0x1019e748], edi
jne 0x1005f35f
mov ebx, 1
mov dword [0x1019e748], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1005f35f
cmp al, 6
jb 0x1005f35f
mov dword [0x1019e74c], ebx
jmp 0x1005f367
cmp dword [0x1019e74c], edi
je 0x1005f375
push edi
call sym.EncDec.dll_IsSystemUser
test eax, eax
jne 0x1005f63e
call fcn.1004fd70
test eax, eax
jne 0x1005f63e
lea eax, [esp + 0x20]
push eax
push str.RemoveDeadTrayIconDisable
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], edi
call fcn.10031670
cmp dword [esp + 0x20], edi
jne 0x1005f63e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 1
push str.MyBlankCursor
push 1
push edi
call sym.EncDec.dll_MyCreateMutex
mov ebp, eax
mov dword [esp + 0x10], ebp
cmp ebp, edi
je 0x1005f3ed
call ebx
cmp eax, 0xb7
jne 0x1005f3ed
lea ecx, [esp + 0x10]
push ecx
call fcn.100673f0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x1005f3af
mov ebp, dword [esp + 0x10]
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push edi
push str.Shell_TrayWnd
push edi
push edi
call esi
cmp eax, edi
je 0x1005f634
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
mov ebx, eax
mov dword [esp + 0x2c], ebx
cmp ebx, edi
jne 0x1005f42b
lea edx, [esp + 0x10]
push edx
call fcn.100673f0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.Button
push edi
push ebx
call esi
mov esi, eax
cmp esi, edi
je 0x1005f484
lea eax, [esp + 0x1c]
push eax
push str.EnableAutoTray
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov edx, closesocket
call fcn.10031670
test al, al
jne 0x1005f462
mov dword [esp + 0x1c], 1
jmp 0x1005f468
cmp dword [esp + 0x1c], edi
je 0x1005f484
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x201
push esi
call edi
push 0
push 0
push 0x202
push esi
call edi
lea ecx, [esp + 0x38]
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x1005f419
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call edi
push 0x32
mov esi, eax
call edi
mov ebx, eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test ebp, ebp
je 0x1005f4c4
push 1
call fcn.1005f150
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
sub eax, edi
cdq
idiv ebx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], 0
test eax, eax
jl 0x1005f565
mov eax, dword [esp + 0x40]
sub eax, ecx
cdq
idiv esi
mov dword [esp + 0x1c], 0
mov ebx, eax
xor ebp, ebp
test ebx, ebx
jl 0x1005f53d
xor ebx, ebx
jmp 0x1005f506
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
add edx, edi
push edx
lea eax, [ebx + ecx]
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
sub eax, ecx
cdq
idiv esi
mov edi, dword [esp + 0x3c]
add ebx, esi
mov dword [esp + 0x28], ebx
inc ebp
mov ebx, eax
cmp ebp, ebx
jle 0x1005f502
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
add dword [esp + 0x1c], edx
sub eax, edi
cdq
idiv dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, eax
jle 0x1005f4f8
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
sub eax, edi
cdq
idiv ebx
mov dword [esp + 0x14], 0
test eax, eax
jl 0x1005f5fe
mov eax, dword [esp + 0x40]
sub eax, ecx
cdq
idiv esi
mov dword [esp + 0x1c], 0
mov ebx, eax
xor ebp, ebp
test ebx, ebx
jl 0x1005f5da
xor ebx, ebx
jmp 0x1005f5a4
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add eax, edi
push eax
add ecx, ebx
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
sub eax, ecx
cdq
idiv esi
mov edi, dword [esp + 0x3c]
add ebx, esi
mov dword [esp + 0x28], ebx
inc ebp
mov ebx, eax
cmp ebp, ebx
jle 0x1005f5a0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
add dword [esp + 0x1c], edx
sub eax, edi
cdq
idiv dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, eax
jle 0x1005f591
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esp + 0x24], 0
je 0x1005f620
test ebp, ebp
je 0x1005f620
push 0
call fcn.1005f150
mov edx, dword [esp + 0x2c]
push 0x105
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_RedrawWindow]
lea eax, [esp + 0x10]
push eax
call fcn.100673f0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret