Function at 0x429b40
Capabilities:
Create thread
Inspect section memory permissions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43c988
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
sub esp, 0x5c
mov dword [eax], 0
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, dword [esi + 4]
push 0xfffffffffffffff0
push ecx
call edi
mov ecx, eax
or ecx, 0x80000
cmp eax, ecx
je 0x429b8f
mov edx, dword [esi + 4]
push ecx
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x444020]
push 0x80
lea ecx, [esp + 0x8c]
mov dword [esp + 0x8c], eax
call fcn.00405370
mov eax, dword [esp + 0x88]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esp + 0x88]
mov ecx, dword [0x444024]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x429bf3
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x429bf3
mov eax, dword [esp + 0x88]
add eax, 0xfffffff4
push eax
call fcn.0043a372
add esp, 4
mov dword [esi + 0x18d0], 0
mov ecx, dword [esi + 4]
push 0xfffffffffffffff0
push ecx
call edi
mov ebp, dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
and ebx, 0x40000000
je 0x429c1d
mov edx, dword [esi + 4]
push edx
call ebp
jmp 0x429c29
mov eax, dword [esi + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x34]
push ecx
push edx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test ebx, ebx
jne 0x429ca0
test edi, edi
je 0x429c5b
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x429c59
test eax, 0x20000000
je 0x429c5b
xor edi, edi
lea eax, [esp + 0x24]
push 0
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test edi, edi
jne 0x429c92
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jmp 0x429ccd
lea edx, [esp + 0x14]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x429ccd
mov eax, dword [esi + 4]
push eax
call ebp
mov ebp, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x24]
mov ebx, eax
push ecx
push ebx
call ebp
lea edx, [esp + 0x14]
push edx
push edi
call ebp
lea eax, [esp + 0x14]
push 2
push eax
push ebx
push edi
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ebp, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x34]
sub ebp, edx
mov edx, dword [esp + 0x14]
sub ebx, edi
lea eax, [ecx + edx]
cdq
sub eax, edx
mov ecx, eax
mov eax, ebx
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
sar ecx, 1
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0x20]
add eax, edx
cdq
sub eax, edx
mov edi, eax
mov eax, ebp
cdq
sub eax, edx
sar edi, 1
sar eax, 1
sub edi, eax
mov eax, dword [esp + 0x24]
cmp ecx, eax
jl 0x429d2b
mov eax, dword [esp + 0x2c]
lea edx, [ecx + ebx]
cmp edx, eax
jle 0x429d2d
sub eax, ebx
mov ecx, eax
mov eax, dword [esp + 0x28]
cmp edi, eax
jl 0x429d42
mov eax, dword [esp + 0x30]
lea edx, [edi + ebp]
cmp edx, eax
jle 0x429d44
sub eax, ebp
mov edi, eax
mov eax, dword [esi + 4]
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esi + 0x18d4], 0
mov ebx, dword [0x445278]
push 0xc
call edi
push eax
push 0xb
call edi
mov ebp, dword [sym.imp.USER32.dll_LoadImageA]
push eax
push 1
push 0x80
push ebx
call ebp
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 1
push 0x80
push ecx
call ebx
mov edx, dword [0x445278]
push 0
push 0x32
mov dword [esp + 0x90], edx
call edi
push eax
push 0x31
call edi
push eax
mov eax, dword [esp + 0x94]
push 1
push 0x80
push eax
call ebp
mov ecx, dword [esi + 4]
xor ebp, ebp
push eax
push ebp
push 0x80
push ecx
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x445260]
mov edi, eax
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4452f8]
push edi
call fcn.0042ca40
mov edi, eax
mov eax, dword [0x445260]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, ebp
je 0x429e1f
lea ecx, [esi + 0x120]
mov dword [esp + 0x88], ecx
jmp 0x429e26
mov dword [esp + 0x88], ebp
lea edx, [esp + 0x88]
lea ecx, [edi + 4]
push edx
call fcn.0042c9d0
cmp esi, ebp
je 0x429e49
lea eax, [esi + 0x124]
mov dword [esp + 0x88], eax
jmp 0x429e50
mov dword [esp + 0x88], ebp
lea ecx, [esp + 0x88]
push ecx
lea ecx, [edi + 0x10]
call fcn.0042c9d0
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x429e82
lea edx, [esp + 0x14]
lea ecx, [esi + 0x128]
push edx
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], 4
call fcn.0042ca80
push 0xd8e9ec
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x18b0], eax
mov ecx, esi
mov dword [esi + 0x1694], ebp
mov dword [esi + 0x18b4], ebp
mov dword [esi + 0x16b0], 0x445620
call fcn.0042b7e0
mov eax, dword [esi + 4]
push 0x3e8
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea edi, [esi + 0x2a4]
push eax
mov ecx, edi
call fcn.00406c40
cmp eax, ebp
je 0x429f7c
lea ebp, [edi + 4]
push 0
push 0
push 0x2000
mov ecx, ebp
call fcn.0042caf0
push 0x1b
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0042cb50
push ecx
lea ecx, [edi + 0x24]
mov eax, esp
mov dword [eax], 0xec
call fcn.00402330
push ecx
lea ecx, [edi + 0x28]
mov eax, esp
mov dword [eax], 0xed
call fcn.00402330
push ecx
lea ecx, [edi + 0x2c]
mov eax, esp
mov dword [eax], 0xee
call fcn.00402330
push ecx
lea ecx, [edi + 0x30]
mov eax, esp
mov dword [eax], 0xef
call fcn.00402330
push ecx
lea ecx, [edi + 0x34]
mov eax, esp
mov dword [eax], 0xf0
call fcn.00402330
push ecx
lea ecx, [edi + 0x38]
mov eax, esp
mov dword [eax], 0xf1
call fcn.00402330
push ecx
lea ecx, [edi + 0x3c]
mov eax, esp
mov dword [eax], 0xf2
call fcn.00402330
mov ecx, edi
call fcn.0042a230
add edi, 0x40
push eax
mov ecx, edi
call fcn.0042ce40
mov ecx, dword [esi + 0x2a8]
lea ebp, [esi + 0x2a8]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, eax
or ecx, 0x2000000
cmp eax, ecx
je 0x429faa
mov edx, dword [ebp]
push ecx
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [ebp]
push 0x50
push 0
push 0x1331
push eax
call ebx
mov ecx, dword [ebp]
push 0x17ffff
push 0
push 0x1329
push ecx
call ebx
lea edx, [esp + 0x34]
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x38]
push edx
push eax
rep stosd dword es:[edi], eax
mov eax, dword [ebp]
push 0x1307
push eax
mov dword [esp + 0x44], 1
mov dword [esp + 0x50], 0x444eb8
call ebx
mov edx, dword [ebp]
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], 1
push ecx
push 1
push 0x1307
push edx
mov dword [esp + 0x50], 0x444eac
call ebx
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp]
lea eax, [esp + 0x50]
push eax
push 2
mov edi, 1
push 0x1307
push ecx
mov dword [esp + 0x60], edi
mov dword [esp + 0x6c], 0x444ea0
call ebx
push 0x444e94
push 3
mov ecx, ebp
call fcn.0042cb80
xor ebp, ebp
mov ecx, esi
push ebp
call fcn.0042a4f0
mov dword [esp + 0x10], ebp
push 0x4442d0
push 0x20
push ebp
push ebp
push ebp
push 0x86
push ebp
push edi
push ebp
push 0x384
push ebp
push ebp
push ebp
push 0xffffffffffffffe4
lea ecx, [esp + 0x48]
mov dword [esp + 0xac], ebp
call fcn.004045f0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], ebp
push eax
lea ecx, [esi + 0x144]
call fcn.0042ccf0
lea ebx, [esi + 0x24c]
push ebp
push 0x40
mov ecx, ebx
call fcn.0041bed0
push str.http:__www.360safe.com_
mov ecx, ebx
call fcn.0042cc40
mov edx, dword [esi + 4]
push 0x3fc
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov ecx, ebx
call fcn.0041bf00
mov dword [esi + 0x294], 0x8000
mov dword [esi + 0x16b8], ebp
mov dword [esi + 0x16b4], ebp
call fcn.00420230
neg eax
sbb eax, eax
push ecx
and eax, 0x24
mov ecx, esp
add eax, 0xe3
mov dword [esp + 0x8c], esp
and eax, 0xffff
mov dword [ecx], eax
lea ecx, [esi + 0x18a8]
call fcn.0042cda0
call fcn.00420230
neg eax
sbb eax, eax
push ecx
and eax, 0x22
mov ecx, esp
add eax, 0xe5
mov dword [esp + 0x8c], esp
and eax, 0xffff
mov dword [ecx], eax
lea ecx, [esi + 0x18ac]
call fcn.0042cda0
mov eax, dword [esi + 0x16b0]
cmp dword [eax + 0x6c], ebp
jne 0x42a169
mov ecx, esi
call fcn.0042a7b0
push str.TaskbarCreated
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ecx, dword [esi + 0x16b0]
mov dword [esi + 0x18a4], eax
mov eax, dword [ecx + 0x54]
lea ecx, [esi + 0x2e8]
cmp eax, edi
sete dl
push edx
call fcn.00436a40
mov ecx, esi
call fcn.0042b400
mov ecx, 0x445300
call fcn.0040a300
push esi
push ebp
push 0x4291f0
mov dword [esi + 0x1684], ebp
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esi + 0x18b8]
push eax
push ebp
push esi
push 0x42af50
push ebp
push ebp
call ebx
push ebp
push ebp
push esi
push 0x42c320
push ebp
push ebp
mov dword [esi + 0x18bc], eax
mov byte [esi + 0x18d8], 1
call ebx
mov ecx, dword [esi + 4]
push ebp
push 0xa4cb80
push 4
push ecx
mov dword [esi + 0x18d4], eax
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.00402310
mov ecx, dword [esp + 0x6c]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x68
ret 0x10